@mjasnikovs/pi-task 0.40.32 → 0.40.34

package/README.md

@@ -268,7 +268,7 @@ bun run lint       # prettier + eslint + tsc --noEmit
 bun run build      # tsc → dist/
 ```
 
-Built with [Bun](https://bun.sh), TypeScript (strict), and [TypeBox](https://github.com/sinclairzx81/typebox) for tool schemas. Design plans live in [`plans/`](./plans).
+Built with [Bun](https://bun.sh), TypeScript (strict), and [TypeBox](https://github.com/sinclairzx81/typebox) for tool schemas.
 
 ## License
 

package/dist/shared/child-output.d.ts

@@ -65,7 +65,7 @@ export declare function verifyExcerpt(excerpt: string, content: string): Excerpt
  * fabrication. An excerpt assembled from several real spans is a stitched quote,
  * which is what the extraction prompt produces — and calling that a possible
  * hallucination was wrong on 21 of 21 measured cases, on a fifth of every run's
- * answers. See "Defect 18" in DOC_REGRESSINONS.md.
+ * answers.
  */
 export declare function formatResultText(header: string, parsed: {
     answer: string;

package/dist/shared/child-output.js

@@ -112,7 +112,7 @@ export function verifyExcerpt(excerpt, content) {
  * fabrication. An excerpt assembled from several real spans is a stitched quote,
  * which is what the extraction prompt produces — and calling that a possible
  * hallucination was wrong on 21 of 21 measured cases, on a fifth of every run's
- * answers. See "Defect 18" in DOC_REGRESSINONS.md.
+ * answers.
  */
 export function formatResultText(header, parsed, check) {
     if (!parsed.excerpt) {

package/dist/task/deep-render-check.d.ts

@@ -70,7 +70,8 @@ export interface SessionRequest {
     failed: boolean;
     /** CDP resource type, collapsed: what ISSUED this request. */
     initiator: 'xhr' | 'document' | 'other';
-    /** Relative to the sign-in request: before it, it, or after it. */
+    /** Before the submit, the sign-in request itself, or issued at or after the
+     *  submit. */
     phase: 'pre' | 'auth' | 'post';
 }
 export interface DeepSessionFacts {
@@ -93,8 +94,8 @@ export interface DeepSessionFacts {
         status: number | null;
         failed: boolean;
     } | null;
-    /** Same-origin XHR/fetch requests issued AFTER the sign-in response, excluding
-     *  the sign-in request itself. Derived: `sessionRequests` in phase 'post'. */
+    /** Same-origin XHR/fetch requests issued at or after the submit, excluding the
+     *  sign-in request itself. Derived: `sessionRequests` in phase 'post'. */
     postAuthDataAttempted: number;
     postAuthData2xx: number;
     /** Origins the client called that are not the app's own, whose requests failed
@@ -112,8 +113,9 @@ export interface DeepSessionFacts {
  * The three request-shaped facts, computed from the log and from nothing else. The
  * driver records `sessionRequests` and calls this; the values are exactly what the
  * pre-log driver computed by filtering the same map (the sign-in request is the
- * first same-origin non-GET after submit; the data requests are the same-origin
- * XHR/fetch issued at or after it, itself excluded).
+ * first same-origin non-GET issued at or after the submit; the data requests are the
+ * same-origin
+ * XHR/fetch issued at or after the submit, the sign-in request itself excluded).
  */
 export declare function deriveLegacyFacts(log: SessionRequest[]): Pick<DeepSessionFacts, 'authRequest' | 'postAuthDataAttempted' | 'postAuthData2xx'>;
 /**
@@ -225,7 +227,7 @@ export interface DriveSessionOptions {
 /**
  * The session over an already-connected browser: navigate, inspect, sign in if the
  * landing is a wall and credentials exist, settle, phase the same-origin request
- * log against the sign-in request, re-enter once the sign-in was accepted, and
+ * log against the submit, re-enter once the sign-in was accepted, and
  * hand the facts to `judge`. Pure protocol logic — no process, no filesystem, no
  * socket — so every branch is testable against a fake `CdpLike`.
