@mjasnikovs/pi-task 0.18.29 → 0.18.31

package/dist/config/config.d.ts

@@ -61,6 +61,21 @@ export interface PiTaskConfig {
      * a true hang doesn't cost half an hour of dead time.
      */
     requestTimeoutMs: number;
+    /**
+     * UNATTENDED AUTO-PICK (see task/yolo.ts): wherever pi-task would stop and ask,
+     * take the option it already marks RECOMMENDED, stamp the artifact `(YOLO)` so
+     * an audit can tell a machine decided, and never notify. Lets a local model run
+     * a throwaway/test project end to end with nobody watching.
+     *
+     * Decided PER SITE, before the prompt is built — so the lone prompt notification
+     * (SessionUI.ask) is suppressed structurally, and the existing unattended budgets
+     * (MAX_AUTO_AUTOFIX, MAX_FINAL_GATE_AUTOFIX) still bound the loops they were
+     * written to bound. An auto-pick may cost time, never work: a question with no
+     * recommendation, or one the anti-synthesis guard demoted, is SKIPPED, not
+     * invented.
+     * DEFAULT OFF — this is never the behaviour of a normal, watched run.
+     */
+    yoloMode: boolean;
 }
 /**
  * The command-watchdog timeout choices offered by /task-config, newest-first in

package/dist/config/config.js

@@ -38,7 +38,9 @@ const DEFAULTS = {
     researchCache: true,
     searchProvider: 'exa',
     extensionWhitelist: [],
-    requestTimeoutMs: DEFAULT_REQUEST_TIMEOUT_MS
+    requestTimeoutMs: DEFAULT_REQUEST_TIMEOUT_MS,
+    // OFF: auto-answering is for unattended throwaway runs only.
+    yoloMode: false
 };
 /**
  * A hand-edited config can hold anything; keep only string entries so a stray
@@ -67,6 +69,11 @@ if (!G.loaded) {
             delete parsed.searchProvider;
         parsed.extensionWhitelist = sanitizeExtensionWhitelist(parsed.extensionWhitelist);
         parsed.requestTimeoutMs = sanitizeRequestTimeoutMs(parsed.requestTimeoutMs);
+        // A hand-edited `"yoloMode": "false"` is a truthy string — it must not
+        // silently switch a watched run into unattended auto-pick. Only a real
+        // boolean counts; anything else falls back to the OFF default.
+        if (typeof parsed.yoloMode !== 'boolean')
+            delete parsed.yoloMode;
         G.config = { ...DEFAULTS, ...parsed };
     }
     catch {

package/dist/config/register.js

@@ -107,6 +107,16 @@ const ITEMS = [
             + 'unbounded',
         // Display human labels; the stored config value stays the ms number.
         values: COMMAND_TIMEOUT_OPTIONS.map(o => o.label)
+    },
+    {
+        id: 'yoloMode',
+        label: 'yolo mode',
+        description: 'UNATTENDED: auto-answer every question with the option pi already recommends, '
+            + 'and show no prompts at all — clarify/grill answers, the verify-FAIL picker '
+            + '(auto-ACCEPT, recorded as a yolo debt), and the final-gate picker (autofix '
+            + 'while the budget lasts, then leave the run FAILED). Every auto-pick is stamped '
+            + '(YOLO) in the task file and debt ledger. For THROWAWAY/TEST projects you are '
+            + 'not watching — a real run should decide these itself'
     }
 ];
 /** Human label for the stored command-timeout ms (falls back to the raw ms). */

