@mjasnikovs/pi-task 0.38.15 → 0.38.17

package/dist/config/config.d.ts

@@ -189,5 +189,31 @@ export declare const DEFAULT_CONFIG: PiTaskConfig;
  * object/number can't reach the child argv as `-e [object Object]`.
  */
 export declare function sanitizeExtensionWhitelist(value: unknown): string[];
+/**
+ * How each setting's STORED value becomes a safe in-memory value — one loader per
+ * key, keyed on the config's own type.
+ *
+ * `ConfigItem` (config/register.ts) already absorbed three of the four edits its
+ * own header names: *"Adding one enum setting meant four coordinated edits (row,
+ * format arm, parse arm, sanitizer) and NONE of them failed to compile if you
+ * forgot it."* The sanitizer was the fourth, and it stayed behind in this file as
+ * a hand-ordered statement ladder covering 7 of 14 keys. This is the mapped type
+ * that closes it: a new field on `PiTaskConfig` is a compile error until it
+ * declares how a hostile value becomes a safe one.
+ */
+export declare const CONFIG_LOADERS: {
+    [K in keyof PiTaskConfig]: (raw: unknown) => PiTaskConfig[K];
+};
+/**
+ * Turn parsed config JSON into a `PiTaskConfig`. Pure — this is the seam the load
+ * block used to have none of, so every hostile-value case was reachable only
+ * through `getConfig()`, which reads the developer's own machine.
+ *
+ * A non-object `raw` yields the defaults. That is not merely defensive: the old
+ * block spread `parsed` directly, and `{...DEFAULT_CONFIG, ...'ab'}` produces
+ * numeric index keys. Keys absent from the table are dropped rather than carried
+ * into the config object.
+ */
+export declare function loadConfig(raw: unknown): PiTaskConfig;
 export declare function getConfig(): PiTaskConfig;
 export declare function saveConfig(config: PiTaskConfig): Promise<void>;

