@piagent/platform 1.6.0 → 1.7.1

package/packages/piagent-core/runtime/workflows/task-intake.ts

@@ -1,19 +1,97 @@
 import { classifyContextTask } from "../../extensions/context-engine.js";
-import { matchesAnyPath, matchesProtectedPath, normalizePathCandidate } from "../../extensions/policy-core.js";
+import { acceptanceContractConjuncts } from "../../extensions/acceptance-contract-conjunction.js";
+import { matchesProtectedPath, normalizePathCandidate } from "../../extensions/policy-core.js";
 import type { ReviewLens } from "../../extensions/guard-types.js";
-import { LONG_INPUT_CHARS, RUNTIME_INTAKE_MESSAGE_MAX_CHARS } from "../runtime-limits.ts";
+import { LONG_INPUT_CHARS } from "../runtime-limits.ts";
+import { classifyConditionalRepairIntent } from "./task-repair-intent.ts";
+import {
+  foldChangeIntent,
+  hasChangeIntent,
+  isExplicitChangeRequest,
+  isLightweightNonAuthorizingChangeLanguage,
+  isNonAuthorizingChangeLanguage
+} from "./change-clarification.ts";
+import {
+  completedFollowupScope,
+  hasConditionalRepairIntent,
+  type PriorTaskScopeEvidence
+} from "./task-followup-policy.ts";
+export { boundedRuntimeIntakeMessage } from "./runtime-intake-compaction.ts";
+export { resolveTaskScopePatterns } from "./task-scope-resolution.ts";
+export type { TaskScopeResolution } from "./task-scope-resolution.ts";
 
