@mjasnikovs/pi-task 0.38.29 → 0.38.30

package/dist/task/gate-child.d.ts

@@ -5,28 +5,24 @@
  * Five children run under the gates: `verify`, `recommend`, `lint-fix`,
  * `final-fix` and `enforce`. All five share one ritual — reset the widget state,
  * stamp the start, open a per-gate debug log, write a start marker, raise a
- * status loader, call `runWorker` unguarded (no wall clock, exact-match loop
- * guard only), warn on a surviving loop, classify the failure, write an end
- * marker, throw on failure, and stop the loader in a `finally`. That was ~85
- * lines, and it was written TWICE: once as `makeGateChild` and once as an inline
- * closure for `enforce`, whose comments repeated the originals verbatim.
+ * status loader, call `runWorker` on the `gate` profile (no wall clock; the
+ * path-revisit loop rule disabled, leaving the exact-match rule), warn on a
+ * surviving loop, classify the failure, write an end marker, throw on failure,
+ * and stop the loader — `ChildStatus.track` does that last one in a `finally`,
+ * so a throwing child never leaves the widget up.
  *
- * The enforce copy differed in exactly four things — no git-state guard, no
- * tool-result logging, no tree-change capture, and a different end marker — which
- * is why they are row data here rather than a forked body. Apply the deletion
- * test to that copy and it passes: routing enforce through this concentrates the
- * differences into a table instead of moving them.
+ * Only THREE of the differences between the kinds are row data below: the
+ * git-state guard, tool-result logging, and the end marker (plus the loader's
+ * step label). Tree-change capture is deliberately NOT a row — it is decided at
+ * the bottom of this file by a test on the child's TOOLS, so a future
+ * write-capable kind gets it without anyone remembering to set a flag.
  *
- * The second reason for the module is that all of it used to live inside
- * `buildGateDeps`'s closure, so nothing about it was reachable from a test:
- * `buildGateDeps` is ~700 lines and is never called by the suite. The
- * git-state-guard wiring in particular — snapshot, restore-in-`finally`,
- * `verdictTainted` — is the mechanism that discards a verify verdict computed on
- * a tree the child mutated (mx5 run 6, where the verify child `git stash`ed the
- * task's uncommitted work and never popped it), and it could only be checked
- * indirectly through a fake `mutationCheck` one layer up. Here `runWorker` and
- * the git helpers are injected, so the ordering, the trail lines and the
- * throwing-child path are all directly assertable.
+ * The module exists so this is reachable from a test at all. It would otherwise
+ * live inside `buildGateDeps`'s closure, and the git-state-guard wiring in
+ * particular — snapshot, restore-in-`finally`, `verdictTainted` — is what
+ * discards a verify verdict computed on a tree the child itself mutated. Here
+ * `runWorker` and the git helpers are injected, so the ordering, the trail lines
+ * and the throwing-child path are directly assertable.
  */
 import type { ExtensionCommandContext } from '@earendil-works/pi-coding-agent';
 import type { RunWorkerInput, RunWorkerResult } from '../workers/pi-worker-core.js';
@@ -36,16 +32,17 @@ import type { ChildStatus } from './child-status.js';
 export type GateChildKind = 'verify' | 'recommend' | 'lint-fix' | 'final-fix' | 'enforce';
 export interface GateChildRow {
     /**
-     * Snapshot the tree before and restore after. These children are read-only BY
-     * CONTRACT, but the contract is prompt-level and the live model breaks it.
-     * `lint-fix` and `final-fix` are excluded because editing is their job (they
-     * carry their own revert guards), and `enforce` because it edits too.
+     * Snapshot the tree before and restore after. `verify` and `recommend` are
+     * read-only BY CONTRACT, but that contract is only prompt-level — nothing
+     * stops the child mutating the tree, so the restore is what makes it hold.
+     * `lint-fix` and `final-fix` are excluded because editing is their job and
+     * they carry their own revert guards; `enforce` because it edits too.
