pi-orchestrator-config 4.18.0 → 4.20.0

package/README.md

@@ -805,6 +805,8 @@ PI_PIDIFF_ENABLE=false pi
 | `myk-pi-tools pr get-skipped-comments` | Get previously skipped review comments for a PR                                                                                                |
 | `myk-pi-tools pr claude-md`            | Fetch `CLAUDE.md` and `AGENTS.md` content for a PR's repository                                                                                |
 | `myk-pi-tools release create`          | Create a GitHub release with changelog                                                                                                         |
+| `myk-pi-tools release plan`            | Scoped-release plan: which packages changed since their last publish (per-package registry-anchored diff windows). Detection only — no proposed versions. Read-only; requires `release-map.toml` at the repo root — without it, reports lockstep mode and changes nothing (issue #965) |
+| `myk-pi-tools release bump-scoped`     | Bump ONLY the affected packages' version files. Versions are ALWAYS explicit: `--set NAME=VERSION` per affected package (the versions the LLM/user decided in the `/release` flow) or a global `--version X.Y.Z` — the plan never proposes versions. Each package versions from its own registry history (no global repo-tag guard — no forced jumps for long-skipped packages); tags are per-package `<name>@<version>`. Versions are validated (strict x.y.z, no leading zeros, strictly greater than the registry-published version). Errored packages, undetected version files, or partially-updatable manifests abort before or at the first bad write. Requires `release-map.toml` — without it, exit 1 (use `bump-version` for lockstep) (issue #965) |
 | `myk-pi-tools db`                      | Review database query commands                                                                                                                 |
 | `myk-pi-tools reviews`                 | Review handling commands (fetch, poll, address, post, store, store-session)                                                                   |
 | `myk-pi-tools reviews poll`            | Poll a PR for review comments until approved or actionable — `--source qodo` reads findings through the `qodo` CLI (structured, with spans and authoritative open/closed status) when the binary is installed and authenticated, and falls back to the GitHub sticky-comment scrape otherwise. Read-only: replies are always posted as GitHub comments via `reviews address` |
@@ -815,6 +817,51 @@ PI_PIDIFF_ENABLE=false pi
 | `myk-pi-tools coderabbit`              | CodeRabbit commands (check, trigger, retry)                                                                                                    |
 | `myk-pi-tools settings get [key ...]`  | Resolve settings (project → global → env → default). No args = all keys                                                                        |
 
