pi-tasks 0.2.10

Release Notes 0.2.10

Highlight

• Fixed #13: valid plans no longer fail when callers send an empty criterionIds array, wording failures identify their exact matched fragment, and one rejection reports every invalid submitted step.

Plan Creation Recovery

New task and decomposition steps now treat empty criterionIds arrays like omitted arrays and auto-link the available task criteria. Non-empty arrays still reject unknown generated criterion IDs, preserving the criterion-link invariant.

Plan validation now evaluates every submitted step before rejecting the event. A multi-step plan receives one indexed error list instead of discovering later invalid steps through repeated full-plan retries. The reducer remains atomic: no task event or partial step state is persisted after any validation failure.

Plan Quality Diagnostics

Vague and compound wording failures now include the exact matched fragment, such as "Fix" or "and". Every quality issue on an atomic step is a hard failure, matching the documented atomic-step contract. Non-atomic steps retain scored validation so deliberately coarse work can still enter the required decomposition flow.

Path-token exclusions remain intact: action-like filename segments such as fixtures/fix.json, update.json, and then.json remain valid when the surrounding plan is concrete.

Regression Coverage

Reducer regressions cover:

• empty criterionIds auto-linking all task criteria during creation and parent criteria during decomposition;
• a single vague wording issue rejecting with its matched token;
• a single compound output issue rejecting with its matched token;
• all invalid step indexes appearing in one rejection; and
• existing path-token and recursive-decomposition behavior remaining valid.

Dependency Security

Vitest was updated to 5.0.5, bringing patched @vitest/mocker and Vite transitive dependencies into the development and release toolchain. The release audit reports zero vulnerabilities.

Verification Status

• Passed PI_SDK_ROOT=/tmp/pi-tasks-sdk-1.3.0/node_modules/@earendil-works/pi-coding-agent npm run release:check: strict typecheck, Biome, 94 unit tests, 7 native Pi SDK tests, build, source/dist imports, pack dry-run, clean tarball install/import, and zero-vulnerability audit.
• Passed real Pi 1.3.0 source lifecycle dogfood: aggregated two-step rejection with matched fragments, empty-criteria task creation, update, decision, blocker/unblock, evidence quality recovery, duplicate evidence, completion, same-session resume, and fork replay.
• Passed live /tasks detail rendering and clean /quit.
• Passed fixed English and Traditional Chinese weak-model prompts for compound-plan rejection, current-step evidence locking, evidence-budget enforcement, and task_next convergence.
• Passed installed pi-tasks-0.2.10.tgz smokes for structured invalid-plan recovery and valid empty-criteria task creation.

Publishing

The GitHub release contains the verified source and package metadata for 0.2.10. npm publication remains a separate manual maintainer action.

pi-tasks 0.2.9

Release Notes 0.2.9

Highlight

• Fixed #12: reducer replay no longer deep-clones accumulated event history before immediately replacing that cloned history.

Large-Session Replay

Each non-snapshot transition still deep-clones mutable task state before applying the event, preserving rejection isolation and immutable reducer behavior. The clone now receives an empty events array because event history is append-only and is rebuilt from the prior history plus the current event after a successful transition.

This removes repeated cloning of historical event payloads during branch replay without changing persisted events, snapshot data, malformed-event handling, task validation, or completion gates.

Regression Coverage

A deterministic reducer regression test verifies that:

• historical events are excluded from every transition clone;
• all prior events and the new event remain in order;
• historical event references retain the existing identity semantics;
• mutable task state remains isolated from the input state; and
• a rejected transition leaves the input state unchanged.

Verification Status

• Passed the deterministic 500-event reproducer: the transition clone received zero historical events, returned 501 events in order, preserved historical references, and isolated mutable task state.
• Passed PI_SDK_ROOT=/tmp/pi-tasks-sdk-1.2.0/node_modules/@earendil-works/pi-coding-agent npm run release:check in both the release worktree and a fresh v0.2.9 clone after npm ci: strict typecheck, Biome, 89 unit tests, 7 native Pi SDK tests, build, source/dist imports, pack dry-run, clean tarball install/import, and the audit gate.
• Passed real Pi 0.87.1 source dogfood with openai-codex/gpt-5.6-sol: task creation, update, evidence, completion, duplicate-evidence rejection, ordered-step rejection, decision/blocker rendering, same-session resume, and fork replay.
• Passed live Pi TUI /tasks detail rendering and clean /quit.
• Passed the fixed English and Traditional Chinese weak-model source prompts: compound-plan rejection, future-step evidence lock, 500-character evidence budget, and single-tool task_next convergence. The fixed installed-package English prompt also returned structured task_plan recovery.
• Passed installed pi-tasks-0.2.9.tgz extension smoke: task_resume reported the empty initial state and task_plan persisted task T1 with current step T1-S1.