      */
     guarded: boolean;
     /**
-     * Log tool OUTPUTS, not just the calls (mx5 run 10 item 6): without the result,
-     * "verify claimed curl PASS on a server that cannot serve" is undecidable from
-     * the log. Off for `enforce`, whose log is a per-pass verdict trail.
+     * Log tool OUTPUTS, not just the calls. Without the result, a claim like
+     * "verify ran curl and it passed" cannot be checked against what the command
+     * actually printed. Off for `enforce`, whose log is a per-pass verdict trail.
      */
     logToolResults: boolean;
     /** The loader's step label. */
@@ -71,7 +68,9 @@ export interface GateChildDeps {
      * verify gate does). Two loaders on one widget key only fight each other.
      */
     loader?: boolean;
-    /** Per-command ceiling; pi's bash tool has no default timeout. */
+    /** Per-command ceiling. pi's bash tool has none of its own: its schema
+     *  describes `timeout` as "optional, no default timeout", and
+     *  `resolveTimeoutMs(undefined)` returns undefined. */
     commandTimeoutMs: number;
     /** Hung-stream bound; the probe-based stall guard cannot supply it. */
     streamInactivityMs: number;

package/dist/task/gate-child.js

@@ -5,28 +5,24 @@
  * Five children run under the gates: `verify`, `recommend`, `lint-fix`,
  * `final-fix` and `enforce`. All five share one ritual — reset the widget state,
  * stamp the start, open a per-gate debug log, write a start marker, raise a
- * status loader, call `runWorker` unguarded (no wall clock, exact-match loop
- * guard only), warn on a surviving loop, classify the failure, write an end
- * marker, throw on failure, and stop the loader in a `finally`. That was ~85
- * lines, and it was written TWICE: once as `makeGateChild` and once as an inline
- * closure for `enforce`, whose comments repeated the originals verbatim.
+ * status loader, call `runWorker` on the `gate` profile (no wall clock; the
+ * path-revisit loop rule disabled, leaving the exact-match rule), warn on a
+ * surviving loop, classify the failure, write an end marker, throw on failure,
+ * and stop the loader — `ChildStatus.track` does that last one in a `finally`,
+ * so a throwing child never leaves the widget up.
  *
- * The enforce copy differed in exactly four things — no git-state guard, no
- * tool-result logging, no tree-change capture, and a different end marker — which
- * is why they are row data here rather than a forked body. Apply the deletion
- * test to that copy and it passes: routing enforce through this concentrates the
- * differences into a table instead of moving them.
+ * Only THREE of the differences between the kinds are row data below: the
+ * git-state guard, tool-result logging, and the end marker (plus the loader's
+ * step label). Tree-change capture is deliberately NOT a row — it is decided at
+ * the bottom of this file by a test on the child's TOOLS, so a future
+ * write-capable kind gets it without anyone remembering to set a flag.
  *
- * The second reason for the module is that all of it used to live inside
- * `buildGateDeps`'s closure, so nothing about it was reachable from a test:
- * `buildGateDeps` is ~700 lines and is never called by the suite. The
- * git-state-guard wiring in particular — snapshot, restore-in-`finally`,
- * `verdictTainted` — is the mechanism that discards a verify verdict computed on
- * a tree the child mutated (mx5 run 6, where the verify child `git stash`ed the
- * task's uncommitted work and never popped it), and it could only be checked
- * indirectly through a fake `mutationCheck` one layer up. Here `runWorker` and
- * the git helpers are injected, so the ordering, the trail lines and the
- * throwing-child path are all directly assertable.
+ * The module exists so this is reachable from a test at all. It would otherwise
+ * live inside `buildGateDeps`'s closure, and the git-state-guard wiring in
+ * particular — snapshot, restore-in-`finally`, `verdictTainted` — is what
+ * discards a verify verdict computed on a tree the child itself mutated. Here
+ * `runWorker` and the git helpers are injected, so the ordering, the trail lines
+ * and the throwing-child path are directly assertable.
