@mjasnikovs/pi-task 0.38.16 → 0.38.18

package/dist/config/config.d.ts

@@ -189,5 +189,42 @@ export declare const DEFAULT_CONFIG: PiTaskConfig;
  * object/number can't reach the child argv as `-e [object Object]`.
  */
 export declare function sanitizeExtensionWhitelist(value: unknown): string[];
+/**
+ * How each setting's STORED value becomes a safe in-memory value — one loader per
+ * key, keyed on the config's own type.
+ *
+ * `ConfigItem` (config/register.ts) already absorbed three of the four edits its
+ * own header names: *"Adding one enum setting meant four coordinated edits (row,
+ * format arm, parse arm, sanitizer) and NONE of them failed to compile if you
+ * forgot it."* The sanitizer was the fourth, and it stayed behind in this file as
+ * a hand-ordered statement ladder covering 7 of 14 keys. This is the mapped type
+ * that closes it: a new field on `PiTaskConfig` is a compile error until it
+ * declares how a hostile value becomes a safe one.
+ */
+export declare const CONFIG_LOADERS: {
+    [K in keyof PiTaskConfig]: (raw: unknown) => PiTaskConfig[K];
+};
+/**
+ * Turn parsed config JSON into a `PiTaskConfig`. Pure — this is the seam the load
+ * block used to have none of, so every hostile-value case was reachable only
+ * through `getConfig()`, which reads the developer's own machine.
+ *
+ * A non-object `raw` yields the defaults. That is not merely defensive: the old
+ * block spread `parsed` directly, and `{...DEFAULT_CONFIG, ...'ab'}` produces
+ * numeric index keys. Keys absent from the table are dropped rather than carried
+ * into the config object.
+ */
+export declare function loadConfig(raw: unknown): PiTaskConfig;
+/**
+ * Where the saved config lives. `PI_TASK_CONFIG_PATH` overrides it.
+ *
+ * The override exists because this module loads the real file at import time,
+ * which made every test that reads a config value depend on the developer's own
+ * `~/.config/pi-task/config.json` — a machine-local `"debugLogs": "off"` failed
+ * 12 tests here while CI (no config file at all) stayed green. The test preload
+ * points this at a path under the tmp dir that never exists, so tests always see
+ * DEFAULT_CONFIG. Read once at module eval: the preload runs before any import.
+ */
+export declare const CONFIG_PATH_ENV = "PI_TASK_CONFIG_PATH";
 export declare function getConfig(): PiTaskConfig;
 export declare function saveConfig(config: PiTaskConfig): Promise<void>;

