copilot-operator 0.1.23 → 0.1.26

package/dist/src/exec/confinement.js

@@ -55,6 +55,19 @@ export function isWithin(path, roots) {
         return target === root || target.startsWith(`${root}\\`);
     });
 }
+/**
+ * The folders a session's commands may reach: its own, and the projects registered in Settings when its
+ * own folder is one of them (or inside one) — a front end, a back end and their tests are one piece of
+ * work and a test suite starts the application next door. A session working anywhere else is confined to
+ * its own folder: found live on 2026-10-03, a fixture session elsewhere on the disk could write into every
+ * registered project, whose paths were also sent to the chat in each refusal, and nothing there would have
+ * been put back or committed.
+ */
+export function sessionRoots(cwd, registered) {
+    const projects = projectRoots(registered);
+    const inProject = projects.some((p) => isWithin(cwd, [p]));
+    return projectRoots([cwd, ...(inProject ? projects : [])]);
+}
 /** Roots as a set: resolved, de-duplicated, empty ones dropped. */
 export function projectRoots(folders) {
     const seen = new Map();
@@ -92,11 +105,74 @@ const TILDE = /(?:^|[\s"'=(,])~(?=[\\/]|$|[\s"'`;|&)])/;
 const CD_TO_ROOT = /(?:^|[\s;|&({])(?:Set-Location|Push-Location|cd|chdir|sl|pushd)\s+["']?[\\/]["']?(?=$|[\s;|&)}])/i;
 /** A path segment that climbs: `..` on its own, or between separators. */
 const CLIMBS = /(?:^|[\\/])\.\.(?:$|[\\/])/;
+/**
+ * A here-string, `@'…'@` or `@"…"@`: its lines are text, not part of the command line.
+ */
+const HERE_STRING = /@(['"])[ \t]*\r?\n[\s\S]*?\r?\n[ \t]*\1@/g;
+/**
+ * A quoted PowerShell string, single- or double-quoted, over several lines too: a script's text kept in a
+ * variable over many lines was still read as paths when only one-line strings were matched (live run 2026-10-04).
+ */
+const STRING = String.raw `(?:'(?:[^']|'')*'|"(?:[^"` + '`' + String.raw `]|""|` + '`' + String.raw `[\s\S])*")`;
+/** Text: a quoted string, or an array of them `@('a', "b")` or `('a', "b")`, which may be joined `-join "…"`. */
+const TEXT_VALUE = String.raw `(?:${STRING}|@?\(\s*(?:${STRING}\s*,?\s*)*\)(?:\s*-join\s*${STRING})?)`;
+/** Where what follows is the text written: `-Value`, `-InputObject`, `WriteAllText(path, …`, or Set-Content's second positional argument. */
+const CONTENT_LEAD = String.raw `-(?:Value|InputObject)\s+|::(?:Write|Append)All(?:Text|Lines)\s*\([^,]*,\s*|\b(?:Set|Add)-Content\s+(?:-(?:Path|LiteralPath)\s+)?(?:${STRING}|[^\s;|&()"'$-][^\s;|&()"'$]*)\s+`;
+/** The text after `-Value`/`-InputObject`, the content argument of `WriteAllText`/`AppendAllText`, or Set-Content's positional text. */
+const CONTENT_ARGUMENT = new RegExp(`(${CONTENT_LEAD})${TEXT_VALUE}`, 'gi');
+/** A command that runs text as code: then the text is the command, and is read as one. */
+const RUNS_TEXT = /\b(?:Invoke-Expression|iex|Invoke-Command|ScriptBlock\]?::Create|Start-Job)\b|\|\s*&?\s*(?:pwsh|powershell|cmd|node|python3?|py|bash|sh|wsl|ruby|perl|php)(?:\.exe)?\b/i;
+/**
+ * The command without the text it writes into a file.
+ *
+ * Found in a live run on 2026-10-03: a step writing `src/cart.mjs` with a here-string, as the contract
+ * recommends, was refused because the file's own `new URL('../config/limits.json', import.meta.url)`
+ * was read as a path, resolved against the working folder — where it climbs out — instead of against
+ * the file it belongs to, where it does not. The same text in double quotes passed, by an accident of
+ * splitting. What a step writes into a file is data; the path it writes to is still read, and so is
+ * the text of a command that runs it (`iex`, a pipe into an interpreter). A script written now and run
+ * later is read when it is run (see `scriptFiles.ts`).
+ */
