codecartographer-pi 0.18.0 → 0.19.1

package/dist/core/coverage.d.ts

@@ -0,0 +1,45 @@
+import type { WorkspaceState } from "./types.ts";
+/** The section heading whose bullets this module reads. */
+export declare const COVERAGE_SECTION_HEADING = "Coverage and limits";
+/** The ledger's five fixed bullets, verbatim values with the label stripped. */
+export type CoverageLedger = {
+    inspected_scope: string;
+    skipped_scope: string;
+    evidence_basis: string;
+    known_blind_spots: string;
+    coverage_disposition: string;
+};
+/** One declared gap from one completed phase's ledger. */
+export type CoverageGap = {
+    /** The phase that declared it. */
+    phaseId: string;
+    /** Which bullet it came from: "skipped scope" or "known blind spots". */
+    label: string;
+    /** The bullet's text, sub-bullets folded onto one line. */
+    detail: string;
+    /** `.codecarto/`-relative path of the output the ledger was read from. */
+    output: string;
+};
+/**
+ * Read a phase output's `## Coverage and limits` ledger.
+ *
+ * Returns null when the document has no such section. A bullet the author left
+ * blank comes back as an empty string, as does a label the section omits, so a
+ * caller never has to distinguish "absent" from "empty" — both mean nothing to
+ * carry forward.
+ *
+ * Sub-bullets and wrapped continuation lines under a label belong to that
+ * label: a real report writes its blind spots as a nested list, and dropping
+ * them would silence exactly the case this exists for. They fold onto one line
+ * (sub-bullets joined with "; ") because the consumer is a prompt bullet.
+ */
+export declare function parseCoverageAndLimits(content: string): CoverageLedger | null;
+/**
+ * Every declared gap from every completed phase whose primary output exists.
+ *
+ * Walks `phase_order` so the list is deterministic and reads upstream-first.
+ * Only `Skipped scope` and `Known blind spots` are collected: those are the
+ * two bullets that bind a later phase's claims. Unreadable or unparsable
+ * outputs contribute nothing.
+ */
+export declare function collectCoverageGaps(state: WorkspaceState): Promise<CoverageGap[]>;