package/dist/config/config.js

@@ -115,7 +115,86 @@ export function sanitizeExtensionWhitelist(value) {
         return [];
     return value.filter((p) => typeof p === 'string' && p.trim().length > 0);
 }
-const CONFIG_PATH = path.join(os.homedir(), '.config', 'pi-task', 'config.json');
+/**
+ * A boolean setting's loader. Only a REAL boolean counts; anything else falls
+ * back to the shipped default.
+ *
+ * This is `yoloMode`'s guard, generalised. Its comment — *"a hand-edited
+ * `"yoloMode": "false"` is a truthy string"* — was true verbatim of the other
+ * seven booleans, none of which had it, so a stale `"verifyWork": "off"` reached
+ * `getConfig().verifyWork` as truthy and a `"autoCommit": 0` reached it as falsy.
+ */
+function asBoolean(key) {
+    return raw => (typeof raw === 'boolean' ? raw : DEFAULT_CONFIG[key]);
+}
+/**
+ * How each setting's STORED value becomes a safe in-memory value — one loader per
+ * key, keyed on the config's own type.
+ *
+ * `ConfigItem` (config/register.ts) already absorbed three of the four edits its
+ * own header names: *"Adding one enum setting meant four coordinated edits (row,
+ * format arm, parse arm, sanitizer) and NONE of them failed to compile if you
+ * forgot it."* The sanitizer was the fourth, and it stayed behind in this file as
+ * a hand-ordered statement ladder covering 7 of 14 keys. This is the mapped type
+ * that closes it: a new field on `PiTaskConfig` is a compile error until it
+ * declares how a hostile value becomes a safe one.
+ */
+export const CONFIG_LOADERS = {
+    remote: asBoolean('remote'),
+    autoCommit: asBoolean('autoCommit'),
+    orientation: asBoolean('orientation'),
+    enforceGuidelines: asBoolean('enforceGuidelines'),
+    verifyWork: asBoolean('verifyWork'),
+    parallelResearchWorkers: asBoolean('parallelResearchWorkers'),
+    researchCache: asBoolean('researchCache'),
+    yoloMode: asBoolean('yoloMode'),
+    // A hand-edited or stale enum value must not leak an unknown provider into
+    // the dispatch switch — fall back to the default.
+    searchProvider: raw => (isSearchProvider(raw) ? raw : DEFAULT_CONFIG.searchProvider),
+    extensionWhitelist: sanitizeExtensionWhitelist,
+    requestTimeoutMs: sanitizeRequestTimeoutMs,
+    commandTimeoutExemptTools: sanitizeCommandTimeoutExemptTools,
+    streamInactivityMs: sanitizeStreamInactivityMs,
+    debugLogs: sanitizeDebugLogs
+};
+/**
+ * Turn parsed config JSON into a `PiTaskConfig`. Pure — this is the seam the load
+ * block used to have none of, so every hostile-value case was reachable only
+ * through `getConfig()`, which reads the developer's own machine.
+ *
+ * A non-object `raw` yields the defaults. That is not merely defensive: the old
+ * block spread `parsed` directly, and `{...DEFAULT_CONFIG, ...'ab'}` produces
+ * numeric index keys. Keys absent from the table are dropped rather than carried
+ * into the config object.
+ */
+export function loadConfig(raw) {
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {
+        return { ...DEFAULT_CONFIG };
+    }
+    const stored = raw;
+    const out = { ...DEFAULT_CONFIG };
+    for (const key of Object.keys(CONFIG_LOADERS)) {
+        // `undefined` reaches the loader like any other hostile value: every
+        // loader answers a missing key with its own default, which is what the
+        // old `delete parsed.X` + spread did.
+        ;
+        out[key] = CONFIG_LOADERS[key](stored[key]);
+    }
+    return out;
+}
+/**
+ * Where the saved config lives. `PI_TASK_CONFIG_PATH` overrides it.
+ *
+ * The override exists because this module loads the real file at import time,
+ * which made every test that reads a config value depend on the developer's own
+ * `~/.config/pi-task/config.json` — a machine-local `"debugLogs": "off"` failed
+ * 12 tests here while CI (no config file at all) stayed green. The test preload
+ * points this at a path under the tmp dir that never exists, so tests always see
+ * DEFAULT_CONFIG. Read once at module eval: the preload runs before any import.
+ */
+export const CONFIG_PATH_ENV = 'PI_TASK_CONFIG_PATH';
+const CONFIG_PATH = process.env[CONFIG_PATH_ENV]?.trim()
+    || path.join(os.homedir(), '.config', 'pi-task', 'config.json');
 const _g = globalThis;
 if (!_g.__piTaskConfig) {
     _g.__piTaskConfig = { config: { ...DEFAULT_CONFIG }, loaded: false };
@@ -125,23 +204,7 @@ const G = _g.__piTaskConfig;
 // before any session_start handler fires.
 if (!G.loaded) {
     try {
-        const raw = fs.readFileSync(CONFIG_PATH, 'utf8');
-        const parsed = JSON.parse(raw);
-        // A hand-edited or stale enum value must not leak an unknown provider
-        // into the dispatch switch — fall back to the default.
-        if (!isSearchProvider(parsed.searchProvider))
-            delete parsed.searchProvider;
-        parsed.extensionWhitelist = sanitizeExtensionWhitelist(parsed.extensionWhitelist);
-        parsed.requestTimeoutMs = sanitizeRequestTimeoutMs(parsed.requestTimeoutMs);
-        parsed.commandTimeoutExemptTools = sanitizeCommandTimeoutExemptTools(parsed.commandTimeoutExemptTools);
-        parsed.streamInactivityMs = sanitizeStreamInactivityMs(parsed.streamInactivityMs);
-        // A hand-edited `"yoloMode": "false"` is a truthy string — it must not
-        // silently switch a watched run into unattended auto-pick. Only a real
-        // boolean counts; anything else falls back to the OFF default.
-        if (typeof parsed.yoloMode !== 'boolean')
-            delete parsed.yoloMode;
-        parsed.debugLogs = sanitizeDebugLogs(parsed.debugLogs);
-        G.config = { ...DEFAULT_CONFIG, ...parsed };
+        G.config = loadConfig(JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf8')));
     }
     catch {
         G.config = { ...DEFAULT_CONFIG };

