@mjasnikovs/pi-task 0.37.5 → 0.37.7

package/README.md

@@ -9,7 +9,7 @@
 [![npm](https://img.shields.io/npm/v/@mjasnikovs/pi-task?color=cb3837&logo=npm)](https://www.npmjs.com/package/@mjasnikovs/pi-task)
 [![license](https://img.shields.io/badge/license-AGPL--3.0-blue.svg)](./LICENSE)
 [![pi extension](https://img.shields.io/badge/pi-extension-7c3aed)](https://www.npmjs.com/package/@earendil-works/pi-coding-agent)
-[![tests](https://img.shields.io/badge/tests-2077%20passing-3fb950)](#development)
+[![tests](https://img.shields.io/badge/tests-3025%20passing-3fb950)](#development)
 [![types](https://img.shields.io/badge/TypeScript-strict-3178c6?logo=typescript&logoColor=white)](./tsconfig.json)
 
 </div>
@@ -72,7 +72,7 @@ A whole plan — `/task-auto` splits it into an ordered task list and runs each
 | `/task-auto <feature>` | Plan a feature into a task list and run each title through `/task` in order (resumable). |
 | `/task-auto-resume [--unattended]` | Resume the active `/task-auto` run at the next unfinished task. `--unattended` is the boot-hook form: in-flight runs only. |
 | `/task-auto-cancel` | Stop the `/task-auto` loop after the current task (still resumable). |
-| `/task-config` | Toggle pi-task settings in an editor dialog: remote control, compress thinking, auto-commit, verify work, enforce guidelines, project tour, command timeout, stuck reply retry, debug logs, and one `ext:` toggle per installed host extension. |
+| `/task-config` | Toggle pi-task settings in an editor dialog: remote control, compress thinking, auto-commit, verify work, enforce guidelines, project tour, parallel research, research cache, search engine, command timeout, stuck reply retry, yolo mode, debug logs, one `watch:` toggle per live tool, and one `ext:` toggle per installed host extension. |
 | `/remote` | Show the QR code & URLs for the web view (`/remote stop` to stop). Answer grill questions, start tasks, and watch progress from your phone. |
 
 ## The pipeline
@@ -186,6 +186,7 @@ Runs a web search and returns a compact markdown list (title · URL · snippet).
 Fetches a URL, cleans HTML to markdown ([Readability](https://github.com/mozilla/readability) + [Turndown](https://github.com/mixmark-io/turndown)), then hands it to an isolated child that extracts **only** the content answering your `query`. The parent never sees the raw page.
 
 - HTML is cleaned; text formats (plain text, markdown, JSON, XML/feeds, `llms.txt`, …) pass through verbatim. Binary responses — PDFs, images, octet-streams — return a clear error.
+- A GitHub `/blob/` URL is rewritten to `raw.githubusercontent.com` before fetching. The blob page renders the file client-side, so a plain fetch returns the chrome and none of the code.
 - Bodies over 2 MB are rejected.
 - The extraction child runs with `--no-tools` to mitigate visible-text prompt injection.
 
@@ -229,6 +230,8 @@ Run `/task-config` to toggle pi-task's behavior in an editor dialog. Settings pe
 | `PI_REMOTE_PUSH_DEBUG` | remote push | When set (e.g. `1`), logs push delivery and push-service HTTP status. Off by default. |
 | `PI_REMOTE_PUSH_LOG` | remote push | Path for the debug log (defaults to `/tmp/pi-task-push.log`). |
 | `PI_TASK_DEBUG_LOG` | task trail | Overrides the **debug logs** setting for one session: `off`, `events`, or `full`. For reproducing a report without walking someone through `/task-config`. An unrecognised value is ignored, not treated as `off`. |
+| `CHROME_BIN` | verify-work render check | Explicit headless Chrome-family binary. Tried before the Playwright cache and a browser on `PATH`. No browser found ⇒ the render check SKIPs; it never installs one. |
+| `PLAYWRIGHT_BROWSERS_PATH` | verify-work render check | Where to look for a cached Playwright Chromium (defaults to `~/.cache/ms-playwright`, or `~/Library/Caches/ms-playwright` on macOS). |
 
 Tasks are persisted to `<cwd>/.pi-tasks/TASK_NNNN.md`. Add `.pi-tasks/` to your `.gitignore` if you don't want them checked in.
 
