@mjasnikovs/pi-task 0.38.11 → 0.38.13

package/README.md

@@ -9,7 +9,7 @@
 [![npm](https://img.shields.io/npm/v/@mjasnikovs/pi-task?color=cb3837&logo=npm)](https://www.npmjs.com/package/@mjasnikovs/pi-task)
 [![license](https://img.shields.io/badge/license-AGPL--3.0-blue.svg)](./LICENSE)
 [![pi extension](https://img.shields.io/badge/pi-extension-7c3aed)](https://www.npmjs.com/package/@earendil-works/pi-coding-agent)
-[![tests](https://img.shields.io/badge/tests-3025%20passing-3fb950)](#development)
+[![tests](https://img.shields.io/badge/tests-3771%20passing-3fb950)](#development)
 [![types](https://img.shields.io/badge/TypeScript-strict-3178c6?logo=typescript&logoColor=white)](./tsconfig.json)
 
 </div>
@@ -72,7 +72,7 @@ A whole plan — `/task-auto` splits it into an ordered task list and runs each
 | `/task-auto <feature>` | Plan a feature into a task list and run each title through `/task` in order (resumable). |
 | `/task-auto-resume [--unattended]` | Resume the active `/task-auto` run at the next unfinished task. `--unattended` is the boot-hook form: in-flight runs only. |
 | `/task-auto-cancel` | Stop the `/task-auto` loop after the current task (still resumable). |
-| `/task-config` | Toggle pi-task settings in an editor dialog: remote control, compress thinking, auto-commit, verify work, enforce guidelines, project tour, parallel research, research cache, search engine, command timeout, stuck reply retry, yolo mode, debug logs, one `watch:` toggle per live tool, and one `ext:` toggle per installed host extension. |
+| `/task-config` | Toggle pi-task settings in an editor dialog: remote control, auto-commit, verify work, enforce guidelines, project tour, parallel research, research cache, search engine, command timeout, stuck reply retry, yolo mode, debug logs, one `watch:` toggle per live tool, and one `ext:` toggle per installed host extension. |
 | `/remote` | Show the QR code & URLs for the web view (`/remote stop` to stop). Answer grill questions, start tasks, and watch progress from your phone. |
 
 ## The pipeline
@@ -204,7 +204,6 @@ Run `/task-config` to toggle pi-task's behavior in an editor dialog. Settings pe
 | Setting | Default | What it does |
 | --- | --- | --- |
 | **remote control** | on | The remote UI server (QR code, phone access). Turn off to never start it. |
-| **compress thinking** | on | After each message, compresses the model's `<think>` blocks down to the decisions/constraints/facts that matter later — keeping long local-model runs from drowning their own context in self-talk. |
 | **auto-commit** | on | Snapshots the working tree into one git commit per `/task-auto` sub-task (see above). |
 | **verify work** | on | After each `/task` (and `/task-auto` task) implements — but **before** it's checked off or committed — actually **runs** the spec's own `VERIFY` block in the real workspace. pi-task otherwise only _authors_ a VERIFY block and never executes it, so a task that doesn't build is indistinguishable from one that works. A fresh `read` + `bash` child of the same local model runs the declared check, observes the real output, and reports **PASS/FAIL** (a legitimately no-op VERIFY is a PASS). On FAIL the run doesn't dead-stop: you get a boxed picker — **Autofix** (re-run the implementation turn against the failure, then re-verify; no attempt cap) or **Accept** (override a misjudged artifact) — and dismissing it pauses the run, resumable. A genuine clean pass is also the behavioral signal that lets **enforce guidelines** fix in place (see below). |
 | **enforce guidelines** | on | After each `/task` (and `/task-auto` task) is committed, re-checks that commit's work against the project's `AGENTS.md` / `CLAUDE.md` (in the working directory). A bare fix-in-place pass trashes working code (A/B-proven), so enforcement is gated on the **verify work** signal. **With** a genuine verify pass: a fresh `read` + `edit` child of the same local model reads the **last commit's** diff and fixes violations in place; its fixes are committed **separately** as an `ENFORCE GUIDELINES` commit, then the verify signal is re-run against the enforced tree — a regression **reverts** the enforce commit and keeps the verified work. **Without** that signal (verify off, no spec, or an accept-override): the pass runs read-only and only **reports** violations, never rewrites logic. Either way a violation it can't clear (or a pass that can't run) only **warns** — the task commit already landed, so the run continues. Skipped when nothing was committed for the task. |
@@ -233,13 +232,17 @@ Run `/task-config` to toggle pi-task's behavior in an editor dialog. Settings pe
 | `CHROME_BIN` | verify-work render check | Explicit headless Chrome-family binary. Tried before the Playwright cache and a browser on `PATH`. No browser found ⇒ the render check SKIPs; it never installs one. |
 | `PLAYWRIGHT_BROWSERS_PATH` | verify-work render check | Where to look for a cached Playwright Chromium (defaults to `~/.cache/ms-playwright`, or `~/Library/Caches/ms-playwright` on macOS). |
 