package/dist/core/coverage.js

@@ -0,0 +1,131 @@
+// The coverage-gap ledger every primary output carries (#122, #186).
+//
+// Each phase output ends with a `## Coverage and limits` section whose bullet
+// labels are fixed across every template — `- Inspected scope:`, `- Skipped
+// scope:`, `- Evidence basis:`, `- Known blind spots:`, `- Coverage
+// disposition:` — which is what makes reading it a parse and not a guess.
+//
+// The ledger was carried nowhere: not into the next phase's prompt, not into
+// status.yaml, not into validation. So an upstream phase could declare "the
+// encoded search-proxy command was not fully decoded" and the next phase could
+// assert an `observed fact` about that exact component, with nothing in the
+// framework comparing the two. The contradiction sweep could not have caught
+// it either: that sweep compares against `owner_notes`, and a declared blind
+// spot is not an owner note.
+//
+// Everything here is non-gating and read-only. A missing file, a missing
+// section, or an empty bullet yields nothing; nothing throws.
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { pathExists } from "./utils.js";
+/** The section heading whose bullets this module reads. */
+export const COVERAGE_SECTION_HEADING = "Coverage and limits";
+/** Bullet label (normalized) to ledger field. */
+const LEDGER_LABELS = new Map([
+    ["inspected scope", "inspected_scope"],
+    ["skipped scope", "skipped_scope"],
+    ["evidence basis", "evidence_basis"],
+    ["known blind spots", "known_blind_spots"],
+    ["coverage disposition", "coverage_disposition"],
+]);
+/** The two ledger bullets a downstream phase is bound by, in render order. */
+const GAP_FIELDS = [
+    { field: "skipped_scope", label: "skipped scope" },
+    { field: "known_blind_spots", label: "known blind spots" },
+];
+function emptyLedger() {
+    return {
+        inspected_scope: "",
+        skipped_scope: "",
+        evidence_basis: "",
+        known_blind_spots: "",
+        coverage_disposition: "",
+    };
+}
+function normalizeLabel(label) {
+    return label.replace(/[`*_]/g, "").replace(/\s+/g, " ").trim().toLowerCase();
+}
+/**
+ * Read a phase output's `## Coverage and limits` ledger.
+ *
+ * Returns null when the document has no such section. A bullet the author left
+ * blank comes back as an empty string, as does a label the section omits, so a
+ * caller never has to distinguish "absent" from "empty" — both mean nothing to
+ * carry forward.
+ *
+ * Sub-bullets and wrapped continuation lines under a label belong to that
+ * label: a real report writes its blind spots as a nested list, and dropping
+ * them would silence exactly the case this exists for. They fold onto one line
+ * (sub-bullets joined with "; ") because the consumer is a prompt bullet.
+ */
+export function parseCoverageAndLimits(content) {
+    const lines = content.split(/\r?\n/);
+    const start = lines.findIndex((line) => /^##\s+Coverage and limits\s*$/i.test(line.replace(/[`*_]/g, "")));
+    if (start < 0)
+        return null;
+    const ledger = emptyLedger();
+    let current = null;
+    for (let i = start + 1; i < lines.length; i++) {
+        const line = lines[i];
+        if (/^##\s/.test(line))
+            break;
+        const bullet = /^[-*]\s+(.*)$/.exec(line);
+        if (bullet) {
+            const separator = bullet[1].indexOf(":");
+            const field = separator >= 0 ? LEDGER_LABELS.get(normalizeLabel(bullet[1].slice(0, separator))) : undefined;
+            // An unrecognized top-level bullet ends the previous label's block
+            // rather than absorbing text that belongs to neither.
+            current = field ?? null;
+            if (field)
+                ledger[field] = bullet[1].slice(separator + 1).trim();
+            continue;
+        }
+        if (!line.trim())
+            continue; // a blank line does not end a label's block
+        if (!current || !/^\s/.test(line)) {
+            current = null; // unindented prose is not part of any bullet
+            continue;
+        }
+        const continuation = line.trim();
+        const nested = /^[-*]\s+(.*)$/.exec(continuation);
+        const text = (nested ? nested[1] : continuation).trim();
+        if (!text)
+            continue;
+        ledger[current] = ledger[current] ? `${ledger[current]}${nested ? "; " : " "}${text}` : text;
+    }
+    return ledger;
+}
+/**
+ * Every declared gap from every completed phase whose primary output exists.
+ *
+ * Walks `phase_order` so the list is deterministic and reads upstream-first.
+ * Only `Skipped scope` and `Known blind spots` are collected: those are the
+ * two bullets that bind a later phase's claims. Unreadable or unparsable
+ * outputs contribute nothing.
+ */
+export async function collectCoverageGaps(state) {
+    const configs = new Map(state.pipeline.phases.map((phase) => [phase.id, phase]));
+    const gaps = [];
+    for (const phaseId of state.pipeline.phase_order ?? []) {
+        if (state.status.phases[phaseId]?.status !== "complete")
+            continue;
+        const output = configs.get(phaseId)?.primary_output;
+        if (!output)
+            continue;
+        const outputPath = join(state.workspaceDir, output);
+        if (!(await pathExists(outputPath)))
+            continue;
+        const content = await readFile(outputPath, "utf8").catch(() => null);
+        if (content === null)
+            continue;
+        const ledger = parseCoverageAndLimits(content);
+        if (!ledger)
+            continue;
+        for (const { field, label } of GAP_FIELDS) {
+            const detail = ledger[field];
+            if (detail)
+                gaps.push({ phaseId, label, detail, output });
+        }
+    }
+    return gaps;
+}

package/dist/core/dashboard.d.ts

@@ -39,4 +39,17 @@ export interface DashboardInputs {
     narration?: DashboardNarration;
 }
 export declare function renderDashboard(inputs: DashboardInputs): string;
+/**
+ * A dashboard link target, or undefined when the path is not a safe relative
+ * reference. Absolute paths, scheme-bearing URLs and `.`/`..` segments are
+ * refused outright.
+ *
+ * Percent-encoding each segment is load-bearing, not cosmetic: a Windows-style
+ * `dir\..\secret` survives the segment scan, because that scan splits on `/`
+ * — but `encodeURIComponent` turns the separators into `%5C`, which no URL
+ * parser treats as a path separator, so the traversal cannot resolve. Removing
+ * the encoding, or "simplifying" it to a raw join, reopens it. Exported so
+ * that property has a test.
+ */
+export declare function safeRelativeHref(path: string): string | undefined;
 export declare function escapeHtml(input: string): string;

