pi-plans 0.6.0 → 0.7.0

package/src/tasks.ts

@@ -0,0 +1,189 @@
+/**
+ * Task-tree runtime model (v0.6.1): the execution phase tracks plan tasks
+ * (`## Tasks`) as the unit of progress. Status flows in exclusively through
+ * the task status tool; completion of the whole run is gated by the
+ * independent completion auditor over the plan's verification checks.
+ */
+
+import type { CheckItem, PlanTasks, TaskNode, WaveEntry } from "./plan.ts";
+import { extractTaskCoverage, flattenTasks, resolveTaskWaves } from "./plan.ts";
+
+export type TaskStatus = "pending" | "complete" | "skipped";
+
+export interface TaskProgress {
+	status: TaskStatus;
+	/** Evidence recorded with the completion/skip (tool call payload). */
+	evidence?: string;
+	/** Skip reason, present only for skipped tasks. */
+	skipReason?: string;
+}
+
+/** Runtime view of one task node: plan metadata merged with live status. */
+export interface TaskView {
+	id: string;
+	title: string;
+	wave: number;
+	deps: string[];
+	files: string[];
+	status: TaskStatus;
+	evidence?: string;
+	skipReason?: string;
+	children: TaskView[];
+}
+
+/** Serializable progress map persisted in the run checkpoint. */
+export type TaskProgressMap = Record<string, TaskProgress>;
+
+/** Build the runtime task tree from parsed plan tasks + persisted progress. */
+export function buildTaskView(planTasks: PlanTasks, progress?: TaskProgressMap): TaskView[] {
+	const waves = resolveTaskWaves(planTasks);
+	const build = (node: TaskNode): TaskView => {
+		const state = progress?.[node.id];
+		const children = node.children.map(build);
+		return {
+			id: node.id,
+			title: node.title,
+			wave: waves.get(node.id) ?? 1,
+			deps: node.deps,
+			files: node.files,
+			status: state?.status ?? "pending",
+			evidence: state?.evidence,
+			skipReason: state?.skipReason,
+			children,
+		};
+	};
+	return planTasks.tasks.map(build);
+}
+
+export function flattenTaskViews(tasks: TaskView[]): TaskView[] {
+	const out: TaskView[] = [];
+	for (const t of tasks) {
+		out.push(t);
+		out.push(...flattenTaskViews(t.children));
+	}
+	return out;
+}
+
+/** A task counts as terminal when it is skipped, or complete together with
+ * every child (parents close last; an open child reopens the parent for
+ * scheduling purposes even if the parent itself reported complete). */
+export function taskIsTerminal(task: TaskView): boolean {
+	if (task.status === "skipped") return true;
+	if (task.status !== "complete") return false;
+	return task.children.every((child) => taskIsTerminal(child));
+}
+
+export function allTasksTerminal(tasks: TaskView[]): boolean {
+	return flattenTaskViews(tasks).length > 0 && flattenTaskViews(tasks).every((task) => taskIsTerminal(task));
+}
+
+/** Snapshot of statuses for persistence and stall detection. */
+export function taskProgressMap(tasks: TaskView[]): TaskProgressMap {
+	const map: TaskProgressMap = {};
+	for (const task of flattenTaskViews(tasks)) {
+		if (task.status === "pending" && task.evidence === undefined && task.skipReason === undefined) continue;
+		map[task.id] = {
+			status: task.status,
+			evidence: task.evidence,
+			skipReason: task.skipReason,
+		};
+	}
+	return map;
+}
+
+/** Progress aggregation for the dashboard: done counts terminal tasks. */
+export function taskProgress(tasks: TaskView[]): { done: number; total: number } {
+	const flat = flattenTaskViews(tasks);
+	return {
+		done: flat.filter((task) => taskIsTerminal(task)).length,
+		total: flat.length,
+	};
+}
+
+/** The current task: the first non-terminal task in wave order, then
