sortie-dogs 0.12.22 → 0.12.24

package/dist/asset-version.d.ts

@@ -3,5 +3,5 @@
  * installed project marker without importing every asset body.
  */
 export declare const RUNTIME_ASSET_VERSION = "0.3.89-completion-proof-v1";
-export declare const V010_RUNTIME_ASSET_VERSION = "0.12.22-mission-replacement-v1";
+export declare const V010_RUNTIME_ASSET_VERSION = "0.12.24-review-evidence-recovery-v1";
 export type RuntimeAssetVersion = typeof RUNTIME_ASSET_VERSION | typeof V010_RUNTIME_ASSET_VERSION;

package/dist/asset-version.js

@@ -3,4 +3,4 @@
  * installed project marker without importing every asset body.
  */
 export const RUNTIME_ASSET_VERSION = "0.3.89-completion-proof-v1";
-export const V010_RUNTIME_ASSET_VERSION = "0.12.22-mission-replacement-v1";
+export const V010_RUNTIME_ASSET_VERSION = "0.12.24-review-evidence-recovery-v1";

package/dist/plugin/declared-artifacts.d.ts

@@ -1,8 +1,11 @@
 /** Explicit external artifacts are filesystem inputs, not Git pathspecs. Stream complete bytes;
  * previews are bounded independently. Follow package links only inside a declared physical root.
  */
-export declare function declaredArtifacts(paths: readonly string[], previewLimit?: number): Promise<{
+export declare function declaredArtifacts(paths: readonly string[], previewLimit?: number, options?: {
+    reportUnreadableDirectories?: boolean;
+}): Promise<{
     entries: (readonly [string, string, (string | undefined)?])[];
     excerpt: string;
     truncated: boolean;
+    unreadable: string[];
 }>;

package/dist/plugin/declared-artifacts.js

@@ -9,7 +9,7 @@ const within = (root, path) => {
 /** Explicit external artifacts are filesystem inputs, not Git pathspecs. Stream complete bytes;
  * previews are bounded independently. Follow package links only inside a declared physical root.
  */
-export async function declaredArtifacts(paths, previewLimit = 0) {
+export async function declaredArtifacts(paths, previewLimit = 0, options = {}) {
     const roots = [...new Set(paths.map(path => resolve(path)))].sort();
     const physical = await Promise.all(roots.map(path => realpath(path).catch((error) => {
         if (error.code === "ENOENT")
@@ -18,6 +18,7 @@ export async function declaredArtifacts(paths, previewLimit = 0) {
     })));
     const entries = [];
     const excerpts = [];
+    const unreadable = [];
     let remaining = previewLimit, truncated = false;
     const visited = new Set();
     const visit = async (path, ancestors) => {
@@ -47,7 +48,26 @@ export async function declaredArtifacts(paths, previewLimit = 0) {
         if (metadata.isDirectory()) {
             entries.push([label, "directory", canonical]);
             const next = new Set([...ancestors, canonical]);
-            for (const child of (await readdir(path)).sort())
+            let children;
+            try {
+                children = await readdir(path);
+            }
+            catch (error) {
+                if (!options.reportUnreadableDirectories || !["EACCES", "EPERM"].includes(error.code ?? ""))
+                    throw error;
+                entries.push([label, `unreadable:${error.code}`, canonical]);
+                unreadable.push(label);
+                const notice = `\n--- external directory: ${label} ---\n[not inspected: permission denied; select specific result files as review evidence]\n`;
+                const bytes = Buffer.from(notice), bounded = bytes.subarray(0, remaining);
+                if (bounded.length) {
+                    excerpts.push(bounded.toString("utf8"));
+                    remaining -= bounded.length;
+                }
+                if (bounded.length < bytes.length)
+                    truncated = true;
+                return;
+            }
+            for (const child of children.sort())
                 await visit(join(path, child), next);
             return;
         }
@@ -76,5 +96,5 @@ export async function declaredArtifacts(paths, previewLimit = 0) {
     };
     for (const path of roots)
         await visit(path, new Set());
-    return { entries, excerpt: excerpts.join(""), truncated };
+    return { entries, excerpt: excerpts.join(""), truncated, unreadable };
 }