 const AUTO_INTAKE_MAX_PROMPT_CHARS = LONG_INPUT_CHARS;
 const AUTO_TASK_SUMMARY_CHARS = 700;
 const AUTO_ACCEPTANCE_CRITERION_CHARS = 600;
 const AUTO_ACCEPTANCE_CRITERIA_MAX = 12;
-const AUTO_INTAKE_CHANGE_INTENT = /\b(?:add|build|change|correct|create|fix|implement|modify|refactor|remove|rename|repair|replace|update|write|sua|them|doi|cap nhat|xoa|tao)\b/i;
 const AUTO_INTAKE_READ_ONLY_LEAD = /^\s*\/?(?:analy[sz]e|audit|check|discuss|explain|inspect|plan|research|review|scout|summari[sz]e|why|how|can\s+(?:you|we)|kiem tra|nghien cuu|giai thich|danh gia)\b/i;
 const AUTO_INTAKE_MANUAL_RISK = /\b(?:credential|database|deploy|destructive|encryption|external provider|payment|permission|production|publish|secret|token rotation)\b/i;
 const AUTO_READ_ONLY_INTENT = /\b(?:analy[sz]e|audit|check|diagnos(?:e|is)|explain|inspect|investigate|plan|research|review|scout|summari[sz]e|triage|kiem tra|nghien cuu|giai thich|danh gia)\b/i;
-const AUTO_READ_ONLY_BOUNDARY = /\b(?:read-only|no edits?|do not edit(?: files?| source| project| repo)?|do not change (?:files?|source|project|repo)|do not mutate (?:files?|source|project|repo|workspace)|khong sua(?: file| source| project)?|khong edit(?: file| source| project)?|khong doi(?: file| source| project)?)\b/i;
+const AUTO_STANDALONE_NO_MUTATION = /\bwithout\s+(?:editing|changing|modifying|mutating|touching|writing)(?=\s*(?:[.!?]|$))/i;
+// Candidate wording is separated from the following qualifier. This keeps a
+// durable zero-delta instruction distinct from local path authority and from a
+// temporary "inspect first, edit later" instruction.
+const AUTO_NO_MUTATION_CANDIDATES = [
+  AUTO_STANDALONE_NO_MUTATION,
+  /\b(?:do not|don't|must not|never)\s+(?:edit|change|modify|mutate|touch|write(?:\s+to)?)(?:\s+(?:or|and)\s+create)?\s+(?:(?:any|all|the|this|entire)\s+)?(?:files?|code|source(?:\s+files?)?|project(?:\s+files?)?|workspace|repo(?:sitory)?|anything)\b/i,
+  /\b(?:do not|don't|must not|never)\s+create\s+(?:or|and)\s+(?:edit|change|modify|mutate|touch|write(?:\s+to)?)\s+(?:(?:any|all|the|this|entire)\s+)?(?:files?|code|source(?:\s+files?)?|project(?:\s+files?)?|workspace|repo(?:sitory)?|anything)\b/i,
+  /\b(?:do not|don't|must not|never)\s+make\s+(?:any\s+)?(?:changes?|edits?|mutations?)(?:\s+to\s+(?:(?:any|all|the)\s+)?(?:files?|code|source(?:\s+files?)?|project(?:\s+files?)?|workspace|repo(?:sitory)?))?\b/i,
+  /\b(?:make\s+)?no\s+(?:(?:code|source|project|file|workspace|repo(?:sitory)?)\s+)?(?:changes?|edits?|mutations?)(?:\s+to\s+(?:(?:any|all|the)\s+)?(?:files?|code|source(?:\s+files?)?|project(?:\s+files?)?|workspace|repo(?:sitory)?))?\b/i,
+  /\bno\s+(?:project|source)\s+files?\s+(?:are\s+)?(?:changed|edited|modified|mutated)\b/i,
+  /\bwithout\s+(?:editing|changing|modifying|mutating|touching|writing(?:\s+to)?)\s+(?:(?:any|all|the)\s+)?(?:files?|code|source(?:\s+files?)?|project(?:\s+files?)?|workspace|repo(?:sitory)?)\b/i,
+  /\bleave\s+(?:(?:all|the|this|entire)\s+)?(?:files?|code|source|project|workspace|repo(?:sitory)?)\s+(?:fully\s+)?(?:unchanged|unmodified)\b/i,
+  /\b(?:zero\s+task\s+delta|mutation[- ]free)\b/i,
+  /\bkh(?:o|ô)ng\s+(?:s(?:u|ử)a|edit|thay\s+(?:d|đ)(?:o|ổ)i)\s+(?:b(?:a|ấ)t\s+k(?:y|ỳ)\s+)?(?:file|source|project|workspace|repo)\b/i
+];
+const AUTO_BOUNDARY_TAIL_PREFIX = "^(?:\\s|[,.;:!?()\\[\\]{}—–-])*(?:but\\s+)?";
+const AUTO_LOCAL_BOUNDARY_TAIL = new RegExp(`${AUTO_BOUNDARY_TAIL_PREFIX}(?:outside|beyond|under|within|inside|in|on|for(?!\\s+now\\b)|except(?:\\s+for)?|other\\s+than|apart\\s+from|to\\b|only\\s+(?:(?:edit|change|modify|mutate|touch|write)\\b|(?:in|under|within|outside)\\b|(?:[a-z0-9_.@*?-]+\\/))|ngo(?:a|à)i\\b|tr(?:u|ừ)\\b)`, "i");
+const AUTO_TEMPORARY_BOUNDARY_TAIL = new RegExp(`${AUTO_BOUNDARY_TAIL_PREFIX}(?:(?:not\\s+)?yet\\b|right\\s+now\\b|for\\s+now\\b|at\\s+(?:(?:this|the\\s+current)\\s+(?:step|stage|phase|time)|the\\s+moment)\\b|during\\s+(?:(?:this|the\\s+current)\\s+)?(?:step|stage|phase|planning)\\b|while\\b|unless\\b|until\\b|before\\b|hi(?:e|ệ)n\\s+t(?:a|ạ)i\\b|b(?:a|â)y\\s+gi(?:o|ờ)\\b)`, "i");
+const AUTO_GLOBAL_NO_ACCESS_BOUNDARY = /\b(?:do not|don't|must not|never)\s+(?:read|execute|write|delete|restore|hash|echo|compare)(?:\s*,\s*(?:read|execute|write|delete|restore|hash|echo|compare)){1,6}(?:\s*,?\s*or\s+(?:read|execute|write|delete|restore|hash|echo|compare))?\s+(?:any\s+|the\s+|this\s+)?(?:project|workspace|repository|repo|audit|environment)(?:\s+or\s+(?:project|workspace|repository|repo|audit|environment))?\s+(?:content|data|files?|records?|history)\b/i;
+const AUTO_PROTECTED_ACCESS_DENIAL = /\b(?:do not|don't|must not|never)\s+(?:inspect|read|open|access|copy|print|echo|reveal|expose|export|disclose)\s+(?:(?:the|a|an|any|all|this|that|complete|raw)\s+){0,3}(?:protected(?:[- ](?:credentials?|files?|data|material|secrets?|tokens?))?|credentials?|secrets?|tokens?|passwords?|api[- ]?keys?|auth(?:entication)?(?:\s+(?:data|material|values?|tokens?))?)\b/i;
+// Some refusal prompts establish the protected object in the preceding
+// boundary sentence and then refer to it only as "the file". Admit that
+// grammar only when both halves are explicit; a generic file denial alone is
+// not protected-material authority.
+const AUTO_PROTECTED_MATERIAL_BOUNDARY_CONTEXT = /\bthis\s+request\s+crosses\s+the\s+protected[- ]material\s+boundary\b/i;
+const AUTO_GENERIC_FILE_ACCESS_DENIAL = /\b(?:do not|don't|must not|never)\s+(?:inspect|read|open|access)\s+(?:(?:the|this|that|requested|referenced|target(?:ed)?)\s+){0,2}(?:files?|paths?)\b/i;
+const AUTO_DESTRUCTIVE_HISTORY_BOUNDARY_CONTEXT = /\bthis\s+request\s+crosses\s+the\s+destructive[- ]history\s+boundary\b/i;
+const AUTO_AUDIT_LEDGER_ACCESS_DENIAL = /\b(?:do not|don't|must not|never)\s+(?:read|inspect|open|access)(?:\s*,\s*(?:truncate|delete|move|overwrite)){1,4}(?:\s*,?\s*(?:or|and)\s+(?:truncate|delete|move|overwrite))?\s+(?:the|this)\s+audit\s+(?:ledger|history|log)\b/i;
+const AUTO_REFUSAL_INTENT = /\b(?:refuse|decline|reject)\b/i;
+const AUTO_REFUSAL_NEGATION = /\b(?:do not|don't|must not|never)\s+(?:refuse|decline|reject)\b/i;
+const AUTO_GLOBAL_READ_ONLY_PATTERNS = [
+  /^\s*\/?read-only\s*(?:$|[.!?:;—–-])/im,
+  /^\s*\/?read-only\s+(?:task|run|session)\s*(?:$|[.!?:;—–-]|\b(?:to|for)\b)/im,
+  /^\s*\/?read-only\s+(?:assessment|review)\s*(?:$|[.!?:;—–-]|\b(?:of|for)\b)/im,
+  /\b(?:as|in)\s+(?:a\s+)?read-only\s+(?:mode|task|run|session|assessment|review)\b/i,
+  /\b(?:use|perform|conduct|run)\s+(?:a\s+)?read-only\s+(?:task|run|assessment|review)\b/i,
+  /\b(?:keep\s+)?(?:this\s+|the\s+)?(?:task|run|session|workspace|project|repo|repository)\s+(?:(?:is|must|should)\s+(?:be\s+|remain\s+)?|remain\s+)?read-only\b/i,
+  // A task-wide refusal may forbid every material operation without using the
+  // literal phrase "read-only" or naming a file mutation. Keep this narrow:
+  // require a compound operation list and a global project/audit data object.
+  AUTO_GLOBAL_NO_ACCESS_BOUNDARY
+];
 const AUTO_EXECUTION_INTENT = /(?:\b(?:run|execute|execution|rerun|re-run|chay)\b.{0,80}\b(?:tests?|build|checks?|gates?|lint|typecheck|package|pack|verify|verification)\b|\b(?:npm|pnpm|yarn|bun)\s+(?:test|pack|run\s+(?:build|check|lint|typecheck|verify))\b)/i;
 