  */
 import { formatLoopHint } from './child-runner.js';
 import { classifyEnforceChildFailure } from './enforce-guidelines.js';
@@ -64,9 +60,11 @@ export function makeGateChild(deps) {
         deps.status.reset();
         const startedAt = Date.now();
         // Every marker below (start/end, the guard's restore, the loop warning, a
-        // write-capable child's tree changes) is a guard record that survives at
-        // the default level. Only the child's own stdout and its tool results
-        // pass 'stream'.
+        // write-capable child's tree changes) goes through `log` with no kind, so
+        // it defaults to 'event'. The shipped default level is 'events', where
+        // shouldLogDebug keeps 'event' and drops 'stream' — so the audit trail
+        // survives while the child's own stdout and its tool results, the only
+        // things passed as 'stream', do not.
         const log = deps.makeDebugAppender(deps.logPath);
         log(`=== ${deps.kind} start: ${deps.taskTitle} ===`);
         const guardSnapshot = row.guarded ? await deps.captureGitState(deps.cwd, sig) : null;
@@ -88,12 +86,13 @@ export function makeGateChild(deps) {
                     cwd: deps.cwd,
                     ...(sig ? { signal: sig } : {}),
                     tools,
-                    // The four guard literals that used to sit here — run to
-                    // completion, a per-command watchdog, a stream watchdog, and
-                    // the path rule disabled — are the `gate` row of
-                    // WORKER_PROFILES (workers/worker-profiles.ts), which carries
-                    // the reasoning for each. The two ceilings stay inputs
-                    // because they are user config, not policy.
+                    // The four guard literals — run to completion, a per-command
+                    // watchdog, a stream watchdog, and the path-revisit rule
+                    // disabled — are the `gate` row of WORKER_PROFILES
+                    // (workers/worker-profiles.ts), whose resolve() sets
+                    // worker-timeout to {timeoutMs: 0} and pathThreshold to
+                    // Infinity. The two ceilings stay inputs because they are user
+                    // config, not policy.
                     profile: 'gate',
                     policyInputs: {
                         commandTimeoutMs: deps.commandTimeoutMs,
@@ -122,8 +121,10 @@ export function makeGateChild(deps) {
                         }
                         : {}),
                     onContextUsage: snapshot => deps.status.onContextUsage(snapshot),
-                    // The gate child has to be TOLD its window: nothing in pi's
-                    // event stream reports one (issue #16).
+                    // The gate child has to be TOLD its window. pi's session event
+                    // stream — what `--mode json` emits — carries token counts but
+                    // no context window; `contextWindow` appears nowhere in
+                    // agent-session.d.ts.
                     contextWindow: deps.status.parentContextWindow
                 });
             }
@@ -164,10 +165,10 @@ export function makeGateChild(deps) {
                 : `=== ${deps.kind} end: ${row.okMarker} ===`);
             if (failure)
                 throw new Error(failure);
-            // CAPABILITY-LEVEL diff capture (mx5 run 11): any WRITE-capable child —
-            // decided by its TOOLS, not by which phase spawned it — gets its tree
-            // changes logged, so a future write-capable kind cannot run invisibly
-            // the way the final-fix child's `rm` did.
+            // CAPABILITY-LEVEL diff capture: any WRITE-capable child — decided by
+            // its TOOLS, not by which phase spawned it or by a row in the table
+            // above — gets its tree changes logged, so a future write-capable kind
+            // cannot run invisibly.
             if (/\b(?:edit|bash|write)\b/.test(tools)) {
                 log(`=== ${deps.kind} tree changes: `
                     + `${await deps.describeTreeChanges(deps.cwd, sig)} ===`);

package/dist/task/gate-deps.d.ts

@@ -10,8 +10,11 @@ import { type TreeChangeSummary, type IgnoredSnapshot } from './write-guard.js';
 export type RunTaskFn = GateDeps['runTask'];
 /**
  * One-line, tail-kept, whitespace-flattened summary of a tool's output for the gate
- * debug log. The TAIL is kept (a bind failure / final status / assertion lands at the
- * end of the output) with a leading ellipsis when truncated; empty output → "(no output)".