  *

package/dist/task/deep-render-check.js

@@ -202,8 +202,9 @@ export function pinnedLocalPort(vars) {
  * The three request-shaped facts, computed from the log and from nothing else. The
  * driver records `sessionRequests` and calls this; the values are exactly what the
  * pre-log driver computed by filtering the same map (the sign-in request is the
- * first same-origin non-GET after submit; the data requests are the same-origin
- * XHR/fetch issued at or after it, itself excluded).
+ * first same-origin non-GET issued at or after the submit; the data requests are the
+ * same-origin
+ * XHR/fetch issued at or after the submit, the sign-in request itself excluded).
  */
 export function deriveLegacyFacts(log) {
     const auth = log.find(r => r.phase === 'auth') ?? null;
@@ -636,7 +637,7 @@ export async function launchBrowser(bin, userDataDir, { signal } = {}) {
 /**
  * The session over an already-connected browser: navigate, inspect, sign in if the
  * landing is a wall and credentials exist, settle, phase the same-origin request
- * log against the sign-in request, re-enter once the sign-in was accepted, and
+ * log against the submit, re-enter once the sign-in was accepted, and
  * hand the facts to `judge`. Pure protocol logic — no process, no filesystem, no
  * socket — so every branch is testable against a fake `CdpLike`.
  *
@@ -645,18 +646,27 @@ export async function launchBrowser(bin, userDataDir, { signal } = {}) {
 export async function driveSession(cdp, { url, credentials, judge, quietMs }) {
     const origin = new URL(url).origin;
     const requests = new Map();
+    let nextSeq = 0;
     let lastActivity = Date.now();
     cdp.on('Network.requestWillBeSent', p => {
-        const req = p.request;
-        requests.set(String(p.requestId), {
-            url: String(req?.url ?? ''),
-            method: String(req?.method ?? 'GET'),
-            type: String(p.type ?? ''),
-            status: null,
-            mimeType: null,
-            failed: false,
-            at: Date.now()
-        });
+        const id = String(p.requestId);
+        // A redirect hop reuses the requestId, carrying the NEXT hop's method and
+        // url. The request the client made is the first hop and the status that
+        // judges it is the chain's last, so the first hop stays and the eventual
+        // response lands on it. Overwriting reads a POST that 302s as a GET, and
+        // then no sign-in request is ever found.
+        if (p.redirectResponse === undefined || !requests.has(id)) {
+            const req = p.request;
+            requests.set(id, {
+                url: String(req?.url ?? ''),
+                method: String(req?.method ?? 'GET'),
+                type: String(p.type ?? ''),
+                status: null,
+                mimeType: null,
+                failed: false,
+                seq: nextSeq++
+            });
+        }
         lastActivity = Date.now();
     });
     cdp.on('Network.responseReceived', p => {
@@ -711,27 +721,23 @@ export async function driveSession(cdp, { url, credentials, judge, quietMs }) {
     const initiatorOf = (r) => isData(r) ? 'xhr'
         : r.type === 'Document' ? 'document'
             : 'other';
-    /** The same-origin request log, phased against the sign-in request. `authAt` is
-     *  Infinity before the submit, so every request so far is 'pre'. */
-    const sessionLog = (authId, authAt) => {
-        const out = [];
-        for (const [id, r] of requests) {
-            if (!sameOrigin(r))
-                continue;
-            out.push({
-                method: r.method,
-                path: pathOf(r.url),
-                status: r.status,
-                mimeType: r.mimeType,
-                failed: r.failed,
-                initiator: initiatorOf(r),
-                phase: id === authId ? 'auth'
-                    : r.at >= authAt ? 'post'
-                        : 'pre'
-            });
-        }
-        return out;
-    };