@@ -236,7 +239,7 @@ Tasks are persisted to `<cwd>/.pi-tasks/TASK_NNNN.md`. Add `.pi-tasks/` to your
 
 ```sh
 bun install
-bun run test       # 2078 tests across 129 files
+bun run test       # 3028 tests across 173 files
 bun run lint       # prettier + eslint + tsc --noEmit
 bun run build      # tsc → dist/
 ```

package/dist/task/launch-manifest.js

@@ -39,7 +39,7 @@
  * project that ever recorded a launch contract (mx5, npm) and one non-npm project
  * that reached extraction (IAR1, CMake). A third ecosystem would be a guess.
  */
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import * as path from 'node:path';
 /** GNU make's own lookup order, and nothing beyond it — this is one ecosystem. */
 const MAKEFILE_NAMES = ['GNUmakefile', 'makefile', 'Makefile'];
@@ -85,6 +85,28 @@ export function makeTargets(src) {
     }
     return out;
 }
+/**
+ * The makefiles that really exist in `cwd`, in GNU make's lookup order, named as
+ * the DIRECTORY spells them. `existsSync` cannot do this job: on a case-insensitive
+ * filesystem (Windows, macOS) `existsSync('makefile')` is true for a `Makefile`, and
+ * the failure text would then name a file the project does not have.
+ */
+function makefilesOnDisk(cwd) {
+    let entries;
+    try {
+        entries = readdirSync(cwd);
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const want of MAKEFILE_NAMES) {
+        const hit = entries.find(e => e.toLowerCase() === want.toLowerCase());
+        if (hit && !out.includes(hit))
+            out.push(hit);
+    }
+    return out;
+}
 /**
  * Resolve the manifest the launch contract may be diffed against.
  *
@@ -103,12 +125,13 @@ export function readLaunchManifest(cwd) {
             return { kind: 'none', file: '', names: [], why: 'its package.json could not be parsed' };
         }
     }
-    for (const name of MAKEFILE_NAMES) {
-        const mk = path.join(cwd, name);
-        if (!existsSync(mk))
-            continue;
+    for (const name of makefilesOnDisk(cwd)) {
         try {
-            return { kind: 'make', file: name, names: makeTargets(readFileSync(mk, 'utf8')) };
+            return {
+                kind: 'make',
+                file: name,
+                names: makeTargets(readFileSync(path.join(cwd, name), 'utf8'))
+            };
         }
         catch {
             break;