+ * document order (top-level-first; subtasks close before their parent is
+ * re-listed). Deterministic; used for the ▸ anchor in the dashboard and
+ * the per-turn injection. */
+export function currentTask(tasks: TaskView[]): TaskView | null {
+	const flat = flattenTaskViews(tasks);
+	const open = flat.filter((task) => !taskIsTerminal(task));
+	if (open.length === 0) return null;
+	open.sort((a, b) => (a.wave - b.wave) || (flat.indexOf(a) - flat.indexOf(b)));
+	return open[0] ?? null;
+}
+
+/** Tasks of one wave (top-level only — children belong to their parent). */
+export function waveTasks(tasks: TaskView[], wave: number): TaskView[] {
+	return tasks.filter((task) => task.wave === wave);
+}
+
+export function maxWave(tasks: TaskView[]): number {
+	return flattenTaskViews(tasks).reduce((max, task) => Math.max(max, task.wave), 1);
+}
+
+/** Legal status transitions for the task status tool: pending may close
+ * (complete/skipped); closed states are immutable except through the
+ * completion-audit flow (never through the task tool). */
+export function canTransition(task: TaskView, next: TaskStatus): boolean {
+	if (task.status === next) return false;
+	if (task.status === "pending") return next === "complete" || next === "skipped";
+	return false;
+}
+
+/** Rollback set for a failed verification check: every task in its covers
+ * clause (parents cascade to their children, skipped tasks reopen too).
+ * Returns the ids that actually reopen. */
+export function auditRollbackSet(
+	tasks: TaskView[],
+	checklist: CheckItem[],
+	vcId: string,
+): string[] {
+	const vc = checklist.find((item) => item.id === vcId);
+	if (!vc) return [];
+	const covered = new Set(extractTaskCoverage(vc.text));
+	const flat = flattenTaskViews(tasks);
+	const reopen: string[] = [];
+	const reopenNode = (node: TaskView): void => {
+		if (node.status !== "pending") {
+			node.status = "pending";
+			node.evidence = undefined;
+			node.skipReason = undefined;
+			reopen.push(node.id);
+		}
+		for (const child of node.children) reopenNode(child);
+	};
+	for (const node of flat) {
+		if (covered.has(node.id)) reopenNode(node);
+	}
+	return reopen;
+}
+
+/** Verification checks that cover no task are excluded from audit (their
+ * pass state cannot be derived from task statuses). */
+export function auditableChecks(checklist: CheckItem[], tasks: TaskView[]): CheckItem[] {
+	const known = new Set(flattenTaskViews(tasks).map((task) => task.id));
+	return checklist.filter((item) => {
+		const covered = extractTaskCoverage(item.text);
+		return covered.length > 0 && covered.some((id) => known.has(id));
+	});
+}
+
+/** Checks with at least one skipped covered task whose remaining covered
+ * tasks are all complete (I-007: a skip whose siblings carry the delivery
+ * passes without an audit round). Pure-complete and pure-pending coverages
+ * are NOT presolved here — the former the audit affirms, the latter cannot
+ * arise once all tasks are terminal. */
+export function skippedPassCheckIds(checklist: CheckItem[], tasks: TaskView[]): string[] {
+	const byId = new Map(flattenTaskViews(tasks).map((task) => [task.id, task]));
+	return auditableChecks(checklist, tasks)
+		.filter((item) => {
+			const covered = extractTaskCoverage(item.text).filter((id) => byId.has(id));
+			if (covered.length === 0) return false;
+			const statuses = covered.map((id) => byId.get(id)!.status);
+			return statuses.includes("skipped")
+				&& statuses.every((status) => status === "skipped" || status === "complete");
+		})
+		.map((item) => item.id);
+}
+
+export type { PlanTasks, TaskNode, WaveEntry };