+ * debug log. The TAIL is kept — a bind failure, a final status or an assertion
+ * lands at the END of the output — with a leading ellipsis when truncated.
+ * Measured: all-whitespace and empty input both give "(no output)", internal
+ * newlines collapse to single spaces, and a 410-char input comes back 301 chars
+ * long, starting `…` and ending on the input's last characters.
  */
 export declare function truncateToolResult(text: string, limit?: number): string;
 /** One bounded final-gate fix attempt (see final-gate-fix.ts): fix child →
@@ -32,7 +35,7 @@ ignoredKnown?: string[]) => Promise<FinalFixResult>;
 export declare function collectChangedFiles(cwd: string, signal?: AbortSignal): Promise<ChangedFile[]>;
 /**
  * Collect the task's added lines WITH CONTENT (path + text) for the probe-gaming
- * probe (F6), which needs the actual line text the numstat-shape collector omits.
+ * probe, which needs the actual line text the numstat-shape collector omits.
  * Pre-commit the work is the tree-vs-HEAD diff plus untracked files (read whole, as
  * all-added); on the post-enforce re-verify the tree is clean, so fall back to the
  * last commit's diff. Failures degrade to an empty list — the probe is a sharpener,
@@ -40,10 +43,10 @@ export declare function collectChangedFiles(cwd: string, signal?: AbortSignal):
  */
 export declare function collectAddedLines(cwd: string, signal?: AbortSignal): Promise<AddedLine[]>;
 /**
- * Deterministic sandbox-path-leak pass (see foreign-path.ts, mx5 run 13 PROMPT 4
- * item 1): find absolute paths the task committed that resolve nowhere on this
- * machine while the real file sits in the repo, REPAIR the ones whose relative
- * form provably resolves, and return verify findings for whatever is left.
+ * Deterministic sandbox-path-leak pass (see foreign-path.ts): find absolute paths
+ * the task committed that resolve nowhere on this machine while the real file sits
+ * in the repo, REPAIR the ones whose relative form provably resolves, and return
+ * verify findings for whatever is left.
  *
  * The repair runs here, before the verify child, for the same reason lint-fix
  * does: the defect is mechanical and the correct target is already known, so
@@ -53,9 +56,8 @@ export declare function collectAddedLines(cwd: string, signal?: AbortSignal): Pr
  */
 export declare function collectForeignPathFindings(cwd: string, signal?: AbortSignal, logDebug?: (m: string) => void): Promise<string[]>;
 /**
- * Deterministic neutered-check-script pass (see script-escape.ts, mx5 run 13 PROMPT
- * 4 item 4): check-class scripts that cannot report failure, in a manifest THIS
- * task changed.
+ * Deterministic neutered-check-script pass (see script-escape.ts): check-class
+ * scripts that cannot report failure, in a manifest THIS task changed.
  *
  * Scoped to manifests the task touched, so the finding lands on the task that
  * authored the script rather than being re-served to every later task. A script
@@ -66,10 +68,9 @@ export declare function collectForeignPathFindings(cwd: string, signal?: AbortSi
  */
 export declare function collectScriptEscapeFindings(cwd: string, signal?: AbortSignal): Promise<string[]>;
 /**
- * Deterministic test-runner glob-collision pass (see runner-globs.ts, mx5 runs 7 AND
- * 13, PROMPT 4 item 2): the manifest declares both `bun test` and `playwright test`
- * without a provably disjoint file set, so `bun test` imports the playwright specs
- * and dies during collection.
+ * Deterministic test-runner glob-collision pass (see runner-globs.ts): the manifest
+ * declares both `bun test` and `playwright test` without a provably disjoint file
+ * set, so `bun test` imports the playwright specs and dies during collection.
