atom-agent 1.2.0 → 1.3.0

package/dist/goal.js

@@ -0,0 +1,583 @@
+import { toolSignature } from "./agent/normalize.js";
+// Declared-unverifiable checks on a `complete` report (ticket 06): checks
+// the model could not run, recorded openly in the closing verdict — never a
+// gate (they do not block completion). Bounded so a report stays a short
+// transcript line, never a pasted log.
+export const GOAL_UNVERIFIED_MAX_ITEMS = 10;
+export const GOAL_UNVERIFIED_MAX_LENGTH = 200;
+// Expected update_goal shape for validation details (mirrors the registry's
+// expectedShape framing — the tool definition itself lives in src/tools.ts).
+const UPDATE_GOAL_EXPECTED = `{"status": "continue" | "complete" | "blocked", "next"?: string, "reason"?: string, "unverified"?: string[]}`;
+// Arg validation for update_goal (same detail-string contract as the
+// registry validators — the loop wraps it with invalidCall, so bad args are
+// a model mistake that records nothing). `continue` takes an optional
+// non-empty next action; `complete`/`blocked` require a non-empty reason.
+// `complete` also takes an optional `unverified` list of checks the model
+// could not run (non-empty strings, capped in count and length — recorded
+// openly in the verdict, never a gate). Unknown fields are ignored (same
+// leniency as the registry validators).
+export function validateUpdateGoalArgs(args) {
+    if (typeof args !== "object" || args === null || Array.isArray(args)) {
+        return `arguments for tool "update_goal" must be an object. Expected ${UPDATE_GOAL_EXPECTED}`;
+    }
+    const a = args;
+    const status = a["status"];
+    if (status !== "continue" && status !== "complete" && status !== "blocked") {
+        return (`field "status" for tool "update_goal" must be one of "continue", "complete", "blocked" ` +
+            `(got ${JSON.stringify(status) ?? String(status)}). Expected ${UPDATE_GOAL_EXPECTED}`);
+    }
+    if (status === "continue") {
+        const next = a["next"];
+        if (next !== undefined && (typeof next !== "string" || next.trim().length === 0)) {
+            return (`field "next" for tool "update_goal" must be a non-empty string when present ` +
+                `(got ${JSON.stringify(next) ?? String(next)}). Expected ${UPDATE_GOAL_EXPECTED}`);
+        }
+        return null;
+    }
+    const reason = a["reason"];
+    if (typeof reason !== "string" || reason.trim().length === 0) {
+        return (`field "reason" for tool "update_goal" with status "${status}" must be a non-empty string. ` +
+            `Expected ${UPDATE_GOAL_EXPECTED}`);
+    }
+    if (status === "complete") {
+        const unverified = a["unverified"];
+        if (unverified !== undefined) {
+            if (!Array.isArray(unverified)) {
+                return (`field "unverified" for tool "update_goal" must be an array of non-empty strings ` +
+                    `when present. Expected ${UPDATE_GOAL_EXPECTED}`);
+            }
+            if (unverified.length > GOAL_UNVERIFIED_MAX_ITEMS) {
+                return (`field "unverified" for tool "update_goal" must hold at most ` +
+                    `${GOAL_UNVERIFIED_MAX_ITEMS} items (got ${unverified.length}). Expected ${UPDATE_GOAL_EXPECTED}`);
+            }
+            for (const item of unverified) {
+                if (typeof item !== "string" || item.trim().length === 0) {
+                    return (`field "unverified" for tool "update_goal" must be an array of non-empty strings. ` +
+                        `Expected ${UPDATE_GOAL_EXPECTED}`);
+                }
+                if (item.trim().length > GOAL_UNVERIFIED_MAX_LENGTH) {
+                    return (`field "unverified" for tool "update_goal" must hold items of at most ` +
+                        `${GOAL_UNVERIFIED_MAX_LENGTH} characters. Expected ${UPDATE_GOAL_EXPECTED}`);
+                }
+            }
+        }
+    }
+    return null;
+}
+// Build the typed disposition from validated args (call only after
+// validateUpdateGoalArgs returns null — anything else is a caller bug, and
+// the unknown-status fallthrough below keeps it total rather than throwing).
