@mjasnikovs/pi-task 0.39.4 → 0.39.5

package/README.md

@@ -68,10 +68,10 @@ A whole plan — `/task-auto` splits it into an ordered task list and runs each
 | `/task-plan <prompt>` | Plan one task with the model — it asks, you answer, ask it something back, or proceed — then run it through `/task`. |
 | `/task-list` | Open the task list in an editor dialog. |
 | `/task-resume [id]` | Resume the most recent (or named) unfinished task. |
-| `/task-cancel` | Cancel the running task (soft-terminal — still resumable). |
+| `/task-cancel` | Stop the running task at the next safe checkpoint (still resumable). Mid-phase it kills the running child; during the implementation turn it lets the turn finish and stops before the gates. |
 | `/task-auto <feature>` | Plan a feature into a task list and run each title through `/task` in order (resumable). |
 | `/task-auto-resume [--unattended]` | Resume the active `/task-auto` run at the next unfinished task. `--unattended` is the boot-hook form: in-flight runs only. |
-| `/task-auto-cancel` | Stop the `/task-auto` loop after the current task (still resumable). |
+| `/task-auto-cancel` | Stop the `/task-auto` loop at the next safe checkpoint — the end of the current phase, research worker, implementation turn or gate, not the end of the task (still resumable). During planning it abandons the plan, which is not yet written. |
 | `/task-config` | Toggle pi-task settings in an editor dialog: remote control, auto-commit, verify work, enforce guidelines, project tour, parallel research, research cache, search engine, command timeout, stuck reply retry, yolo mode, debug logs, one `watch:` toggle per live tool, and one `ext:` toggle per installed host extension. |
 | `/remote` | Show the QR code & URLs for the web view (`/remote stop` to stop). Answer grill questions, start tasks, and watch progress from your phone. |
 

package/dist/task/auto-orchestrator.d.ts

@@ -162,6 +162,42 @@ export interface CoveredPlan {
 export declare function coverPlan(ctx: ExtensionCommandContext, cwd: string, deps: AutoDeps, oriented: OrientedFeature, clarifications: string, decomposed: DecomposedPlan, specDangling: DanglingRef[]): Promise<CoveredPlan>;
 /** Plan phase: clarify → decompose → write AUTO file. Returns the new id, or null. */
 export declare function planAuto(ctx: ExtensionCommandContext, cwd: string, feature: string, deps: AutoDeps): Promise<string | null>;
+/**
+ * One best-effort, HOST-GROUNDED extraction: ask a child to emit lines, drop
+ * every line the design does not literally contain, log the kept/emitted split,
+ * and append what survives to a run-level artifact.
+ *
+ * The grounding step is the reason this shape exists rather than a plain child
+ * call. A child asked for interface facts will paraphrase and occasionally invent
+ * them, and an invented fact in a run-level registry is read as
+ * authoritative by every downstream refine/compose/verify. So nothing the child
+ * says is trusted: `ground` re-checks each emitted line against the design text
+ * host-side, and only substrings survive.
+ *
+ * Best-effort by contract. These artifacts SHARPEN planning; none of them gates
+ * it, so a fault here is swallowed rather than failing a run that is otherwise
+ * fine — which is why the whole body sits in one `catch {}`.
+ *
+ * The two call sites (contracts, launch scripts) were byte-identical apart from
+ * the four values this row carries, and the contracts copy parsed its child's
+ * output twice — once for the artifact and once for the log count — because the
+ * duplication made the second parse easy to miss.
+ */
+export declare function runGroundedExtraction<T>(row: {
+    cwd: string;
+    runChild: (name: string, tools: string, prompt: string) => Promise<string>;
+    /** Child name — also the key AUTO_PLAN_STEPS renders in the loader. */
+    child: string;
+    /** Singular noun for the log line ("contract", "script"). */
+    noun: string;
+    /** Log prefix naming the step. */
+    label: string;
+    prompt: string;
+    parse: (raw: string) => T[];
+    /** Keep only what the design itself backs. Runs host-side, never the child. */
+    ground: (emitted: T[]) => T[];
+    append: (cwd: string, kept: T[]) => Promise<void>;
+}): Promise<void>;
 export declare function requestAutoCancel(): void;
 export declare function runAutoLoop(ctx: ExtensionCommandContext, cwd: string, id: string, deps: AutoDeps): Promise<void>;
 export declare function registerTaskAuto(pi: ExtensionAPI): void;

