@piagent/platform 1.49.1 → 1.50.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/platform",
-  "version": "1.49.1",
+  "version": "1.50.0",
   "license": "MIT",
   "publishConfig": {
     "access": "public",

package/packages/piagent-core/managed/approval-refusal.mjs

@@ -0,0 +1,9 @@
+// Why an approval did not allow the action, in words the agent can act on: a card
+// nobody answered in time is not a refusal, and asking again is then the right move.
+export function approvalRefusal(decision) {
+  const receipt = decision?.receipt;
+  if (receipt?.state === 'expired') return Error('managed-operation-expired: the approval card ran out of time with no answer. Nobody refused it and no policy blocked it; the command did not run. Tell the member it is waiting for them, or send the same command again when they are back.');
+  if (receipt?.state === 'cancelled') return Error('managed-operation-cancelled: the approval was cancelled because the runtime restarted or stopped the task; nobody refused it and the command did not run.');
+  if (receipt?.decision === 'deny') return Error('managed-operation-denied: the member refused this exact command on the approval card; it did not run. Do not send it again unless they say so.');
+  return Error('managed-operation-denied: the command was not approved and did not run.');
+}

package/packages/piagent-core/managed/check-evidence.mjs

@@ -0,0 +1,134 @@
+import path from 'node:path';
+import { readPatchDigest } from './patch-snapshot.mjs';
+import { itemText, undecided } from './ledger.mjs';
+import { changeLane, lanePolicy, patchStats } from './risk-lanes.mjs';
+
+// What passed on which code, repository by repository: a folder can hold several,
+// a later small run must not erase a whole-suite pass, and a pass in one repository
+// says nothing about a push of another. Also what a push needs first: its review.
+
+const FAST_SUITE_MS = 60_000, MAX_PARTS = 20, PUSH_REVIEWS = 2;
+const repositoryNames = self => Object.keys(self.repositoryBases ?? {});
+const plain = word => word.replace(/^["']|["']$/g, '');
+
+// The repositories a command goes to, from its `cd` and `git -C`. `known` is false
+// when one is a variable: a loop or a function decides it, not the text.
+export function commandRepositories(self, command) {
+  const names = repositoryNames(self);
+  if (!names.length) return { repositories: ['.'], known: true };
+  const found = new Set(); let dir = self.cwd, known = true;
+  const visit = (word, stay) => {
+    const target = plain(word);
+    if (target.includes('$')) { known = false; return; }
+    const next = path.resolve(dir, target), first = path.relative(self.cwd, next).split(path.sep)[0];
+    if (names.includes(first)) found.add(first);
+    if (!stay) dir = next;
+  };
+  for (const match of String(command ?? '').matchAll(/(?:^|[\s;&|(])(cd|git\s+-C)\s+("[^"]*"|'[^']*'|[^\s;&|)]+)/g)) visit(match[2], match[1] !== 'cd');
+  return { repositories: [...found], known };
+}
+const changedRepositories = self => {
+  const names = repositoryNames(self);
+  return [...new Set([...(self.ownPaths ?? [])].map(file => String(file).split('/')[0]))].filter(name => names.includes(name));
+};
+// What a push sends: the repositories it names, else the ones this conversation changed.
+export function pushRepositories(self, command) {
+  const { repositories, known } = commandRepositories(self, command);
+  return known && repositories.length ? repositories : changedRepositories(self);
+}
+// The code of one repository: this conversation's files in it, compared with where it started.
+async function repositoryDigest(self, repository) {
+  if (repository === '.') return self.digest();
+  const scope = new Set([...(self.ownPaths ?? [])].filter(file => String(file).startsWith(`${repository}/`)));
+  try { return await (self.scopedDigest ?? (paths => readPatchDigest(self.boundary, paths, self.base, self.repositoryBases)))(scope); } catch { return null; }
+}
+// Reading a digest starts a sandboxed worker: one question reads each once.
+export function digestsOnce(self) {
+  const known = new Map();
+  return repository => { if (!known.has(repository)) known.set(repository, repositoryDigest(self, repository)); return known.get(repository); };
+}
+const entryOf = (run, repository) => { const passes = run.passes ??= new Map(); if (!passes.has(repository)) passes.set(repository, { suite: null, parts: [] }); return passes.get(repository); };
+
+// One test command ended. `part` names its test step, for how long that step takes.
+export async function recordCheck(run, self, command, scope, ok, part) {
+  if (!self || !scope) return;
+  const started = run.checkStarts?.get(command), took = started ? Date.now() - started : null;
+  run.checkStarts?.delete(command);
+  for (const repository of commandRepositories(self, command).repositories) {
+    const digest = await repositoryDigest(self, repository), entry = entryOf(run, repository);
+    if (scope === 'suite') {
+      entry.suite = ok ? { digest, command } : null;
+      if (ok) run.fullFor?.delete(repository);