package/dist/task/accept-debt.d.ts

@@ -11,6 +11,11 @@
  *     created files need a tsconfig registration every spec forbids). Cross-task
  *     contradiction: no unattended re-run can converge, so the gate loop records the
  *     defect and routes to the human picker instead of burning AUTOFIX rounds.
+ *   - 'yolo-accepted'   — YOLO MODE (unattended auto-pick, see yolo.ts) took the
+ *     verify-FAIL picker's terminal option with nobody watching. It is NOT the
+ *     'accepted' class and must never collapse into it: 'accepted' asserts a HUMAN
+ *     weighed this failing artifact and blessed it, which is exactly the assurance
+ *     an auto-pick cannot give. Same re-check treatment, honest provenance.
  *   - 'cross-task-deletion' — the task's work DELETED a sibling task's committed
  *     deliverable (mx5 run 12 PROMPT 2: a fix child deleted TASK_0020's playwright ct
  *     files to green a lint) and the user ACCEPTed the verify-FAIL anyway, so the
@@ -18,7 +23,7 @@
  *     resolved iff the named file is back in the tree (a later task restored it),
  *     otherwise surfaced.
  */
-export type DebtOrigin = 'accepted' | 'enforce-revert' | 'frozen-blocked' | 'cross-task-deletion';
+export type DebtOrigin = 'accepted' | 'enforce-revert' | 'frozen-blocked' | 'cross-task-deletion' | 'yolo-accepted';
 /** One recorded defect: the task, why its VERIFY failed, and how it was recorded. */
 export interface AcceptDebt {
     taskId: string;
@@ -77,6 +82,13 @@ export declare function recordCrossTaskDeletionDebt(cwd: string, taskId: string,
     path: string;
     owner: string;
 }): Promise<void>;
+/**
+ * Record a YOLO-ACCEPTED debt: unattended auto-pick took the verify-FAIL picker's
+ * ACCEPT branch because there was nobody to ask (yolo.ts). Its own origin — and
+ * therefore its own line in the final gate's surfaced report — so a later audit
+ * reading only the artifacts can never read it as "a human decided this".
+ */
+export declare function recordYoloAcceptDebt(cwd: string, taskId: string, reason: string): Promise<void>;
 /**
  * The deleted path a cross-task-deletion debt names (the fixed shape
  * recordCrossTaskDeletionDebt writes). Null on any other reason text — an

package/dist/task/accept-debt.js

@@ -76,7 +76,8 @@ export function parseAcceptDebts(raw) {
             reason: parts[1].trim(),
             ...((origin === 'enforce-revert'
                 || origin === 'frozen-blocked'
-                || origin === 'cross-task-deletion') ?
+                || origin === 'cross-task-deletion'
+                || origin === 'yolo-accepted') ?
                 { origin: origin }
                 : {})
         });
@@ -173,6 +174,19 @@ export async function recordCrossTaskDeletionDebt(cwd, taskId, deletion) {
         origin: 'cross-task-deletion'
     });
 }
+/**
+ * Record a YOLO-ACCEPTED debt: unattended auto-pick took the verify-FAIL picker's
+ * ACCEPT branch because there was nobody to ask (yolo.ts). Its own origin — and
+ * therefore its own line in the final gate's surfaced report — so a later audit
+ * reading only the artifacts can never read it as "a human decided this".
+ */
+export async function recordYoloAcceptDebt(cwd, taskId, reason) {
+    await appendDebt(cwd, {
+        taskId: taskId.trim(),
+        reason: normaliseReason(reason),
+        origin: 'yolo-accepted'
+    });
+}
 /**
  * The deleted path a cross-task-deletion debt names (the fixed shape
  * recordCrossTaskDeletionDebt writes). Null on any other reason text — an
@@ -324,5 +338,8 @@ export function describeDebt(d) {
     if (d.origin === 'cross-task-deletion') {
         return "a sibling task's committed deliverable was DELETED by this task's work and the deletion was accepted (still missing from the tree)";
     }
+    if (d.origin === 'yolo-accepted') {
+        return 'auto-ACCEPTED by YOLO mode despite verify-FAIL (unattended — no human weighed this)';
+    }
     return 'accepted despite verify-FAIL';
 }

package/dist/task/auto-orchestrator.d.ts

@@ -45,6 +45,14 @@ export interface AutoDeps extends GateDeps {
      * Leave-failed / Accept, exactly the pre-autofix behavior.
      */
     finalGateFix?: FinalGateFixFn;
+    /**
+     * Paths currently uncommitted in the working tree (`git status` shape), used to
+     * detect SUB-FIXES a non-converging final-gate autofix left behind (mx5 run 13
+     * PROMPT 4 item 3). Every task is committed by the time the final gate runs, so
+     * anything dirty here is the fix pass's own work. Absent → the stranded-fix
+     * handling is skipped entirely (prior behavior).
+     */
+    pendingChanges?: (cwd: string) => Promise<string[]>;
 }
 /**
  * Expand any @file references in the feature text by appending each referenced

