@piagent/platform 1.3.0 → 1.4.0

package/packages/piagent-core/runtime/registration/activity-inspector-command.ts

@@ -1,14 +1,18 @@
+import { createHash } from "node:crypto";
+
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 
 import type { TaskContract } from "../../extensions/guard-types.ts";
 import {
   buildActivityInspector,
   formatActivityInspector,
-  inspectWorkingTreeFiles,
   type ActivityInspectorEvent,
   type CurrentActivity
 } from "../product/activity-inspector.ts";
 import { formatActivityFooter, formatActivityPanel } from "../product/activity-inspector-footer.ts";
+import { adaptActivityTelemetryEvent, runtimeStartedEventDraft } from "../inspection/activity-event-adapter.ts";
+import { RuntimeEventStore, type RuntimeEventRevision } from "../inspection/runtime-event-store.ts";
+import { WEBUI_RUNTIME_INSTANCE_REF, webUiProjectRef, webUiSessionRef } from "../inspection/webui-snapshot.ts";
 import { prefixCompletions, registerRuntimeCommand } from "./extension-registration.ts";
 
 const INSPECTOR_ACTIONS = ["summary", "files", "commands", "security", "context", "toggle", "help"] as const;
@@ -25,12 +29,30 @@ type InspectorDependencies = {
     defaultValue?: string
   ) => Promise<string | undefined>;
   emit: (ctx: ExtensionContext, customType: string, content: string, details?: Record<string, unknown>) => void;
+  protectedPaths?: (ctx: ExtensionContext) => string[];
 };
 
 function sessionKey(ctx: ExtensionContext): string {
   return `${ctx.cwd}\u0000${ctx.sessionManager.getSessionId()}`;
 }
 
+function revisionToken(prefix: string, value: unknown): string {
+  return `${prefix}.${createHash("sha256").update(JSON.stringify(value)).digest("hex")}`;
+}
+
+function eventRevision(ctx: ExtensionContext, task?: TaskContract): RuntimeEventRevision {
+  return {
+    runtimeRevision: revisionToken("runtime-rev", [WEBUI_RUNTIME_INSTANCE_REF, ctx.sessionManager.getSessionId()]),
+    taskRevision: task ? revisionToken("task-rev", [task.taskRunId, task.updatedAt, task.trace.outcome]) : null,
+    controlRevision: task ? revisionToken("control-rev", [task.taskRunId, task.trace.outcome]) : null,
+    workspaceRevision: null,
+    indexRevision: null,
+    approvalRevision: null,
+    sessionOptionRevision: null,
+    queueRevision: null
+  };
+}
+
 function clipped(value: unknown, maximum = 96): string | undefined {
   if (typeof value !== "string") return undefined;
   const normalized = value.replace(/\s+/g, " ").trim();
@@ -67,7 +89,23 @@ export function registerActivityInspector(pi: ExtensionAPI, dependencies: Inspec
   const running = new Map<string, Map<string, CurrentActivity>>();
   const lastActivity = new Map<string, CurrentActivity>();
   const enabled = new Map<string, boolean>();
-  const cached = new Map<string, { at: number; view: ReturnType<typeof buildActivityInspector> }>();
+  const cached = new Map<string, { at: number; view: Awaited<ReturnType<typeof buildActivityInspector>> }>();
+  const eventStores = new Map<string, RuntimeEventStore>();
+
+  function eventStore(ctx: ExtensionContext): RuntimeEventStore {
+    const key = sessionKey(ctx);
+    const existing = eventStores.get(key);
+    if (existing) return existing;
+    const projectRef = webUiProjectRef(ctx.cwd), sessionRef = webUiSessionRef(ctx.sessionManager.getSessionId());
+    const created = new RuntimeEventStore({ projectRoot: ctx.cwd, projectRef, runtimeInstanceId: WEBUI_RUNTIME_INSTANCE_REF, sessionRef });
+    eventStores.set(key, created);
+    if (!created.resyncRequired() && created.replay(null, 1).lastAvailableSequence === null) {
+      const now = new Date().toISOString();
+      created.append(runtimeStartedEventDraft({ identity: { projectRef, runtimeInstanceId: WEBUI_RUNTIME_INSTANCE_REF, sessionRef },
+        revision: eventRevision(ctx), sourceObservedAt: now, buildRef: "runtime-build.unavailable", capabilitySnapshotRef: "capabilities.inspect-only" }), now);
+    }
+    return created;
+  }
 