+export function updateGoalDisposition(args) {
+    const a = args;
+    if (a.status === "continue") {
+        return typeof a.next === "string" ? { status: "continue", next: a.next } : { status: "continue" };
+    }
+    if (a.status === "complete") {
+        const reason = a.reason;
+        // Defensive carry: validation already capped count/length, but the
+        // builder stays total on unvalidated input (judge verdicts, direct
+        // callers) — trim, drop empties, cap, and omit when nothing remains.
+        const raw = a.unverified;
+        if (Array.isArray(raw)) {
+            const items = raw
+                .filter((s) => typeof s === "string")
+                .map((s) => s.trim())
+                .filter((s) => s.length > 0)
+                .slice(0, GOAL_UNVERIFIED_MAX_ITEMS);
+            if (items.length > 0)
+                return { status: "complete", reason, unverified: items };
+        }
+        return { status: "complete", reason };
+    }
+    if (a.status === "blocked") {
+        return { status: "blocked", reason: a.reason };
+    }
+    return { status: "continue" };
+}
+// Same-value comparison for idempotence (absent next counts as empty —
+// `{continue}` and `{continue, next:""}` can never both be valid anyway).
+export function sameGoalDisposition(a, b) {
+    if (a.status === "continue" && b.status === "continue") {
+        return (a.next ?? "") === (b.next ?? "");
+    }
+    if (a.status === "complete" && b.status === "complete") {
+        if (a.reason !== b.reason)
+            return false;
+        const au = a.unverified ?? [];
+        const bu = b.unverified ?? [];
+        return au.length === bu.length && au.every((s, i) => s === bu[i]);
+    }
+    if (a.status === "blocked" && b.status === "blocked") {
+        return a.reason === b.reason;
+    }
+    return false;
+}
+// Terminal verdict (ticket 03): the run's final text AND the pause notice —
+// same `(…)` voice as the stop notices, carrying the model's reason. A
+// `complete` may also carry declared-unverifiable checks (ticket 06): they
+// print openly as a trailing `(unverified: …)` segment — recorded, never
+// gated. Total: unvalidated input degrades to the bare verdict.
+export function goalVerdictNotice(objective, status, reason, unverified) {
+    const base = `(goal ${status} — "${objective}": ${reason})`;
+    if (status !== "complete" || !Array.isArray(unverified))
+        return base;
+    const items = unverified
+        .filter((s) => typeof s === "string")
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0)
+        .slice(0, GOAL_UNVERIFIED_MAX_ITEMS);
+    if (items.length === 0)
+        return base;
+    return `${base} (unverified: ${items.join(", ")})`;
+}
+// Success ack for a recorded report (a transcript-visible receipt —
+// deliberately not an Error, so it never trips failure accounting).
+export function goalReportAck(disposition) {
+    switch (disposition.status) {
+        case "continue":
+            return disposition.next !== undefined
+                ? `(goal report recorded — "continue": ${disposition.next})`
+                : `(goal report recorded — "continue")`;
+        case "complete":
+            return `(goal report recorded — "complete": ${disposition.reason})`;
+        case "blocked":
+            return `(goal report recorded — "blocked": ${disposition.reason})`;
+    }
+}
+// Post-terminal rejection (ticket 03): the first terminal report sticks —
+// anything after it changes nothing and reads as a notice (not an Error,
+// so failure accounting stays quiet).
+export function goalReportRejectedNotice(existing) {
+    return (`(update_goal already reported "${existing.status}" for this turn — ` +
+        `keeping the first report; further reports change nothing)`);
+}
+// Outside-goal structured error (ticket 03): with no live goal turn there is
+// nothing to record into, so the call changes zero state — the Error:
+// framing keeps it repairable, never silent.
+export function goalReportOutsideError() {
+    return (`Error: update_goal is only available during an active goal turn ` +
+        `(no active goal — set one with /goal <objective>). Nothing was recorded.`);
+}
+// Pure arg parser: bare `/goal` (or whitespace-only) shows status,
+// `/goal clear` / `/goal pause` / `/goal resume` (case-insensitive) manage
+// the goal, everything else after `/goal ` is the objective verbatim (case
+// preserved — it echoes back). A literal objective of "pause"/"resume"/
+// "clear" reads as the command (same pre-existing ambiguity as "clear").