+    /** The same-origin request log, phased against the submit. `postSeq` is the
+     *  first `seq` the submit could issue — Infinity while no submit has happened —
+     *  so before a submit every request so far is 'pre'; the sign-in request sits at
+     *  or after the boundary but is 'auth', not 'post'. */
+    const sessionLog = (authId, postSeq) => [...requests]
+        .filter(([, r]) => sameOrigin(r))
+        .map(([id, r]) => ({
+        method: r.method,
+        path: pathOf(r.url),
+        status: r.status,
+        mimeType: r.mimeType,
+        failed: r.failed,
+        initiator: initiatorOf(r),
+        phase: id === authId ? 'auth'
+            : r.seq >= postSeq ? 'post'
+                : 'pre'
+    }));
     const facts = (log, over) => ({
         sessionRequests: log,
         ...deriveLegacyFacts(log),
@@ -749,13 +755,15 @@ export async function driveSession(cdp, { url, credentials, judge, quietMs }) {
     const unsubmitted = (over) => facts(sessionLog(null, Number.POSITIVE_INFINITY), over);
     if (!before.hasPassword || credentials === null)
         return judge(unsubmitted({}));
-    const submitMark = Date.now();
     const filled = await evaluate(fillExpr(credentials.identifier, credentials.password));
     if (!filled?.ok)
         return judge(unsubmitted({ submitted: false }));
     // Separate turn: the fill's input events schedule framework state updates that
     // the submit handler must already see.
     await sleep(300);
+    // Captured after the fill: background traffic before the submit must not be
+    // eligible as the sign-in request.
+    const submitSeq = nextSeq;
     const submitted = await evaluate(SUBMIT_EXPR);
     if (!submitted?.ok)
         return judge(unsubmitted({ submitted: false }));
@@ -765,16 +773,14 @@ export async function driveSession(cdp, { url, credentials, judge, quietMs }) {
     // own 2xx is the precondition for judging anything, and it is EXCLUDED from the
     // data evidence — a broken build satisfies "at least one same-origin 2xx" with
     // exactly this request and nothing else.
-    const after = new Map([...requests].filter(([, r]) => r.at >= submitMark));
     let authId = null;
-    for (const [id, r] of after) {
-        if (sameOrigin(r) && r.method !== 'GET') {
+    for (const [id, r] of requests) {
+        if (r.seq >= submitSeq && sameOrigin(r) && r.method !== 'GET') {
             authId = id;
             break;
         }
     }
-    const authReq = authId !== null ? after.get(authId) : null;
-    const authAt = authReq?.at ?? submitMark;
+    const authReq = authId === null ? null : requests.get(authId);
     const now = await evaluate(INSPECT_EXPR);
     const domJudgment = judgeRenderedDom(now?.html ?? '');
     const leftAuthWall = !(now?.hasPassword ?? false) || (now?.pathname ?? '') !== before.pathname;
@@ -795,7 +801,7 @@ export async function driveSession(cdp, { url, credentials, judge, quietMs }) {
         lastActivity = Date.now();
         await settle(() => lastActivity, RE_NAV_CAP_MS, quietMs);
     }
-    return judge(facts(sessionLog(authId, authAt), {
+    return judge(facts(sessionLog(authId, submitSeq), {
         submitted: true,
         foreignOriginFailures: foreignOriginFailures(),
         leftAuthWall,

package/dist/workers/docs-core.js

@@ -549,13 +549,11 @@ function docsRawCached(cache, pkg, profile, query, ensureIndexed, retrieveChunks
 }
 function docsRawUncached(pkg, profile, cacheError, autoInstalled) {
     const parts = [];
+    // Already entry-first, and already past the selection rules: assembling that
+    // order here needed the entry compared against a list the walker spells with
+    // its own resolved paths, and a miss read as "a rule dropped it".
     const surfaceFiles = collectFiles(pkg, profile).surface;
-    // Only an entry the rules KEPT goes first. A CJS-first package names its
-    // `.d.cts` in `types`, so the entry is exactly the twin `collectFiles` drops,
-    // and prepending it blind put it back at the head of the truncated blob.