package/dist/task/accept-debt.js

@@ -29,6 +29,7 @@ import { existsSync } from 'node:fs';
 import * as path from 'node:path';
 import * as fsp from 'node:fs/promises';
 import { runVerifyCommandLine, spawnCommand } from './command-run.js';
+import { failClassOfReason, isStaticClass } from './verify-work.js';
 import { taskThatIntroduced } from './task-provenance.js';
 import { makeLedger } from './ledger.js';
 import { parseVerifyBlockStrict } from './spec-validation.js';
@@ -233,7 +234,7 @@ export async function writeAcceptDebts(cwd, debts) {
  * behavioral and cannot be proven resolved without re-running the model.
  */
 export function isStaticClassDebt(reason) {
-    return /^\s*repo health:/i.test(reason);
+    return isStaticClass(failClassOfReason(reason));
 }
 /**
  * The VERIFY-COMMAND class (nexttask 5): the ONE command a recorded reason itself

package/dist/task/artifact-closure.js

@@ -40,8 +40,9 @@
  * c.notFound()`): an existence guard is exactly how the bug presents (permanent
  * 404), so guarded reads deliberately do NOT step aside.
  */
-import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import * as path from 'node:path';
+import { shippedSources, stripCommentLines, SOURCE_HTML_RE, SOURCE_JS_RE } from './shipped-source.js';
 export function emptyProducers() {
     return {
         files: new Set(),
@@ -83,14 +84,6 @@ const hasExt = (p) => /\.[A-Za-z0-9]{1,8}$/.test(path.posix.basename(p));
 /** Source-only extensions nothing ships un-built: a missing one of these is hard
  *  evidence on its own (a script entrypoint like `bun src/server/index.ts`). */
 const SOURCE_ONLY_EXT_RE = /\.(?:ts|tsx|mts|cts|jsx)$/i;
-/** Strip comment-only lines (`// …`, `* …`) — a ref quoted in a comment is not a
- *  runtime read. Inline comments are left alone (strings may contain `//`). */
-function stripCommentLines(src) {
-    return src
-        .split('\n')
-        .filter(l => !/^\s*(?:\/\/|\*|\/\*)/.test(l))
-        .join('\n');
-}
 // Literal-first-argument read-side constructs. `[^'"\`\n]` keeps the argument on
 // one line and free of a closing quote; normalizeRefPath rejects `${…}` holes.
 const JS_READ_PATTERNS = [
@@ -229,7 +222,7 @@ export function collectEmittedHtml(source) {
     const writeRe = /\b(?:Bun\.write|writeFileSync|writeFile|fs\.promises\.writeFile)\(\s*(['"`])([^'"`\n]+)\1\s*,\s*/g;
     for (let m = writeRe.exec(src); m !== null; m = writeRe.exec(src)) {
         const docPath = normalizeRefPath(m[2]);
-        if (docPath === null || !SCAN_HTML_RE.test(docPath))
+        if (docPath === null || !SOURCE_HTML_RE.test(docPath))
             continue;
         const at = m.index + m[0].length;
         let html;
@@ -777,58 +770,20 @@ export function resolveDanglingRefs(refs, prod, exists) {
         out.push({ ...ref, reason });
     }
 }
-// Directories never scanned for referencing sources: VCS/dep/artifact trees,
-// every discovered produced dir (bundled output re-referencing its own chunks is
-// noise), and test/fixture/doc trees — those reference fixture paths and quoted
-// examples freely and are not the runtime serving surface this guard protects.
-const SKIP_DIR_RE = /^(?:\.git|node_modules|\.pi-tasks|dist|build|out|coverage|target|vendor|__pycache__|\.venv|venv|tmp|test|tests|__tests__|__fixtures__|fixtures|e2e|examples|example|docs|doc)$/;
