@mjasnikovs/pi-task 0.17.14 → 0.17.16

package/dist/task/auto-commit.d.ts

@@ -11,7 +11,18 @@ export interface CommitResult {
     committed: boolean;
     /** Short, human-readable reason when committed === false. */
     reason?: string;
+    /** Set when the commit needed a fallback (e.g. self-supplied identity). */
+    note?: string;
 }
+/**
+ * Does this git stderr describe a missing author identity? Seen live (mx5 run 4):
+ * the headless docker container has no HOME gitconfig, so EVERY per-task commit
+ * failed "Author identity unknown" — which silently disabled enforce and every
+ * commit-based differential guard for the whole run.
+ */
+export declare function isIdentityFailure(stderr: string): boolean;
+/** Fallback identity for environments with no git config (headless containers). */
+export declare const FALLBACK_IDENTITY_ARGS: readonly ["-c", "user.name=pi-task", "-c", "user.email=pi-task@local"];
 export declare function git(cwd: string, args: string[], signal: AbortSignal | undefined, spawnFn?: SpawnFn): Promise<{
     stdout: string;
     stderr: string;

package/dist/task/auto-commit.js

@@ -7,6 +7,22 @@
  * reason and let the loop continue (the task already succeeded).
  */
 import { runChildDefault } from '../shared/child-process.js';
+/**
+ * Does this git stderr describe a missing author identity? Seen live (mx5 run 4):
+ * the headless docker container has no HOME gitconfig, so EVERY per-task commit
+ * failed "Author identity unknown" — which silently disabled enforce and every
+ * commit-based differential guard for the whole run.
+ */
+export function isIdentityFailure(stderr) {
+    return /identity unknown|unable to auto-detect email|user\.(name|email)/i.test(stderr);
+}
+/** Fallback identity for environments with no git config (headless containers). */
+export const FALLBACK_IDENTITY_ARGS = [
+    '-c',
+    'user.name=pi-task',
+    '-c',
+    'user.email=pi-task@local'
+];
 function firstLine(s) {
     const line = s.split('\n').find(l => l.trim().length > 0);
     return (line ?? s).trim();
@@ -42,11 +58,25 @@ export async function gitCommitAll(cwd, message, signal, spawnFn) {
         return { committed: false, reason: 'cancelled' };
     if (diff.exitCode === 0)
         return { committed: false, reason: 'nothing to commit' };
-    // 4. Commit. A failure here is usually missing user.name/user.email config.
+    // 4. Commit. A failure here is usually missing user.name/user.email config —
+    //    retry once with a self-supplied identity rather than losing the snapshot
+    //    (and with it enforce + every differential guard) for the whole run.
     const commit = await git(cwd, ['commit', '-m', message], signal, spawnFn);
     if (commit.aborted)
         return { committed: false, reason: 'cancelled' };
     if (commit.exitCode !== 0) {
+        if (isIdentityFailure(commit.stderr || commit.stdout)) {
+            const retry = await git(cwd, [...FALLBACK_IDENTITY_ARGS, 'commit', '-m', message], signal, spawnFn);
+            if (retry.aborted)
+                return { committed: false, reason: 'cancelled' };
+            if (retry.exitCode === 0) {
+                return { committed: true, note: 'no git identity configured — used pi-task fallback' };
+            }
+            return {
+                committed: false,
+                reason: `git commit failed: ${firstLine(retry.stderr || retry.stdout)}`
+            };
+        }
         return {
             committed: false,
             reason: `git commit failed: ${firstLine(commit.stderr || commit.stdout)}`