+      if (ok && took !== null) (self.checkTimes ??= new Map()).set(`${repository}\u0000${part}`, took);
+    } else if (ok) entry.parts = [...entry.parts, { digest, command }].slice(-MAX_PARTS);
+  }
+}
+export function markCheckStart(run, command) { (run.checkStarts ??= new Map()).set(command, Date.now()); }
+
+// A whole suite this conversation has seen pass quickly is not worth a detour.
+export function knownFast(self, command, part) {
+  const times = self.checkTimes, { repositories } = commandRepositories(self, command);
+  return !!times && repositories.length > 0 && repositories.every(repository => times.get(`${repository}\u0000${part}`) < FAST_SUITE_MS);
+}
+
+// The repositories whose whole suite has not passed on their current code.
+export async function missingSuites(digestOf, run, repositories) {
+  const missing = [];
+  for (const repository of repositories) {
+    const digest = await digestOf(repository), pass = run.passes?.get(repository)?.suite;
+    if (!(pass && digest !== null && pass.digest === digest)) missing.push(repository);
+  }
+  return missing;
+}
+const minutes = ms => Math.max(1, Math.round(ms / 60_000));
+// The member decides from this: what ran, what did not, what changed, how long the rest takes.
+export async function pushQuestion(self, digestOf, run, repositories, missing) {
+  const name = repository => repository === '.' ? 'repo này' : repository;
+  const lines = [`Sắp push${repositories.length && repositories[0] !== '.' ? ` ${repositories.join(', ')}` : ' code'} nhưng toàn bộ test chưa pass trên code này.`];
+  const passed = repositories.filter(repository => !missing.includes(repository));
+  if (passed.length) lines.push(`Đã pass toàn bộ: ${passed.map(name).join(', ')}.`);
+  const partly = [], none = [];
+  for (const repository of missing) {
+    const digest = await digestOf(repository), count = (run.passes?.get(repository)?.parts ?? []).filter(p => digest !== null && p.digest === digest).length;
+    if (count) partly.push(`${name(repository)} (${count} lệnh)`); else none.push(name(repository));
+  }
+  if (partly.length) lines.push(`Mới pass một phần: ${partly.join(', ')}.`);
+  if (none.length) lines.push(`Chưa có test nào pass trên code hiện tại: ${none.join(', ')}.`);
+  const files = self.ownPaths?.size ?? 0;
+  if (files) lines.push(`Phiên này đổi ${files} file.`);
+  const took = [...(self.checkTimes ?? new Map())].filter(([key]) => missing.includes(key.split('\u0000')[0])).map(([, ms]) => ms);
+  if (took.length) lines.push(`Lần chạy toàn bộ gần nhất mất khoảng ${minutes(Math.max(...took))} phút.`);
+  return lines.join('\n');
+}
+
+// The checks worth naming: those of the repositories this conversation changed,
+// not of every repository that happens to sit in the folder.
+export function relevantChecks(self, commands) {
+  const changed = new Set([...(self.ownPaths ?? [])].map(file => String(file).split('/')[0]));
+  if (!changed.size) return commands;
+  const kept = commands.filter(command => { const dir = String(command).match(/^cd '([^']+)'/)?.[1]; return !dir || changed.has(dir.split('/')[0]); });
+  return kept.length ? kept : commands;
+}
+
+// Before a push under a required review: a finding is cheap now and costs a release
+// after. The patch the turn's end would review is the same, so it is reviewed once.
+export async function reviewBeforePush(self, digestOf, run, signal) {
+  if (!self.delegate || !self.patchDigest || run.reviewSettled) return;
+  const code = await digestOf('.');
+  if (run.startDigest === null || code === null || code === run.startDigest) return;
+  let policy = run.policy;
+  if (policy.lanes) { let stats = null; try { stats = patchStats(await self.patchSnapshot?.()); } catch { /* unreadable: standard */ } policy = lanePolicy(policy, changeLane(stats, run)); }
+  if (policy.review !== 'require') return;
+  let patch = null; try { patch = await self.patchDigest(); } catch { return; }
+  const fresh = !!self.review && !self.review.stale && self.review.patchDigest === patch;
+  if (!fresh) {
+    if ((run.pushReviews ?? 0) >= PUSH_REVIEWS) return;
+    run.pushReviews = (run.pushReviews ?? 0) + 1;
+    self.session?.sessionManager?.appendCustomEntry?.('agent-watch-review-start', {});
+    // A review that cannot run does not hold the push: the turn's status says so.
+    try { await self.delegate({ role: 'review', task: "Review the current patch against the member's request. The main agent is about to push it: report what must change before it leaves this machine." }, signal, { harness: true }); }
+    catch (error) { if (signal?.aborted) throw error; return; }
+  }
+  const pending = undecided(run).filter(item => item.source === 'review');
+  if (pending.length) throw Error(`managed-review-before-push: this command did not run. The review of the code you are pushing has ${pending.length} finding(s) with no decision:\n${pending.map(item => '- ' + itemText(item)).join('\n')}\nFix each, or reject it with resolve_objection (what you checked and why), then push again.`);
+}