+### Scoped releases
+
+By default every release is **lockstep**: all detected version files bump together, exactly as before.
+A repo can opt into **scoped releases** by committing a `release-map.toml` at its root
+(see this repo's own map for the format): a `[release]` section, one `[[package]]` block per
+published artifact (`name`, `registry` `npm`/`pypi`/`npm+pypi`, `version-files`, `paths`,
+optional `exclude-paths`, `npm-name`/`pypi-name` overrides for scoped or renamed registry
+names), and a `[container]` `rebuild-paths` list.
+
+With a map present, `myk-pi-tools release plan` (read-only) reports which packages changed since **their own last publish**:
+
+```bash
+myk-pi-tools release plan            # human-readable plan
+myk-pi-tools release plan --json     # machine-readable, for tooling
+myk-pi-tools release plan --force-package pi-docsite
+```
+
+- The last published version comes from the registries (`npm view`, PyPI JSON API) — ground truth that cannot drift from tags.
+- Each package's diff window is anchored at the commit where its version file was bumped to
+  that published version, so a package skipped for several releases reaches back to its own last publish.
+- Global excludes configured in the map (e.g. `tests/`) never trigger a release by themselves;
+  multi-registry packages must agree across their registries or they are reported as errored,
+  never silently skipped.
+- The plan also reports **unmapped changes**: files changed since the last repo tag that
+  belong to no package, no exclude, and no container rebuild-path. A change that ships
+  nowhere silently is the broken failure mode — the operator maps the path or consciously
+  accepts it as release-inert.
+- The container image is reported as needing a rebuild when any package ships or a `rebuild-paths` entry changed since the last repo tag.
+
+`myk-pi-tools release bump-scoped` performs the scoped version bump: only affected
+packages' version files are written, and any errored package or undetected version file
+aborts before a single write. Each package versions from **its own registry history** —
+there is deliberately no global repo-tag guard, so a package skipped for several releases
+takes the next version after its own last publish (never a forced jump past the global tag
+sequence). Tags are **per package** (`<name>@<version>`) and cannot collide. The plan
+detects WHAT changed and nothing more — no proposed versions, no bump types. The next
+versions are decided by the LLM and the user in `/release` and passed as
+`--set NAME=VERSION` (without `--set` or `--version`, `bump-scoped` refuses to run).
+`/release X.Y.Z` overrides every affected package to that version. Each shipped package
+gets its own GitHub release tagged `<name>@<version>`. See the Scoped Mode Check in the
+release prompt.
+
+Without a `release-map.toml`, `release plan` reports lockstep mode and nothing else changes —
+the generic release flow is untouched.
+
 `reviews address` — bulk-apply replies to a fetched reviews JSON, then post and store it:
 
 ```bash

package/extensions/orchestrator/dreaming.ts

@@ -123,9 +123,25 @@ export function registerDreaming(
       `   - Patterns or conventions → [pattern] → patterns.md\n` +
       `   - Architectural/design decisions → [decision] → decisions.md\n` +
       `   QUALITY GATE for extraction: one-off permissions granted in a single session\n` +
-      `   ("you can merge this PR", "skip tests just this once") are session instructions,\n` +
-      `   NOT memories — never extract them. Only standing, repeated rules are durable.\n` +
+      `   ("you can merge this PR", "skip tests just this once") AND task-scoped instructions\n` +
+      `   ("when done, I want an html report", "when bumping to 1.4.0, drop the vendor dir",\n` +
+      `   config-change notes like "every 30min (changed from 1h)") are session/task\n` +
+      `   instructions, NOT memories — never extract them. Apply the standing test: would\n` +
+      `   this apply to a future, unrelated task? No → discard. Only standing, repeated\n` +
+      `   rules are durable.\n` +
       `   Do NOT add duplicates of existing entries.\n` +
+      `3b. Review the preference candidate queue: if ${topicsDir}/../preference-candidates.jsonl\n` +
+      `   exists and has entries, each holds a VERBATIM sentence the regex extractor queued\n` +
+      `   from user input (issue #961). For each candidate:\n` +
+      `   - Durable standing preference → DISTILL it into a clean one-line [preference]\n` +
+      `     (≤100 chars, actionable, no verbatim chatter) and add to preferences.md\n` +
+      `   - Task-scoped instruction, one-off ask, question, or already covered → discard\n` +
+      `   After processing: RE-READ preference-candidates.jsonl and rewrite it keeping ONLY\n` +
+      `   the entries that appeared after your first read — the extractor appends\n` +
+      `   concurrently, so do NOT truncate the whole file (an entry queued between your\n` +
+      `   read and your rewrite would be erased before any dream cycle reviewed it).\n` +
+      `   Keep the file bounded: if it exceeds 200 lines, also drop the oldest entries\n` +
+      `   beyond that cap.\n` +
       `4. Scan past session files for unprocessed knowledge. Check if ${topicsDir}/../.dream-watermark exists.\n` +
       `   If it does, read the timestamp — only process sessions newer than that.\n` +
       `   Session directory: find .jsonl files under the pi sessions directory.\n` +
@@ -135,6 +151,11 @@ export function registerDreaming(
       `   - Remove duplicate or near-duplicate entries\n` +
       `   - Remove stale/useless entries\n` +
       `   - Remove session-scoped or expired entries — they are transient by design\n` +
+      `   - Remove task-scoped instruction entries (issue #961): verbatim user utterances\n` +
+      `     (colloquial chat captured raw), mid-sentence cutoffs, one-off deliverable asks\n` +
+      `     ("when done I want a report"), version-pinned migration checklists, config-change\n` +
+      `     notes — these are task/session artifacts, not durable rules. NEVER remove\n` +
+      `     pinned or enforced entries even when they match these shapes.\n` +
       `   - Keep each file at a reasonable size (aim for under 20 entries per topic)\n` +
       `   - NEVER remove or modify entries marked with *(pinned)*\n` +
       `   - NEVER remove or modify entries marked with *(enforced)* — these have code-enforced triggers/actions that are keyed by text hash. ANY text change destroys the enforcement binding.\n` +

package/extensions/orchestrator/enforcement-helpers.ts

@@ -1511,62 +1511,196 @@ export function isReadOnlyStatement(stmt: string): boolean {
 /** Pattern matching direct recursive rm commands (subset of DANGEROUS patterns). */
 const RM_PATTERN = /\brm\s+(?:-[a-zA-Z]+\s+)*(-[a-zA-Z]*r[a-zA-Z]*|--recursive)/i;
 
-/**
- * Check if a dangerous rm command only targets paths within .pi/tmp/ or /tmp/<something>.
- * Returns true if the command should be silently allowed.
- * Note: bare /tmp (without subpath) is NOT allowed — only /tmp/<file-or-folder>.
- */
-export function isRmInProjectTmp(stmt: string, cwd: string): boolean {
-  // Only applies to direct rm commands, not find/xargs variants
-  if (!RM_PATTERN.test(stmt)) return false;
-
-  // Ensure rm is the actual command, not an argument to another command (e.g., xargs rm)
