@piagent/platform 1.3.0 → 1.4.0

package/packages/piagent-core/extensions/state-retention.js

@@ -1,3 +1,4 @@
+import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { ensurePrivateStateDirectory, resolveLocalStatePath } from "./local-state-path.js";
@@ -16,75 +17,107 @@ function processAlive(pid) {
   }
 }
 
+function ensurePrivateParent(filePath, projectRoot) {
+  const safeFilePath = projectRoot
+    ? resolveLocalStatePath(projectRoot, filePath, { label: "Local JSONL state" })
+    : filePath;
+  if (projectRoot) ensurePrivateStateDirectory(projectRoot, path.dirname(filePath), "Local JSONL state directory");
+  else fs.mkdirSync(path.dirname(safeFilePath), { recursive: true, mode: 0o700 });
+  try {
+    fs.chmodSync(path.dirname(safeFilePath), 0o700);
+  } catch {
+    // Best effort on filesystems that do not expose POSIX modes.
+  }
+  return safeFilePath;
+}
+
+function publishOwnedLock(lockPath) {
+  let candidatePath;
+  let descriptor;
+  while (true) {
+    const candidate = `${lockPath}.${process.pid}.${crypto.randomBytes(12).toString("hex")}.candidate`;
+    try {
+      descriptor = fs.openSync(candidate, "wx", 0o600);
+      candidatePath = candidate;
+      break;
+    } catch (error) {
+      if (error?.code !== "EEXIST") throw error;
+    }
+  }
+  try {
+    fs.writeFileSync(descriptor, `${process.pid}\n`);
+    fs.closeSync(descriptor);
+    descriptor = undefined;
+    try {
+      fs.linkSync(candidatePath, lockPath);
+      const stat = fs.lstatSync(candidatePath);
+      return { device: stat.dev, inode: stat.ino };
+    } catch (error) {
+      if (error?.code === "EEXIST") return undefined;
+      throw error;
+    }
+  } finally {
+    if (descriptor !== undefined) {
+      try { fs.closeSync(descriptor); } catch {}
+    }
+    fs.rmSync(candidatePath, { force: true });
+  }
+}
+
+function releaseOwnedLock(lockPath, owner) {
+  try {
+    const stat = fs.lstatSync(lockPath);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.dev !== owner.device || stat.ino !== owner.inode) return;
+    fs.rmSync(lockPath, { force: true });
+  } catch (error) {
+    if (error?.code !== "ENOENT") throw error;
+  }
+}
+
 function recoverDeadLock(lockPath) {
   const recoveryPath = `${lockPath}.recovery`;
-  let recoveryDescriptor;
+  const recoveryOwner = publishOwnedLock(recoveryPath);
+  // A recovery owner is never stolen automatically: without a kernel
+  // compare-and-delete primitive, doing so can delete a live successor. A
+  // crashed recovery owner therefore fails closed and needs operator cleanup.
+  if (!recoveryOwner) return false;
   try {
-    recoveryDescriptor = fs.openSync(recoveryPath, "wx", 0o600);
     let stat;
-    let owner = null;
+    let ownerText;
     try {
       stat = fs.lstatSync(lockPath);
       if (!stat.isFile() || stat.isSymbolicLink()) return false;
-      owner = Number.parseInt(fs.readFileSync(lockPath, "utf8").trim(), 10);
+      ownerText = fs.readFileSync(lockPath, "utf8").trim();
     } catch (error) {
       return error?.code === "ENOENT";
     }
-    const validDeadOwner = Number.isInteger(owner) && owner > 0 && !processAlive(owner);
-    const malformedAndStale = (!Number.isInteger(owner) || owner <= 0) && Date.now() - stat.mtimeMs > LOCK_STALE_MS;
+    const parsedOwner = /^[1-9]\d*$/.test(ownerText) ? Number(ownerText) : undefined;
+    const owner = Number.isSafeInteger(parsedOwner) && parsedOwner > 0 ? parsedOwner : undefined;
+    const validDeadOwner = owner !== undefined && !processAlive(owner);
+    const malformedAndStale = owner === undefined && Date.now() - stat.mtimeMs > LOCK_STALE_MS;
     if (!validDeadOwner && !malformedAndStale) return false;
     fs.rmSync(lockPath, { force: true });
     return true;
-  } catch (error) {
-    if (error?.code === "EEXIST") return false;
-    throw error;
   } finally {
-    if (recoveryDescriptor !== undefined) {
-      try { fs.closeSync(recoveryDescriptor); } catch {}
-      fs.rmSync(recoveryPath, { force: true });
-    }
+    releaseOwnedLock(recoveryPath, recoveryOwner);
   }
 }
 