package/packages/piagent-core/managed/check-questions.mjs

@@ -1,6 +1,7 @@
 import { randomUUID } from 'node:crypto';
 import { memberQuestions } from './member-questions.mjs';
 import { effectivePermission } from './permission.mjs';
+import { digestsOnce, knownFast, markCheckStart, missingSuites, pushQuestion, pushRepositories, reviewBeforePush } from './check-evidence.mjs';
 
 // How much to test is the member's decision: a one-line fix should not cost a
 // thirty-minute suite. The harness asks at the end of a change, before a whole
@@ -15,19 +16,26 @@ const FILTERED = /(?:^|\s)(?:-k|-t|--grep|--testNamePattern|--test-name-pattern|
 const TEST_RUNNER = /\b(npm|pnpm|yarn|bun)\s+(run\s+)?test(:\S+)?(?=\s|$)|\bnode\s+--test\b|\b(vitest|jest|mocha|pytest|rspec|phpunit)\b|\bplaywright\s+test\b|\bpython3?\s+-m\s+(pytest|unittest)\b|\b(go|cargo|swift|dotnet|deno)\s+test\b|\bmake\s+test\b|\bxcodebuild\b.*\btest\b|\b(gradle|gradlew|mvn|mvnw)\b.*\b(test|verify)\b/;
 // Test commands start a command: `npm install -D vitest` or `rm jest.config.ts` only name one.
 const TEST_START = new RegExp(`^(?:${TEST_RUNNER.source})`);
-const LAUNCHER = /^(?:\w+=\S*\s+|time\s+|nohup\s+|timeout\s+\S+\s+|npx\s+(?:-\S+\s+)*|bunx\s+|pnpm\s+(?:exec|dlx)\s+|uv\s+run\s+|poetry\s+run\s+|yarn\s+(?=jest|vitest|mocha|playwright)|node_modules\/\.bin\/|\.\/)+/;
-const partsOf = bare => bare.split(/\s*(?:\|\|?|&&|;)\s*/).map(part => part.replace(/\s\d*>.*$/, '').trim());
+// A function body, a group or a loop body opens a part as well.
+const LAUNCHER = /^(?:[\w-]+\s*\(\)\s*\{?\s*|\{\s+|\(\s*|(?:do|then|else)\s+|\w+=\S*\s+|time\s+|nohup\s+|timeout\s+\S+\s+|npx\s+(?:-\S+\s+)*|bunx\s+|pnpm\s+(?:exec|dlx)\s+|uv\s+run\s+|poetry\s+run\s+|yarn\s+(?=jest|vitest|mocha|playwright)|node_modules\/\.bin\/|\.\/)+/;
+const partsOf = bare => bare.split(/\s*(?:\|\|?|&&|;)\s*/).map(part => part.replace(/\s\d*>.*$/, '').replace(/[\s)}]+$/, '').trim());
 const NOT_TESTS = /\b(lint|typecheck|type-check|tsc|eslint|biome|ruff|mypy|pyright|vet|clippy|format|build)\b/;
 const TARGET_FLAG = /^(-p|--package|-w|--workspace|--tests)$|^(-Dtest=|-only-testing:|--workspace=|--package=)/;
+// `go test -p 4` sets how many packages run at once; for cargo -p names a package.
+const GO_TEST = /^go\s+test\b/;
 const VALUE_FLAG = /^(-c|--config|--reporter|--project|--workers|--timeout|--rootDir|--root|-f|--file|-o|--output)$/;
 // A file or folder named on the command line; a flag's own value names none.
-const targetsPart = args => args.some((a, i) => {
+const targetsPart = (args, go = false) => args.some((a, i) => {
+  // A variable: a function's arguments, a loop's file, $(go list …). The caller chose them, so this is not the whole command.
+  if (a.startsWith('$')) return true;
+  if (go && a === '-p') return false;
   if (TARGET_FLAG.test(a)) return true;
+  if (go && args[i - 1] === '-p') return false;
   if (a.startsWith('-') || VALUE_FLAG.test(args[i - 1] ?? '') || a.includes('*') || a.endsWith('...')) return false;
   return a.includes('/') || /\.(test|spec)\.\w+$|_test\.\w+$|^test_\w+\.\w+$/.test(a);
 });
 // What a command runs, without the text it merely quotes (a commit message, an echo).
-const unquoted = text => text.replace(/"[^"]*"|'[^']*'/g, '""');
+const unquoted = text => text.replace(/"[^"]*"|'[^']*'/g, quoted => quoted.startsWith('"$') ? '$' : '""');
 export function checkScope(command, declared = []) {
   const text = String(command ?? '').replace(/\s+/g, ' ').trim();
   if (!text || /^(echo|printf|grep|rg|cat|sed|awk|head|tail|less|git|ls|find)\b/.test(text) || VERSION_ONLY.test(text) || /--collect-only/.test(text)) return null;
@@ -36,12 +44,17 @@ export function checkScope(command, declared = []) {
     const own = part.replace(LAUNCHER, ''), runner = own.match(TEST_START);
     if (!runner) continue;
     if (FILTERED.test(own)) return 'partial';
-    return !declared.includes(text) && targetsPart(own.slice(runner[0].length).split(' ').filter(Boolean)) ? 'partial' : 'suite';
+    return !declared.includes(text) && targetsPart(own.slice(runner[0].length).split(' ').filter(Boolean), GO_TEST.test(own)) ? 'partial' : 'suite';
   }
   // A script the repository declares: it cannot be narrowed from here.
   const named = declared.find(d => partsOf(bare).some(part => part.startsWith(unquoted(d))));
   return named && !NOT_TESTS.test(named) ? 'suite' : null;
 }
+// The test step of a command, without what surrounds it: the same step costs the same.
+export function suitePart(command) {
+  for (const part of partsOf(unquoted(String(command ?? '').replace(/\s+/g, ' ').trim()))) { const own = part.replace(LAUNCHER, ''); if (TEST_START.test(own)) return own; }
+  return String(command ?? '').trim();
+}
 // The member's own words asking for the whole suite: nothing to ask them then.
 const RUN_ALL = String.raw`(?:full|all(?:\s+the)?|whole(?:\s+the)?|entire(?:\s+the)?|the\s+(?:full|whole|entire))`;
 const FULL_WORDS = new RegExp([
@@ -94,18 +107,19 @@ export async function askCheckScope(self, { partPassed = false, signal } = {}) {
 
 const PARTIAL_REASON = 'managed-check-scope: the member chose to run only the tests that cover the change. Run one file, a filter or one package, not the whole suite. If this project has no way to run part of it, say so and repeat the command: the member is asked.';
 const BYPASS_REASON = 'managed-check-scope: run the tests that cover the change (one file, a filter, one package). A whole-suite run needs the member to ask for it, or their answer before a push. If this project has no way to run part of it, say so and repeat the command.';
-const PUSH_REASON = 'managed-check-scope: the member wants the whole suite before this push. Run it, fix what fails, then push.';
+const PUSH_REASON = missing => `managed-check-scope: the member wants the whole suite before this push${missing.length && missing[0] !== '.' ? ` (still needed in: ${missing.join(', ')})` : ''}. Run it, fix what fails, then push.`;
 const STOPPED_REASON = 'managed-check-scope: the member did not answer whether to push now. Do not push; say so and let them decide.';
 const WORDS_REASON = words => `managed-check-scope: this command did not run. The member answered about testing: "${String(words).slice(0, 500)}". Follow that.`;
 