package/src/thinking-levels.ts

@@ -0,0 +1,67 @@
+/**
+ * Thin thinking-level adapter over pi-ai's exported helpers.
+ *
+ * pi-ai already owns the level domain rules (`getSupportedThinkingLevels`:
+ * non-reasoning models only support "off"; a null mapping disables a level;
+ * xhigh/max appear only when explicitly mapped). Re-implementing them here
+ * would drift — this module only adds the pi-plans "default" sentinel and
+ * the stored-level resolution used by the reviewer spawn path (F-012).
+ *
+ * Semantics (decision 4 / F-009): `thinking_level: null` in the global
+ * reviewer config means DEFAULT — the child pi gets NO --thinking flag and
+ * resolves its own default chain (per-model settings → defaultThinkingLevel
+ * → medium, then model clamping). That is deliberately distinct from the
+ * explicit "off" level.
+ */
+
+import { getSupportedThinkingLevels, type Model, type ModelThinkingLevel } from "@earendil-works/pi-ai";
+import type { GlobalRoleConfig, ThinkingLevelValue } from "./global-state.ts";
+
+/** Panel/label sentinel for `thinking_level: null` (omit --thinking). */
+export const DEFAULT_LEVEL_SENTINEL = "default";
+
+/** Levels a model actually supports, via pi-ai (single source of truth). */
+export function levelsForModel(model: Pick<Model<any>, "reasoning" | "thinkingLevelMap">): ModelThinkingLevel[] {
+	return getSupportedThinkingLevels(model);
+}
+
+/** True when the stored level is supported by the model (spawn passes it
+ * through verbatim; unsupported stored levels are clamped by the child). */
+export function isLevelSupported(
+	model: Pick<Model<any>, "reasoning" | "thinkingLevelMap">,
+	level: string | null,
+): boolean {
+	if (level === null) return true; // default: no flag, always valid
+	return levelsForModel(model).includes(level as ModelThinkingLevel);
+}
+
+/** Resolve the CLI argument for the stored level: null → omit the flag. */
+export function spawnThinkingFlag(level: ThinkingLevelValue | null): string | null {
+	return level ?? null;
+}
+
+/** Display label for the reviewer overlay and subagents ledger. */
+export function roleModelLabel(modelSelector: string, thinkingLevel: ThinkingLevelValue | null): string {
+	return `${modelSelector}:${thinkingLevel ?? DEFAULT_LEVEL_SENTINEL}`;
+}
+
+/** Human-facing one-liner for the default row / docs (F-009): the default
+ * is the child pi's own chain, NOT the current session's level. */
+export const DEFAULT_LEVEL_DESCRIPTION =
+	"no --thinking flag: the child pi resolves its default (per-model settings → defaultThinkingLevel → medium)";
+
+/** Spawn-view of a confirmed reviewer role: concrete model + optional level. */
+export interface ResolvedReviewerSpawn {
+	modelSelector: string;
+	thinkingLevel: ThinkingLevelValue | null;
+	label: string;
+}
+
+export function resolveReviewerSpawn(role: Pick<GlobalRoleConfig, "model_selector" | "thinking_level">): ResolvedReviewerSpawn {
+	const modelSelector = role.model_selector ?? "";
+	return {
+		modelSelector,
+		thinkingLevel: role.thinking_level ?? null,
+		label: modelSelector ? roleModelLabel(modelSelector, role.thinking_level ?? null) : "unconfirmed",
+	};
+}

package/src/ui-language.ts

@@ -1,10 +1,9 @@
 /**
  * Single source of truth for user-visible UI chrome language (issue #3).
  *
- * Workspace `language.tag` (`.git/pi_plans/config.json`) selects the chrome
- * strings for every user-visible surface: the batch form (src/ask-form.ts),
- * the refine/refs overlay footer (src/refine-ui.ts), the status panel
- * (src/panel.ts) and the execution status line (src/exec.ts).
+ * Workspace `language.tag` (`.git/pi-plans/config.json`) selects the chrome
+ * strings for every user-visible surface: the batch form (src/ask-form.ts)
+ * and the refine/refs overlay footer (src/refine-ui.ts).
  *
  * Mapping follows RFC 4647 primary-subtag fallback (zh-Hant-CN → zh-Hant →
  * zh), so every `zh*` tag renders the existing Simplified strings verbatim.
@@ -125,54 +124,4 @@ export function refineChrome(lang: UiLanguage): RefineChrome {
 	return REFINE_CHROME[lang];
 }
 