package/dist/task/lint-fix.js

@@ -74,10 +74,17 @@ export function revertGuardViolations(preDirty, stillDirty) {
     return preDirty.filter(f => !stillDirty.has(f));
 }
 const EXCLUDE_TASKS_DIR = ':(exclude).pi-tasks';
+/**
+ * Files differing from HEAD, or null when git itself failed. The distinction is
+ * load-bearing: mx5 run 4 rolled back two GOOD converged fixes because a git
+ * failure after the child read as "[] files still dirty" → every pre-existing work
+ * file looked reverted → false "discarded work". A git error is INCONCLUSIVE, not
+ * evidence of destruction.
+ */
 async function dirtyFiles(deps) {
     const r = await deps.git(['diff', '--name-only', 'HEAD', '--', '.', EXCLUDE_TASKS_DIR]);
     if (r.exitCode !== 0)
-        return [];
+        return null;
     return r.stdout
         .split('\n')
         .map(l => l.trim())
@@ -89,12 +96,24 @@ async function dirtyFiles(deps) {
  */
 export async function runBoundedLintFix(deps) {
     // Snapshot the full working state as a tree object (includes untracked files),
-    // then unstage so the child sees the tree exactly as it was.
-    const preDirty = await dirtyFiles(deps);
-    const preUntracked = (await deps.git(['ls-files', '--others', '--exclude-standard', '--', '.', EXCLUDE_TASKS_DIR])).stdout
-        .split('\n')
-        .map(l => l.trim())
-        .filter(l => l.length > 0);
+    // then unstage so the child sees the tree exactly as it was. A git failure at
+    // snapshot time leaves the guard without a baseline — it then runs vacuously
+    // (nothing to compare) rather than inventing violations.
+    const preDirty = (await dirtyFiles(deps)) ?? [];
+    const preUntrackedRes = await deps.git([
+        'ls-files',
+        '--others',
+        '--exclude-standard',
+        '--',
+        '.',
+        EXCLUDE_TASKS_DIR
+    ]);
+    const preUntracked = preUntrackedRes.exitCode !== 0 ?
+        []
+        : preUntrackedRes.stdout
+            .split('\n')
+            .map(l => l.trim())
+            .filter(l => l.length > 0);
     let snapshot = null;
     const add = await deps.git(['add', '-A']);
     if (add.exitCode === 0) {
@@ -115,15 +134,32 @@ export async function runBoundedLintFix(deps) {
     }
     // REVERT-GUARD: every pre-existing work file must still differ from HEAD, and
     // every pre-existing untracked file must still exist. Trip → restore snapshot.
-    const stillDirty = new Set(await dirtyFiles(deps));
-    const violations = revertGuardViolations(preDirty, stillDirty);
-    for (const f of preUntracked) {
-        const probe = await deps.git(['ls-files', '--others', '--exclude-standard', '--', f]);
-        const gone = probe.stdout.trim().length === 0
-            // ...unless the child legitimately made it tracked-dirty (it edited it).
-            && !stillDirty.has(f);
-        if (gone)
-            violations.push(f);
+    // Every comparison requires git to have actually SUCCEEDED: a git error after
+    // the child is inconclusive (proven live: it flagged the whole untracked file
+    // list as "discarded" while the child had verifiably edited only lint findings)
+    // — then the guard steps aside and the converge check below still decides.
+    const stillDirtyList = await dirtyFiles(deps);
+    let guardNote;
+    const violations = [];
+    if (stillDirtyList === null) {
+        guardNote = 'revert-guard inconclusive (git failed after fix) — converge check decides';
+    }
+    else {
+        const stillDirty = new Set(stillDirtyList);
+        violations.push(...revertGuardViolations(preDirty, stillDirty));
+        for (const f of preUntracked) {
+            const probe = await deps.git(['ls-files', '--others', '--exclude-standard', '--', f]);
+            if (probe.exitCode !== 0) {
+                // git error → unknown, not "gone"; note it once and move on.
+                guardNote ??= 'revert-guard partly inconclusive (git probe failed)';
+                continue;
+            }
+            const gone = probe.stdout.trim().length === 0
+                // ...unless the child legitimately made it tracked-dirty (it edited it).
+                && !stillDirty.has(f);
+            if (gone)
+                violations.push(f);
+        }
     }
     if (violations.length > 0) {
         if (snapshot) {
@@ -142,5 +178,5 @@ export async function runBoundedLintFix(deps) {
     if (!health.ok) {
         return { ok: false, reason: `did not converge: ${health.reason}` };
     }
-    return { ok: true };
+    return { ok: true, reason: guardNote };
 }

package/dist/task/repo-health-check.js

@@ -110,6 +110,11 @@ export function runRepoHealthCheck(cwd, timeoutMs = 600_000) {
         // Tool missing (ENOENT) or killed by timeout → cannot conclude; skip it.
         if (r.error || r.status === null)
             continue;
+        // Exit 127 = "command not found" INSIDE the script chain (e.g. `bun run lint`
+        // before node_modules exists — seen live failing TASK_0001's first verify).
+        // Same environment gap as ENOENT, just surfaced through the runner's shell.
+        if (r.status === 127)
+            continue;
         if (r.status !== 0) {
             return {
                 ok: false,