-Tasks are persisted to `<cwd>/.pi-tasks/TASK_NNNN.md`. Add `.pi-tasks/` to your `.gitignore` if you don't want them checked in.
+Tasks are persisted to `<cwd>/.pi-tasks/TASK_NNNN.md`. A run also keeps small
+line-oriented ledgers beside them — contracts, launch contract, environment
+notes, accepted debt, repair queue, requirements — plus `*-debug.log` when
+**debug logs** is on. Add `.pi-tasks/` to your `.gitignore` if you don't want
+them checked in.
 
 ## Development
 
 ```sh
 bun install
-bun run test       # 3028 tests across 173 files
+bun run test       # 3772 tests across 212 files
 bun run lint       # prettier + eslint + tsc --noEmit
 bun run build      # tsc → dist/
 ```

package/dist/config/config.d.ts

@@ -1,7 +1,6 @@
 import { type SearchProvider } from '../workers/search-types.js';
 export interface PiTaskConfig {
     remote: boolean;
-    compressReasoning: boolean;
     autoCommit: boolean;
     orientation: boolean;
     enforceGuidelines: boolean;

package/dist/config/config.js

@@ -87,7 +87,6 @@ export function sanitizeStreamInactivityMs(value) {
  */
 export const DEFAULT_CONFIG = {
     remote: true,
-    compressReasoning: true,
     autoCommit: true,
     orientation: true,
     enforceGuidelines: true,

package/dist/config/register.js

@@ -94,8 +94,6 @@ function booleanItem(id, label, description) {
 export const ITEMS = [
     booleanItem('remote', 'remote control', 'Serve the task UI on your local network so you can follow and steer a run from '
         + 'your phone. Prints a QR code to scan when it starts'),
-    booleanItem('compressReasoning', 'compress thinking', "Shrink the model's thinking blocks once it has moved on, so a long run keeps more "
-        + 'room for the work itself'),
     booleanItem('autoCommit', 'auto-commit', 'Make a git commit before and after every sub-task, so each step is a checkpoint '
         + 'you can read back or roll back to'),
     booleanItem('verifyWork', 'verify work', 'When a task says it is done, actually run the checks its spec asks for and report '

package/dist/index.js

@@ -4,7 +4,6 @@ import { registerTaskAuto } from './task/auto-orchestrator.js';
 import { registerTaskPlan } from './task/plan-orchestrator.js';
 import { registerWorkers } from './workers/index.js';
 import { registerRemote } from './remote/register.js';
-import { registerThinkingCompression } from './thinking/compress.js';
 import { registerCommandWatchdog } from './task/command-watchdog.js';
 import { registerStreamWatchdog } from './task/stream-watchdog.js';
 export default function (pi) {
@@ -14,7 +13,6 @@ export default function (pi) {
     registerTaskPlan(pi);
     registerWorkers(pi);
     registerRemote(pi);
-    registerThinkingCompression(pi);
     registerCommandWatchdog(pi);
     registerStreamWatchdog(pi);
 }

