pi-orchestrator-config 4.13.0 → 4.15.0

package/README.md

@@ -600,6 +600,28 @@ files organized by category (lessons, preferences, patterns, decisions, completi
 - **Pinned** — user-requested memories (via `/remember`), never auto-removed
 - **Learned** — auto-extracted by dreaming, can be reorganized/removed
 
+**Code-enforced memories and trigger warnings** — a memory with a `trigger`
+(`bash_contains`, `bash_regex`, `tool_name`, `file_modified`) and an `action`
+(`block`, `warn`, `run_after <command>`) is enforced by runtime hooks; the LLM
+cannot ignore it. When you store one, the write response may carry a warning:
+
+- `tool_name <shell-command>` (curl, npm, python, …) — names a shell command,
+  not a pi tool: commands run inside `bash`, so the trigger never fires. Use a
+  `bash_contains` pattern for the specific command instead.
+- `tool_name bash` — fires on EVERY bash call; usually over-broad. Prefer a
+  `bash_contains` pattern targeting the specific command.
+- A trigger without an action — never fires at all; add `block`, `warn`, or
+  `run_after <command>` for enforcement to load it.
+
+**Conflict gate** — when a new memory contradicts an existing one, the write is
+refused with an ask-first message instead of stored silently. Complementary
+rules coexist: different targets (`deploy production` vs `deploy staging`),
+restatements, coordinated or multi-sentence rules, and quoted examples are not
+conflicts. A genuine same-action polarity flip (`never X` vs `always X`, in any
+wording) rejects and asks which rule is correct; a confirmed rule change
+re-supplies the write with `overrideConflicts: true` and supersedes the old
+entry. Pinned entries are never auto-superseded — the user edits them directly.
+
 The `.pi/memory/` directory is auto-added to the global gitignore in the container
 (along with `.pi/`, `.worktrees/`, `.cursor/agents/`, `.claude/agents/`, and
 `.gemini/agents/`). This repo's `.gitignore` also ignores those three `*/agents/`

package/extensions/orchestrator/enforcement-helpers.ts

@@ -1905,3 +1905,13 @@ export function clearBranchCache(): void {
 export function seedBranchCacheForTests(cwd: string, branch: string | null, at?: number): void {
   branchCache.set(cwd, { branch, at: at ?? Date.now() });
 }
+
+/** Diagnostic for a FAILED edit/write skipping file_modified triggers
+ *  (#940, Qodo 2addbfc4): nothing was modified, so file-pattern rules must
+ *  not fire. Logs at debug level itself (Qodo ea636782 — logging
+ *  requirements apply to helpers too) and returns the message for tests. */
+export function failedFileEditSkipMessage(toolName: string, path: string): string {
+  const msg = `enforcement: failed ${toolName} (path=${path}) — skipping file_modified triggers, nothing was modified`;
+  enfLog.debug(msg);
+  return msg;
+}

package/extensions/orchestrator/enforcement-rules.ts

@@ -220,11 +220,17 @@ export function matchBashCommand(
 
 /**
  * Find all enforced entries whose triggers match a tool call.
+ *
+ * `isError` marks a FAILED tool call: `file_modified` triggers must not
+ * match then (nothing was modified — e.g. an edit whose oldText was not
+ * found), while `tool_name` and bash matching stay live (a failed bash
+ * command still executed; tool_name matches the invocation itself).
  */
 export function matchToolCall(
   entries: EnforcedEntry[],
   toolName: string,
   input: Record<string, any>,
+  isError = false,
 ): TriggerMatch[] {
   const matches: TriggerMatch[] = [];
   for (const rule of entries) {
@@ -244,8 +250,9 @@ export function matchToolCall(
       }
     }
 
-    // Check file_modified for write/edit tools
-    if ((toolName === "write" || toolName === "edit") && input?.path) {
+    // Check file_modified for write/edit tools — only when the call
+    // actually (modified) the file, not when it failed before writing.
+    if (!isError && (toolName === "write" || toolName === "edit") && input?.path) {
       const fileHit = matchFileTrigger(rule.trigger, input.path);
       if (fileHit) {
         matches.push({ rule, matched: fileHit });

package/extensions/orchestrator/enforcement.ts

@@ -61,6 +61,7 @@ import {
   isTestRunnerCommand,
   isBumpVersionBranch,
   getCachedBranch,
+  failedFileEditSkipMessage,
 } from "./enforcement-helpers.js";
 
 const log = createLogger("enforcement");
@@ -741,7 +742,13 @@ export function registerEnforcement(pi: ExtensionAPI, inContainer?: boolean): vo
 
 
 
-    let matches = matchToolCall(entries, toolName, input);
+    // Failed edit/write calls skip file_modified matching (#940) — log the
+    // decision so silent trigger skips are diagnosable (Qodo 2addbfc4).
+    const isToolCallError = (event as any).isError === true;
+    if (isToolCallError && (toolName === "edit" || toolName === "write") && input?.path) {
+      failedFileEditSkipMessage(toolName, input.path);
+    }
+    let matches = matchToolCall(entries, toolName, input, isToolCallError);
 