-  const firstWord = stmt.trim().split(/\s+/)[0];
-  if (firstWord !== "rm" && !firstWord?.endsWith("/rm")) return false;
-
-  // Don't silently allow if the statement also matches other DANGEROUS patterns
-  // (e.g., sudo rm -rf .pi/tmp/foo — sudo should still trigger confirmation)
-  if (/\bsudo\b/i.test(stmt)) return false;
-
-  // Reject statements containing subshells or process substitutions — these could
-  // embed arbitrary commands that bypass the allowlist check
-  if (extractSubshells(stmt).length > 0) return false;
+/** Tokenize the target paths of an rm command found in `stmt` (flags, the
+ *  `--` separator, and shell redirections skipped; surrounding quotes
+ *  stripped). Returns null when no rm token is present. Shared by
+ *  isRmInProjectTmp and relativeRecursiveRmTarget (issue #963). */
+interface RmPathToken {
+  value: string;
+  /** Quote character that surrounded the token, if any. SINGLE quotes make
+   *  the content fully literal; DOUBLE quotes still expand $VAR and
+   *  backticks while suppressing tilde expansion and globbing (Qodo PR
+   *  #964 round 3 — a boolean quoted flag conflated the two). */
+  quote: "'" | '"' | null;
+}
+
+/** Whitespace tokenizer that keeps quoted spans together: `rm -rf "/abs/My
+ *  Dir"` is ONE path token, not the fragments `"/abs/My` and `Dir"` (Qodo
+ *  PR #964 round 3). A quote character always starts a new token —
+ *  mid-token quotes (`--flag="x"`) split, which is conservative for rm
+ *  argument parsing. */
+function splitRmTokens(stmt: string): RmPathToken[] {
+  const out: RmPathToken[] = [];
+  let cur = "";
+  let quote: "'" | '"' | null = null;
+  const push = (q: "'" | '"' | null) => {
+    if (cur) out.push({ value: cur, quote: q });
+    cur = "";
+  };
+  for (const ch of stmt.trim()) {
+    if (quote) {
+      if (ch === quote) {
+        push(quote);
+        quote = null;
+      } else cur += ch;
+    } else if (ch === '"' || ch === "'") {
+      push(null);
+      quote = ch;
+    } else if (/\s/.test(ch)) {
+      push(null);
+    } else cur += ch;
+  }
+  push(quote); // unterminated quote — keep the residue as its own token
+  return out;
+}
 
-  // Parse arguments: split on whitespace, skip flags, handle -- separator
-  const tokens = stmt.trim().split(/\s+/);
-  const paths: string[] = [];
+function parseRmPathTokens(stmt: string): RmPathToken[] | null {
+  const paths: RmPathToken[] = [];
   let pastSeparator = false;
   let pastRm = false;
   let skipNext = false;
 
-  for (const token of tokens) {
+  for (const token of splitRmTokens(stmt)) {
     if (skipNext) {
       skipNext = false;
       continue;
     }
     if (!pastRm) {
-      if (token === "rm" || token.endsWith("/rm")) pastRm = true;
+      if (token.value === "rm" || token.value.endsWith("/rm")) pastRm = true;
       continue;
     }
-    if (token === "--") {
+    if (token.value === "--" && token.quote === null) {
       pastSeparator = true;
       continue;
     }
-    if (!pastSeparator && token.startsWith("-")) continue;
+    if (!pastSeparator && token.value.startsWith("-") && token.quote === null) continue;
     // Skip shell redirections — handle both joined (2>/dev/null) and spaced (2> /dev/null)
-    if (/^[0-9]*>{1,2}|^&>|^[0-9]*</.test(token)) {
+    if (/^[0-9]*>{1,2}|^&>|^[0-9]*</.test(token.value)) {
       // If the token is ONLY the operator (no target attached), skip the next token too
-      if (/^(?:[0-9]*>{1,2}|&>|[0-9]*<)$/.test(token)) {
+      if (/^(?:[0-9]*>{1,2}|&>|[0-9]*<)$/.test(token.value)) {
         skipNext = true;
       }
       continue;
     }
-    // Strip surrounding quotes — prevents false positives on rm -rf ".pi/tmp/foo"
-    paths.push(token.replace(/^["']|["']$/g, ""));
+    paths.push(token);
   }
 
+  return pastRm ? paths : null;
+}
+
+/** Leading wrapper prefixes that may precede a direct `rm` invocation
+ *  (issue #963). Same family as the bare-shell wrapper alternation in the
+ *  DANGEROUS patterns, but INCLUDES sudo: the absolute-path requirement
+ *  applies to `sudo rm -rf rel` just as much as to bare `rm -rf rel`. */
+// The `--` end-of-options marker is its own alternative that consumes NO
+// value: the old `-.S+` matched `--` and then its optional value slot ate
+// the command itself (`env -- rm -rf x` left `-rf x` with no command token,
+// evading the gate — Qodo PR #964).
+const RM_LEADING_WRAPPERS_RE =
+  /^\s*(?:\S+=\S*\s+|sudo(?:\s+(?:--\S+|--|-(?!-)\S+(?:\s+\S+)?))*\s+|rtk(?:\s+(?:--\S+|-(?!-)\S+))*\s+|(?:command|builtin|exec)\s+|env(?:\s+(?:--\S+|--|-(?!-)\S+(?:\s+\S+)?|\S+=\S*))*\s+|timeout\s+(?:(?:--\S+|--|-(?!-)\S+(?:\s+\S+)?)\s+)*\S+\s+|nice(?:\s+(?:--\S+|--|-(?!-)\S+(?:\s+\S+)?))*\s+|nohup\s+)+/;
+
+/**
+ * First non-absolute target of a direct (optionally wrapped) recursive rm
+ * statement, or null (issue #963). "Absolute" = starts with `/` or `~`.
+ *
+ * find -exec / xargs rm variants return null — their targets come from find
+ * output / stdin, not statement text. Recursive rm with a relative target
+ * must be blocked: a persistent "always allow" approval stores the
+ * statement text, so a relative target would approve the identical text in
+ * ANY directory; an absolute path binds the approval to exactly one folder.
+ */
+export function relativeRecursiveRmTarget(stmt: string): string | null {
+  if (!RM_PATTERN.test(stmt)) return null;
+  // rm must be the COMMAND, not a word inside another command (Qodo PR
+  // #964): `git rm -r --cached build` and `git commit -m "chore: rm -rf
+  // build dir"` previously matched because the tokenizer scanned for `rm`
+  // anywhere — hard-blocking git subcommands and commit messages that the
+  // dangerous-prompt path already handles.
+  const stripped = stmt.replace(/^\(\s*/, "").replace(RM_LEADING_WRAPPERS_RE, "");
+  const firstWord = stripped.trim().split(/\s+/)[0];
+  if (firstWord !== "rm" && !firstWord?.endsWith("/rm")) return null;
+  // find -exec rm / xargs rm carry their targets from find output / stdin.
+  // COMMAND-POSITION only: `rm -rf find` (a directory named find) must stay
+  // blocked (Qodo PR #964) — the old word-boundary test exempted it.
+  if (firstWord === "find" || /(?:^|\|\s*)xargs\s+rm\b/.test(stmt) || /\bfind\b[^|;]*-exec\b/.test(stmt)) {
+    return null;
+  }
+  const paths = parseRmPathTokens(stripped);
+  if (!paths || paths.length === 0) return null;
+  for (const p of paths) {
+    const t = p.value;
+    // Project temp dir by variable: deterministic per-cwd, expanded and
+    // validated by isRmInProjectTmp downstream (Qodo PR #964 — the gate
+    // must not block the documented ${PROJECT_TMP_DIR} cleanup pattern).
+    // ANCHORED (Qodo PR #964 round 3): the variable must END here or be
+    // followed by / — a prefix match let $PROJECT_TMP_DIR_BACKUP skip the
+    // gate. The variable expands unquoted AND inside double quotes.
+    const projTmpVar = /^\$\{PROJECT_TMP_DIR\}(?:$|\/)|^\$PROJECT_TMP_DIR(?![\w$])(?:$|\/)/.test(t);
+    // Traversal and non-literal suffixes drop the exemption (Qodo PR #964
+    // rounds 4-5): a legit temp path never needs ".." (the variable already
+    // points at the tmp root), and its suffix must be LITERAL —
+    // "${PROJECT_TMP_DIR}/$TARGET" with TARGET=../../important expanded
+    // past both the gate and the tmp check while still looking exempt.
+    const suffix = t
