@piagent/platform 1.3.1 → 1.4.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (329) hide show
  1. package/CHANGELOG.md +132 -0
  2. package/README.md +10 -4
  3. package/README.vi.md +27 -0
  4. package/architecture/layers.json +96 -1
  5. package/docs/README.md +1 -0
  6. package/docs/architecture.md +1 -0
  7. package/docs/authority-manifest.md +1 -0
  8. package/docs/auto-delegation-policy.md +1 -0
  9. package/docs/capability-packs.md +1 -0
  10. package/docs/command-reference-vietnamese.md +5 -4
  11. package/docs/context-engine.md +1 -0
  12. package/docs/context-window-policy.md +1 -0
  13. package/docs/distribution-standard.md +8 -7
  14. package/docs/en/architecture.md +13 -0
  15. package/docs/herdr-workflow.md +1 -0
  16. package/docs/languages.json +20 -4
  17. package/docs/mcp-and-tools.md +125 -9
  18. package/docs/memory-policy.md +1 -0
  19. package/docs/model-options.md +1 -0
  20. package/docs/oauth-providers.md +1 -0
  21. package/docs/operator-manual-vietnamese.md +15 -12
  22. package/docs/package-architecture-notes.md +1 -0
  23. package/docs/project-adapters.md +1 -0
  24. package/docs/project-onboarding.md +1 -0
  25. package/docs/publishing-for-teams.md +37 -0
  26. package/docs/quality-benchmark.md +1 -0
  27. package/docs/quickstart-vietnamese.md +3 -2
  28. package/docs/release-install-policy.md +22 -8
  29. package/docs/runtime-harness-standard.md +2 -1
  30. package/docs/runtime-policy-design.md +1 -0
  31. package/docs/runtime-quality-baseline.md +1 -0
  32. package/docs/security-redaction-benchmark.md +1 -0
  33. package/docs/security-threat-model.md +2 -1
  34. package/docs/subagent-orchestration-capabilities.md +1 -0
  35. package/docs/subagents-and-multiagent.md +1 -0
  36. package/docs/task-implementation-contract.md +12 -4
  37. package/docs/task-lifecycle-vietnamese.md +1 -0
  38. package/docs/team-onboarding.md +3 -2
  39. package/docs/third-party-neutrality.md +26 -0
  40. package/docs/usage-observability.md +71 -0
  41. package/docs/vercel-docs-site.md +1 -0
  42. package/docs/vi/architecture.md +13 -0
  43. package/docs/workflow-recipes.md +1 -0
  44. package/docs-site/architecture.html +5 -1
  45. package/docs-site/benchmark.html +5 -1
  46. package/docs-site/commands.html +5 -1
  47. package/docs-site/content/en/index.html +49 -0
  48. package/docs-site/content/en/runtime.html +13 -0
  49. package/docs-site/content/index.html +49 -0
  50. package/docs-site/content/runtime.html +28 -0
  51. package/docs-site/context-engine.html +5 -1
  52. package/docs-site/en/architecture.html +5 -1
  53. package/docs-site/en/benchmark.html +5 -1
  54. package/docs-site/en/commands.html +5 -1
  55. package/docs-site/en/context-engine.html +5 -1
  56. package/docs-site/en/index.html +54 -1
  57. package/docs-site/en/mcp-approval.html +5 -1
  58. package/docs-site/en/mcp-auth.html +5 -1
  59. package/docs-site/en/mcp-servers.html +5 -1
  60. package/docs-site/en/mcp.html +5 -1
  61. package/docs-site/en/permissions.html +5 -1
  62. package/docs-site/en/profiles.html +5 -1
  63. package/docs-site/en/quickstart.html +5 -1
  64. package/docs-site/en/runtime.html +18 -1
  65. package/docs-site/en/scope.html +5 -1
  66. package/docs-site/en/security.html +5 -1
  67. package/docs-site/en/team.html +5 -1
  68. package/docs-site/en/whats-new.html +5 -1
  69. package/docs-site/en/workflows.html +5 -1
  70. package/docs-site/index.html +54 -1
  71. package/docs-site/mcp-approval.html +5 -1
  72. package/docs-site/mcp-auth.html +5 -1
  73. package/docs-site/mcp-servers.html +5 -1
  74. package/docs-site/mcp.html +5 -1
  75. package/docs-site/permissions.html +5 -1
  76. package/docs-site/profiles.html +5 -1
  77. package/docs-site/quickstart.html +5 -1
  78. package/docs-site/runtime.html +33 -1
  79. package/docs-site/scope.html +5 -1
  80. package/docs-site/security.html +5 -1
  81. package/docs-site/team.html +5 -1
  82. package/docs-site/whats-new.html +5 -1
  83. package/docs-site/workflows.html +5 -1
  84. package/evals/fixtures/mutation-provenance-record.invalid.json +17 -0
  85. package/evals/fixtures/mutation-provenance-record.valid.json +27 -0
  86. package/evals/fixtures/piagent-webui/approval-v1.invalid.json +54 -0
  87. package/evals/fixtures/piagent-webui/approval-v1.valid.json +58 -0
  88. package/evals/fixtures/piagent-webui/attachment-v1.invalid.json +25 -0
  89. package/evals/fixtures/piagent-webui/attachment-v1.valid.json +25 -0
  90. package/evals/fixtures/piagent-webui/capabilities-v1.invalid.json +51 -0
  91. package/evals/fixtures/piagent-webui/capabilities-v1.valid.json +122 -0
  92. package/evals/fixtures/piagent-webui/commit-summary-v1.invalid.json +10 -0
  93. package/evals/fixtures/piagent-webui/commit-summary-v1.valid.json +25 -0
  94. package/evals/fixtures/piagent-webui/control-command-v1.invalid.json +37 -0
  95. package/evals/fixtures/piagent-webui/control-command-v1.valid.json +35 -0
  96. package/evals/fixtures/piagent-webui/diff-v1.invalid.json +13 -0
  97. package/evals/fixtures/piagent-webui/diff-v1.valid.json +141 -0
  98. package/evals/fixtures/piagent-webui/gateway-capabilities-v1.invalid.json +35 -0
  99. package/evals/fixtures/piagent-webui/gateway-capabilities-v1.valid.json +35 -0
  100. package/evals/fixtures/piagent-webui/gateway-protocol-v1.invalid.json +14 -0
  101. package/evals/fixtures/piagent-webui/gateway-protocol-v1.valid.json +14 -0
  102. package/evals/fixtures/piagent-webui/handoff-history-v1.invalid.json +16 -0
  103. package/evals/fixtures/piagent-webui/handoff-history-v1.valid.json +16 -0
  104. package/evals/fixtures/piagent-webui/model-catalog-v1.invalid.json +31 -0
  105. package/evals/fixtures/piagent-webui/model-catalog-v1.valid.json +43 -0
  106. package/evals/fixtures/piagent-webui/queue-v1.invalid.json +29 -0
  107. package/evals/fixtures/piagent-webui/queue-v1.valid.json +44 -0
  108. package/evals/fixtures/piagent-webui/recovery-history-v1.invalid.json +17 -0