package/dist/workers/docs-core.d.ts

@@ -16,6 +16,13 @@ import { type SpawnFn } from '../shared/child-process.js';
 export interface AutoInstallPin {
     source: 'declared-range' | 'npm-latest';
     range?: string;
+    /**
+     * The package the CALLER asked about — the HEAD of the resolution chain, not
+     * its terminal. `bun -> @types/bun -> bun-types` resolves correctly and must
+     * keep doing so, but the sentence a banner writes is about `bun`: the project
+     * cannot declare `bun-types`, and was never asked about it.
+     */
+    asked?: string;
 }
 export type DocsRawResult = {
     kind: 'ok';
@@ -85,14 +92,48 @@ export interface DocsFocusedResult {
 }
 export type DocsFocusedInput = DocsRawInput;
 export declare function extractParentPackage(moduleName: string): string;
+/** What a project's package.json says about one package, whether or not the
+ *  value is something the install path could use. */
+export interface Declaration {
+    /** The dependency-map KEY the declaration was found under. */
+    pkg: string;
+    /** Its value, trimmed — `^1.2.0`, `latest`, `workspace:*`. */
+    value: string;
+    /** False for dist-tags, wildcards and non-registry protocols. */
+    usable: boolean;
+}
+/**
+ * The names a declaration for `asked` can honestly live under, nearest first:
+ * the package itself, its DefinitelyTyped package, and the terminal the type
+ * resolution chain landed on. A project that uses Bun declares `@types/bun`, not
+ * `bun`; asking only about the terminal `bun-types` finds nothing at all, which
+ * is how 35 of run 20's 48 banners came to report on a package nobody asked
+ * about.
+ */
+export declare function declarationChain(asked: string, resolved?: string): string[];
+/**
+ * The first declaration for any name in `names`, searching the four standard
+ * dependency maps of `cwd`'s package.json. A USABLE declaration always wins;
+ * only if none of the names has one does an unusable declaration (a dist-tag or
+ * a non-registry protocol) come back, so the caller can tell "declared as
+ * `latest`" apart from "not declared at all" — two different facts that used to
+ * produce the same sentence. Returns null when no name appears anywhere, or the
+ * package.json is missing or unparseable. Best-effort; never throws.
+ */
+export declare function findDeclaration(names: string[], cwd: string): Declaration | null;
 /**
  * The version range a project DECLARES for `parentPkg` in its package.json under
  * `cwd`. Lets a not-yet-installed scaffolding dependency be documented against
  * the major the project intends, instead of whatever npm currently tags
- * `latest`. Scans the four standard dependency maps in priority order. Returns
- * null — caller falls back to latest — when the dep is undeclared, the
- * package.json is missing/unreadable, or the declared value is not a usable
- * range. Best-effort; never throws.
+ * `latest`. Returns null — caller falls back to latest — when the dep is
+ * undeclared, the package.json is missing/unreadable, or the declared value is
+ * not a usable range.
+ *
+ * This is the INSTALL target and takes one name deliberately: `npm install
+ * <parentPkg>@<range>` must use the range declared for `parentPkg` itself.
+ * `@types/bun`'s range is not `bun`'s. The banner's wider, chain-aware question
+ * is `findDeclaration`; keeping them apart is what stops a wording fix from
+ * silently changing what gets installed.
  */
 export declare function findDeclaredRange(parentPkg: string, cwd: string): string | null;
 /**
@@ -102,8 +143,14 @@ export declare function findDeclaredRange(parentPkg: string, cwd: string): strin
  * the prose the impl model reads, rather than burying it in tool `details`.
  * Empty string when there was no auto-install (already-installed packages need
  * no banner — their version is the project's own).
+ *
+ * `resolved` is the package the types were finally read from — the TERMINAL of
+ * the redirect chain. The banner names `pin.asked`, the package the caller asked
+ * about, and mentions the terminal only as provenance: a project can declare
+ * `bun`, and cannot declare `bun-types`, so a sentence about what package.json
+ * does or does not say has to be a sentence about `bun`.
  */
-export declare function buildVersionBanner(pin: AutoInstallPin | undefined, pkgName: string, version: string): string;
+export declare function buildVersionBanner(pin: AutoInstallPin | undefined, resolved: string, version: string, cwd: string): string;
 export declare function getDocsModulesDir(): string;
 export declare function ensureDocsModulesDir(dir: string): void;
 export declare function runAutoInstall(spawn: SpawnFn, packageName: string, signal: AbortSignal | undefined, versionRange?: string): Promise<{