+      .replace(/^\$\{PROJECT_TMP_DIR\}/, "")
+      .replace(/^\$PROJECT_TMP_DIR(?![\w$])/, "");
+    const suffixLiteral = !/[$`*?[\]]/.test(suffix) && !t.includes("..");
+    if (projTmpVar && p.quote !== "'" && suffixLiteral) continue;
+    if (p.quote === "'") {
+      // Single quotes: fully literal. A quoted tilde does NOT expand (it
+      // is a relative path), and $/glob chars are inert — only a quoted
+      // absolute path binds to one folder.
+      if (t.startsWith("/")) continue;
+      return t;
+    }
+    if (p.quote === '"') {
+      // Double quotes: tilde does NOT expand (relative → block), but $VAR
+      // and backticks DO — an approval for "/home/$USER/build" must not
+      // bind. Globs are inert inside quotes, so only / $ ` matter.
+      if (t.startsWith("~")) return t;
+      if (/[$`]/.test(t)) return t;
+      if (t.startsWith("/")) continue;
+      return t;
+    }
+    // Unquoted: tilde expands to $HOME (absolute); any expansion or glob
+    // char makes the target non-literal — an approval for
+    // /home/$USER/build or /home/*/build must not bind to varying
+    // directories (Qodo PR #964).
+    if (t.startsWith("~")) continue;
+    if (/[$`*?[\]]/.test(t)) return t;
+    if (t.startsWith("/")) continue;
+    return t;
+  }
+  return null;
+}
+
+/**
+ * Check if a dangerous rm command only targets paths within .pi/tmp/ or /tmp/<something>.
+ * Returns true if the command should be silently allowed.
+ * Note: bare /tmp (without subpath) is NOT allowed — only /tmp/<file-or-folder>.
+ */
+export function isRmInProjectTmp(stmt: string, cwd: string): boolean {
+  // Only applies to direct rm commands, not find/xargs variants
+  if (!RM_PATTERN.test(stmt)) return false;
+
+  // Ensure rm is the actual command, not an argument to another command (e.g., xargs rm)
+  const firstWord = stmt.trim().split(/\s+/)[0];
+  if (firstWord !== "rm" && !firstWord?.endsWith("/rm")) return false;
+
+  // Don't silently allow if the statement also matches other DANGEROUS patterns
+  // (e.g., sudo rm -rf .pi/tmp/foo — sudo should still trigger confirmation)
+  if (/\bsudo\b/i.test(stmt)) return false;
+
+  // Reject statements containing subshells or process substitutions — these could
+  // embed arbitrary commands that bypass the allowlist check
+  if (extractSubshells(stmt).length > 0) return false;
+
+  // Parse arguments: flags, -- separator, redirections (shared tokenizer)
+  const tokens = parseRmPathTokens(stmt);
+
   // Guard against vacuous truth — if no paths extracted, don't silently allow
-  if (paths.length === 0) return false;
+  if (!tokens || tokens.length === 0) return false;
+  const paths = tokens.map((t) => t.value);
 
   // Resolve and substitute PROJECT_TMP_DIR env var
   const projectTmpDir = path.join(cwd, ".pi", "tmp");

package/extensions/orchestrator/enforcement.ts

@@ -54,6 +54,7 @@ import {
   isReadOnlyStatement,
   isRealGitCommitOrPush,
   isRmInProjectTmp,
+  relativeRecursiveRmTarget,
   normalizeForRepeatCheck,
   realGitSub,
   resolveEffectiveCwd,
@@ -437,6 +438,40 @@ async function checkDangerousCommands(command: string, cwd: string, ctx: any): P
     return DANGEROUS.some((p) => p.test(stmt));
   });
   if (hasDangerous) {
+    // Absolute-path requirement for recursive rm (issue #963): a persistent
+    // "always allow" stores the statement TEXT, so a relative target would
+    // approve the identical text in ANY directory. Force the agent to spell
+    // out the full path — the approval then binds to exactly one folder the
+    // user knows. Blocks in every mode (headless included): this is a
+    // rewrite rule, not a confirmation.
+    const relativeRm = statements
+      .map((stmt) => ({
+        stmt,
+        target: isReadOnlyStatement(stmt) ? null : relativeRecursiveRmTarget(stmt),
+      }))
+      .find((r) => r.target !== null);
+    if (relativeRm && relativeRm.target !== null) {
+      log.warn("recursive_rm_relative_path_blocked", { target: relativeRm.target });
+      // A target with unquoted expansion chars ($VAR, globs) is not a literal
+      // folder — echoing it back as the "rewrite" would suggest re-running the
+      // same non-binding command (live battery, Qodo PR #964).
+      const nonLiteral = /[$`*?[\]]/.test(relativeRm.target);
+      const rewrite = nonLiteral
+        ? `Rewrite with a LITERAL full path (no variables or globs — an approval must bind to ` +
+          `one concrete folder) and re-run.`
+        : `Rewrite as rm -rf ${resolve(resolveEffectiveCwd(command, cwd), relativeRm.target)} (full path) and re-run. `;
+      return {
+        block: true,
+        reason:
+          `Blocked: recursive rm must use ABSOLUTE paths — "${relativeRm.stmt.trim()}" targets ` +
+          `"${relativeRm.target}", which is ${nonLiteral ? "not a literal path" : "relative"}. ` +
+          `A persistent "always allow" stores the statement text, so a relative ` +
+          `target would approve the same text in ANY directory. ${rewrite} ` +
+          `Do NOT bypass with an equivalent command (find -delete, git clean, perl, python ` +
+          `os.remove). Stop and report this block to the user if a rewrite is not possible.`,
+      };
+    }
+
     // Allow rm -rf targeting only .pi/tmp/ paths without confirmation
     const allRmInTmp = statements
       .filter((stmt) => DANGEROUS.some((p) => p.test(stmt)) && !isReadOnlyStatement(stmt))

package/extensions/orchestrator/memory-scoring.ts

@@ -674,19 +674,104 @@ const GRANT_PHRASE_RE: RegExp[] = [
   /\b(this|that|specific) (pr|issue|task|ticket|branch)\b/i,
 ];
 
+/** Strip quoted spans for natural-language guardrail text: double-quoted
+ *  spans always; single-quoted spans only when the opening quote is not
+ *  mid-word (excludes contractions like "user's"). Quoting someone else's
+ *  words is not granting or asking them (live-battery false positive,
+ *  issue #961): 'Never tell the user "you can test it live"' must not read
+ *  as a grant. */
+function stripQuotedText(text: string): string {
+  let out = text.replace(/"(?:\\.|[^"\\])*"/g, '""');
+  // Single quotes: opening ' must be at start or after whitespace/bracket —
+  // never directly after a letter (that is a contraction), and the span must
+  // contain a space (a quotation, not a possessive artifact).
+  out = out.replace(/(^|[\s(\[{])'([^']*\s[^']*)'/g, "$1''");
+  return out;
+}
+
 /** Detect one-off grant phrasing (shared by extractor and memory_add guardrail). */
 export function isGrantText(text: string): boolean {
+  // Quoted payloads are stripped first — a quoted example is not a grant.
   // Classification is logged (Qodo 64954ee5): the negation-aware grant
   // patterns decide whether a permission-looking sentence is a durable
   // rule or a one-off grant, and silent decisions left runtime
   // diagnostics blind when the classification changed behavior.
-  const matched = GRANT_PHRASE_RE.find((re) => re.test(text));
+  const stripped = stripQuotedText(text);
+  const matched = GRANT_PHRASE_RE.find((re) => re.test(stripped));
   if (matched) {
     memLog.debug("memory-scoring: grant phrase detected", text.slice(0, 120), matched.source);
   }
   return matched !== undefined;
 }
 
+/** Task-scoped instruction shapes — high-precision only (issue #961).
+ *  These mark an instruction as bound to ONE task, deliverable, or