-    const entry = pkg.entry !== null && surfaceFiles.includes(pkg.entry) ? pkg.entry : null;
-    const entryFirst = entry === null ? surfaceFiles : [entry, ...surfaceFiles.filter(f => f !== entry)];
-    for (const abs of entryFirst) {
+    for (const abs of surfaceFiles) {
         let raw;
         try {
             raw = fs.readFileSync(abs, 'utf8');

package/dist/workers/docs-ecosystems.d.ts

@@ -87,7 +87,7 @@ export interface EcosystemProfile {
     /**
      * Packages whose declarations belong in THIS package's index, because this
      * package exports names it does not declare — `hspec`/`hspec-core`,
-     * `axum`/`axum-core`; see DEFECT-12-STOPPING-RULE.md.
+     * `axum`/`axum-core`.
      */
     supplements?: (pkg: ResolvedPackage, cwd: string, io: EcosystemIo) => Promise<ResolvedPackage[]>;
     /**

package/dist/workers/docs-index.js

@@ -58,9 +58,14 @@ function computeContentHash(pkg, profile, supplements = []) {
     hash.update(Buffer.from(chunkerFingerprint(), 'utf8'));
     hash.update(ZERO_SEP);
     // Source text, the same trick as `declSplitRe.source`: the fingerprint moves
-    // whenever the selection rule does, with nothing to remember to bump.
+    // whenever the selection rule does, with nothing to remember to bump. The
+    // walker is here because it decides which files EXIST to be selected, and it
+    // sits one level below `String(ingestBody)` — the level three earlier fixes
+    // hid in.
     hash.update(Buffer.from(`${String(profile.isSurfaceFile)}\u0000${String(profile.selectFiles)}`
-        + `\u0000${String(dropDeadMajors)}`, 'utf8'));
+        + `\u0000${String(dropDeadMajors)}\u0000${String(walkSurface)}`
+        + `\u0000${String(withinPackage)}\u0000${String(entryFirst)}`
+        + `\u0000${profile.skipDirs.join(',')}`, 'utf8'));
     hash.update(ZERO_SEP);
     // The extractor and the writer, by source. Surfacing only `pkg.entry` below
     // leaves a package cached whenever a fix moves some OTHER module — the
@@ -91,7 +96,9 @@ function computeContentHash(pkg, profile, supplements = []) {
     return hash.digest('hex');
 }
 function walkSurface(root, profile) {
-    const out = [];
+    // A set, not a list: two links to one file are one file, and the uncached
+    // path prints this list into a single already-truncated blob.
+    const out = new Set();
     const stack = [root];
     // A directory symlink is followed by its resolved target, so one pointing at
     // an ancestor inside `root` walks the same subtree forever without this.
@@ -119,17 +126,19 @@ function walkSurface(root, profile) {
                 catch {
                     continue;
                 }
-                const relReal = path.relative(root, realPath);
-                if (relReal.startsWith('..'))
+                if (!withinPackage(root, realPath, profile))
                     continue;
                 if (stat.isDirectory()) {
                     if (walked.has(realPath))
                         continue;
                     walked.add(realPath);
                     stack.push(realPath);
+                    // Surface-ness is the visible name's, identity is the target's:
+                    // `index.d.ts -> src/impl.ts` is what a consumer imports, and
+                    // `helpers_test.go -> helpers.go` is still a test file.
                 }
-                else if (stat.isFile() && profile.isSurfaceFile(realPath))
-                    out.push(realPath);
+                else if (stat.isFile() && profile.isSurfaceFile(entry.name))
+                    out.add(realPath);
                 continue;
             }
             if (entry.isDirectory()) {
@@ -139,10 +148,23 @@ function walkSurface(root, profile) {
                 stack.push(full);
             }
             else if (entry.isFile() && profile.isSurfaceFile(entry.name))
-                out.push(full);
+                out.add(full);
         }
     }
-    return out.sort();
+    return [...out].sort();
+}
+/**
+ * Is this symlink target part of the package, by the same rules its own tree obeys?