 // Before a whole suite or a push: returns to let it run, throws to send the agent another way.
 export async function beforeCheckOrPush(self, command, ctx, signal) {
   const run = self.run;
-  if (!run || run.policy?.verify === 'off') return;
+  if (!run || (run.policy?.verify === 'off' && !isGitPush(command))) return;
   // Calls sent together wait for one answer: the next one sees it.
   const turn = (run.scopeQuestion ?? Promise.resolve()).then(() => holdOrLet(self, run, command, ctx, signal));
   run.scopeQuestion = turn.catch(() => {});
-  return turn;
+  await turn;
+  markCheckStart(run, command);
 }
 async function holdOrLet(self, run, command, ctx, signal) {
   const push = isGitPush(command);
@@ -113,18 +127,22 @@ async function holdOrLet(self, run, command, ctx, signal) {
   const surface = surfaceOf(self, ctx);
   if (!surface) return;
   if (push) {
-    const now = await self.digest();
-    if (run.suitePassedOn(now) || (run.pushAllowedOn !== undefined && run.pushAllowedOn === now)) return;
-    const picked = await ask(surface, 'Sắp push code nhưng toàn bộ test chưa pass trên code này. Làm gì?', [PUSH_FULL, PUSH_NOW], signal);
+    const digestOf = digestsOnce(self);
+    await reviewBeforePush(self, digestOf, run, signal);
+    if (run.policy?.verify === 'off') return;
+    const now = await digestOf('.'), repositories = pushRepositories(self, command), single = !repositories.length || repositories[0] === '.';
+    const missing = await missingSuites(digestOf, run, repositories.length ? repositories : ['.']);
+    if ((single ? run.suitePassedOn(now) : false) || !missing.length || (run.pushAllowedOn !== undefined && run.pushAllowedOn === now)) return;
+    const picked = await ask(surface, await pushQuestion(self, digestOf, run, repositories, missing), [PUSH_FULL, PUSH_NOW], signal);
     if (picked === PUSH_NOW) { run.pushAllowedOn = now; return; }
     if (picked?.other) throw Error(WORDS_REASON(picked.other));
     if (picked !== PUSH_FULL) throw Error(STOPPED_REASON);
-    run.scopeChoice = 'full';
-    throw Error(PUSH_REASON);
+    run.scopeChoice = 'full'; run.fullFor = new Set(missing);
+    throw Error(PUSH_REASON(missing));
   }
   // Sent another way once; the same command again means the part did not do: the member decides (Bypass: it runs).
   const held = run.scopeHeld ??= new Set(), again = held.has(command); held.add(command);
-  if (effectivePermission(self) === 'bypass') { if (again) return; throw Error(BYPASS_REASON); }
+  if (effectivePermission(self) === 'bypass') { if (again || knownFast(self, command, suitePart(command))) return; throw Error(BYPASS_REASON); }
   if (run.scopeChoice === 'partial' && !again) throw Error(PARTIAL_REASON);
   const picked = await ask(surface, `Agent muốn chạy toàn bộ test: ${String(command).slice(0, 160)}`, [PART, FULL], signal);
   if (picked === FULL) { run.scopeChoice = 'full'; return; }

package/packages/piagent-core/managed/command-tools.mjs

@@ -1,5 +1,6 @@
 import { spawn } from 'node:child_process';
 import { beforeCheckOrPush } from './check-questions.mjs';
+import { approvalRefusal } from './approval-refusal.mjs';
 import { asksOnlyHandoff, broadAccess, effectivePermission, networkConfirmation } from './permission.mjs';
 import { handoffReason } from '../runtime/policy/handoff-policy.mjs';
 import { engineAlive, engineLauncher } from './container-engine.mjs';
@@ -38,7 +39,7 @@ const KINDS = {
   },
   host: {
     name: 'run_on_host', label: 'Run on this machine', scope: 'host-command-once', provider: 'host', riskClass: 'high',
-    description: 'Run one shell command on the member\'s machine, outside the sandbox, as the member, after they approve that exact command (only Bypass runs it without asking, and even there a push, PR, publish, deploy or a command that reaches credentials is asked). Use it when the sandbox blocks what the task needs and no other tool covers it: install a runtime or tool the project needs (brew install openjdk@21, brew install node@22, sdk install java…), git pull with the member\'s sign-in, git push only when the member asked for it, a private registry, a file outside the project. It has the member\'s files, Keychain and sign-ins, so ask only for what the task needs and say why in reason. No input can be typed: commands that need the member\'s password (sudo, a .pkg installer) or an interactive sign-in are refused; ask the member with ask_user for those.',
+    description: 'Run one shell command on the member\'s machine, outside the sandbox, as the member, in their login shell (zsh on macOS: an unquoted $var is not split into words, unlike bash), after they approve that exact command (only Bypass runs it without asking, and even there a push, PR, publish, deploy or a command that reaches credentials is asked). Use it when the sandbox blocks what the task needs and no other tool covers it: install a runtime or tool the project needs (brew install openjdk@21, brew install node@22, sdk install java…), git pull with the member\'s sign-in, git push only when the member asked for it, a private registry, a file outside the project. It has the member\'s files, Keychain and sign-ins, so ask only for what the task needs and say why in reason. No input can be typed: commands that need the member\'s password (sudo, a .pkg installer) or an interactive sign-in are refused; ask the member with ask_user for those.',
     allow: 'Run this exact command once on this machine, outside the sandbox, as you: it can read and change your files and use your sign-ins.',
     title: 'Chạy lệnh trên máy (ngoài sandbox)', allowText: 'chạy đúng lệnh này một lần trên máy bạn, ngoài sandbox, bằng quyền của bạn: lệnh đọc/sửa được file và dùng được tài khoản đã đăng nhập trên máy.',
     // Full access does not cover it: the member approves each command (with
@@ -78,6 +79,7 @@ export function stillAsks(self, reason) {
 // member may allow it once, allow the same exact action for the rest of the
 // conversation (never a handoff or a waiver of checks: its scope names it), deny it, or deny it and
 // stop the turn so the agent does not try again.
+const HANDOFF_APPROVAL_MS = 30 * 60_000;
 const CHOICES = { once: 'Đồng ý một lần', session: 'Đồng ý cho cả cuộc trò chuyện (đúng lệnh này)', deny: 'Từ chối', stop: 'Từ chối và dừng lượt này' };
 export async function approve(self, id, signal, ctx, action, { title, body }) {
   const grantable = !/handoff|waiver/.test(String(action.requestedScope ?? '')), key = `${action.toolName}\u0000${action.commandPreview ?? JSON.stringify(action.rawAction ?? {})}`;
@@ -91,9 +93,11 @@ export async function approve(self, id, signal, ctx, action, { title, body }) {
       const picked = await ctx.ui.select(`${title}\n\n${body}`, choices.map(choice => CHOICES[choice]));
       return choices.find(choice => CHOICES[choice] === picked) ?? 'deny';
     } } : {}),
+    // A push waits longer than other cards: the member may be away while a suite ran.
+    ...(/handoff/.test(String(action.requestedScope ?? '')) ? { ttlMs: HANDOFF_APPROVAL_MS } : {}),
     unavailableFallback: 'terminal-confirm', recheck: () => !signal?.aborted && Boolean(self.grant) });
   if (!decision.allowed && decision.choice === 'stop') { try { ctx?.abort?.(); } catch { /* the denial below still stands */ } throw Error('managed-operation-denied-stop: bạn đã từ chối và dừng lượt này; không thử lại, chờ member.'); }
-  if (!decision.allowed || !decision.consume() || signal?.aborted) throw Error('managed-operation-denied');
+  if (!decision.allowed || !decision.consume() || signal?.aborted) throw approvalRefusal(decision);
   if (decision.choice === 'session' && grantable) (self.sessionApprovals ??= new Set()).add(key);
 }
 