package/dist/plugin/index.js

@@ -7884,6 +7884,32 @@ export const SortieDogsPlugin = async (input, options) => {
                 cost_note: "Worker token-price estimates from complete native usage; missing requests remain unknown and are reconciled on later status. Excludes orchestration/review and external campaign spend. Zero settled cost does not mean free execution." };
             return snapshot;
         },
+        extendMissionUnitBudget: (root, maxUnits) => serializeChatTransition(root, async () => {
+            if (!isCoordinatorSession(root) && !await recoverCoordinatorRoot(root))
+                throw new Error("operator-coordinator-required");
+            await recoverPendingRealGoalTurn(root);
+            await recoverCompletedGoalReservations(root);
+            const ledger = await goalLedger(root), state = (await ledger.readGoal()).state;
+            if (state.phase !== "active" || state.receipt !== null || state.goal_id === null || state.budget === null ||
+                state.latest_user_message_id === null)
+                throw new Error("mission-budget-goal-not-active");
+            if (!Number.isSafeInteger(maxUnits) || maxUnits <= 0 || maxUnits < state.budget.max_units ||
+                maxUnits < state.consumed_units + state.outstanding_reservations.length)
+                throw new Error("mission-budget-limit-invalid");
+            const changed = maxUnits > state.budget.max_units;
+            if (changed) {
+                await ledger.appendGoal({ kind: "goal.revised", at: new Date().toISOString(), goal_id: state.goal_id,
+                    revision: state.revision + 1, scope_epoch: state.scope_epoch + 1,
+                    acceptance_fingerprint: state.acceptance_fingerprint, origin_user_message_id: state.latest_user_message_id,
+                    session_id: root, selected_agent: state.selected_agent, delivery: state.delivery,
+                    budget: { ...state.budget, max_units: maxUnits, source: "user-revision" },
+                    acceptance_contract: state.acceptance_contract });
+            }
+            const updated = (await ledger.readGoal()).state;
+            const reserved = updated.outstanding_reservations.length;
+            return { status: changed ? "extended" : "unchanged", max_units: updated.budget.max_units, consumed_units: updated.consumed_units,
+                reserved_units: reserved, remaining_units: updated.budget.max_units - updated.consumed_units - reserved };
+        }),
         ...{
             missionWorkerTerminal: async (childSessionID, writeScopes) => {
                 const active = activeSessions.get(childSessionID), authorization = sessionAuthorizations.get(childSessionID);

package/dist/plugin/mission-review.d.ts

@@ -13,4 +13,5 @@ export declare function completedMissionReviewPrompts(mission: OperatorMission |
 export declare function missionReviewSource(directory: string, run: OperatorState, evidence?: readonly MissionEvidenceExcerpt[], baseline?: string, priorScope?: MissionReviewScope): Promise<{
     fingerprint: string;
     excerpt: string;
+    truncatedEvidence: string[];
 }>;