-function ensurePrivateParent(filePath, projectRoot) {
-  const safeFilePath = projectRoot
-    ? resolveLocalStatePath(projectRoot, filePath, { label: "Local JSONL state" })
-    : filePath;
-  if (projectRoot) ensurePrivateStateDirectory(projectRoot, path.dirname(filePath), "Local JSONL state directory");
-  else fs.mkdirSync(path.dirname(safeFilePath), { recursive: true, mode: 0o700 });
-  try {
-    fs.chmodSync(path.dirname(safeFilePath), 0o700);
-  } catch {
-    // Best effort on filesystems that do not expose POSIX modes.
-  }
-  return safeFilePath;
-}
-
 function withFileLock(filePath, action) {
   const lockPath = `${filePath}.lock`;
   const deadline = Date.now() + LOCK_WAIT_MS;
-  let descriptor;
-  while (descriptor === undefined) {
-    try {
-      descriptor = fs.openSync(lockPath, "wx", 0o600);
-      fs.writeFileSync(descriptor, `${process.pid}\n`);
-    } catch (error) {
-      if (error?.code !== "EEXIST") throw error;
-      if (recoverDeadLock(lockPath)) continue;
-      if (Date.now() >= deadline) {
-        throw new Error(`Timed out waiting for state lock: ${path.basename(filePath)}`);
-      }
-      Atomics.wait(sleepBuffer, 0, 0, 10);
+  let owner;
+  while (!(owner = publishOwnedLock(lockPath))) {
+    if (recoverDeadLock(lockPath)) continue;
+    if (Date.now() >= deadline) {
+      throw new Error(`Timed out waiting for state lock: ${path.basename(filePath)}`);
     }
+    Atomics.wait(sleepBuffer, 0, 0, 10);
   }
   try {
     return action();
   } finally {
-    try {
-      fs.closeSync(descriptor);
-    } finally {
-      fs.rmSync(lockPath, { force: true });
-    }
+    releaseOwnedLock(lockPath, owner);
   }
 }
 

package/packages/piagent-core/extensions/task-journal.js

@@ -282,6 +282,23 @@ export function appendTaskJournalEventAtMost(cwd, event, options = {}) {
   }
 }
 
+export function transactTaskJournal(cwd, transaction) {
+  if (typeof transaction !== "function") throw new TypeError("Task journal transaction must be a function");
+  const safePaths = writableJournalPaths(cwd);
+  const release = acquireLock(safePaths);
+  try {
+    const journal = recoverIncompleteJournalTail(cwd, safePaths, readTaskJournal(cwd));
+    if (journal.corruptions.length > 0) throw new Error(`Task journal chain is corrupt: ${journal.corruptions[0]}`);
+    const decision = transaction({ events: [...journal.events], head: journal.head ? { ...journal.head } : undefined });
+    if (!decision || typeof decision !== "object" || Array.isArray(decision)) throw new Error("Task journal transaction returned an invalid decision");
+    if (!decision.event) return { appended: false, record: undefined, result: decision.result };
+    const record = appendJournalRecord(safePaths, journal, decision.event, decision.recordedAt);
+    return { appended: true, record, result: decision.result };
+  } finally {
+    release();
+  }
+}
+
 export function readTaskJournal(cwd, options = {}) {
   const paths = taskJournalPaths(cwd);
   let safePath;
@@ -290,7 +307,17 @@ export function readTaskJournal(cwd, options = {}) {
   } catch {
     return { events: [], corruptions: ["journal path is unsafe"], head: undefined };
   }
-  if (!fs.existsSync(safePath)) return { events: [], corruptions: [], head: undefined };
+  if (!fs.existsSync(safePath)) return { events: [], corruptions: [], head: undefined, inputTruncated: false, omittedEvents: 0 };
+  if (Number.isInteger(options.maximumBytes) && options.maximumBytes > 0) {
+    try {
+      const stat = fs.lstatSync(safePath);
+      if (!stat.isFile() || stat.isSymbolicLink() || stat.size > options.maximumBytes) {
+        return { events: [], corruptions: ["journal exceeds bounded inspection size"], head: undefined, inputTruncated: true, omittedEvents: 0 };
+      }
+    } catch {
+      return { events: [], corruptions: ["journal size could not be inspected"], head: undefined, inputTruncated: false, omittedEvents: 0 };
+    }
+  }
   const content = fs.readFileSync(safePath);
   const finalNewline = content.length === 0 || content.at(-1) === 0x0a;
   const lastNewline = finalNewline ? content.length - 1 : content.lastIndexOf(0x0a);
@@ -329,6 +356,8 @@ export function readTaskJournal(cwd, options = {}) {
   return {
     events: visibleEvents,
     corruptions,
+    inputTruncated: visibleEvents.length < events.length,
+    omittedEvents: Math.max(0, events.length - visibleEvents.length),
     recoverableTailBytes,
     validBytes,
     head: events.at(-1)