+ *  version transition, so it is a task attribute or session instruction,
+ *  not a durable memory. Deliberately NARROW: standing rules like
+ *  "When done, commit and push everything" or "After PR merge, switch
+ *  back to main" must NOT match (recurring events, not one-off asks).
+ *  Fuzzy cases are left to the dreaming review / candidate queue, not
+ *  this regex. */
+const TASK_SCOPED_RE: RegExp[] = [
+  // Deliverable asks tied to a completion event: "once it's done I want an
+  // html report", "after this is done, give me a table". Only FIRST-PERSON
+  // wants count (Qodo PR #964): bare make/create/generate/produce also
+  // matched standing workflow rules like "when done, make sure the linter
+  // passes", rejecting durable rules as one-off asks.
+  /\b(?:when|once|after)\b[^.?!]{0,50}\b(?:done|finished|complete[d]?)\b[^.?!]{0,60}\b(?:i (?:want|need|would like|'d like)|give me|send me|show me|make me|(?:produce|generate|create)\b[^.?!]{0,30}\bfor me\b)\b/i,
+  /\bi (?:want|need|would like|'d like)\b[^.?!]{0,60}\b(?:when|once|after)\b[^.?!]{0,50}\b(?:done|finished|complete[d]?)\b/i,
+  // Version-pinned migration steps: "when bumping to 1.4.0, drop the
+  // vendor dir" — a one-time transition checklist, not a standing rule.
+  /\bwhen (?:bump(?:ing)?|upgrad(?:e|ing)|migrat(?:e|ing)|mov(?:e|ing)) to\s+v?\d/i,
+  // Bounded deliverable references: "for this report", "for this task",
+  // "for this PR" (Qodo PR #964: explicit task/PR bounds passed the old
+  // list, so "For this task, always use pnpm" landed as durable).
+  /\bfor this (?:report|summary|document|doc|ticket|task|pr|migration|demo|poc|analysis|investigation|presentation|benchmark)\b/i,
+  // Config-change notes: "every 30min (changed from 1h)" — a change log
+  // entry, not a preference. Category-locked to preferences: durable
+  // lessons/decisions describing a past change legitimately contain the
+  // phrase (Qodo PR #964).
+  /\bchanged from\b/i,
+];
+
+/** Categories whose entries are standing behavioral rules; only these
+ *  are screened by the task-scope and durability gates. Lessons, decisions,
+ *  mistakes, patterns, and completions are OUTCOME records — historical
+ *  facts are legitimately one-time and are stored as such (Qodo PR #964). */
+const STANDING_CATEGORIES = new Set(["preference"]);
+
+/** Detect task-scoped instruction phrasing (shared by extractor and
+ *  memory_add guardrail). High precision, lower recall by design —
+ *  ambiguous shapes go to the candidate queue for dreaming review.
+ *  Quoted payloads are stripped first (quoting is not asking).
+ *  `category` (optional) locks config-change patterns to preferences. */
+export function isTaskScopedText(text: string, category?: string): boolean {
+  const stripped = stripQuotedText(text);
+  const patterns = TASK_SCOPED_RE.filter(
+    (re) =>
+      // "changed from" only rejects preferences: lessons and decisions
+      // describing a past change are exactly what those categories are for.
+      re.source !== "\\bchanged from\\b" || !category || STANDING_CATEGORIES.has(category),
+  );
+  const matched = patterns.find((re) => re.test(stripped));
+  if (matched) {
+    memLog.debug("memory-scoring: task-scoped instruction detected", text.slice(0, 120), matched.source);
+  }
+  return matched !== undefined;
+}
+
+const DURABILITY_MARKERS_RE =
+  /\b(?:always|never|only|prefer(?:s|ence|red)?|from now on|going forward|each time|whenever|every|permanently|exclusively|by default|make it a rule|as a rule)\b/i;
+
+/** Does the text carry an explicit durability marker? A preference is
+ *  durable only when the user marked it (always/never/from now on…) or
+ *  confirmed it — a single unmarked utterance is a guess, not a rule
+ *  (issue #961, live-battery discussion). Unmarked one-timers queue as
+ *  candidates and evaporate unless repeated. */
+export function hasDurabilityMarker(text: string): boolean {
+  return DURABILITY_MARKERS_RE.test(stripQuotedText(text));
+}
+
 /**
  * Extract preference statements from user text.
  * Questions and one-off permission grants are excluded — they are not
@@ -706,9 +791,14 @@ export function extractPreferences(text: string): string[] {
   for (const sentence of sentences) {
     if (sentence.endsWith("?")) continue; // question, not a statement
     if (isGrantText(sentence)) continue; // one-off grant, not a preference
+    if (isTaskScopedText(sentence, "preference")) continue; // task-scoped instruction, not a preference (issue #961)
     if (PREFERENCE_PATTERNS.some((p) => p.test(sentence))) {
-      // Normalize to a clean one-liner
-      const clean = sentence.replace(/\s+/g, " ").slice(0, 100);
+      // Normalize whitespace but keep the FULL sentence (Qodo PR #964): the
+      // 280-char slice still amputated long preferences mid-thought, and
+      // dreaming needs the omitted instructions to distill correctly.
+      // Input length is bounded by the message itself; a generous sanity
+      // cap of 1000 guards against pathological input.
+      const clean = sentence.replace(/\s+/g, " ").slice(0, 1000);
       found.push(clean);
     }
   }

package/extensions/orchestrator/memory-write.ts

@@ -36,6 +36,8 @@ import {
   newEntryId,
   reinforce,
   isGrantText,
+  isTaskScopedText,
+  hasDurabilityMarker,
 } from "./memory-scoring.js";
 import { CATEGORY_TO_TOPIC, MAX_TOPIC_CHARS, readAllTopicEntries, formatTopicLine, findTopicLine, invalidateTopicFileCache } from "./memory-tree.js";
 import { embedEntry, removeEmbedding, vectorSearch } from "./memory-embeddings.js";
@@ -2403,6 +2405,28 @@ export async function addMemoryEntry(cwd: string, input: AddMemoryInput): Promis
     };
   }
 
+  // 2b. Task-scope guardrail (issue #961): task-scoped instructions are task
+  // attributes or session instructions, not durable memories. High-precision
+  // shapes only (deliverable asks tied to a completion event, version-pinned
+  // migration steps, bounded deliverable references, config-change notes) —
+  // the same relative-path logic as the grant gate: a stored approval/rule
+  // must bind to a standing behavior, not to ONE task's deliverable.
+  // Category-locked config-change pattern: lessons/decisions describing a
+  // past change are legitimate outcome records (Qodo PR #964).
+  if (isTaskScopedText(text, category) && input.scope !== "session") {
+    log.info("memory_task_scoped_rejected", { category, text: text.slice(0, 120) });
+    return {
+      status: "rejected",
+      message:
+        `Rejected: "${text}" reads like a task-scoped instruction (e.g. "when done, I want an ` +
+        `html report" or "when bumping to 1.4.0, drop the vendor dir"). ` +
+        `Task-scoped asks belong to the CURRENT task (its description, a task attribute, or a ` +
+        `session instruction) — NOT memory. If the user confirmed a standing rule, rephrase it ` +
+        `as the durable rule itself (e.g. "Always produce an HTML report when a task completes") ` +
+        `without the task-scoped phrasing.`,
+    };
+  }
+
   // 3. Contradiction gate — before dedup, so a permission-flipping near-duplicate
   // is refused rather than silently reinforcing the wrong entry. A conflict is
   // a decision point, not a dead end (issue #915): the model asks the user, and
@@ -2470,6 +2494,37 @@ export async function addMemoryEntry(cwd: string, input: AddMemoryInput): Promis