package/dist/shared/child-process.d.ts

@@ -81,6 +81,14 @@ export interface LoopHit {
     call: ToolCall;
     count: number;
     windowSize: number;
+    /**
+     * Set when the kill came from the whole-run StallDetector rather than the
+     * short-window LoopDetector, naming which of its two rules tripped
+     * (task/stall-detector.ts). Absent for an ordinary loop hit. Carried here so
+     * a stall rides the kill/restart plumbing the loop hit already has instead of
+     * needing a second channel.
+     */
+    stall?: 'no-new-ground' | 'context-churn';
 }
 export interface ContextSnapshot {
     tokens: number;

package/dist/shared/command-watchdog.d.ts

@@ -54,7 +54,7 @@ export interface WatchdogDeps {
 }
 /**
  * Stable substring of {@link reminderMessage}, used by the steer loop
- * (orchestrator steerUntilDone) to recognise the watchdog's follow-up turn in
+ * (implementation-turn steerUntilDone) to recognise the watchdog's follow-up turn in
  * the session entries — the artifact that distinguishes a watchdog abort from a
  * human ESC. Interpolated into the message so the detector and the text cannot
  * drift apart.

package/dist/shared/command-watchdog.js

@@ -53,7 +53,7 @@ function correction() {
 }
 /**
  * Stable substring of {@link reminderMessage}, used by the steer loop
- * (orchestrator steerUntilDone) to recognise the watchdog's follow-up turn in
+ * (implementation-turn steerUntilDone) to recognise the watchdog's follow-up turn in
  * the session entries — the artifact that distinguishes a watchdog abort from a
  * human ESC. Interpolated into the message so the detector and the text cannot
  * drift apart.

package/dist/task/accept-debt.d.ts

@@ -1,3 +1,4 @@
+import { type CommandRunner } from './command-run.js';
 /**
  * Provenance of a recorded defect:
  *   - 'accepted'       — the user chose ACCEPT despite a verify-FAIL (the original class).
@@ -226,3 +227,49 @@ export declare function buildAcceptDebtNote(open: AcceptDebt[]): string;
  * origin falls back to the 'accepted' class exactly as the branch chain did.
  */
 export declare function describeDebt(d: AcceptDebt): string;
+/**
+ * ACCEPT-debt re-check (mx5 run 4 B3 / run 8 TASK_0012): read the ledger of tasks
+ * the user accepted despite a verify-FAIL and re-check each against the CURRENT
+ * tree. A static-class debt whose statics now pass is provably RESOLVED (a later
+ * task fixed it) and pruned from the ledger; every other debt cannot be proven
+ * resolved deterministically, so it stays OPEN and is surfaced — a run may not
+ * complete silently carrying an accepted defect. FP-safe by construction (see
+ * accept-debt.ts). Best-effort: a ledger read/write failure must never break the
+ * caller.
+ *
+ * FACTORED OUT of runFinalIntegrationGate (nexttask 6): the derivation has to be
+ * runnable at a SECOND moment — after a converged final-gate autofix, where the
+ * orchestrator used to rebuild its gate outcome as a bare `{ok, reason}` and drop
+ * `openDebts` entirely. The report a run ends on has to be derived from the tree
+ * the run ends with, not from the tree as it was before the fix pass.
+ *
+ * `staticOk` is the caller's claim about the CURRENT statics, and it is the only
+ * thing that can auto-close a static-class debt — so a caller that does not know
+ * must pass `false` (unprovable ⇒ stays open), never a guess.
+ */
+export declare function deriveOpenDebts(cwd: string, staticOk: boolean): Promise<{
+    openDebts: AcceptDebt[];
+    debtNote?: string;
+    trail?: string[];
+}>;
+/**
+ * Re-run ONE debt's stored VERIFY command for the re-check, with the no-write guard
+ * (`inv-no-write`) wrapped around it.
+ *
+ * A VERIFY command is the project's own command and may legitimately write (a build
+ * emits `dist/`, a suite writes a snapshot). What it may NOT do is turn the tree into
+ * a passing tree and have that count as the debt being fixed — the run would then be
+ * certifying its own side effect. So tracked state is captured before and after, and
+ * a pass that came with a tracked change is downgraded to INCONCLUSIVE with the
+ * change named. Untracked output is left alone: it is what a build legitimately
+ * produces, and `git status --porcelain` in a repo with the usual ignores does not
+ * see it.
+ *
+ * A repository the guard cannot read (no git, git absent) is not a licence to skip
+ * the guard: the re-run is INCONCLUSIVE there, because "nothing changed" would be an
+ * assumption rather than an observation.
+ */
+export declare function rerunDebtVerifyCommand(cwd: string, command: string, 
+/** The spawner, for BOTH the command and the tracked-state reads. Injected so
+ *  the guard's four outcomes are testable without a repo or a real command. */
+run?: CommandRunner): VerifyRerunResult;