pi-tasks 0.2.8

Release Notes 0.2.8

Highlights

• Fixed #10: non-atomic steps at decomposition depth 4 now converge on an explicit blocker recovery instead of recommending another rejected task_decompose call.
• Fixed #8: evidence schemas expose reducer text limits, and command/test/dogfood recovery templates preserve valid commands while replacing invalid values with caller-supplied placeholders.
• Fixed #9: conditional scope fields are model-visible, and missing activity or scope_reason now returns a targeted snake_case task_update recovery.
• Fixed #11: action-like filename segments such as fixtures/fix.json, update.json, and then.json no longer reduce plan quality; genuine broad and compound instructions remain guarded.
• Updated transitive source-map-js to 1.2.2 after the release audit detected GHSA-68fv-2mgg-jv7q.

Recovery Contracts

At decomposition depth 4, task_resume, task_next, task_focus, task_granularity_check, task state, and rejected mutation output now agree on one executable path: explicitly block the unfinished task and carry remaining scope plus evidence references into a manually planned flat successor. The reducer still rejects further decomposition and premature completion; no successor is created automatically.

Evidence fields now declare the runtime limits enforced by the reducer:

Field	Maximum characters
summary	500
quality.observedOutput	1,000
each reference, artifact reference, source, or command	300

Recovery templates do not truncate commands into different commands. Valid values are retained; missing or over-limit values become explicit placeholders that the caller must replace with observed data.

task_update.scope requires non-empty activity. scope_change and off_plan additionally require scope_reason. These two rejection classes now recommend the corrected task_update call even when the task's ordinary next action is a different tool.

Verification Status

• Passed: PI_SDK_ROOT=/tmp/pi-tasks-sdk-1.2.0/node_modules/@earendil-works/pi-coding-agent npm run release:check after the 0.2.8 version bump: strict typecheck, Biome, 88 unit tests, 7 native Pi SDK tests, build, source/dist imports, pack dry-run, clean tarball install/import, and zero-vulnerability audit.
• Passed: native recovery coverage validated host schema rejection at the 301-character command boundary, a runtime-only evidence rejection, a host-valid corrected retry, JSONL persistence, and evidence restoration in a new session.
• Passed: real Pi 0.87.1 source dogfood with OpenAI Codex GPT-5.5 in English and Traditional Chinese rejected compound plans, future-step evidence, and over-500-character summaries, then converged on task_evidence for the current step.
• Passed: real Pi lifecycle dogfood accepted fixtures/fix.json at plan quality 100, returned targeted scope recovery, preserved a valid evidence command, rejected out-of-order updates, deduplicated evidence, rendered decisions/blockers, completed at 100%, restored the session, and replayed a fork.
• Passed: real Pi maximum-depth dogfood reached T1-S1.1.1.1.1, made all four guidance surfaces select task_update, rejected a fifth decomposition without persistence, applied the blocker recovery, and exposed task_plan without completing work or creating a successor.
• Passed: live Pi TUI /tasks detail rendered the completed task, two evidence records, resolved blocker, and decision; /quit exited with code 0.
• Passed: clean pi-tasks-0.2.8.tgz consumer install, package import, zero-vulnerability audit, and installed-extension weak-model smoke through node_modules/pi-tasks/dist/index.js.

pi-tasks 0.2.7

Release Notes 0.2.7

Highlights

• Merged PR #6 to make fresh Pi sessions lean: only task_plan and task_resume start active when no pi-tasks state exists.
• Restored the available pi-tasks controls after successful task creation, task-bearing session replay, and session-tree navigation.
• Preserved explicit host ceilings and unrelated tools: Pi allowlists, exclusions, noTools, and foreign task-like tools remain authoritative.
• Upgraded Vitest to 5.0.0 after audit reported the vulnerable @vitest/mocker dependency chain in the previous test stack.

Native Tool Activation

On native Pi hosts that expose getActiveTools, getAllTools, and setActiveTools, pi-tasks now reconciles only the tools it registered for the current extension API instance.

Fresh task-free sessions keep the entrypoint surface compact:

task_plan
task_resume

After a task is persisted or restored, pi-tasks activates the available task controls without adding names outside the host's configured registry or removing unrelated active tools.

Older compatible hosts without native activation APIs keep the previous all-tools behavior and retain full tool guidance in descriptions.

