@mjasnikovs/pi-task 0.40.37 → 0.40.39

package/dist/shared/child-process.js

@@ -215,6 +215,7 @@ export function runChild(spawn, invocation, cwd, signal, opts) {
         let stdout = '';
         let stderr = '';
         let kill;
+        let stdinError;
         const discardStdout = opts?.mode === 'text' && opts.discardStdout === true;
         // Deliver the prompt on stdin, not argv. A large prompt — an inlined design
         // doc, say — exceeds the OS argv ceiling and the spawn fails outright rather
@@ -237,9 +238,13 @@ export function runChild(spawn, invocation, cwd, signal, opts) {
         });
         if (usesStdin) {
             // A child killed before it read the prompt leaves the pipe broken, and an
-            // unhandled EPIPE on stdin takes the whole process down. The child's own
-            // exit is what reports that run; this write has nothing left to say.
-            proc.stdin?.on?.('error', () => { });
+            // unhandled EPIPE on stdin takes the whole process down. Recorded rather
+            // than dropped: a child WE killed reports itself through `kill`, but one
+            // that read a truncated prompt and exited 0 would otherwise pass off an
+            // answer to half a spec as a clean run.
+            proc.stdin?.on?.('error', (e) => {
+                stdinError ??= e instanceof Error ? e : new Error(String(e));
+            });
             // pi reads the prompt from stdin and waits for EOF, so write then end.
             proc.stdin?.write(invocation.stdin);
             proc.stdin?.end();
@@ -405,10 +410,14 @@ export function runChild(spawn, invocation, cwd, signal, opts) {
             if (sink)
                 sink.flush();
             const text = sink ? sink.text : undefined;
+            // pi waits for EOF before it runs, so a stdin error on a child nobody
+            // killed means it ran on a prompt that never finished arriving. Its own
+            // exit describes that half-spec, so it cannot stand as the verdict.
+            const truncated = kill === undefined ? stdinError : undefined;
             settle({
                 stdout,
-                stderr,
-                exitCode: code ?? 0,
+                stderr: truncated ? `${stderr}\nprompt delivery failed: ${truncated.message}` : stderr,
+                exitCode: truncated ? (code ?? 0) || 1 : (code ?? 0),
                 aborted: kill !== undefined,
                 ...(kill ? { kill } : {}),
                 text,

package/dist/task/deep-render-check.d.ts

@@ -65,13 +65,19 @@ export declare function pinnedLocalPort(vars: Record<string, string>): number |
 export interface SessionRequest {
     method: string;
     path: string;
+    /** Where the chain ENDED — the path `status` and `mimeType` actually describe.
+     *  Absent in a pre-existing recorded session, where it falls back to `path`. */
+    finalPath?: string;
     status: number | null;
     mimeType: string | null;
     failed: boolean;
     /** CDP resource type, collapsed: what ISSUED this request. */
     initiator: 'xhr' | 'document' | 'other';
-    /** Before the submit, the sign-in request itself, or issued at or after the
-     *  submit. */
+    /** The chain redirected, so `status` and `mimeType` above describe a hop this
+     *  entry does not name. Any rule that reads a status AS A FACT ABOUT `path`
+     *  must skip these. */
+    redirected: boolean;
+    /** Before the sign-in request, the sign-in request itself, or after it. */
     phase: 'pre' | 'auth' | 'post';
 }
 export interface DeepSessionFacts {
@@ -93,11 +99,17 @@ export interface DeepSessionFacts {
         path: string;
         status: number | null;
         failed: boolean;
+        /** The sign-in chain redirected, so `status` is the hop it LANDED on. */
+        redirected?: boolean;
     } | null;
-    /** Same-origin XHR/fetch requests issued at or after the submit, excluding the
-     *  sign-in request itself. Derived: `sessionRequests` in phase 'post'. */
+    /** Same-origin XHR/fetch requests issued at or after the sign-in request,
+     *  excluding that request itself. Derived: `sessionRequests` in phase 'post'. */
     postAuthDataAttempted: number;
     postAuthData2xx: number;
+    /** The origin the sign-in left for, when the submit addressed this app and the
+     *  chain ended somewhere else — an external identity provider, which no
+     *  declared credential pair can drive. Optional: absent means "not recorded". */
+    signInLeftOrigin?: string | null;
     /** Origins the client called that are not the app's own, whose requests failed
      *  (a bundle pinned to a build-time base URL that is not the port under test). */
     foreignOriginFailures: string[];
@@ -111,11 +123,8 @@ export interface DeepSessionFacts {
 }
 /**
  * The three request-shaped facts, computed from the log and from nothing else. The
- * driver records `sessionRequests` and calls this; the values are exactly what the
- * pre-log driver computed by filtering the same map (the sign-in request is the
- * first same-origin non-GET issued at or after the submit; the data requests are
- * the same-origin XHR/fetch issued at or after the sign-in request, that request
- * itself excluded).