-// ---------------------------------------------------------------------------
-// Status panel chrome (src/panel.ts) — implWarning branch only.
-// ---------------------------------------------------------------------------
-
-export interface PanelChrome {
-	badgeStatus(topic: string, vcDone: number, vcTotal: number): string;
-	progressWarning(): string;
-	summaryWarning(topic: string, vcDone: number, vcTotal: number, nextAction: string): string;
-}
-
-const PANEL_CHROME: Record<UiLanguage, PanelChrome> = {
-	zh: {
-		badgeStatus: (topic, vcDone, vcTotal) => `${topic} · ⚠ I 解析 0 项 · VC ${vcDone}/${vcTotal}`,
-		progressWarning: () => `⚠ plan 格式：Implementation Items 解析 0 项（面板无法计 I 进度）`,
-		summaryWarning: (topic, vcDone, vcTotal, nextAction) =>
-			`plans: ${topic} ▸ ⚠ Implementation Items 解析 0 项 · VC ${vcDone}/${vcTotal} · next: ${nextAction}`,
-	},
-	en: {
-		badgeStatus: (topic, vcDone, vcTotal) => `${topic} · ⚠ I parse 0 items · VC ${vcDone}/${vcTotal}`,
-		progressWarning: () => `⚠ plan format: Implementation Items parsed 0 items (I progress cannot be counted)`,
-		summaryWarning: (topic, vcDone, vcTotal, nextAction) =>
-			`plans: ${topic} ▸ ⚠ Implementation Items parsed 0 items · VC ${vcDone}/${vcTotal} · next: ${nextAction}`,
-	},
-};
-
-export function panelChrome(lang: UiLanguage): PanelChrome {
-	return PANEL_CHROME[lang];
-}
-
-// ---------------------------------------------------------------------------
-// Execution status line chrome (src/exec.ts) — goal-wait segment.
-// ---------------------------------------------------------------------------
-
-export interface ExecChrome {
-	goalWait(noProgressRounds: number, waitRounds: number): string;
-}
-
-const EXEC_CHROME: Record<UiLanguage, ExecChrome> = {
-	zh: {
-		goalWait: (noProgressRounds, waitRounds) =>
-			` · 🔁 goal-wait · 无进展 ${noProgressRounds}/3 · 等待 ${waitRounds}/6`,
-	},
-	en: {
-		goalWait: (noProgressRounds, waitRounds) =>
-			` · 🔁 goal-wait · no progress ${noProgressRounds}/3 · waiting ${waitRounds}/6`,
-	},
-};
 
-export function execChrome(lang: UiLanguage): ExecChrome {
-	return EXEC_CHROME[lang];
-}

package/src/workflow-state.ts

@@ -145,8 +145,15 @@ export interface ExecutionCheckpoint {
 	/** True when this approval/progress was produced in a different (origin) worktree. */
 	originWorktree?: string;
 	/** v0.6.0: set while a delegated executor child owns the implementation;
-	 * stale after a restart (orphaned delegate — the child died with the parent). */
+	 * stale after a restart (orphaned delegate — the child died with the parent).
+	 * Removed with delegated execution in v0.6.1; read-tolerated on legacy checkpoints. */
 	delegate?: { modelSelector: string; startedAt: string };
+	/** v0.6.1: task-tree progress (task id → status/evidence), the primary
+	 * progress record. doneVcIds stays for legacy checkpoints and the final
+	 * audit pass. */
+	tasks?: Record<string, { status: string; evidence?: string; skipReason?: string }>;
+	/** v0.6.1: completion-audit bookkeeping (rounds, last failed set, pass). */
+	audit?: { rounds: number; lastResult?: string; passed?: boolean };
 }
 