package/dist/task/accept-debt.js

@@ -25,10 +25,14 @@
  * model, so it is SURFACED, never auto-closed — biasing hard toward informing the
  * user rather than re-hiding a live defect. "Nothing still open = clean."
  */
-import * as fsp from 'node:fs/promises';
+import { existsSync } from 'node:fs';
 import * as path from 'node:path';
+import * as fsp from 'node:fs/promises';
+import { runVerifyCommandLine, spawnCommand } from './command-run.js';
+import { taskThatIntroduced } from './task-provenance.js';
+import { makeLedger } from './ledger.js';
 import { parseVerifyBlockStrict } from './spec-validation.js';
-import { taskFilePath, tasksDir } from './task-io.js';
+import { taskFilePath } from './task-io.js';
 import { isUnfailableCommand } from './unfailable-command.js';
 const ACCEPT_DEBT_FILE = 'accept-debt.md';
 /** Cap kept records so a run that accepts many FAILs cannot grow the report unboundedly. */
@@ -69,16 +73,11 @@ function isKnownOrigin(origin) {
     return origin !== undefined && Object.hasOwn(DEBT_LABELS, origin);
 }
 export function acceptDebtFile(cwd) {
-    return path.join(tasksDir(cwd), ACCEPT_DEBT_FILE);
+    return ledger.path(cwd);
 }
 /** The raw stored ledger ('' when none recorded yet). Parse with parseAcceptDebts. */
 export async function readAcceptDebtsRaw(cwd) {
-    try {
-        return (await fsp.readFile(acceptDebtFile(cwd), 'utf8')).trim();
-    }
-    catch {
-        return '';
-    }
+    return ledger.readRaw(cwd);
 }
 /**
  * Parse the stored ledger into records. Fields are tab-separated: `id`, `reason`, and
@@ -117,7 +116,7 @@ export function parseAcceptDebts(raw) {
 }
 /** Read + parse in one step. */
 export async function readAcceptDebts(cwd) {
-    return parseAcceptDebts(await readAcceptDebtsRaw(cwd));
+    return ledger.read(cwd);
 }
 function normaliseReason(reason) {
     return reason
@@ -142,6 +141,18 @@ function serialize(d) {
 function debtKey(d) {
     return `${d.origin ?? 'accepted'} ${d.taskId.toLowerCase()} ${d.reason.toLowerCase()}`;
 }
+/**
+ * The debt ledger. `onNoop: 'skip'` — a duplicate is a return, not a rewrite: the
+ * file is touched only when a NEW debt enters it.
+ */
+const ledger = makeLedger({
+    file: ACCEPT_DEBT_FILE,
+    max: MAX_DEBTS,
+    key: debtKey,
+    serialize,
+    parse: parseAcceptDebts,
+    onNoop: 'skip'
+});
 /**
  * Append one accepted-despite-FAIL record, deduplicated against what is already
  * stored (case-insensitive on task id + reason), keeping the newest MAX_DEBTS.
@@ -158,13 +169,7 @@ async function appendDebt(cwd, entry) {
         const verifyCommand = entry.verifyCommand ?? (await classifyVerifyCommand(cwd, entry.taskId, entry.reason));
         if (verifyCommand !== null && verifyCommand !== undefined)
             entry = { ...entry, verifyCommand };
-        const existing = parseAcceptDebts(await readAcceptDebtsRaw(cwd));
-        const seen = new Set(existing.map(debtKey));
-        if (seen.has(debtKey(entry)))
-            return;
-        const kept = [...existing, entry].slice(-MAX_DEBTS);
-        await fsp.mkdir(tasksDir(cwd), { recursive: true });
-        await fsp.writeFile(acceptDebtFile(cwd), kept.map(serialize).join('\n') + '\n', 'utf8');
+        await ledger.append(cwd, [entry]);
     }
     catch {
         // best-effort ledger