package/dist/plugin/mission-review.js

@@ -214,9 +214,11 @@ export async function missionReviewSource(directory, run, evidence = [], baselin
         if (needsNotice[index])
             selected += truncated(item.entry);
     }
+    const truncatedEvidence = focused.flatMap(({ entry }, index) => needsNotice[index] ? [`${entry.path}:${entry.offset}`] : []);
     if (writes.length === 0)
         return { fingerprint: `sha256:${hash.digest("hex")}`,
-            excerpt: selected + "[Read-only units: no declared output files. Review the supplied observations, traces and validation evidence.]" };
+            excerpt: selected + "[Read-only units: no declared output files. Review the supplied observations, traces and validation evidence.]",
+            truncatedEvidence };
     // The shared dependency environment is local tooling, never reviewed or pinned source.
     const external = [], local = [];
     for (const path of writes) {
@@ -230,12 +232,15 @@ export async function missionReviewSource(directory, run, evidence = [], baselin
     const git = async (args) => (await exec("git", args, { cwd: directory, maxBuffer: 8 * 1024 * 1024 })).stdout;
     const names = local.length ? await git(["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...scopes]) : "";
     const untracked = new Set((local.length ? await git(["ls-files", "-z", "--others", "--exclude-standard", "--", ...scopes]) : "").split("\0").filter(Boolean));
-    // Explicitly declared outputs are review evidence even when gitignored (for example a probe
-    // JSON in _testenv). Their bytes must participate in staleness checks as well as the excerpt.
-    const ignored = local.length ? await git(["ls-files", "-z", "--others", "--ignored", "--exclude-standard", "--", ...scopes]) : "";
+    // Go's ignored in-project caches may be writable during validation but are not candidate
+    // output. Keep every other ignored declared output visible and fingerprinted, including
+    // directories of generated artifacts; focused references can still pin a cache file.
+    const ignored = local.length ? await git(["ls-files", "-z", "--others", "--ignored", "--exclude-standard", "--",
+        ...scopes, ...[".gocache", ".gomodcache", ".gopath"].map(path => `:(exclude)${path}`)]) : "";
     for (const path of ignored.split("\0").filter(Boolean))
         untracked.add(path);
     const omitted = [];
+    const unreadable = [];
     let diff = "";
     if (local.length && baseline) {
         // HEAD-only diffs are empty once the Worker commits. Show bounded changes from the
@@ -305,13 +310,19 @@ export async function missionReviewSource(directory, run, evidence = [], baselin
         }
     }
     if (external.length) {
-        const artifacts = await declaredArtifacts(external, Math.max(1, 24_000 - Buffer.byteLength(excerpt)));
+        // A declared write scope can also be a host-managed runtime directory (e.g. Docker's data root).
+        // Do not make review depend on listing it; record the missing coverage instead. Protected
+        // validation still requires readable outputs and does not use this review-only option.
+        const artifacts = await declaredArtifacts(external, Math.max(1, 24_000 - Buffer.byteLength(excerpt)), { reportUnreadableDirectories: true });
         hash.update(JSON.stringify(artifacts.entries));
         excerpt += artifacts.excerpt;
         if (artifacts.truncated)
             omitted.push("external artifacts");
+        unreadable.push(...artifacts.unreadable);
     }
     const bytes = Buffer.from(excerpt);
     return { fingerprint: `sha256:${hash.digest("hex")}`, excerpt: (bytes.length > 24_000 ? bytes.subarray(0, 24_000).toString("utf8") : excerpt) +
-            (bytes.length > 24_000 || omitted.length ? `\n[EXCERPT TRUNCATED: ${omitted.slice(0, 20).join(", ")}; supply focused traces for missing sections, not another implementation unit]` : "") };
+            (bytes.length > 24_000 || omitted.length ? `\n[EXCERPT TRUNCATED: ${omitted.slice(0, 20).join(", ")}; supply focused traces for missing sections, not another implementation unit]` : "") +
+            (unreadable.length ? `\n[UNINSPECTED EXTERNAL DIRECTORIES: ${unreadable.slice(0, 20).join(", ")}; select specific result files as review evidence]` : ""),
+        truncatedEvidence };
 }