+function explicitSourceWorkflow(text: string): boolean {
+  const signal = classifyContextTask(text);
+  return Boolean(signal.workflowId && signal.changeMode === "source-change");
+}
+
+/** A question about whether to mutate is conversational context, not mutation authority. */
+export function isNonAuthorizingChangeClarification(prompt: string): boolean {
+  const text = String(prompt ?? "").trim();
+  if (!text) return false;
+  if (explicitSourceWorkflow(text)) return false;
+  return isNonAuthorizingChangeLanguage(text);
+}
+
+/** Only a short yes/no-or-choice continuation may bypass repository retrieval. */
+export function isLightweightNonAuthorizingChangeContinuation(prompt: string): boolean {
+  const text = String(prompt ?? "").trim();
+  if (!text || explicitSourceWorkflow(text)) return false;
+  return isLightweightNonAuthorizingChangeLanguage(text);
+}
+
 export const AUTO_INTAKE_SNAPSHOT_PATTERNS = [
   "src/**", "app/**", "lib/**", "packages/**", "test/**", "tests/**", "spec/**", "__tests__/**"
 ];
@@ -22,6 +100,59 @@ function uniqueStrings(values: string[]): string[] {
   return [...new Set(values)];
 }
 
+// Bare "without editing." is a directive only in prose, not quoted UI text,
+// an example block, or repository data quoted by the operator.
+function boundaryDirectiveProse(text: string): string {
+  let fence: string | undefined;
+  return text.split("\n").map(line => {
+    const marker = line.match(/^\s*(`{3,}|~{3,})/);
+    if (marker) {
+      if (!fence) fence = marker[1];
+      else if (marker[1][0] === fence[0] && marker[1].length >= fence.length) fence = undefined;
+      return "<quoted-content>";
+    }
+    if (fence || /^\s*>/.test(line)) return "<quoted-content>";
+    return line.replace(/`[^`\n]*`|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|“[^”]*”|‘[^’]*’/g, "<quoted-content>");
+  }).join("\n");
+}
+
+function noMutationBoundarySignals(text: string): { taskWide: boolean; temporary: boolean } {
+  let temporary = false;
+  for (const pattern of AUTO_NO_MUTATION_CANDIDATES) {
+    const candidateText = pattern === AUTO_STANDALONE_NO_MUTATION ? boundaryDirectiveProse(text) : text;
+    const matcher = new RegExp(pattern.source, `${pattern.flags}g`);
+    for (const match of candidateText.matchAll(matcher)) {
+      const tail = candidateText.slice((match.index ?? 0) + match[0].length, (match.index ?? 0) + match[0].length + 160);
+      if (AUTO_LOCAL_BOUNDARY_TAIL.test(tail)) continue;
+      if (AUTO_TEMPORARY_BOUNDARY_TAIL.test(tail)) {
+        temporary = true;
+        continue;
+      }
+      return { taskWide: true, temporary };
+    }
+  }
+  return { taskWide: false, temporary };
+}
+
+function hasGlobalReadOnlyBoundary(text: string): boolean {
+  return AUTO_GLOBAL_READ_ONLY_PATTERNS.some((pattern) => pattern.test(text));
+}
+
+function hasGlobalNoAccessBoundary(text: string): boolean {
+  return AUTO_GLOBAL_NO_ACCESS_BOUNDARY.test(text);
+}
+
+export function hasProtectedRefusalBoundary(text: string): boolean {
+  const accessDenied = AUTO_PROTECTED_ACCESS_DENIAL.test(text)
+    || (AUTO_PROTECTED_MATERIAL_BOUNDARY_CONTEXT.test(text) && AUTO_GENERIC_FILE_ACCESS_DENIAL.test(text));
+  const directive = boundaryDirectiveProse(text);
+  return AUTO_REFUSAL_INTENT.test(text)
+    && !AUTO_REFUSAL_NEGATION.test(text)
+    && ((accessDenied && noMutationBoundarySignals(text).taskWide)
+      || (AUTO_REFUSAL_INTENT.test(directive) && AUTO_DESTRUCTIVE_HISTORY_BOUNDARY_CONTEXT.test(directive)
+        && AUTO_AUDIT_LEDGER_ACCESS_DENIAL.test(directive)));
+}
+
 const PLAUSIBLE_SCOPE_ROOT = /^(?:\.github|app|apps|bin|config|docs|examples|lib|logs|packages|pages|public|scripts|spec|src|test|tests|vendor|__tests__)(?:\/|$)/i;
 const PLAUSIBLE_SCOPE_FILE = /(?:^|\/)(?:\.[^/]+|[^/]+\.(?:bash|c|cc|cjs|cpp|css|csv|env|go|graphql|gql|h|hpp|html|java|js|json|jsx|kt|kts|md|mdx|mjs|php|proto|py|rb|rs|scss|sh|sql|svg|swift|toml|ts|tsx|txt|xml|yaml|yml))$/i;
 