+function withoutWrittenText(command) {
+    if (RUNS_TEXT.test(command))
+        return command;
+    let line = command.replace(HERE_STRING, ' ').replace(CONTENT_ARGUMENT, (_m, lead) => `${lead}''`);
+    /*
+     * The same text put in a variable first and then written: `$t = "…'../config/x'…"; $f::WriteAllText('a.mjs', $t, $e)`.
+     * Taken out only when every use of the variable is as what is written — never when it is used as a path —
+     * so `$p = '..\..\x'; Set-Content -Path $p` is still read (live run 2026-10-04, a second form of 2026-10-03's).
+     */
+    // An array of lines `$c = @("…", "…")` too, and Set-Content's positional text `Set-Content a.js $c` (live run 2026-10-04).
+    // And lines joined into another variable first, `$t = ($lines -join "`n")`: content when that one is.
+    const joined = new Map();
+    for (const j of line.matchAll(new RegExp(String.raw `\$(\w+)\s*=\s*\(?\s*\$(\w+)\s+-join\s*${STRING}\s*\)?`, 'gi')))
+        joined.set(j[1].toLowerCase(), j[2].toLowerCase());
+    const contentOnly = (name, depth = 0) => {
+        if (depth > 3)
+            return false;
+        const uses = [...line.matchAll(new RegExp(`\\$${name}\\b`, 'gi'))].length - 1;
+        if (uses <= 0)
+            return false;
+        const direct = [
+            new RegExp(`(?:${CONTENT_LEAD})\\$${name}\\b`, 'gi'),
+            new RegExp(`\\$${name}\\s*\\|\\s*(?:Set-Content|Add-Content|Out-File)\\b`, 'gi'),
+        ].reduce((n, re) => n + [...line.matchAll(re)].length, 0);
+        const viaJoin = [...joined].filter(([into, from]) => from === name.toLowerCase() && contentOnly(into, depth + 1)).length;
+        return direct + viaJoin === uses;
+    };
+    for (const m of [...line.matchAll(new RegExp(String.raw `\$(\w+)\s*=\s*${TEXT_VALUE}`, 'g'))]) {
+        const name = m[1];
+        if (contentOnly(name))
+            line = line.replace(m[0], () => `$${name} = ''`);
+    }
+    return line;
+}
 /** Every whitespace- or separator-delimited token, quoted content split the same way. */
 function tokens(command) {
     const out = [];
     const rest = command.replace(QUOTED, (_whole, _q, inner) => {
-        out.push(...inner.split(/\s+/));
+        // Split like the rest of the line: `URL('../x'` inside a double-quoted string is the token `../x`.
+        out.push(...inner.split(/[\s;|&<>(){},'"]+/));
         return ' ';
     });
     out.push(...rest.split(/[\s;|&<>(){},]+/));
@@ -199,21 +275,23 @@ export function confinementRefusal(command, c) {
     const pip = pipRefusal(command);
     if (pip)
         return pip;
-    const env = ENV_LOCATION.exec(command);
+    // Paths are read from the command line without the text it writes into a file: see `withoutWrittenText`.
+    const line = withoutWrittenText(command);
+    const env = ENV_LOCATION.exec(line);
     if (env)
         return outside(`\`${env[0]}\` is a location on the machine — the operator's profile or the system — not in the project`, c);
-    if (HOME_VAR.test(command) || TILDE.test(command)) {
+    if (HOME_VAR.test(line) || TILDE.test(line)) {
         return outside('`~` and `$HOME` are the operator\'s profile, not the project', c);
     }
-    if (UNC.test(command))
+    if (UNC.test(line))
         return outside('a network share is not the project', c);
-    if (CD_TO_ROOT.test(command))
+    if (CD_TO_ROOT.test(line))
         return outside('this changes to the root of the drive', c);
-    for (const p of drivePaths(command)) {
+    for (const p of drivePaths(line)) {
         if (!isWithin(p, c.roots))
             return outside(`\`${p}\` is outside the project`, c);
     }
-    for (const t of tokens(command)) {
+    for (const t of tokens(line)) {
         if (!CLIMBS.test(t))
             continue;
         const resolved = win32.resolve(c.cwd, t);

