@mjasnikovs/pi-task 0.21.1 → 0.21.3

package/dist/remote/ui-script.js

@@ -337,10 +337,12 @@ export function clientScript(wsUrl) {
       updateStatusDot();
       const promptOpen = activePromptId !== null;
       inputEl.disabled = !connected || promptOpen;
+      // Keep these SHORT: the 1-row textarea clips a long placeholder at phone
+      // width (seen at 390px in a real browser).
       inputEl.placeholder = agentRunning
-        ? 'message the agent \\u2014 steers the live turn'
+        ? 'steers the live turn'
         : (runHolding
-            ? 'task running \\u2014 held for the next task turn'
+            ? 'held for the next task turn'
             : 'type a message\\u2026 (/ for commands)');
       if (agentRunning && !promptOpen) {
         // Send morphs into a red Stop that interrupts the running turn.

package/dist/task/final-gate.d.ts

@@ -44,6 +44,24 @@ export interface FinalGateOutcome {
  * first because it is the richer signal and the more common script). First
  * manifest that exists wins, mirroring discoverHealthCommands. Empty means
  * "nothing to run" — the static half may still gate.
+ *
+ * THE MANIFEST ALLOWLIST BELOW IS NARROW, AND THAT IS A KNOWN, MEASURED GAP: a
+ * C++/CMake project (no package.json) and a package.json whose only script is
+ * `verify` both discover NOTHING here and fall through to the static-only PASS
+ * at the `no integration command found` return below.
+ *
+ * The obvious fix — harvest each task's own `## verified tooling` section, which
+ * DOES record the missing commands — was measured on 2026-07-27 and REFUTED. That
+ * section is model-authored and, despite its name, unverified: on godot-engine it
+ * yields 3 commands that exit 0 and 8 that exit non-zero, six of those for purely
+ * fabricated reasons (recorded without a required argument, pointing at files that
+ * do not exist, naming a test runner the project does not use) — so harvesting it
+ * turns that project's PASS into a FAIL citing "No scene path provided", plus ~15
+ * minutes of hang. Full numbers, the reproduction rig, and why no pre-execution
+ * filter can separate a fabricated command from a real one:
+ * scripts/harvest-verified-tooling-step0.ts. DO NOT re-propose the harvest without
+ * first fixing the PROVENANCE of `## verified tooling` (record cwd + exit code at
+ * authoring time); widening this allowlist tool-by-tool is not the fix either.
  */
 export declare function discoverIntegrationCommands(cwd: string): {
     ecosystem: string | null;

package/dist/task/final-gate.js

@@ -73,6 +73,24 @@ function makeHasTarget(cwd, target) {
  * first because it is the richer signal and the more common script). First
  * manifest that exists wins, mirroring discoverHealthCommands. Empty means
  * "nothing to run" — the static half may still gate.
+ *
+ * THE MANIFEST ALLOWLIST BELOW IS NARROW, AND THAT IS A KNOWN, MEASURED GAP: a
+ * C++/CMake project (no package.json) and a package.json whose only script is
+ * `verify` both discover NOTHING here and fall through to the static-only PASS
+ * at the `no integration command found` return below.
+ *
+ * The obvious fix — harvest each task's own `## verified tooling` section, which
+ * DOES record the missing commands — was measured on 2026-07-27 and REFUTED. That
+ * section is model-authored and, despite its name, unverified: on godot-engine it
+ * yields 3 commands that exit 0 and 8 that exit non-zero, six of those for purely
+ * fabricated reasons (recorded without a required argument, pointing at files that
+ * do not exist, naming a test runner the project does not use) — so harvesting it
+ * turns that project's PASS into a FAIL citing "No scene path provided", plus ~15
+ * minutes of hang. Full numbers, the reproduction rig, and why no pre-execution
+ * filter can separate a fabricated command from a real one:
+ * scripts/harvest-verified-tooling-step0.ts. DO NOT re-propose the harvest without
+ * first fixing the PROVENANCE of `## verified tooling` (record cwd + exit code at
+ * authoring time); widening this allowlist tool-by-tool is not the fix either.
  */
 export function discoverIntegrationCommands(cwd) {
     if (existsSync(path.join(cwd, 'package.json'))) {
@@ -867,6 +885,13 @@ export async function runFinalIntegrationGate(cwd, timeoutMs = 900_000, bootGrac
     const lockCmds = discoverLockfileChecks(cwd);
     const { cmds } = discoverIntegrationCommands(cwd);
     const boot = discoverBootCommand(cwd);
+    // ZERO-DISCOVERY STILL READS AS A PASS HERE, AND THAT IS THE OPEN DEFECT. Nothing was
+    // discovered, so nothing ran, so observabilityGapFailure (attempted === 0 → null) never
+    // fires: "we never checked" is reported identically to "we checked and it was fine". IAR1
+    // shipped this verdict TWICE while carrying open verify-FAIL debt (its .pi-tasks/
+    // TASK_AUTO_0001.md:31 and TASK_AUTO_0002.md:37). The fix is to make this outcome
+    // UNOBSERVED rather than PASS — it needs no new command source and so cannot inject a
+    // fabricated failure, unlike the harvest lever refuted at discoverIntegrationCommands above.
     if (lockCmds.length === 0 && cmds.length === 0 && !boot && failures.length === 0) {
         return withDebts({ ok: true, reason: 'no integration command found (statics passed)' });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@mjasnikovs/pi-task",
-    "version": "0.21.1",
+    "version": "0.21.3",
     "description": "Deterministic task planning and spec-orchestration for local models — crash-safe /task pipelines with verify/enforce gates, a real-time remote web view, and web/docs/fetch/worker subagent tools.",
     "type": "module",
     "main": "./dist/index.js",