package/packages/piagent-core/extensions/task-state.js

@@ -66,17 +66,9 @@ export function safeTaskId(value) {
   return normalized || "task";
 }
 
-function stateRoot(cwd) {
-  return path.join(cwd, ".pi", "piagent-state");
-}
-
-function tasksRoot(cwd) {
-  return path.join(stateRoot(cwd), "tasks");
-}
-
-function sessionsRoot(cwd) {
-  return path.join(stateRoot(cwd), "session-tasks");
-}
+function stateRoot(cwd) { return path.join(cwd, ".pi", "piagent-state"); }
+function tasksRoot(cwd) { return path.join(stateRoot(cwd), "tasks"); }
+function sessionsRoot(cwd) { return path.join(stateRoot(cwd), "session-tasks"); }
 
 function taskRunPath(cwd, taskRunId) {
   return path.join(tasksRoot(cwd), `${safeTaskId(taskRunId)}.json`);
@@ -98,7 +90,12 @@ function readJson(cwd, filePath) {
     const safePath = resolveLocalStatePath(cwd, filePath, { label: "Task state", kind: "file" });
     const descriptor = fs.openSync(safePath, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
     try {
-      return JSON.parse(fs.readFileSync(descriptor, "utf8"));
+      const before = fs.fstatSync(descriptor, { bigint: true });
+      if (!before.isFile() || before.size > BigInt(8 * 1024 * 1024)) return undefined;
+      const value = JSON.parse(fs.readFileSync(descriptor, "utf8"));
+      const after = fs.fstatSync(descriptor, { bigint: true });
+      const fields = ["dev", "ino", "mode", "size", "mtimeNs", "ctimeNs"];
+      return fields.every((field) => before[field] === after[field]) ? value : undefined;
     } finally {
       fs.closeSync(descriptor);
     }
@@ -586,7 +583,6 @@ function gitOutput(cwd, args, options = {}) {
     stdio: ["ignore", "pipe", "ignore"]
   });
 }
-
 function gitHasHead(cwd) {
   try {
     gitOutput(cwd, ["rev-parse", "--verify", "HEAD"]);
@@ -595,7 +591,6 @@ function gitHasHead(cwd) {
     return false;
   }
 }
-
 export function isGitWorkingTree(cwd) {
   try {
     return gitOutput(cwd, ["rev-parse", "--is-inside-work-tree"]).trim() === "true";
@@ -603,20 +598,18 @@ export function isGitWorkingTree(cwd) {
     return false;
   }
 }
-
 function normalizedGitPath(value) {
   return String(value ?? "").replaceAll("\\", "/").replace(/^\/+/, "");
 }
-
 function prefixedGitPath(prefix, file) {
   const normalized = normalizedGitPath(file);
   return prefix ? `${prefix}/${normalized}` : normalized;
 }
 
-function workingTreeFilesForGitRoot(cwd) {
+function workingTreeFilesForGitRoot(cwd, observeRename) {
   if (!isGitWorkingTree(cwd)) return [];
   const changed = gitHasHead(cwd)
-    ? changedPathsFromNameStatus(gitOutput(cwd, ["diff", "--name-status", "-z", "--find-renames", "--diff-filter=ACMRD", "HEAD", "--"]))
+    ? changedPathsFromNameStatus(gitOutput(cwd, ["diff", "--name-status", "-z", "--find-renames", "--diff-filter=ACMRD", "HEAD", "--"]), observeRename)
     : gitOutput(cwd, ["ls-files", "-z"]).split("\0").filter(Boolean);
   const untracked = gitOutput(cwd, ["ls-files", "--others", "--exclude-standard", "-z"]).split("\0").filter(Boolean);
   return [...new Set([...changed, ...untracked].map(normalizedGitPath).filter((item) => item && !item.startsWith(".pi/piagent-state/")))].sort();
@@ -694,9 +687,7 @@ function nonGitWorkspaceFiles(cwd, gitRootPrefixes) {
   return files.sort();
 }
 