     log.info("memory_conflict_override", conflict.text.slice(0, 60), `count=${conflicts.length}`);
   }
 
+  // 3b. Durability gate (issue #961, live-battery discussion): a preference
+  // is durable only when the user MARKED it (always/never/from now on…),
+  // pinned it, or confirmed it. A single unmarked utterance is a guess about
+  // intent — the same words are a task instruction when said casually and a
+  // standing rule when said emphatically, and phrasing cannot tell them
+  // apart. Unmarked one-timers belong to the session or the candidate queue
+  // (repetition earns durability); they must not silently apply to all
+  // future work. Outcome categories (lesson, decision, mistake, pattern,
+  // done) are exempt — they record what happened, not standing behavior.
+  // Runs AFTER the contradiction gate so a permission flip reports the
+  // conflict rather than a missing marker, and exempts overrideConflicts —
+  // a user-confirmed rule change is durable by definition.
+  if (
+    category === "preference" &&
+    !input.pinned &&
+    !input.overrideConflicts &&
+    input.scope !== "session" &&
+    !hasDurabilityMarker(text)
+  ) {
+    log.info("memory_unmarked_preference_rejected", { text: text.slice(0, 120) });
+    return {
+      status: "rejected",
+      message:
+        `Rejected: "${text}" carries no durability marker (always, never, prefer, from now on, ` +
+        `by default…). A preference said once, unmarked, is a session instruction — it must not ` +
+        `apply to all future work. Either confirm with the user that it is a standing rule ` +
+        `(then rephrase as the rule itself, e.g. "Always commit and push before reporting done"), ` +
+        `store it with scope=session, or pin it with "remember this".`,
+    };
+  }
+
   const canonicalLine = `- [${category}] ${text}`;
   const topicEntries = readAllTopicEntries(cwd);
 

package/extensions/orchestrator/preference-extractor.ts

@@ -1,53 +1,107 @@
 /**
- * Preference Auto-Extractor — detects user preferences from conversation.
+ * Preference Auto-Extractor — detects user preference statements from
+ * conversation and queues them for dreaming review (issue #961).
  *
- * Listens to user input and routes detected preference statements through the
- * unified memory write path (memory-write.ts, issue #915). Extraction filters
- * out questions and one-off permission grants; the write path enforces the
- * topic cap, near-duplicate dedup, and the contradiction gate — the extractor
- * no longer bypasses any memory_add safeguard.
+ * The extractor no longer lands memories directly. Regex extraction fires
+ * on PHRASE, not meaning, so direct writes stored verbatim sentences —
+ * including half-finished, task-scoped thoughts — as durable preferences
+ * (e.g. "for the tag normalization we should have maping for datadog in
+ * the settings, i always prefer to have", cut mid-sentence at the 100-char
+ * topic-line cap). Candidates now go to
+ * .pi/memory/preference-candidates.jsonl (full sentence, source session)
+ * and dreaming distills/lands only the durable standing preferences.
+ * Questions, one-off grants, and task-scoped instructions are filtered
+ * before queueing; the LLM path (memory_add + guardrails) remains for
+ * immediate capture.
  *
  * Architecture inspired by OpenHuman (https://github.com/tinyhumansai/openhuman).
  * Clean-room TypeScript implementation under MIT — not a code translation.
  */
 
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import fs from "node:fs";
+import { join } from "node:path";
 import { createLogger } from "../shared/logger.js";
-import { extractPreferences, entryHash } from "./memory-scoring.js";
-import { addMemoryEntry } from "./memory-write.js";
+import { extractPreferences } from "./memory-scoring.js";
+import { getProjectMemoryDir } from "./utils.js";
 
 const log = createLogger("memory");
 
 // Debounce: don't extract from every message, only meaningful ones
 const MIN_MESSAGE_LENGTH = 20;
 
-// Cooldown: don't re-extract the same preference within 1 hour. Tracked
-// per pending write and only STAMPED once the write actually lands (added or
-// reinforced) — a rejected write (conflict gate, cap, guardrail) must not
-// suppress the next attempt for an hour (Qodo #14, PR #916).
-const COOLDOWN_MS = 60 * 60 * 1000;
-const recentExtractions = new Map<string, number>();
+// Candidate queue bounds: the file stays small (dreaming consumes it each
+// cycle), but a repo where dreaming never runs must not grow it unbounded.
+const MAX_CANDIDATES = 200;
+const CANDIDATE_FILE = "preference-candidates.jsonl";
 
-// Pending fire-and-forget writes — drained on session shutdown so a write is
-// never lost to process exit (Qodo #13, PR #916).
-const pendingWrites = new Set<Promise<unknown>>();
+export function candidateQueuePath(cwd: string): string {
+  return join(getProjectMemoryDir(cwd), CANDIDATE_FILE);
+}
+
+interface PreferenceCandidate {
+  text: string;
+  sourceSession: string | null;
+  timestamp: string;
+}
+
+function readCandidates(file: string): PreferenceCandidate[] {
+  try {
+    return fs
+      .readFileSync(file, "utf-8")
+      .split("\n")
+      .filter(Boolean)
+      .map((line) => {
+        try {
+          const parsed = JSON.parse(line) as Partial<PreferenceCandidate>;
+          return {
+            text: String(parsed.text ?? ""),
+            sourceSession: parsed.sourceSession ?? null,
+            timestamp: String(parsed.timestamp ?? ""),
+          };
+        } catch {
+          return null; // malformed line — dropped below
+        }
+      })
+      .filter((c): c is PreferenceCandidate => c !== null && c.text.length > 0);
+  } catch {
+    return []; // no file yet
+  }
+}
+
+/** Append a preference candidate for dreaming review. Synchronous by
+ *  design: a single sub-millisecond line append. APPEND-ONLY (Qodo PR
+ *  #964): the old read-modify-write lost a concurrent session's candidate
+ *  when both read the same snapshot and each replaced the whole file.
+ *  `appendFileSync` composes line appends from concurrent writers — the
+ *  read-before-append dedup keeps the common case duplicate-free, and a
+ *  race-window duplicate is harmless (dreaming dedups at distillation).
+ *  The size cap is enforced during dream compaction, not here: a rewrite
+ *  here would reintroduce the lost-update race. */
+export function appendPreferenceCandidate(
+  cwd: string,
+  text: string,
+  sourceSession?: string,
+): "queued" | "duplicate" {
+  const file = candidateQueuePath(cwd);
+  const existing = readCandidates(file);
+  if (existing.some((c) => c.text === text)) return "duplicate";
+  fs.appendFileSync(
+    file,
+    JSON.stringify({ text, sourceSession: sourceSession ?? null, timestamp: new Date().toISOString() }) + "\n",
+  );
+  return "queued";
+}
+
+/** Read the pending preference candidates (used by dreaming tooling/tests). */
+export function readPreferenceCandidates(cwd: string): PreferenceCandidate[] {
+  return readCandidates(candidateQueuePath(cwd));
+}
 
 export function registerPreferenceExtractor(pi: ExtensionAPI): void {
   // Only run in the orchestrator, not in subagents
   if (process.env.PI_SUBAGENT_CHILD === "1") return;
 
-  pi.on("session_shutdown", async () => {
-    if (pendingWrites.size === 0) return;
-    const pending = [...pendingWrites];