  109. package/evals/fixtures/piagent-webui/recovery-history-v1.valid.json +20 -0
  110. package/evals/fixtures/piagent-webui/release-monitor-v1.invalid.json +12 -0
  111. package/evals/fixtures/piagent-webui/release-monitor-v1.valid.json +29 -0
  112. package/evals/fixtures/piagent-webui/review-state-v1.invalid.json +25 -0
  113. package/evals/fixtures/piagent-webui/review-state-v1.valid.json +38 -0
  114. package/evals/fixtures/piagent-webui/runtime-event-v2.invalid.json +49 -0
  115. package/evals/fixtures/piagent-webui/runtime-event-v2.valid.json +49 -0
  116. package/evals/fixtures/piagent-webui/session-catalog-v1.invalid.json +17 -0
  117. package/evals/fixtures/piagent-webui/session-catalog-v1.valid.json +58 -0
  118. package/evals/fixtures/piagent-webui/session-command-v1.invalid.json +19 -0
  119. package/evals/fixtures/piagent-webui/session-command-v1.valid.json +19 -0
  120. package/evals/fixtures/piagent-webui/snapshot-v1.invalid.json +5 -0
  121. package/evals/fixtures/piagent-webui/snapshot-v1.valid.json +191 -0
  122. package/evals/fixtures/piagent-webui/source-change-v1.invalid.json +57 -0
  123. package/evals/fixtures/piagent-webui/source-change-v1.valid.json +98 -0
  124. package/evals/fixtures/piagent-webui/source-mutation-v1.invalid.json +19 -0
  125. package/evals/fixtures/piagent-webui/source-mutation-v1.valid.json +38 -0
  126. package/evals/fixtures/piagent-webui/source-revert-v1.invalid.json +20 -0
  127. package/evals/fixtures/piagent-webui/source-revert-v1.valid.json +62 -0
  128. package/evals/fixtures/piagent-webui/subagent-tree-v1.invalid.json +26 -0
  129. package/evals/fixtures/piagent-webui/subagent-tree-v1.valid.json +39 -0
  130. package/evals/fixtures/piagent-webui/task-index-v1.invalid.json +15 -0
  131. package/evals/fixtures/piagent-webui/task-index-v1.valid.json +15 -0
  132. package/evals/fixtures/piagent-webui/task-timeline-v1.invalid.json +14 -0
  133. package/evals/fixtures/piagent-webui/task-timeline-v1.valid.json +16 -0
  134. package/evals/fixtures/piagent-webui/transcript-v1.invalid.json +35 -0
  135. package/evals/fixtures/piagent-webui/transcript-v1.valid.json +55 -0
  136. package/evals/fixtures/task-baseline-manifest.invalid.json +16 -0
  137. package/evals/fixtures/task-baseline-manifest.valid.json +41 -0
  138. package/evals/fixtures/verifier-file-snapshot.invalid.json +21 -0
  139. package/evals/fixtures/verifier-file-snapshot.valid.json +21 -0
  140. package/package.json +43 -4
  141. package/packages/piagent-core/README.md +3 -2
  142. package/packages/piagent-core/benchmark/benchmark-candidate.d.ts +1 -0
  143. package/packages/piagent-core/benchmark/benchmark-forensics.d.ts +1 -0
  144. package/packages/piagent-core/benchmark/benchmark-ledger.d.ts +4 -0
  145. package/packages/piagent-core/benchmark/benchmark-record-validation.d.ts +1 -0
  146. package/packages/piagent-core/benchmark/benchmark-runtime.d.ts +1 -0
  147. package/packages/piagent-core/capabilities/capability-core.js +2 -2
  148. package/packages/piagent-core/capabilities/capability-verification-cache.js +17 -7
  149. package/packages/piagent-core/capabilities/runtime-integrity.js +190 -0
  150. package/packages/piagent-core/extensions/piagent-guard.ts +80 -272
  151. package/packages/piagent-core/extensions/redaction-core.d.ts +2 -0
  152. package/packages/piagent-core/extensions/runtime-evidence.js +12 -1
  153. package/packages/piagent-core/extensions/shell-reach.ts +250 -0
  154. package/packages/piagent-core/extensions/task-journal.js +30 -1
  155. package/packages/piagent-core/extensions/task-state.js +33 -36
  156. package/packages/piagent-core/mcp/mcp-command-actions.js +1 -1
  157. package/packages/piagent-core/mcp/mcp-server-catalog.js +139 -9
  158. package/packages/piagent-core/package.json +1 -1
  159. package/packages/piagent-core/runtime/hooks/session-start-hook.ts +2 -2
  160. package/packages/piagent-core/runtime/hooks/tool-call-hook.ts +12 -2
  161. package/packages/piagent-core/runtime/hooks/tool-result-hook.ts +20 -19
  162. package/packages/piagent-core/runtime/hooks/tool-result-metadata.ts +13 -0
  163. package/packages/piagent-core/runtime/input/chat-images.ts +2 -2
  164. package/packages/piagent-core/runtime/inspection/activity-event-adapter.ts +94 -0
  165. package/packages/piagent-core/runtime/inspection/approval-broker.ts +318 -0
  166. package/packages/piagent-core/runtime/inspection/commit-summary-projection.ts +59 -0
  167. package/packages/piagent-core/runtime/inspection/context-telemetry-inspection.ts +37 -0
  168. package/packages/piagent-core/runtime/inspection/criteria-links.ts +295 -0
  169. package/packages/piagent-core/runtime/inspection/diff-projection.ts +499 -0
  170. package/packages/piagent-core/runtime/inspection/git-filter-safety.ts +38 -0
  171. package/packages/piagent-core/runtime/inspection/git-numstat-adapter.ts +71 -0
  172. package/packages/piagent-core/runtime/inspection/git-status-adapter.ts +493 -0
  173. package/packages/piagent-core/runtime/inspection/git-tree-adapter.ts +108 -0
  174. package/packages/piagent-core/runtime/inspection/mcp-control.ts +10 -0
  175. package/packages/piagent-core/runtime/inspection/mutation-provenance-contract.ts +131 -0
  176. package/packages/piagent-core/runtime/inspection/mutation-provenance-recorder.ts +48 -0
  177. package/packages/piagent-core/runtime/inspection/mutation-provenance-store.ts +161 -0
  178. package/packages/piagent-core/runtime/inspection/project-runtime-inspection.ts +36 -0
  179. package/packages/piagent-core/runtime/inspection/review-state-contract.ts +108 -0
  180. package/packages/piagent-core/runtime/inspection/review-state-projection.ts +93 -0
  181. package/packages/piagent-core/runtime/inspection/review-state-store.ts +112 -0
  182. package/packages/piagent-core/runtime/inspection/runtime-event-store.ts +262 -0
  183. package/packages/piagent-core/runtime/inspection/same-process-bridge-proof.ts +103 -0