package/dist/src/exec/programs.js

@@ -126,7 +126,13 @@ export function externalProgram(head) {
  * anywhere on the line refused honest work, which is the error this gate can least afford.
  */
 const INLINE_CODE = [
-    { what: 'node -e', pattern: /\bnode(\.exe)?\s+(-\S+\s+)*?-(e|-eval)\b/i },
+    { what: 'node -e', pattern: /\bnode(\.exe)?\s+(-\S+\s+)*?-(e|-eval|p|-print)\b/i },
+    /*
+     * Code piped into an interpreter that has no script to run: the same thing as `-e`, spelled through
+     * stdin. Seen live on 2026-10-03: refused `node -e`, the chat sent `'…' | node` in its next step and
+     * it ran. An interpreter given a script file after the pipe (`| node tools/format.js`) is not this.
+     */
+    { what: 'code piped into an interpreter', pattern: /\|\s*&?\s*(node|deno|bun|python3?|py|ruby|perl|php)(\.exe)?(\s+-)?\s*($|[;|)&])/im },
     { what: 'deno eval', pattern: /\bdeno(\.exe)?\s+eval\b/i },
     { what: 'bun -e', pattern: /\bbun(\.exe)?\s+(-\S+\s+)*?-e\b/i },
     { what: 'python -c', pattern: /\b(python3?|py)(\.exe)?\s+(-\S+\s+)*?-c\b/i },
@@ -214,8 +220,11 @@ export function programRefusal(command, allowedPrograms, shell = 'pwsh') {
     const scan = scanCommandHeads(command, shell);
     if (scan.uncertain) {
         return (`refused: the runner could not tell which programs this line starts (${scan.uncertain}). ` +
-            'Write it so every program is named literally — close each quote and bracket, and call a program by its ' +
-            'name or a literal path rather than through a variable or an expression.');
+            // The advice for the case at hand: a here-string with text on its header line got the general one, which does not say what to change (live run 2026-10-04).
+            (/here-string/.test(scan.uncertain)
+                ? "PowerShell itself rejects it too: nothing may follow @' or @\" on its line — the text starts on the next line, and '@ or \"@ closes it at the very start of a line of its own."
+                : 'Write it so every program is named literally — close each quote and bracket, and call a program by its ' +
+                    'name or a literal path rather than through a variable or an expression.'));
     }
     // What `Start-Process` is asked to start is a program this line starts, as much as a head is.
     for (const head of [...scan.heads, ...startProcessTargets(command)]) {

package/dist/src/exec/reportFile.js

@@ -44,9 +44,11 @@ export function clip(text, maxChars) {
 function sectionFor(r, maxOutputChars) {
     // A refused step never ran, so it is not given an exit code or a duration that could be read as
     // a command that ran and failed; the header says what happened instead.
-    const head = r.outcome === 'refused'
-        ? `--- step ${r.id} (${r.shell}, REFUSED by the runner, never executed, no exit code)\n$ ${r.command}\n`
-        : `--- step ${r.id} (${r.shell}, ${r.outcome}, exit ${r.exitCode}, ` + `${(r.durationMs / 1000).toFixed(1)}s)\n$ ${r.command}\n`;
+    const head = r.outcome === 'refused' && r.skippedAfter !== undefined
+        ? `--- step ${r.id} (${r.shell}, NOT RUN because step ${r.skippedAfter} was refused, no exit code)\n$ ${r.command}\n`
+        : r.outcome === 'refused'
+            ? `--- step ${r.id} (${r.shell}, REFUSED by the runner, never executed, no exit code)\n$ ${r.command}\n`
+            : `--- step ${r.id} (${r.shell}, ${r.outcome}, exit ${r.exitCode}, ` + `${(r.durationMs / 1000).toFixed(1)}s)\n$ ${r.command}\n`;
     const out = clip(r.stdout, maxOutputChars);
     const err = r.stderr.trim().length > 0 ? `[stderr]\n${clip(r.stderr, maxOutputChars)}\n` : '';
     const note = r.truncated ? `[note] output was truncated; the full stream is in ${r.logPath}\n` : '';