-const SKIP_FILE_RE = /\.(?:test|spec|stories)\.[a-z]+$|\.d\.[mc]?ts$/i;
-const SCAN_JS_RE = /\.(?:ts|tsx|js|jsx|mjs|cjs|mts|cts)$/i;
-const SCAN_HTML_RE = /\.html?$/i;
-const MAX_SCAN_FILES = 3000;
-const MAX_FILE_BYTES = 400_000;
-/** Walk the tree for scannable sources (bounded, deterministic order). */
+// The tree walk, the caps and the skip sets live in task/shipped-source.ts —
+// this was serve-entry's walker written a second time, and the two skip sets had
+// drifted: `bench`/`benchmarks` and `*.bench.*` were skipped there and scanned
+// here, so a dangling reference in a benchmark was a run-level finding while the
+// same file was invisible to the sibling scan.
+//
+// `producedDirs` stays this scan's own: bundled output re-referencing its own
+// chunks is noise, and which dirs are produced is discovered per run.
 function scanCandidates(cwd, prod) {
-    const out = [];
-    const producedDirs = new Set([...prod.dirs, ...prod.opaque, ...prod.enumerable.keys()].map(d => d.split('/')[0]));
-    const walk = (rel) => {
-        if (out.length >= MAX_SCAN_FILES)
-            return;
-        let entries;
-        try {
-            entries = readdirSync(path.join(cwd, rel)).sort();
-        }
-        catch {
-            return;
-        }
-        for (const name of entries) {
-            if (out.length >= MAX_SCAN_FILES)
-                return;
-            const relPath = rel === '' ? name : `${rel}/${name}`;
-            let st;
-            try {
-                st = statSync(path.join(cwd, relPath));
-            }
-            catch {
-                continue;
-            }
-            if (st.isDirectory()) {
-                if (name.startsWith('.') || SKIP_DIR_RE.test(name))
-                    continue;
-                if (rel === '' && producedDirs.has(name))
-                    continue;
-                walk(relPath);
-            }
-            else if (st.isFile() && st.size <= MAX_FILE_BYTES) {
-                if (SKIP_FILE_RE.test(name))
-                    continue;
-                if (SCAN_JS_RE.test(name) || SCAN_HTML_RE.test(name))
-                    out.push(relPath);
-            }
-        }
-    };
-    walk('');
-    return out;
+    const producedRoots = new Set([...prod.dirs, ...prod.opaque, ...prod.enumerable.keys()].map(d => d.split('/')[0]));
+    return shippedSources(cwd, {
+        ext: new RegExp(`${SOURCE_JS_RE.source}|${SOURCE_HTML_RE.source}`, 'i'),
+        excludeRoots: producedRoots
+    });
 }
 /**
  * FINAL-GATE seam: scan the shipped tree for dangling runtime references.
@@ -855,7 +810,7 @@ export function findDanglingArtifacts(cwd) {
         catch {
             continue;
         }
-        if (SCAN_HTML_RE.test(rel)) {
+        if (SOURCE_HTML_RE.test(rel)) {
             refs.push(...extractHtmlRefs(src, rel));
         }
         else {
@@ -901,7 +856,7 @@ export function collectGeneratedHtmlRefs(cwd) {
     const production = discoverProducers(cwd, { excludeDevScripts: true });
     const sources = [];
     for (const rel of scanCandidates(cwd, full)) {
-        if (SCAN_HTML_RE.test(rel))
+        if (SOURCE_HTML_RE.test(rel))
             continue;
         let src;
         try {