+ * driver records `sessionRequests` and calls this; the phases carry the whole
+ * derivation, so this reads them and decides nothing of its own.
  */
 export declare function deriveLegacyFacts(log: SessionRequest[]): Pick<DeepSessionFacts, 'authRequest' | 'postAuthDataAttempted' | 'postAuthData2xx'>;
 /**
@@ -227,7 +236,7 @@ export interface DriveSessionOptions {
 /**
  * The session over an already-connected browser: navigate, inspect, sign in if the
  * landing is a wall and credentials exist, settle, phase the same-origin request
- * log against the submit, re-enter once the sign-in was accepted, and
+ * log against the sign-in request, re-enter once the sign-in was accepted, and
  * hand the facts to `judge`. Pure protocol logic — no process, no filesystem, no
  * socket — so every branch is testable against a fake `CdpLike`.
  *

package/dist/task/deep-render-check.js

@@ -200,17 +200,20 @@ export function pinnedLocalPort(vars) {
 }
 /**
  * The three request-shaped facts, computed from the log and from nothing else. The
- * driver records `sessionRequests` and calls this; the values are exactly what the
- * pre-log driver computed by filtering the same map (the sign-in request is the
- * first same-origin non-GET issued at or after the submit; the data requests are
- * the same-origin XHR/fetch issued at or after the sign-in request, that request
- * itself excluded).
+ * driver records `sessionRequests` and calls this; the phases carry the whole
+ * derivation, so this reads them and decides nothing of its own.
  */
 export function deriveLegacyFacts(log) {
     const auth = log.find(r => r.phase === 'auth') ?? null;
     const data = log.filter(r => r.phase === 'post' && r.initiator === 'xhr');
     return {
-        authRequest: auth === null ? null : ({ method: auth.method, path: auth.path, status: auth.status, failed: auth.failed }),
+        authRequest: auth === null ? null : ({
+            method: auth.method,
+            path: auth.path,
+            status: auth.status,
+            failed: auth.failed,
+            redirected: auth.redirected
+        }),
         postAuthDataAttempted: data.length,
         postAuthData2xx: data.filter(r => r.status !== null && r.status >= 200 && r.status < 300)
             .length
@@ -220,6 +223,11 @@ export function deriveLegacyFacts(log) {
  *  answered No. 501 is included because a server that routes but implements
  *  nothing is the same dead call from the client's side. */
 const MISSING_ROUTE_STATUS = new Set([404, 405, 501]);
+/** A redirected entry's `status` and `mimeType` belong to its LAST hop, so the two
+ *  rules below may read them only where that hop is still the client's own business.
+ *  Before and during sign-in, a 302 to the login page is the normal unauthenticated
+ *  flow; after sign-in, that same redirect IS the defect. */
+const lastHopJudgesTheClient = (r) => !r.redirected || r.phase === 'post';
 /**
  * Judge a recorded session. The ONE thing that may FAIL is a session the SERVER
  * authenticated (2xx on the sign-in request) whose client then could not use it:
@@ -264,6 +272,14 @@ export function judgeDeepSession(f) {
         };
     }
     if (f.authRequest === null) {
+        if (f.signInLeftOrigin) {
+            return {
+                outcome: 'skip',
+                note: `signing in leaves this app for ${f.signInLeftOrigin} — an external identity `
+                    + 'provider cannot be driven with a declared credential pair, so the '
+                    + 'authenticated half of the app was NOT observed'
+            };
+        }
         const pinned = f.foreignOriginFailures.length > 0 ?