+export function parseGoalCommand(raw) {
+    const text = raw.trim();
+    const rest = text === "/goal" ? "" : text.slice("/goal".length).trim();
+    if (rest === "")
+        return { kind: "status" };
+    const lowered = rest.toLowerCase();
+    if (lowered === "clear")
+        return { kind: "clear" };
+    if (lowered === "pause")
+        return { kind: "pause" };
+    if (lowered === "resume")
+        return { kind: "resume" };
+    return { kind: "set", objective: rest };
+}
+// Zero stats for a fresh goal (a set/replace always resets the counters).
+export function emptyGoalStats() {
+    return { turns: 0, requests: 0, tokens: 0, workMs: 0 };
+}
+// Read view: absent stats (ticket-01 literals) count as zeros — never throw.
+export function goalStatsOf(goal) {
+    const s = goal?.stats;
+    return {
+        turns: s?.turns ?? 0,
+        requests: s?.requests ?? 0,
+        tokens: s?.tokens ?? 0,
+        workMs: s?.workMs ?? 0,
+    };
+}
+// Token slice for one reported usage payload: total_tokens when the API
+// sent it, else prompt + completion. Anything unreported counts as zero —
+// goal spend, like session spend, is real reports only, never estimated.
+export function goalTokensForUsage(u) {
+    const total = u.total_tokens;
+    if (typeof total === "number" && Number.isFinite(total))
+        return Math.max(0, Math.floor(total));
+    const prompt = typeof u.prompt_tokens === "number" && Number.isFinite(u.prompt_tokens) ? u.prompt_tokens : 0;
+    const completion = typeof u.completion_tokens === "number" && Number.isFinite(u.completion_tokens)
+        ? u.completion_tokens
+        : 0;
+    return Math.max(0, Math.floor(prompt) + Math.floor(completion));
+}
+// Serialize the live goal for a session save: a deep copy (the save must
+// never alias live state), or null when no goal is live. Total: never throws.
+export function serializeGoalForPersist(goal) {
+    try {
+        if (!goal)
+            return null;
+        if (typeof goal.objective !== "string" || goal.objective.length === 0)
+            return null;
+        const s = goal.stats ?? emptyGoalStats();
+        return {
+            objective: goal.objective,
+            active: goal.active === true,
+            stats: {
+                turns: coerceGoalCounter(s.turns),
+                requests: coerceGoalCounter(s.requests),
+                tokens: coerceGoalCounter(s.tokens),
+                workMs: coerceGoalCounter(s.workMs),
+            },
+        };
+    }
+    catch {
+        return null;
+    }
+}
+// Restore a saved goal: valid records come back verbatim (counters intact,
+// never reset); absent or corrupt data loads as no-goal (null) — never a
+// throw, at most the caller's warning. Old saves without a goal key and
+// records with a trashed stats block both land here safely.
+export function restoreGoalFromPersist(value) {
+    try {
+        if (value === null || value === undefined)
+            return null;
+        if (typeof value !== "object" || Array.isArray(value))
+            return null;
+        const r = value;
+        if (typeof r["objective"] !== "string" || r["objective"].length === 0)
+            return null;
+        if (typeof r["active"] !== "boolean")
+            return null;
+        const stats = r["stats"];
+        if (stats === undefined)
+            return { objective: r["objective"], active: r["active"] };
+        if (typeof stats !== "object" || stats === null || Array.isArray(stats))
+            return null;
+        const s = stats;
+        return {
+            objective: r["objective"],
+            active: r["active"],
+            stats: {
+                turns: coerceGoalCounter(s["turns"]),
+                requests: coerceGoalCounter(s["requests"]),
+                tokens: coerceGoalCounter(s["tokens"]),
+                workMs: coerceGoalCounter(s["workMs"]),
+            },
+        };
+    }
+    catch {
+        return null;
+    }
+}
+// One counter from untrusted save data: finite, floored, never negative —
+// anything else reads as zero (a trashed counter must not trash the goal).
+function coerceGoalCounter(value) {
+    return typeof value === "number" && Number.isFinite(value) && value > 0
+        ? Math.floor(value)
+        : 0;
+}
+// Compact counters for status lines: raw below 1K, one-decimal K above.
+export function formatGoalTokens(n) {
+    if (typeof n !== "number" || !Number.isFinite(n) || n <= 0)
+        return "0";
+    const v = Math.floor(n);
+    if (v < 1000)
+        return `${v}`;
+    return `${(v / 1000).toFixed(1)}K`;
+}
+// Wall-clock rendering for status lines: 4s / 1m23s / 2h05m. Never throws.