   function sessionEvents(ctx: ExtensionContext): ActivityInspectorEvent[] {
     let persisted: ActivityInspectorEvent[] = [];
@@ -85,14 +123,15 @@ export function registerActivityInspector(pi: ExtensionAPI, dependencies: Inspec
     return active.length > 0 ? active : lastActivity.has(key) ? [lastActivity.get(key) as CurrentActivity] : [];
   }
 
-  function project(ctx: ExtensionContext, force = false, exactFiles = false) {
+  async function project(ctx: ExtensionContext, force = false) {
     const key = sessionKey(ctx);
     const previous = cached.get(key);
     const current = currentFor(ctx);
-    if (!exactFiles && !force && previous && Date.now() - previous.at < 400) {
+    if (!force && previous && Date.now() - previous.at < 400) {
       return { ...previous.view, state: { ...previous.view.state, running: current.filter((activity) => activity.status === "running").length, current } };
     }
-    const view = buildActivityInspector({
+    const events = eventStore(ctx);
+    const view = await buildActivityInspector({
       cwd: ctx.cwd,
       sessionId: ctx.sessionManager.getSessionId(),
       task: dependencies.activeTask(ctx),
@@ -100,8 +139,11 @@ export function registerActivityInspector(pi: ExtensionAPI, dependencies: Inspec
       sessionEntries: ctx.sessionManager.getBranch(),
       contextUsage: ctx.getContextUsage(),
       current,
-      fileEvidenceMode: exactFiles ? "exact" : "observed",
-      workingTreeFiles: exactFiles ? undefined : inspectWorkingTreeFiles(ctx.cwd)
+      protectedPaths: dependencies.protectedPaths?.(ctx),
+      runtimeInstanceId: WEBUI_RUNTIME_INSTANCE_REF,
+      eventCursor: events.currentCursor(),
+      resyncRequired: events.resyncRequired(),
+      eventReplay: events.retention()
     });
     cached.set(key, { at: Date.now(), view });
     return view;
@@ -112,7 +154,8 @@ export function registerActivityInspector(pi: ExtensionAPI, dependencies: Inspec
     if (typeof ctx.ui?.setWidget === "function") ctx.ui.setWidget("piagent-inspector", undefined);
   }
 
-  function renderSurface(ctx: ExtensionContext, force = false): void {
+  async function renderSurface(ctx: ExtensionContext, force = false): Promise<void> {
+    if (ctx.mode !== "tui") return;
     const canUseStatus = typeof ctx.ui?.setStatus === "function";
     const canUseWidget = typeof ctx.ui?.setWidget === "function";
     if (ctx.hasUI === false || (!canUseStatus && !canUseWidget)) return;
@@ -122,7 +165,7 @@ export function registerActivityInspector(pi: ExtensionAPI, dependencies: Inspec
       return;
     }
     try {
-      const view = project(ctx, force);
+      const view = await project(ctx, force);
       const color = process.env.NO_COLOR === undefined && process.env.TERM !== "dumb";
       if (canUseWidget) {
         ctx.ui.setWidget("piagent-inspector", formatActivityPanel(view, { color }), { placement: "belowEditor" });
@@ -148,6 +191,15 @@ export function registerActivityInspector(pi: ExtensionAPI, dependencies: Inspec
     };
     const stored = [...(memoryEvents.get(key) ?? []), event].slice(-1_000);
     memoryEvents.set(key, stored);
+    try {
+      const store = eventStore(ctx);
+      const draft = adaptActivityTelemetryEvent({ event, identity: { projectRef: webUiProjectRef(ctx.cwd), runtimeInstanceId: WEBUI_RUNTIME_INSTANCE_REF,
+        sessionRef: webUiSessionRef(ctx.sessionManager.getSessionId()), taskId: task?.taskId ?? null, taskRunId: task?.taskRunId ?? null },
+      revision: eventRevision(ctx, task) });
+      if (draft) store.append(draft);
+    } catch {
+      // Event replay is an optional projection. Terminal execution remains authoritative.
+    }
     let active = running.get(key);
     if (!active) {
       active = new Map();
@@ -182,7 +234,7 @@ export function registerActivityInspector(pi: ExtensionAPI, dependencies: Inspec
       }
     }
     cached.delete(key);
-    renderSurface(ctx, event.event === "tool_result" || event.event === "tool_decision");
+    void renderSurface(ctx, event.event === "tool_result" || event.event === "tool_decision");
   }
 