+ *
+ * The link's NAME cleared `skipDirs`; the path it resolves to has to as well, or
+ * `deps -> node_modules` files another package's declarations under this one's
+ * name and version banner.
+ */
+function withinPackage(root, realPath, profile) {
+    const rel = path.relative(root, realPath);
+    if (rel.startsWith('..'))
+        return false;
+    return !rel.split(path.sep).some(seg => profile.skipDirs.includes(seg));
 }
 /**
  * Drop a `.d.cts` / `.d.mts` that sits beside a `.d.ts` of the same name.
@@ -200,10 +222,48 @@ function dropDeadMajors(files, root, version) {
 export function collectFiles(pkg, profile) {
     const walked = walkSurface(pkg.root, profile);
     const surface = dropDeadMajors(walked, pkg.root, pkg.version);
-    return {
-        surface: profile.selectFiles ? profile.selectFiles(surface, pkg) : surface,
-        readme: pkg.readme
-    };
+    const selected = profile.selectFiles ? profile.selectFiles(surface, pkg) : surface;
+    return { surface: entryFirst(selected, walked, pkg), readme: pkg.readme };
+}
+/** The list's own spelling of `entry`, resolving links only if the plain compare misses. */
+function sameFile(files, entry) {
+    const direct = files.find(f => f === entry);
+    if (direct !== undefined)
+        return direct;
+    const real = realpathOr(entry);
+    return files.find(f => f === real || realpathOr(f) === real) ?? null;
+}
+function realpathOr(file) {
+    try {
+        return fs.realpathSync(file);
+    }
+    catch {
+        return file;
+    }
+}
+/**
+ * The manifest's entry at the head, and back in the list when the walk never
+ * offered it.
+ *
+ * Two different questions, and membership alone cannot tell them apart. A rule
+ * that DROPPED the entry is doing its job — a CJS-first package names the
+ * `.d.cts` twin `dropParallelDeclarations` removes, and putting it back blind
+ * put it at the head of the truncated blob. A package naming a `src/index.ts`
+ * in `types` was never a surface-file candidate at all, and answering "has no
+ * .d.ts files" for it is not the same as answering without one file.
+ *
+ * The head matters on the uncached path, which prints this list into one
+ * truncated blob and nothing else.
+ */
+function entryFirst(selected, walked, pkg) {
+    if (pkg.entry === null)
+        return [...selected];
+    const kept = sameFile(selected, pkg.entry);
+    if (kept !== null)
+        return [kept, ...selected.filter(f => f !== kept)];
+    if (sameFile(walked, pkg.entry) !== null)
+        return [...selected];
+    return fs.existsSync(pkg.entry) ? [pkg.entry, ...selected] : [...selected];
 }
 function ingestBody(cache, pkg, profile, contentHash, supplements = []) {
     const ecosystem = profile.id;
@@ -252,8 +312,9 @@ function ingestBody(cache, pkg, profile, contentHash, supplements = []) {
         }
     }
     // A facade package indexes to a table of contents: `hspec` is 14 chunks of
-    // export lists and every signature is in `hspec-core`. Fill only the holes —
-    // see DEFECT-12-STOPPING-RULE.md for the boundary and why it stops here.
+    // export lists and every signature is in `hspec-core`. Fill only the holes,
+    // and only one hop out: after one hop hspec has zero unresolved names left,
+    // and no package measured had anything for a second hop to fetch.
     const found = supplements.length > 0 ? (profile.exportGap?.(pkg.root) ?? null) : null;
     const gap = found !== null && !found.empty ? found : null;
     for (const sup of gap === null ? [] : supplements) {

package/dist/workers/eco-cargo.d.ts

@@ -122,7 +122,7 @@ export declare function manifestCrates(cwd: string): Set<string> | undefined;
  * The trigger is the hole, with no threshold — measured, and for the same reason
  * as hackage: across twenty-two crates the unresolved fraction reads 100% on a
  * crate with one re-export and 0% on a crate with none, so a ratio separates
- * nothing. See "Defect 16" in DOC_REGRESSINONS.md for the sweep.