package/dist/src/exec/shells.js

@@ -276,6 +276,16 @@ export function shellNote(inventory = detectShells(), fallback) {
  * `cmdArgument`, because nothing else quotes them any more. PowerShell is not touched: it reads its
  * arguments by the C runtime's rules, and Node's quoting is the right quoting for it.
  */
+/**
+ * Put in front of every PowerShell command: the console in UTF-8 both ways, and `$OutputEncoding` with it.
+ *
+ * Without it a step ran with the console's OEM code page (866 on this machine): what a native program
+ * printed and the step captured in a variable was decoded as 866 and written back mangled — node's "✔"
+ * saved as "тЬФ" in a kept artifact — and Cyrillic printed by a cmdlet reached the runner, which reads
+ * UTF-8, as "�" (live run 2026-10-03). Through a variable, because the line is a command line and the
+ * chat's own `[Type]::` restriction is about what survives the chat, not about what the runner runs.
+ */
+export const PWSH_UTF8 = 'try { $__u = New-Object System.Text.UTF8Encoding $false; [Console]::OutputEncoding = $__u; [Console]::InputEncoding = $__u; $OutputEncoding = $__u; Remove-Variable __u } catch { }; ';
 export function invocationFor(resolved, command, scriptArgs) {
     const isScript = Array.isArray(scriptArgs);
     switch (resolved.shell) {
@@ -284,10 +294,11 @@ export function invocationFor(resolved, command, scriptArgs) {
             const base = ['-NoProfile', '-NonInteractive'];
             return isScript
                 ? { file: resolved.path, args: [...base, '-File', command, ...(scriptArgs ?? [])], windowsVerbatimArguments: false }
-                : { file: resolved.path, args: [...base, '-Command', command], windowsVerbatimArguments: false };
+                : { file: resolved.path, args: [...base, '-Command', `${PWSH_UTF8}${command}`], windowsVerbatimArguments: false };
         }
         case 'cmd': {
-            const line = isScript ? [`"${command}"`, ...(scriptArgs ?? []).map(cmdArgument)].join(' ') : command;
+            // The code page to UTF-8 first, for the same reason as PowerShell's (see `PWSH_UTF8`).
+            const line = `chcp 65001 >nul & ${isScript ? [`"${command}"`, ...(scriptArgs ?? []).map(cmdArgument)].join(' ') : command}`;
             return { file: resolved.path, args: ['/d', '/s', '/c', `"${line}"`], windowsVerbatimArguments: true };
         }
     }

package/dist/src/log/runLog.js

@@ -23,7 +23,12 @@ export class RunLog {
     }
     /** Structured record for the transcript; nothing is printed unless `human` is given. */
     event(type, data = {}, human, level = 'info') {
-        this.stream.write(JSON.stringify({ at: new Date().toISOString(), type, ...data }) + '\n');
+        /*
+         * The level and the sentence go into the transcript too. Without them the runner export's list of
+         * problems was always empty — it looks for warn and error — and an event read back said only its type
+         * (live run 2026-10-03).
+         */
+        this.stream.write(JSON.stringify({ at: new Date().toISOString(), type, ...data, ...(human && data.message === undefined ? { message: human } : {}), ...(level !== 'info' ? { level } : {}) }) + '\n');
         if (human && !this.quiet) {
             const prefix = level === 'error' ? '  !! ' : level === 'warn' ? '  ! ' : '  ';
             process.stdout.write(prefix + human + '\n');

package/dist/src/orchestrator/contract.js

@@ -9,7 +9,7 @@
  * chat could never have met. This names the contradiction instead, before the first message.
  *
  * Only what can be known without running anything is judged: the flags against each other, and
- * the file checks against the tree as it is now. A file check that already passes needs no change;
+ * the file checks against the tree the task starts from (see `ContractTree`). A file check that already passes needs no change;
  * one that fails needs its file changed, which a read-only task, or a scope that leaves the file
  * out, forbids. Command checks are not judged: whether a command will pass depends on work the
  * task is allowed to do elsewhere.
@@ -17,15 +17,27 @@
 import { readFile, stat } from 'node:fs/promises';
 import { isAbsolute, relative, resolve } from 'node:path';
 import { inScope } from '../vcs/scope.js';
-async function fileCheckPassesNow(check, cwd) {
+import { gitBytes } from '../vcs/git.js';
+async function fileCheckPassesNow(check, cwd, repoDir, at) {
     const path = resolve(cwd, (check.cwd ?? '').trim() || '.', (check.file ?? '').trim());
-    const info = await stat(path).catch(() => null);
-    const exists = !!info?.isFile();
+    const rel = relative(resolve(repoDir), path).replace(/\\/g, '/');
+    const inRepo = rel !== '' && !rel.startsWith('..') && !isAbsolute(rel);
+    let exists;
+    let text = '';
+    if (at !== 'tree' && inRepo) {
+        const shown = await gitBytes(repoDir, ['show', `${at.ref}:${rel}`]).catch(() => null);
+        exists = !!shown?.ok;
+        text = exists ? shown.stdout.toString('utf8') : '';
+    }
+    else {
+        const info = await stat(path).catch(() => null);
+        exists = !!info?.isFile();
+        text = exists && check.expect === 'file-contains' ? await readFile(path, 'utf8').catch(() => '') : '';
+    }
     if (check.expect === 'file-exists')
         return { passes: exists, path };
     if (check.expect === 'file-missing')
         return { passes: !exists, path };
-    const text = exists ? await readFile(path, 'utf8').catch(() => '') : '';
     return { passes: exists && text.includes(check.value ?? ''), path };
 }
 /** `git` with the global options that may come before its subcommand. */
@@ -68,7 +80,7 @@ function branchCheckPasses(check, branch) {
 }
 /** Each contradiction in the task, as a sentence; empty when it can be satisfied. */
 export async function contractConflicts(task, cwd, repoDir, 
-/** The branch version control put the task on, when it is on. */
+/** The branch version control put the task on, when it is on; where its file checks are judged (see `ContractTree`). */
 vcs = {}) {
     const out = [];
     const scope = task.scope ?? [];
@@ -96,12 +108,22 @@ vcs = {}) {
         ...(task.checks ?? []),
         ...(task.reviewChecks ?? []).filter((rc) => rc.state === 'active').map((rc) => rc.check),
     ].filter((c) => c.expect === 'file-exists' || c.expect === 'file-missing' || c.expect === 'file-contains');
+    const at = vcs.files ?? 'tree';
+    // Judged when the task starts, on its own tree, once that is known.
+    if (at === 'unknown')
+        return out;
     for (const check of checks) {
-        const { passes, path } = await fileCheckPassesNow(check, cwd);
+        const { passes, path } = await fileCheckPassesNow(check, cwd, repoDir, at);
         if (passes)
             continue;
         const rel = relative(resolve(repoDir), path).replace(/\\/g, '/');
         const inside = rel !== '' && !rel.startsWith('..') && !isAbsolute(rel);
+        /*
+         * An input file the runner carries onto the task's start from its last capture is not in the tree
+         * judged here, and needs no change to be there: judged at the task's start (live run 2026-10-04).
+         */
+        if (inside && (vcs.carried?.length ?? 0) > 0 && inScope(rel, vcs.carried))
+            continue;
         if (task.readOnly) {
             out.push(`The check "${check.name}" fails now and can only pass if ${rel || path} changes, but the task is read-only.`);
         }