package/dist/config/config.js

@@ -115,6 +115,73 @@ export function sanitizeExtensionWhitelist(value) {
         return [];
     return value.filter((p) => typeof p === 'string' && p.trim().length > 0);
 }
+/**
+ * A boolean setting's loader. Only a REAL boolean counts; anything else falls
+ * back to the shipped default.
+ *
+ * This is `yoloMode`'s guard, generalised. Its comment — *"a hand-edited
+ * `"yoloMode": "false"` is a truthy string"* — was true verbatim of the other
+ * seven booleans, none of which had it, so a stale `"verifyWork": "off"` reached
+ * `getConfig().verifyWork` as truthy and a `"autoCommit": 0` reached it as falsy.
+ */
+function asBoolean(key) {
+    return raw => (typeof raw === 'boolean' ? raw : DEFAULT_CONFIG[key]);
+}
+/**
+ * How each setting's STORED value becomes a safe in-memory value — one loader per
+ * key, keyed on the config's own type.
+ *
+ * `ConfigItem` (config/register.ts) already absorbed three of the four edits its
+ * own header names: *"Adding one enum setting meant four coordinated edits (row,
+ * format arm, parse arm, sanitizer) and NONE of them failed to compile if you
+ * forgot it."* The sanitizer was the fourth, and it stayed behind in this file as
+ * a hand-ordered statement ladder covering 7 of 14 keys. This is the mapped type
+ * that closes it: a new field on `PiTaskConfig` is a compile error until it
+ * declares how a hostile value becomes a safe one.
+ */
+export const CONFIG_LOADERS = {
+    remote: asBoolean('remote'),
+    autoCommit: asBoolean('autoCommit'),
+    orientation: asBoolean('orientation'),
+    enforceGuidelines: asBoolean('enforceGuidelines'),
+    verifyWork: asBoolean('verifyWork'),
+    parallelResearchWorkers: asBoolean('parallelResearchWorkers'),
+    researchCache: asBoolean('researchCache'),
+    yoloMode: asBoolean('yoloMode'),
+    // A hand-edited or stale enum value must not leak an unknown provider into
+    // the dispatch switch — fall back to the default.
+    searchProvider: raw => (isSearchProvider(raw) ? raw : DEFAULT_CONFIG.searchProvider),
+    extensionWhitelist: sanitizeExtensionWhitelist,
+    requestTimeoutMs: sanitizeRequestTimeoutMs,
+    commandTimeoutExemptTools: sanitizeCommandTimeoutExemptTools,
+    streamInactivityMs: sanitizeStreamInactivityMs,
+    debugLogs: sanitizeDebugLogs
+};
+/**
+ * Turn parsed config JSON into a `PiTaskConfig`. Pure — this is the seam the load
+ * block used to have none of, so every hostile-value case was reachable only
+ * through `getConfig()`, which reads the developer's own machine.
+ *
+ * A non-object `raw` yields the defaults. That is not merely defensive: the old
+ * block spread `parsed` directly, and `{...DEFAULT_CONFIG, ...'ab'}` produces
+ * numeric index keys. Keys absent from the table are dropped rather than carried
+ * into the config object.
+ */
+export function loadConfig(raw) {
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {
+        return { ...DEFAULT_CONFIG };
+    }
+    const stored = raw;
+    const out = { ...DEFAULT_CONFIG };
+    for (const key of Object.keys(CONFIG_LOADERS)) {
+        // `undefined` reaches the loader like any other hostile value: every
+        // loader answers a missing key with its own default, which is what the
+        // old `delete parsed.X` + spread did.
+        ;
+        out[key] = CONFIG_LOADERS[key](stored[key]);
+    }
+    return out;
+}
 const CONFIG_PATH = path.join(os.homedir(), '.config', 'pi-task', 'config.json');
 const _g = globalThis;
 if (!_g.__piTaskConfig) {
@@ -125,23 +192,7 @@ const G = _g.__piTaskConfig;
 // before any session_start handler fires.
 if (!G.loaded) {
     try {
-        const raw = fs.readFileSync(CONFIG_PATH, 'utf8');
-        const parsed = JSON.parse(raw);
-        // A hand-edited or stale enum value must not leak an unknown provider
-        // into the dispatch switch — fall back to the default.
-        if (!isSearchProvider(parsed.searchProvider))
-            delete parsed.searchProvider;
-        parsed.extensionWhitelist = sanitizeExtensionWhitelist(parsed.extensionWhitelist);
-        parsed.requestTimeoutMs = sanitizeRequestTimeoutMs(parsed.requestTimeoutMs);
-        parsed.commandTimeoutExemptTools = sanitizeCommandTimeoutExemptTools(parsed.commandTimeoutExemptTools);
-        parsed.streamInactivityMs = sanitizeStreamInactivityMs(parsed.streamInactivityMs);
-        // A hand-edited `"yoloMode": "false"` is a truthy string — it must not
-        // silently switch a watched run into unattended auto-pick. Only a real
-        // boolean counts; anything else falls back to the OFF default.
-        if (typeof parsed.yoloMode !== 'boolean')
-            delete parsed.yoloMode;
-        parsed.debugLogs = sanitizeDebugLogs(parsed.debugLogs);
-        G.config = { ...DEFAULT_CONFIG, ...parsed };
+        G.config = loadConfig(JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf8')));
     }
     catch {
         G.config = { ...DEFAULT_CONFIG };

package/dist/shared/child-process.js

@@ -1,5 +1,6 @@
 import { spawn as defaultSpawn, spawnSync as spawnSyncDefault } from 'node:child_process';
 import { realStreamTimerDeps, StreamWatchdog } from './stream-watchdog.js';
+import { workerChannel } from '../workers/worker-channels.js';
 /** Grace period between SIGTERM and SIGKILL (ms). */
 export const KILL_GRACE_MS = 5000;
 /** Base flags shared by all child pi invocations. */
@@ -460,25 +461,17 @@ export function summarizeToolArgs(toolName, args) {
     if (!args || typeof args !== 'object')
         return '';
     const a = args;
-    const clip = (s) => {
-        const one = s.replace(/\s+/g, ' ').trim();
-        return one.length > 60 ? one.slice(0, 59) + '…' : one;
-    };
     if (toolName === 'bash' && typeof a.command === 'string') {
         return a.command.replace(/\s+/g, ' ').trim();
     }
-    if (toolName === 'pi-worker-docs'
-        && typeof a.module === 'string'
-        && typeof a.query === 'string') {
-        return `${a.module} "${clip(a.query)}"`;
-    }
-    // Search/fetch workers: without these the debug log shows a bare tool name
-    // and a run audit cannot tell WHAT was searched or fetched.
-    if (toolName === 'pi-worker-search' && typeof a.query === 'string') {
-        return `"${clip(a.query)}"`;
-    }
-    if (toolName === 'pi-worker-fetch' && typeof a.url === 'string') {
-        return clip(a.url);
+    // Each worker tool's argument shape is its own row's fact (worker-channels.ts);
+    // this used to be a third copy of the names AND a re-statement of each one's
+    // parameters. A row that has nothing to say falls through to the generic keys.
+    const channel = workerChannel(toolName);
+    if (channel) {
+        const summary = channel.summarize(a);
+        if (summary)
+            return summary;
     }
     if (typeof a.file_path === 'string')
         return a.file_path;