package/dist/plugin/profiled.js

@@ -663,6 +663,14 @@ export function createProfiledPlugin(profile, assetVersion) {
         function missionDispatchPacket(mission, run) {
             const packet = { ...missionPacket(mission, run), project_root: input.directory,
                 coordinator_dispatch: mission.dispatchOpen ? "active" : ["completed", "cancelled"].includes(mission.phase) ? "terminal" : "resumable" };
+            if (mission.phase === "submitted" && mission.submission?.status === "blocked" &&
+                run?.units.some(unit => unit.status === "running")) {
+                return { ...packet, next_action: `If the native Worker Task is still active, wait for it; do not start a duplicate. ` +
+                        `If the parent Coordinator Task has finished or was interrupted, and the user chose to stop/replan, Operator root (not Coordinator): ` +
+                        `call ${profile.toolPrefix}cancel_operator with reason=plain to stop owned children, then ` +
+                        `${profile.toolPrefix}start_mission with intent=replace and the saved requirements. ` +
+                        `Use the returned Coordinator Task; the previous Mission is archived and cumulative spend is retained.` };
+            }
             if (sourceReconciliationRequired(mission, run))
                 return { ...packet, status: "mission-source-reconciliation-required",
                     next_action: mission.dispatchOpen ? "The Coordinator Task is still active. Do not redispatch; wait for its native completion and reconcile via operator_status."
@@ -1072,7 +1080,10 @@ export function createProfiledPlugin(profile, assetVersion) {
                 const mission = await missions.read(context.sessionID);
                 if (mission && !["completed", "cancelled"].includes(mission.phase)) {
                     await stop(context.sessionID, "explicit-cancellation", false);
-                    return JSON.stringify(missionPacket(await missions.required(context.sessionID), await operators.read(context.sessionID)));
+                    return JSON.stringify({ ...missionPacket(await missions.required(context.sessionID), await operators.read(context.sessionID)),
+                        next_action: `Owned children were stopped; cumulative spend is retained. To continue the same request, ` +
+                            `Operator root calls ${profile.toolPrefix}start_mission with intent=replace and the saved requirements, ` +
+                            `then dispatches its returned Coordinator Task. The cancelled Mission is historical; do not reuse its Worker.` });
                 }
                 const rawReason = args.reason;
                 const requestedReason = rawReason === "plain" || rawReason === undefined ? undefined : rawReason;
@@ -1471,8 +1482,22 @@ export function createProfiledPlugin(profile, assetVersion) {
                     return JSON.stringify({ ...proposalIdentity(committed), execution: JSON.parse(preparedTask(prepared.state)) });
                 });
             } };
-        const startMission = `${profile.toolPrefix}start_mission`, planUnits = `${profile.toolPrefix}plan_units`, reviewMission = `${profile.toolPrefix}review_mission`, submitMission = `${profile.toolPrefix}submit_mission`, completeMission = `${profile.toolPrefix}complete_mission`, expandUnit = `${profile.toolPrefix}expand_unit`, skipMissionConsultation = `${profile.toolPrefix}skip_mission_consultation`;
+        const startMission = `${profile.toolPrefix}start_mission`, planUnits = `${profile.toolPrefix}plan_units`, reviewMission = `${profile.toolPrefix}review_mission`, submitMission = `${profile.toolPrefix}submit_mission`, completeMission = `${profile.toolPrefix}complete_mission`, expandUnit = `${profile.toolPrefix}expand_unit`, skipMissionConsultation = `${profile.toolPrefix}skip_mission_consultation`, extendMissionBudget = `${profile.toolPrefix}extend_mission_budget`;
         const stringList = { type: "array", items: { type: "string" } };
+        tools[extendMissionBudget] = { description: "Root-only: after the user explicitly approves a cumulative Worker-unit increase, extend the same active Mission's host goal budget. max_units is the new cumulative total, not an increment. Preserve consumed/reserved units, requirements and execution; this does not dispatch a Worker or change the campaign cost cap. Read operator_status for the exact mission ID and counters, then resume its existing Coordinator.",
+            args: { mission_id: stringSchema, max_units: { type: "integer", minimum: 1 } }, execute: async (args, context) => {
+                await requireRoot(context.sessionID);
+                return serializeDispatchTransition(context.sessionID, async () => {
+                    const mission = await missions.required(context.sessionID);
+                    if (mission.id !== args.mission_id || ["cancelled", "completed"].includes(mission.phase))
+                        throw new Error("mission-budget-mission-not-active");
+                    const maxUnits = Number(args.max_units);
+                    const result = await control.extendMissionUnitBudget(context.sessionID, maxUnits);
+                    const { status, ...budget } = result;
+                    return JSON.stringify({ status, mission_id: mission.id, budget,