package/dist/task/auto-orchestrator.js

@@ -24,13 +24,14 @@ import { SessionUI, registerBridgeCommand, publishLifecycleNotice } from '../rem
 import { pushNotify } from '../remote/push.js';
 import { startAutoLoader } from './widget.js';
 import { getParentContextWindow, resolveContextUsage } from './context-usage.js';
-import { buildGateDeps } from './gate-deps.js';
+import { buildGateDeps, collectTreeChanges } from './gate-deps.js';
 import { runGatesForTask } from './task-gates.js';
 import { gitUnmergedPaths, gitStashRef } from './auto-commit.js';
 import { runFinalIntegrationGate } from './final-gate.js';
 import { describeDebt } from './accept-debt.js';
-import { classifyFinalGateAnswer, MAX_FINAL_GATE_AUTOFIX, FINAL_LEAVE_LABEL, FINAL_LEAVE_VALUE, FINAL_ACCEPT_LABEL, FINAL_ACCEPT_VALUE, FINAL_AUTOFIX_LABEL, FINAL_AUTOFIX_VALUE } from './final-gate-fix.js';
+import { classifyFinalGateAnswer, MAX_FINAL_GATE_AUTOFIX, FINAL_LEAVE_LABEL, FINAL_LEAVE_VALUE, FINAL_ACCEPT_LABEL, FINAL_ACCEPT_VALUE, FINAL_AUTOFIX_LABEL, FINAL_AUTOFIX_VALUE, STRANDED_FIX_COMMIT, strandedFixNote } from './final-gate-fix.js';
 import { getConfig } from '../config/config.js';
+import { isYoloMode, yoloPickAnswer, yoloFinalGateChoice, YOLO_STAMP } from './yolo.js';
 import { configureResearchRun } from '../workers/research-cache.js';
 import { CONTRACT_EXTRACT_PROMPT, parseContractLines, keepGroundedContracts, appendContracts } from './contracts.js';
 import { reconcileTitleSources } from './decompose-fidelity.js';
@@ -409,6 +410,20 @@ export async function planAuto(ctx, cwd, feature, deps) {
         // the recommended one tinted green; an open question shows the bare text
         // prompt. No verbose "Recommended:" / "press Enter to accept" scaffolding.
         const twoOption = plainSuggested !== undefined && plainAlt !== undefined;
+        // YOLO: take the recommended option (index 0 / the green card) without ever
+        // building the prompt. Clarify has no anti-synthesis channel — it runs before
+        // any research — so the only step-aside here is a question that carries no
+        // recommendation to take; that one is skipped rather than guessed.
+        const yolo = yoloPickAnswer(isYoloMode(), {
+            ...(plainSuggested !== undefined && { suggested: plainSuggested }),
+            ...(plainAlt !== undefined && { alt: plainAlt })
+        });
+        if (yolo !== null) {
+            const auto = yolo.kind === 'answer' ? yolo.answer : `(skipped — ${yolo.note})`;
+            answers.push(`Q${answers.length + 1}: ${plainQ}\n`
+                + `A${answers.length + 1}: ${auto} ${YOLO_STAMP}`);
+            continue;
+        }
         const options = twoOption ?
             [
                 {
@@ -889,7 +904,14 @@ function defaultDeps(ctx, cwd, signal, title) {
         // run-level half of the same verification story.
         finalGate: (cwd2, planText) => getConfig().verifyWork ?
             runFinalIntegrationGate(cwd2, undefined, undefined, undefined, planText)
-            : Promise.resolve({ ok: true, reason: 'disabled' })
+            : Promise.resolve({ ok: true, reason: 'disabled' }),
+        // Uncommitted paths, for the stranded-sub-fix handling around the final-gate
+        // picker (mx5 run 13 PROMPT 4 item 3). Every task is committed by the time
+        // the gate runs, so whatever is dirty here belongs to the fix pass.
+        pendingChanges: async (cwd2) => {
+            const changes = await collectTreeChanges(cwd2, signal);
+            return [...changes.modified, ...changes.added, ...changes.deleted].sort();
+        }
     };
 }
 // ─── Loop ────────────────────────────────────────────────────────────────────
@@ -994,6 +1016,21 @@ export async function runAutoLoop(ctx, cwd, id, deps) {
                     // after MAX_FINAL_GATE_AUTOFIX attempts that still FAIL the
                     // autofix card is withdrawn so the loop cannot run unbounded.
                     let fixAttempts = 0;
+                    // Sub-fixes a non-converging autofix attempt left uncommitted.
+                    // Refreshed after every attempt; drives the picker note and the
+                    // accept-time commit (mx5 run 13 PROMPT 4 item 3).
+                    let stranded = [];
+                    const refreshStranded = async () => {
+                        if (!deps.pendingChanges)
+                            return;
+                        try {
+                            stranded = await deps.pendingChanges(cwd);
+                        }
+                        catch {
+                            // Inconclusive: say nothing rather than claim a clean tree.
+                            stranded = [];
+                        }
+                    };
                     while (!fin.ok) {
                         const canAutofix = deps.finalGateFix !== undefined && fixAttempts < MAX_FINAL_GATE_AUTOFIX;