package/dist/task/accept-debt.d.ts

@@ -190,12 +190,12 @@ export declare function recheckAcceptDebts(debts: AcceptDebt[], opts: {
      * caller is expected to have made `pass` mean "ran, exited 0, and changed
      * nothing tracked" (`inv-no-write`).
      */
-    rerunVerify?: (command: string, debt: AcceptDebt) => VerifyRerunResult;
-}): {
+    rerunVerify?: (command: string, debt: AcceptDebt) => Promise<VerifyRerunResult>;
+}): Promise<{
     open: AcceptDebt[];
     resolved: AcceptDebt[];
     trail: string[];
-};
+}>;
 /**
  * Extract the paths whose EXISTENCE the reason asserts as the failure — a path
  * token immediately followed by "exists" / "still exists", or by "must/should not
@@ -247,7 +247,9 @@ export declare function describeDebt(d: AcceptDebt): string;
  * thing that can auto-close a static-class debt — so a caller that does not know
  * must pass `false` (unprovable ⇒ stays open), never a guess.
  */
-export declare function deriveOpenDebts(cwd: string, staticOk: boolean): Promise<{
+export declare function deriveOpenDebts(cwd: string, staticOk: boolean, 
+/** The spawner for the VERIFY-COMMAND re-runs. Defaults to the real one. */
+run?: CommandRunner, signal?: AbortSignal): Promise<{
     openDebts: AcceptDebt[];
     debtNote?: string;
     trail?: string[];
@@ -272,4 +274,4 @@ export declare function deriveOpenDebts(cwd: string, staticOk: boolean): Promise
 export declare function rerunDebtVerifyCommand(cwd: string, command: string, 
 /** The spawner, for BOTH the command and the tracked-state reads. Injected so
  *  the guard's four outcomes are testable without a repo or a real command. */
-run?: CommandRunner): VerifyRerunResult;
+run?: CommandRunner, signal?: AbortSignal): Promise<VerifyRerunResult>;