package/dist/core/dashboard.js

@@ -660,7 +660,19 @@ function renderSafeLink(path, label, className) {
     const classAttr = className ? ` class="${escapeAttr(className)}"` : "";
     return `<a${classAttr} href="${escapeAttr(href)}">${escapeHtml(label)}</a>`;
 }
-function safeRelativeHref(path) {
+/**
+ * A dashboard link target, or undefined when the path is not a safe relative
+ * reference. Absolute paths, scheme-bearing URLs and `.`/`..` segments are
+ * refused outright.
+ *
+ * Percent-encoding each segment is load-bearing, not cosmetic: a Windows-style
+ * `dir\..\secret` survives the segment scan, because that scan splits on `/`
+ * — but `encodeURIComponent` turns the separators into `%5C`, which no URL
+ * parser treats as a path separator, so the traversal cannot resolve. Removing
+ * the encoding, or "simplifying" it to a raw join, reopens it. Exported so
+ * that property has a test.
+ */
+export function safeRelativeHref(path) {
     if (!path || path.startsWith("/") || path.startsWith("\\") || /^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(path))
         return undefined;
     const parts = path.split("/");

package/dist/core/index.d.ts

@@ -5,6 +5,7 @@ export * from "./status.ts";
 export * from "./amendment.ts";
 export * from "./pipeline.ts";
 export * from "./findings.ts";
+export * from "./coverage.ts";
 export * from "./prompts.ts";
 export * from "./workspace.ts";
 export * from "./completion.ts";

package/dist/core/index.js

@@ -8,6 +8,7 @@ export * from "./status.js";
 export * from "./amendment.js";
 export * from "./pipeline.js";
 export * from "./findings.js";
+export * from "./coverage.js";
 export * from "./prompts.js";
 export * from "./workspace.js";
 export * from "./completion.js";

package/dist/core/prompts.js

@@ -4,12 +4,17 @@
 import { readdir } from "node:fs/promises";
 import { join } from "node:path";
 import { pathExists } from "./utils.js";
+import { collectCoverageGaps } from "./coverage.js";
 import { countPendingProposals } from "./completion.js";
 import { describeScaffoldStaleness } from "./workspace.js";
 import { runPhasePreflight } from "./synthesis.js";
 /** Open-question kinds whose label the orchestrator re-tests at each phase boundary. */
 const RETRIAGE_KINDS = new Set(["needs-maintainer-decision", "needs-runtime-test"]);
-/** Cap on individually listed re-triage questions; the rest collapse to a count. */
+/**
+ * Cap on the individually listed entries of a mechanically surfaced duty list
+ * — re-triage questions and upstream coverage gaps alike; the rest collapse to
+ * a count naming where the full list lives.
+ */
 const RETRIAGE_LIST_LIMIT = 10;
 /**
  * Build the "Orchestrator duties" prompt block (issue #98): the cross-phase
@@ -47,6 +52,19 @@ async function buildOrchestratorDuties(state, phase, auto) {
             lines.push(`  - .codecarto/${output.path} (${exists ? "exists" : "missing"})`);
         }
     }
+    // The coverage-gap ledger (#122, #186). The contradiction sweep below
+    // compares against `owner_notes` only, and a declared blind spot is not an
+    // owner note — so a phase could assert an observed fact about a component
+    // the upstream phase had recorded as not decoded, and nothing compared the
+    // two. Non-gating: this is a duty in the prompt, not a validation rule.
+    const coverageGaps = await collectCoverageGaps(state);
+    if (coverageGaps.length > 0) {
+        lines.push("- Upstream phases declared these coverage gaps in their `## Coverage and limits` sections. A finding of yours that lands inside one must either close the gap with cited new evidence of its own or inherit its uncertainty — an upstream `not inspected` or `not decoded` does not license an `observed fact` about that scope:");
+        for (const gap of coverageGaps.slice(0, RETRIAGE_LIST_LIMIT))
+            lines.push(`  - ${gap.phaseId} (${gap.label}): ${gap.detail}`);
+        if (coverageGaps.length > RETRIAGE_LIST_LIMIT)
+            lines.push(`  - (+${coverageGaps.length - RETRIAGE_LIST_LIMIT} more in completed phases' Coverage and limits sections)`);
+    }
     const anyCompleted = Object.values(state.status.phases).some((phaseState) => phaseState.status === "complete");
     if (anyCompleted) {
         lines.push("- Contradiction sweep: compare this phase's required reads against completed phases' owner_notes; a measured fact that contradicts a summarized claim is a gap to route through the handoff, not a nuance to smooth over.");