+                        next_action: "Read operator_status: if the Coordinator dispatch is active, continue it; otherwise dispatch the returned task to resume the same Coordinator. Retain requirements, spend and candidate; no new mission or plan approval." });
+                });
+            } };
         tools[startMission] = { description: "Operator: save the current user requirements. Use intent=replace when the user changes an existing request (version, parallelism, target): host cancels the previous run and archives its requirements/results while retaining spend. If status reports mission-source-reconciliation-required and the saved requirements reflect that changed scope, call intent=replace with those exact requirements: the host repairs this mission in place and keeps its Coordinator. Supply the complete current requirements, retaining constraints the user has not changed. For separate work in a different location use intent=new. Dispatch the Coordinator immediately, or plan_units for a known single-unit procedure; item count and runtime alone do not require a Coordinator.",
             args: { requirements: { ...stringList, minItems: 1, maxItems: 64 },
                 kind: { type: "string", enum: ["implementation", "operation"], description: "Use operation for running an existing benchmark, command or procedure. The host records its actual execution separately from setup and checks.", "x-sortie-optional": true },
@@ -1771,6 +1796,14 @@ export function createProfiledPlugin(profile, assetVersion) {
                     return await serializeDispatchTransition(root, () => declareMissionUnits(root, context.sessionID, mission, args.units, args.reason, args.execution));
                 }
                 catch (error) {
+                    if (error instanceof Error && error.message === "mission-replan-worker-still-active") {
+                        return JSON.stringify({ status: error.message, mission_id: mission.id,
+                            next_action: `Coordinator: do not repeat plan_units or try ${cancel} (root-only). ` +
+                                `If the Worker Task is still active, wait for its native completion. If its parent Task was interrupted, ` +
+                                `submit_mission with status=blocked and report this code, the Worker/Task IDs and what did not run. ` +
+                                `Operator root can then use ${cancel} with reason=plain to stop owned children and resume the request ` +
+                                `through ${startMission} with intent=replace, preserving cumulative spend. No duplicate Worker.` });
+                    }
                     if (!(error instanceof OperatorContractError))
                         throw error;
                     return JSON.stringify({ status: "invalid-plan", diagnostics: error.diagnostics, diagnostics_truncated: error.diagnostics_truncated,
@@ -1792,7 +1825,7 @@ export function createProfiledPlugin(profile, assetVersion) {
                     return declareMissionUnits(root, context.sessionID, mission, units, args.reason);
                 });
             } };
-        tools[reviewMission] = { description: "Coordinator: prepare the independent Reviewer task from current source, requirements and observed checks. Supply risk_tags (empty only for genuinely low risk) and concise criterion-level changed-code/test traces. Host supplies diff, IDs, manifest, mappings and evidence; keep candidate lineage across corrections. A low-risk skip is recorded, never inferred from a missing review.",
+        tools[reviewMission] = { description: "Coordinator: prepare the independent Reviewer task from current source, requirements and observed checks. Supply risk_tags (empty only for genuinely low risk) and concise criterion-level changed-code/test traces. Host supplies diff, IDs, manifest, mappings and evidence; if truncated_evidence is returned, narrow those ranges before dispatching the Reviewer. Keep candidate lineage across corrections. A low-risk skip is recorded, never inferred from a missing review.",
             args: { risk_tags: { type: "array", items: { type: "string", enum: SOURCE_REVIEW_RISK_TAGS } },
                 evidence: { type: "array", maxItems: 6, items: { type: "object", additionalProperties: false,
                         properties: { path: { type: "string" }, offset: { type: "integer", minimum: 1 }, limit: { type: "integer", minimum: 1, maximum: 200 } },
@@ -1848,7 +1881,10 @@ export function createProfiledPlugin(profile, assetVersion) {
                         ...(initialPrompt ? { initialPrompt } : {}),
                         ...(mission.review?.evidenceGapReviews ? { evidenceGapReviews: mission.review.evidenceGapReviews } : {}) };
                 });
-                return JSON.stringify(task ? { status: "review-required", task: missionReviewTask(reviewed) } : { status: "skipped-low-risk" });
+                return JSON.stringify(task ? { status: "review-required", task: missionReviewTask(reviewed),
+                    ...(source.truncatedEvidence.length ? { truncated_evidence: source.truncatedEvidence,
+                        next_action: "Narrow these focused evidence ranges with review_mission before dispatching the Reviewer; no Worker or new validation is needed." } : {}) }
+                    : { status: "skipped-low-risk" });
             } };
         async function assertMissionReview(root, mission) {
             const run = await operators.required(root), review = mission.review;

