@bermudi/pi-delegate 0.1.13 → 0.1.15

package/ticket-format.ts

@@ -10,9 +10,10 @@ import {
   relativeTouchedSummary,
   findTouchedOverlaps,
   formatTouchedOverlapWarning,
+  resumeMarker,
 } from "./format.ts";
 import { renderOutputForPoll } from "./spill.ts";
-import { getOutputSpillTail } from "./config.ts";
+import { getOutputSpillTail, getOutputSpillThreshold } from "./config.ts";
 import type {
   AsyncTicket,
   DelegateDetails,
@@ -93,12 +94,12 @@ export function formatInFlightTaskLine(p: TaskProgress): string {
   if (p.tokens > 0) parts.push(`${fmtTokens(p.tokens)} tokens`);
   const age = getActivityAge(p.lastActivityAt);
   if (age) parts.push(age);
-  return `⏳ ${p.agent}${formatTaskId(p.id)} · ${parts.join(" · ")}`;
+  return `⏳ ${p.agent}${resumeMarker(p)}${formatTaskId(p.id)} · ${parts.join(" · ")}`;
 }
 
 /** Queued-task line shared by poll snapshots and cancel previews. */
 export function formatQueuedTaskLine(p: TaskProgress): string {
-  return `○ ${p.agent}${formatTaskId(p.id)} · waiting…`;
+  return `○ ${p.agent}${resumeMarker(p)}${formatTaskId(p.id)} · waiting…`;
 }
 
 function appendTouchedMeta(
@@ -120,23 +121,28 @@ function formatSettledPollLines(
   const meta = taskMetaBase(result);
   appendTouchedMeta(meta, result, task);
   const tailChars = getOutputSpillTail(ticket.config);
+  const thresholdChars = getOutputSpillThreshold(ticket.config);
   if (!failed) {
     const lines = [
-      `✓ ${result.agent}${formatTaskId(result.id)} · ${meta.join(" · ")}`,
+      `✓ ${result.agent}${resumeMarker(result)}${formatTaskId(result.id)} · ${meta.join(" · ")}`,
     ];
     if (result.output && result.output !== "(no output)") {
-      lines.push(renderOutputForPoll(result.output, { tailChars }));
+      lines.push(
+        renderOutputForPoll(result.output, { tailChars, thresholdChars }),
+      );
     }
     return lines;
   }
   const errorText = result.error ?? "unknown error";
   const lines = [
-    `✗ ${result.agent}${formatTaskId(result.id)} · ${errorText} · ${meta.join(" · ")}`,
+    `✗ ${result.agent}${resumeMarker(result)}${formatTaskId(result.id)} · ${errorText} · ${meta.join(" · ")}`,
   ];
   if (result.sessionFile)
     lines.push(`  session: ${shortenPath(result.sessionFile)}`);
   if (result.output && result.output !== "(no output)") {
-    lines.push(renderOutputForPoll(result.output, { tailChars }));
+    lines.push(
+      renderOutputForPoll(result.output, { tailChars, thresholdChars }),
+    );
   }
   return lines;
 }
@@ -268,9 +274,9 @@ export function formatCancelPreview(ticket: AsyncTicket): string {
 
   for (const p of ticket.progress) {
     if (p.status === "done") {
-      lines.push(`✓ ${p.agent}${formatTaskId(p.id)} · completed`);
+      lines.push(`✓ ${p.agent}${resumeMarker(p)}${formatTaskId(p.id)} · completed`);
     } else if (p.status === "failed") {
-      lines.push(`✗ ${p.agent}${formatTaskId(p.id)} · ${p.error ?? "failed"}`);
+      lines.push(`✗ ${p.agent}${resumeMarker(p)}${formatTaskId(p.id)} · ${p.error ?? "failed"}`);
     } else if (p.status === "running") {
       lines.push(formatInFlightTaskLine(p));
     } else {

package/tickets.ts

@@ -11,6 +11,7 @@ import {
   fmtDuration,
   formatCompletedTask,
   formatTaskId,
+  resumeMarker,
   trunc,
   findTouchedOverlaps,
   formatTouchedOverlapWarning,
@@ -94,8 +95,13 @@ export const ticketRegistry = new TicketRegistry();
 