package/dist/core/status.d.ts

@@ -1,9 +1,16 @@
-import type { NormalizedStatus, OpenQuestionEntry, PostPipelineEntry, PhaseHandoff, PipelineFile, ProposedConventionEntry, StatusFile, StatusPhase } from "./types.ts";
+import type { ClosureEntry, NormalizedStatus, OpenQuestionEntry, PostPipelineEntry, PhaseHandoff, PipelineFile, ProposedConventionEntry, StatusFile, StatusPhase } from "./types.ts";
 export declare const LOCK_RETRY_MS = 125;
 export declare const LOCK_TIMEOUT_MS = 5000;
 export declare const STALE_LOCK_MS = 60000;
 export declare function assertSafePhaseId(phaseId: string): void;
 export declare function ensureArray(value: unknown): string[];
+/**
+ * Normalize a handoff's `open_question_closures` (#122, #186). Accepts both
+ * the original bare-string shape and `{ id, evidence }`; a string becomes
+ * `{ id }`, and an entry with no usable id is dropped rather than resolving
+ * nothing under the lock. Values are trimmed.
+ */
+export declare function ensureClosureArray(value: unknown): ClosureEntry[];
 export declare function ensureEntryArray<T extends OpenQuestionEntry>(value: unknown, allowTargetPhase?: boolean): T[];
 export declare function autoAssignIds(entries: OpenQuestionEntry[], prefix: string, phaseId: string): void;
 export declare function ensurePostPipelineArray(value: unknown): PostPipelineEntry[];

package/dist/core/status.js

@@ -36,8 +36,42 @@ function coerceEntry(value, allowTargetPhase) {
         entry.deferred_reason = raw.deferred_reason.trim();
     if (allowTargetPhase && typeof raw.target_phase === "string" && raw.target_phase.trim())
         entry.target_phase = raw.target_phase.trim();
+    // derives_from rides the same flag as target_phase: it is a carry-forward
+    // concept only — the id of the open question this routed item answers one
+    // candidate of (#122, #186). An open_questions entry has nothing to derive
+    // from, so the field is dropped there rather than silently carried.
+    if (allowTargetPhase && typeof raw.derives_from === "string" && raw.derives_from.trim())
+        entry.derives_from = raw.derives_from.trim();
     return Object.keys(entry).length > 0 ? entry : null;
 }
+/**
+ * Normalize a handoff's `open_question_closures` (#122, #186). Accepts both
+ * the original bare-string shape and `{ id, evidence }`; a string becomes
+ * `{ id }`, and an entry with no usable id is dropped rather than resolving
+ * nothing under the lock. Values are trimmed.
+ */
+export function ensureClosureArray(value) {
+    if (!Array.isArray(value))
+        return [];
+    const result = [];
+    for (const item of value) {
+        if (typeof item === "string") {
+            const id = item.trim();
+            if (id)
+                result.push({ id });
+            continue;
+        }
+        if (!item || typeof item !== "object" || Array.isArray(item))
+            continue;
+        const raw = item;
+        const id = typeof raw.id === "string" ? raw.id.trim() : "";
+        if (!id)
+            continue;
+        const evidence = typeof raw.evidence === "string" && raw.evidence.trim() ? raw.evidence.trim() : undefined;
+        result.push({ id, ...(evidence !== undefined && { evidence }) });
+    }
+    return result;
+}
 export function ensureEntryArray(value, allowTargetPhase = false) {
     if (!Array.isArray(value))
         return [];
@@ -218,7 +252,7 @@ export function parseHandoff(value) {
         open_questions: openQuestions,
         carry_forward: carryForward,
         carry_forward_closures: ensureArray(raw.carry_forward_closures),
-        open_question_closures: ensureArray(raw.open_question_closures),
+        open_question_closures: ensureClosureArray(raw.open_question_closures),
         post_pipeline: ensurePostPipelineArray(raw.post_pipeline),
         decisions: ensureArray(raw.decisions),
         proposed_conventions: ensureProposedConventionArray(raw.proposed_conventions),
@@ -335,7 +369,8 @@ export function applyHandoff(status, handoff) {
         }
     }
     // Apply open_question_closures: remove resolved questions from ALL phases by id
-    for (const closureId of handoff.open_question_closures) {
+    for (const closure of handoff.open_question_closures) {
+        const closureId = closure?.id;
         if (!closureId)
             continue;
         for (const ph of Object.values(status.phases)) {

