@piagent/platform 1.6.0 → 1.7.1

package/packages/piagent-core/runtime/inspection/tool-failure-classification.ts

@@ -1,15 +1,22 @@
 export type ToolFailureReasonCode =
   | "target-not-found"
+  | "target-is-directory"
   | "search-target-missing"
   | "edit-anchor-not-unique"
   | "edit-anchor-stale"
+  | "helper-dispatch-rejected"
+  | "helper-insufficient-evidence"
   | "tool-result-failed";
 
-function boundedText(content: unknown): string {
+function boundedText(content: unknown, depth = 0): string {
+  if (depth > 2) return "";
+  const nested = content && typeof content === "object" && !Array.isArray(content)
+    ? (content as { content?: unknown }).content
+    : undefined;
   const text = typeof content === "string" ? content : Array.isArray(content)
     ? content.filter((item) => item && typeof item === "object" && (item as { type?: unknown }).type === "text")
       .map((item) => String((item as { text?: unknown }).text ?? "")).join("\n")
-    : "";
+    : nested !== undefined ? boundedText(nested, depth + 1) : "";
   return text.slice(0, 8_192);
 }
 
@@ -22,9 +29,50 @@ function commandFromInput(input: unknown): string {
     ? (args as { command: string }).command : "";
 }
 
+const CONFLICTING_FAILURE = /\b(?:EACCES|EPERM|ETIMEDOUT|ECONNRESET|ECONNREFUSED|ENETUNREACH|EAI_AGAIN|ENOSPC|EMFILE|ENOMEM)\b|permission denied|operation not permitted|timed? out|authentication (?:failed|required)|unauthorized|rate limit|invalid (?:regular expression|regex|pattern|option)|regex parse error|syntax error|unterminated|unclosed|unknown option|^usage:/im;
+const MISSING_TARGET = /\b(?:ENOENT|ENOTDIR)\b|no such file or directory|(?:file|path) (?:does not exist|not found)|not a directory|cannot find the (?:file|path)|no valid search paths given|\bos error 2\b/i;
+
+function standaloneSearchWithPartialEvidence(command: string, text: string): boolean {
+  const source = command.trim();
+  if (!/^(?:rg|grep|git\s+grep)\b/.test(source)) return false;
+  // A compound shell can fail for a second reason after a useful search. Do
+  // not neutralize its whole result from one missing-path diagnostic.
+  if (/[\r\n;<>]|&&|\|\||\$\(|`|(?<!\|)\|(?!\|)/.test(source)) return false;
+  if (CONFLICTING_FAILURE.test(text)) return false;
+
+  let usefulMatches = false;
+  let missingTarget = false;
+  for (const rawLine of text.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line) continue;
+    if (!/^\s*(?:rg|grep):/i.test(line) && /^.+?:\d+:/.test(line)) {
+      usefulMatches = true;
+      continue;
+    }
+    if (MISSING_TARGET.test(line)) {
+      missingTarget = true;
+      continue;
+    }
+    if (/^(?:command|process) exited with (?:code|status) [12]$/i.test(line)) continue;
+    return false;
+  }
+  return usefulMatches && missingTarget;
+}
+
 export function classifyToolFailure(toolName: string, isError: boolean, content: unknown, input?: unknown): ToolFailureReasonCode | null {
-  if (!isError) return null;
   const text = boundedText(content);
+  const subagent = /(?:^|[._-])subagents?(?:$|[._-])/i.test(toolName);
+  // Some subagent providers return a successful tool envelope even though no
+  // child was launched, or a zero-exit child explicitly reports that it could
+  // inspect no evidence. Canonical replay must not turn either outcome into a
+  // green "passed" Activity row merely because `isError` is false.
+  if (subagent && /spawn limit reached|no children were started|declared run cannot fit/i.test(text)) {
+    return "helper-dispatch-rejected";
+  }
+  if (subagent && /scope inspected:[^\n]{0,16}\bnone\b|insufficient-evidence rule|no source (?:content|evidence)[^\n]{0,80}(?:accessible|collected)/i.test(text)) {
+    return "helper-insufficient-evidence";
+  }
+  if (!isError) return null;
   // Only the registered, policy-governed `edit` tool may receive an automatic
   // current-file recovery snapshot. A similarly named third-party `replace`
   // tool is not necessarily covered by Piagent's mutation guard.
@@ -36,18 +84,28 @@ export function classifyToolFailure(toolName: string, isError: boolean, content:
       return "edit-anchor-stale";
     }
   }
-  const readLike = /(?:^|[._-])(?:read|document[_-]?read)(?:$|[._-])/i.test(toolName);
-  if (readLike && /\bENOENT\b|no such file or directory|file (?:does not exist|not found)|cannot find the (?:file|path)/i.test(text)) {
+  const trustedRead = /^(?:read|piagent_document_read)$/i.test(toolName);
+  const conflictingFailure = CONFLICTING_FAILURE.test(text);
+  if (trustedRead && !conflictingFailure && /\bEISDIR\b|illegal operation on a directory|is a directory/i.test(text)) {
+    return "target-is-directory";
+  }
+  if (trustedRead && !conflictingFailure && /\bENOENT\b|no such file or directory|(?:file|path) (?:does not exist|not found)|cannot find the (?:file|path)/i.test(text)) {
     return "target-not-found";
   }
+  const structuredSearch = /^(?:grep|find|ls)$/i.test(toolName);
+  if (structuredSearch && !conflictingFailure && MISSING_TARGET.test(text)) {
+    return "search-target-missing";
+  }
   const shellLike = /^(?:bash|shell|exec|command)$/i.test(toolName);
-  const searchCommand = /^\s*(?:rg|grep|git\s+grep)\b/.test(commandFromInput(input));
-  const missingTarget = /no such file or directory|cannot find the (?:file|path)|\bos error 2\b/i.test(text);
-  const usefulMatches = text.split(/\r?\n/).some((line) => !/^\s*(?:rg|grep):/i.test(line) && /^.+?:\d+:/.test(line));
-  if (shellLike && searchCommand && missingTarget && usefulMatches) return "search-target-missing";
+  if (shellLike && standaloneSearchWithPartialEvidence(commandFromInput(input), text)) return "search-target-missing";
   return "tool-result-failed";
 }
 