@@ -217,17 +222,7 @@ export function extractDeletedDebtPath(reason) {
 }
 /** Overwrite the ledger with exactly these records (used to prune resolved debts). */
 export async function writeAcceptDebts(cwd, debts) {
-    try {
-        await fsp.mkdir(tasksDir(cwd), { recursive: true });
-        if (debts.length === 0) {
-            await fsp.writeFile(acceptDebtFile(cwd), '', 'utf8');
-            return;
-        }
-        await fsp.writeFile(acceptDebtFile(cwd), debts.map(serialize).join('\n') + '\n', 'utf8');
-    }
-    catch {
-        // best-effort ledger
-    }
+    await ledger.write(cwd, debts);
 }
 /**
  * STATIC-CLASS debt: one whose accepted FAIL was the deterministic whole-repo static
@@ -484,3 +479,107 @@ export function buildAcceptDebtNote(open) {
 export function describeDebt(d) {
     return isKnownOrigin(d.origin) ? DEBT_LABELS[d.origin] : DEBT_LABELS.accepted;
 }
+/**
+ * ACCEPT-debt re-check (mx5 run 4 B3 / run 8 TASK_0012): read the ledger of tasks
+ * the user accepted despite a verify-FAIL and re-check each against the CURRENT
+ * tree. A static-class debt whose statics now pass is provably RESOLVED (a later
+ * task fixed it) and pruned from the ledger; every other debt cannot be proven
+ * resolved deterministically, so it stays OPEN and is surfaced — a run may not
+ * complete silently carrying an accepted defect. FP-safe by construction (see
+ * accept-debt.ts). Best-effort: a ledger read/write failure must never break the
+ * caller.
+ *
+ * FACTORED OUT of runFinalIntegrationGate (nexttask 6): the derivation has to be
+ * runnable at a SECOND moment — after a converged final-gate autofix, where the
+ * orchestrator used to rebuild its gate outcome as a bare `{ok, reason}` and drop
+ * `openDebts` entirely. The report a run ends on has to be derived from the tree
+ * the run ends with, not from the tree as it was before the fix pass.
+ *
+ * `staticOk` is the caller's claim about the CURRENT statics, and it is the only
+ * thing that can auto-close a static-class debt — so a caller that does not know
+ * must pass `false` (unprovable ⇒ stays open), never a guess.
+ */
+export async function deriveOpenDebts(cwd, staticOk) {
+    const { open: openRaw, resolved, trail } = recheckAcceptDebts(await readAcceptDebts(cwd), {
+        staticOk,
+        // Cross-task-deletion debts auto-close iff the deleted file is back in the
+        // tree — a deterministic existence check, corroborating the per-file
+        // provenance the record already carries.
+        fileExists: rel => existsSync(path.join(cwd, rel)),
+        // VERIFY-COMMAND class (nexttask 5): a debt that NAMES a command is settled
+        // by running that command, under the gate's own env-gap contract and behind
+        // the no-write guard below.
+        rerunVerify: cmd => rerunDebtVerifyCommand(cwd, cmd)
+    });
+    if (resolved.length > 0)
+        await writeAcceptDebts(cwd, openRaw);
+    // Conflicting-claim annotation (mx5 run 11): an existence-as-failure debt whose
+    // named file is another task's committed deliverable is a plan defect — surface
+    // the contradiction with the debt so nobody (human or child) treats the claim as
+    // a deletion instruction. Pure git-history lookup; degrades to no annotation.
+    const openDebts = annotateDebtConflicts(openRaw, p => taskThatIntroduced(cwd, p));