-function nonGitWorkspaceFileDigest(cwd, file) {
-  return streamedWorkingTreeFileDigest(cwd, file, false);
-}
+function nonGitWorkspaceFileDigest(cwd, file, protectedProjectPath = null) { return streamedWorkingTreeFileDigest(cwd, file, false, protectedProjectPath); }
 
 function pathWithinNonGitWorkspaceEvidenceRoot(candidate, gitRootPrefixes) {
   const topSegment = candidate.split("/")[0];
@@ -777,7 +768,7 @@ export function repositoryFileManifest(cwd, maxFiles = 10_000) {
   return [...new Set(files)].sort();
 }
 
-function changedPathsFromNameStatus(output) {
+function changedPathsFromNameStatus(output, observeRename) {
   const fields = String(output ?? "").split("\0").filter(Boolean);
   const files = [];
   for (let index = 0; index < fields.length;) {
@@ -787,7 +778,7 @@ function changedPathsFromNameStatus(output) {
     files.push(source);
     if (/^[RC]/.test(status)) {
       const destination = fields[index++];
-      if (destination) files.push(destination);
+      if (destination) { files.push(destination); observeRename?.(source, destination); }
     }
   }
   return files;
@@ -804,8 +795,12 @@ export function workingTreeSnapshotHasUnavailableEvidence(snapshot) {
   return Object.values(snapshot ?? {}).some((digest) => isUnavailableWorkingTreeDigest(digest));
 }
 
-function streamedWorkingTreeFileDigest(root, file, hasHead) {
+function streamedWorkingTreeFileDigest(root, file, hasHead, protectedProjectPath = null) {
   const absolute = path.resolve(root, file);
+  if (protectedProjectPath) {
+    try { return unavailableWorkingTreeDigest(protectedProjectPath, "protected-path", fs.lstatSync(absolute)); }
+    catch { return unavailableWorkingTreeDigest(protectedProjectPath, "protected-path"); }
+  }
   const relative = path.relative(root, absolute);
   if (!relative || relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
     return unavailableWorkingTreeDigest(file, "outside-root");
@@ -866,22 +861,24 @@ function streamedWorkingTreeFileDigest(root, file, hasHead) {
   }
 }
 
-export function workingTreeSnapshot(cwd) {
+export function workingTreeSnapshot(cwd, options = {}) {
   const snapshot = {};
+  const isProtectedProjectPath = typeof options.isProtectedProjectPath === "function" ? options.isProtectedProjectPath : () => false;
   const roots = gitEvidenceRoots(cwd);
   for (const root of roots) {
-    const hasHead = gitHasHead(root.cwd);
-    for (const file of workingTreeFilesForGitRoot(root.cwd)) {
-      const snapshotPath = prefixedGitPath(root.prefix, file);
-      snapshot[snapshotPath] = streamedWorkingTreeFileDigest(root.cwd, file, hasHead);
+    const protectedAliases = new Set();
+    const observeRename = (source, destination) => {
+      const paths = [source, destination];
+      if (paths.some((file) => file === ".pi/piagent-state" || file.startsWith(".pi/piagent-state/") || isProtectedProjectPath(prefixedGitPath(root.prefix, file))))
+        paths.forEach((file) => protectedAliases.add(file));
+    };
+    const hasHead = gitHasHead(root.cwd); for (const file of workingTreeFilesForGitRoot(root.cwd, observeRename)) {
+      const projectPath = prefixedGitPath(root.prefix, file);
+      snapshot[projectPath] = streamedWorkingTreeFileDigest(root.cwd, file, hasHead, isProtectedProjectPath(projectPath) || protectedAliases.has(file) ? projectPath : null);
     }
-  }
-  if (!isGitWorkingTree(cwd) && roots.length > 0) {
-    for (const file of nonGitWorkspaceFiles(cwd, roots.map((root) => root.prefix))) {
-      snapshot[file] = nonGitWorkspaceFileDigest(cwd, file);
-    }
-  }
-  return snapshot;
+  } if (!isGitWorkingTree(cwd) && roots.length > 0) for (const file of nonGitWorkspaceFiles(cwd, roots.map((root) => root.prefix))) {
+      snapshot[file] = nonGitWorkspaceFileDigest(cwd, file, isProtectedProjectPath(file) ? file : null);
+  } return snapshot;
 }
 