 /** Generate a short human-copyable identifier for an async ticket. */
 export function generateTicketId(): string {
-  // 8-char alphanumeric, no lookalikes
-  return Math.random().toString(36).slice(2, 10);
+  // Retry on the extremely unlikely collision rather than allowing Map.set()
+  // in dispatch to replace a still-retained ticket.
+  let id: string;
+  do {
+    id = Math.random().toString(36).slice(2, 10);
+  } while (!id || ticketRegistry.has(id));
+  return id;
 }
 
 /** Remove completed tickets after their retention TTL. Running tickets have no
@@ -220,13 +226,19 @@ export function resolveFinalTicketStatus(
 export function formatCompletedTicket(
   ticket: AsyncTicket,
 ): AgentToolResult<DelegateDetails> {
+  // Shutdown can make a ticket terminal while its workers are still unwinding.
+  // Do not freeze that partial projection: late TaskResults must appear in a
+  // later poll once the worker-settled barrier has resolved. Tickets created
+  // before this marker existed (including simple fixtures) are already safe to
+  // memoize because only live async dispatches explicitly set it false.
+  const canMemoize = ticket.workersSettled !== false;
+  if (canMemoize && ticket.formattedResult) return ticket.formattedResult;
+
   const parts: string[] = [];
   const succeeded = ticket.results.filter(
     (r) => r && !("error" in r && r.error),
   ).length;
-  const elapsedTotal = ticket.completedAt
-    ? ticket.completedAt - ticket.created
-    : 0;
+  const elapsedTotal = (ticket.completedAt ?? Date.now()) - ticket.created;
   // Surface the overall ticket status so a failed/cancelled batch is not
   // mistaken for success. "done" tickets keep the original header; others
   // get an explicit status tag up front.
@@ -257,7 +269,7 @@ export function formatCompletedTicket(
     const t = ticket.resolved[i]!;
     if (!r) {
       parts.push(
-        `=== ${t.agentName}${formatTaskId(t.id)}: ${trunc(t.prompt || "", 80)} ===`,
+        `=== ${t.agentName}${resumeMarker(ticket.progress[i]!)}${formatTaskId(t.id)}: ${trunc(t.prompt || "", 80)} ===`,
       );
       parts.push(`[${pendingLabelFor(i)}]`);
       continue;
@@ -280,7 +292,7 @@ export function formatCompletedTicket(
     );
   }
 
-  return {
+  const formatted: AgentToolResult<DelegateDetails> = {
     content: [{ type: "text", text: parts.join("\n\n") }],
     details: {
       tasks: ticket.tasks,
@@ -297,10 +309,13 @@ export function formatCompletedTicket(
       // the human sees which ticket they polled, even in the rich tree path.
       ticketId: ticket.id,
       status: ticket.status,
+      elapsedMs: elapsedTotal,
       overlapWarning: overlapWarning || undefined,
       dispatchWarning: ticket.dispatchWarning,
     },
   };
+  if (canMemoize) ticket.formattedResult = formatted;
+  return formatted;
 }
 
 // ── Waiter helpers ─────────────────────────────────────────────────────────
@@ -309,6 +324,7 @@ function pendingResultPlaceholder(task: ResolvedTask | undefined): TaskResult {
   return {
     id: task?.id,
     agent: task?.agentName ?? "unknown",
+    resumedFrom: task?.resumeFromDisplay,
     output: "",
     durationMs: 0,
     tokens: 0,
@@ -340,6 +356,7 @@ function buildWaitDetails(ticket: AsyncTicket): DelegateDetails {
     parentModel: ticket.parentModelId,
     ticketId: ticket.id,
     status: ticket.status,
+    elapsedMs: (ticket.completedAt ?? Date.now()) - ticket.created,
     overlapWarning: overlapWarning || undefined,
     dispatchWarning: ticket.dispatchWarning,
   };
@@ -427,6 +444,9 @@ function settleWaiter(
   if (w.settled) return;
   w.settled = true;
   w.clearDeadline?.();
+  w.clearDeadline = undefined;
+  w.removeAbortListener?.();
+  w.removeAbortListener = undefined;
   w.resolve(result);
 }
 