  184. package/packages/piagent-core/runtime/inspection/source-change-projection.ts +471 -0
  185. package/packages/piagent-core/runtime/inspection/source-evidence-contract.ts +139 -0
  186. package/packages/piagent-core/runtime/inspection/source-evidence-store.ts +315 -0
  187. package/packages/piagent-core/runtime/inspection/source-handoff-store.ts +70 -0
  188. package/packages/piagent-core/runtime/inspection/source-inspection-plan.ts +34 -0
  189. package/packages/piagent-core/runtime/inspection/source-mutation-projection.ts +164 -0
  190. package/packages/piagent-core/runtime/inspection/source-mutation-store.ts +168 -0
  191. package/packages/piagent-core/runtime/inspection/source-open-target.ts +38 -0
  192. package/packages/piagent-core/runtime/inspection/source-revert-projection.ts +147 -0
  193. package/packages/piagent-core/runtime/inspection/task-baseline-start-capture.ts +22 -0
  194. package/packages/piagent-core/runtime/inspection/task-compaction-history.ts +160 -0
  195. package/packages/piagent-core/runtime/inspection/task-control-journal.ts +131 -0
  196. package/packages/piagent-core/runtime/inspection/task-handoff-history.ts +95 -0
  197. package/packages/piagent-core/runtime/inspection/task-provenance-projection.ts +60 -0
  198. package/packages/piagent-core/runtime/inspection/task-recovery-timeline.ts +88 -0
  199. package/packages/piagent-core/runtime/inspection/task-run-index.ts +87 -0
  200. package/packages/piagent-core/runtime/inspection/task-source-projection.ts +401 -0
  201. package/packages/piagent-core/runtime/inspection/task-subagent-tree.ts +101 -0
  202. package/packages/piagent-core/runtime/inspection/text-diff.ts +60 -0
  203. package/packages/piagent-core/runtime/inspection/verifier-snapshot-contract.ts +114 -0
  204. package/packages/piagent-core/runtime/inspection/verifier-snapshot-store.ts +189 -0
  205. package/packages/piagent-core/runtime/inspection/webui-snapshot.ts +320 -0
  206. package/packages/piagent-core/runtime/inspection/workspace-file-reader.ts +132 -0
  207. package/packages/piagent-core/runtime/inspection/workspace-source-projection.ts +96 -0
  208. package/packages/piagent-core/runtime/inspection/zero-turn-conformance.ts +175 -0
  209. package/packages/piagent-core/runtime/orchestration/owned-work-budget.ts +93 -6
  210. package/packages/piagent-core/runtime/policy/block-remedy.ts +139 -0
  211. package/packages/piagent-core/runtime/policy/source-index-transaction.ts +173 -0
  212. package/packages/piagent-core/runtime/policy/source-mutation-guard-binding.ts +42 -0
  213. package/packages/piagent-core/runtime/policy/source-mutation-guard.ts +184 -0
  214. package/packages/piagent-core/runtime/policy/source-worktree-transaction.ts +105 -0
  215. package/packages/piagent-core/runtime/product/activity-inspector-footer.ts +5 -3
  216. package/packages/piagent-core/runtime/product/activity-inspector.ts +85 -343
  217. package/packages/piagent-core/runtime/recovery/resume-state.ts +38 -1
  218. package/packages/piagent-core/runtime/registration/activity-inspector-command.ts +68 -14
  219. package/packages/piagent-core/runtime/registration/task-start-tool.ts +22 -27
  220. package/packages/piagent-core/runtime/session/model-authorship-state.ts +31 -3
  221. package/packages/piagent-core/runtime/session/runtime-state.ts +11 -1
  222. package/packages/piagent-core/runtime/session/token-economics.js +34 -0
  223. package/packages/piagent-core/runtime/tools/phase-tool-runtime.ts +2 -1
  224. package/packages/piagent-core/runtime/workflows/task-intake.ts +5 -0
  225. package/packages/piagent-core/security/sensitive-data.js +7 -0
  226. package/packages/piagent-webui/dist/client/assets/index-DwKCWbwd.css +1 -0
  227. package/packages/piagent-webui/dist/client/assets/index-bu7XpD9Q.js +172 -0
  228. package/packages/piagent-webui/dist/client/index.html +16 -0
  229. package/packages/piagent-webui/extension/attachment-store.ts +323 -0
  230. package/packages/piagent-webui/extension/held-message-queue.ts +311 -0
  231. package/packages/piagent-webui/extension/lifecycle-controller.ts +423 -0
  232. package/packages/piagent-webui/extension/lifecycle-event-adapter.ts +23 -0
  233. package/packages/piagent-webui/extension/piagent-webui.ts +470 -0
  234. package/packages/piagent-webui/extension/review-controller.ts +160 -0
  235. package/packages/piagent-webui/extension/same-session-bridge.ts +500 -0
  236. package/packages/piagent-webui/extension/session-options-controller.ts +281 -0
  237. package/packages/piagent-webui/extension/session-stream-adapter.ts +249 -0
  238. package/packages/piagent-webui/extension/source-mutation-controller.ts +215 -0
  239. package/packages/piagent-webui/extension/source-open-controller.ts +136 -0
  240. package/packages/piagent-webui/extension/source-revert-controller.ts +189 -0
  241. package/packages/piagent-webui/extension/terminal-session-adapter.ts +73 -0
  242. package/packages/piagent-webui/extension/vscode-handoff.ts +51 -0
  243. package/packages/piagent-webui/gateway/control-socket.ts +92 -0
  244. package/packages/piagent-webui/gateway/extension-authority.ts +47 -0
  245. package/packages/piagent-webui/gateway/gateway-events.ts +60 -0
  246. package/packages/piagent-webui/gateway/gateway-protocol-service.ts +64 -0
  247. package/packages/piagent-webui/gateway/gateway-service.ts +215 -0
  248. package/packages/piagent-webui/gateway/gateway-session-stream.ts +110 -0
  249. package/packages/piagent-webui/gateway/mcp-auth-broker.ts +158 -0
  250. package/packages/piagent-webui/gateway/native-project-picker.ts +29 -0
  251. package/packages/piagent-webui/gateway/pi-host.ts +41 -0
  252. package/packages/piagent-webui/gateway/profile-state.ts +1 -0
  253. package/packages/piagent-webui/gateway/project-registry.ts +108 -0
  254. package/packages/piagent-webui/gateway/provider-auth-broker.ts +172 -0