@@ -34,28 +165,40 @@ function plausibleTaskScopePath(value: string): boolean {
 }
 
 export function automaticTaskSummary(prompt: string): string {
-  return String(prompt ?? "").replace(/\s+/g, " ").trim().slice(0, AUTO_TASK_SUMMARY_CHARS);
-}
-
-export function boundedRuntimeIntakeMessage(value: string): string {
-  const text = String(value ?? "").replace(/\r\n/g, "\n");
-  if (text.length <= RUNTIME_INTAKE_MESSAGE_MAX_CHARS) return text;
-  const marker = "\n\n[Piagent intake guidance compacted; the complete operator request and durable Task Contract remain authoritative.]\n\n";
-  const available = RUNTIME_INTAKE_MESSAGE_MAX_CHARS - marker.length;
-  const head = Math.floor(available * 0.58);
-  return `${text.slice(0, head).trimEnd()}${marker}${text.slice(-(available - head)).trimStart()}`;
-}
+  return String(prompt ?? "").replace(/\s+/g, " ").trim().slice(0, AUTO_TASK_SUMMARY_CHARS); }
 
 export function automaticTaskIntakeEligible(prompt: string, readProtectedPaths: string[]): boolean {
   const text = String(prompt ?? "").trim();
   if (!text || text.length > AUTO_INTAKE_MAX_PROMPT_CHARS) return false;
+  const folded = foldChangeIntent(text);
+  const explicitChange = isExplicitChangeRequest(folded);
+  if (isNonAuthorizingChangeClarification(text)) return false;
+  const noMutationBoundary = noMutationBoundarySignals(text);
+  // Verification-only execution keeps the source-task lane so the configured
+  // verifier is available, with mutation forbidden by its separate policy.
+  // For every non-execution task, a durable zero-delta boundary wins over
+  // incidental mutation verbs inside the prohibition itself.
+  if (noMutationBoundary.taskWide && !AUTO_EXECUTION_INTENT.test(folded)) return false;
+  if (noMutationBoundary.temporary && !noMutationBoundary.taskWide) return false;
+  if (hasGlobalReadOnlyBoundary(text)) return false;
   const signal = classifyContextTask(text);
-  if (AUTO_EXECUTION_INTENT.test(text)) {
+  const conditionalRepair = hasConditionalRepairIntent(text);
+  // Explicit non-execution workflows own their operation semantics; an implementation verb inside
+  // /plan, /discuss, or a git workflow must not create a source-change task early.
+  // A review that explicitly makes repair conditional on observed evidence is
+  // different: it needs verifier authority and may legitimately finish with
+  // either zero delta or a scoped repair.
+  if (signal.workflow !== "task" && !(signal.workflow === "review" && conditionalRepair)) return false;
+  if (AUTO_EXECUTION_INTENT.test(folded)) {
+    if (/\bpiagent_task_start\b/i.test(text)) return false;
+    return !signal.paths.some((candidate) => matchesProtectedPath(candidate, readProtectedPaths));
+  }
+  if (conditionalRepair) {
     if (/\bpiagent_task_start\b/i.test(text)) return false;
     return !signal.paths.some((candidate) => matchesProtectedPath(candidate, readProtectedPaths));
   }
-  if (signal.workflow !== "task" || !AUTO_INTAKE_CHANGE_INTENT.test(text)) return false;
-  if (AUTO_INTAKE_READ_ONLY_LEAD.test(text) || AUTO_INTAKE_MANUAL_RISK.test(text)) return false;
+  if (!hasChangeIntent(folded) && !explicitChange) return false;
+  if ((AUTO_INTAKE_READ_ONLY_LEAD.test(folded) && !explicitChange) || AUTO_INTAKE_MANUAL_RISK.test(folded)) return false;
   if (/\bpiagent_task_start\b/i.test(text)) return false;
   return !signal.paths.some((candidate) => matchesProtectedPath(candidate, readProtectedPaths));
 }
@@ -63,54 +206,59 @@ export function automaticTaskIntakeEligible(prompt: string, readProtectedPaths:
 export function automaticReadOnlyTaskIntakeEligible(prompt: string, readProtectedPaths: string[]): boolean {
   const text = String(prompt ?? "").trim();
   if (!text || text.length > AUTO_INTAKE_MAX_PROMPT_CHARS) return false;
+  const folded = foldChangeIntent(text);
+  if (isNonAuthorizingChangeClarification(text)) return false;
   const signal = classifyContextTask(text);
-  if (signal.workflow === "usage" || signal.workflow === "permission" || signal.workflow === "context") return false;
-  if (!AUTO_READ_ONLY_INTENT.test(text) && !AUTO_READ_ONLY_BOUNDARY.test(text)) return false;
-  if (AUTO_INTAKE_CHANGE_INTENT.test(text) && !AUTO_READ_ONLY_BOUNDARY.test(text)) return false;
+  if (["usage", "permission", "context", "discuss", "plan", "release", "onboard"].includes(signal.workflow)) return false;
+  const protectedRefusalBoundary = hasProtectedRefusalBoundary(text);
+  const readOnlyBoundary = noMutationBoundarySignals(text).taskWide || hasGlobalReadOnlyBoundary(text) || protectedRefusalBoundary;
+  if (!AUTO_READ_ONLY_INTENT.test(folded) && !readOnlyBoundary) return false;
+  if (hasChangeIntent(folded) && !readOnlyBoundary) return false;
   if (/\bpiagent_task_start\b/i.test(text)) return false;
-  return !signal.paths.some((candidate) => matchesProtectedPath(candidate, readProtectedPaths));
+  const protectedTarget = signal.paths.some((candidate) => matchesProtectedPath(candidate, readProtectedPaths));
+  return !protectedTarget || hasGlobalNoAccessBoundary(text) || protectedRefusalBoundary;
 }
 
 export function automaticTaskIntakeMode(prompt: string, readProtectedPaths: string[]): "source-change" | "read-only" | undefined {
   if (automaticTaskIntakeEligible(prompt, readProtectedPaths)) return "source-change";
-  if (automaticReadOnlyTaskIntakeEligible(prompt, readProtectedPaths)) return "read-only";
-  return undefined;
+  return automaticReadOnlyTaskIntakeEligible(prompt, readProtectedPaths) ? "read-only" : undefined;
 }
 
 export function automaticTaskMutationPolicy(
   prompt: string,
   changeMode: "source-change" | "read-only"
-): "required" | "forbidden" {
-  return changeMode === "read-only" || AUTO_READ_ONLY_BOUNDARY.test(String(prompt ?? "")) ? "forbidden" : "required";
+): "required" | "allowed" | "forbidden" {
+  const text = String(prompt ?? "");
+  // A feature can intentionally become read-only while the implementation
+  // still requires source changes. Only a task-wide boundary may suppress
+  // mutation; incidental domain wording such as "list/detail read-only" must
+  // never convert a delegated implementation into a zero-delta task.
+  if (changeMode === "read-only" || noMutationBoundarySignals(text).taskWide || hasGlobalReadOnlyBoundary(text)) {
+    return "forbidden";
+  }
+  return classifyConditionalRepairIntent(text) === "conditional-only" ? "allowed" : "required";
 }
 
 export function automaticTaskRiskLane(prompt: string): "tiny" | "normal" {
   return classifyContextTask(prompt).lane === "tiny" ? "tiny" : "normal";
 }
 