-export function handledToolFailure(reasonCode: unknown): boolean {
-  return reasonCode === "search-target-missing";
+export function handledToolFailure(reasonCode: unknown, toolName: unknown): boolean {
+  const trustedTool = String(toolName ?? "").toLowerCase();
+  if (reasonCode === "target-not-found" || reasonCode === "target-is-directory") {
+    return trustedTool === "read" || trustedTool === "piagent_document_read";
+  }
+  return reasonCode === "search-target-missing"
+    && ["grep", "find", "ls", "bash", "shell", "exec", "command"].includes(trustedTool);
 }

package/packages/piagent-core/runtime/inspection/webui-snapshot.ts

@@ -6,7 +6,7 @@ import { redactSensitiveText } from "../../extensions/redaction-core.js";
 import { workingTreeSnapshot } from "../../extensions/task-state.js";
 import { workingTreeEvidenceDigest, workingTreeSnapshotUsesCurrentAlgorithm } from "../../extensions/working-tree-digest.js";
 import { inspectTaskContinuationBudget } from "../recovery/continuation-budget.ts";
-import { readHandoffProjection } from "../recovery/handoff-projection.ts";
+import { handoffIdentityMatchesTask, readHandoffProjection } from "../recovery/handoff-projection.ts";
 import type { ActivityInspectorEvent, CurrentActivity } from "../product/activity-inspector.ts";
 import { recoveredToolCalls } from "./activity-recovery.ts";
 import { classifyToolFailure, handledToolFailure } from "./tool-failure-classification.ts";
@@ -84,8 +84,13 @@ function scopedEvents(events: ActivityInspectorEvent[], sessionId: string, task?
   return [...deduped.values()].sort((left, right) => String(left.recordedAt).localeCompare(String(right.recordedAt))).slice(-2_000);
 }
 