   function emitHelp(ctx: ExtensionContext): void {
@@ -235,14 +287,14 @@ export function registerActivityInspector(pi: ExtensionAPI, dependencies: Inspec
         const key = sessionKey(ctx);
         const next = enabled.get(key) === false;
         enabled.set(key, next);
-        renderSurface(ctx, true);
+        await renderSurface(ctx, true);
         ctx.ui.notify(`Piagent Inspector footer panel: ${next ? "on" : "off"}`, "info");
         return;
       }
-      const view = project(ctx, true, action === "files" || action === "security");
+      const view = await project(ctx, true);
       const content = json ? JSON.stringify({ action, inspector: view }) : formatActivityInspector(view, action);
       dependencies.emit(ctx, `piagent-inspector-${action}`, content, { action, inspector: view });
-      renderSurface(ctx);
+      void renderSurface(ctx);
     }
   });
 
@@ -254,12 +306,14 @@ export function registerActivityInspector(pi: ExtensionAPI, dependencies: Inspec
     lastActivity.delete(key);
     enabled.delete(key);
     cached.delete(key);
+    eventStores.delete(key);
   }
 
   return {
     observe,
     refresh: (ctx: ExtensionContext) => renderSurface(ctx, true),
-    project: (ctx: ExtensionContext) => project(ctx, true, true),
+    project: (ctx: ExtensionContext) => project(ctx, true),
+    replay: (ctx: ExtensionContext, afterCursor: string | null, limit?: number) => eventStore(ctx).replay(afterCursor, limit),
     dispose
   };
 }