package/dist/plugin/runtime-bridge.d.ts

@@ -105,6 +105,13 @@ export interface RuntimeBridge {
             readonly reserved_units: number;
             readonly remaining_units: number;
         } | null>;
+        extendMissionUnitBudget(rootSessionID: string, maxUnits: number): Promise<{
+            readonly status: "extended" | "unchanged";
+            readonly max_units: number;
+            readonly consumed_units: number;
+            readonly reserved_units: number;
+            readonly remaining_units: number;
+        }>;
         renderReturnReport(rootSessionID: string, text: string, receiptFingerprint: string): Promise<string | undefined>;
         recoverUnitEvidence(rootSessionID: string, request: {
             unitID: string;

package/dist/runtime-mission-assets.js

@@ -42,7 +42,7 @@ permission:
     ${profileAgent(profile, "dog-advisor")}: allow
 tools:
   "sortie_*": false
-${controls(profile, ["start_mission", "plan_units", "operator_next", "operator_status", "expand_unit", "review_mission", "complete_mission", "cancel_operator", "reflection"])}
+${controls(profile, ["start_mission", "plan_units", "operator_next", "operator_status", "extend_mission_budget", "expand_unit", "review_mission", "complete_mission", "cancel_operator", "reflection"])}
 ---
 # ${profileAgent(profile, "dog-coordinator")}
 
@@ -70,6 +70,12 @@ quality threshold and explicit model/budget choice. Follow AGENTS.md and use the
     SAME mission before any Worker starts, retains its Coordinator and cumulative spend, and checks
     old children before preparing a Worker. This is not permission to discard unchanged acceptance:
     if the scope is uncertain, ask the user which requirements remain instead of inferring a replacement.
+    If a Coordinator reports mission-replan-worker-still-active after an interrupted native Task,
+    it cannot call cancel_operator (root-only). Inspect operator_status and the native Task outcome.
+    If the Worker is still active, wait, not duplicate. If the user chose to stop/replan, root calls
+    ${profile.toolPrefix}cancel_operator with reason: "plain" to stop its owned children, then
+    ${profile.toolPrefix}start_mission with intent: "replace" and the saved requirements. The cancelled
+    Mission is archived; cumulative spend is retained. Dispatch only the returned Coordinator Task.
 2. Dispatch the returned ${profileAgent(profile, "dog-operator")} task immediately. It owns investigation,
    unit boundaries, Worker/Scout/Advisor/independent Reviewer calls, write-scope extensions and corrections
    within the original request and cumulative budget. Do not investigate or approve each unit at the root.
@@ -107,7 +113,10 @@ Use foreground delegation. Unit progress is displayed on the running Task withou
 Do not poll or re-run successful checks. Inspect operator_status only to recover missing durable state.
 Ordinary defects return to Coordinator, not the user. Ask through question only for a user-only choice,
 an extension beyond the original requirements, or a cumulative budget increase. Resume the same work after
-the answer. Do not reset spend, silently shrink acceptance, or create substitute goals.
+the answer. For an approved Mission Worker-unit increase, root calls ${profile.toolPrefix}extend_mission_budget
+with operator_status.mission_id and the new cumulative max_units (not the increment), then resumes the same
+Coordinator. This does not change a separate campaign dollar cap or dispatch a Worker. Do not reset spend,
+silently shrink acceptance, or create substitute goals.
 
 When bounded process reflections are injected, pass the relevant prevention in Coordinator feedback while
 preserving the original requirements. After a resolved repeated process failure, record its verified cause/prevention

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sortie-dogs",
-  "version": "0.12.22",
+  "version": "0.12.24",
   "description": "Bounded agent harness and validated orchestration loop plugin for OpenCode",
   "keywords": [
     "opencode",