package/dist/task/auto-orchestrator.js

@@ -773,7 +773,8 @@ export async function coverPlan(ctx, cwd, deps, oriented, clarifications, decomp
         try {
             verdict = parseCoverageVerdict(await deps.runChild('decompose-coverage', '', DECOMPOSE_COVERAGE_PROMPT(featureForModel, clarifications, titles)));
         }
-        catch {
+        catch (err) {
+            rethrowIfCancelled(err);
             verdict = null;
         }
         const verdictMissing = verdict?.kind === 'incomplete' ? verdict.missing : [];
@@ -796,7 +797,8 @@ export async function coverPlan(ctx, cwd, deps, oriented, clarifications, decomp
                     + `${acc.crossCutting.length} cross-cutting, ${acc.unmapped.length} unmapped; `
                     + `${covered.size} requirement(s) title-grounded`);
             }
-            catch {
+            catch (err) {
+                rethrowIfCancelled(err);
                 // mapping fault — Fix A accounting degrades; the grounded owned-set
                 // above still guards against drops.
             }
@@ -1080,7 +1082,7 @@ export async function planAuto(ctx, cwd, feature, deps) {
  * output twice — once for the artifact and once for the log count — because the
  * duplication made the second parse easy to miss.
  */
-async function runGroundedExtraction(row) {
+export async function runGroundedExtraction(row) {
     try {
         const emitted = row.parse(await row.runChild(row.child, '', row.prompt));
         const grounded = row.ground(emitted);
@@ -1088,10 +1090,32 @@ async function runGroundedExtraction(row) {
             + ` from ${emitted.length} emitted`);
         await row.append(row.cwd, grounded);
     }
-    catch {
+    catch (err) {
+        rethrowIfCancelled(err);
         // best-effort artifact — never a planning blocker
     }
 }
+/**
+ * Let a cancel through a best-effort catch.
+ *
+ * Planning's degrade-quietly catches exist so one weak child cannot sink a plan,
+ * and every one of them predates the `plan:` checkpoint. That checkpoint throws
+ * USER_CANCELLED from inside `runPlanningChild`, so without this the throw reads
+ * as "that extraction failed": planning carries on, writes the AUTO file, and
+ * leaves a resumable run whose contracts silently lost the entries the cancelled
+ * child would have grounded. Cancel means abandon the plan, so it is not a
+ * degradable fault.
+ *
+ * The requirement-extraction catch already gets this right through
+ * `isFatalChildCause`, which covers USER_CANCELLED as well as the fatal kills.
+ * This is the narrow half of the same rule for the catches that guard only an
+ * optional artifact, where promoting every fatal kill would be a behaviour change
+ * this fix has no evidence for.
+ */
+function rethrowIfCancelled(err) {
+    if (err instanceof Error && err.message === USER_CANCELLED)
+        throw err;
+}
 /** The two feature-level planning children, shown as steps in the loader. */
 const AUTO_PLAN_STEPS = {
     'auto-clarify': { step: 'clarify', stepNum: 1 },
@@ -1470,7 +1494,12 @@ async function handleTaskAuto(args, ctx) {
             catch (err) {
                 const msg = err instanceof Error ? err.message : String(err);
                 if (msg === USER_CANCELLED) {
-                    announceDone(ctx, '/task-auto cancelled.', 'warning');
+                    // Say what was thrown away. Planning writes nothing until it
+                    // finishes, so there is no half-plan to resume and no
+                    // /task-auto-resume to offer — the user has to start over,
+                    // and a bare "cancelled" would leave them looking for one.
+                    announceDone(ctx, '/task-auto cancelled — the plan was discarded. Nothing was written; '
+                        + 'run /task-auto again to re-plan.', 'warning');
                     return;
                 }
                 announceDone(ctx, `/task-auto planning failed: ${msg}`, 'error');
@@ -1559,8 +1588,16 @@ async function handleTaskAutoCancel(_args, ctx) {
  * promise "after the current task": the request is now honoured at the next safe
  * checkpoint (see cancel-points.ts), which mid-spec-pipeline is the end of the
  * current phase, not the end of the task.
+ *
+ * It names the seam set rather than the one seam the run happens to be between,
+ * because that seam is not knowable from here — the checkpoint trail says where
+ * the run has BEEN. Naming the set is what stops "next safe checkpoint" reading
+ * as "some time before the run ends", which is how a wait that is really one
+ * research worker gets mistaken for a wait of the whole task.
  */
-const CANCEL_ACK = 'Stopping /task-auto at the next safe checkpoint…';
+const CANCEL_ACK = 'Stopping /task-auto at the next safe checkpoint — the next planning child, or the '
+    + 'end of the current phase, research worker, implementation turn or gate. The model '
+    + 'call already in flight finishes first.';
 /**
  * Deliver a /task-auto-cancel typed in the terminal while a run owns the main
  * loop — the run bracket's `onCancel`. The armed listener watches raw stdin, so