     // For subagent results, extract actual bash commands from the subagent's
     // tool call messages (structured data only — no prose text fallback).
@@ -756,6 +763,26 @@ export function registerEnforcement(pi: ExtensionAPI, inContainer?: boolean): vo
       const bashCommands: string[] = [];
       for (const r of results) {
         const msgs = Array.isArray(r?.messages) ? r.messages : [];
+        // Error state per tool call (#940, Qodo 1f528064): a subagent's
+        // FAILED edit/write modified nothing, so its file_modified triggers
+        // must be skipped exactly like a failed top-level call. The result
+        // messages carry role "toolResult" entries with toolCallId/isError.
+        // A call with NO result at all (Qodo 2d02b5d5) — the child exited
+        // after emitting the call but before its result — has an UNKNOWN
+        // outcome, so it must not count as a successful modification
+        // either: file_modified warnings fire only for calls that
+        // explicitly succeeded.
+        const erroredCalls = new Set<string>();
+        const resolvedCalls = new Set<string>();
+        for (const msg of msgs) {
+          if (msg?.role !== "toolResult") continue;
+          if (typeof (msg as any).toolCallId === "string") {
+            resolvedCalls.add((msg as any).toolCallId);
+          }
+          if ((msg as any).isError === true && typeof (msg as any).toolCallId === "string") {
+            erroredCalls.add((msg as any).toolCallId);
+          }
+        }
         for (const msg of msgs) {
           if (msg?.role !== "assistant") continue;
           const parts = Array.isArray(msg?.content) ? msg.content : [];
@@ -764,15 +791,29 @@ export function registerEnforcement(pi: ExtensionAPI, inContainer?: boolean): vo
             // Check both field naming conventions (name/arguments and toolName/args)
             const partToolName = part?.name || part?.toolName;
             const partToolArgs = part?.arguments || part?.args;
+            const partCallId = part?.id ?? part?.toolCallId;
+            const partIsError = partCallId !== undefined && erroredCalls.has(partCallId);
+            const partUnresolved = partCallId !== undefined && !resolvedCalls.has(partCallId);
             if (partToolName === "bash" && partToolArgs?.command) {
               bashCommands.push(partToolArgs.command);
             }
             // Also check non-bash tool calls against tool_name/file_modified triggers
             if (partToolName && partToolName !== "bash") {
+              // Failed child edit/write calls skip file_modified matching
+              // like top-level ones (#940) — leave the same diagnostic
+              // naming the tool and path (Qodo b00dc05f).
+              if (
+                partIsError &&
+                (partToolName === "edit" || partToolName === "write") &&
+                partToolArgs?.path
+              ) {
+                failedFileEditSkipMessage(partToolName, partToolArgs.path);
+              }
               const toolMatches = matchToolCall(
                 nonBlockEntries,
                 partToolName,
                 partToolArgs || {},
+                partIsError || partUnresolved,
               );
               for (const m of toolMatches) {
                 if (!seen.has(m.rule.hash)) {

package/extensions/orchestrator/memory-scoring.ts

@@ -657,9 +657,14 @@ const PREFERENCE_PATTERNS: RegExp[] = [
 ];
 
 /** Sentence starts that mark a question, not a statement. */
-/** One-off permission grant phrasing — session instruction, not a durable preference. */
+/** One-off permission grant phrasing — session instruction, not a durable
+ *  preference. Negation-blind "you may" would reject prohibitions like
+ *  "You may not merge PRs without review" (live battery, #936), so a
+ *  grant followed by not/never/'t — or a withdrawal like "no longer" —
+ *  does not count (Qodo 77fc2333: "You can no longer force-push" is a
+ *  standing rule, not a grant). */
 const GRANT_PHRASE_RE: RegExp[] = [
-  /\byou (can|may)\b/i,
+  /\byou (?:can|may)\b(?!\s+(?:not(?!\s+only\b)|never|no\s+longer)\b)(?!['’]t\b)/i,
   /\bgo ahead\b/i,
   /\bfeel free\b/i,
   /\bjust this once\b/i,
@@ -671,7 +676,15 @@ const GRANT_PHRASE_RE: RegExp[] = [
 
 /** Detect one-off grant phrasing (shared by extractor and memory_add guardrail). */
 export function isGrantText(text: string): boolean {
-  return GRANT_PHRASE_RE.some((re) => re.test(text));
+  // Classification is logged (Qodo 64954ee5): the negation-aware grant
+  // patterns decide whether a permission-looking sentence is a durable
+  // rule or a one-off grant, and silent decisions left runtime
+  // diagnostics blind when the classification changed behavior.
+  const matched = GRANT_PHRASE_RE.find((re) => re.test(text));
+  if (matched) {
+    memLog.debug("memory-scoring: grant phrase detected", text.slice(0, 120), matched.source);
+  }
+  return matched !== undefined;
 }
 
 /**