package/dist/task/accept-debt.js

@@ -29,6 +29,7 @@ import { existsSync } from 'node:fs';
 import * as path from 'node:path';
 import * as fsp from 'node:fs/promises';
 import { runVerifyCommandLine, spawnCommand } from './command-run.js';
+import { failClassOfReason, isStaticClass } from './verify-work.js';
 import { taskThatIntroduced } from './task-provenance.js';
 import { makeLedger } from './ledger.js';
 import { parseVerifyBlockStrict } from './spec-validation.js';
@@ -233,7 +234,7 @@ export async function writeAcceptDebts(cwd, debts) {
  * behavioral and cannot be proven resolved without re-running the model.
  */
 export function isStaticClassDebt(reason) {
-    return /^\s*repo health:/i.test(reason);
+    return isStaticClass(failClassOfReason(reason));
 }
 /**
  * The VERIFY-COMMAND class (nexttask 5): the ONE command a recorded reason itself
@@ -339,7 +340,7 @@ const MAX_VERIFY_RERUNS = 3;
  * passed. FP-safe: the only auto-closes are ones a deterministic check can stand
  * behind, and here the check is the task spec's own command.
  */
-export function recheckAcceptDebts(debts, opts) {
+export async function recheckAcceptDebts(debts, opts) {
     const open = [];
     const resolved = [];
     const trail = [];
@@ -381,7 +382,7 @@ export function recheckAcceptDebts(debts, opts) {
         rerunsLeft -= 1;
         let r;
         try {
-            r = opts.rerunVerify(cmd, d);
+            r = await opts.rerunVerify(cmd, d);
         }
         catch {
             // A harness fault observes nothing, so it proves nothing.
@@ -499,8 +500,10 @@ export function describeDebt(d) {
  * thing that can auto-close a static-class debt — so a caller that does not know
  * must pass `false` (unprovable ⇒ stays open), never a guess.
  */
-export async function deriveOpenDebts(cwd, staticOk) {
-    const { open: openRaw, resolved, trail } = recheckAcceptDebts(await readAcceptDebts(cwd), {
+export async function deriveOpenDebts(cwd, staticOk, 
+/** The spawner for the VERIFY-COMMAND re-runs. Defaults to the real one. */
+run = spawnCommand, signal) {
+    const { open: openRaw, resolved, trail } = await recheckAcceptDebts(await readAcceptDebts(cwd), {
         staticOk,
         // Cross-task-deletion debts auto-close iff the deleted file is back in the
         // tree — a deterministic existence check, corroborating the per-file
@@ -509,7 +512,7 @@ export async function deriveOpenDebts(cwd, staticOk) {
         // VERIFY-COMMAND class (nexttask 5): a debt that NAMES a command is settled
         // by running that command, under the gate's own env-gap contract and behind
         // the no-write guard below.
-        rerunVerify: cmd => rerunDebtVerifyCommand(cwd, cmd)
+        rerunVerify: cmd => rerunDebtVerifyCommand(cwd, cmd, run, signal)
     });
     if (resolved.length > 0)
         await writeAcceptDebts(cwd, openRaw);
@@ -552,26 +555,27 @@ const DEBT_INFRA_GAP_RE = /ERR_POSTGRES_CONNECTION_CLOSED|ERR_MYSQL_CONNECTION|E
  * the guard: the re-run is INCONCLUSIVE there, because "nothing changed" would be an
  * assumption rather than an observation.
  */
-export function rerunDebtVerifyCommand(cwd, command, 
+export async function rerunDebtVerifyCommand(cwd, command, 
 /** The spawner, for BOTH the command and the tracked-state reads. Injected so
  *  the guard's four outcomes are testable without a repo or a real command. */
-run = spawnCommand) {
-    const tracked = () => {
-        const r = run({
+run = spawnCommand, signal) {
+    const tracked = async () => {
+        const r = await run({
             cwd,
             bin: 'git',
             args: ['status', '--porcelain', '--untracked-files=no'],
-            timeoutMs: 60_000
+            timeoutMs: 60_000,
+            ...(signal === undefined ? {} : { signal })
         });
         return r.failedToStart || r.status !== 0 ? null : r.stdout;
     };
-    const before = tracked();
-    const r = runVerifyCommandLine(cwd, command, DEBT_RERUN_TIMEOUT_MS, DEBT_INFRA_GAP_RE, run);
+    const before = await tracked();
+    const r = await runVerifyCommandLine(cwd, command, DEBT_RERUN_TIMEOUT_MS, DEBT_INFRA_GAP_RE, run, signal);
     if (r.outcome === 'fail')
         return { outcome: 'fail', detail: `exit ${r.status} — ${r.tail}` };
     if (r.outcome === 'gap')
         return { outcome: 'gap', detail: r.detail };
-    const after = tracked();
+    const after = await tracked();
     if (before === null || after === null) {
         return { outcome: 'gap', detail: 'tracked-state guard could not read git status' };
     }