package/dist/core/types.d.ts

@@ -9,6 +9,16 @@ export type OpenQuestionEntry = {
 };
 export type CarryForwardEntry = OpenQuestionEntry & {
     target_phase?: string;
+    /**
+     * Optional id of the `open_questions` entry this routed item is one
+     * candidate answer to (#122, #186). The upstream phase usually registers
+     * the question and routes the candidate onward in the same handoff, which
+     * is the cheapest moment to record the link. Completion refuses a closure
+     * of this entry while that question is still open and is not closed by the
+     * same handoff: closing a routed item does not settle the question it came
+     * from. Omitted on every entry that predates the field.
+     */
+    derives_from?: string;
 };
 export type PostPipelineEntry = OpenQuestionEntry & {
     source_phase?: string;
@@ -114,6 +124,18 @@ export type ProposedConventionEntry = {
     /** Optional: where the pattern showed up (file, phase, incident). */
     evidence?: string;
 };
+/**
+ * One claimed closure in a handoff's `open_question_closures` (#122, #186).
+ * A bare string — the only shape before this field grew — normalizes to
+ * `{ id }`; the object form adds the evidence that settles the question.
+ * Completion requires non-empty `evidence` when the closed question's `kind`
+ * is `needs-runtime-test`, because such a question closes on runtime evidence
+ * rather than on another source read.
+ */
+export type ClosureEntry = {
+    id: string;
+    evidence?: string;
+};
 export type PhaseHandoff = {
     phase_id: string;
     /**
@@ -126,7 +148,8 @@ export type PhaseHandoff = {
     open_questions: OpenQuestionEntry[];
     carry_forward: CarryForwardEntry[];
     carry_forward_closures: string[];
-    open_question_closures: string[];
+    /** ids to resolve and remove from all phases; a bare string parses to `{ id }`. */
+    open_question_closures: ClosureEntry[];
     post_pipeline: PostPipelineEntry[];
     decisions: string[];
     /** Conventions proposed for promotion; completion stages them in CONVENTIONS.md. Omitted defaults to empty. */

package/dist/core/yaml.js

@@ -126,6 +126,19 @@ export function parseSimpleYaml(raw) {
     };
     const parseMapping = (indent) => {
         const result = {};
+        // Duplicate detection tracks keys explicitly rather than testing
+        // `key in result`. A bare object inherits from Object.prototype, so
+        // `"constructor" in result` is already true before anything is parsed —
+        // a document whose key is `constructor`, `toString`, `valueOf` or any
+        // other prototype member was rejected as a duplicate on first sight.
+        const seen = new Set();
+        // Assignment goes through defineProperty for the same reason: plain
+        // `result[key] = value` with the key `__proto__` invokes the prototype
+        // setter instead of creating an entry, so a hand-edited YAML file could
+        // change the shape of every object in the process rather than parse.
+        const assign = (key, value) => {
+            Object.defineProperty(result, key, { value, writable: true, enumerable: true, configurable: true });
+        };
         while (index < lines.length) {
             skipBlank();
             if (index >= lines.length)
@@ -147,9 +160,10 @@ export function parseSimpleYaml(raw) {
             const key = trimmed.slice(0, separator).trim();
             const rawValue = trimmed.slice(separator + 1).trim();
             index++;
-            if (key in result) {
+            if (seen.has(key)) {
                 throw new Error(`Duplicate YAML key: ${key} near line: ${line.trim()}`);
             }
+            seen.add(key);
             if (rawValue === "|" || rawValue === "|-") {
                 const blockLines = [];
                 let contentIndent = null;
@@ -168,19 +182,19 @@ export function parseSimpleYaml(raw) {
                     index++;
                 }
                 const content = blockLines.join("\n").replace(/\n+$/, "");
-                result[key] = rawValue === "|" ? `${content}\n` : content;
+                assign(key, rawValue === "|" ? `${content}\n` : content);
                 continue;
             }
             if (rawValue !== "") {
-                result[key] = parseYamlScalar(rawValue);
+                assign(key, parseYamlScalar(rawValue));
                 continue;
             }
             skipBlank();
             if (index < lines.length && countIndent(lines[index] ?? "") > indent) {
-                result[key] = parseBlock(countIndent(lines[index] ?? ""));
+                assign(key, parseBlock(countIndent(lines[index] ?? "")));
             }
             else {
-                result[key] = null;
+                assign(key, null);
             }
         }
         return result;
@@ -198,7 +212,13 @@ export function parseSimpleYaml(raw) {
             const trimmed = line.slice(lineIndent);
             if (lineIndent !== indent || (!trimmed.startsWith("- ") && trimmed !== "-"))
                 break;
-            const rawItem = trimmed === "-" ? "" : trimmed.slice(2).trim();
+            const afterDash = trimmed === "-" ? "" : trimmed.slice(2);
+            const rawItem = afterDash.trim();
+            // A sequence item's mapping continues at the column where its own
+            // content starts, which is not always two past the dash: `-   id: x`
+            // aligns its siblings under the `i`, four columns in. Hardcoding two
+            // rejected that valid layout as bad indentation.
+            const itemIndent = indent + 2 + (afterDash.length - afterDash.trimStart().length);
             index++;
             if (rawItem === "") {
                 skipBlank();
@@ -221,7 +241,7 @@ export function parseSimpleYaml(raw) {
                     item[key] = parseBlock(countIndent(lines[index] ?? ""));
                 }
                 if (index < lines.length && countIndent(lines[index] ?? "") > indent) {
-                    const nested = parseMapping(indent + 2);
+                    const nested = parseMapping(itemIndent);
                     for (const [nestedKey, nestedValue] of Object.entries(nested))
                         item[nestedKey] = nestedValue;
                 }