@@ -126,7 +130,7 @@ function commandTool(self, kind) {
       } finally {
         // What the command installed (a JDK, Node) is there for the next one.
         if (kind === 'host') self.boundary.refreshEnvironment();
-        await self.claimChanges(before); await self.run?.afterTool('bash', args, ok, () => self.digest()); await self.refreshReview();
+        await self.claimChanges(before); await self.run?.afterTool('bash', args, ok, () => self.digest(), self); await self.refreshReview();
       }
     } };
 }

package/packages/piagent-core/managed/helper-roles.mjs

@@ -87,7 +87,7 @@ export function countedCheck(managed, tool) {
     try { const result = await tool.execute(...args); ok = !result?.isError; return result; }
     finally {
       const after = counted && before !== null ? await folder() : null;
-      if (after !== null && after === before) await managed.run.afterTool('bash', args[1], ok, () => managed.digest());
+      if (after !== null && after === before) await managed.run.afterTool('bash', args[1], ok, () => managed.digest(), managed);
     }
   } };
 }

package/packages/piagent-core/managed/helper-run.mjs

@@ -4,6 +4,7 @@
 // refusal, starts once more: Studio then gives the new helper the next model
 // of its role that serves (an auto role's list).
 import { fenced, HELPER_UNTRUSTED_RULE } from './untrusted.mjs';
+import { relevantChecks } from './check-evidence.mjs';
 import { jobTitle } from './call-purpose.mjs';
 import { ManagedToolBoundary } from './tool-boundary.mjs';
 import { managedResourceLoader } from './resource-loader.mjs';
@@ -144,7 +145,7 @@ async function answerUnder(managed, key, task, signal, harness, snapshot, parts,
     (managed.jobTitles ??= new WeakMap()).set(runtime, jobTitle(task, title));
     const setup = HELPER_SETUP[role], memory = helperMemoryTools(managed, () => grant, renew);
     boundary = new ManagedToolBoundary({ cwd: managed.cwd, sdkRoot: managed.sdk, protectedRoots: managed.protectedRoots, readOnly: true, commands: setup.commands });
-    const checks = role === 'verify' ? `\n\nRepository checks: ${managed.checks.commands.length ? managed.checks.commands.map(c => '`' + c + '`').join(', ') : 'none declared or detected; choose the tests, type check or build that cover the claims'}.${managed.run?.fullAsked || managed.run?.scopeChoice === 'full' ? '' : ' Run only the tests that cover the claims: the member decides about a whole-suite run.'}` : '';
+    const checks = role === 'verify' ? `\n\nRepository checks: ${managed.checks.commands.length ? relevantChecks(managed, managed.checks.commands).map(c => '`' + c + '`').join(', ') : 'none declared or detected; choose the tests, type check or build that cover the claims'}.${managed.run?.fullAsked || managed.run?.scopeChoice === 'full' ? '' : ' Run only the tests that cover the claims: the member decides about a whole-suite run.'}` : '';
     // One helper session answers the brief (with one part of the patch for a
     // review in parts); its reply and tokens. A helper runs at its role's
     // level from Studio (fixed by the Harness, or its main agent's).