                         // The picker question shows the debts (the HUMAN weighs them);
@@ -1004,26 +1041,73 @@ export async function runAutoLoop(ctx, cwd, id, deps) {
                             + '(the project’s own test/build/static commands, run unaided).'
                             + (fixAttempts > 0 ?
                                 `\n\nAutofix attempts so far: ${fixAttempts}/${MAX_FINAL_GATE_AUTOFIX}.`
-                                : '');
-                        const answer = await new SessionUI(active).ask({
-                            localTitle: 'Final integration gate failed — how should pi proceed?',
-                            displayQuestion: question,
-                            question,
-                            recommended: FINAL_LEAVE_LABEL,
-                            recommended2: canAutofix ? FINAL_AUTOFIX_LABEL : FINAL_ACCEPT_LABEL,
-                            allowSkip: false,
-                            options: [
-                                { label: FINAL_LEAVE_LABEL, value: FINAL_LEAVE_VALUE },
-                                ...(canAutofix ?
-                                    [{ label: FINAL_AUTOFIX_LABEL, value: FINAL_AUTOFIX_VALUE }]
-                                    : []),
-                                { label: FINAL_ACCEPT_LABEL, value: FINAL_ACCEPT_VALUE }
-                            ]
-                        });
+                                : '')
+                            // Never let a partial repair be invisible at the moment
+                            // the human decides (run 13: a bunfig fix that made
+                            // `bun run test` pass 116/116 was stranded by an ACCEPT).
+                            + strandedFixNote(stranded);
+                        // YOLO: keep autofixing WHILE the card is still offered — the
+                        // loop withdraws it after MAX_FINAL_GATE_AUTOFIX, so the cap
+                        // that bounds a non-converging fix pass still bounds this —
+                        // then LEAVE the run failed. Never 'accept': an unattended run
+                        // that could not green the whole-repo gate has not produced a
+                        // working project, and mx5 run 13 shows what an accepted FAIL
+                        // looks like afterwards (a shipped app that 404s at `/`).
+                        const yoloFinal = yoloFinalGateChoice(isYoloMode(), canAutofix);
+                        if (yoloFinal !== null) {
+                            await recGate(`final-gate: auto-chose ${yoloFinal.action.toUpperCase()} ${YOLO_STAMP}`);
+                        }
+                        const answer = yoloFinal !== null ?
+                            yoloFinal.action === 'autofix' ?
+                                FINAL_AUTOFIX_VALUE
+                                : FINAL_LEAVE_VALUE
+                            : await new SessionUI(active).ask({
+                                localTitle: 'Final integration gate failed — how should pi proceed?',
+                                displayQuestion: question,
+                                question,
+                                recommended: FINAL_LEAVE_LABEL,
+                                recommended2: canAutofix ? FINAL_AUTOFIX_LABEL : FINAL_ACCEPT_LABEL,
+                                allowSkip: false,
+                                options: [
+                                    { label: FINAL_LEAVE_LABEL, value: FINAL_LEAVE_VALUE },
+                                    ...(canAutofix ?
+                                        [
+                                            {
+                                                label: FINAL_AUTOFIX_LABEL,
+                                                value: FINAL_AUTOFIX_VALUE
+                                            }
+                                        ]
+                                        : []),
+                                    { label: FINAL_ACCEPT_LABEL, value: FINAL_ACCEPT_VALUE }
+                                ]
+                            });
                         const choice = classifyFinalGateAnswer(answer);
                         if (choice.action === 'accept') {
                             await recGate('final-gate: FAIL accepted by user');
-                            active.ui.notify(`${id}: final integration gate FAIL accepted by user — completing.`, 'warning');
+                            // STRANDED SUB-FIXES: the run completes here, so anything
+                            // the fix pass repaired but never committed would be lost
+                            // to the next `git checkout` while HEAD keeps the defect
+                            // it fixed. Commit it as its own, named commit — the
+                            // ACCEPT is a decision about the FAILING gate, never an