package/dist/task/cancel-points.d.ts

@@ -27,18 +27,42 @@
  *   pre-final-gate (run-final-gate) every task is checked off and committed; the
  *                  whole-repo gate has not started. A resume re-enters the same
  *                  branch.
+ *   plan:<child>   (child-status, runPlanningChild — the one funnel BOTH
+ *                  /task-auto's planning and /task-plan go through) DURABLE BY
+ *                  DISCARD, and the one seam here that is not durable by writing.
+ *                  Nothing planning produces reaches disk until planAuto's final
+ *                  writeTaskFile, so there is no partial plan to resume and no
+ *                  half-state to repair — stopping abandons the whole plan. That
+ *                  is the point: the alternative measured at 13+ minutes of
+ *                  running after the user asked to stop.
+ *   research:<w>   (research-worker) after persistSection. The four workers run
+ *                  serially by default and each one's section is read back by
+ *                  readCached, so a resume skips every worker already on disk.
+ *                  Costs nothing and repeats nothing — the only seam here that is
+ *                  free in both directions.
+ *   impl:post-turn (orchestrator) the implementation turn has ENDED and the spec
+ *                  sections are all on disk. The turn's edits are uncommitted, so
+ *                  a resume re-delivers the spec onto the partly-edited tree —
+ *                  identical to the shipped ESC-then-decline-steer ending.
+ *   gate:post-commit  (task-gates) the task is checked off and its snapshot is in
+ *                  HEAD. Only the enforce pass is skipped, and enforce is
+ *                  re-runnable.
+ *   gate:pre-resolution (task-gates) at the top of the verify-resolution loop, before
+ *                  a round spends a lint fix, a research child or a whole
+ *                  implementation re-run. The task file is demoted there: it
+ *                  still reads `completed` from spec handoff, and the work is
+ *                  neither verified nor committed.
  *
- * DELIBERATELY NOT checkpoints — stopping here is not safe:
- *   - mid implementation turn: uncommitted, half-applied edits. The user's ESC
+ * DELIBERATELY NOT a checkpoint — stopping here is not safe:
+ *   - mid implementation turn. The turn is a host-session turn, not a child, so
+ *     stopping it means abandoning a half-applied edit set with no commit behind
+ *     it. `impl:post-turn` waits for the turn to end instead. The user's ESC
  *     (declined steer) path already covers "stop now, I accept a partial tree".
- *   - between the implementation turn and the gates, or inside the gates: the
- *     work is written but unverified and uncommitted; the gates are what make it
- *     durable. Cancel is observed on the far side, at loop-top.
  */
 /** Every place the cancel flag is polled. A closed union so the tests enumerate
  *  the same set the loop does — and they do: cancel-points.test.ts asserts on the
  *  recorded trail rather than on the loop's own bookkeeping. */
-export type CancelCheckpoint = 'loop-top' | 'pre-task' | 'pre-final-gate' | `phase:${string}`;
+export type CancelCheckpoint = 'loop-top' | 'pre-task' | 'pre-final-gate' | 'impl:post-turn' | 'gate:post-commit' | 'gate:pre-resolution' | `phase:${string}` | `plan:${string}` | `research:${string}`;
 export declare function requestCancel(): void;
 export declare function isCancelRequested(): boolean;
 /**
@@ -61,5 +85,9 @@ export declare function resetCheckpointTrail(): void;
  * @returns true when the caller must stop here.
  */
 export declare function cancelCheckpoint(where: CancelCheckpoint): boolean;
+/** Let only the seams this answers true for fire. Tests only. */
+export declare function onlyCheckpoints(predicate: (where: CancelCheckpoint) => boolean): void;
+/** Back to production: every seam fires. */
+export declare function clearCheckpointSuppression(): void;
 /** Checkpoints crossed since the last reset. */
 export declare function checkpointsCrossed(): readonly CancelCheckpoint[];