package/packages/piagent-core/managed/ledger.mjs

@@ -120,7 +120,7 @@ export function rejudgeBrief(item) {
 // One step of the completion gate (true: the gate goes round again). A
 // rejected premise objection goes back to its helper, which withdraws it or
 // keeps it for the member; then the items the main agent never decided are
-// put to it once, with no new review.
+// put to it once each, with no new review: a later review's findings are new items.
 export async function settleLedger(managed, run, { note, send, signal }) {
   const rejected = toRejudge(run)[0];
   if (rejected) {
@@ -133,9 +133,9 @@ export async function settleLedger(managed, run, { note, send, signal }) {
     await note(`Harness: the ${rejected.role} subagent keeps its objection; the member decides.\n${itemText(rejected)}`, { phase: 'dispute', role: rejected.role, id: rejected.id });
     return true;
   }
-  const pending = undecided(run);
-  if (!pending.length || run.decideAsked) return false;
-  run.decideAsked = true;
+  const asked = run.decidedAsked ??= new Set(), pending = undecided(run).filter(item => !asked.has(item.id));
+  if (!pending.length) return false;
+  for (const item of pending) asked.add(item.id);
   await send(decideText(pending), { phase: 'answer', ids: pending.map(i => i.id), issues: pending.slice(0, 10).map(i => ({ kind: i.kind, detail: i.detail })) });
   return true;
 }
@@ -151,7 +151,7 @@ export function ledgerWords(run) {
   const items = ledgerOf(run), count = s => items.filter(i => i.status === s).length, words = [];
   if (!items.length && !run.minorFindings) return null;
   for (const [status, label] of [['accepted', 'accepted'], ['rejected', 'rejected'], ['withdrawn', 'withdrawn by the helper'], ['cleared', 'cleared by a later check'], ['disputed', 'for the member'], ['open', 'left without a decision'], ['noted', 'noted']])
-    if (count(status)) words.push(`${count(status)} ${label}`);
+    if (count(status)) words.push(`${count(status)} ${label}${status === 'open' ? ` (${items.filter(i => i.status === 'open').map(i => i.id).join(', ')})` : ''}`);
   if (run.minorFindings) words.push(`${run.minorFindings} minor finding(s) listed`);
   return `objections: ${words.join(', ')}`;
 }

package/packages/piagent-core/managed/memory-lessons.mjs

@@ -55,7 +55,7 @@ export class CheckLessons {
  // shape it becomes a failure lesson for the team memory.
  #toolError(call,event,output) {
   if(!COMMAND_TOOLS.has(call.tool)||call.check||this.lessons.length>=MAX_LESSONS)return;
-  if(/managed[-_](?:tool[-_]cancelled|operation[-_]denied|helper[-_]cancelled)|Command aborted|Command timed out/i.test(output))return;
+  if(/managed[-_](?:tool[-_]cancelled|operation[-_](?:denied|expired|cancelled)|helper[-_]cancelled)|Command aborted|Command timed out/i.test(output))return;
   const line=output.split('\n').find(l=>ERROR_LINE.test(l));
   if(!line)return;
   const command=commandShape(call.command);
@@ -85,7 +85,7 @@ export class CheckLessons {
   const output=textOf(event.result), c=call.check;
   const exitFailed=event.isError || (event.result?.details?.exitCode !== undefined && event.result.details.exitCode!==0);
   if(exitFailed || (c.piped && failedOutput(output))) {
-   if(/managed[-_](?:tool[-_]cancelled|operation[-_]denied|helper[-_]cancelled)|Command aborted|Command timed out/i.test(output))return;
+   if(/managed[-_](?:tool[-_]cancelled|operation[-_](?:denied|expired|cancelled)|helper[-_]cancelled)|Command aborted|Command timed out/i.test(output))return;
    this.failed++;this.last='failed';
    const diagnostic=output.split('\n').find(l=>/error|fail|exception|not found|EADDRINUSE/i.test(l)) ?? 'Check exited unsuccessfully';
    if(this.failures.size>=20)this.failures.delete(this.failures.keys().next().value);

package/packages/piagent-core/managed/repository-operation.mjs

@@ -1,4 +1,5 @@
 import { broadAccess } from './permission.mjs';
+import { approvalRefusal } from './approval-refusal.mjs';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -121,7 +122,7 @@ export function fetchOriginTool(self) {
           reason:`Fetch origin branches from ${plan.repository}`,riskClass:'low',allowConsequence:'Download origin branches once; keep the current branch and working files unchanged.',denyConsequence:'No network request or credential read.'},
         terminalConfirm:()=>ctx?.ui?.confirm?.('Tải nhánh từ origin',`Tải các nhánh của ${plan.repository} về ${plan.cwd} một lần.\n\nĐồng ý: chỉ tải nhánh; nhánh hiện tại và file đang làm không đổi.\nTừ chối: không gửi request mạng, không đọc thông tin đăng nhập.`)??Promise.resolve(false),
         unavailableFallback:'terminal-confirm',recheck:()=>!signal?.aborted&&Boolean(self.grant)});
-      if(!decision.allowed||!decision.consume()||signal?.aborted)throw Error('managed-operation-denied');
+      if(!decision.allowed||!decision.consume()||signal?.aborted)throw approvalRefusal(decision);
       return executeRepositoryFetch(self.boundary,plan,signal);
     }};
 }

package/packages/piagent-core/managed/tool-boundary.mjs

@@ -112,7 +112,7 @@ ${proxyPort && !network ? `(allow mach-lookup (global-name "com.apple.trustd.age
 (allow network-outbound (literal ${literal(docker)}))` : ''}` : loopback ? '(allow network-outbound (remote ip "localhost:*"))' : proxyPort ? `(allow network-outbound (remote ip "localhost:${Number(proxyPort)}"))` : ''}
 ${denied.map(root => `(deny file-read* file-write* (require-all (subpath ${literal(root)})${skills.filter(dir => inside(dir, root) && dir !== root).map(dir => ` (require-not (subpath ${literal(dir)}))`).join('')}))`).join('\n')}
 (deny file-read* file-read-metadata file-write* (require-all (require-any (regex #"(^|/)(\\.env([./]|$)|credentials([./]|$)|\\.npmrc$|\\.netrc$)") (regex #"/\\.[^/]+/auth\\.json$") ${projectRoots.map(root => `(literal ${literal(path.join(root, 'auth.json'))})`).join(' ')})
-  (require-not (regex #"(^|/)\\.env\\.(example|sample|template|dist|defaults)$"))))
+  (require-not (regex #"(^|/)\\.env\\.(example|sample|template|dist|defaults)$"))))  (allow file-read* file-read-metadata file-write* (require-all (subpath ${literal(temporary)}) (regex #"/\\.env([.][^/]*)?$")))
 `;
 }
 // Toolchains from the pinned node/git and Homebrew, compilers and SDK; the