package/dist/task/task-gates.d.ts

@@ -6,9 +6,11 @@
  * just-finished work:
  *
  *   1. VERIFY — RUN the composed spec's VERIFY block in the real workspace and
- *      judge a PASS/FAIL. A FAIL offers the user a boxed AUTOFIX / ACCEPT / dismiss
- *      picker (the user always decides; AUTOFIX re-runs the implementation turn and
- *      loops back to the gate uncapped).
+ *      judge a PASS/FAIL. On a FAIL a fresh read-only child recommends AUTOFIX or
+ *      ACCEPT: an AUTOFIX recommendation re-runs the implementation turn UNATTENDED
+ *      (no prompt) and loops back to the gate, bounded by MAX_AUTO_AUTOFIX; the user
+ *      is shown the boxed picker only when the recommendation is ACCEPT (blessing the
+ *      artifact as-is) or when that unattended-autofix cap is reached.
  *   2. ENFORCE — hold the committed work to the project's AGENTS.md / CLAUDE.md
  *      rules. Runs in `edit` mode (fix in place) only when the verify gate produced
  *      a genuine clean pass to guard the edits against; otherwise `flag` mode
@@ -166,6 +168,16 @@ export type GateResult = {
     ctx: ExtensionCommandContext;
     reason?: string;
 };
+/**
+ * How many times a verify FAIL may be auto-fixed UNATTENDED (the research
+ * recommended AUTOFIX, so pi re-runs the impl turn without prompting) before the
+ * loop falls back to the human picker. Each AUTOFIX is a full implementation
+ * re-run, so a non-converging loop must not run forever with nobody able to break
+ * it — after this many consecutive auto attempts that still FAIL, the picker is
+ * shown so a person can decide. A recommendation to ACCEPT always shows the picker
+ * regardless of this count (blessing an artifact as-is is a human's call).
+ */
+export declare const MAX_AUTO_AUTOFIX = 3;
 /**
  * Show the boxed two-choice picker after a verify FAIL and return what the user
  * decided. The model-recommended card is placed first so the renderer tints it