Verification Status

• Passed: security review found no concrete privilege-escalation, allowlist-bypass, denial-of-service, information-leak, prototype-pollution, path-injection, or unsafe-error-propagation issue in the PR #6 activation path.
• Passed: strict implementation review findings were resolved before merge: native test API mismatch, older-host prompt guidance preservation, native test release-gate coverage, package metadata cleanup, and audit failure.
• Passed: targeted native Pi SDK extension test with PI_SDK_ROOT=/tmp/pi-sdk-llLMrY/node_modules/@earendil-works/pi-coding-agent; fresh schema+description surface was 2969 chars and active task-state surface was 9266 chars.
• Passed: npm run release:check with PI_SDK_ROOT=/tmp/pi-sdk-llLMrY/node_modules/@earendil-works/pi-coding-agent after the 0.2.7 version bump; it covered typecheck, Biome check, unit tests, native Pi SDK extension tests, build, source/dist import smoke, pack dry run, clean tarball install smoke, and audit.
• Pending: manual npm publish.

pi-tasks 0.2.6

Release Notes 0.2.6

Highlights

• Fixed PR #5 so concrete passing evidence summaries are not rejected merely because they contain vague words such as done or 完成了.
• Kept vague passing summaries blocked with matched-fragment feedback that tells agents to describe the observed result, without exposing the internal length heuristic as a target.
• Added English and Traditional Chinese regression coverage for concrete short summaries and vague summaries.

Vague Evidence Gate Fix

task_evidence still rejects passing evidence summaries that are genuinely vague:

Evidence summary is too vague for passing evidence (matched "done"); describe the observed result

Concrete observed summaries now pass even when they include status words:

CLI returned MATCH Done/Done
畫面顯示完成了並回傳 code 0

The gate now combines whole-summary vague phrase checks with observed-result signals for short summaries. The summary-length cutoff remains an internal heuristic; agent-facing guidance asks for observed command/tool output or state instead of asking for longer text.

Verification Status

• Passed: strict PR review; initial PR implementation had one blocker for short concrete summaries, fixed by maintainer commit 013af77 before merge.
• Passed: npm run release:check for 0.2.6.
• Passed: source Pi dogfood for Traditional Chinese vague-summary rejection, concrete Chinese evidence acceptance, task update, task completion, and detailed task listing.
• Passed: same-session resume, fork replay, live /tasks detail, and clean /quit.
• Passed: English weak-model source prompt for vague done rejection and concrete CLI returned MATCH Done/Done acceptance.
• Passed: installed-package tarball import and Pi dogfood through ./node_modules/pi-tasks/dist/index.js.
• Pending: manual npm publish.

pi-tasks 0.2.5

Release Notes 0.2.5

Highlights

• Fixed Issue #4 by allowing a later passing evidence rerun to explicitly supersede prior linked failed evidence.
• Preserved honest failed-gate lineage while unblocking fully verified task_complete calls.
• Added smart-model and weak-model convergence guidance to every pi-tasks tool prompt.
• Tightened weak-model dogfood prompts so oversized evidence rejection is deterministic.

Issue #4 Fix

task_evidence now accepts supersedes:

{
  "passed": "true",
  "step_ids": ["T1-S1"],
  "criterion_ids": ["T1-AC1"],
  "supersedes": ["E1"]
}

A failing evidence item stops blocking completion only when a later passing evidence item explicitly supersedes it and links to the same step or criterion scope. The original failed evidence remains visible in task lineage and detailed task output.

Invalid supersedes attempts are rejected when they reference missing evidence, non-failed evidence, earlier evidence, or evidence not linked to the same step/criterion scope.

Prompt Convergence

Every registered tool now includes guidance for two failure modes:

• Smart models: stay inside the current persisted task contract; do not jump ahead, add speculative scope, or reconstruct stale state from memory.
• Weak models: copy IDs and minimum params from task_next, task_focus, or task_resume; call only the recommended tool and never retry rejected calls unchanged.

Verification Status

• Passed: npm run release:check for 0.2.5.
• Passed: source Pi dogfood for superseded failed evidence, same-session resume, fork replay, live /tasks detail, and clean /quit.
• Passed: installed-package Pi dogfood through ./node_modules/pi-tasks/dist/index.js.
• Passed: English and Traditional Chinese weak-model prompt dogfood for compound plan rejection, current-step lock, oversized evidence rejection, and task_next convergence.
• Passed: installed-package weak-model smoke for structured recovery.
• Pending: manual npm publish.

pi-tasks 0.2.4

Release Notes 0.2.4

Highlights

• Fixed Issue #3 by aligning task_evidence tool schema with runtime evidence quality gates for Oh My Pi and weak local models.
• Replaced weak-model-hostile conditional/root-oneOf evidence parameters with a flat OMP-compatible object schema.
• Required traceability fields at generation time: top-level references plus complete quality metadata.
• Kept command/test/dogfood rejection recovery copyable through retry_example.