package/dist/workers/docs-core.js

@@ -43,15 +43,32 @@ function isUsableRange(range) {
     return true;
 }
 /**
- * The version range a project DECLARES for `parentPkg` in its package.json under
- * `cwd`. Lets a not-yet-installed scaffolding dependency be documented against
- * the major the project intends, instead of whatever npm currently tags
- * `latest`. Scans the four standard dependency maps in priority order. Returns
- * null — caller falls back to latest — when the dep is undeclared, the
- * package.json is missing/unreadable, or the declared value is not a usable
- * range. Best-effort; never throws.
+ * The names a declaration for `asked` can honestly live under, nearest first:
+ * the package itself, its DefinitelyTyped package, and the terminal the type
+ * resolution chain landed on. A project that uses Bun declares `@types/bun`, not
+ * `bun`; asking only about the terminal `bun-types` finds nothing at all, which
+ * is how 35 of run 20's 48 banners came to report on a package nobody asked
+ * about.
  */
-export function findDeclaredRange(parentPkg, cwd) {
+export function declarationChain(asked, resolved) {
+    const out = [asked];
+    const types = typesPackageName(asked);
+    if (types && !out.includes(types))
+        out.push(types);
+    if (resolved && !out.includes(resolved))
+        out.push(resolved);
+    return out;
+}
+/**
+ * The first declaration for any name in `names`, searching the four standard
+ * dependency maps of `cwd`'s package.json. A USABLE declaration always wins;
+ * only if none of the names has one does an unusable declaration (a dist-tag or
+ * a non-registry protocol) come back, so the caller can tell "declared as
+ * `latest`" apart from "not declared at all" — two different facts that used to
+ * produce the same sentence. Returns null when no name appears anywhere, or the
+ * package.json is missing or unparseable. Best-effort; never throws.
+ */
+export function findDeclaration(names, cwd) {
     let json;
     try {
         json = JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf8'));
@@ -59,15 +76,40 @@ export function findDeclaredRange(parentPkg, cwd) {
     catch {
         return null;
     }
-    for (const field of DEP_FIELDS) {
-        const map = json[field];
-        if (!map || typeof map !== 'object')
-            continue;
-        const range = map[parentPkg];
-        if (typeof range === 'string' && isUsableRange(range))
-            return range.trim();
+    let unusable = null;
+    for (const name of names) {
+        for (const field of DEP_FIELDS) {
+            const map = json[field];
+            if (!map || typeof map !== 'object')
+                continue;
+            const range = map[name];
+            if (typeof range !== 'string')
+                continue;
+            const value = range.trim();
+            if (isUsableRange(value))
+                return { pkg: name, value, usable: true };
+            unusable ??= { pkg: name, value, usable: false };
+        }
     }
-    return null;
+    return unusable;
+}
+/**
+ * The version range a project DECLARES for `parentPkg` in its package.json under
+ * `cwd`. Lets a not-yet-installed scaffolding dependency be documented against
+ * the major the project intends, instead of whatever npm currently tags
+ * `latest`. Returns null — caller falls back to latest — when the dep is
+ * undeclared, the package.json is missing/unreadable, or the declared value is
+ * not a usable range.
+ *
+ * This is the INSTALL target and takes one name deliberately: `npm install
+ * <parentPkg>@<range>` must use the range declared for `parentPkg` itself.
+ * `@types/bun`'s range is not `bun`'s. The banner's wider, chain-aware question
+ * is `findDeclaration`; keeping them apart is what stops a wording fix from
+ * silently changing what gets installed.
+ */
+export function findDeclaredRange(parentPkg, cwd) {
+    const found = findDeclaration([parentPkg], cwd);
+    return found?.usable === true ? found.value : null;
 }
 /**
  * One-line version-provenance banner that LEADS a docs answer for a package the
@@ -76,18 +118,54 @@ export function findDeclaredRange(parentPkg, cwd) {
  * the prose the impl model reads, rather than burying it in tool `details`.
  * Empty string when there was no auto-install (already-installed packages need
  * no banner — their version is the project's own).
+ *
+ * `resolved` is the package the types were finally read from — the TERMINAL of
+ * the redirect chain. The banner names `pin.asked`, the package the caller asked
+ * about, and mentions the terminal only as provenance: a project can declare
+ * `bun`, and cannot declare `bun-types`, so a sentence about what package.json
+ * does or does not say has to be a sentence about `bun`.
  */
-export function buildVersionBanner(pin, pkgName, version) {
+export function buildVersionBanner(pin, resolved, version, cwd) {
     if (!pin)
         return '';
+    const asked = pin.asked ?? resolved;
+    const grounded = resolved !== asked ? ` The types this answer reads come from ${resolved}.` : '';
     if (pin.source === 'declared-range') {
-        return (`[VERSION] "${pkgName}" resolved to this project's declared range `
-            + `${pin.range} (installed v${version}); the answer below is pinned to that version.\n\n`);
+        return (`[VERSION] "${asked}" resolved to this project's declared range `
+            + `${pin.range} (installed v${version}); the answer below is pinned to that `
+            + `version.${grounded}\n\n`);
+    }
+    // The install fell back to npm latest. A usable declaration can still exist
+    // further along the chain (`@types/<name>`) — it did not pin THIS install, so
+    // the banner reports it as provenance, not as a pin.
+    const decl = findDeclaration(declarationChain(asked, resolved), cwd);
+    // Declared, but as a dist-tag or a non-registry protocol. That is NOT the
+    // same fact as undeclared: the project did say what it wants, `latest` is
+    // exactly what this answer is grounded in, and so there is no other major to
+    // confirm and nothing to hold as unverified. Only the SENTENCE splits —
+    // `isUsableRange` still rejects the value and the install path still cannot
+    // use it as an `install <pkg>@<range>` target.
+    if (decl && !decl.usable) {
+        const where = decl.pkg === asked ? '' : ` only through ${decl.pkg},`;
+        return (`[VERSION] "${asked}" is declared in this project's package.json${where} as `
+            + `\`${decl.value}\` — a moving tag, not a pinned range — so this answer is based `
+            + `on npm latest (v${version}), which is what that declaration resolves to `
+            + `today.${grounded}\n\n`);
+    }
+    // A usable range on the ASKED name with an npm-latest pin means package.json
+    // gained the declaration between the install and this sentence. Rare, but the
+    // alternative wording would flatly contradict itself.
+    if (decl?.usable === true && decl.pkg === asked) {
+        return (`[VERSION — verify] "${asked}" is declared as ${decl.value}, but this answer is `
+            + `based on npm latest (v${version}) — the install was not pinned to that range. `
+            + `Confirm the version you intend before relying on an API that differs across `
+            + `majors.${grounded}\n\n`);
     }
-    return (`[VERSION — verify] "${pkgName}" is not declared in this project's package.json, `
+    const via = decl?.usable === true ? ` — only its types are, as ${decl.pkg} ${decl.value} —` : ',';
+    return (`[VERSION — verify] "${asked}" is not declared in this project's package.json${via} `
         + `so this answer is based on npm latest (v${version}). Your project may target a `
         + `different MAJOR — confirm the version you intend to install and treat any API that `
-        + `differs across majors as unverified until you check it against that version.\n\n`);
+        + `differs across majors as unverified until you check it against that version.${grounded}\n\n`);
 }
 export function getDocsModulesDir() {
     const base = process.env.XDG_CACHE_HOME?.trim() || path.join(os.homedir(), '.cache');
@@ -208,8 +286,8 @@ export async function docsRaw(input) {
             const declaredRange = findDeclaredRange(parentPkg, input.cwd);
             autoInstallPin =
                 declaredRange ?
-                    { source: 'declared-range', range: declaredRange }
-                    : { source: 'npm-latest' };
+                    { source: 'declared-range', range: declaredRange, asked: parentPkg }
+                    : { source: 'npm-latest', asked: parentPkg };
             const installResult = await runAutoInstall(spawn, parentPkg, undefined, declaredRange ?? undefined);
             if (!installResult.success) {
                 return {