package/dist/task/cancel-points.js

@@ -27,13 +27,37 @@
  *   pre-final-gate (run-final-gate) every task is checked off and committed; the
  *                  whole-repo gate has not started. A resume re-enters the same
  *                  branch.
+ *   plan:<child>   (child-status, runPlanningChild — the one funnel BOTH
+ *                  /task-auto's planning and /task-plan go through) DURABLE BY
+ *                  DISCARD, and the one seam here that is not durable by writing.
+ *                  Nothing planning produces reaches disk until planAuto's final
+ *                  writeTaskFile, so there is no partial plan to resume and no
+ *                  half-state to repair — stopping abandons the whole plan. That
+ *                  is the point: the alternative measured at 13+ minutes of
+ *                  running after the user asked to stop.
+ *   research:<w>   (research-worker) after persistSection. The four workers run
+ *                  serially by default and each one's section is read back by
+ *                  readCached, so a resume skips every worker already on disk.
+ *                  Costs nothing and repeats nothing — the only seam here that is
+ *                  free in both directions.
+ *   impl:post-turn (orchestrator) the implementation turn has ENDED and the spec
+ *                  sections are all on disk. The turn's edits are uncommitted, so
+ *                  a resume re-delivers the spec onto the partly-edited tree —
+ *                  identical to the shipped ESC-then-decline-steer ending.
+ *   gate:post-commit  (task-gates) the task is checked off and its snapshot is in
+ *                  HEAD. Only the enforce pass is skipped, and enforce is
+ *                  re-runnable.
+ *   gate:pre-resolution (task-gates) at the top of the verify-resolution loop, before
+ *                  a round spends a lint fix, a research child or a whole
+ *                  implementation re-run. The task file is demoted there: it
+ *                  still reads `completed` from spec handoff, and the work is
+ *                  neither verified nor committed.
  *
- * DELIBERATELY NOT checkpoints — stopping here is not safe:
- *   - mid implementation turn: uncommitted, half-applied edits. The user's ESC
+ * DELIBERATELY NOT a checkpoint — stopping here is not safe:
+ *   - mid implementation turn. The turn is a host-session turn, not a child, so
+ *     stopping it means abandoning a half-applied edit set with no commit behind
+ *     it. `impl:post-turn` waits for the turn to end instead. The user's ESC
  *     (declined steer) path already covers "stop now, I accept a partial tree".
- *   - between the implementation turn and the gates, or inside the gates: the
- *     work is written but unverified and uncommitted; the gates are what make it
- *     durable. Cancel is observed on the far side, at loop-top.
  */
 let requested = false;
 /** Checkpoints actually reached since the last reset, in order. Instrumentation
@@ -71,14 +95,42 @@ export function resetCheckpointTrail() {
  */
 export function cancelCheckpoint(where) {
     crossed.push(where);
-    // CANCEL_AB_ARM=baseline collapses the checkpoint set back to loop-top alone,
-    // so the two arms differ in exactly one thing. Nothing in src/ ever sets it;
-    // the only writer in the tree is cancel-points.test.ts, which uses it to pin
-    // that the extra checkpoints — and only they — are what the flag gates.
-    if (process.env.CANCEL_AB_ARM === 'baseline' && where !== 'loop-top')
+    if (isSuppressed(where))
         return false;
     return requested;
 }
+// ─── Suppression (negative controls) ─────────────────────────────────────────
+/**
+ * Which seams may fire. `null` is production: all of them.
+ *
+ * This is what makes the seam matrix falsifiable, and a predicate rather than a
+ * name list because three of the seams are open-ended (`phase:`, `plan:`,
+ * `research:`) and a list could not name them all.
+ *
+ * The matrix asks one seam at a time — `onlyCheckpoints(w => w === 'pre-task')`
+ * for the assertion, `onlyCheckpoints(() => false)` for its control — so the two
+ * runs differ by exactly that seam and nothing else. Without the control, "the
+ * run stopped here" also passes against a loop that stops everywhere, or one that
+ * stopped for an unrelated reason: several seams see the same raised flag, and
+ * whichever comes first is the one that stops the run.
+ */
+let allowed = null;
+function isSuppressed(where) {
+    // CANCEL_AB_ARM=baseline collapses the set back to loop-top alone — the
+    // original two-arm control, kept because it is the coarse "does the extra
+    // checkpoint set do anything at all" question, which no per-seam control asks.
+    if (process.env.CANCEL_AB_ARM === 'baseline' && where !== 'loop-top')
+        return true;
+    return allowed !== null && !allowed(where);
+}
+/** Let only the seams this answers true for fire. Tests only. */
+export function onlyCheckpoints(predicate) {
+    allowed = predicate;
+}
+/** Back to production: every seam fires. */
+export function clearCheckpointSuppression() {
+    allowed = null;
+}
 /** Checkpoints crossed since the last reset. */
 export function checkpointsCrossed() {
     return crossed;