-function enrichedFailureReasons(events: ActivityInspectorEvent[], sessionEntries: unknown[]): ActivityInspectorEvent[] {
-  const inputs = new Map<string, unknown>(), results = new Map<string, { content: unknown; isError: boolean; toolName: string }>();
+type CanonicalToolResult = { content: unknown; isError: boolean; toolName: string; recordedAt?: string };
+
+function canonicalToolEvidence(sessionEntries: unknown[]): {
+  inputs: Map<string, unknown>;
+  results: Map<string, CanonicalToolResult>;
+} {
+  const inputs = new Map<string, unknown>(), results = new Map<string, CanonicalToolResult>();
   for (const entry of sessionEntries) {
     if (!entry || typeof entry !== "object" || (entry as any).type !== "message") continue;
     const message = (entry as any).message;
@@ -93,16 +98,44 @@ function enrichedFailureReasons(events: ActivityInspectorEvent[], sessionEntries
       for (const block of message.content) if (block?.type === "toolCall" && typeof block.id === "string") inputs.set(block.id, block.arguments);
     }
     if (message?.role === "toolResult" && typeof message.toolCallId === "string") {
-      results.set(message.toolCallId, { content: message.content, isError: message.isError === true, toolName: String(message.toolName ?? "unknown") });
+      const recordedAt = TIMESTAMP.test(String((entry as any).timestamp ?? message.timestamp ?? ""))
+        ? String((entry as any).timestamp ?? message.timestamp) : undefined;
+      results.set(message.toolCallId, { content: message.content, isError: message.isError === true,
+        toolName: typeof message.toolName === "string" ? message.toolName : "", recordedAt });
     }
   }
-  return events.map((event) => {
-    if (event.event !== "tool_result" || !event.toolCallId || !event.isError) return event;
-    const raw = results.get(event.toolCallId);
+  return { inputs, results };
+}
+
+function reconciledToolResults(events: ActivityInspectorEvent[], evidence: ReturnType<typeof canonicalToolEvidence>): ActivityInspectorEvent[] {
+  const resultIds = new Set(events.filter((event) => event.event === "tool_result" && event.toolCallId).map((event) => event.toolCallId as string));
+  const reconciled = events.map((event) => {
+    if (event.event !== "tool_result" || !event.toolCallId) return event;
+    const raw = evidence.results.get(event.toolCallId);
     if (!raw) return event;
-    const reasonCode = classifyToolFailure(raw.toolName, raw.isError, raw.content, inputs.get(event.toolCallId));
+    const reasonCode = classifyToolFailure(raw.toolName || event.toolName, raw.isError, raw.content, evidence.inputs.get(event.toolCallId));
+    if (!event.isError) {
+      // A newer explicit success remains authoritative over an older canonical
+      // hard error. The exception is a provider-level helper soft failure:
+      // legacy telemetry could only see `isError=false`, while the canonical
+      // result proves that no useful child actually ran.
+      if (raw.isError || !["helper-dispatch-rejected", "helper-insufficient-evidence"].includes(String(reasonCode))) return event;
+      return { ...event, isError: true, reasonCode };
+    }
     return reasonCode ? { ...event, reasonCode } : event;
   });
+  for (const call of events) {
+    if (call.event !== "tool_call" || !call.toolCallId || resultIds.has(call.toolCallId)) continue;
+    const raw = evidence.results.get(call.toolCallId);
+    if (!raw) continue;
+    const reasonCode = classifyToolFailure(raw.toolName || call.toolName, raw.isError, raw.content, evidence.inputs.get(call.toolCallId));
+    const effectiveError = raw.isError || Boolean(reasonCode && !handledToolFailure(reasonCode, raw.toolName || call.toolName));
+    reconciled.push({ activityId: `canonical-result:${call.toolCallId}`, event: "tool_result",
+      recordedAt: raw.recordedAt ?? call.recordedAt, sessionId: call.sessionId, taskRunId: call.taskRunId,
+      toolCallId: call.toolCallId, toolName: raw.toolName || call.toolName, isError: effectiveError,
+      ...(reasonCode ? { reasonCode } : {}) });
+  }
+  return reconciled.sort((left, right) => String(left.recordedAt ?? "").localeCompare(String(right.recordedAt ?? "")));
 }
 
 function sourceSummary(document: SourceChangeDocument | null, view: "task" | "working-tree" | "staged") {
@@ -129,29 +162,64 @@ function sourceSummary(document: SourceChangeDocument | null, view: "task" | "wo
   };
 }
 