             ` — the client calls ${f.foreignOriginFailures.join(', ')}, not the origin under test (a base URL baked in at build time)`
             : '';
@@ -277,25 +293,29 @@ export function judgeDeepSession(f) {
     // Deliberately narrow: 400/401/403/419/422 are a handler ANSWERING (a rejected
     // password, a missing permission — the app working), 5xx is the server failing,
     // and both keep their existing behaviour. Only "no such route" is here.
-    const missingRoute = (f.sessionRequests ?? []).find(r => r.initiator === 'xhr' && r.status !== null && MISSING_ROUTE_STATUS.has(r.status));
+    const missingRoute = (f.sessionRequests ?? []).find(r => r.initiator === 'xhr'
+        && lastHopJudgesTheClient(r)
+        && r.status !== null
+        && MISSING_ROUTE_STATUS.has(r.status));
     if (missingRoute) {
+        const landed = missingRoute.finalPath ?? missingRoute.path;
+        const hop = landed === missingRoute.path ? '' : ` → \`${landed}\``;
         return {
             outcome: 'fail',
-            detail: `\`${missingRoute.method} ${missingRoute.path}\` → ${String(missingRoute.status)}: `
-                + 'the client sent this to a path the server does not route. The credentials were '
-                + 'never evaluated. This is a dead client call — a base URL joined twice, a renamed '
-                + 'route, a wrong method. No type or mock can produce a route that is not mounted.'
+            detail: `\`${missingRoute.method} ${missingRoute.path}\`${hop} → ${String(missingRoute.status)}: `
+                + 'the client sent this to a path the server does not route. This is a dead client '
+                + 'call — a base URL joined twice, a renamed route, a wrong method. No type or mock '
+                + 'can produce a route that is not mounted.'
         };
     }
     // Rule B — the SPA catch-all answering an API call. Any server with a
     // `GET /*` → index.html fallback returns 200 for a route it does not have, so
     // the status is healthy and the body is the app shell. A document navigation
     // answered with HTML is normal; an XHR asking for data and getting HTML is a
-    // call that reached nothing. The sign-in request is exempt: it keeps the first
-    // hop but carries the LAST hop's mime, so a fetch login that 302s to a page
-    // reads as HTML here while being a sign-in that worked.
+    // call that reached nothing. A fetch login that 302s to a page reads as HTML
+    // while being a sign-in that worked, hence the last-hop guard.
     const swallowed = (f.sessionRequests ?? []).find(r => r.initiator === 'xhr'
-        && r.phase !== 'auth'
+        && lastHopJudgesTheClient(r)
         && (r.mimeType ?? '').startsWith('text/html'));
     if (swallowed) {
         return {
@@ -306,7 +326,7 @@ export function judgeDeepSession(f) {
                 + 'sees a 200 it cannot parse. No status check can see this.'
         };
     }
-    const { method, path: p, status, failed } = f.authRequest;
+    const { method, path: p, status, failed, redirected: authRedirected } = f.authRequest;
     if (failed || status === null || status < 200 || status >= 300) {
         return {
             outcome: 'skip',
@@ -317,6 +337,18 @@ export function judgeDeepSession(f) {
     }
     const signedIn = `signed in (\`${method} ${p}\` → ${status})`;
     if (!f.leftAuthWall) {
+        // A form sign-in that redirects lands its status on the hop it reached, so a
+        // 200 here is the landing page's, not a verdict on the credentials. Landing
+        // back on the wall is what a REJECTED password looks like, and the gate's one
+        // FAIL needs the server to have said yes.