  255. package/packages/piagent-webui/gateway/session-catalog.ts +128 -0
  256. package/packages/piagent-webui/gateway/session-command-controller.ts +237 -0
  257. package/packages/piagent-webui/gateway/session-command-store.ts +224 -0
  258. package/packages/piagent-webui/gateway/session-inspection-registry.ts +239 -0
  259. package/packages/piagent-webui/gateway/session-lease-store.ts +1 -0
  260. package/packages/piagent-webui/gateway/session-metadata-store.ts +152 -0
  261. package/packages/piagent-webui/gateway/session-runtime-supervisor.ts +489 -0
  262. package/packages/piagent-webui/ownership/gateway-runtime-context.ts +8 -0
  263. package/packages/piagent-webui/ownership/profile-state.ts +117 -0
  264. package/packages/piagent-webui/ownership/session-lease-store.ts +329 -0
  265. package/packages/piagent-webui/ownership/session-refs.ts +8 -0
  266. package/packages/piagent-webui/package.json +33 -0
  267. package/packages/piagent-webui/server/README.md +4 -0
  268. package/packages/piagent-webui/server/benchmark-release-monitor.ts +230 -0
  269. package/packages/piagent-webui/server/core-inspection-provider.ts +403 -0
  270. package/packages/piagent-webui/server/gateway-websocket.ts +143 -0
  271. package/packages/piagent-webui/server/http-security.ts +27 -0
  272. package/packages/piagent-webui/server/ipc-read-model-client.ts +89 -0
  273. package/packages/piagent-webui/server/loopback-server.ts +368 -0
  274. package/packages/piagent-webui/server/read-model-provider.ts +37 -0
  275. package/packages/piagent-webui/server/read-only-router.ts +105 -0
  276. package/packages/piagent-webui/server/session-auth.ts +88 -0
  277. package/packages/piagent-webui/server/sidecar-main.ts +86 -0
  278. package/packages/piagent-webui/server/sse-hub.ts +76 -0
  279. package/packages/piagent-webui/server/static-bundle.ts +40 -0
  280. package/packages/piagent-webui/server/transcript-projection.ts +125 -0
  281. package/schemas/mutation-provenance-record.schema.json +100 -0
  282. package/schemas/piagent-webui/approval-v1.schema.json +654 -0
  283. package/schemas/piagent-webui/attachment-v1.schema.json +267 -0
  284. package/schemas/piagent-webui/capabilities-v1.schema.json +729 -0
  285. package/schemas/piagent-webui/catalog-v1.json +240 -0
  286. package/schemas/piagent-webui/commit-summary-v1.schema.json +63 -0
  287. package/schemas/piagent-webui/common-v1.schema.json +479 -0
  288. package/schemas/piagent-webui/control-command-v1.schema.json +1780 -0
  289. package/schemas/piagent-webui/diff-v1.schema.json +826 -0
  290. package/schemas/piagent-webui/gateway-capabilities-v1.schema.json +136 -0
  291. package/schemas/piagent-webui/gateway-protocol-v1.schema.json +456 -0
  292. package/schemas/piagent-webui/handoff-history-v1.schema.json +92 -0
  293. package/schemas/piagent-webui/model-catalog-v1.schema.json +95 -0
  294. package/schemas/piagent-webui/queue-v1.schema.json +99 -0
  295. package/schemas/piagent-webui/recovery-history-v1.schema.json +144 -0
  296. package/schemas/piagent-webui/release-monitor-v1.schema.json +173 -0
  297. package/schemas/piagent-webui/review-state-v1.schema.json +206 -0
  298. package/schemas/piagent-webui/runtime-event-v2.schema.json +5206 -0
  299. package/schemas/piagent-webui/session-catalog-v1.schema.json +222 -0
  300. package/schemas/piagent-webui/session-command-v1.schema.json +390 -0
  301. package/schemas/piagent-webui/snapshot-v1.schema.json +2622 -0
  302. package/schemas/piagent-webui/source-change-v1.schema.json +763 -0
  303. package/schemas/piagent-webui/source-mutation-v1.schema.json +96 -0
  304. package/schemas/piagent-webui/source-revert-v1.schema.json +130 -0
  305. package/schemas/piagent-webui/subagent-tree-v1.schema.json +88 -0
  306. package/schemas/piagent-webui/task-index-v1.schema.json +74 -0
  307. package/schemas/piagent-webui/task-timeline-v1.schema.json +49 -0
  308. package/schemas/piagent-webui/transcript-v1.schema.json +243 -0
  309. package/schemas/task-baseline-manifest.schema.json +122 -0
  310. package/schemas/verifier-file-snapshot.schema.json +81 -0
  311. package/scripts/build-docs-site.mjs +21 -1
  312. package/scripts/check-architecture.mjs +1 -0
  313. package/scripts/check-doc-languages.mjs +19 -2
  314. package/scripts/check-third-party-neutrality.mjs +43 -0
  315. package/scripts/explain-command.mjs +240 -0
  316. package/scripts/install-global.sh +105 -4
  317. package/scripts/mcp-manage.mjs +17 -4
  318. package/scripts/pi-session-stats.sh +10 -2
  319. package/scripts/piagent-cli.mjs +30 -3
  320. package/scripts/piagent-dashboard.mjs +261 -0
  321. package/scripts/piagent-webui-launcher.mjs +121 -0
  322. package/scripts/setup.sh +69 -33
  323. package/scripts/traffic-snapshot.mjs +214 -0
  324. package/scripts/typescript-loader.mjs +42 -1
  325. package/scripts/uninstall-global.sh +53 -2
  326. package/scripts/update-global.mjs +33 -1
  327. package/scripts/verify-local.sh +257 -0
  328. package/scripts/verify-release-identity.mjs +4 -1
  329. package/scripts/verify-translation-pairing.mjs +121 -0
@@ -0,0 +1,59 @@
1
+ import { createHash } from "node:crypto";
2
+
3
+ import { redactSensitiveText } from "../../extensions/redaction-core.js";
4
+ import { canonicalReviewValue } from "./review-state-contract.ts";
5
+ import type { SourceChangeDocument, WebUiIdentity } from "./source-change-projection.ts";
6
+
7
+ const MAX_FILES = 300, MAX_BODY_FILES = 12;
8
+ type Status = "A" | "M" | "D" | "R" | "C";
9
+ const ACTION: Record<Status, string> = { A: "Add", M: "Update", D: "Remove", R: "Rename", C: "Resolve conflict in" };
10
+
11
+ function token(value: unknown): string { return `commit-summary.${createHash("sha256").update(canonicalReviewValue(value)).digest("hex")}`; }
12
+ function safe(value: unknown, maximum: number): { text: string; redacted: boolean } {
13
+ const raw = String(value ?? "").replace(/[\u0000-\u001F\u007F]/g, " ").replace(/\s+/g, " ").trim();
14