-function activityProjection(events: ActivityInspectorEvent[], current: CurrentActivity[]) {
+function sourceProjectionRevision(views: CriteriaLinkProjection["sourceViews"]): string {
+  const content = (["task", "workingTree", "staged"] as const).map((key) => {
+    const document = views[key];
+    if (!document) return null;
+    const { generatedAt: _generatedAt, identity: _identity, snapshotBinding: _snapshotBinding, ...stable } = document;
+    const bases = Array.isArray(stable.bases) ? stable.bases.map((value) => {
+      if (!value || typeof value !== "object") return value;
+      const { taskRevision: _taskRevision, ...sourceBasis } = value as Record<string, unknown>;
+      return sourceBasis;
+    }) : stable.bases;
+    return { ...stable, bases };
+  });
+  return token("source-projection-rev", content);
+}
+
+function activityProjection(events: ActivityInspectorEvent[], current: CurrentActivity[], generatedAt: string,
+  operationLiveness?: "idle" | "running" | "unknown") {
   const results = new Map(events.filter((event) => event.event === "tool_result").map((event) => [event.toolCallId, event]));
   const decisions = new Map(events.filter((event) => event.event === "tool_decision").map((event) => [event.toolCallId, event]));
   const recoveries = recoveredToolCalls(events);
+  // Tool-call telemetry is deliberately written before execution. A missing
+  // result therefore cannot remain authoritative forever: compaction, abrupt
+  // host replacement, or an older runtime may have lost the matching result.
+  // A later host lifecycle boundary proves only that the call is no longer
+  // running, not that it passed or failed, so project it as terminal/unknown.
+  let lastLifecycleBoundary = -1;
+  for (let index = events.length - 1; index >= 0; index -= 1) {
+    if (!["turn_end", "agent_settled", "session_shutdown"].includes(String(events[index]?.event))) continue;
+    lastLifecycleBoundary = index;
+    break;
+  }
   const calls = events.filter((event) => event.event === "tool_call").slice(-200);
   const projected = calls.map((call) => {
     const result = results.get(call.toolCallId), decision = decisions.get(call.toolCallId);
     const blocked = decision?.decision === "blocked";
-    const handled = Boolean(result && handledToolFailure(result.reasonCode));
+    const handled = Boolean(result && handledToolFailure(result.reasonCode, result.toolName ?? call.toolName));
     const failed = !blocked && !handled && Boolean(result && (result.isError === true || (typeof result.exitCode === "number" && result.exitCode !== 0)));
     const recovery = call.toolCallId ? recoveries.get(call.toolCallId) : undefined;
-    const state = blocked ? "blocked" : !result ? "running" : failed && !recovery ? "failed" : "passed";
+    const lifecycleSettled = !result && !blocked && (operationLiveness === "idle"
+      || lastLifecycleBoundary > events.indexOf(call));
+    const state = blocked ? "blocked" : lifecycleSettled ? "unknown" : !result ? "running" : failed && !recovery ? "failed" : "passed";
     const toolName = display(call.toolName ?? "unknown", 80).replace(/[^A-Za-z0-9._:@~-]/g, "-") || "unknown";
     const rawId = String(call.toolCallId ?? call.activityId ?? `${call.recordedAt}:${toolName}`);
     const command = display(call.command ?? call.targetPath ?? toolName, 65_536);
+    const boundaryAt = lastLifecycleBoundary > events.indexOf(call)
+      ? timestamp(events[lastLifecycleBoundary]?.recordedAt, timestamp(call.recordedAt, generatedAt))
+      : timestamp(events.at(-1)?.recordedAt, timestamp(call.recordedAt, generatedAt));
     return {
       activityRef: token("activity", [rawId, call.recordedAt]), kind: ["bash", "shell", "exec"].includes(toolName) ? "command" : "tool", state,
-      label: display(recovery ? `${toolName} recovered` : handled ? `${toolName} warning` : state === "running" ? `${toolName} running` : `${toolName} ${state}`, 500), preview: command,
+      label: display(recovery ? `${toolName} recovered` : handled ? `${toolName} warning`
+        : state === "unknown" ? `${toolName} ended · result unavailable`
+          : state === "running" ? `${toolName} running` : `${toolName} ${state}`, 500), preview: command,
       toolCallId: token("tool", rawId), toolName, commandDigest: call.command ? `sha256:${hash(call.command)}` : null,
       logRef: null, exitCode: recovery?.exitCode ?? (typeof result?.exitCode === "number" ? result.exitCode : null),
       exitCodeExact: recovery?.exitCodeExact ?? (result?.exitCodeExact === true),
       startedAt: timestamp(call.recordedAt), finishedAt: recovery ? timestamp(recovery.recoveredAt, timestamp(call.recordedAt))