package/dist/task/child-status.js

@@ -19,9 +19,10 @@
  * gate-wide loader over a child that renders none (`frame: null`, reached when
  * `deps.loader === false` in gate-child), so both must see the same object.
  */
-import { runPhaseChild } from './child-runner.js';
+import { runPhaseChild, USER_CANCELLED } from './child-runner.js';
 import { resolveContextUsage } from './context-usage.js';
 import { startAutoLoader } from './widget.js';
+import { cancelCheckpoint } from './cancel-points.js';
 export class ChildStatus {
     _lastLine;
     _contextUsage;
@@ -95,6 +96,17 @@ export class ChildStatus {
  */
 export async function runPlanningChild(opts) {
     const { ctx, status, phaseDeps, name, tools, prompt, loader } = opts;
+    // SAFE CHECKPOINT (planning): the one funnel every planning child goes through
+    // — orient, clarify, decompose, each coverage round, each grounded extraction,
+    // and /task-plan's children too. Safe by DISCARD rather than by writing:
+    // planning puts nothing on disk before planAuto's closing writeTaskFile, so
+    // there is no partial plan to resume and none to repair. Without it the flag
+    // was read only after planning RETURNED — measured at 13+ minutes of planning
+    // still running after the user asked to stop.
+    if (cancelCheckpoint(`plan:${name}`)) {
+        phaseDeps.logDebug?.(`cancel: abandoning the plan before ${name}`);
+        throw new Error(USER_CANCELLED);
+    }
     const startedAt = Date.now();
     return status.track(ctx, () => ({
         ...(loader.command === undefined ? {} : { command: loader.command }),