-    log.debug("preference-extractor: draining pending memory writes on shutdown", pending.length);
-    try {
-      await Promise.allSettled(pending);
-    } catch {
-      // allSettled never rejects — belt and braces
-    }
-    log.info("preference-extractor: drained pending memory writes", pending.length);
-  });
-
   pi.on("input", (event, ctx) => {
     const text = event.text;
     if (!text || text.length < MIN_MESSAGE_LENGTH) return;
@@ -61,34 +115,16 @@ export function registerPreferenceExtractor(pi: ExtensionAPI): void {
       (ctx as any).sessionManager?.getSessionId?.() || undefined;
 
     for (const pref of preferences) {
-      const hash = entryHash(`- [preference] ${pref}`);
-
-      // Cooldown check (against LANDED writes only)
-      const lastExtracted = recentExtractions.get(hash);
-      if (lastExtracted && Date.now() - lastExtracted < COOLDOWN_MS) continue;
-
-      // Fire-and-forget: the write path may load the embedding model on first
-      // use (~2.7s) — never block user input on it. The promise is tracked so
-      // session_shutdown can drain it before the process exits.
-      const write = addMemoryEntry(ctx.cwd, {
-        text: pref,
-        category: "preference",
-        sourceSession,
-      })
-        .then((result) => {
-          log.info("preference_extracted", pref.slice(0, 60), result.status);
-          // Stamp cooldown only on success — a rejected write must retry
-          if (result.status !== "rejected") {
-            recentExtractions.set(hash, Date.now());
-          }
-        })
-        .catch((err) => {
-          log.warn("preference extraction failed:", err?.message || err);
-        })
-        .finally(() => {
-          pendingWrites.delete(write);
-        });
-      pendingWrites.add(write);
+      try {
+        const status = appendPreferenceCandidate(ctx.cwd, pref, sourceSession);
+        // Routine queue/duplicate writes are debug, not info (Qodo PR
+        // #964): every user message with a preference-shaped sentence
+        // logs here — the queue file itself is the record, and info-level
+        // noise drowns real events. Failures stay warn.
+        log.debug("preference_candidate", status, pref.slice(0, 60));
+      } catch (err) {
+        log.warn("preference candidate queue append failed:", (err as Error)?.message || err);
+      }
     }
   });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-orchestrator-config",
-  "version": "4.18.0",
+  "version": "4.20.0",
   "description": "Orchestrator pattern for pi: specialist subagents, enforcement, code review loop, workflow commands",
   "keywords": [
     "pi-package"

package/prompts/release.md

@@ -65,6 +65,80 @@ Check validations:
 - Working tree must be clean
 - Must be synced with remote
 
+### Scoped Mode Check (after Phase 1)
+
+Check for `release-map.toml` at the repository root (exact filename, repo
+root only).
+
+**If ABSENT:** continue with the standard lockstep flow below, unchanged.
+
+**If PRESENT:** run the SCOPED flow instead of Phases 2–5:
+
+- **Phase S2 — Detection:** `myk-pi-tools release plan --json`. If any
+  package is errored, show the errors and abort — do not bump. The plan
+  only reports WHICH packages changed and their published versions — it
+  does NOT decide the next versions. ALSO inspect `unmapped_changes` in
+  the plan JSON — ALWAYS, before any other decision: files that changed
+  but belong to no package, exclude, or container rebuild-path. If
+  non-empty, show them to the user as text IMMEDIATELY (a changed file
+  that ships nowhere silently is the broken failure mode) — map the
+  path (edit `release-map.toml`) or consciously accept it as
+  release-inert. This display is NOT part of Phase S4 approval: it
+  happens even when an explicit version was given and even when no
+  packages are affected. Then, if no packages are affected, report
+  "nothing to release — no package changed since its last publish"
+  (plus the unmapped list, if any) and stop.
+- **Phase S3 — Changelog + version proposals:** generate the changelog
+  with the standard Phase 3 rules, EXCEPT the commit window: scoped
+  repos have per-package tags (`name@version`), so do NOT anchor the
+  changelog on `release info`'s `last_tag` or its version-branch tag
+  filter (`v2.10.*` inference finds no per-package tags and would treat
+  the run as a first release) — anchor on each affected package's own
+  `anchor` from the plan JSON. Then, for EACH affected package, YOU
+  (the LLM) decide the next version. IMPORTANT: a package's history
+  reaches back to ITS last publish, which may predate the last repo tag
+  — do NOT rely on the changelog alone. For each affected package run
+  `git log <anchor>..HEAD --format="%h %s%n%b" -- <its mapped paths>`
+  (the plan's JSON carries each package's `anchor` and `changed_files`)
+  and apply the standard semver rules to THOSE commits (`feat:` →
+  minor, `fix:` → patch, breaking → major). Read FULL messages, not
+  just subjects — a `BREAKING CHANGE:` footer lives in the commit body
+  and forces major even under a `feat:`/`fix:` subject. The plan does NOT propose versions — you
+  do. An explicit version argument (`/release X.Y.Z`) instead sets EVERY
+  affected package to that version, skipping per-package decisions.
+  Each package versions from ITS OWN registry history only — a package
+  skipped for N releases takes the next version after its own last
+  publish (e.g. 4.18.0 → 4.19.0), never a jump past the global tag
+  sequence.
+- **Phase S4 — Approval:** skip the `ask_user` entirely if an explicit
+  version was provided in the raw arguments (same contract as lockstep
+  Phase 4 — the unmapped-changes display already happened in S2).
+  Otherwise: show the changelog, the per-package version
+  proposals (`current → proposed`), the plan's skipped-packages list,
+  AND any `unmapped_changes` files as text — the human validates the
+  detection on every scoped release (a package wrongly skipped is the
+  broken failure mode). Then a short `ask_user`: `Release?` with
+  options `yes`, `no`, plus one override option per package in the form
+  `<name>: <level>` (e.g. `myk-pi-tools: minor`) so the user can adjust
+  any package's level before confirming.
+- **Phase S5 — Bump:** `myk-pi-tools release bump-scoped --json` with
+  one `--set <name>=<version>` per affected package carrying YOUR final
+  proposed versions (after any user overrides). Use `--version X.Y.Z`
+  instead when the user passed an explicit version. Parse the JSON:
+  stage ONLY the files in `updated[]`; each entry in `packages[]`
+  carries its per-package `tag` (`<name>@<version>`). Bump PR, merge,
+  and branch sync follow the standard Phase 5 delegation (git-expert /
+  github-expert), with the bump PR message `chore: bump version to
+  <name1>@<v1>[, <name2>@<v2>...]` (keep the `chore: bump version`
+  prefix — it is filtered from changelogs).
+- **Phase S6/S7:** release create ONE GitHub RELEASE PER SHIPPED
+  PACKAGE, tag `<name>@<version>` from the bump JSON, same changelog
+  body (including the Shipped packages section), and PASS
+  `--title "<name> <version>"` explicitly — without it the release
+  title defaults to the raw `name@version` tag. Tags are per-package
+  and cannot collide — there is no repo-wide `v<TAG>` in scoped mode.
+  Summary lists each release URL and per-package versions.
+
 ### Phase 2: Version Detection
 