package/dist/src/orchestrator/review.js

@@ -31,6 +31,7 @@ import { writeReport } from '../exec/reportFile.js';
 import { mergeRedactions } from '../exec/redaction.js';
 import { trackedRepoOf } from '../vcs/taskVcs.js';
 import { buildCoveringMessage, assertSendable } from '../protocol/reporter.js';
+import { inScope } from '../vcs/scope.js';
 /** The sentence both sides get when a review left something listening. */
 function leftoverNote(leftovers) {
     const listening = leftovers.filter((l) => l.ports.length > 0);
@@ -54,7 +55,18 @@ export function deliverableFor(task, summary, tracked, changedFiles) {
 export function reviewBrief(session, task, changedFiles, cwd, deviations = [], previous, disputes = [], derivedFailing = [], earlier = [], deliverable) {
     // The same repository the runner branched and read the changed files from, however it is named.
     const repo = trackedRepoOf(session);
-    const files = changedFiles.length > 0 ? changedFiles.map((f) => `- ${f}`).join('\n') : '(version control recorded no file changes for this task)';
+    // Each file marked against the task's scope, and the scope said: the reviewer was shown side effects as
+    // the task's changes, with no scope to judge them by (live run 2026-10-03).
+    const scope = task.scope ?? [];
+    const outside = (f) => !!task.readOnly || (scope.length > 0 && !inScope(f, scope));
+    const files = changedFiles.length > 0
+        ? changedFiles.map((f) => `- ${f}${outside(f) ? " (outside what this task may change — a violation if it is the task's)" : ''}`).join('\n')
+        : '(version control recorded no file changes for this task)';
+    const rule = task.readOnly
+        ? 'This task is read-only: it may change no file in the project.'
+        : scope.length > 0
+            ? `This task may change only: ${scope.join(', ')}. The runner puts back what it changes outside that.`
+            : '';
     return [
         '## The task that was given',
         '',
@@ -81,6 +93,7 @@ export function reviewBrief(session, task, changedFiles, cwd, deviations = [], p
         `Working directory for your commands: ${cwd}`,
         repo ? `Repository: ${repo}` : 'There is no repository for this work.',
         '',
+        ...(rule ? [rule, ''] : []),
         'Files this task changed:',
         files,
         ...(deliverable
@@ -227,8 +240,8 @@ export async function runReview(transport, session, task, deps) {
         // The machine's shells, when they are not what the contract's example assumes — the same note
         // the implementer's conversation opens with, for a conversation working to the same example.
         const machineNote = shellNote(undefined, defaultShell);
-        let before = await transport.sendAndConfirm(machineNote ? `${contract}
-
+        let before = await transport.sendAndConfirm(machineNote ? `${contract}
+
 ${machineNote}` : contract);
         await transport.waitForReply(before);
         await pacer.throttleSend();