+                            // instruction to throw away work (mx5 run 13 item 3).
+                            if (stranded.length > 0) {
+                                try {
+                                    const sha = await deps.commit(cwd, STRANDED_FIX_COMMIT(id));
+                                    await recGate(`final-gate: committed ${stranded.length} stranded fix-pass change(s)`
+                                        + `${sha ? ` as ${sha}` : ''} — ${stranded.slice(0, 8).join(', ')}`);
+                                }
+                                catch (err) {
+                                    // Never break the completion path over this — but
+                                    // say so, so the changes are not silently lost.
+                                    await recGate(`final-gate: could NOT commit ${stranded.length} stranded fix-pass `
+                                        + `change(s) (${err instanceof Error ? err.message : String(err)}) — `
+                                        + `they remain UNCOMMITTED in the working tree: ${stranded.slice(0, 8).join(', ')}`);
+                                }
+                            }
+                            active.ui.notify(`${id}: final integration gate FAIL accepted by user — completing.`
+                                + (stranded.length > 0 ?
+                                    ` ${stranded.length} uncommitted fix-pass change(s) committed separately.`
+                                    : ''), 'warning');
                             break;
                         }
                         if (choice.action === 'autofix' && canAutofix) {
@@ -1042,6 +1126,14 @@ export async function runAutoLoop(ctx, cwd, id, deps) {
                                 break;
                             }
                             await recGate(`final-gate: autofix attempt ${fixAttempts} failed — ${fix.reason.slice(0, 200)}`);
+                            // The attempt's edits survive a non-convergence (only a
+                            // guard trip discards). Find out what they are NOW, so
+                            // the next picker shows them and an ACCEPT can commit them.
+                            await refreshStranded();
+                            if (stranded.length > 0) {
+                                await recGate(`final-gate: autofix attempt ${fixAttempts} left ${stranded.length} `
+                                    + `uncommitted change(s) — ${stranded.slice(0, 8).join(', ')}`);
+                            }
                             active.ui.notify(`${id}: final-gate autofix did not converge — ${fix.reason.slice(0, 140)}`, 'warning');
                             // Work from the FRESH gate failure when the fix pass got
                             // as far as re-running the gate; otherwise keep the last.
@@ -1064,9 +1156,22 @@ export async function runAutoLoop(ctx, cwd, id, deps) {
                         }
                         // Leave failed — the dismissal default, unchanged from the
                         // two-option picker (an unavailable autofix demotes here too).
-                        await recGate('final-gate: left failed (user)');
+                        await recGate(yoloFinal !== null ?
+                            `final-gate: left failed — autofix budget spent, nobody to ask ${YOLO_STAMP}`
+                            : 'final-gate: left failed (user)');
+                        // Leaving the run failed hands the working tree back to the
+                        // user, so uncommitted fix-pass edits are theirs to keep or
+                        // drop — but they must be VISIBLE, not discovered later by a
+                        // stray `git status` (mx5 run 13 item 3).
+                        if (stranded.length > 0) {
+                            await recGate(`final-gate: ${stranded.length} uncommitted fix-pass change(s) left in the `
+                                + `working tree — ${stranded.slice(0, 8).join(', ')}`);
+                        }
                         await updateTaskFrontMatter(cwd, id, { state: 'failed' });
-                        announceDone(active, `${id} finished all tasks but FAILED the final integration gate — ${fin.reason.slice(0, 200)} — fix and /task-auto-resume (the gate re-runs).`, 'error');
+                        announceDone(active, `${id} finished all tasks but FAILED the final integration gate — ${fin.reason.slice(0, 200)} — fix and /task-auto-resume (the gate re-runs).`
+                            + (stranded.length > 0 ?
+                                ` NOTE: ${stranded.length} uncommitted fix-pass change(s) are in your working tree (${stranded.slice(0, 4).join(', ')}).`
+                                : ''), 'error');
                         return;
                     }
                 }