+ * nothing.
  */
 export declare function cargoExportGap(root: string): ExportGap;
 /**

package/dist/workers/eco-cargo.js

@@ -869,7 +869,7 @@ export function manifestCrates(cwd) {
     }
     return out;
 }
-// ── the facade gap (DEFECT-12-STOPPING-RULE.md, cargo half) ─────────────────
+// ── the facade gap, cargo half ──────────────────────────────────────────────
 /** A `pub use …;` statement, attributes and line breaks included. */
 const PUB_USE_RE = /\bpub\s+use\s+([^;]+);/g;
 /** Every item head that introduces a name, visibility ignored — a facade may
@@ -995,7 +995,7 @@ function moduleOfPath(relPath) {
  * The trigger is the hole, with no threshold — measured, and for the same reason
  * as hackage: across twenty-two crates the unresolved fraction reads 100% on a
  * crate with one re-export and 0% on a crate with none, so a ratio separates
- * nothing. See "Defect 16" in DOC_REGRESSINONS.md for the sweep.
+ * nothing.
  */
 export function cargoExportGap(root) {
     const deps = runtimeDeps(root);

package/dist/workers/eco-go.js

@@ -25,7 +25,7 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 import { ResolveError } from './docs-resolve.js';
 import { findAtOrAbove } from './eco-cargo.js';
-import { buildConstraint, splitGoItems } from './go-surface.js';
+import { buildConstraint, codeOnly, splitGoItems } from './go-surface.js';
 import { readZip, readEntry, isUnsafeEntryName } from '../shared/zip.js';
 import { acquireStdlibPackage, findInGoroot, findSliced } from './go-stdlib.js';
 const PROXY = 'https://proxy.golang.org';
@@ -658,16 +658,22 @@ function holdsByDefault(src) {
  * line, and reading those keeps the very subpackage `selectOwnPackage` exists to
  * drop. A regex cannot draw that line — a column-0 `import (` also sits inside a
  * generator template's raw string and inside a doc comment's example — so the
- * split is the surface scanner's, which already skips comments and literals.
+ * split is the surface scanner's. That split strips only the comments BETWEEN
+ * declarations, and a commented-out import line inside the block is ordinary Go,
+ * so the item's own comments come off too.
  * An `ImportPath` is a `string_lit`, so the backtick form is legal Go and
  * dropping it silently drops everything reachable only through it.
  */
 function importsOf(src) {
     const out = [];
     for (const item of splitGoItems(src)) {
-        if (!/^import\b/.test(item.text))
+        if (/^package\b/.test(item.text))
             continue;
-        for (const m of item.text.matchAll(/"([^"\n]+)"|`([^`]+)`/g))
+        // Go puts every import declaration before every other one, so the first
+        // item that is not an import ends the search.
+        if (!/^import\b/.test(item.text))
+            break;
+        for (const m of codeOnly(item.text).matchAll(/"([^"\n]+)"|`([^`]+)`/g))
             out.push(m[1] ?? m[2]);
     }
     return out;
@@ -785,6 +791,7 @@ export function goContentFingerprintParts() {
         String(selectOwnPackage),
         String(declaresApi),
         String(goMajor),
-        String(importsOf)
+        String(importsOf),
+        String(codeOnly)
     ];
 }

package/dist/workers/eco-hackage.js

@@ -600,8 +600,9 @@ export function manifestPackages(cwd) {
  * re-export puts the name in the export list; a `module X` re-export puts
  * nothing there at all, which is why `shouldBe` is invisible to the first.
  *
- * See DEFECT-12-STOPPING-RULE.md for why this triggers on the hole itself
- * rather than on a fraction of the export list.