-function splitAcceptanceCriterion(value: string): string[] {
+function splitAcceptanceCriterion(value: string, grouped = false): string[] {
   const normalized = value.replace(/^\s*(?:[-*+] |\d+[.)]\s+)/, "").replace(/\s+/g, " ").trim();
-  if (!normalized || normalized.length < 8) return [];
-  const label = normalized.match(/^(\[[^\]\n]{1,40}\])\s+/)?.[1] ?? "";
-  let remaining = label ? normalized.slice(label.length).trim() : normalized;
+  if (!normalized) return [];
+  const label = grouped ? "" : normalized.match(/^(\[[^\]\n]{1,40}\])\s+/)?.[1] ?? "";
+  const body = label ? normalized.slice(label.length).trim() : normalized;
   const prefix = label ? `${label} ` : "";
   const available = AUTO_ACCEPTANCE_CRITERION_CHARS - prefix.length;
   const fragments: string[] = [];
-  while (remaining.length > available) {
-    const window = remaining.slice(0, available + 1);
-    const sentence = [...window.matchAll(/[.!?;:]\s+/g)].at(-1);
-    const clause = [...window.matchAll(/,\s+/g)].at(-1);
-    const whitespace = window.lastIndexOf(" ");
-    const preferred = sentence && sentence.index! + sentence[0].trimEnd().length >= Math.floor(available / 3)
-      ? sentence.index! + sentence[0].trimEnd().length
-      : clause && clause.index! + 1 >= Math.floor(available / 2)
-        ? clause.index! + 1
-        : whitespace;
-    const cut = preferred > 0 ? preferred : available;
-    fragments.push(`${prefix}${remaining.slice(0, cut).trim()}`);
-    remaining = remaining.slice(cut).trim();
+  const units = acceptanceContractConjuncts(body, { preserveSeparators: true })
+    .flatMap((clause) => clause.split(/(?<=[.!?])\s+(?=(?:[`"'([{]|[\p{Lu}\p{N}]|(?:do|must|never|verify)\b))/u))
+    .filter((item) => item.trim());
+  for (const unit of units) {
+    const remaining = unit.trim();
+    if (remaining.length > available) throw acceptanceCriteriaOverflow();
+    if (remaining) fragments.push(`${prefix}${remaining}`);
   }
-  if (remaining) fragments.push(`${prefix}${remaining}`);
   return fragments;
 }
 
@@ -122,76 +270,105 @@ function isPathOnlyCriterion(value: string): boolean {
   return /^(?:[A-Za-z0-9_@.-]+\/)+[A-Za-z0-9_@.-]+$/.test(normalized);
 }
 
-function evenlySpacedCriteria(values: string[], limit: number): string[] {
-  if (limit <= 0) return [];
-  if (values.length <= limit) return values;
-  if (limit === 1) return [values[values.length - 1]];
-  return Array.from({ length: limit }, (_entry, index) => (
-    values[Math.round((index * (values.length - 1)) / (limit - 1))]
-  ));
+function acceptanceCriteriaOverflow(): RangeError {
+  return new RangeError(`Automatic intake cannot retain every requirement within ${AUTO_ACCEPTANCE_CRITERIA_MAX} criteria of ${AUTO_ACCEPTANCE_CRITERION_CHARS} characters. No task was created by this intake. Use explicit bounded tasks without omitting requirements.`);
+}
+
+function groupedAcceptanceCriteria(values: string[], limit: number): string[] {
+  // Repack the source text, not a ranked sample of its obligations. Keep generic
+  // verification/safety criteria separate so they cannot stand in for user clauses.
+  // Preserve clause boundaries as line breaks: receipts require independent
+  // evidence for the whole multiline criterion, including unpunctuated bullets.
+  const groups: string[] = [];
+  let current = "";
+  for (const value of values) {
+    if (current && current.length + 1 + value.length > AUTO_ACCEPTANCE_CRITERION_CHARS) {
+      groups.push(current);
+      current = "";
+    }
+    current = current ? `${current}\n${value}` : value;
+  }
+  if (current) groups.push(current);
+  if (groups.length > limit) throw acceptanceCriteriaOverflow();
+  return groups;
+}
+
+function isStandaloneOpaqueMetadata(line: string, current: string): boolean {
+  // Preserve JSON, code, Markdown separators and punctuated exact tokens. A
+  // lone identifier-like token after a closed sentence is metadata/padding,
+  // not a criterion; the lossless operatorRequest remains the authority for it.
+  return /^[A-Za-z0-9_]+$/.test(line) && !/[.!?;:]$/.test(line)
+    && (!current || /[.!?;:]$/.test(current));
 }
 