Issue #3 Fix

task_evidence now asks models for every field the reducer quality gate can require:

• references
• quality.source
• quality.reproducible
• quality.verifier
• quality.command
• quality.artifactRefs
• quality.observedOutput

For non-command evidence, quality.command is a verification-action label rather than a shell command.

Weak-Model Dogfood

Validated with Oh My Pi and the local ornith1.5 model:

llama.cpp/bartowski/Ornith-1.5-35B-A3B-GGUF:Q6_K_L

Evidence root:

/private/tmp/pi-tasks-issue3-ornith15-fixed

Final transcript summary:

/private/tmp/pi-tasks-issue3-ornith15-fixed/summary2.json

Observed results:

• Command evidence positive path accepted on the first task_evidence call.
• Recovery path used one rejected command-evidence call followed by one corrected accepted call.
• Test evidence accepted with complete quality metadata.
• Review evidence accepted with quality.command used as a verification-action label.
• Traditional Chinese command-evidence prompt accepted on the first call after references became schema-required.
• Duplicate rejected payload count was zero across final sessions.

Verification Status

• Passed: npm run release:check.
• Passed: real Oh My Pi ornith1.5 weak-model dogfood for Issue #3.
• Passed: release audit after lockfile refresh.
• Pending: npm publish. The tarball is ready for manual npm publish.

pi-tasks 0.2.3

Release Notes 0.2.3

Highlights

• Corrected Oh My Pi (omp) installation documentation after verifying the CLI behavior.
• Removed the unsupported project-scoped npm package install example. Oh My Pi's --scope project flag applies to marketplace refs such as name@marketplace, and is ignored for npm package specs like pi-tasks.
• Documented verified npm and local-development commands.

Verified Install Commands

omp install pi-tasks
omp plugin install pi-tasks
omp plugin install ./

Verification used Oh My Pi CLI dry-runs:

omp install pi-tasks --dry-run
omp plugin install pi-tasks --dry-run
omp plugin install ./ --dry-run

Verification Status

• Passed: npm run release:check.
• Passed: Oh My Pi CLI dry-run checks for npm install, explicit plugin install, and local plugin install.
• Passed: unit suite with 59 tests through the release gate.
• Skipped: real Pi/Oh My Pi TUI dogfood; this patch corrects documentation and package metadata only.

pi-tasks 0.2.2

Release Notes 0.2.2

Highlights

• Documented verified Oh My Pi (omp) npm-package and local-development installation paths plus extension compatibility behavior.
• Mirrored each tool's critical promptGuidelines into its registered description so Oh My Pi and other hosts that ignore custom prompt fields still provide the model with task-contract guidance.
• Removed the local ctx.mode shim assumption; pi-tasks now records tool events without depending on runtime-specific context mode fields.

Compatibility

Oh My Pi discovers pi-tasks through the existing pi.extensions manifest, so no separate omp manifest is required. The extension uses shared Pi-native APIs available in Oh My Pi: registerTool, registerCommand, appendEntry, ctx.sessionManager.getBranch(), status/widget UI calls, and session lifecycle events.

The description mirroring keeps existing Pi hosts compatible with promptSnippet and promptGuidelines while strengthening Oh My Pi's model-facing tool metadata path.

Verified install commands:

omp install pi-tasks
omp plugin install pi-tasks
omp plugin install ./

Oh My Pi's --scope project flag is for marketplace refs such as
name@marketplace; it is ignored for npm package specs like pi-tasks.

Verification Status

• Passed: npm run release:check.
• Passed: unit suite with 59 tests, including coverage that prompt guidelines are projected into registered tool descriptions.
• Passed: source and dist import smokes, npm pack --dry-run, clean tarball install smoke, and npm audit --audit-level=low through the release gate.
• Skipped: real Pi/Oh My Pi TUI dogfood; this patch changes documentation, tool metadata descriptions, and a no-op context shim.

pi-tasks 0.2.1

Release Notes 0.2.1

Highlights

• Added explicit type: "string" to Type.Enum() JSON Schema output.
• Restored compatibility with Moonshot/Kimi-style tool schema validators that reject bare enum schemas without a type field.
• Added regression coverage for enum schema typing and schema option preservation.

Compatibility

Type.Enum() only accepts string enum values, so the emitted schema is now stricter and provider-compatible without changing pi-tasks task state, reducer behavior, persistence, rendering, or tool execution logic.

Verification Status

• Passed: npm run release:check.
• Passed: targeted regression test npx vitest --run test/unit/schema.test.ts.
• Passed: npm run typecheck, Biome check, npm test, npm run build, source import smoke, dist import smoke, npm pack --dry-run, clean tarball install smoke, and npm audit --audit-level=low.
• Skipped: real Pi dogfood; this patch only changes tool schema metadata and npm publication is being handled manually.