 export interface OwnerInfo {
@@ -454,7 +461,7 @@ function asExecution(value: unknown, label: string): ExecutionCheckpoint {
 	const record = asRecord(value, label);
 	rejectExtraKeys(
 		record,
-		new Set(["approval", "doneVcIds", "implStatus", "currentI", "usage", "pausedReason", "reverifyAll", "originWorktree", "delegate"]),
+		new Set(["approval", "doneVcIds", "implStatus", "currentI", "usage", "pausedReason", "reverifyAll", "originWorktree", "delegate", "tasks", "audit"]),
 		label,
 	);
 	const execution: ExecutionCheckpoint = {
@@ -484,6 +491,30 @@ function asExecution(value: unknown, label: string): ExecutionCheckpoint {
 			startedAt: asString(delegate.startedAt, `${label}.delegate.startedAt`),
 		};
 	}
+	if (record.tasks !== undefined && record.tasks !== null) {
+		const tasksRecord = asRecord(record.tasks, `${label}.tasks`);
+		const tasks: NonNullable<ExecutionCheckpoint["tasks"]> = {};
+		for (const [id, raw] of Object.entries(tasksRecord)) {
+			const entry = asRecord(raw, `${label}.tasks.${id}`);
+			rejectExtraKeys(entry, new Set(["status", "evidence", "skipReason"]), `${label}.tasks.${id}`);
+			const status = asEnum(entry.status, new Set(["pending", "complete", "skipped"]), `${label}.tasks.${id}.status`);
+			const item: { status: string; evidence?: string; skipReason?: string } = { status };
+			if (entry.evidence !== undefined) item.evidence = asString(entry.evidence, `${label}.tasks.${id}.evidence`);
+			if (entry.skipReason !== undefined) item.skipReason = asString(entry.skipReason, `${label}.tasks.${id}.skipReason`);
+			tasks[id] = item;
+		}
+		execution.tasks = tasks;
+	}
+	if (record.audit !== undefined && record.audit !== null) {
+		const audit = asRecord(record.audit, `${label}.audit`);
+		rejectExtraKeys(audit, new Set(["rounds", "lastResult", "passed"]), `${label}.audit`);
+		const parsed: { rounds: number; lastResult?: string; passed?: boolean } = {
+			rounds: asInt(audit.rounds, `${label}.audit.rounds`, 0),
+		};
+		if (audit.lastResult !== undefined) parsed.lastResult = asString(audit.lastResult, `${label}.audit.lastResult`);
+		if (audit.passed !== undefined) parsed.passed = asBool(audit.passed, `${label}.audit.passed`);
+		execution.audit = parsed;
+	}
 	return execution;
 }
 
@@ -1000,19 +1031,6 @@ export function applyReviewConsolidated(cp: WorkflowCheckpoint, roundId: string,
 	return { ...cp, reviewRounds: cp.reviewRounds.map((entry) => (entry.roundId === roundId ? nextRound : entry)) };
 }
 
-/** F-004: `completed` requires explicit evidence; approval cannot be forged by state writes. */
-export function applyCompleted(cp: WorkflowCheckpoint, evidence: string): WorkflowCheckpoint {
-	if (cp.phase !== "implementation-review") {
-		throw new StateError(`cannot complete from phase "${cp.phase}"`);
-	}
-	const review = cp.implementationReview;
-	if (!review || review.terminationCondition === undefined) {
-		throw new StateError("cannot complete without a recorded termination condition");
-	}
-	if (evidence.trim() === "") throw new StateError("completion requires non-empty evidence");
-	return { ...cp, phase: "completed", nextAction: "none" };
-}
-
 export function applyExecutionApproved(cp: WorkflowCheckpoint, approval: ExecutionApproval): WorkflowCheckpoint {
 	// F-007 (implementation review): terminal and review phases cannot approve
 	// execution; a re-approval (stop/migration reset approval to null) is legal
@@ -1036,6 +1054,8 @@ export function applyExecutionApproved(cp: WorkflowCheckpoint, approval: Executi
 			doneVcIds: [],
 			implStatus: {},
 			usage: { inToks: 0, outToks: 0 },
+			tasks: {},
+			audit: { rounds: 0 },
 		},
 	};
 }
@@ -1048,6 +1068,10 @@ export interface ExecutionProgressInput {
 	pausedReason?: string | null;
 	/** v0.6.0: set/clear the delegated-executor record; null clears it. */
 	delegate?: { modelSelector: string; startedAt: string } | null;
+	/** v0.6.1: task-tree progress snapshot (authoritative). */
+	tasks?: Record<string, { status: string; evidence?: string; skipReason?: string }>;
+	/** v0.6.1: completion-audit bookkeeping update. */
+	audit?: { rounds: number; lastResult?: string; passed?: boolean };
 }
 