-function boundedAcceptanceCriteria(values: string[], limit: number): string[] {
-  if (limit <= 0 || values.length === 0) return [];
-  if (values.length <= limit) return values;
-  const highSignal = /\b(?:do not|fail(?:s|ed)?(?:[-\s]+)closed|invalid|missing|must|never|reject(?:s|ed|ion)?|throws?|typeerror|without mutat(?:e|ing)|unchanged)\b/i;
-  const required = values.filter((criterion) => highSignal.test(criterion));
-  const selectedRequired = evenlySpacedCriteria(required, Math.min(limit, required.length));
-  const selected = new Set(selectedRequired);
-  const remaining = values.filter((criterion) => !selected.has(criterion));
-  for (const criterion of evenlySpacedCriteria(remaining, limit - selected.size)) selected.add(criterion);
-  return values.filter((criterion) => selected.has(criterion));
+function isStandaloneAcceptanceLabel(value: string): boolean {
+  const normalized = value.trim();
+  return /^(?:acceptance criteria|behavior|contract|constraints|expected behavior|expected output|requirements|rules|validation):$/i.test(normalized);
 }
 
 export function automaticAcceptanceCriteria(
   prompt: string,
-  changeMode: "source-change" | "read-only" = "source-change"
+  changeMode: "source-change" | "read-only" = "source-change",
+  mutationPolicy: "required" | "allowed" | "forbidden" = changeMode === "read-only" ? "forbidden" : "required"
 ): string[] {
   const lines = String(prompt ?? "").split(/\r?\n/);
-  const criteria: string[] = [];
-  const obligation = /\b(?:add|change only|do not|emits?|ensure|exactly|fail(?:s|ed)?(?:[-\s]+)closed|invalid|missing|must|never|preserve|reject|returns?|throw|without)\b/i;
+  const criterionGroups: Array<{ source: string; criteria: string[] }> = [];
   let current = "";
-  let currentIsBullet = false;
   const push = (value: string) => {
     if (isPathOnlyCriterion(value)) return;
-    criteria.push(...splitAcceptanceCriterion(value));
+    const source = value.replace(/^\s*(?:[-*+] |\d+[.)]\s+)/, "").replace(/\s+/g, " ").trim();
+    criterionGroups.push({ source, criteria: splitAcceptanceCriterion(source) });
   };
   const flush = () => {
-    if (current && (currentIsBullet || obligation.test(current))) push(current);
+    if (current) push(current);
     current = "";
-    currentIsBullet = false;
   };
-  for (const line of lines) {
+  const listItem = /^(?:[-*+] |\d+[.)]\s+)/;
+  for (const [index, line] of lines.entries()) {
     const trimmed = line.trim();
-    if (/^(?:[-*+] |\d+[.)]\s+)/.test(trimmed)) {
+    if (listItem.test(trimmed)) {
+      if (isStandaloneAcceptanceLabel(current)) {
+        current = `${current} ${trimmed.replace(listItem, "")}`;
+        continue;
+      }
       flush();
       current = trimmed;
-      currentIsBullet = true;
       continue;
     }
     if (!trimmed) {
+      const next = lines.slice(index + 1).find((candidate) => candidate.trim())?.trim() ?? "";
+      if (isStandaloneAcceptanceLabel(current) && listItem.test(next)) continue;
       flush();
       continue;
     }
+    if (isStandaloneOpaqueMetadata(trimmed, current)) continue;
     current = current ? `${current} ${trimmed}` : trimmed;
   }
   flush();
-  const generic = changeMode === "read-only"
+  const generic = changeMode === "read-only" || mutationPolicy === "forbidden"
     ? ["No project files are changed.", "The final response addresses the requested diagnostic result."]
-    : ["Changes stay within the runtime-derived task scope.", "The configured verification command passes after the final mutation."];
-  const uniqueCriteria = uniqueStrings(criteria);
-  const selected = boundedAcceptanceCriteria(uniqueCriteria, AUTO_ACCEPTANCE_CRITERIA_MAX);
-  if (selected.length === AUTO_ACCEPTANCE_CRITERIA_MAX) return selected;
-  const missingGeneric = generic.filter((criterion) => !selected.includes(criterion));
-  return [...selected, ...missingGeneric].slice(0, AUTO_ACCEPTANCE_CRITERIA_MAX);
+    : mutationPolicy === "allowed"
+      ? ["Every configured verification command passes against the final working tree."]
+      : ["The configured verification command passes after the final mutation."];
+  const limit = AUTO_ACCEPTANCE_CRITERIA_MAX - generic.length;
+  const atomic = criterionGroups.flatMap((group) => group.criteria);
+  const selected = atomic.length <= limit
+    ? atomic
+    : groupedAcceptanceCriteria(criterionGroups.flatMap((group) => splitAcceptanceCriterion(group.source, true)), AUTO_ACCEPTANCE_CRITERIA_MAX);
+  if (new Set(selected).size !== selected.length) throw acceptanceCriteriaOverflow();
+  const available = AUTO_ACCEPTANCE_CRITERIA_MAX - selected.length;
+  return [...selected, ...generic.filter((criterion) => !selected.includes(criterion)).slice(0, available)];
 }
 
 export function manualTaskIntakeEligible(prompt: string, readProtectedPaths: string[]): boolean {
   const text = String(prompt ?? "").trim();
   if (!text || text.length > LONG_INPUT_CHARS) return false;
+  const folded = foldChangeIntent(text);
+  const explicitChange = isExplicitChangeRequest(folded);
+  if (isNonAuthorizingChangeClarification(text)) return false;
   const signal = classifyContextTask(text);
-  if (signal.workflow !== "task" || !AUTO_INTAKE_CHANGE_INTENT.test(text)) return false;
-  if (AUTO_INTAKE_READ_ONLY_LEAD.test(text) || /\bpiagent_task_start\b/i.test(text)) return false;
+  if (signal.workflow !== "task" || (!hasChangeIntent(folded) && !explicitChange)) return false;
+  if ((AUTO_INTAKE_READ_ONLY_LEAD.test(folded) && !explicitChange) || /\bpiagent_task_start\b/i.test(text)) return false;
   if (signal.paths.length === 0) return true;
   return signal.paths.some((candidate) => !matchesProtectedPath(candidate, readProtectedPaths));
 }
@@ -236,97 +413,27 @@ function inferredProjectScope(prompt: string, projectFiles: string[]): string[]
     .map((item) => item.path);
 }
 