@@ -573,6 +593,7 @@ export function deliverTicketResults(
           ...formatted.details,
           ticketId: ticket.id,
           status: ticket.status,
+          crossLeafDelivery: crossLeaf,
         },
       },
       crossLeaf
@@ -626,6 +647,7 @@ export function handlePoll(
         // (friction #2). The LLM-facing content still names the ticket id too.
         ticketId: ticket.id,
         status: ticket.status,
+        elapsedMs: Date.now() - ticket.created,
         overlapWarning: snapshot.overlapWarning || undefined,
         dispatchWarning: ticket.dispatchWarning,
       },
@@ -747,13 +769,13 @@ export function handleWait(
     };
 
     if (signal) {
-      signal.addEventListener(
-        "abort",
-        () => {
-          abortWaiter(waiter, ticket);
-        },
-        { once: true },
-      );
+      const onAbort = () => {
+        abortWaiter(waiter, ticket);
+      };
+      signal.addEventListener("abort", onAbort, { once: true });
+      waiter.removeAbortListener = () => {
+        signal.removeEventListener("abort", onAbort);
+      };
     }
 
     if (

package/tools.ts

@@ -35,10 +35,11 @@ const PROVIDER_TOOLS: Readonly<Record<string, readonly string[]>> = {
 };
 
 export function availableToolNames(modelProvider?: string): string[] {
-  return [
-    ...Object.keys(TOOL_FACTORIES),
-    ...(modelProvider ? (PROVIDER_TOOLS[modelProvider] ?? []) : []),
-  ];
+  const providerTools =
+    modelProvider && Object.hasOwn(PROVIDER_TOOLS, modelProvider)
+      ? PROVIDER_TOOLS[modelProvider]
+      : undefined;
+  return [...Object.keys(TOOL_FACTORIES), ...(providerTools ?? [])];
 }
 
 /** Expand tool-group shorthands (`*`, `ro`) into concrete tool lists.

package/types.ts

@@ -70,6 +70,7 @@ export interface TicketWaiter {
   resolve: (result: AgentToolResult<DelegateDetails>) => void;
   reject: (reason: unknown) => void;
   clearDeadline?: () => void;
+  removeAbortListener?: () => void;
   settled: boolean;
 }
 
@@ -112,6 +113,10 @@ export interface AsyncTicket {
   /** Immutable dispatch-scoped delegate.json snapshot used by async workers and
    *  later result formatting. */
   config?: import("./config.ts").DelegateConfig;
+  /** Memoized terminal projection, populated only after workers settle. Besides
+   * avoiding repeated work, this keeps repeated poll/wait calls from creating
+   * duplicate output spill files without freezing a shutdown-time partial result. */
+  formattedResult?: AgentToolResult<DelegateDetails>;
 }
 
 /** Live parent settings captured when a delegate call starts. The built-in
@@ -143,6 +148,14 @@ export interface ResolvedTask {
   sessionId?: string;
   sessionAction?: SessionAction;
   resumeFrom?: string;
+  /** Display tag (`formatResumeTag`) of the *caller's* `resumeFrom` path, frozen
+   *  once at task resolution. `resumeFrom` itself is later replaced by the
+   *  canonical transcript path for locking/acquisition/quarantine, which can
+   *  have a different basename (symlink alias vs target). Settled-result and
+   *  progress `resumedFrom` tags must read this field — never re-derive from the
+   *  now-canonical `resumeFrom` — so the live and settled rows agree and
+   *  `resumeMarker`'s no-duplication rule holds. */
+  resumeFromDisplay?: string;
   /** Hard wall-clock budget in milliseconds, measured from task start. */
   deadlineMs?: number;
   agentName: string;
@@ -156,10 +169,45 @@ export interface ResolvedTask {
   providerExtensionSources?: string;
 }
 