+export function formatGoalWorkMs(ms) {
+    if (typeof ms !== "number" || !Number.isFinite(ms) || ms <= 0)
+        return "0s";
+    const s = Math.floor(ms / 1000);
+    if (s < 60)
+        return `${s}s`;
+    const m = Math.floor(s / 60);
+    if (m < 60)
+        return `${m}m${s % 60}s`;
+    return `${Math.floor(m / 60)}h${m % 60}m`;
+}
+// Stats segment for the status line (zeros when absent — a fresh goal still
+// shows the shape so the counters are discoverable).
+export function goalStatsText(stats) {
+    const s = stats ?? emptyGoalStats();
+    return (`turns ${s.turns} · requests ${s.requests} · ` +
+        `tokens ${formatGoalTokens(s.tokens)} · work ${formatGoalWorkMs(s.workMs)}`);
+}
+// Status line: goal text plus state plus cumulative stats, or the none-hint.
+export function goalStatusText(goal) {
+    if (!goal)
+        return "(no goal — set one with /goal <objective>)";
+    return `(goal [${goal.active ? "active" : "paused"}] — ${goal.objective} — ${goalStatsText(goal.stats)})`;
+}
+// Set confirmation: echoes the objective; replacing an active goal says so.
+export function goalSetNotice(objective, previous) {
+    if (previous)
+        return `(goal replaced — "${previous.objective}" replaced with "${objective}")`;
+    return `(goal set — "${objective}")`;
+}
+// Clear notice: ends the active goal, or a harmless no-op when absent.
+export function goalClearNotice(previous) {
+    if (!previous)
+        return "(no goal — nothing to clear)";
+    return `(goal cleared — "${previous.objective}")`;
+}
+// Manual pause/resume notices: state flips live in App; these only describe.
+export function goalPauseNotice(previous) {
+    if (!previous)
+        return "(no goal — nothing to pause)";
+    if (!previous.active)
+        return `(goal already paused — "${previous.objective}")`;
+    return `(goal paused — "${previous.objective}")`;
+}
+export function goalResumeNotice(previous) {
+    if (!previous)
+        return "(no goal — set one with /goal <objective>)";
+    if (previous.active)
+        return `(goal already active — "${previous.objective}")`;
+    return `(goal resumed — "${previous.objective}")`;
+}
+// Auto-continue follow-up (tickets 02–03): the ONLY continuation message
+// the goal seam pushes — same assistant+user commit shape as the turn-end
+// guards, so assistant/tool pairing stays valid and the transcript shows
+// each turn normally (no synthetic user input beyond this mechanism). It
+// also carries the report protocol (the only model-visible channel for the
+// goal-scoped update_goal tool — the tool-schema payload wiring arrives in
+// a later ticket): the model reports each turn's outcome, and a turn with
+// no report counts as `continue` until the ticket-04 evaluator lands.
+export function goalFollowUp(objective) {
+    return (`(goal continues: "${objective}" — keep working toward the goal with ` +
+        `tool calls, or answer in text when there is nothing left to do. ` +
+        `Final text starts the next goal turn automatically; the goal runs ` +
+        `until it is paused or cleared. Report the turn outcome with the ` +
+        `update_goal tool (status "continue" with the next action, or ` +
+        `"complete"/"blocked" with a reason); a turn with no report continues ` +
+        `the goal.)`);
+}
+// Pause-with-preservation notice for cancel/budget paths: names the reason,
+// keeps the objective quoted, and points at /goal resume. The goal itself
+// is never cleared here — pausing only flips `active`.
+export function goalPausedNotice(objective, reason) {
+    return `(goal paused — "${objective}" preserved ${reason}; resume with /goal resume)`;
+}
+// Judge tail (ticket 04): the evaluator sees the goal text plus the recent
+// turns only — never the full history. 20 messages covers a few turns of
+// tool traffic without bloating the judge POST.
+export const GOAL_JUDGE_TAIL_MESSAGES = 20;
+// Slice the recent transcript tail for the judge (read-only — the caller
+// shares the message objects, and the judge must never mutate them).