package/packages/piagent-core/runtime/registration/task-start-tool.ts

@@ -1,5 +1,4 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-
 import { exactFinalOutputGuidance } from "../quality/exact-output-contract.ts";
 import { taskPerformanceAssurance } from "../quality/performance-assurance.ts";
 import { automaticTaskSummary, boundedRuntimeIntakeMessage } from "../workflows/task-intake.ts";
@@ -7,18 +6,16 @@ import { WORKING_TREE_DIGEST_ALGORITHM } from "../../extensions/working-tree-dig
 import { createEnvironmentBoundTaskAuthority } from "../policy/task-authority-runtime.ts";
 import { authorityReplacementState } from "../policy/authority-resume-policy.ts";
 import { compileCriterionGraph, criterionGraphContextSelection, criterionGraphGuidance, criterionGraphMode } from "../../extensions/criterion-graph.js";
-
+import { captureTaskStartBaseline } from "../inspection/task-baseline-start-capture.ts";
 type ExtensionContext = any;
 type TaskContract = any;
 type TaskStartParameters = any;
-
 function sameStringRecord(left: Record<string, string>, right: Record<string, string>): boolean {
   const leftEntries = Object.entries(left).sort(([a], [b]) => a.localeCompare(b));
   const rightEntries = Object.entries(right).sort(([a], [b]) => a.localeCompare(b));
   return leftEntries.length === rightEntries.length
     && leftEntries.every(([key, value], index) => rightEntries[index]?.[0] === key && rightEntries[index]?.[1] === value);
 }
-
 function satisfiesAuthorityReplacement(task: TaskContract, state: ReturnType<typeof authorityReplacementState>): boolean {
   if (!task.authoritySnapshot) return false;
   if (state.reason === "mechanical-rollback-requested") {
@@ -31,7 +28,6 @@ function satisfiesAuthorityReplacement(task: TaskContract, state: ReturnType<typ
   }
   return true;
 }
-
 export function registerTaskStartTool(pi: ExtensionAPI, deps: Record<string, any>): any {
   const {
     DEFAULT_MAX_TASK_ATTEMPTS, ORCHESTRATION_ROLES, REVIEW_LENSES, StringEnum, Type,
@@ -39,10 +35,10 @@ export function registerTaskStartTool(pi: ExtensionAPI, deps: Record<string, any
     applyRuntimeLifecycleObservation, automaticAcceptanceCriteria, automaticReadOnlyTaskScope, automaticReviewLenses, automaticTaskIntakeMode, automaticTaskRiskLane, automaticTaskScope,
     acceptanceBaselineGuidance, acceptanceProofGuidance, bindSessionTask, buildAcceptanceReceipt, compactTaskDetails, contextBudgetConfig, createTaskRunId,
     currentSessionName, defaultWorkPlan, effectiveProtectedPaths, hasGitEvidenceRoot, hasOperatorSessionName,
-    loadProfileFromContext, normalizeReviewLenses, normalizeWorkPlanSteps, nowIso, policy,
+    loadProfileFromContext, matchesProtectedPath, normalizeReviewLenses, normalizeWorkPlanSteps, nowIso, policy,
     priorTaskAttempts, recordTaskStartCheckpoint, redactText, redactTextArray, registerRuntimeTool,
     repositoryFileManifest, resolveOrchestrationPolicy, resolveTaskScopePatterns, runtimeLifecycleMode, runtimeState, safeTaskId, selectVerificationPlan,
-    summarizeAttempt, validTaskScopePattern, validateNewWorkPlan, verifierCommandInstructions, workingTreeSnapshot, workingTreeSnapshotHasUnavailableEvidence,
+    summarizeAttempt, validTaskScopePattern, validateNewWorkPlan, verifierCommandInstructions, workingTreeEvidenceDigest, workingTreeSnapshot, workingTreeSnapshotHasUnavailableEvidence,
     writeTask
   } = deps;
   const taskStartTool = {
@@ -287,6 +283,15 @@ export function registerTaskStartTool(pi: ExtensionAPI, deps: Record<string, any