+ const result = redactSensitiveText(raw); return { text: result.text.slice(0, maximum).trim(), redacted: result.redacted };
15
+ }
16
+ function unavailable(identity: WebUiIdentity, generatedAt: string, reasonCode: string) {
17
+ return { schemaVersion: 1 as const, version: "piagent-webui-commit-summary-v1" as const, generatedAt, identity,
18
+ state: "unavailable" as const, summary: null, reasonCode,
19
+ health: { state: "unavailable" as const, reasonCode, message: "A current non-empty staged projection is required." } };
20
+ }
21
+
22
+ export function projectDeterministicCommitSummary(options: { identity: WebUiIdentity; sourceView: SourceChangeDocument;
23
+ taskRevision: string; indexRevision: string; generatedAt?: string }) {
24
+ const generatedAt = options.generatedAt ?? new Date().toISOString(), identity = { ...options.identity, agentOperationId: null, toolCallId: null };
25
+ if (!identity.taskId || !identity.taskRunId || options.sourceView.view !== "staged"
26
+ || options.sourceView.availability.state !== "current") return unavailable(identity, generatedAt, "staged-projection-unavailable");
27
+ const files = options.sourceView.files.slice(0, MAX_FILES) as Array<Record<string, any>>;
28
+ const total = Math.min(2_000, Number((options.sourceView.page as any)?.total ?? files.length));
29
+ if (total < 1 || files.length < 1) return unavailable(identity, generatedAt, "no-staged-changes");
30
+ const statusCounts: Record<Status, number> = { A: 0, M: 0, D: 0, R: 0, C: 0 }, lines: string[] = [];
31
+ let protectedFileCount = 0, redacted = false, additions = 0, deletions = 0, exactStats = total === files.length;
32
+ const commitments: unknown[] = [];
33
+ for (const file of files) {
34
+ const status = ["A", "M", "D", "R", "C"].includes(file.status) ? file.status as Status : "M";
35
+ statusCounts[status] += 1; commitments.push([file.fileRef, file.fileRevision, status, file.currentDigest, file.baseDigest]);
36
+ const restricted = file.content?.access !== "available" || file.pathDisplay !== "exact-safe";
37
+ if (restricted) { protectedFileCount += 1; exactStats = false; continue; }
38
+ const display = safe(file.path, 300); redacted ||= display.redacted;
39
+ const label = display.redacted || !display.text ? "[redacted staged file]" : display.text;
40
+ const statsExact = file.stats?.state === "exact" && Number.isInteger(file.stats.additions) && Number.isInteger(file.stats.deletions);
41
+ if (statsExact) { additions += file.stats.additions; deletions += file.stats.deletions; } else exactStats = false;
42
+ if (lines.length < MAX_BODY_FILES) lines.push(`- ${ACTION[status]} ${label}${statsExact ? ` (+${file.stats.additions}/-${file.stats.deletions})` : ""}`);
43
+ }
44
+ if (protectedFileCount) lines.push(`- ${protectedFileCount} protected staged file${protectedFileCount === 1 ? "" : "s"} (names omitted)`);
45
+ const omitted = Math.max(0, total - Math.min(files.length, MAX_BODY_FILES + protectedFileCount));
46
+ if (omitted) lines.push(`- ${omitted} additional staged file${omitted === 1 ? "" : "s"} omitted from this bounded preview`);
47
+ lines.push(exactStats ? `- Staged changes: +${additions} / -${deletions}` : "- Staged line totals are incomplete");
48
+ const singleVisible = total === 1 && protectedFileCount === 0 && lines[0]?.startsWith("- ") ? lines[0].replace(/^- /, "").replace(/ \(\+\d+\/-\d+\)$/, "") : null;
49
+ const title = safe(singleVisible ?? `Update ${total} staged files`, 160).text || `Update ${total} staged files`;
50
+ const summaryRef = token({ taskRevision: options.taskRevision, indexRevision: options.indexRevision, total, commitments, lines, title });
51
+ const modelPrompt = ["Write a concise Git commit message from the exact staged summary below.",
52
+ "Return one title of at most 72 characters, then optional bullet points. Do not claim that a commit or push was executed.",
53
+ `Index revision: ${options.indexRevision}`, `Deterministic title: ${title}`, ...lines].join("\n").slice(0, 8_000);
54
+ return { schemaVersion: 1 as const, version: "piagent-webui-commit-summary-v1" as const, generatedAt, identity, state: "ready" as const,
55
+ summary: { summaryRef, taskRevision: options.taskRevision, indexRevision: options.indexRevision, title, bodyLines: lines,
56
+ modelPrompt, fileCount: total, returnedFiles: files.length, statusCounts, additions: exactStats ? additions : null,
57
+ deletions: exactStats ? deletions : null, protectedFileCount, redacted, truncated: Boolean((options.sourceView.page as any)?.truncated) || omitted > 0 },
58
+ reasonCode: null, health: { state: "ok" as const, reasonCode: null, message: null } };
59
+ }
@@ -0,0 +1,37 @@
1
+ import fs from "node:fs";
2
+
3
+ import { contextEnginePaths } from "../../extensions/context-engine.js";
4
+ import { resolveLocalStatePath } from "../../extensions/local-state-path.js";
5
+
6
+ function tailText(file: string, maximumBytes: number): { text: string; truncated: boolean } {
7
+ const descriptor = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
8
+ try {
9
+ const stat = fs.fstatSync(descriptor), start = Math.max(0, stat.size - maximumBytes);
10
+ const buffer = Buffer.allocUnsafe(stat.size - start); fs.readSync(descriptor, buffer, 0, buffer.length, start);
11
+ let text = buffer.toString("utf8"); if (start > 0) text = text.slice(Math.max(0, text.indexOf("\n") + 1));
12
+ return { text, truncated: start > 0 };
13
+ } finally { fs.closeSync(descriptor); }
14
+ }
15
+
16
+ export function inspectBoundedContextTelemetry(cwd: string, options: { limit?: number; maximumBytes?: number } = {}) {
17
+ const limit = Math.max(1, Math.min(50_000, options.limit ?? 5_000));
18
+ const maximumBytes = Math.max(64 * 1024, Math.min(256 * 1024 * 1024, options.maximumBytes ?? 32 * 1024 * 1024));
19
+ const target = contextEnginePaths(cwd).telemetry, rows: Record<string, unknown>[] = [];
20
+ let exists = false, corruptions = 0, recoverableTailBytes = 0, inputTruncated = false;