-        : result || blocked ? timestamp(result?.recordedAt ?? decision?.recordedAt, timestamp(call.recordedAt)) : null
+        : result || blocked ? timestamp(result?.recordedAt ?? decision?.recordedAt, timestamp(call.recordedAt))
+          : lifecycleSettled ? boundaryAt : null
     };
   });
   const callIds = new Set(calls.map((call) => String(call.toolCallId ?? "")));
@@ -180,7 +248,7 @@ function capabilities(identity: WebUiIdentity, generatedAt: string, resyncRequir
     capabilities: {
       inspect: { status: "available", version: 1, reason: null, sourceViews: ["task", "working-tree", "staged"] },
       "control.chat": unavailableCapability("chat-control-not-enabled", "The same-session bridge exists, but transcript, queue, server control and browser UX are not enabled"),
-      "control.lifecycle": unavailableCapability("lifecycle-contract-incomplete", "Pi 0.84.1 lacks semantic Pause and an acknowledged phase-complete Stop contract"),
+      "control.lifecycle": unavailableCapability("lifecycle-contract-incomplete", "Pi 0.86.1 lacks semantic Pause and an acknowledged phase-complete Stop contract"),
       "control.resumeAndContinue": unavailableCapability("compound-control-unavailable", "Resume is unavailable until a durable acknowledged Pause contract exists"),
       "control.sessionOptions": unavailableCapability("effect-scope-not-productionized", "Model and thinking APIs exist but lifecycle and persistence scope enforcement is not enabled"),
       attachments: unavailableCapability("attachments-not-implemented", "Attachments are not implemented"),
@@ -266,7 +334,7 @@ function handoff(cwd: string, task: TaskContract | undefined, currentDigest: str
   if (!task) return null;
   let value;
   try { value = readHandoffProjection(cwd, task.taskRunId); } catch { return null; }
-  if (!value) return null;
+  if (!value || !handoffIdentityMatchesTask(value.identity, task)) return null;
   const stale = Boolean(currentDigest && value.tree.currentDigest && currentDigest !== value.tree.currentDigest);
   return { handoffRef: token("handoff", task.taskRunId), state: stale ? "stale" : "ready", summary: display(value.goal.summary, 500),
     blocker: value.failure.warnings[0] ? display(value.failure.warnings[0], 500) : null,
@@ -291,6 +359,7 @@ export async function buildWebUiInspectionProjection(input: {
   eventReplay?: { eventRetentionCount: number; eventRetentionSeconds: number };
   model?: WebUiRuntimeModel;
   thinkingLevel?: unknown;
+  operationLiveness?: "idle" | "running" | "unknown";
 }): Promise<WebUiInspectionProjection> {
   const generatedAt = timestamp(input.generatedAt);
   const identity: WebUiIdentity = { projectRef: webUiProjectRef(input.cwd), runtimeInstanceId: input.runtimeInstanceId ?? WEBUI_RUNTIME_INSTANCE_REF,
@@ -302,15 +371,22 @@ export async function buildWebUiInspectionProjection(input: {
   const taskRevision = input.task ? webUiTaskRevision(input.task) : null;
   const views = await collectSourceChangeViews({ cwd: input.cwd, identity, generatedAt, taskRevision,
     isProtectedPath: (_root, repoPath) => Boolean(matchesProtectedPath(repoPath, effectiveProtectedPaths)) });
-  const events = enrichedFailureReasons(scopedEvents(input.events ?? [], input.sessionId, input.task), input.sessionEntries ?? []);
+  const canonicalEvidence = canonicalToolEvidence(input.sessionEntries ?? []);
+  const events = reconciledToolResults(scopedEvents(input.events ?? [], input.sessionId, input.task), canonicalEvidence);
   const linked = projectCriteriaFileVerifier({ cwd: input.cwd, task: input.task, sourceViews: views, currentSnapshot,
     protectedPaths: input.protectedPaths, events, at: new Date(generatedAt) });
-  const sourceChanges = { task: sourceSummary(linked.sourceViews.task, "task"), workingTree: sourceSummary(linked.sourceViews.workingTree, "working-tree"), staged: sourceSummary(linked.sourceViews.staged, "staged") };
+  const sourceChanges = { projectionRevision: sourceProjectionRevision(linked.sourceViews),
+    task: sourceSummary(linked.sourceViews.task, "task"), workingTree: sourceSummary(linked.sourceViews.workingTree, "working-tree"),
+    staged: sourceSummary(linked.sourceViews.staged, "staged") };
   const currentDigest = workingTreeSnapshotUsesCurrentAlgorithm(currentSnapshot) ? workingTreeEvidenceDigest(currentSnapshot) : null;
-  const current = input.current ?? [], controlState = input.task?.trace.outcome === "pending" ? "active" as const : "terminal" as const;
+  const current = (input.current ?? []).filter((item) => ((item.status ?? "running") !== "running" || input.operationLiveness !== "idle")
+    && ((item.status ?? "running") !== "running" || !canonicalEvidence.results.has(item.toolCallId)));