package/dist/task/task-gates.js

@@ -1,5 +1,15 @@
 import { resolutionOptions, classifyResolutionAnswer } from './verify-resolution.js';
 import { SessionUI } from '../remote/bridge.js';
+/**
+ * How many times a verify FAIL may be auto-fixed UNATTENDED (the research
+ * recommended AUTOFIX, so pi re-runs the impl turn without prompting) before the
+ * loop falls back to the human picker. Each AUTOFIX is a full implementation
+ * re-run, so a non-converging loop must not run forever with nobody able to break
+ * it — after this many consecutive auto attempts that still FAIL, the picker is
+ * shown so a person can decide. A recommendation to ACCEPT always shows the picker
+ * regardless of this count (blessing an artifact as-is is a human's call).
+ */
+export const MAX_AUTO_AUTOFIX = 3;
 /**
  * Show the boxed two-choice picker after a verify FAIL and return what the user
  * decided. The model-recommended card is placed first so the renderer tints it
@@ -60,10 +70,13 @@ export async function runGatesForTask(ctxIn, deps, p) {
         active.ui.notify(`${p.tag}: verifying "${p.title}"…`, 'info');
         let verified = await deps.verify(active, p.cwd, p.title, p.taskId);
         await rec(verdictLine(verified));
-        // A FAIL no longer dead-stops: offer the boxed AUTOFIX / ACCEPT / dismiss
-        // picker. The USER always decides; AUTOFIX loops straight back to the gate
-        // as many times as they keep choosing it (no attempt cap).
+        // A FAIL no longer dead-stops. When the research recommends AUTOFIX, pi
+        // re-runs the impl turn UNATTENDED (no picker) — the human is consulted only
+        // when the recommendation is ACCEPT (blessing the artifact as-is). The
+        // unattended fix is BOUNDED by MAX_AUTO_AUTOFIX: once that many consecutive
+        // auto attempts still FAIL, the picker returns so a person can break the loop.
         let lintFixAttempted = false;
+        let autoFixCount = 0;
         while (!verified.ok) {
             const failReason = verified.reason ?? 'did not verify';
             // GRADUATED resolution: a repo-health FAIL (pure static findings) gets ONE
@@ -74,7 +87,9 @@ export async function runGatesForTask(ctxIn, deps, p) {
                 lintFixAttempted = true;
                 active.ui.notify(`${p.tag}: static findings on "${p.title}" — attempting bounded lint fix…`, 'info');
                 const fix = await deps.lintFix(active, p.cwd, p.title, failReason);
-                await rec(`lint-fix: ${fix.ok ? 'applied — re-verifying' : `not applied (${fix.reason ?? 'failed'})`}`);
+                await rec(`lint-fix: ${fix.ok ?
+                    `applied${fix.reason ? ` (${fix.reason})` : ''} — re-verifying`
+                    : `not applied (${fix.reason ?? 'failed'})`}`);
                 if (fix.ok) {
                     verified = await deps.verify(active, p.cwd, p.title, p.taskId);
                     await rec(verdictLine(verified));
@@ -85,7 +100,23 @@ export async function runGatesForTask(ctxIn, deps, p) {
                 await deps.recommend(active, p.cwd, p.title, p.taskId, failReason)
                 : { recommend: 'autofix', rationale: failReason };
             await rec(`resolution: recommended ${recOutcome.recommend.toUpperCase()}`);
-            const choice = await askVerifyResolution(active, p.title, failReason, recOutcome);
+            // AUTO-RESOLVE the AUTOFIX path: when the research says the work is
+            // genuinely wrong, re-run the fix WITHOUT prompting the user. The picker is
+            // reserved for the ACCEPT recommendation (the human decides whether to bless
+            // an artifact the gate FAILed) and for the bounded fallback: after
+            // MAX_AUTO_AUTOFIX consecutive unattended attempts that still FAIL, hand
+            // control back so a person can break a non-converging loop.
+            const autoFixNow = recOutcome.recommend === 'autofix' && autoFixCount < MAX_AUTO_AUTOFIX;
+            let choice;
+            if (autoFixNow) {
+                autoFixCount += 1;
+                await rec(`resolution: auto-AUTOFIX (recommended, unattended ${autoFixCount}/${MAX_AUTO_AUTOFIX})`);
+                active.ui.notify(`${p.tag}: verify FAIL on "${p.title}" — auto-fixing (recommended, ${autoFixCount}/${MAX_AUTO_AUTOFIX})…`, 'info');
+                choice = { action: 'autofix' };
+            }
+            else {
+                choice = await askVerifyResolution(active, p.title, failReason, recOutcome);
+            }
             if (choice.action === 'cancel') {
                 await rec('resolution: user dismissed the verify-FAIL picker — paused');
                 return { kind: 'paused', ctx: active, reason: failReason };
@@ -128,12 +159,19 @@ export async function runGatesForTask(ctxIn, deps, p) {
     // so a passing task is durably recorded no matter what enforcement later finds.
     const commit = await deps.commit(p.cwd, `task: ${p.title} (${p.taskId})`);
     if (commit.committed) {
-        await rec('commit: task snapshot committed');
+        await rec(`commit: task snapshot committed${commit.note ? ` (${commit.note})` : ''}`);
         active.ui.notify(`${p.tag}: committed "${p.title}".`, 'info');
     }
     else {
         await rec(`commit: skipped (${commit.reason ?? 'unknown'})`);
-        active.ui.notify(`${p.tag}: not committed (${commit.reason ?? 'unknown'}) — continuing.`, 'warning');
+        // A benign skip ("nothing to commit", auto-commit off) is a warning. A real
+        // git failure is louder: it silently disables enforce AND every commit-based
+        // guard — mx5 run 4 lost all 10 commits (no container git identity) with only
+        // per-task warnings to show for it.
+        const gitFailure = /^git (commit|add) failed/.test(commit.reason ?? '');
+        active.ui.notify(gitFailure ?
+            `${p.tag}: COMMIT FAILED (${commit.reason}) — enforce and revert guards are disabled for this task.`
+            : `${p.tag}: not committed (${commit.reason ?? 'unknown'}) — continuing.`, gitFailure ? 'error' : 'warning');
     }
     // With the task committed, hold its work to AGENTS.md / CLAUDE.md — but as a step
     // INSIDE the validation gate, gated by the verify signal (see GateDeps.enforce).