+export function recentTurnsForJudge(history) {
+    if (!Array.isArray(history))
+        return [];
+    return history.slice(-GOAL_JUDGE_TAIL_MESSAGES);
+}
+// Strict-but-tolerant judge-verdict parsing (ticket 04): the judge must
+// answer with one JSON verdict object; anything else (prose, empty text, a
+// bad shape, failed validation) counts as unclear → null → the loop pauses
+// instead of looping. Code fences are tolerated (the slice runs from the
+// first `{` to the last `}`); single-object only. An empty `next` on
+// `continue` reads as absent (still a clear verdict — the generic follow-up
+// covers it); everything else validates exactly like update_goal args.
+export function parseGoalJudgeVerdict(text) {
+    if (typeof text !== "string")
+        return null;
+    const start = text.indexOf("{");
+    const end = text.lastIndexOf("}");
+    const candidate = start >= 0 && end > start ? text.slice(start, end + 1) : text;
+    let parsed;
+    try {
+        parsed = JSON.parse(candidate);
+    }
+    catch {
+        return null;
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+        return null;
+    const args = { ...parsed };
+    if (args["status"] === "continue" &&
+        typeof args["next"] === "string" &&
+        args["next"].trim().length === 0) {
+        delete args["next"];
+    }
+    if (validateUpdateGoalArgs(args) !== null)
+        return null;
+    const disposition = updateGoalDisposition(args);
+    // Trim payloads so a padded verdict prints clean (validation already
+    // guaranteed the required fields are non-empty).
+    if (disposition.status === "continue" && typeof disposition.next === "string") {
+        return { status: "continue", next: disposition.next.trim() };
+    }
+    if (disposition.status === "complete" || disposition.status === "blocked") {
+        return { status: disposition.status, reason: disposition.reason.trim() };
+    }
+    return disposition;
+}
+// Novelty progress guard (ticket 05): the goal measures real forward motion,
+// not motion. Every committed tool result fingerprints to name + stable args
+// + result; an exact repeat (fingerprint already seen) advances nothing,
+// while genuinely new evidence bumps the novel count and resets the stall
+// streak. Error results never count — the error-streak machinery owns those.
+// When the streak reaches GOAL_STALL_REPEATS at a goal turn end, the loop
+// pushes the replan nudge as the next follow-up and resets the epoch —
+// stalling never pauses, clears, or ends the goal. Loop-local only: a whole
+// goal run normally lives inside one runLoopWithChat call, so the seen-set
+// never leaves the turn (a later ticket can expose it if App/telemetry ever
+// needs it).
+// Consecutive non-novel commits before the replan nudge fires: 3. One repeat
+// is often a legit retry (truncation repair, parallel re-fetch) and two can
+// be coincidence; three identical results is a loop. It also mirrors the
+// other turn-end guards (MAX_VERIFY_ROUNDS / MAX_TODO_ROUNDS = 3, error-streak
+// default 3), so every guard agrees on what "sustained" means.
+export const GOAL_STALL_REPEATS = 3;
+// Upper bound on retained fingerprints: runs are budget-bounded, but the
+// default budgets are uncapped, so the set never grows without limit. Past
+// the cap an unseen key still counts as novel (the safe direction — progress
+// over stall) without being stored.
+export const GOAL_PROGRESS_SEEN_CAP = 5000;
+// Fresh per-run progress memory (the loop owns one per runLoopWithChat call).
+export function emptyGoalProgress() {
+    return { seen: new Set(), novel: 0, stale: 0 };
+}
+// FNV-1a (32-bit, non-crypto): small, dependency-free, and total — never
+// throws, so accounting can never break the turn.
+function goalFingerprintHash(text) {
+    let hash = 0x811c9dc5;
+    for (let i = 0; i < text.length; i++) {
+        hash ^= text.charCodeAt(i);
+        hash = Math.imul(hash, 0x01000193);
+    }
+    return (hash >>> 0).toString(16);
+}
+// Bounded novelty key: name + stable args (via toolSignature, so key order
+// never aliases) + full result, hashed — the set keeps ~40 chars per entry,
+// never result text. Total: never throws (unstringifiable args fall back
+// inside toolSignature; anything else degrades to a length-only key).
+export function goalProgressFingerprint(name, parsed, result) {
+    const tool = typeof name === "string" ? name : "(unknown)";
+    const body = typeof result === "string" ? result : "";
+    let argsKey;
+    try {
+        argsKey = toolSignature(tool, parsed ?? {});
+    }
+    catch {
+        argsKey = `${tool} {}`;
+    }
+    return `${tool}#${goalFingerprintHash(`${argsKey}\n${body}`)}:${body.length}`;
+}
+// Record one committed result: errors are ignored (owned by the error-streak
+// machinery — they neither advance nor stall progress); a repeat bumps the
+// streak; anything new bumps the novel count and resets the streak. Returns
+// true when the commit advanced progress. Total: never throws.