+    const debtNote = buildAcceptDebtNote(openDebts);
+    return { openDebts, ...(debtNote ? { debtNote } : {}), ...(trail.length > 0 ? { trail } : {}) };
+}
+/** Per-command ceiling for a debt re-run (`inv-bounded`). */
+const DEBT_RERUN_TIMEOUT_MS = 300_000;
+/**
+ * Extra infrastructure-gap shapes recognised ONLY when re-running a debt's command,
+ * never in the gate's own verdicts. A driver that reports its connection simply
+ * closed (`ERR_POSTGRES_CONNECTION_CLOSED` — what bun's SQL client says when the
+ * database is not there at all, as on this box with the mx5 container stopped) is an
+ * absent dependency, and calling that "the defect is still present" would be a
+ * finding the environment invented. Kept out of INFRA_GAP_OUTPUT_RE on purpose: in a
+ * gate verdict the same wording can be a real fault the suite must own, and only the
+ * debt re-check needs the conservative reading — where it costs nothing, because gap
+ * and fail both leave the debt open.
+ */
+const DEBT_INFRA_GAP_RE = /ERR_POSTGRES_CONNECTION_CLOSED|ERR_MYSQL_CONNECTION|ECONNRESET/i;
+/**
+ * Re-run ONE debt's stored VERIFY command for the re-check, with the no-write guard
+ * (`inv-no-write`) wrapped around it.
+ *
+ * A VERIFY command is the project's own command and may legitimately write (a build
+ * emits `dist/`, a suite writes a snapshot). What it may NOT do is turn the tree into
+ * a passing tree and have that count as the debt being fixed — the run would then be
+ * certifying its own side effect. So tracked state is captured before and after, and
+ * a pass that came with a tracked change is downgraded to INCONCLUSIVE with the
+ * change named. Untracked output is left alone: it is what a build legitimately
+ * produces, and `git status --porcelain` in a repo with the usual ignores does not
+ * see it.
+ *
+ * A repository the guard cannot read (no git, git absent) is not a licence to skip
+ * the guard: the re-run is INCONCLUSIVE there, because "nothing changed" would be an
+ * assumption rather than an observation.
+ */
+export function rerunDebtVerifyCommand(cwd, command, 
+/** The spawner, for BOTH the command and the tracked-state reads. Injected so
+ *  the guard's four outcomes are testable without a repo or a real command. */
+run = spawnCommand) {
+    const tracked = () => {
+        const r = run({
+            cwd,
+            bin: 'git',
+            args: ['status', '--porcelain', '--untracked-files=no'],
+            timeoutMs: 60_000
+        });
+        return r.failedToStart || r.status !== 0 ? null : r.stdout;
+    };
+    const before = tracked();
+    const r = runVerifyCommandLine(cwd, command, DEBT_RERUN_TIMEOUT_MS, DEBT_INFRA_GAP_RE, run);
+    if (r.outcome === 'fail')
+        return { outcome: 'fail', detail: `exit ${r.status} — ${r.tail}` };
+    if (r.outcome === 'gap')
+        return { outcome: 'gap', detail: r.detail };
+    const after = tracked();
+    if (before === null || after === null) {
+        return { outcome: 'gap', detail: 'tracked-state guard could not read git status' };
+    }
+    if (before !== after) {
+        return {
+            outcome: 'gap',
+            detail: 'the re-run itself CHANGED tracked files — a command that edits the tree into a pass proves nothing'
+        };
+    }
+    return { outcome: 'pass' };
+}