 export function taskStateMigrationStatus(cwd) {

package/packages/piagent-core/mcp/mcp-server-catalog.js

@@ -68,7 +68,7 @@ export const CATALOG_SERVERS = {
     }
   },
   figma: {
-    description: "Figma remote MCP server. Requires Figma OAuth from the MCP panel when first used.",
+    description: "Figma remote MCP server. OAuth works only for clients approved in the Figma MCP Catalog.",
     config: {
       url: "https://mcp.figma.com/mcp",
       auth: "oauth",
@@ -99,7 +99,7 @@ export const CATALOG_PREREQUISITES = {
     "export GITHUB_PERSONAL_ACCESS_TOKEN with the scopes you intend to use"
   ],
   playwright: ["browsers installed on first use (npx playwright install)"],
-  figma: ["Figma OAuth, completed from the Pi MCP panel on first use"],
+  figma: ["Piagent approved in the Figma MCP Catalog before remote OAuth can register"],
   "figma-desktop": ["Figma desktop running with Dev Mode MCP enabled"]
 };
 
@@ -119,12 +119,12 @@ export const CATALOG_PRESETS = {
   docs: ["context7"],
   browser: ["chrome-devtools", "playwright"],
   github: ["github"],
-  design: ["figma"],
+  design: ["figma-desktop"],
   "design-local": ["figma-desktop"],
   web: ["context7", "chrome-devtools", "playwright"],
   core: ["context7", "chrome-devtools", "github"],
-  popular: ["context7", "chrome-devtools", "playwright", "github", "figma"],
-  all: ["context7", "chrome-devtools", "playwright", "github", "figma", "figma-desktop"]
+  popular: ["context7", "chrome-devtools", "playwright", "github", "figma-desktop"],
+  all: ["context7", "chrome-devtools", "playwright", "github", "figma-desktop", "figma"]
 };
 
 /** @param {string} name @returns {boolean} */

package/packages/piagent-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/core",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "type": "module",
   "private": true,
   "license": "MIT",

package/packages/piagent-core/runtime/hooks/session-start-hook.ts

@@ -49,7 +49,7 @@ type SessionStartHookDependencies = {
   inspectResume: (cwd: string, task: TaskContract, sessionId: string) => ResumeState;
   telemetry: (ctx: ExtensionContext, payload: Record<string, unknown>) => void;
   syncTrajectory?: (ctx: ExtensionContext, task: TaskContract) => TrajectorySyncResult;
-  afterStart?: (ctx: ExtensionContext) => void;
+  afterStart?: (ctx: ExtensionContext) => void | Promise<void>;
 };
 
 export function registerSessionStartHook(pi: ExtensionAPI, dependencies: SessionStartHookDependencies): void {
@@ -227,6 +227,6 @@ export function registerSessionStartHook(pi: ExtensionAPI, dependencies: Session
       taskRecovery,
       executionBackend
     });
-    dependencies.afterStart?.(ctx);
+    await dependencies.afterStart?.(ctx);
   });
 }

package/packages/piagent-core/runtime/hooks/tool-call-hook.ts

@@ -17,6 +17,7 @@ type ToolCallHookDependencies = {
   beforeAuthorize?: (event: ToolCallEvent, ctx: ExtensionContext) => Promise<ToolCallDecision> | ToolCallDecision;
   authorize: (event: ToolCallEvent, ctx: ExtensionContext) => Promise<ToolCallDecision> | ToolCallDecision;
   reviewBudgetDecision?: (event: ToolCallEvent, ctx: ExtensionContext) => ToolCallDecision;
+  beforeStart?: (event: ToolCallEvent, ctx: ExtensionContext) => ToolCallDecision;
   afterDecision?: (
     event: ToolCallEvent,
     ctx: ExtensionContext,
@@ -72,7 +73,9 @@ export function registerToolCallHook(pi: ExtensionAPI, dependencies: ToolCallHoo
     const decision = authorizationDecision && typeof authorizationDecision === "object" && authorizationDecision.block
       ? authorizationDecision
       : dependencies.reviewBudgetDecision?.(resolvedEvent, ctx);
-    const blockedDecision = decision && typeof decision === "object" ? decision : undefined;
+    const startDecision = !(decision && typeof decision === "object" && decision.block) ? dependencies.beforeStart?.(resolvedEvent, ctx) : undefined;
+    const finalDecision = startDecision && typeof startDecision === "object" && startDecision.block ? startDecision : decision;
+    const blockedDecision = finalDecision && typeof finalDecision === "object" ? finalDecision : undefined;
     record(ctx, {
       activityId: `decision:${toolCallId}`,
       event: "tool_decision",
@@ -88,6 +91,6 @@ export function registerToolCallHook(pi: ExtensionAPI, dependencies: ToolCallHoo
       observeTrajectorySync(ctx, dependencies.afterAuthorized?.(resolvedEvent, ctx, { toolCallId }), dependencies.telemetry);
     }
     dependencies.afterDecision?.(resolvedEvent, ctx, { toolCallId, allowed: !blockedDecision?.block, reason: blockedDecision?.reason });
-    return decision;
+    return finalDecision;
   });
 }