+  const runningCurrent = current.find((item) => (item.status ?? "running") === "running");
+  const controlState = input.task?.trace.outcome === "pending" ? "active" as const : "terminal" as const;
   const context = contextProjection(input.contextUsage, generatedAt), usageFacts = usage(input.sessionEntries ?? []);
   const eventCursor = input.eventCursor ?? token("event-cursor", events.map((event) => event.activityId ?? [event.event, event.toolCallId, event.recordedAt]));
-  const runtimeRevision = token("runtime-rev", [taskRevision, sourceChanges.workingTree.revision, sourceChanges.staged.revision, eventCursor, current]);
+  const runtimeRevision = token("runtime-rev", [taskRevision, sourceChanges.workingTree.revision, sourceChanges.staged.revision,
+    eventCursor, current, input.operationLiveness ?? null]);
   const approvals = { state: "unknown", pending: [], recent: [], health: { state: "unavailable", reasonCode: "approval-projection-unavailable", message: "Current host approval state is not exposed to the read-only projector" } };
   const task = input.task ? taskProjection(input.task, linked.criteria, controlState) : null;
   const issues = [
@@ -328,8 +404,8 @@ export async function buildWebUiInspectionProjection(input: {
     capabilities: capabilities(identity, generatedAt, input.resyncRequired === true, input.eventReplay),
     session: {
       connectionState: input.resyncRequired ? "resync-required" : "connected", connectionReason: input.resyncRequired ? "event-replay-gap" : null, displayName: input.task?.sessionName ?? null,
-      operation: current.some((item) => (item.status ?? "running") === "running")
-        ? { liveness: "running", operationRef: null, hostPhase: { state: "known", value: "tool", evidence: "derived", reasonCode: null }, startedAt: timestamp(current[0]?.startedAt, generatedAt), settledAt: null, reasonCode: null }
+      operation: input.operationLiveness === "running" || runningCurrent
+        ? { liveness: "running", operationRef: null, hostPhase: { state: "known", value: runningCurrent ? "tool" : "other", evidence: "derived", reasonCode: null }, startedAt: runningCurrent ? timestamp(runningCurrent.startedAt, generatedAt) : null, settledAt: null, reasonCode: null }
         : { liveness: "idle", operationRef: null, hostPhase: { state: "known", value: "idle", evidence: "derived", reasonCode: null }, startedAt: null, settledAt: null, reasonCode: null },
       controlState: input.task ? controlState : "active", taskOutcome: input.task?.trace.outcome ?? null, approvalState: approvals.state,
       verificationState: linked.verification.state, permissionProfile: { state: "unavailable", value: null, evidence: null, reasonCode: "permission-profile-not-projected" },
@@ -337,12 +413,18 @@ export async function buildWebUiInspectionProjection(input: {
       thinking: thinkingFact(input.thinkingLevel),
       queue: { state: "unavailable", hasPending: null, heldCount: null, revision: null, reasonCode: "host-queue-api-unavailable" }, context
     },
-    task, sourceChanges, activity: activityProjection(events, current), approvals, verification: linked.verification,
+    task, sourceChanges, activity: activityProjection(events, current, generatedAt, input.operationLiveness), approvals, verification: linked.verification,
     usage: { context, latestTurn: usageCounter(usageFacts.latest, "no-assistant-turn"), sessionTotal: usageCounter(usageFacts.observed ? usageFacts.totals : null, "host-total-usage-unavailable"),
       taskTotal: usageCounter(null, input.task ? "task-usage-boundary-unavailable" : "no-active-task"), capturedAt: generatedAt,
       health: { state: "degraded", reasonCode: "partial-usage-only", message: "Task-attributed usage is not available" } },
     continuation: continuation(input.cwd, input.task), handoff: handoff(input.cwd, input.task, currentDigest),
     health: { state: issues.length ? "degraded" : "ok", issues, resyncRequired: input.resyncRequired === true, generatedFromRevision: runtimeRevision }
   };
+  const snapshotBinding = { sourceProjectionRevision: snapshot.sourceChanges.projectionRevision,
+    taskViewRevision: snapshot.sourceChanges.task.revision, workspaceRevision: snapshot.sourceChanges.workingTree.revision,
+    indexRevision: snapshot.sourceChanges.staged.revision };
+  for (const document of Object.values(linked.sourceViews)) {
+    if (document) (document as SourceChangeDocument & { snapshotBinding: typeof snapshotBinding }).snapshotBinding = snapshotBinding;
+  }
   return { snapshot, sourceViews: linked.sourceViews, relations: linked.relations, verifierAttempts: linked.verifierAttempts, scopedEvents: events };
 }