21
+ for (const source of [`${target}.1`, target]) {
22
+ const safe = resolveLocalStatePath(cwd, source, { label: "Context telemetry" });
23
+ try {
24
+ const stat = fs.lstatSync(safe); if (!stat.isFile() || stat.isSymbolicLink()) throw new Error("Context telemetry must be a regular file");
25
+ exists = true;
26
+ } catch (error: any) { if (error?.code === "ENOENT") continue; throw error; }
27
+ const read = tailText(safe, maximumBytes); inputTruncated ||= read.truncated;
28
+ const complete = read.text.endsWith("\n") || read.text.endsWith("\r"), lines = read.text.split(/\r?\n/);
29
+ for (let index = 0; index < lines.length; index += 1) {
30
+ const line = lines[index]; if (!line) continue;
31
+ try { const row = JSON.parse(line); if (row && typeof row === "object" && !Array.isArray(row)) rows.push(row); else corruptions += 1; }
32
+ catch { if (!complete && index === lines.length - 1) recoverableTailBytes += Buffer.byteLength(line); else corruptions += 1; }
33
+ }
34
+ }
35
+ return { records: rows.slice(-limit), exists, corruptions, recoverableTailBytes,
36
+ inputTruncated: inputTruncated || rows.length > limit };
37
+ }
@@ -0,0 +1,295 @@
1
+ import { createHash } from "node:crypto";
2
+
3
+ import type { TaskContract } from "../../extensions/guard-types.ts";
4
+ import { hashEvidenceCommand } from "../../extensions/runtime-evidence.js";
5
+ import { matchesAnyPath, normalizePathCandidate } from "../../extensions/policy-core.js";
6
+ import { redactSensitiveText } from "../../extensions/redaction-core.js";
7
+ import { isCurrentWorkingTreeDigest, workingTreeEvidenceDigest, workingTreeSnapshotUsesCurrentAlgorithm } from "../../extensions/working-tree-digest.js";
8
+ import type { ActivityInspectorEvent } from "../product/activity-inspector.ts";
9
+ import type { SourceChangeViews } from "./source-change-projection.ts";
10
+ import {
11
+ decodeVerifierSnapshotPath,
12
+ type VerifierFileSnapshot
13
+ } from "./verifier-snapshot-contract.ts";
14
+ import {
15
+ findVerifierFileSnapshot,
16
+ inspectVerifierStaleness,
17
+ readVerifierFileSnapshots
18
+ } from "./verifier-snapshot-store.ts";
19
+
20
+ export type CriterionRelationSource = "target-hint" | "explicit-evidence" | "verifier-declaration";
21
+ export type CriterionRelation = {
22
+ criterionId: string;
23
+ fileRef: string | null;
24
+ verifierAttemptRef: string | null;
25
+ source: CriterionRelationSource;
26
+ };
27
+ export type CriterionProjection = {
28
+ criterionId: string;
29
+ obligation: string;
30
+ priority: "normal" | "critical";
31
+ state: "pending" | "satisfied" | "blocked" | "unknown";
32
+ evidence: "observed" | "derived" | "unavailable";
33
+ relatedFileRefs: string[];
34
+ verifierAttemptRefs: string[];
35
+ reasonCode: string | null;
36
+ };
37
+ export type VerifierAttemptProjection = {
38
+ attemptRef: string;
39
+ command: string;
40
+ commandDigest: string;
41
+ exact: boolean;
42
+ state: "passed" | "failed" | "stale" | "unknown";
43
+ exitCode: number;
44
+ exitCodeExact: boolean;
45
+ treeDigest: string | null;
46
+ startedAt: string;
47
+ finishedAt: string;
48
+ staleByFileRefs: string[];
49
+ staleByPaths: string[];
50
+ staleFilesKnown: boolean;
51
+ };
52
+ export type CriteriaLinkProjection = {
53
+ criteria: CriterionProjection[];
54
+ sourceViews: SourceChangeViews;
55
+ verifierAttempts: VerifierAttemptProjection[];
56
+ verification: {
57
+ state: "not-run" | "current" | "failed" | "stale" | "unavailable";
58
+ latest: VerifierAttemptProjection | null;
59
+ requiredCommands: string[];
60
+ reasonCode: string | null;
61
+ health: { state: "ok" | "degraded" | "unavailable"; reasonCode: string | null; message: string | null };
62
+ };
63
+ relations: CriterionRelation[];
64
+ };
65
+
66
+ type FileLink = { path: string; fileRef: string; criterionIds: Set<string>; verifierAttemptIds: Set<string> };
67
+ const TIMESTAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
68
+
69
+ function hash(value: string): string { return createHash("sha256").update(value).digest("hex"); }
70
+ function strings(values: unknown[], maximum = 300): string[] {
71
+ return [...new Set(values.filter((value): value is string => typeof value === "string" && value.trim().length > 0))].sort().slice(0, maximum);
72
+ }
73
+ function safeTimestamp(value: unknown, fallback: string): string {
74
+ return typeof value === "string" && TIMESTAMP.test(value) ? value : fallback;
75
+ }
76
+ function commandDigest(command: string): string {
77
+ const exact = hashEvidenceCommand(command);
78
+ return `sha256:${exact || hash(`redacted-verifier-command\0${command}`)}`;
79
+ }
80
+ function safeCommand(command: string): string {
81
+ return redactSensitiveText(command).text.replace(/\u0000/g, " ").slice(0, 4000) || "[verifier command unavailable]";
82
+ }
83
+ function evidenceObservedAt(evidence: TaskContract["verifyEvidence"][number]): string {
84
+ return safeTimestamp(evidence.observedAt, safeTimestamp(evidence.recordedAt, "1970-01-01T00:00:00.000Z"));
85
+ }
86
+
87
+ function cloneViews(views: SourceChangeViews): SourceChangeViews {
88
+ return structuredClone(views);
89
+ }
90
+
91
+ function fileLinks(views: SourceChangeViews): { links: FileLink[]; byPath: Map<string, FileLink[]>; byRef: Map<string, FileLink[]> } {
92
+ const links: FileLink[] = [];
93
+ for (const view of [views.task, views.workingTree, views.staged]) {
94
+ for (const file of view?.files ?? []) {
95
+ const path = normalizePathCandidate(String(file.path ?? ""));
96
+ const fileRef = String(file.fileRef ?? "");
97
+ if (!path || !fileRef) continue;
98
+ const link = {
99
+ path,
100
+ fileRef,
101
+ criterionIds: new Set(Array.isArray(file.criterionIds) ? file.criterionIds as string[] : []),
102
+ verifierAttemptIds: new Set(Array.isArray(file.verifierAttemptIds) ? file.verifierAttemptIds as string[] : [])
103
+ };
104
+ links.push(link);
105
+ }
106
+ }
107