-export type TaskScopeResolution = {
-  scope: string[];
-  mappings: Array<{ from: string; to: string }>;
-  ambiguous: Array<{ input: string; candidates: string[] }>;
-  unmatched: string[];
-};
-
-const STANDARD_SCOPE_ROOT = /^(?:\.github|app|apps|bin|config|docs|examples|lib|logs|packages|pages|plans|public|scripts|services|spec|src|test|tests|vendor|__tests__)(?:\/|$)/i;
-
-function wildcardPrefix(value: string): string {
-  const index = value.search(/[*?{}\[\]]/);
-  return (index < 0 ? value : value.slice(0, index)).replace(/\/+$/, "");
-}
-
-function nestedDirectoryMatches(prefix: string, projectFiles: string[]): string[] {
-  if (!prefix) return [];
-  const segments = prefix.split("/").filter(Boolean);
-  const matches = new Set<string>();
-  for (const file of projectFiles) {
-    const parts = normalizePathCandidate(file).split("/");
-    for (let index = 0; index <= parts.length - 1 - segments.length; index += 1) {
-      if (segments.every((segment, offset) => parts[index + offset] === segment)) {
-        matches.add(parts.slice(0, index + segments.length).join("/"));
-      }
-    }
-  }
-  return [...matches].sort();
-}
-
-export function resolveTaskScopePatterns(scope: string[], projectFiles: string[]): TaskScopeResolution {
-  const files = uniqueStrings(projectFiles.map(normalizePathCandidate).filter(Boolean));
-  const resolved: string[] = [];
-  const mappings: Array<{ from: string; to: string }> = [];
-  const ambiguous: Array<{ input: string; candidates: string[] }> = [];
-  const unmatched: string[] = [];
-  for (const raw of scope) {
-    const candidate = normalizePathCandidate(raw);
-    if (!candidate) continue;
-    if (files.includes(candidate) || files.some((file) => matchesAnyPath(file, [candidate]))) {
-      resolved.push(candidate);
-      continue;
-    }
-    const hasWildcard = /[*?{}\[\]]/.test(candidate);
-    if (hasWildcard) {
-      const prefix = wildcardPrefix(candidate);
-      const directories = nestedDirectoryMatches(prefix, files);
-      if (directories.length === 1) {
-        const suffix = candidate.slice(prefix.length).replace(/^\/+/, "");
-        const canonical = suffix ? `${directories[0]}/${suffix}` : directories[0];
-        resolved.push(canonical);
-        mappings.push({ from: candidate, to: canonical });
-      } else if (directories.length > 1 && prefix && !STANDARD_SCOPE_ROOT.test(prefix)) {
-        ambiguous.push({ input: candidate, candidates: directories.slice(0, 12).map((directory) => {
-          const suffix = candidate.slice(prefix.length).replace(/^\/+/, "");
-          return suffix ? `${directory}/${suffix}` : directory;
-        }) });
-      } else if (directories.length === 0 && prefix && !prefix.includes("/") && !STANDARD_SCOPE_ROOT.test(prefix) && !raw.startsWith("./")) {
-        unmatched.push(candidate);
-      } else {
-        resolved.push(candidate);
-      }
-      continue;
-    }
-    const suffixMatches = files.filter((file) => file === candidate || file.endsWith(`/${candidate}`));
-    if (suffixMatches.length === 1) {
-      resolved.push(suffixMatches[0]);
-      mappings.push({ from: candidate, to: suffixMatches[0] });
-    } else if (suffixMatches.length > 1) {
-      ambiguous.push({ input: candidate, candidates: suffixMatches.slice(0, 12) });
-    } else if (!candidate.includes("/") && !raw.startsWith("./")) {
-      unmatched.push(candidate);
-    } else {
-      resolved.push(candidate);
-    }
-  }
-  return { scope: uniqueStrings(resolved), mappings, ambiguous, unmatched: uniqueStrings(unmatched) };
-}
-
-export function automaticTaskScope(prompt: string, context: Array<{ path: string }>, projectFiles: string[] = []): string[] {
+export function automaticTaskScope(
+  prompt: string,
+  context: Array<{ path: string }>,
+  projectFiles: string[] = [],
+  priorTask?: PriorTaskScopeEvidence
+): string[] {
   const signal = classifyContextTask(prompt);
   const explicit = signal.paths.filter(plausibleTaskScopePath);
-  const navigated = context
-    .map((item) => normalizePathCandidate(item.path))
-    .filter((candidate): candidate is string => Boolean(
-      candidate
-      && candidate !== "."
-      && !candidate.startsWith(".pi/")
-      && !["AGENTS.md", "README.md", "REVIEW_GUIDELINES.md"].includes(candidate)
-      && /^(?:app|apps|lib|packages|services|spec|src|test|tests|__tests__)\//.test(candidate)
-    ))
-    .slice(0, 8);
+  const completedTaskScope = completedFollowupScope(prompt, priorTask, plausibleTaskScopePath);
+  const navigated = completedTaskScope.length > 0
+    ? completedTaskScope
+    : context
+      .map((item) => normalizePathCandidate(item.path))
+      .filter((candidate): candidate is string => Boolean(
+        candidate
+        && candidate !== "."
+        && !candidate.startsWith(".pi/")
+        && !["AGENTS.md", "README.md", "REVIEW_GUIDELINES.md"].includes(candidate)
+        && /^(?:app|apps|lib|packages|services|spec|src|test|tests|__tests__)\//.test(candidate)
+      ))
+      .slice(0, 8);
   const inferred = explicit.length === 0 && navigated.length === 0
     ? inferredProjectScope(prompt, projectFiles)
     : [];