package/dist/extensions/codecarto/auto-runner.d.ts

@@ -44,7 +44,7 @@ export interface AutoCompleteResult {
     /** Non-gating closure-integrity notes from completion (#122). */
     warnings: string[];
 }
-export declare function autoCompletePhase(ctx: ExtensionContext, validation: ValidationResult): Promise<AutoCompleteResult>;
+export declare function autoCompletePhase(cwd: string, validation: ValidationResult): Promise<AutoCompleteResult>;
 export type AutoOutcome = "complete" | "stopped" | "aborted";
 export interface AutoRunOptions {
     strict: boolean;

package/dist/extensions/codecarto/auto-runner.js

@@ -151,9 +151,13 @@ export function isPhaseRunning(phaseId) {
     const existing = getPhaseActivity(phaseId);
     return existing?.status === "running";
 }
-export async function autoCompletePhase(ctx, validation) {
-    const result = await completeValidatedPhase(ctx.cwd, validation, "/codecarto-complete");
-    void writeDashboard(ctx.cwd, PACKAGE_VERSION);
+export async function autoCompletePhase(
+// A directory, not a ctx: this only ever needed `ctx.cwd`, and its callers
+// run after a sub-agent has invalidated the ctx they captured, where every
+// property access throws.
+cwd, validation) {
+    const result = await completeValidatedPhase(cwd, validation, "/codecarto-complete");
+    void writeDashboard(cwd, PACKAGE_VERSION);
     return result;
 }
 export function decideAfterPhase(phaseStatus, phaseError, validation, strict) {
@@ -185,6 +189,9 @@ export function decideAfterPhase(phaseStatus, phaseError, validation, strict) {
 }
 export async function runAuto(ctx, pi, initialState, options) {
     const startedAt = Date.now();
+    // Captured once: the loop below spawns a sub-agent per phase, and each one
+    // invalidates this ctx, after which reading `ctx.cwd` throws.
+    const autoCwd = ctx.cwd;
     const phasesRun = [];
     const totalTokens = { input: 0, output: 0, cacheWrite: 0 };
     const totalPhases = initialState.pipeline.phase_order.length;
@@ -262,7 +269,7 @@ export async function runAuto(ctx, pi, initialState, options) {
         // decision.action === "continue" → auto-complete and loop.
         // validation is guaranteed non-null on the continue branch.
         try {
-            const { updatedState } = await autoCompletePhase(ctx, validation);
+            const { updatedState } = await autoCompletePhase(autoCwd, validation);
             state = updatedState;
             phasesRun.push(phase.id);
             options.onPhaseAdvanced?.(state);