+        if (authRedirected === true) {
+            return {
+                outcome: 'skip',
+                note: `the sign-in request (\`${method} ${p}\`) redirected, so its ${String(status)} `
+                    + 'describes the page it landed on and not the credentials, and the client is '
+                    + 'still on the wall — the authenticated half of the app was NOT observed'
+            };
+        }
         return {
             outcome: 'fail',
             detail: `${signedIn} but the client NEVER LEFT THE SIGN-IN WALL: the page is still `
@@ -641,7 +673,7 @@ export async function launchBrowser(bin, userDataDir, { signal } = {}) {
 /**
  * The session over an already-connected browser: navigate, inspect, sign in if the
  * landing is a wall and credentials exist, settle, phase the same-origin request
- * log against the submit, re-enter once the sign-in was accepted, and
+ * log against the sign-in request, re-enter once the sign-in was accepted, and
  * hand the facts to `judge`. Pure protocol logic — no process, no filesystem, no
  * socket — so every branch is testable against a fake `CdpLike`.
  *
@@ -712,18 +744,17 @@ export async function driveSession(cdp, { url, credentials, judge, quietMs }) {
     if (!before)
         throw new Error('the page could not be inspected');
     const sameOrigin = (r) => r.finalUrl.startsWith(`${origin}/`) || r.finalUrl === origin;
+    /** Which origin the client ASKED for — the first hop, before any redirect. */
+    const addressedOrigin = (r) => r.url.startsWith(`${origin}/`) || r.url === origin;
     const isData = (r) => r.type === 'XHR' || r.type === 'Fetch';
     const foreignOriginFailures = () => {
         const out = new Set();
         for (const r of requests.values()) {
             if (sameOrigin(r) || !r.failed || !r.finalUrl.startsWith('http'))
                 continue;
-            try {
-                out.add(new URL(r.finalUrl).origin);
-            }
-            catch {
-                // unparseable url — nothing to name
-            }
+            const o = originOf(r.finalUrl);
+            if (o)
+                out.add(o);
         }
         return [...out];
     };
@@ -735,19 +766,27 @@ export async function driveSession(cdp, { url, credentials, judge, quietMs }) {
      *  'pre'; the sign-in request itself is 'auth', not 'post'. The boundary is the
      *  sign-in request, not the submit: a CSRF token or a beacon the submit fires
      *  BEFORE the login is not evidence about the authenticated client. */
-    const sessionLog = (authId, postSeq) => [...requests]
-        .filter(([, r]) => sameOrigin(r))
-        .map(([id, r]) => ({
-        method: r.method,
-        path: pathOf(r.url),
-        status: r.status,
-        mimeType: r.mimeType,
-        failed: r.failed,
-        initiator: initiatorOf(r),
-        phase: id === authId ? 'auth'
-            : r.seq >= postSeq ? 'post'
-                : 'pre'
-    }));
+    const sessionLog = (authId, postSeq) => {
+        const out = [];
+        for (const [id, r] of requests) {
+            if (!sameOrigin(r))
+                continue;
+            out.push({
+                method: r.method,
+                path: pathOf(r.url),
+                finalPath: pathOf(r.finalUrl),
+                status: r.status,
+                mimeType: r.mimeType,
+                failed: r.failed,
+                initiator: initiatorOf(r),
+                redirected: r.finalUrl !== r.url,
+                phase: id === authId ? 'auth'
+                    : r.seq >= postSeq ? 'post'
+                        : 'pre'
+            });
+        }
+        return out;
+    };
     const facts = (log, over) => ({
         sessionRequests: log,
         ...deriveLegacyFacts(log),
@@ -755,6 +794,7 @@ export async function driveSession(cdp, { url, credentials, judge, quietMs }) {
         credentialsFound: credentials !== null,
         submitted: false,
         foreignOriginFailures: foreignOriginFailures(),
+        signInLeftOrigin: null,
         leftAuthWall: false,
         urlBefore: before.url,
         urlAfter: before.url,
@@ -780,29 +820,35 @@ export async function driveSession(cdp, { url, credentials, judge, quietMs }) {
         return judge(unsubmitted({ submitted: false }));
     lastActivity = Date.now();
     await settle(() => lastActivity, POST_SUBMIT_CAP_MS, quietMs);
+    const firstRequest = (pred) => {
+        for (const [id, r] of requests)
+            if (pred(r))
+                return id;
+        return null;
+    };
     // The sign-in request: the first same-origin non-GET issued by the submit. Its
     // own 2xx is the precondition for judging anything, and it is EXCLUDED from the
     // data evidence — a broken build satisfies "at least one same-origin 2xx" with
     // exactly this request and nothing else.