package/dist/task/orchestrator.js

@@ -37,10 +37,10 @@ import { parseVerifyBlock } from './spec-validation.js';
 import { findDeliveryPhantoms, formatApiOverrideBanner } from '../workers/phantom-imports.js';
 import { titleForDisplay } from './parsers.js';
 import { USER_CANCELLED } from './child-runner.js';
-import { cancelCheckpoint } from './cancel-points.js';
+import { cancelCheckpoint, requestCancel } from './cancel-points.js';
 import { holdImplementation, liveModelControl } from './implementation-hold.js';
 import { rearmCancelListener } from './cancel-input.js';
-import { takeHeldInput } from './mid-run-input.js';
+import { takeHeldInput, isRunActive } from './mid-run-input.js';
 import { withRun, announceTerminal } from './run-bracket.js';
 import { RUN_END_POLICY, runSucceeded } from './run-end.js';
 import { formatTimings } from './timings.js';
@@ -334,6 +334,31 @@ export class TaskRunner {
             await setTaskSection(cwd, id, 'phase timings', formatTimings(this._timings));
             await setTaskSection(cwd, id, 'handoff', `handoff_at: ${new Date().toISOString()}`);
             await this._deliverSpec(ctx);
+            // SAFE CHECKPOINT (post implementation turn): every phase section is
+            // on disk and the turn has ENDED. Its edits are uncommitted, so a
+            // resume re-delivers the spec onto the partly-edited tree — the same
+            // ending the ESC-then-decline-steer path already produces. Front
+            // matter reads `phase: done`, and PHASE_INDEX.done is past every row,
+            // so the resumed run restores all five sections and falls straight
+            // through to _deliverSpec.
+            //
+            // This is also what makes /task-cancel work here at all: the turn
+            // runs in the host session, not as a child, so aborting this runner's
+            // signal never reached it. The command raises the cooperative flag
+            // and this is where the flag is read.
+            //
+            // AWAITED ONLY. On the fire-and-forget /task path _deliverSpec returns
+            // as soon as the spec is sent, so the turn is STARTING, not finished,
+            // and firing here would write `cancelled` over a task the agent then
+            // goes on to implement in full — reported and recorded as stopped
+            // while it runs, and left in a resumable state that re-delivers the
+            // same spec on top of the finished work. Nothing is lost by staying
+            // out: that path has no gates and no loop to stop, the run just ends,
+            // and ESC is what interrupts the turn itself.
+            if (this._implAwaited && cancelCheckpoint('impl:post-turn')) {
+                this._deps.logDebug?.('cancel: stopping after the implementation turn');
+                throw new Error(USER_CANCELLED);
+            }
             return { kind: 'completed' };
         }
         catch (err) {
@@ -795,12 +820,29 @@ async function handleTaskResume(args, ctx) {
 }
 // eslint-disable-next-line @typescript-eslint/require-await
 async function handleTaskCancel(_args, ctx) {
-    if (!activeTask) {
+    // `activeTask` covers the spec phases and the implementation turn — it is set
+    // in TaskRunner._run and cleared in that run's `finally`. The GATES run after
+    // that, so for the whole verify/autofix/enforce stretch there is no runner to
+    // abort and the honest answer is not "No task is running."
+    const runner = activeTask;
+    if (!runner && !isRunActive()) {
         notifyBoth(ctx, 'No task is running.', 'info');
         return;
     }
-    activeTask.cancel();
-    notifyBoth(ctx, `Cancelling ${activeTask.taskId}…`, 'warning');
+    // The cooperative flag is what gives the command one meaning wherever it is
+    // typed: stop at the next point the run can be resumed from. Without it a
+    // cancel during the gates, or during the implementation turn, had nothing to
+    // observe it. The run bracket scopes the flag to the run that raised it.
+    requestCancel();
+    if (!runner) {
+        notifyBoth(ctx, 'Stopping at the next safe checkpoint…', 'warning');
+        return;
+    }
+    // Abort as well: during the spec phases this kills the running child outright
+    // instead of waiting out its remaining minutes, and the phase already on disk
+    // is what a resume starts from.
+    runner.cancel();
+    notifyBoth(ctx, `Cancelling ${runner.taskId}…`, 'warning');
 }
 // ─── Entry point ─────────────────────────────────────────────────────────────
 export function registerTask(pi) {