+export function noteGoalProgress(state, name, parsed, result, isError) {
+    try {
+        if (!state || isError)
+            return false;
+        const key = goalProgressFingerprint(name, parsed, result);
+        if (state.seen.has(key)) {
+            state.stale += 1;
+            return false;
+        }
+        if (state.seen.size < GOAL_PROGRESS_SEEN_CAP)
+            state.seen.add(key);
+        state.novel += 1;
+        state.stale = 0;
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// The stall redirect fires when the streak reaches the threshold (never
+// earlier — a partial streak is still a working run). Total: never throws.
+export function goalStallReached(state) {
+    try {
+        return (state?.stale ?? 0) >= GOAL_STALL_REPEATS;
+    }
+    catch {
+        return false;
+    }
+}
+// Reset the stall epoch after the nudge fires (the seen-set stays — continued
+// repeats keep reading as repeats, so a stuck run nudges again instead of
+// going quiet). Total: never throws.
+export function resetGoalStall(state) {
+    try {
+        if (state)
+            state.stale = 0;
+    }
+    catch {
+        // accounting never breaks the turn
+    }
+}
+// Replan nudge (ticket 05): the stall-epoch follow-up — same `(…)` notice
+// voice as the other turn-end gates, naming the objective and the repeat
+// count so the redirect is auditable in the transcript. Total: never throws.
+export function goalStallNudge(objective, repeats) {
+    try {
+        const goal = typeof objective === "string" && objective.length > 0 ? objective : "(unknown)";
+        const count = typeof repeats === "number" && Number.isFinite(repeats) && repeats > 0
+            ? Math.floor(repeats)
+            : GOAL_STALL_REPEATS;
+        return (`(goal stalled — "${goal}": the last ${count} tool results repeated earlier work ` +
+            `with nothing new. Replan: try a different approach, file, or check instead of ` +
+            `repeating the same calls. The goal stays active — keep working toward it.)`);
+    }
+    catch {
+        return `(goal stalled — replanning needed; the goal stays active.)`;
+    }
+}
+// Compacted-summary goal block (ticket 08): the canonical `Goal:` text that
+// rides inside the compaction summary, following the `Touched files:`
+// precedent — appended to the model summary within budget, surfaced verbatim
+// on resume. It carries the objective verbatim (never trimmed — user text),
+// the live state flag (active vs paused — a paused goal still resumes), and
+// the cumulative stats (never reset by compaction), plus the open checklist
+// lines (pending/in_progress only — completed work belongs in the summary
+// prose the instruction already asks the summarizer to preserve). The block
+// is the model's context backstop only: record restore (ticket 07) stays the
+// restore path, so nothing here needs machine-parsing — it just has to read
+// unambiguously. Total: never throws; no goal renders "" (caller appends
+// nothing, keeping non-goal output byte-identical).
+// Upper bounds for the checklist tail: the block rides with the model text
+// (never shrunk by the budget fitter — only the touched-files lists shrink),
+// so it stays bounded on its own. 10 lines mirrors
+// GOAL_UNVERIFIED_MAX_ITEMS; 120 chars keeps one line scannable.
+export const GOAL_COMPACT_TODOS_MAX = 10;
+export const GOAL_COMPACT_TODO_CHARS = 120;
+export function formatGoalForCompact(goal, todos) {
+    try {
+        if (!goal)
+            return "";
+        if (typeof goal.objective !== "string" || goal.objective.length === 0)
+            return "";
+        const lines = [
+            `Goal: "${goal.objective}" [${goal.active ? "active" : "paused"}] (${goalStatsText(goal.stats)})`,
+        ];
+        if (Array.isArray(todos)) {
+            const open = [];
+            for (const t of todos) {
+                if (open.length >= GOAL_COMPACT_TODOS_MAX)
+                    break;
+                if (!t || typeof t.content !== "string" || typeof t.status !== "string")
+                    continue;
+                if (t.status === "completed")
+                    continue;
+                const content = t.content.trim();
+                if (content.length === 0)
+                    continue;
+                const short = content.length > GOAL_COMPACT_TODO_CHARS
+                    ? `${content.slice(0, GOAL_COMPACT_TODO_CHARS)}…`
+                    : content;
+                open.push(`[${t.status}] ${short}`);
+            }
+            if (open.length > 0)
+                lines.push(`Goal todos: ${open.join("; ")}`);
+        }
+        return lines.join("\n");
+    }
+    catch {
+        return "";
+    }
+}
+// Append the goal block to a summary (mirrors appendTouchedFiles — empty
+// renders the summary untouched).