+ const byPath = new Map<string, FileLink[]>(), byRef = new Map<string, FileLink[]>();
108
+ for (const link of links) {
109
+ byPath.set(link.path, [...(byPath.get(link.path) ?? []), link]);
110
+ byRef.set(link.fileRef, [...(byRef.get(link.fileRef) ?? []), link]);
111
+ }
112
+ return { links, byPath, byRef };
113
+ }
114
+
115
+ function applyFileLinks(views: SourceChangeViews, links: FileLink[]): void {
116
+ const values = new Map(links.map((link) => [`${link.fileRef}\0${link.path}`, link]));
117
+ for (const view of [views.task, views.workingTree, views.staged]) {
118
+ for (const file of view?.files ?? []) {
119
+ const link = values.get(`${String(file.fileRef)}\0${normalizePathCandidate(String(file.path ?? ""))}`);
120
+ if (!link) continue;
121
+ file.criterionIds = strings([...link.criterionIds], 128);
122
+ file.verifierAttemptIds = strings([...link.verifierAttemptIds], 128);
123
+ }
124
+ }
125
+ }
126
+
127
+ function matchRecord(evidence: TaskContract["verifyEvidence"][number], records: VerifierFileSnapshot[]) {
128
+ const digest = commandDigest(evidence.command);
129
+ return findVerifierFileSnapshot(records, {
130
+ commandDigest: digest,
131
+ observedAt: evidenceObservedAt(evidence),
132
+ treeDigest: String(evidence.workingTreeDigest ?? ""),
133
+ exitCode: evidence.exitCode
134
+ });
135
+ }
136
+
137
+ function startedAtFor(evidence: TaskContract["verifyEvidence"][number], events: ActivityInspectorEvent[]): string {
138
+ const observedAt = evidenceObservedAt(evidence);
139
+ const digest = commandDigest(evidence.command);
140
+ const candidates = events.filter((event) => event.event === "tool_call"
141
+ && typeof event.command === "string" && commandDigest(event.command) === digest
142
+ && safeTimestamp(event.recordedAt, observedAt) <= observedAt);
143
+ return safeTimestamp(candidates.at(-1)?.recordedAt, observedAt);
144
+ }
145
+
146
+ function verifierProjection(input: {
147
+ task: TaskContract;
148
+ records: VerifierFileSnapshot[];
149
+ currentSnapshot: Record<string, string>;
150
+ protectedPaths: string[];
151
+ filesByPath: Map<string, FileLink[]>;
152
+ events: ActivityInspectorEvent[];
153
+ at: Date;
154
+ }): VerifierAttemptProjection[] {
155
+ const currentCapable = workingTreeSnapshotUsesCurrentAlgorithm(input.currentSnapshot);
156
+ const currentDigest = currentCapable ? workingTreeEvidenceDigest(input.currentSnapshot) : null;
157
+ return input.task.verifyEvidence.slice(-64).map((evidence) => {
158
+ const record = matchRecord(evidence, input.records);
159
+ const observedAt = evidenceObservedAt(evidence);
160
+ const treeDigest = isCurrentWorkingTreeDigest(evidence.workingTreeDigest) ? evidence.workingTreeDigest : null;
161
+ const exact = evidence.observed === true && treeDigest !== null
162
+ && input.task.verifyCommands.some((command) => commandDigest(command) === commandDigest(evidence.command));
163
+ const staleness = evidence.exitCode === 0 && record
164
+ ? inspectVerifierStaleness(record, input.currentSnapshot, input.protectedPaths, input.at)
165
+ : undefined;
166
+ const stalePaths = staleness?.invalidatedByFiles ?? [];
167
+ const staleRefs = strings(stalePaths.flatMap((file) => (input.filesByPath.get(file) ?? []).map((link) => link.fileRef)));
168
+ const state = evidence.exitCode !== 0
169
+ ? "failed"
170
+ : exact && currentDigest && treeDigest === currentDigest
171
+ ? "passed"
172
+ : exact && currentDigest && treeDigest
173
+ ? "stale"
174
+ : "unknown";
175
+ return {
176
+ attemptRef: record?.attemptRef ?? `verifier-evidence.${hash(JSON.stringify([input.task.taskRunId, commandDigest(evidence.command), observedAt, treeDigest, evidence.exitCode]))}`,
177
+ command: safeCommand(evidence.command),
178
+ commandDigest: record?.commandDigest ?? commandDigest(evidence.command),
179
+ exact,
180
+ state,
181
+ exitCode: evidence.exitCode,
182
+ exitCodeExact: evidence.observed === true,
183
+ treeDigest,
184
+ startedAt: startedAtFor(evidence, input.events),
185
+ finishedAt: observedAt,
186
+ staleByFileRefs: staleRefs,
187
+ staleByPaths: strings(stalePaths),
188
+ staleFilesKnown: state === "stale" ? staleness?.filesKnown === true : state === "passed"
189
+ };
190
+ });
191
+ }
192
+
193
+ function recordPaths(record: VerifierFileSnapshot): string[] {
194
+ return record.files.map(decodeVerifierSnapshotPath).filter((value): value is string => Boolean(value));
195
+ }
196
+
197
+ function criterionGraphNode(task: TaskContract, receiptIndex: number, criterionHash: string) {
198
+ const criterionIndex = task.acceptanceCriteria.findIndex((text) => hash(text) === criterionHash);
199
+ return task.criterionGraph?.nodes.find((node) => node.criterionIndex === (criterionIndex >= 0 ? criterionIndex : receiptIndex));
200
+ }
201
+
202
+ export function projectCriteriaFileVerifier(input: {
203
+ cwd: string;
204
+ task?: TaskContract;
205
+ sourceViews: SourceChangeViews;
206
+ currentSnapshot: Record<string, string>;
207
+ protectedPaths?: string[];
208
+ events?: ActivityInspectorEvent[];
209
+ at?: Date;
210
+ }): CriteriaLinkProjection {
211
+ const views = cloneViews(input.sourceViews);
212
+ const indexed = fileLinks(views);
213
+ if (!input.task) {
214
+ return {
215
+ criteria: [], sourceViews: views, verifierAttempts: [], relations: [],
216
+ verification: { state: "unavailable", latest: null, requiredCommands: [], reasonCode: "no-active-task", health: { state: "ok", reasonCode: null, message: null } }
217
+ };
218
+ }
219
+ const read = readVerifierFileSnapshots(input.cwd, input.task.taskRunId);
220
+ const attempts = verifierProjection({ task: input.task, records: read.records, currentSnapshot: input.currentSnapshot,
221
+ protectedPaths: input.protectedPaths ?? input.task.protectedPaths, filesByPath: indexed.byPath,
222
+ events: input.events ?? [], at: input.at ?? new Date() });
223
+ const attemptByEvidence = new Map<string, VerifierAttemptProjection>();
224