package/dist/task/artifact-closure.js

@@ -40,8 +40,9 @@
  * c.notFound()`): an existence guard is exactly how the bug presents (permanent
  * 404), so guarded reads deliberately do NOT step aside.
  */
-import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import * as path from 'node:path';
+import { shippedSources, stripCommentLines, SOURCE_HTML_RE, SOURCE_JS_RE } from './shipped-source.js';
 export function emptyProducers() {
     return {
         files: new Set(),
@@ -83,14 +84,6 @@ const hasExt = (p) => /\.[A-Za-z0-9]{1,8}$/.test(path.posix.basename(p));
 /** Source-only extensions nothing ships un-built: a missing one of these is hard
  *  evidence on its own (a script entrypoint like `bun src/server/index.ts`). */
 const SOURCE_ONLY_EXT_RE = /\.(?:ts|tsx|mts|cts|jsx)$/i;
-/** Strip comment-only lines (`// …`, `* …`) — a ref quoted in a comment is not a
- *  runtime read. Inline comments are left alone (strings may contain `//`). */
-function stripCommentLines(src) {
-    return src
-        .split('\n')
-        .filter(l => !/^\s*(?:\/\/|\*|\/\*)/.test(l))
-        .join('\n');
-}
 // Literal-first-argument read-side constructs. `[^'"\`\n]` keeps the argument on
 // one line and free of a closing quote; normalizeRefPath rejects `${…}` holes.
 const JS_READ_PATTERNS = [
@@ -229,7 +222,7 @@ export function collectEmittedHtml(source) {
     const writeRe = /\b(?:Bun\.write|writeFileSync|writeFile|fs\.promises\.writeFile)\(\s*(['"`])([^'"`\n]+)\1\s*,\s*/g;
     for (let m = writeRe.exec(src); m !== null; m = writeRe.exec(src)) {
         const docPath = normalizeRefPath(m[2]);
-        if (docPath === null || !SCAN_HTML_RE.test(docPath))
+        if (docPath === null || !SOURCE_HTML_RE.test(docPath))
             continue;
         const at = m.index + m[0].length;
         let html;
@@ -777,58 +770,20 @@ export function resolveDanglingRefs(refs, prod, exists) {
         out.push({ ...ref, reason });
     }
 }
-// Directories never scanned for referencing sources: VCS/dep/artifact trees,
-// every discovered produced dir (bundled output re-referencing its own chunks is
-// noise), and test/fixture/doc trees — those reference fixture paths and quoted
-// examples freely and are not the runtime serving surface this guard protects.
-const SKIP_DIR_RE = /^(?:\.git|node_modules|\.pi-tasks|dist|build|out|coverage|target|vendor|__pycache__|\.venv|venv|tmp|test|tests|__tests__|__fixtures__|fixtures|e2e|examples|example|docs|doc)$/;
-const SKIP_FILE_RE = /\.(?:test|spec|stories)\.[a-z]+$|\.d\.[mc]?ts$/i;
-const SCAN_JS_RE = /\.(?:ts|tsx|js|jsx|mjs|cjs|mts|cts)$/i;
-const SCAN_HTML_RE = /\.html?$/i;
-const MAX_SCAN_FILES = 3000;
-const MAX_FILE_BYTES = 400_000;
-/** Walk the tree for scannable sources (bounded, deterministic order). */
+// The tree walk, the caps and the skip sets live in task/shipped-source.ts —
+// this was serve-entry's walker written a second time, and the two skip sets had
+// drifted: `bench`/`benchmarks` and `*.bench.*` were skipped there and scanned
+// here, so a dangling reference in a benchmark was a run-level finding while the
+// same file was invisible to the sibling scan.
+//
+// `producedDirs` stays this scan's own: bundled output re-referencing its own
+// chunks is noise, and which dirs are produced is discovered per run.
 function scanCandidates(cwd, prod) {
-    const out = [];
-    const producedDirs = new Set([...prod.dirs, ...prod.opaque, ...prod.enumerable.keys()].map(d => d.split('/')[0]));
-    const walk = (rel) => {
-        if (out.length >= MAX_SCAN_FILES)
-            return;
-        let entries;
-        try {
-            entries = readdirSync(path.join(cwd, rel)).sort();
-        }
-        catch {
-            return;
-        }
-        for (const name of entries) {
-            if (out.length >= MAX_SCAN_FILES)
-                return;
-            const relPath = rel === '' ? name : `${rel}/${name}`;
-            let st;
-            try {
-                st = statSync(path.join(cwd, relPath));
-            }
-            catch {
-                continue;
-            }
-            if (st.isDirectory()) {
-                if (name.startsWith('.') || SKIP_DIR_RE.test(name))
-                    continue;
-                if (rel === '' && producedDirs.has(name))
-                    continue;
-                walk(relPath);
-            }
-            else if (st.isFile() && st.size <= MAX_FILE_BYTES) {
-                if (SKIP_FILE_RE.test(name))
-                    continue;
-                if (SCAN_JS_RE.test(name) || SCAN_HTML_RE.test(name))
-                    out.push(relPath);
-            }
-        }
-    };
-    walk('');
-    return out;
+    const producedRoots = new Set([...prod.dirs, ...prod.opaque, ...prod.enumerable.keys()].map(d => d.split('/')[0]));
+    return shippedSources(cwd, {
+        ext: new RegExp(`${SOURCE_JS_RE.source}|${SOURCE_HTML_RE.source}`, 'i'),
+        excludeRoots: producedRoots
+    });
 }
 /**
  * FINAL-GATE seam: scan the shipped tree for dangling runtime references.
@@ -855,7 +810,7 @@ export function findDanglingArtifacts(cwd) {
         catch {
             continue;
         }
-        if (SCAN_HTML_RE.test(rel)) {
+        if (SOURCE_HTML_RE.test(rel)) {
             refs.push(...extractHtmlRefs(src, rel));
         }
         else {
@@ -901,7 +856,7 @@ export function collectGeneratedHtmlRefs(cwd) {
     const production = discoverProducers(cwd, { excludeDevScripts: true });
     const sources = [];
     for (const rel of scanCandidates(cwd, full)) {
-        if (SCAN_HTML_RE.test(rel))
+        if (SOURCE_HTML_RE.test(rel))
             continue;
         let src;
         try {