  *
  * Whole-repo rather than diff-scoped, unlike the neutered-script probe: a collision
  * is a property of the PAIR of declarations, and the task that completes the pair is
@@ -85,24 +86,30 @@ export declare function collectRunnerGlobFindings(cwd: string): Promise<string[]
  */
 export declare function collectTreeChanges(cwd: string, signal?: AbortSignal): Promise<TreeChangeSummary>;
 /**
- * Build output directories declared by the project's OWN build commands
- * (`--outdir=X`, `--out-dir X`), so the ignored-write exemption follows the real
- * tooling instead of a name list. Best-effort: an unreadable or non-JSON manifest
- * contributes nothing and the name-list fallback in classifyIgnoredPath applies.
+ * Build output directories declared by the project's OWN build commands, so the
+ * ignored-write exemption follows the real tooling instead of a name list.
+ *
+ * The pattern is `--outdir` or `--out-dir`, LOWERCASE, followed by `=` or a space.
+ * Measured on a manifest declaring all four spellings: `--outdir=./dist/` yields
+ * `dist` and `--out-dir build` yields `build`, while `--outDir out` (tsc's
+ * spelling) yields nothing and a bare `--outdir -` is dropped by the leading-dash
+ * guard. Best-effort: an unreadable or non-JSON manifest contributes nothing and
+ * the name-list fallback in classifyIgnoredPath applies.
  */
 export declare function parseBuildOutdirs(cwd: string): string[];
 /**
- * IGNORED-PATH CHANNEL (mx5 run 19 — see write-guard.ts). A fingerprint of every
+ * IGNORED-PATH CHANNEL (see write-guard.ts). A fingerprint of every
  * ACTIONABLE ignored path (`git status --porcelain --ignored=matching`, minus
  * build output / node_modules / .pi-tasks / .git), taken before and after a
  * write-capable gate child so its writes to files git never reports are
  * attributable to it.
  *
  * `--ignored=matching` collapses a wholly-ignored directory into ONE entry, which
- * is what keeps this cheap: `node_modules/` is one exempt line, never 40,000
- * stats. Every failure mode degrades to `{}` — no git, an older git that rejects
- * `--ignored=matching`, an unreadable path — so the gate behaves exactly as it did
- * before this channel existed.
+ * is what keeps this cheap: run against a repo ignoring `logs/`, `node_modules/`
+ * and `.env`, with files in all three, it reports exactly three lines —
+ * `!! .env`, `!! logs/`, `!! node_modules/` — never one per file. Every failure
+ * mode degrades to `{}` (no git, a git that rejects the flag, an unreadable path),
+ * so the gate behaves as if the channel were absent.
  */
 export declare function collectIgnoredSnapshot(cwd: string, signal?: AbortSignal): Promise<IgnoredSnapshot>;
 /**
@@ -128,9 +135,9 @@ export declare function gatePassesWithoutIgnored(cwd: string, paths: string[], r
  */
 export declare function collectTaskTreeChanges(cwd: string, signal?: AbortSignal): Promise<TreeChangeSummary>;
 /**
- * Deterministic test-assembly probe input (see test-assembly.ts, run-8 F4): read the
- * task's own changed TEST files plus the repo's tracked source files, and return the
- * finding lines naming any test that rebuilds a production assembly it never imports.
+ * Deterministic test-assembly probe input: read the task's own changed TEST files
+ * plus the repo's tracked source files, and return the finding lines naming any
+ * test that rebuilds a production assembly it never imports.
  * Pure import-graph shape; failures degrade to no findings (the probe is a sharpener,
  * never a blocker). `changed` is the already-collected task diff, reused so the probe
  * costs one extra tracked-file listing, not a second diff.
@@ -142,7 +149,7 @@ export declare function collectTestAssemblyFindings(cwd: string, changed: Change
  * section, and an unreadable task file is the same case — both are null, and every
  * caller already treats null as "nothing to hold the work to" (verify no-ops,
  * frozen paths are empty, recommend falls back to the title). Never throws. This
- * used to be the same four-line try/catch at four gate sites.
+ * would otherwise be the same four-line try/catch at four gate sites.
  */
 export declare function readSpecForVerification(cwd: string, taskId: string): Promise<string | null>;
 /**