package/packages/piagent-core/managed/tool-failures.mjs

@@ -15,7 +15,7 @@ const INPUT_CHARS = 500, ERROR_HEAD = 1000, ERROR_TAIL = 2000;
 // One request carries at most BATCH failures; KEEP wait for the next one.
 const BATCH = 20, KEEP = 100, ATTEMPTS = 3;
 // The member stopped the tool or declined to approve it: not a failure.
-const NOT_FAILURES = new Set(['managed_tool_cancelled', 'managed_helper_cancelled', 'managed_operation_denied']);
+const NOT_FAILURES = new Set(['managed_tool_cancelled', 'managed_helper_cancelled', 'managed_operation_denied', 'managed_operation_expired', 'managed_operation_cancelled']);
 
 const text = result => typeof result === 'string' ? result
   : Array.isArray(result?.content) ? result.content.filter(part => part?.type === 'text').map(part => part.text ?? '').join('\n') : '';

package/packages/piagent-core/managed/workflow.mjs

@@ -4,7 +4,8 @@ import { TsDiagnostics } from './ts-diagnostics.mjs';
 import { checkpointsOf } from './checkpoints.mjs';
 import { declaredChecks, detectedChecks, repositoryChecks, isCheckCommand, isReadOnlyCommand, nonCodePath, onlyNonCode } from './repository-checks.mjs';
 export { declaredChecks, detectedChecks, repositoryChecks, isCheckCommand, isReadOnlyCommand, nonCodePath, onlyNonCode };
-import { askCheckScope, asksFullChecks, beforeCheckOrPush, checkScope } from './check-questions.mjs';
+import { askCheckScope, asksFullChecks, beforeCheckOrPush, checkScope, suitePart } from './check-questions.mjs';
+import { recordCheck, relevantChecks } from './check-evidence.mjs';
 import { LANE_LIMITS, patchStats, changeLane, lanePolicy } from './risk-lanes.mjs';
 import { briefCounts, decisionsText, ledgerGuard, ledgerOf, ledgerWords, reviewFocus, saveLedger, setStatus, settleLedger } from './ledger.mjs';
 
@@ -81,7 +82,7 @@ export function workflowPrompt(policy, checks) {
     const L = LANE_LIMITS;
     lines.push(`- Size: the process follows the size of your change. A small change (at most ${L.tinyFiles} files and ${L.tinyLines} changed lines, no migration, auth, security, CI, dependency or AGENTS.md file) ends after its checks, without a review: do not ask for one. A risky change (a complex request, one of those files, more than ${L.riskyFiles} files or ${L.riskyLines} lines) must pass the checks${policy.review !== 'off' ? ' and the harness review' : ''} even where they are only suggested.`);
   }
-  return lines.length ? `\n\nProcess for code changes (company Harness):\n${lines.join('\n')}\n${process.platform === 'darwin' ? 'End-to-end and UI checks run in bash with the project\'s Playwright (@playwright/test; add it with npm when the project lacks it) and the browsers installed on this Mac, against a server the test or start_process starts; while a local proxy listens they need run_with_network. When Playwright\'s browsers are missing, ask with run_on_host to run `npx playwright install chromium`.' : 'End-to-end tests that start a local server and a browser run through run_with_network, which the user approves.'} If a check cannot run because the machine lacks something (a runtime such as a JDK, Docker, a database or another service, the network), do not stop there: request the approval that makes it run (run_with_network, run_with_docker, start_docker, or run_on_host to install what is missing) or ask the member with ask_user; never install or start anything without that approval.\nA command stops after 10 minutes and anything left running in the background stops when the turn ends: run the checks that cover your change first and a long suite in parts, not in the background.${process.platform === 'darwin' ? ' A dev server, watcher or local service you need across turns runs with start_process (read it with process_output, stop it with stop_process).' : ''}` : '';
+  return lines.length ? `\n\nProcess for code changes (company Harness):\n${lines.join('\n')}\n${process.platform === 'darwin' ? 'A bash command stops after 10 minutes unless you pass timeout in seconds, at most 1800: a long suite needs that, not another tool. End-to-end and UI checks run in bash with the project\'s Playwright (@playwright/test; add it with npm when the project lacks it) and the browsers installed on this Mac, against a server the test or start_process starts; while a local proxy listens they need run_with_network. When Playwright\'s browsers are missing, ask with run_on_host to run `npx playwright install chromium`.' : 'End-to-end tests that start a local server and a browser run through run_with_network, which the user approves.'} If a check cannot run because the machine lacks something (a runtime such as a JDK, Docker, a database or another service, the network), do not stop there: request the approval that makes it run (run_with_network, run_with_docker, start_docker, or run_on_host to install what is missing) or ask the member with ask_user; never install or start anything without that approval.\nA command stops after 10 minutes and anything left running in the background stops when the turn ends: run the checks that cover your change first and a long suite in parts, not in the background.${process.platform === 'darwin' ? ' A dev server, watcher or local service you need across turns runs with start_process (read it with process_output, stop it with stop_process).' : ''}` : '';
 }
 