 export function applyExecutionProgress(cp: WorkflowCheckpoint, progress: ExecutionProgressInput): WorkflowCheckpoint {
@@ -1066,6 +1090,8 @@ export function applyExecutionProgress(cp: WorkflowCheckpoint, progress: Executi
 	else if (progress.pausedReason !== undefined) execution.pausedReason = progress.pausedReason;
 	if (progress.delegate === null) delete execution.delegate;
 	else if (progress.delegate !== undefined) execution.delegate = progress.delegate;
+	if (progress.tasks !== undefined) execution.tasks = progress.tasks;
+	if (progress.audit !== undefined) execution.audit = progress.audit;
 	return { ...cp, execution };
 }
 
@@ -1077,45 +1103,18 @@ export function applyExecutionHeadChanged(cp: WorkflowCheckpoint): WorkflowCheck
 
 export function applyExecutionCompleted(cp: WorkflowCheckpoint): WorkflowCheckpoint {
 	if (cp.phase !== "executing" || !cp.execution) throw new StateError("requires phase \"executing\"");
+	// v0.6.1 (D-018): the post-execution amelioration loop is gone; a
+	// completed audit passes the run straight to the terminal phase.
 	return {
 		...cp,
-		phase: "implementation-review",
-		nextAction: "ask-question",
-		execution: { ...cp.execution, pausedReason: undefined },
-	};
-}
-
-export function applyImplementationReviewConfigured(
-	cp: WorkflowCheckpoint,
-	terminationCondition: string,
-	reviewerCount?: number,
-): WorkflowCheckpoint {
-	if (cp.phase !== "implementation-review") throw new StateError("requires phase \"implementation-review\"");
-	if (cp.implementationReview?.terminationCondition !== undefined) {
-		throw new StateError("termination condition already configured; do not re-ask");
-	}
-	return {
-		...cp,
-		implementationReview: {
-			terminationCondition,
-			reviewerCount,
-			completedRounds: cp.implementationReview?.completedRounds ?? 0,
+		phase: "completed",
+		nextAction: "none",
+		execution: {
+			...cp.execution,
+			pausedReason: undefined,
+			delegate: undefined,
+			audit: { ...(cp.execution.audit ?? { rounds: 0 }), passed: true },
 		},
-		nextAction: "run-review",
-	};
-}
-
-export function applyImplementationRoundFinished(cp: WorkflowCheckpoint): WorkflowCheckpoint {
-	if (cp.phase !== "implementation-review" || !cp.implementationReview) {
-		throw new StateError("requires phase \"implementation-review\"");
-	}
-	const review = cp.implementationReview;
-	if (review.currentRoundId === undefined) throw new StateError("no current round to finish");
-	const round = cp.reviewRounds.find((entry) => entry.roundId === review.currentRoundId);
-	if (!round || !round.consolidated) throw new StateError("current round is not consolidated");
-	return {
-		...cp,
-		implementationReview: { ...review, completedRounds: review.completedRounds + 1, currentRoundId: undefined },
 	};
 }
 