-    let authId = null;
-    for (const [id, r] of requests) {
-        if (r.seq >= submitSeq && sameOrigin(r) && r.method !== 'GET') {
-            authId = id;
-            break;
-        }
-    }
-    // Nothing after the submit: a form that submits from the fill's own input
-    // events already sent it. Only a NAVIGATION qualifies here — a form submission
-    // is one, and the background traffic the fill races (beacons, telemetry) is
-    // XHR or fetch, never a document.
-    if (authId === null) {
-        for (const [id, r] of requests) {
-            if (r.seq >= fillSeq && sameOrigin(r) && r.method !== 'GET' && r.type === 'Document') {
-                authId = id;
-                break;
-            }
-        }
-    }
+    //
+    // The fallback covers a form that submits from the fill's own input events, so
+    // nothing arrives after the submit at all. Only a NAVIGATION qualifies there —
+    // the background traffic the fill races (beacons, telemetry) is XHR or fetch,
+    // never a document. The two windows overlap; the predicates carry the
+    // distinction.
+    const authId = firstRequest(r => r.seq >= submitSeq && sameOrigin(r) && r.method !== 'GET')
+        ?? firstRequest(r => r.seq >= fillSeq && sameOrigin(r) && r.method !== 'GET' && r.type === 'Document');
+    // An SSO sign-in addresses this app and ends on the provider, so it is absent
+    // from the same-origin log above and "no request to our own origin" would
+    // misname it. Document-only for the same reason the authId fallback is: a
+    // telemetry beacon the fill races that happens to end off-origin would otherwise
+    // name a bogus identity provider.
+    const offsiteSignIn = authId !== null ? null : (firstRequest(r => r.seq >= fillSeq
+        && r.method !== 'GET'
+        && r.type === 'Document'
+        && addressedOrigin(r)
+        && !sameOrigin(r)
+        && r.finalUrl.startsWith('http')));
     const authReq = authId === null ? null : requests.get(authId);
     const now = await evaluate(INSPECT_EXPR);
     const domJudgment = judgeRenderedDom(now?.html ?? '');
@@ -826,7 +872,7 @@ export async function driveSession(cdp, { url, credentials, judge, quietMs }) {
     }
     return judge(facts(sessionLog(authId, authReq?.seq ?? submitSeq), {
         submitted: true,
-        foreignOriginFailures: foreignOriginFailures(),
+        signInLeftOrigin: offsiteSignIn && originOf(requests.get(offsiteSignIn).finalUrl),
         leftAuthWall,
         urlAfter: now?.url ?? before.url,
         postAuthDomOk: domJudgment.ok,
@@ -841,3 +887,11 @@ function pathOf(url) {
         return url;
     }
 }
+function originOf(url) {
+    try {
+        return new URL(url).origin;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/workers/eco-hackage.js

@@ -600,9 +600,9 @@ export function manifestPackages(cwd) {
  * re-export puts the name in the export list; a `module X` re-export puts
  * nothing there at all, which is why `shouldBe` is invisible to the first.
  *
- * The trigger is the hole, with no threshold. Swept over the 299 modules with
- * 5+ exports, the trigger count reads 33 at 50% and 18 at 95%, so the fraction
- * is not carrying the decision and any value picked would just sound right.
+ * The trigger is the hole itself, with no fraction threshold: a threshold moves
+ * the count without changing which modules are actually missing signatures, so
+ * any value picked would only sound principled.
  */
 const EXPORT_NAME_RE = /^[A-Za-z_][\w']*$/;
 /** `module X` inside an export list is a re-export; `Prelude` is base, and base is not fetched. */

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@mjasnikovs/pi-task",
-    "version": "0.40.37",
+    "version": "0.40.39",
     "description": "Deterministic task planning and spec-orchestration for local models — crash-safe /task pipelines with verify/enforce gates, a real-time remote web view, and web/docs/fetch/worker subagent tools.",
     "type": "module",
     "main": "./dist/index.js",