package/packages/piagent-core/runtime/workflows/task-repair-intent.ts

@@ -0,0 +1,67 @@
+import { LONG_INPUT_CHARS } from "../runtime-limits.ts";
+import { foldChangeIntent, isExplicitChangeRequest } from "./change-clarification.ts";
+
+const INSPECTION = /\b(?:audit|check|inspect|review|tests?|verify|verification|validate|rerun|re-run|recheck|re-check|kiem tra|ra soat|xac minh|danh gia|chay lai)\b/i;
+const REPAIR = "(?:address|change|correct(?:ing)?|edit|fix|patch|repair|resolve|update|cap nhat|chinh sua|khac phuc|sua)";
+const ACTION = "(?:add|apply|build|create|implement|modify|mutate|refactor|remove|rename|replace|write|them|tao|xoa|doi|" + REPAIR + ")";
+const PREFIX_CONDITION = /^(?:(?:please|only|chi|em|anh)\s+)*(?:if|when|neu|khi)\b/i;
+const REPAIR_LEAD = new RegExp(`^(?:(?:please|only|chi|em|anh)\\s+)*${REPAIR}\\b`, "i");
+const CONDITIONAL_REPAIR = [
+  new RegExp(`^(?:(?:please|only|chi|em|anh)\\s+)*(?:if|when|neu|khi)\\b.*\\b${REPAIR}\\b`, "i"),
+  new RegExp(`\\b${REPAIR}\\b.*\\b(?:if|when|neu|khi)\\b.*\\b(?:fail(?:s|ed|ures?|ing)?|issues?|errors?|problems?|defects?|findings?|tests?|verification|verifier|needed|necessary|required|found|detected|discovered|can|co|loi|van de)\\b`, "i"),
+  new RegExp(`\\b${REPAIR}\\b.*\\b(?:as\\s+(?:needed|necessary|required)|(?:any|all|every)\\s+(?:(?:additional|remaining|new)\\s+)?(?:failures?|issues?|errors?|problems?|defects?|findings?)|whatever\\s+fails|(?:failures?|issues?|errors?|problems?|defects?|findings?)\\s+(?:(?:(?:if|when)\\s+)?(?:found|detected|discovered)|if\\s+any|(?:you|we)\\s+find)|loi|van de)\\b`, "i"),
+  new RegExp(`\\b${REPAIR}\\b\\s+(?:(?:any|all|every)\\s+)?(?:failures?|issues?|errors?|problems?|defects?|findings?|failing\\s+tests?)\\b`, "i")
+];
+const DIRECTIVE_PREFIX = "(?:(?:you|we|the task|your task)\\s+(?:must|need to|have to)|(?:can|could|would|will)\\s+you|i\\s+(?:need|want)\\s+you\\s+to|(?:em|anh)\\s+(?:phai|can)|must|please|only|chi|em|anh|also|always|still|regardless|in any case|bat buoc)";
+const DIRECTIVE_LEAD = new RegExp(`^(?:${DIRECTIVE_PREFIX}\\b[,;:]?\\s+)*`, "i");
+const ACTION_SEPARATOR = new RegExp(`(?:,\\s*|\\b(?:and|then|but|va|roi|nhung|sau do)\\s+)(?=(?:${DIRECTIVE_PREFIX}\\b[,;:]?\\s+)*${ACTION}\\b)`, "i");
+const NEGATED_REPAIR = /\b(?:do not|don't|must not|never|khong|dung)\s+(?:ever\s+)?(?:fix|repair|edit|change|update|sua|chinh sua|cap nhat)\b/i;
+
+// Examples, quoted data and fenced snippets cannot make an otherwise required
+// implementation optional. Keep line boundaries while masking literal text.
+function instructionText(text: string): string {
+  let quote = "", escaped = false, result = "";
+  for (let index = 0; index < text.length; index++) {
+    const character = text[index];
+    if (quote) {
+      result += character === "\n" ? "\n" : " ";
+      if (character === quote && !escaped) quote = "";
+      escaped = character === "\\" && !escaped;
+      continue;
+    }
+    const apostrophe = character === "'" && /[\p{L}\p{N}]/u.test(text[index - 1] ?? "") && /[\p{L}\p{N}]/u.test(text[index + 1] ?? "");
+    if ((character === "`" || character === '"' || character === "'") && !apostrophe) { quote = character; escaped = false; result += " "; }
+    else result += character;
+  }
+  return result.replace(/^\s*>[^\n]*$/gm, "");
+}
+
+export type ConditionalRepairIntent = "none" | "conditional-only" | "mixed";
+
+/** Linguistic evidence only: task scope, approval and observed failures still gate writes. */
+export function classifyConditionalRepairIntent(text: string): ConditionalRepairIntent {
+  if (text.length > LONG_INPUT_CHARS) return "none";
+  const visible = foldChangeIntent(instructionText(text));
+  if (!INSPECTION.test(visible)) return "none";
+  let conditional = false, unconditional = false;
+  const statements = visible.split(/(?<=[.!?;:])\s+|\n+|\b(?:but|however|nevertheless|nhung|tuy nhien)\b[,:]?\s*|(?:,|\b(?:and|then|va|roi)\b)\s*(?=(?:if|when|neu|khi)\b)/)
+    .map((part) => part.replace(/^\s*(?:[-*+]\s+|\d+[.)]\s+)/, "").trim()).filter(Boolean);
+  for (const statement of statements) {
+    if (PREFIX_CONDITION.test(statement) && CONDITIONAL_REPAIR.some((pattern) => pattern.test(statement)) && !NEGATED_REPAIR.test(statement)) {
+      conditional = true;
+      continue;
+    }
+    for (const clause of statement.split(ACTION_SEPARATOR)) {
+      const directive = clause.trim().replace(DIRECTIVE_LEAD, "");
+      const repairCommand = REPAIR_LEAD.test(directive);
+      const imperative = repairCommand || isExplicitChangeRequest(directive);
+      if (!imperative && NEGATED_REPAIR.test(clause)) continue;
+      // Qualify the repair command itself, not a repair word inside the
+      // description of a different mandatory implementation command.
+      const qualified = repairCommand && CONDITIONAL_REPAIR.some((pattern) => pattern.test(clause));
+      if (qualified) conditional = true;
+      else if (imperative) unconditional = true;
+    }
+  }
+  return !conditional ? "none" : unconditional ? "mixed" : "conditional-only";
+}