@@ -1135,12 +1134,16 @@ export function applyMigration(
 		migration: { fromWorktree: cp.worktreeRoot, migratedAt: utcNow() },
 		execution: cp.execution
 			? {
-					approval: null,
-					doneVcIds: [],
-					implStatus: {},
-					usage: cp.execution.usage,
-					originWorktree: cp.execution.originWorktree ?? cp.worktreeRoot,
-				}
+				approval: null,
+				doneVcIds: [],
+				implStatus: {},
+				usage: cp.execution.usage,
+				originWorktree: cp.execution.originWorktree ?? cp.worktreeRoot,
+				// v0.6.1: task progress and audit state do not survive a worktree
+				// migration (same rule as VC validity).
+				tasks: {},
+				audit: { rounds: 0 },
+			}
 			: undefined,
 		implementationReview: cp.implementationReview
 			? {
@@ -1164,7 +1167,9 @@ function migrationNextAction(cp: WorkflowCheckpoint): NextAction {
 export function applyExecutionStopped(cp: WorkflowCheckpoint, reason: string): WorkflowCheckpoint {
 	if (cp.phase !== "executing" || !cp.execution) throw new StateError("requires phase \"executing\"");
 	const { delegate: _delegate, ...execution } = cp.execution;
-	return { ...cp, execution: { ...execution, pausedReason: reason } };
+	// A stop also revokes any outstanding audit-rollback authorization.
+	const audit = execution.audit ? { ...execution.audit } : undefined;
+	return { ...cp, execution: { ...execution, audit, pausedReason: reason } };
 }
 
 // ---------------------------------------------------------------------------

package/tests/analyze-refs.test.ts

@@ -12,13 +12,22 @@ import { initState, setRole, setLanguage, startRun, readActive } from "../src/st
 const ROOT = path.dirname(path.dirname(url.fileURLToPath(import.meta.url)));
 
 let tmpRoot: string;
+let globalDir: string;
+let previousGlobalDir: string | undefined;
 
 before(() => {
 	tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), "pi-plans-analyze-refs-"));
+	// Isolate the global reviewer config (F-002): never touch ~/.pi/pi-plans.
+	previousGlobalDir = process.env.PI_PLANS_GLOBAL_DIR;
+	globalDir = fs.mkdtempSync(path.join(os.tmpdir(), "pi-plans-global-analyze-refs-"));
+	process.env.PI_PLANS_GLOBAL_DIR = globalDir;
 });
 
 after(() => {
+	if (previousGlobalDir === undefined) delete process.env.PI_PLANS_GLOBAL_DIR;
+	else process.env.PI_PLANS_GLOBAL_DIR = previousGlobalDir;
 	fs.rmSync(tmpRoot, { recursive: true, force: true });
+	fs.rmSync(globalDir, { recursive: true, force: true });
 });
 
 function mkWorkdir(name: string): string {
@@ -102,7 +111,7 @@ function subagentLines(workdir: string): Array<any> {
 		.map((line) => JSON.parse(line));
 }
 
-describe("analyze_refs gates", () => {
+	describe("analyze_refs gates", () => {
 	it("refuses when no pi-plans state exists", async () => {
 		const workdir = mkWorkdir("gates-no-state");
 		const tool = loadTool();
@@ -112,35 +121,43 @@ describe("analyze_refs gates", () => {
 		);
 	});
 
-	it("refuses with role-setting guidance when reviewer mode is invalid", async () => {
-		const workdir = mkWorkdir("gates-bad-mode");
+	it("refuses with embedded text guidance when the reviewer model is unconfirmed (headless)", async () => {
+		const workdir = mkWorkdir("gates-unconfirmed");
 		initState(workdir);
-		const configPath = path.join(workdir, ".git", "pi_plans", "config.json");
-		const config = JSON.parse(fs.readFileSync(configPath, "utf8"));
-		config.reviewer.mode = "bogus";
-		fs.writeFileSync(configPath, `${JSON.stringify(config, null, "\t")}\n`, "utf8");
 		const tool = loadTool();
 		await assert.rejects(
 			tool.execute("c1", { refs: [{ id: "ref-1", localPath: "." }] }, undefined, undefined, headlessCtx(workdir)),
-			/reviewer role mode is missing or invalid/,
+			/model was never confirmed/,
 		);
 	});
 