package/dist/task/final-gate-fix.d.ts

@@ -58,6 +58,31 @@ export declare function parseFinalFixMarker(text: string): {
     blocked: boolean;
     note?: string;
 };
+/**
+ * STRANDED SUB-FIXES (mx5 run 13, PROMPT 4 item 3).
+ *
+ * A fix attempt that does not converge keeps its edits: they are NOT discarded
+ * (only a guard trip discards), and `deps.commit` runs only on `fix.ok`. So a
+ * partial fix that genuinely repaired something sits in the working tree, uncommitted,
+ * and if the user then ACCEPTs the FAIL the run completes around it — leaving HEAD
+ * broken while the repair is invisible unless someone runs `git status`.
+ *
+ * That is exactly what run 13 shipped: the fix child's bunfig.toml change made
+ * `bun run test` pass 116/116, attempt 1 did not converge overall, the user accepted
+ * the FAIL, and the tree still shows the file modified while HEAD's `bun run test` is
+ * broken. The repair and the breakage were BOTH real; only the repair was discarded
+ * by default.
+ *
+ * The rule: a partial fix is either committed (its own commit, named in the trail) or
+ * explicitly surfaced — never silently stranded.
+ */
+/** Commit subject for partial fixes committed alongside an accepted gate FAIL. */
+export declare const STRANDED_FIX_COMMIT: (runId: string) => string;
+/**
+ * The picker/trail line describing what a non-converging fix pass left behind.
+ * Empty string when the tree is clean — the caller then says nothing at all.
+ */
+export declare function strandedFixNote(paths: string[]): string;
 export interface FinalFixResult {
     /** true → the fix child ran AND the re-run gate passed. */
     ok: boolean;

package/dist/task/final-gate-fix.js

@@ -161,6 +161,39 @@ export function parseFinalFixMarker(text) {
     }
     return { blocked: false, note: last[2].trim() || undefined };
 }
+/**
+ * STRANDED SUB-FIXES (mx5 run 13, PROMPT 4 item 3).
+ *
+ * A fix attempt that does not converge keeps its edits: they are NOT discarded
+ * (only a guard trip discards), and `deps.commit` runs only on `fix.ok`. So a
+ * partial fix that genuinely repaired something sits in the working tree, uncommitted,
+ * and if the user then ACCEPTs the FAIL the run completes around it — leaving HEAD
+ * broken while the repair is invisible unless someone runs `git status`.
+ *
+ * That is exactly what run 13 shipped: the fix child's bunfig.toml change made
+ * `bun run test` pass 116/116, attempt 1 did not converge overall, the user accepted
+ * the FAIL, and the tree still shows the file modified while HEAD's `bun run test` is
+ * broken. The repair and the breakage were BOTH real; only the repair was discarded
+ * by default.
+ *
+ * The rule: a partial fix is either committed (its own commit, named in the trail) or
+ * explicitly surfaced — never silently stranded.
+ */
+/** Commit subject for partial fixes committed alongside an accepted gate FAIL. */
+export const STRANDED_FIX_COMMIT = (runId) => `FINAL GATE PARTIAL FIX (${runId}) — accepted with gate still failing`;
+/**
+ * The picker/trail line describing what a non-converging fix pass left behind.
+ * Empty string when the tree is clean — the caller then says nothing at all.
+ */
+export function strandedFixNote(paths) {
+    if (paths.length === 0)
+        return '';
+    const shown = paths.slice(0, 8).join(', ');
+    return (`\n\nUNCOMMITTED: the fix pass left ${paths.length} change(s) in the working tree `
+        + `(${shown}${paths.length > 8 ? ', …' : ''}). These are NOT in HEAD. Accepting will `
+        + `commit them as their own commit so they are not lost; leaving the run failed keeps `
+        + `them in your working tree.`);
+}
 /**
  * Run one bounded final-gate fix attempt: snapshot discovery → child → write-guard
  * stack (diff capture → frozen-path revert → deletion guard → shrink guard → probe