       if (changeMode === "source-change" && workingTreeSnapshotHasUnavailableEvidence(baselineFileDigests)) {
         return { content: [{ type: "text", text: "Task start refused: the baseline contains unavailable working-tree content evidence. Restore readable repository files before starting source changes." }], isError: true };
       }
+      if (changeMode === "source-change") {
+        const protectedPaths = effectiveProtectedPaths(policy, profile).readProtectedPaths;
+        try {
+          await captureTaskStartBaseline({ projectRoot: ctx.cwd, taskId, taskRunId, sessionId, capturedAt: createdAt,
+            baselineTreeDigest: workingTreeEvidenceDigest(baselineFileDigests), protectedPaths, matchesProtectedPath });
+        } catch {
+          return { content: [{ type: "text", text: "Task start refused: the private Task Baseline Manifest could not be captured safely. Inspect local-state permissions and retry before editing." }], isError: true };
+        }
+      }
       const acceptance = buildAcceptanceReceipt({
         summary: safeSummary,
         expectedOutput: redactText(params.expectedOutput),
@@ -369,7 +374,6 @@ export function registerTaskStartTool(pi: ExtensionAPI, deps: Record<string, any
       appendTrace(ctx.cwd, { taskId, taskRunId, sessionId, sessionName, attempt, event: "task_start", summary: task.summary, riskLane: params.riskLane, intakeMode: task.intakeMode, changeMode: task.changeMode, lifecycleMode, criterionGraphMode: written.criterionGraph.mode, criterionGraphDigest: written.criterionGraph.graphDigest, authorityProfile: written.authoritySnapshot.profile, authoritySnapshotDigest: written.authoritySnapshot.snapshotDigest, scopeMappings, seededContext: seededContext.map((item) => item.path) });
       appendSessionTrace(pi, { taskId, taskRunId, sessionId, sessionName, attempt, event: "task_start", summary: task.summary, riskLane: params.riskLane, intakeMode: task.intakeMode, changeMode: task.changeMode, lifecycleMode, criterionGraphMode: written.criterionGraph.mode, criterionGraphDigest: written.criterionGraph.graphDigest, authorityProfile: written.authoritySnapshot.profile, authoritySnapshotDigest: written.authoritySnapshot.snapshotDigest, scopeMappings, seededContext: seededContext.map((item) => item.path) });
       recordTaskStartCheckpoint(ctx, written, firstReady.id, lifecycleMode);
-
       return {
         content: [{
           type: "text",
@@ -408,18 +412,13 @@ export function registerTaskStartTool(pi: ExtensionAPI, deps: Record<string, any
     }
   };
   registerRuntimeTool(pi, taskStartTool);
-
-  async function maybeStartAutomaticTask(
-    prompt: string,
-    ctx: ExtensionContext
-  ): Promise<{ started: boolean; text: string; task?: TaskContract } | undefined> {
+  async function maybeStartAutomaticTask(prompt: string, ctx: ExtensionContext): Promise<{ started: boolean; text: string; task?: TaskContract } | undefined> {
     const profile = loadProfileFromContext(ctx);
     const readProtectedPaths = effectiveProtectedPaths(policy, profile).readProtectedPaths;
     const intakeMode = automaticTaskIntakeMode(prompt, readProtectedPaths);
     if (!intakeMode) return undefined;
     const active = activeSessionTask(ctx.cwd, ctx.sessionManager.getSessionId()) as TaskContract | undefined;
     if (active?.trace.outcome === "pending") return undefined;
-
     const summary = redactText(automaticTaskSummary(prompt));
     const sessionName = currentSessionName(ctx);
     const projectFiles = repositoryFileManifest(ctx.cwd);