-	it("refuses current-session reviewer mode with a switch-to-delegated message", async () => {
+	it("ignores the reviewer mode entirely (Q-4=B): current-session proceeds once a model is confirmed", async () => {
 		const workdir = mkWorkdir("gates-current-session");
 		initState(workdir);
-		setRole(workdir, { role: "reviewer", mode: "current-session" });
-		const tool = loadTool();
-		await assert.rejects(
-			tool.execute("c1", { refs: [{ id: "ref-1", localPath: "." }] }, undefined, undefined, headlessCtx(workdir)),
-			/current-session.*delegated-subagent/s,
+		setRole(workdir, { role: "reviewer", mode: "current-session", modelSelector: "fake/model", confirmed: true });
+		const refDir = path.join(workdir, "refs", "solo");
+		fs.mkdirSync(refDir, { recursive: true });
+		const restore = withFakePi(
+			fakePiScript(
+				`emit({ type: "message_end", message: { role: "assistant", model: "fake/model", content: [{ type: "text", text: "OK" }] } });`,
+			),
 		);
+		const tool = loadTool();
+		try {
+			const result = await tool.execute("c1", { refs: [{ id: "ref-1", localPath: refDir }] }, undefined, undefined, headlessCtx(workdir));
+			assert.match(result.content[0]!.text, /mode is current-session, but analyze_refs always spawns/);
+			assert.match(result.content[0]!.text, /OK/);
+		} finally {
+			restore();
+		}
 	});
 
-	it("refuses with confirmation guidance when the reviewer model is unconfirmed", async () => {
-		const workdir = mkWorkdir("gates-unconfirmed");
+	it("requires a confirmed model even in current-session mode (analysis always spawns)", async () => {
+		const workdir = mkWorkdir("gates-current-session-unconfirmed");
 		initState(workdir);
-		setRole(workdir, { role: "reviewer", mode: "delegated-subagent" });
+		// 'inherit' fully resets selector AND confirmation — the prior test's
+		// confirmed selector must not carry over (the global config is shared).
+		setRole(workdir, { role: "reviewer", mode: "current-session", modelSelector: "inherit" });
 		const tool = loadTool();
 		await assert.rejects(
 			tool.execute("c1", { refs: [{ id: "ref-1", localPath: "." }] }, undefined, undefined, headlessCtx(workdir)),
@@ -310,7 +327,7 @@ describe("analyze_refs fanout", () => {
 			const result = await tool.execute("c1", { refs: [{ id: "ref-1", localPath: refDir }] }, undefined, undefined, headlessCtx(workdir));
 			assert.match(result.content[0]!.text, /### pi-plans-refs-adhoc-ref-1/);
 			assert.equal(readActive(workdir), null);
-			const ledger = path.join(workdir, ".git", "pi_plans", "runs");
+			const ledger = path.join(workdir, ".git", "pi-plans", "runs");
 			const runs = fs.existsSync(ledger) ? fs.readdirSync(ledger) : [];
 			const spawnFiles = runs.flatMap((run) =>
 				fs.existsSync(path.join(ledger, run, "subagents.jsonl")) ? [fs.readFileSync(path.join(ledger, run, "subagents.jsonl"), "utf8")] : [],

package/tests/ask-choice-schema.test.ts

@@ -157,18 +157,6 @@ describe("VC-2 · hardening does not wound legitimate single-question shapes", (
 		assert.equal(Value.Check(AskChoiceParams as never, wellFormed), true);
 	});
 
-	it("single question with trailing + autoComplete:false passes Value.Check", () => {
-		const wellFormed = {
-			question: "实现评审循环如何终止？",
-			options: [
-				{ label: "goal wait：直到无未通过 VC", recommended: true },
-				{ label: "直到无高危发现（硬帽 5 轮）" },
-			],
-			trailing: "auto-refine-loop",
-			autoComplete: false,
-		};
-		assert.equal(Value.Check(AskChoiceParams as never, wellFormed), true);
-	});
 });
 
 describe("VC-3 · zero-recommended batches reject loudly with zero side effects", () => {