package/dist/task/verify-resolution.js

@@ -10,8 +10,12 @@
  *   • Accept    — treat the artifact as good, override the gate, and proceed
  *                 (check off + commit) exactly as a PASS would.
  *
- * The user ALWAYS makes the final call. This module only computes which of the
- * two cards is tinted RECOMMENDED, by handing the FAIL reason + the task spec to
+ * The recommendation now also GATES whether the user is prompted at all: an
+ * AUTOFIX recommendation is auto-applied unattended (bounded — see
+ * task-gates.ts MAX_AUTO_AUTOFIX), and the picker is shown only when the
+ * recommendation is ACCEPT (blessing the artifact is a human's call) or when the
+ * unattended-autofix cap is reached. This module only computes which of the two
+ * cards is tinted RECOMMENDED, by handing the FAIL reason + the task spec to
  * a fresh read+bash child of the SAME local model and letting it INVESTIGATE the
  * real workspace: is the FAIL a genuine defect in the work (→ recommend AUTOFIX),
  * or a false alarm / an acceptable artifact the gate misjudged (→ recommend
@@ -23,9 +27,8 @@
  * through the full implementation runner, not this pass.) A read-only research
  * step can never itself change the tree it is judging.
  *
- * The verdict is advisory: a missing/garbled verdict defaults to recommending
- * AUTOFIX, the conservative choice (re-do the work rather than bless it). The
- * picker is shown regardless; this only moves the green tint.
+ * The verdict defaults to AUTOFIX when missing/garbled — the conservative choice
+ * (re-do the work rather than bless it), which is also the auto-applied path.
  */
 import { USER_CANCELLED } from './child-runner.js';
 /** Same read-only contract as the verify pass: observe, never edit. */

package/dist/task/verify-work.js

@@ -281,19 +281,30 @@ export async function runWorkVerification(deps) {
             findings = [];
         }
     }
-    let text;
-    try {
-        text = await deps.runChild(VERIFY_TOOLS, buildVerifyPrompt(deps.spec, findings), deps.signal);
-    }
-    catch (err) {
-        if (err instanceof Error && err.message === USER_CANCELLED)
-            throw err;
-        const msg = err instanceof Error ? err.message : String(err);
-        return { ok: false, reason: `verification pass could not run: ${msg}` };
+    // A child that emits NO verdict never judged the work (budget/context death mid-
+    // investigation — seen live: an 11-minute verify wandered, died verdict-less, and
+    // the resulting FAIL burned a full implementation re-run on an unjudged artifact).
+    // That is a verify-side fault, so retry the VERIFY once before reporting a FAIL.
+    for (let attempt = 1;; attempt++) {
+        let text;
+        try {
+            text = await deps.runChild(VERIFY_TOOLS, buildVerifyPrompt(deps.spec, findings), deps.signal);
+        }
+        catch (err) {
+            if (err instanceof Error && err.message === USER_CANCELLED)
+                throw err;
+            const msg = err instanceof Error ? err.message : String(err);
+            return { ok: false, reason: `verification pass could not run: ${msg}` };
+        }
+        const verdict = parseVerifyVerdict(text);
+        if (verdict.pass)
+            return { ok: true };
+        if (verdict.detail === 'no verdict emitted' && attempt === 1)
+            continue;
+        return {
+            ok: false,
+            reason: `work did not verify: ${verdict.detail}${verdict.detail === 'no verdict emitted' ? ' (after verify retry)' : ''}`
+        };
     }
-    const verdict = parseVerifyVerdict(text);
-    if (verdict.pass)
-        return { ok: true };
-    return { ok: false, reason: `work did not verify: ${verdict.detail}` };
 }
 export { VERIFY_TOOLS };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@mjasnikovs/pi-task",
-    "version": "0.17.14",
+    "version": "0.17.16",
     "description": "Deterministic spec-orchestration for local models, with a bundled real-time remote web view and web/docs/fetch/worker subagent tools.",
     "type": "module",
     "main": "./dist/index.js",