package/dist/task/plan-orchestrator.js

@@ -277,8 +277,17 @@ async function runPlanCommand(ctx, cwd, planId, task, commandDeps) {
     }
     catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
+        // A user stop is not a fault, and the sentinel is not a sentence. The
+        // cancel checkpoint in runPlanningChild throws USER_CANCELLED here, so
+        // without this branch a /task-cancel during planning reads as a red
+        // "PLAN_0001 stopped — __user_cancelled__".
+        if (msg === USER_CANCELLED) {
+            await updateTaskFrontMatter(cwd, planId, { state: 'cancelled' }).catch(() => { });
+            announceTerminal(ctx, `${planId} cancelled.`, 'warning', { push: false });
+            return;
+        }
         await updateTaskFrontMatter(cwd, planId, {
-            state: msg === USER_CANCELLED ? 'cancelled' : 'failed',
+            state: 'failed',
             reason: msg.slice(0, 200)
         }).catch(() => { });
         // No push: a plan is a conversation, not a task; the run it hands off

package/dist/task/research-worker.js

@@ -20,6 +20,8 @@
  */
 import { classifyWorkerFailure } from '../workers/worker-failure.js';
 import { classifyContextSilence, countBullets } from './context-silence.js';
+import { cancelCheckpoint } from './cancel-points.js';
+import { USER_CANCELLED } from './child-runner.js';
 /**
  * Task-file heading under which a research worker's validated output is cached.
  * A resumed research phase reads these to skip workers that already succeeded,
@@ -403,5 +405,14 @@ export async function runResearchWorker(spec, run, prior = []) {
     // a truncated section can still carry a laundered claim.
     const sectionText = spec.postProcess ? spec.postProcess(rawText) : rawText;
     await run.persistSection(cacheHeading, sectionText);
+    // SAFE CHECKPOINT: this worker's section is on disk and the cache read at the
+    // top of this function is what a resume uses to skip it, so stopping between
+    // workers repeats nothing. Research is the phase's long pole and the workers
+    // run serially, which is what makes this the one seam that costs nothing in
+    // either direction. USER_CANCELLED reuses the phase's existing cancel path.
+    if (cancelCheckpoint(`research:${spec.section}`)) {
+        run.logDebug?.(`cancel: stopping after research worker ${spec.section}`);
+        throw new Error(USER_CANCELLED);
+    }
     return { name: spec.section, text: sectionText };
 }

package/dist/task/run-bracket.js

@@ -1,8 +1,9 @@
 import { armCancelListener, disarmCancelListener } from './cancel-input.js';
-import { beginRun, endRun } from './mid-run-input.js';
+import { beginRun, endRun, isRunActive } from './mid-run-input.js';
 import { reportDroppedInput } from './dropped-input.js';
 import { publishLifecycleNotice } from '../remote/bridge.js';
 import { pushNotify } from '../remote/push.js';
+import { resetCancel } from './cancel-points.js';
 /**
  * Run `fn` as the owner of the session: hold mid-run input and arm the terminal
  * interception for exactly its duration, then release both — on return AND on
@@ -10,6 +11,15 @@ import { pushNotify } from '../remote/push.js';
  * Nests: an inner bracket neither re-renders the surfaces nor un-arms the outer.
  */
 export async function withRun(ctx, opts, fn) {
+    // A cancel is scoped to the run that was asked to stop. runAutoLoop already
+    // cleared the flag at both ends of its own loop; the bracket is what gives
+    // every OTHER entry point the same guarantee, so a /task-cancel raised on a
+    // bare /task cannot survive to stop the next run at its first phase.
+    // Outermost only: an inner bracket clearing it would drop the request the
+    // outer loop has not observed yet.
+    const outermost = !isRunActive();
+    if (outermost)
+        resetCancel();
     beginRun();
     armCancelListener(ctx, opts.onCancel);
     try {
@@ -17,6 +27,8 @@ export async function withRun(ctx, opts, fn) {
     }
     finally {
         disarmCancelListener();
+        if (outermost)
+            resetCancel();
         reportDroppedInput(endRun(), ctx);
     }
 }