+export interface FileAttributionPathSignature {
+  /** Absolute component inspected while resolving the pre-execution target. */
+  path: string;
+  /** Filesystem identity. Strings avoid precision loss on platforms whose
+   * inode/device values exceed JavaScript's safe integer range. */
+  dev: string;
+  ino: string;
+  birthtimeMs: number;
+  kind: "directory" | "symlink" | "other";
+  /** Exact link text, present only for symlinks. */
+  symlinkTarget?: string;
+}
+
+export interface FileAttribution {
+  /** Absolute path spelled by the tool call. This remains associated with the
+   * physical snapshot so a later symlink cannot change what the call targeted. */
+  lexicalPath: string;
+  /** Physical target captured synchronously at tool_execution_start. Consumers
+   * must not resolve this path again against the mutable post-execution tree. */
+  preExecutionPhysicalPath?: string;
+  /** Identity/signature chain used to obtain the physical snapshot. It covers
+   * every existing resolved component, including the leaf, plus the exact text
+   * of each followed symlink. In-place mutation preserves the leaf identity;
+   * replacement makes attribution uncertain. */
+  preExecutionPathSignatures?: FileAttributionPathSignature[];
+  /** Which explicit native tool supplied this evidence. */
+  provenance: "edit" | "write";
+  /** Canonicalization was incomplete, ambiguous, or its signature chain changed
+   * after execution. Such evidence is retained conservatively even when its
+   * lexical path is in a disposable workspace. */
+  uncertain: boolean;
+}
+
 export interface ToolActivity {
   id: string;
   name: string;
   args: Record<string, unknown>;
+  /** Structured edit/write attribution captured before execution. */
+  fileAttribution?: FileAttribution;
   result?: {
     content: Array<{ type: string; text?: string }>;
     isError: boolean;
@@ -171,6 +219,8 @@ export interface ToolActivity {
 }
 
 /** Stable machine-readable reason for a task failure.
+ *  - `cancelled`: the caller or async-ticket controller requested cancellation.
+ *    This must not be inferred from provider error text such as "Aborted".
  *  - `stalled`: inactivity watchdog fired; the prompt was cooperatively aborted.
  *  - `model_error`: the failure is attributable to the resolved model/provider
  *    (account usage limit, quota exhausted, auth lost) — not transient for that
@@ -179,12 +229,16 @@ export interface ToolActivity {
  *  - `deadline_exceeded`: the task's `deadlineMs` wall-clock budget expired
  *    (measured from when the task left the concurrency queue). The prompt was
  *    cooperatively aborted; completed side effects are not rolled back. */
-export type TaskFailureKind = "stalled" | "model_error" | "deadline_exceeded";
+export type TaskFailureKind =
+  "cancelled" | "stalled" | "model_error" | "deadline_exceeded";
 