package/dist/workers/pi-worker-docs.js

@@ -251,7 +251,7 @@ export function registerPiWorkerDocs(pi, internals = {}) {
                 };
             }
             if (rawResult.kind === 'no_chunks') {
-                const banner = buildVersionBanner(rawResult.autoInstallPin, rawResult.pkg.name, rawResult.pkg.version);
+                const banner = buildVersionBanner(rawResult.autoInstallPin, rawResult.pkg.name, rawResult.pkg.version, ctx.cwd);
                 return {
                     text: banner
                         + npmHeader
@@ -269,7 +269,7 @@ export function registerPiWorkerDocs(pi, internals = {}) {
             }
             // kind === 'ok'
             const { pkg, chunks, hitCache, indexingMs, cacheError, autoInstalled } = rawResult;
-            const versionBanner = buildVersionBanner(rawResult.autoInstallPin, pkg.name, pkg.version);
+            const versionBanner = buildVersionBanner(rawResult.autoInstallPin, pkg.name, pkg.version, ctx.cwd);
             const baseDetails = {
                 version: pkg.version,
                 hitCache,

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@mjasnikovs/pi-task",
-    "version": "0.37.5",
+    "version": "0.37.7",
     "description": "Deterministic task planning and spec-orchestration for local models — crash-safe /task pipelines with verify/enforce gates, a real-time remote web view, and web/docs/fetch/worker subagent tools.",
     "type": "module",
     "main": "./dist/index.js",