package/packages/piagent-core/runtime/session/model-authorship-state.ts

@@ -17,6 +17,12 @@ type AuthorizedMutation = {
 };
 
 export type ModelMutationCompletion = { changedPaths: string[]; recordedDigests: Record<string, string> };
+export type ModelMutationEvidenceCompletion = ModelMutationCompletion & {
+  beforeSnapshot: Record<string, string> | null;
+  targetPaths: string[];
+  recordedContentDigests: Record<string, string>;
+  proofModes: Record<string, "full-content" | "exact-replacement">;
+};
 
 function uniquePaths(values: string[]): string[] {
   return [...new Set(values.map((value) => String(value ?? "").replaceAll("\\", "/").replace(/^\.\//, "").trim()).filter(Boolean))].sort();
@@ -95,16 +101,30 @@ export class ModelAuthorshipState {
     currentSnapshot: Record<string, string>,
     currentContentDigests: Record<string, string> = {}
   ): ModelMutationCompletion {
+    const result = this.completeWithEvidence(identity, toolCallId, success, currentSnapshot, currentContentDigests);
+    return { changedPaths: result.changedPaths, recordedDigests: result.recordedDigests };
+  }
+
+  completeWithEvidence(
+    identity: ModelMutationIdentity,
+    toolCallId: string,
+    success: boolean,
+    currentSnapshot: Record<string, string>,
+    currentContentDigests: Record<string, string> = {}
+  ): ModelMutationEvidenceCompletion {
     const key = this.#key(identity.taskRunId, toolCallId);
     const reservation = this.#reservations.get(key);
     this.#reservations.delete(key);
-    if (!reservation) return { changedPaths: [], recordedDigests: {} };
+    const empty: ModelMutationEvidenceCompletion = {
+      changedPaths: [], recordedDigests: {}, beforeSnapshot: null, targetPaths: [], recordedContentDigests: {}, proofModes: {}
+    };
+    if (!reservation) return empty;
     const changed = changedPaths(reservation.workingTreeSnapshot, currentSnapshot);
     const evidence = this.#taskEvidence(reservation.identity.taskRunId);
     const proofPaths = uniquePaths([...reservation.proof.fullContentPaths, ...reservation.proof.replacePaths]);
     const invalidate = () => {
       for (const file of uniquePaths([...reservation.targetPaths, ...changed])) evidence.delete(file);
-      return { changedPaths: changed, recordedDigests: {} };
+      return { ...empty, changedPaths: changed, beforeSnapshot: { ...reservation.workingTreeSnapshot }, targetPaths: [...reservation.targetPaths] };
     };
     if (!sameIdentity(reservation.identity, identity) || !success || changed.length === 0 || !exactPaths(changed, proofPaths)) return invalidate();
     const candidates: Array<{ file: string; workingTreeDigest: string; contentDigest: string }> = [];
@@ -116,12 +136,20 @@ export class ModelAuthorshipState {
       candidates.push({ file, workingTreeDigest, contentDigest: content });
     }
     const recordedDigests: Record<string, string> = {};
+    const recordedContentDigests: Record<string, string> = {};
+    const proofModes: Record<string, "full-content" | "exact-replacement"> = {};
     for (const candidate of candidates) {
       evidence.set(candidate.file, { ...reservation.identity, ...candidate });
       recordedDigests[candidate.file] = candidate.workingTreeDigest;
+      recordedContentDigests[candidate.file] = candidate.contentDigest;
+      proofModes[candidate.file] = reservation.proof.fullContentPaths.includes(candidate.file) ? "full-content" : "exact-replacement";
     }
     while (this.#evidence.size > 100) this.#evidence.delete(this.#evidence.keys().next().value as string);
-    return { changedPaths: changed, recordedDigests };
+    return {
+      changedPaths: changed, recordedDigests,
+      beforeSnapshot: { ...reservation.workingTreeSnapshot }, targetPaths: [...reservation.targetPaths],
+      recordedContentDigests, proofModes
+    };
   }
 
   digests(identity: ModelMutationIdentity, currentSnapshot?: Record<string, string>): Record<string, string> {

package/packages/piagent-core/runtime/session/runtime-state.ts

@@ -6,7 +6,7 @@ import type { TaskContract } from "../../extensions/guard-types.ts";
 import type { RecoveryHistoryEntry } from "../recovery/recovery-policy.ts";
 import type { ResumeState } from "../recovery/resume-state.ts";
 import { ModelAuthorshipState } from "./model-authorship-state.ts";
-import type { ModelMutationIdentity } from "./model-authorship-state.ts";
+import type { ModelMutationEvidenceCompletion, ModelMutationIdentity } from "./model-authorship-state.ts";
 import type { ModelMutationProof } from "../quality/model-mutation-proof.ts";
 import { PerformanceReviewState } from "./performance-review-state.ts";
 import type {
@@ -239,6 +239,16 @@ export class RuntimeSessionState {
     return this.#modelAuthorship.complete(identity, toolCallId, success, currentSnapshot, currentContentDigests);
   }
 
+  completeAuthorizedModelMutationEvidence(
+    identity: ModelMutationIdentity,
+    toolCallId: string,
+    success: boolean,
+    currentSnapshot: Record<string, string>,
+    currentContentDigests: Record<string, string> = {}
+  ): ModelMutationEvidenceCompletion {
+    return this.#modelAuthorship.completeWithEvidence(identity, toolCallId, success, currentSnapshot, currentContentDigests);
+  }
+
   successfulModelMutationDigests(identity: ModelMutationIdentity, currentSnapshot?: Record<string, string>): Record<string, string> {
     return this.#modelAuthorship.digests(identity, currentSnapshot);
   }