 export interface TaskProgress {
   id?: string;
   index: number;
   agent: string;
+  /** Short tag (via `formatResumeTag`) of the transcript this task continued
+   *  via `resumeFrom`, if any. Lets renderers mark the row as a revival. */
+  resumedFrom?: string;
   task: string;
   status: "pending" | "running" | "done" | "failed";
   durationMs: number;
@@ -192,6 +246,8 @@ export interface TaskProgress {
   toolUses: number;
   error?: string;
   failureKind?: TaskFailureKind;
+  /** Terminal lower-bound result returned after quiescence abandonment. */
+  incomplete?: "quiescence_abandoned";
   model?: string;
   lastActivityAt?: number;
   activities: ToolActivity[];
@@ -208,6 +264,10 @@ export interface DelegateDetails {
   ticketId?: string;
   /** Terminal/live ticket status when this result comes from an async ticket. */
   status?: AsyncTicket["status"];
+  /** Actual batch wall time for stable rendering outside the live tool context. */
+  elapsedMs?: number;
+  /** Async result arrived on a different session-tree leaf than it was spawned on. */
+  crossLeafDelivery?: boolean;
   /** Global overlap warning derived from result.attributedFiles, surfaced in both
    *  the textual content and the custom TUI. */
   overlapWarning?: string;
@@ -218,23 +278,32 @@ export interface DelegateDetails {
 export interface TaskResult {
   id?: string;
   agent: string;
+  /** Short tag (via `formatResumeTag`) of the transcript this task continued
+   *  via `resumeFrom`, if any. Lets settled-result renderers mark the row as
+   *  a revival — mirrors `TaskProgress.resumedFrom`. */
+  resumedFrom?: string;
   output: string;
   error?: string;
   /** Stable machine-readable failure reason; error remains human-facing. */
   failureKind?: TaskFailureKind;
+  /** The task returned while its quarantined AgentSession could still run.
+   * Output, file evidence, token usage, and cost are lower bounds rather than
+   * final accounting. */
+  incomplete?: "quiescence_abandoned";
   durationMs: number;
   /** Display token count for the task, derived from the compaction-inclusive
    *  session-stat delta. This matches `usage.totalTokens`; the usage object
    *  additionally preserves the provider breakdown and cost. */
   tokens: number;
-  /** Full provider Usage consumed by this task, including compacted-away
-   *  history. Always present (`emptyUsage()` on no-op/early-failure paths) so a
-   *  sync delegate call can fold subagent spend into the parent's session
-   *  total. Aggregate `cost.total` is accurate; the per-component cost fields
-   *  stay 0 because `getSessionStats()` exposes only the aggregate cost — and
-   *  Pi sums `cost.total` for nested usage anyway. */
+  /** Full provider Usage observed for this task, including compacted-away
+   *  history. Always present (`emptyUsage()` on no-op/early-failure paths).
+   *  When `incomplete` is absent, sync delegate can fold it into the parent and
+   *  aggregate `cost.total` is final. For an abandoned task it is only a lower
+   *  bound and dispatch omits top-level nested usage. Per-component cost fields
+   *  stay 0 because `getSessionStats()` exposes only aggregate cost. */
   usage: Usage;
-  /** Scratch results are excluded from shared-file conflict detection and never resumable. */
+  /** Scratch is never resumable. Its certain internal writes are excluded from
+   * shared-file conflict detection; external or uncertain evidence is retained. */
   workspace?: WorkspaceMode;
   sessionFile?: string;
   /** All files the subagent is known to have touched, including bash mutations
@@ -245,6 +314,9 @@ export interface TaskResult {
    *  for overlap detection so concurrent tasks in the same repo do not
    *  fabricate false conflicts from shared git snapshots. */
   attributedFiles?: string[];
+  /** Provenance-bearing evidence behind attributedFiles. Optional for legacy
+   * callers/tests that only provide the projected string list. */
+  fileAttributions?: FileAttribution[];
   /** Git-native proposal/reconciliation outcome for workspace:"isolated". */
   integration?: TaskIntegration;
 }
@@ -259,6 +331,15 @@ export type TaskIntegrationStatus =
 interface TaskIntegrationFiles {
   proposedFiles: string[];
   appliedFiles: string[];
+  /** Cleanup is separate from the integration outcome: a proposal can remain
+   * successfully applied even when a disposable worktree cannot be removed. */
+  cleanupIssue?: {
+    status: "deferred" | "failed";
+    reason: string;
+    /** Stable recovery marker. It may disappear after a deferred cleanup
+     * succeeds, but is retained when cleanup fails. */
+    recoveryPath?: string;
+  };
 }
 
 interface TaskIntegrationWithoutRecovery extends TaskIntegrationFiles {
@@ -278,6 +359,9 @@ export type TaskIntegration =
     })
   | (TaskIntegrationWithoutRecovery & {
       status: "discarded";
+      /** Reporting-only issues encountered while classifying a failed task's
+       * paths. They do not turn the discarded proposal into an apply failure. */
+      classificationIssues?: Array<{ path: string; reason: string }>;
     })
   | (TaskIntegrationFiles & {
       status: "conflict";