package/dist/task/foreign-path.d.ts

@@ -0,0 +1,96 @@
+import type { AddedLine } from './probe-gaming.js';
+/** One leaked absolute path found in a committed file. */
+export interface ForeignPathFinding {
+    /** Repo-relative file the leaked path was committed into. */
+    file: string;
+    /** The absolute path exactly as written in the file. */
+    absolute: string;
+    /** The repo-relative path its tail resolves to (the repair target). */
+    repoPath: string;
+    /** The leading segments that are foreign to this host (e.g. `/workspace`). */
+    foreignPrefix: string;
+    /** The verbatim line carrying the leak, trimmed. */
+    line: string;
+}
+/**
+ * Resolve a repo-relative path to the real thing it names, honouring the
+ * extensionless module specifiers config files use (`src/client/api` →
+ * `src/client/api.ts`). Returns the resolved repo-relative path, or null.
+ *
+ * This mirrors how the tools that CONSUME these paths (vite/tsconfig aliases,
+ * bundler resolvers) look them up — without it the mx5 true positive
+ * `/workspace/src/client/api` would be missed, since only `src/client/api.ts` exists.
+ */
+export declare function resolveRepoPath(rel: string, exists: (rel: string) => boolean): string | null;
+/**
+ * Scan a task's added lines for sandbox-leaked absolute paths.
+ *
+ * `existsOnHost` answers for an ABSOLUTE path; `existsInRepo` for a REPO-RELATIVE
+ * one. Both are injected so the detector is pure and unit-testable against a
+ * synthetic tree.
+ *
+ * The tail search strips the FEWEST leading segments that still resolve, so the
+ * finding names the smallest foreign prefix (`/workspace`, not `/workspace/src`)
+ * and the largest repo-relative target — the reading that matches how a mount
+ * actually shadows a tree.
+ */
+export declare function findForeignPaths(lines: AddedLine[], existsOnHost: (abs: string) => boolean, existsInRepo: (rel: string) => boolean): ForeignPathFinding[];
+/**
+ * The repair for one finding: the leaked absolute path rewritten relative to the
+ * FILE that carries it, in the `./`-prefixed form config resolvers expect. A target
+ * in a parent directory keeps its `../` form (already relative, no prefix needed).
+ */
+export declare function relativeRepairFor(finding: ForeignPathFinding): string;
+/**
+ * Apply every finding for ONE file to that file's text, as literal substitutions.
+ * Returns the new text and the substitutions made; `text` is returned untouched
+ * when nothing applied (the caller then writes nothing).
+ *
+ * Deliberately a plain string replacement of a path literal for a path literal: it
+ * cannot reflow, reformat, or restructure the file, so a rewrite that turns out to
+ * be semantically wrong is still trivially reviewable in the diff. A finding whose
+ * absolute string is no longer present (the file moved on) is skipped.
+ */
+export declare function applyForeignPathRepairs(text: string, findings: ForeignPathFinding[]): {
+    text: string;
+    applied: Array<{
+        from: string;
+        to: string;
+    }>;
+};
+/** IO seam for the repair pass; injected so the orchestration is unit-testable. */
+export interface ForeignPathRepairIO {
+    readFile: (rel: string) => Promise<string>;
+    writeFile: (rel: string, text: string) => Promise<void>;
+    /** Does this repo-relative path exist? Used to RE-VALIDATE each repair. */
+    existsInRepo: (rel: string) => boolean;
+}
+export interface ForeignPathRepairResult {
+    /** Human-readable repairs actually written, e.g. `cfg.ts: /workspace/src → ./src`. */
+    repaired: string[];
+    /** Findings left alone — these become the verify finding. */
+    remaining: ForeignPathFinding[];
+}
+/**
+ * Deterministically repair what can be repaired, and hand back the rest.
+ *
+ * Every repair is RE-VALIDATED before it is written: the file-relative form is
+ * resolved back to a repo path and must land on the same real file the finding
+ * named. A repair that does not re-resolve is dropped and its finding stays in
+ * `remaining`, where the verify block will raise it for a human or an AUTOFIX
+ * round. An unreadable or unwritable file does the same. Nothing here can turn a
+ * working path into a broken one — the only edit it makes is swapping a path that
+ * provably does not resolve for one that provably does.
+ */
+export declare function repairForeignPaths(findings: ForeignPathFinding[], io: ForeignPathRepairIO): Promise<ForeignPathRepairResult>;
+/**
+ * Verify-child prompt lines: one per leak, naming the file, the leaked path, and
+ * the real repo path it shadows. Empty findings → empty array (caller emits no
+ * block), matching every other probe's contract.
+ */
+export declare function foreignPathVerifyFindings(findings: ForeignPathFinding[]): string[];
+/**
+ * Render findings as a critique/enforce defect block — the same shape as
+ * skipEscapeDefectText: a numbered list the rewrite must resolve.
+ */
+export declare function foreignPathDefectText(findings: ForeignPathFinding[]): string;