+ * The trigger is the hole, with no threshold. Swept over the 299 modules with
+ * 5+ exports, the trigger count reads 33 at 50% and 18 at 95%, so the fraction
+ * is not carrying the decision and any value picked would just sound right.
  */
 const EXPORT_NAME_RE = /^[A-Za-z_][\w']*$/;
 /** `module X` inside an export list is a re-export; `Prelude` is base, and base is not fetched. */

package/dist/workers/export-gap.d.ts

@@ -4,8 +4,8 @@
  * `hspec` indexes to a table of contents and every signature is in `hspec-core`;
  * `axum` re-exports `IntoResponse` and the trait lives in `axum-core`. Both are
  * the same failure — a query retrieves the package's own chunks and not one of
- * them defines the thing asked about — and DEFECT-12-STOPPING-RULE.md fixes the
- * boundary for following the re-export.
+ * them defines the thing asked about — so the re-export is followed exactly one
+ * hop, to a dependency the package's own name prefixes.
  *
  * The boundary is shared; the parsing is not. Haskell states the gap in an export
  * list, Rust in `pub use`, so each ecosystem answers the same three questions in

package/dist/workers/go-surface.d.ts

@@ -38,6 +38,15 @@ export interface GoItem {
     pending: string;
     text: string;
 }
+/**
+ * A declaration's text with its comments removed and its literals intact.
+ *
+ * `splitGoItems` strips only what sits BETWEEN declarations. A comment inside an
+ * import block, or trailing one, stays in the item's own text, so a caller
+ * reading string literals out of a declaration reads the commented-out ones too
+ * — and a commented-out import is one of the commonest shapes in Go source.
+ */
+export declare function codeOnly(text: string): string;
 /**
  * Split source into declarations. Works unchanged on a struct body or a const
  * group, whose members obey the same semicolon rule with no keyword in front.

package/dist/workers/go-surface.js

@@ -162,6 +162,39 @@ function endsStatement(word, lastChar) {
         return !CONTINUING_KEYWORDS.has(word);
     return STMT_END_CHAR_RE.test(lastChar);
 }
+/**
+ * A declaration's text with its comments removed and its literals intact.
+ *
+ * `splitGoItems` strips only what sits BETWEEN declarations. A comment inside an
+ * import block, or trailing one, stays in the item's own text, so a caller
+ * reading string literals out of a declaration reads the commented-out ones too
+ * — and a commented-out import is one of the commonest shapes in Go source.
+ */
+export function codeOnly(text) {
+    let out = '';
+    let i = 0;
+    while (i < text.length) {
+        const c = text[i];
+        if (c === '/' && text[i + 1] === '/') {
+            const nl = text.indexOf('\n', i);
+            i = nl < 0 ? text.length : nl;
+        }
+        else if (c === '/' && text[i + 1] === '*') {
+            const close = text.indexOf('*/', i + 2);
+            i = close < 0 ? text.length : close + 2;
+        }
+        else if (c === '"' || c === "'" || c === '`') {
+            const end = skipLiteral(text, i);
+            out += text.slice(i, end);
+            i = end;
+        }
+        else {
+            out += c;
+            i++;
+        }
+    }
+    return out;
+}
 /**
  * Split source into declarations. Works unchanged on a struct body or a const
  * group, whose members obey the same semicolon rule with no keyword in front.
@@ -530,6 +563,7 @@ export function goContentFingerprint() {
         endsStatement,
         skipToCode,
         skipLiteral,
+        codeOnly,
         trailingGroup,
         splitBody,
         buildConstraint,

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@mjasnikovs/pi-task",
-    "version": "0.40.32",
+    "version": "0.40.34",
     "description": "Deterministic task planning and spec-orchestration for local models — crash-safe /task pipelines with verify/enforce gates, a real-time remote web view, and web/docs/fetch/worker subagent tools.",
     "type": "module",
     "main": "./dist/index.js",