package/utils.ts

@@ -58,8 +58,129 @@ export function extractTextFromPartialResult(
 
 /** Strip ANSI escape sequences from text. */
 export function stripAnsi(text: string): string {
-  // eslint-disable-next-line no-control-regex
-  return text.replace(/\x1b\[[0-9;]*[A-Za-z]/g, "");
+  // A scanner keeps malformed, unterminated control strings linear-time.
+  // Regexes with lazy "anything until ST" branches become quadratic on input
+  // containing many unterminated OSC/DCS introducers.
+  let clean = "";
+  for (let index = 0; index < text.length;) {
+    const code = text.charCodeAt(index);
+
+    if (code === 0x1b) {
+      const next = text.charCodeAt(index + 1);
+      if (next === 0x5d) {
+        index = skipControlString(text, index + 2, true);
+        continue;
+      }
+      if (next === 0x50 || next === 0x58 || next === 0x5e || next === 0x5f) {
+        index = skipControlString(text, index + 2, false);
+        continue;
+      }
+      if (next === 0x5b) {
+        index = skipCsi(text, index + 2);
+        continue;
+      }
+      if (next === 0x5c) {
+        // Preserve a boundary for a standalone 7-bit ST just as for C1 ST,
+        // so removing it cannot concatenate attacker-controlled words.
+        clean += " ";
+        index += 2;
+        continue;
+      }
+
+      // Generic ESC sequence: intermediates followed by one final byte.
+      index++;
+      while (index < text.length) {
+        const value = text.charCodeAt(index);
+        if (value < 0x20 || value > 0x2f) break;
+        index++;
+      }
+      if (index < text.length) {
+        const final = text.charCodeAt(index);
+        if (final >= 0x30 && final <= 0x7e) index++;
+      }
+      continue;
+    }
+
+    if (code === 0x9d) {
+      index = skipControlString(text, index + 1, true);
+      continue;
+    }
+    if (code === 0x90 || code === 0x98 || code === 0x9e || code === 0x9f) {
+      index = skipControlString(text, index + 1, false);
+      continue;
+    }
+    if (code === 0x9b) {
+      index = skipCsi(text, index + 1);
+      continue;
+    }
+    if (code === 0x9c) {
+      // Preserve a boundary for a stray terminator so sanitization cannot
+      // concatenate attacker-controlled words around the removed control.
+      clean += " ";
+      index++;
+      continue;
+    }
+
+    clean += text[index]!;
+    index++;
+  }
+  return clean;
+}
+
+function skipControlString(
+  text: string,
+  index: number,
+  bellTerminates: boolean,
+): number {
+  while (index < text.length) {
+    const code = text.charCodeAt(index);
+    if ((bellTerminates && code === 0x07) || code === 0x9c) return index + 1;
+    if (
+      code === 0x1b &&
+      index + 1 < text.length &&
+      text.charCodeAt(index + 1) === 0x5c
+    ) {
+      return index + 2;
+    }
+    index++;
+  }
+  return index;
+}
+
+function skipCsi(text: string, index: number): number {
+  while (index < text.length) {
+    const code = text.charCodeAt(index);
+    // A malformed CSI must not consume diagnostic layout while searching for
+    // a final byte. Leave common layout controls for the outer sanitizer.
+    if (code === 0x09 || code === 0x0a || code === 0x0d) return index;
+    index++;
+    if (code >= 0x40 && code <= 0x7e) break;
+  }
+  return index;
+}
+
+/**
+ * Remove terminal controls from untrusted multiline text while preserving its
+ * line and ordinary whitespace structure for markdown/plain-text rendering.
+ */
+export function sanitizeTerminalText(text: string): string {
+  return (
+    stripAnsi(text)
+      .replace(/\r\n?|\u2028|\u2029/g, "\n")
+      .replace(/[\u0000-\u0009\u000b-\u001f\u007f-\u009f]+/g, " ")
+      // Invisible bidi marks, embeddings/overrides, and isolates can reorder
+      // attacker-controlled terminal text without changing its stored spelling.
+      .replace(/[\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, "")
+  );
+}
+
+/**
+ * Flatten untrusted text for one terminal row. ANSI sequences and terminal
+ * controls are removed before whitespace is normalized, so callers can safely
+ * truncate and store the result without preserving a partial escape sequence.
+ */
+export function sanitizeTerminalLine(text: string): string {
+  return sanitizeTerminalText(text).replace(/\s+/g, " ").trim();
 }
 
 /** Resolve carriage-return progress bars to their final line state. */