 ```bash

package/rules/35-memory.md

@@ -43,6 +43,14 @@ When a correction is mechanical (can be checked by code), add `trigger` + `actio
 Never `memory_add` them. The write path rejects grant phrasing and contradictions of pinned entries.
 Only standing, repeated rules are durable.
 
+**Task-scoped instructions are NOT memories** (issue #961). "When done, I want an HTML report",
+"when bumping to 1.4.0, drop the vendor dir", "every 30min (changed from 1h)" — deliverable formats,
+one-time migration steps, and config-change notes belong to the current task (its description or a
+session instruction), never to memory. The write path rejects task-scoped phrasing.
+
+**Apply the standing test before storing any preference:** would it apply to a future, unrelated task?
+No → it is a session instruction or a task attribute, not a memory.
+
 **Conflicts are decision points, not dead ends.** When `memory_add` reports a contradiction:
 
 1. Ask the user (`ask_user`) which rule is correct — never decide for them.
@@ -127,8 +135,9 @@ The situation report header shows usage: `# Project Memory [72% — 1,224/1,700
 | PR merged | `done` | Learned |
 | User corrects you | `lesson` | Learned |
 | Multiple fix attempts | `mistake` | Learned |
-| User states a preference | `preference` | Learned |
+| User states a preference that passes the standing test | `preference` | Learned |
 | User grants a one-off permission ("you can merge this PR") | — | **NOT a memory** — session instruction only |
+| User asks for a one-off deliverable/format ("when done, I want an html report") | — | **NOT a memory** — task attribute or session instruction |
 
 ---
 
@@ -180,6 +189,8 @@ If it's knowledge that informs decisions but can't be checked mechanically — p
 - Unfinished conversations where no conclusion was reached
 - User requirements that were never implemented
 - One-off permissions granted for a specific PR, task, or session — session instructions, not durable rules
+- Task-scoped instructions: deliverable formats for the current task, one-time migration steps,
+  session config notes — task attributes or session instructions, not durable rules
 
 Only memorize **outcomes** (what happened), not **intentions** (what was discussed but dropped).
 
@@ -212,6 +223,9 @@ agent.
 
 **Dreaming follows the same NEVER memorize rules as per-turn self-improvement:**
 do NOT extract rejected/abandoned ideas, unfinished conversations, or unimplemented requirements.
+Do NOT extract one-off permissions or task-scoped instructions (deliverable formats, one-time
+migration steps, config-change notes) — dreaming also distills the preference candidate queue
+(`.pi/memory/preference-candidates.jsonl`) into durable standing preferences and discards the rest.
 Only extract outcomes, not intentions.
 
 ---

package/rules/40-critical-rules.md

@@ -114,6 +114,14 @@ Skip when the user explicitly says "skip audit", has previously approved the sou
 
 ---
 
+## Truncated Command Output (rtk)
+
+When command output contains `[+N hidden: rtk recall <id>]` and you need the hidden results,
+run `rtk recall <id>` to retrieve them — never re-run the command or bypass with path-qualified
+binaries (`/usr/bin/grep`). If the hidden data is irrelevant, continue normally.
+
+---
+
 ## Temp Files
 
 All temp files go to `.pi/tmp/` via `getProjectTmpDir(cwd)` — NEVER create temp files directly in the project tree.