+export function appendGoalBlock(summaryText, goalBlock) {
+    if (typeof goalBlock !== "string" || goalBlock.length === 0)
+        return summaryText;
+    return `${summaryText}\n\n${goalBlock}`;
+}

package/dist/project-trust.js

@@ -0,0 +1,96 @@
+// Project trust for extensions (ticket 07): project-scope extensions run
+// unsandboxed with full user privileges, so they never execute until the
+// user trusts the project. Global-scope extensions are user-owned
+// (implicitly trusted, like the user's own config); the gate applies to
+// project-scope + explicit paths only.
+//
+// The grant is durable per project directory (asked once): grants live in
+// ~/.atom/trusted-projects.json (a plain JSON array of absolute dir paths,
+// following the auth.json load-never-throws pattern). A decline persists
+// nothing, so the next boot asks again — declining leaves project extensions
+// fully inert for this session with a visible notice, never silently loaded.
+// Session tool trust (/trust in App.tsx) is a separate, in-memory tier for
+// write/edit/bash approval — this file is only about extension loading.
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import * as path from "node:path";
+import { atomDir } from "./auth.js";
+export const TRUSTED_PROJECTS_FILENAME = "trusted-projects.json";
+// Canonical trust prompt (single source so App and tests share the exact
+// wording): states plainly that extensions run unsandboxed with full user
+// privileges. The acceptance criterion pins on these words.
+export function projectTrustQuestion(names) {
+    const list = names.length > 0 ? ` (${names.join(", ")})` : "";
+    return (`This project contains ${names.length} extension(s)${list} that run unsandboxed ` +
+        `with your full user privileges — they can read/write your files and run commands as you. ` +
+        `Load them?`);
+}
+export function trustedProjectsFilePath(home) {
+    return path.join(atomDir(home), TRUSTED_PROJECTS_FILENAME);
+}
+function normalizeDir(dir) {
+    return path.resolve(dir);
+}
+// Load granted project dirs; missing/corrupt files yield [] (never throws —
+// a missing grant file is the normal first-run case).
+export function loadTrustedProjects(home) {
+    let raw;
+    try {
+        const p = trustedProjectsFilePath(home);
+        if (!existsSync(p))
+            return [];
+        raw = readFileSync(p, "utf8");
+    }
+    catch {
+        return [];
+    }
+    let data;
+    try {
+        data = JSON.parse(raw);
+    }
+    catch {
+        return [];
+    }
+    if (!Array.isArray(data))
+        return [];
+    const out = [];
+    for (const e of data) {
+        if (typeof e === "string" && e.length > 0) {
+            const abs = normalizeDir(e);
+            if (!out.includes(abs))
+                out.push(abs);
+        }
+    }
+    return out;
+}
+export function isProjectTrusted(dir, home) {
+    return loadTrustedProjects(home).includes(normalizeDir(dir));
+}
+function saveTrustedProjects(dirs, home) {
+    const dir = atomDir(home);
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(path.join(dir, TRUSTED_PROJECTS_FILENAME), JSON.stringify([...dirs].sort(), null, 2) + "\n", "utf8");
+}
+// Persist a grant (never throws — disk errors leave trust ungranted, so the
+// next boot asks again rather than assuming consent).
+export function grantProjectTrust(dir, home) {
+    try {
+        const abs = normalizeDir(dir);
+        const current = loadTrustedProjects(home);
+        if (current.includes(abs))
+            return;
+        saveTrustedProjects([...current, abs], home);
+    }
+    catch {
+        // best-effort only; trust stays ungranted
+    }
+}
+// Remove a grant (never throws).
+export function revokeProjectTrust(dir, home) {
+    try {
+        const abs = normalizeDir(dir);
+        saveTrustedProjects(loadTrustedProjects(home).filter((d) => d !== abs), home);
+    }
+    catch {
+        // best-effort only
+    }
+}