+ input.task.verifyEvidence.slice(-64).forEach((evidence, index) => attemptByEvidence.set(`${commandDigest(evidence.command)}\0${evidenceObservedAt(evidence)}`, attempts[index]));
225
+ for (const record of read.records) {
226
+ const attempt = attempts.find((candidate) => candidate.attemptRef === record.attemptRef);
227
+ if (!attempt) continue;
228
+ for (const file of recordPaths(record)) for (const link of indexed.byPath.get(file) ?? []) link.verifierAttemptIds.add(attempt.attemptRef);
229
+ for (const file of attempt.staleByPaths) for (const link of indexed.byPath.get(file) ?? []) link.verifierAttemptIds.add(attempt.attemptRef);
230
+ }
231
+
232
+ const relations: CriterionRelation[] = [];
233
+ const receipt = input.task.acceptanceReceipt;
234
+ const criteria = (receipt?.criteria ?? []).slice(0, 64).map((criterion, index): CriterionProjection => {
235
+ const node = criterionGraphNode(input.task as TaskContract, index, criterion.hash);
236
+ const related = new Set<string>(), verifierRefs = new Set<string>();
237
+ const addFile = (link: FileLink, source: CriterionRelationSource) => {
238
+ link.criterionIds.add(criterion.id); related.add(link.fileRef);
239
+ relations.push({ criterionId: criterion.id, fileRef: link.fileRef, verifierAttemptRef: null, source });
240
+ };
241
+ for (const hint of node?.targetHints ?? []) {
242
+ for (const link of indexed.links) if (matchesAnyPath(link.path, [hint])) addFile(link, "target-hint");
243
+ }
244
+ for (const evidence of criterion.evidence ?? []) {
245
+ for (const evidencePath of evidence.paths ?? []) {
246
+ for (const link of indexed.links) if (matchesAnyPath(link.path, [evidencePath])) addFile(link, "explicit-evidence");
247
+ }
248
+ if (evidence.command) {
249
+ const attempt = [...attemptByEvidence.entries()].reverse().find(([key]) => key.startsWith(`${commandDigest(evidence.command)}\0`))?.[1];
250
+ if (attempt) {
251
+ verifierRefs.add(attempt.attemptRef);
252
+ relations.push({ criterionId: criterion.id, fileRef: null, verifierAttemptRef: attempt.attemptRef, source: "explicit-evidence" });
253
+ }
254
+ }
255
+ }
256
+ if (node?.proofKinds.includes("exact-verifier")) {
257
+ for (const attempt of attempts) {
258
+ if (!input.task?.verifyCommands.some((command) => commandDigest(command) === attempt.commandDigest)) continue;
259
+ verifierRefs.add(attempt.attemptRef);
260
+ relations.push({ criterionId: criterion.id, fileRef: null, verifierAttemptRef: attempt.attemptRef, source: "verifier-declaration" });
261
+ }
262
+ }
263
+ return {
264
+ criterionId: criterion.id,
265
+ obligation: node?.obligation ?? input.task?.acceptanceCriteria.find((text) => hash(text) === criterion.hash) ?? criterion.obligation,
266
+ priority: criterion.priority,
267
+ state: criterion.status,
268
+ evidence: receipt?.source === "runtime" ? "observed" : "derived",
269
+ relatedFileRefs: strings([...related]),
270
+ verifierAttemptRefs: strings([...verifierRefs], 64),
271
+ reasonCode: null
272
+ };
273
+ });
274
+ if (!receipt) {
275
+ for (const node of input.task.criterionGraph?.nodes ?? []) criteria.push({ criterionId: node.id, obligation: node.obligation,
276
+ priority: "normal", state: "unknown", evidence: "unavailable", relatedFileRefs: [], verifierAttemptRefs: [], reasonCode: "acceptance-receipt-unavailable" });
277
+ }
278
+ applyFileLinks(views, indexed.links);
279
+ const latest = attempts.at(-1) ?? null;
280
+ const requiredDigests = strings(input.task.verifyCommands, 64).map(commandDigest);
281
+ const allRequiredCurrent = requiredDigests.length > 0 && requiredDigests.every((digest) =>
282
+ [...attempts].reverse().find((attempt) => attempt.commandDigest === digest)?.state === "passed");
283
+ const verification = !latest
284
+ ? { state: "not-run" as const, latest: null, requiredCommands: strings(input.task.verifyCommands, 64), reasonCode: null, health: { state: read.corruptions.length ? "degraded" as const : "ok" as const, reasonCode: read.corruptions.length ? "verifier-snapshot-corrupt" : null, message: read.corruptions.length ? "Verifier file evidence is corrupt or unavailable" : null } }
285
+ : latest.state === "passed" && allRequiredCurrent
286
+ ? { state: "current" as const, latest, requiredCommands: strings(input.task.verifyCommands, 64), reasonCode: null, health: { state: read.corruptions.length ? "degraded" as const : "ok" as const, reasonCode: read.corruptions.length ? "verifier-snapshot-corrupt" : null, message: read.corruptions.length ? "Verifier file evidence is corrupt or unavailable" : null } }
287
+ : latest.state === "passed"
288
+ ? { state: "unavailable" as const, latest: null, requiredCommands: strings(input.task.verifyCommands, 64), reasonCode: "required-verifier-incomplete", health: { state: "degraded" as const, reasonCode: "required-verifier-incomplete", message: "Not every configured verifier has a current exact pass" } }
289
+ : latest.state === "failed"
290
+ ? { state: "failed" as const, latest, requiredCommands: strings(input.task.verifyCommands, 64), reasonCode: "verifier-exit-nonzero", health: { state: "ok" as const, reasonCode: null, message: null } }
291
+ : latest.state === "stale"
292
+ ? { state: "stale" as const, latest, requiredCommands: strings(input.task.verifyCommands, 64), reasonCode: "working-tree-changed-after-verifier", health: { state: read.corruptions.length ? "degraded" as const : "ok" as const, reasonCode: read.corruptions.length ? "verifier-snapshot-corrupt" : null, message: read.corruptions.length ? "Stale files cannot be identified from corrupt verifier evidence" : null } }
293
+ : { state: "unavailable" as const, latest: null, requiredCommands: strings(input.task.verifyCommands, 64), reasonCode: "current-tree-unavailable", health: { state: "unavailable" as const, reasonCode: "current-tree-unavailable", message: "Current tree evidence is unavailable" } };
294
+ return { criteria, sourceViews: views, verifierAttempts: attempts, verification, relations };
295
+ }