package/packages/piagent-core/runtime/inspection/workspace-file-reader.ts

@@ -1,132 +1,2 @@
-import { createHash } from "node:crypto";
-import fs from "node:fs";
-import path from "node:path";
-
-export class WorkspaceReadError extends Error {
-  readonly code: "outside-root" | "symlink-ancestor" | "not-file" | "oversized" | "changed-during-read";
-
-  constructor(code: WorkspaceReadError["code"], message: string) {
-    super(message);
-    this.name = "WorkspaceReadError";
-    this.code = code;
-  }
-}
-
-type SafeCandidate = { root: string; absolute: string; parent: string };
-
-function inside(root: string, candidate: string): boolean {
-  const relative = path.relative(root, candidate);
-  return relative === "" || (relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
-}
-
-function safeCandidate(repoRoot: string, repoPath: string): SafeCandidate {
-  const root = fs.realpathSync.native(repoRoot);
-  const segments = repoPath.split("/");
-  if (!repoPath || path.posix.isAbsolute(repoPath) || segments.includes("..") || segments.includes("")) {
-    throw new WorkspaceReadError("outside-root", "Workspace path is not a safe repository-relative path");
-  }
-  let parent = root;
-  for (const segment of segments.slice(0, -1)) {
-    parent = path.join(parent, segment);
-    const stat = fs.lstatSync(parent);
-    if (stat.isSymbolicLink()) throw new WorkspaceReadError("symlink-ancestor", "Workspace path traverses a symbolic link");
-    if (!stat.isDirectory()) throw new WorkspaceReadError("not-file", "Workspace path has a non-directory ancestor");
-  }
-  const canonicalParent = fs.realpathSync.native(parent);
-  if (!inside(root, canonicalParent)) throw new WorkspaceReadError("outside-root", "Workspace path resolves outside its repository root");
-  const absolute = path.join(canonicalParent, segments.at(-1) as string);
-  if (!inside(root, absolute)) throw new WorkspaceReadError("outside-root", "Workspace path escapes its repository root");
-  return { root, absolute, parent: canonicalParent };
-}
-
-function sameFile(left: fs.Stats, right: fs.Stats): boolean {
-  return left.dev === right.dev && left.ino === right.ino && left.mode === right.mode;
-}
-
-function openRegularFile(repoRoot: string, repoPath: string): { descriptor: number; stat: fs.Stats; candidate: SafeCandidate } {
-  const candidate = safeCandidate(repoRoot, repoPath);
-  const descriptor = fs.openSync(candidate.absolute, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
-  try {
-    const stat = fs.fstatSync(descriptor);
-    if (!stat.isFile()) throw new WorkspaceReadError("not-file", "Workspace entry is not a regular file");
-    const canonical = fs.realpathSync.native(candidate.absolute);
-    const current = fs.lstatSync(candidate.absolute);
-    if (!inside(candidate.root, canonical) || !sameFile(stat, current)) {
-      throw new WorkspaceReadError("changed-during-read", "Workspace path changed while it was opened");
-    }
-    return { descriptor, stat, candidate };
-  } catch (error) {
-    fs.closeSync(descriptor);
-    throw error;
-  }
-}
-
-function verifyAfterRead(descriptor: number, before: fs.Stats, candidate: SafeCandidate): void {
-  const after = fs.fstatSync(descriptor);
-  const current = fs.lstatSync(candidate.absolute);
-  const canonical = fs.realpathSync.native(candidate.absolute);
-  if (
-    !sameFile(before, after)
-    || !sameFile(after, current)
-    || before.size !== after.size
-    || before.mtimeMs !== after.mtimeMs
-    || before.ctimeMs !== after.ctimeMs
-    || !inside(candidate.root, canonical)
-  ) {
-    throw new WorkspaceReadError("changed-during-read", "Workspace file changed during inspection");
-  }
-}
-
-export function inspectWorkspaceEntry(repoRoot: string, repoPath: string): fs.Stats {
-  const candidate = safeCandidate(repoRoot, repoPath);
-  return fs.lstatSync(candidate.absolute);
-}
-
-export function readWorkspaceLink(repoRoot: string, repoPath: string): string {
-  const candidate = safeCandidate(repoRoot, repoPath);
-  const before = fs.lstatSync(candidate.absolute);
-  if (!before.isSymbolicLink()) throw new WorkspaceReadError("not-file", "Workspace entry is not a symbolic link");
-  const target = fs.readlinkSync(candidate.absolute);
-  const after = fs.lstatSync(candidate.absolute);
-  if (!sameFile(before, after) || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs) {
-    throw new WorkspaceReadError("changed-during-read", "Workspace link changed during inspection");
-  }
-  return target;
-}
-
-export function readWorkspaceFile(repoRoot: string, repoPath: string, maxBytes: number): Buffer {
-  const opened = openRegularFile(repoRoot, repoPath);
-  try {
-    if (opened.stat.size > maxBytes) throw new WorkspaceReadError("oversized", "Workspace file exceeds its read cap");
-    const content = Buffer.allocUnsafe(opened.stat.size);
-    let position = 0;
-    while (position < content.length) {
-      const count = fs.readSync(opened.descriptor, content, position, content.length - position, position);
-      if (count <= 0) throw new WorkspaceReadError("changed-during-read", "Workspace file ended during inspection");
-      position += count;
-    }
-    verifyAfterRead(opened.descriptor, opened.stat, opened.candidate);
-    return content;
-  } finally {
-    fs.closeSync(opened.descriptor);
-  }
-}
-
-export function hashWorkspaceFile(repoRoot: string, repoPath: string): string {
-  const opened = openRegularFile(repoRoot, repoPath);
-  try {
-    const state = createHash("sha256");
-    const buffer = Buffer.allocUnsafe(256 * 1024);
-    let position = 0;
-    while (position < opened.stat.size) {
-      const count = fs.readSync(opened.descriptor, buffer, 0, Math.min(buffer.length, opened.stat.size - position), position);
-      if (count <= 0) throw new WorkspaceReadError("changed-during-read", "Workspace file ended during hashing");
-      state.update(buffer.subarray(0, count));
-      position += count;
-    }
-    verifyAfterRead(opened.descriptor, opened.stat, opened.candidate);
-    return state.digest("hex");
-  } finally {
-    fs.closeSync(opened.descriptor);
-  }
-}
+// Compatibility entrypoint; core and runtime share the same bounded file reader.
+export * from "../../security/workspace-file-reader.ts";