package/packages/piagent-core/runtime/hooks/tool-result-hook.ts

@@ -11,6 +11,7 @@ import { redactForStorage, redactSensitiveText } from "../../extensions/redactio
 import { appendObservedBashResult, hashEvidenceCommand, observedBashResultFromToolResultEvent } from "../../extensions/runtime-evidence.js";
 import { workingTreeSnapshot, workingTreeSnapshotHasUnavailableEvidence } from "../../extensions/task-state.js";
 import { workingTreeObservation } from "../../extensions/working-tree-digest.js";
+import { recordMutationResult } from "../inspection/mutation-provenance-recorder.ts";
 import { boundedGitDiffReview } from "../quality/performance-assurance.ts";
 import { currentFileContentDigests } from "../quality/model-mutation-proof.ts";
 import { boundedPerformanceReviewResultText } from "../quality/performance-review-evidence.ts";
@@ -18,6 +19,7 @@ import { attachToolResultCompactionDetails, compactToolResultDetails, compactToo
 import { RuntimeSessionState, type ObservedTaskContext } from "../session/runtime-state.ts";
 import { observeTrajectorySync } from "../trajectory/trajectory-observability.ts";
 import type { TrajectorySyncResult } from "../trajectory/trajectory-runtime.ts";
+import { patchLineStats } from "./tool-result-metadata.ts";
 
 type ToolResultEvent = { toolCallId?: string; toolName: string; input?: unknown; content?: unknown; details?: unknown; isError?: boolean; usage?: unknown };
 type ObservedBashResult = NonNullable<ReturnType<typeof observedBashResultFromToolResultEvent>>;
@@ -50,7 +52,8 @@ type ToolResultHookDependencies = {
     ctx: ExtensionContext,
     observed: ObservedVerificationResult,
     pendingContext: ObservedTaskContext[],
-    maxManifestFiles: number, shellSnapshotBefore?: Record<string, string>, eventTree?: WorkingTreeObservation
+    maxManifestFiles: number, shellSnapshotBefore?: Record<string, string>, eventTree?: WorkingTreeObservation,
+    readProtectedPaths?: string[]
   ) => unknown;
   extractLikelyPath: (cwd: string, input: Record<string, unknown>) => string | undefined;
   mutationTargets: (cwd: string, toolName: string, input: Record<string, unknown>) => string[];
@@ -124,20 +127,6 @@ function boundedToolResultText(content: unknown): string {
   return text.slice(-20_000);
 }
 
-function patchLineStats(details: unknown): { additions?: number; deletions?: number } {
-  if (!details || typeof details !== "object") return {};
-  const patch = (details as Record<string, unknown>).patch;
-  if (typeof patch !== "string" || !patch.trim()) return {};
-  let additions = 0;
-  let deletions = 0;
-  for (const line of patch.split(/\r?\n/)) {
-    if (line.startsWith("+++ ") || line.startsWith("--- ")) continue;
-    if (line.startsWith("+")) additions += 1;
-    else if (line.startsWith("-")) deletions += 1;
-  }
-  return { additions, deletions };
-}
-
 function countChangedStringLeaves(before: unknown, after: unknown): number {
   if (typeof before === "string" && typeof after === "string") return before === after ? 0 : 1;
   if (Array.isArray(before) && Array.isArray(after)) {
@@ -270,9 +259,9 @@ export function registerToolResultHook(pi: ExtensionAPI, dependencies: ToolResul
       dependencies.recordObservedTaskVerification(
         pi,
         ctx,
-        { ...observed, outputText: boundedToolResultText(event.content) },
+        { ...observed, toolCallId: observed.toolCallId ?? resultToolCallId, outputText: boundedToolResultText(event.content) },
         pendingContext,
-        dependencies.maxManifestFiles, shellSnapshotBefore, eventTree
+        dependencies.maxManifestFiles, shellSnapshotBefore, eventTree, readProtectedPaths
       );
     }
 