package/dist/task/task-gates.js

@@ -10,6 +10,8 @@ import { attributeEnforceFailure } from './enforce-attribution.js';
 // re-check-side parser (extractDeletedDebtPath) have to move together.
 import { crossTaskDeletionReason } from './accept-debt.js';
 import { clampOutput } from './clamp-output.js';
+import { cancelCheckpoint } from './cancel-points.js';
+import { updateTaskFrontMatter } from './task-io.js';
 /**
  * How many times a verify FAIL may be auto-fixed UNATTENDED (the research
  * recommended AUTOFIX, so pi re-runs the impl turn without prompting) before the
@@ -114,6 +116,24 @@ export async function resolveVerifyGate(ctxIn, deps, p, rec, routeRootCause) {
         // YOLO only: has the one-attempt rescue below already been spent on this task?
         let yoloRescueUsed = false;
         while (!verified.ok) {
+            // SAFE CHECKPOINT (before a resolution round): a round is a bounded
+            // lint fix, a research child and possibly a whole implementation
+            // re-run, so a cancel observed only INSIDE one buys all of that
+            // first. At the TOP of the loop because every later position is past
+            // something that already recorded itself — the unattended branch
+            // increments the counter, writes its `## gates` line and toasts
+            // "auto-fixing…" before it reaches any code below.
+            //
+            // The task file still reads `completed` here, written at spec handoff
+            // before any of this ran, and `completed` is not in RESUMABLE_STATES.
+            // Returning `cancelled` without this write would leave the announced
+            // "resume with /task-resume" pointing at a file /task-resume skips —
+            // the work is unverified AND uncommitted at this point, so that is the
+            // one place in the gate where a missed demotion loses it.
+            if (cancelCheckpoint('gate:pre-resolution')) {
+                await updateTaskFrontMatter(p.cwd, p.taskId, { state: 'cancelled' }).catch(() => { });
+                return { stop: { kind: 'cancelled', ctx: active } };
+            }
             const failReason = verified.reason ?? 'did not verify';
             // GRADUATED resolution: a repo-health FAIL (pure static findings) gets ONE
             // bounded fix attempt before the picker — smallest tool first. Applied →
@@ -671,6 +691,20 @@ export async function runGatesForTask(ctxIn, deps, p) {
         else
             notifyBoth(active, line, 'warning');
     }
+    // SAFE CHECKPOINT (post task commit): the work verified, the parent entry is
+    // checked off and the snapshot is in HEAD. Only the enforce pass is skipped,
+    // and enforce is re-runnable.
+    //
+    // Returns `done`, not `cancelled`: this task IS done, and `cancelled` would
+    // announce "resume with /task-resume" over a task whose work is already
+    // committed — a resume there re-runs the whole spec pipeline to redo it. The
+    // flag stays raised, so /task-auto stops one step later at loop-top with the
+    // right wording and a ticked checkbox, and a bare /task simply ends. The trail
+    // line is what keeps the skip from being silent.
+    if (cancelCheckpoint('gate:post-commit')) {
+        await rec('enforce: skipped — cancel requested after the task snapshot committed');
+        return { kind: 'done', ctx: active };
+    }
     await runEnforcePass(active, deps, p, rec, routeRootCause, { cleanPass, commit });
     return { kind: 'done', ctx: active };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@mjasnikovs/pi-task",
-    "version": "0.39.4",
+    "version": "0.39.5",
     "description": "Deterministic task planning and spec-orchestration for local models — crash-safe /task pipelines with verify/enforce gates, a real-time remote web view, and web/docs/fetch/worker subagent tools.",
     "type": "module",
     "main": "./dist/index.js",