package/packages/piagent-core/runtime/model/provider-wire-fingerprint.ts

@@ -236,3 +236,23 @@ export function buildOpenAiCodexWireFingerprint(input: {
     return unavailable(modelId, error instanceof SurfaceBoundError ? error.reasonCode : "surface-not-json");
   }
 }
+
+// Measurement remains outside the signed fingerprint contract. A new telemetry
+// field must not silently change an existing signed-receipt schema.
+export function measureProviderPayload(payload: unknown) {
+  if (!record(payload)) return null;
+  try {
+    // Validate the entire payload within the existing bounds before measuring.
+    // This is the JSON at this hook, not HTTP bytes or proof of a cache hit.
+    canonicalJson(payload);
+    const serialized = JSON.stringify(payload);
+    const measured = JSON.parse(serialized);
+    const bytes = (value: unknown) => Buffer.byteLength(JSON.stringify(value) ?? "", "utf8");
+    const instructionsBytes = bytes(measured.instructions);
+    const toolsBytes = bytes(measured.tools);
+    const inputBytes = bytes(measured.input);
+    const totalBytes = Buffer.byteLength(serialized, "utf8");
+    return { basis: "hook-json-utf8" as const, instructionsBytes, toolsBytes, inputBytes,
+      remainingBytes: totalBytes - instructionsBytes - toolsBytes - inputBytes, totalBytes, cacheHit: null };
+  } catch { return null; }
+}