@@ -287,20 +276,32 @@ export function registerToolResultHook(pi: ExtensionAPI, dependencies: ToolResul
     const currentSnapshot = taskIdentity ? eventTree?.snapshot : undefined;
     const currentTreeDigest = taskIdentity ? eventTree?.digest : undefined;
     const directMutationResult = modelMutationIdentity && currentSnapshot
-      ? dependencies.state.completeAuthorizedModelMutation(
+      ? dependencies.state.completeAuthorizedModelMutationEvidence(
           modelMutationIdentity,
           resultToolCallId,
           successfulToolResult(event),
           currentSnapshot,
           currentFileContentDigests(ctx.cwd, directMutationTargets)
         )
-      : { changedPaths: [] as string[], recordedDigests: {} as Record<string, string> };
+      : { changedPaths: [] as string[], recordedDigests: {} as Record<string, string>, beforeSnapshot: null,
+          targetPaths: [] as string[], recordedContentDigests: {} as Record<string, string>, proofModes: {} as Record<string, "full-content" | "exact-replacement"> };
     const shellChangedPaths = taskIdentity && currentSnapshot && shellSnapshotBefore
       ? changedSnapshotFiles(shellSnapshotBefore, currentSnapshot)
       : [];
     if (modelMutationIdentity && shellChangedPaths.length > 0) {
       dependencies.state.invalidateSuccessfulModelMutationPaths(modelMutationIdentity, shellChangedPaths);
     }
+    if (modelMutationIdentity && currentSnapshot) {
+      try {
+        recordMutationResult({
+          projectRoot: ctx.cwd, identity: modelMutationIdentity, toolCallId: resultToolCallId, toolName: event.toolName,
+          recordedAt: dependencies.now(), successful: successfulToolResult(event), currentSnapshot,
+          completion: directMutationResult, shellSnapshotBefore, shellChangedPaths, protectedPaths: readProtectedPaths
+        });
+      } catch (error) {
+        ctx.ui.notify(`Piagent could not persist mutation provenance: ${error instanceof Error ? error.message : String(error)}`, "warn");
+      }
+    }
     const outputText = boundedToolResultText(event.content);
     const performanceReviewOutputText = boundedPerformanceReviewResultText(event.content);
     const observedExitCode = observed?.exitCode

package/packages/piagent-core/runtime/hooks/tool-result-metadata.ts

@@ -0,0 +1,13 @@
+export function patchLineStats(details: unknown): { additions?: number; deletions?: number } {
+  if (!details || typeof details !== "object") return {};
+  const patch = (details as Record<string, unknown>).patch;
+  if (typeof patch !== "string" || !patch.trim()) return {};
+  let additions = 0;
+  let deletions = 0;
+  for (const line of patch.split(/\r?\n/)) {
+    if (line.startsWith("+++ ") || line.startsWith("--- ")) continue;
+    if (line.startsWith("+")) additions += 1;
+    else if (line.startsWith("-")) deletions += 1;
+  }
+  return { additions, deletions };
+}

package/packages/piagent-core/runtime/input/chat-images.ts

@@ -32,7 +32,7 @@ function escapeRegExp(input: string): string {
   return input.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
-function supportedImageMimeType(bytes: Buffer): string | undefined {
+export function supportedChatImageMimeType(bytes: Buffer): string | undefined {
   if (
     bytes.length >= 24
     && bytes.subarray(0, 8).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]))
@@ -236,7 +236,7 @@ export function readChatImage(
       offset += read;
     }
     if (offset !== bytes.length) return { status: "error", reason: "file changed while it was being read" };
-    const mimeType = supportedImageMimeType(bytes);
+    const mimeType = supportedChatImageMimeType(bytes);
     if (!mimeType) return { status: "error", reason: "file bytes are not a supported image" };
     return { status: "ok", absolutePath: canonicalPath, bytes, mimeType };
   } finally {