 // Every helper checks the brief it was given: it may object with evidence, it
@@ -173,7 +174,7 @@ export class RunProcess {
       // asked for, and where the harness last sent the agent back (to read
       // its answer and see whether the code moved).
       ledger: [], disputes: [], verifyFails: [], claimsAsked: false, claimsAt: null, claimsRechecked: false, claimsDone: false, mainReviews: 0, minorFindings: 0,
-      sentAt: null, sentDigest: null, rejudged: false, reviewSettled: false, decideAsked: false,
+      sentAt: null, sentDigest: null, rejudged: false, reviewSettled: false,
       // How much of the suite the member wants run (check-questions.mjs).
       scopeChoice: null, scopeWords: null, fullAsked: asksFullChecks(request), pushAllowedOn: undefined,
       // The patch's risk lane (workflow.lanes) and the main agent's own web lookups.
@@ -197,15 +198,17 @@ export class RunProcess {
   changedWithoutPlan() {
     this.unplannedChange = true; this.planSkipped = true;
   }
-  async afterTool(name, args, ok, digestOf) {
+  // `owner`: the conversation the command ran in, for what passed in which repository.
+  async afterTool(name, args, ok, digestOf, owner = null) {
     if (['write', 'edit'].includes(name) && ok) this.edited = true;
     if (name === 'bash' && isCheckCommand(args?.command, this.checks.commands)) {
       const scope = checkScope(args.command, this.checks.commands), digest = await digestOf(), last = this.lastCheck;
       this.checksRun += 1; if (!ok) this.checksFailed += 1;
       // A lint after a partial test run does not make it the whole suite.
       this.lastCheck = { ok, digest, mutations: this.mutations, scope: scope ?? (last?.scope === 'partial' && last.digest === digest ? 'partial' : 'other') };
-      // The member's "run it all" covers one run; after a fix they are asked again.
-      if (scope === 'suite' && this.scopeChoice === 'full') this.scopeChoice = null;
+      await recordCheck(this, owner, args.command, scope, ok, suitePart(args.command));
+      // The member's "run it all" covers one run in each repository a push needs; after a failure they are asked again.
+      if (scope === 'suite' && this.scopeChoice === 'full' && (!ok || !this.fullFor?.size)) { this.scopeChoice = null; this.fullFor = null; }
     // A command may change files, so it counts. Without a git repository to
     // compare the code against, one that only reads does not: counting every
     // command reported code changes in turns that only read and checked.
@@ -298,7 +301,7 @@ export async function completionGate(managed, run, signal) {
       }
       if (policy.verify === 'require' && (!run.verified || run.scopeWords) && !run.docsOnly && !verifyGaveUp && run.waivedDigest !== digest) {
         run.fixLoops += 1;
-        const list = run.checks.commands.length ? run.checks.commands.map(c => '`' + c + '`').join(', ') : 'the tests, type check or build that cover the change';
+        const list = run.checks.commands.length ? relevantChecks(managed, run.checks.commands).map(c => '`' + c + '`').join(', ') : 'the tests, type check or build that cover the change';
         const words = run.scopeWords; run.scopeWords = null;
         const ask = words ? `The member answered about testing: "${String(words).slice(0, 500)}". Follow that and fix what fails.`
           : run.scopeChoice === 'partial' ? 'Run only the tests that cover your change (one file, a filter, one package), not the whole suite, and fix what fails.'
@@ -446,7 +449,7 @@ export function processEditTools(session, tools) {
         }
         return result;
       }
-      finally { await session.run?.afterTool(tool.name, args[1], ok, () => session.digest()); await session.refreshReview(); }
+      finally { await session.run?.afterTool(tool.name, args[1], ok, () => session.digest(), session); await session.refreshReview(); }
     } };
   });
 }

package/packages/piagent-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/core",
-  "version": "1.49.1",
+  "version": "1.50.0",
   "type": "module",
   "private": true,
   "license": "MIT",

package/packages/piagent-core/runtime/inspection/approval-broker.ts

@@ -8,7 +8,7 @@ const PUBLIC_REF = /^[A-Za-z0-9][A-Za-z0-9._:@~-]{0,159}$/;
 const REVISION = /^[A-Za-z0-9][A-Za-z0-9._:~-]{0,159}$/;
 const DIGEST = /^sha256:[a-f0-9]{64}$/;
 const TIMESTAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
-const MAX_PENDING = 32, MAX_RECENT = 64, DEFAULT_TTL_MS = 5 * 60_000;
+const MAX_PENDING = 32, MAX_RECENT = 64, DEFAULT_TTL_MS = 5 * 60_000, MAX_TTL_MS = 30 * 60_000;
 
 type Identity = { projectRef: string; runtimeInstanceId: string; sessionRef: string; taskId: string; taskRunId: string;
   agentOperationId: string; toolCallId: string };
@@ -161,7 +161,7 @@ export class PiApprovalBroker {
     if (!binding || !authority || authority.taskState !== "active" || input.expectedTask && (authority.identity.taskId !== input.expectedTask.taskId || authority.identity.taskRunId !== input.expectedTask.taskRunId)
       || !REF.test(authority.identity.agentOperationId)
       || !toolCallId || binding.pending.size >= MAX_PENDING) return this.#unavailable(input);
-    const now = Date.now(), requestedAt = new Date(now).toISOString(), expiresAt = new Date(now + Math.min(Math.max(input.ttlMs ?? DEFAULT_TTL_MS, 5_000), DEFAULT_TTL_MS)).toISOString();
+    const now = Date.now(), requestedAt = new Date(now).toISOString(), expiresAt = new Date(now + Math.min(Math.max(input.ttlMs ?? DEFAULT_TTL_MS, 5_000), MAX_TTL_MS)).toISOString();
     const approvalRef = ref("approval", binding.secret, [toolCallId, now, randomUUID()]);
     const decisionToken = randomBytes(32).toString("base64url");
     const nextRevision = this.#nextRevision(binding, "requested", approvalRef);