@arhen/pi-core-subagent 1.3.39 → 1.3.41

package/README.md

@@ -147,9 +147,11 @@ On completion the extension commits the child's changes (the child is told not t
 git merge --no-ff subagents/<run>/<task>
 ```
 
-**Branch relationships — read this before merging.** A write task that `needs` a completed write task is **stacked**: its worktree branches from the upstream's branch, so the child actually sees the files its upstream wrote (basing on main `HEAD` would hand it a tree without them, and its merge would revert the upstream). The summary says `Stacked on <branch> — merge that branch FIRST`; merge in dependency order.
+**Branch relationships — read this before merging.** A write task that `needs` a completed write task is **stacked**: its worktree branches from the upstream's branch, so the child actually sees the files its upstream wrote. A stacked branch *contains* its upstream's commits, so merge order doesn't matter — merging the stacked branch brings both, and the upstream's own merge is then a no-op.
 
-Same-wave write tasks are **siblings**: both branch from the same base, so they are independent, not stacked. When two siblings changed the same file the summary emits `CONFLICT RISK` naming the overlap — the second `git merge` will be a real 3-way. Siblings that touched *different* but coupled files (a schema and its consumer) merge cleanly and can still break at runtime; that one is on you.
+Why this matters (verified against real git, not just reasoned about): when a downstream child *can't* see its upstream's work, merging produces spurious conflicts, half-clobbered files where the child's side looks like a phantom delete, and — worst — **clean merges that leave a broken tree**. If the upstream renamed `login`→`signIn` and the downstream wrote new code importing `login`, git reports success with exit 0 and the code doesn't compile. Stacking removes that class by construction.
+
+Same-wave write tasks are **siblings**: both branch from the same base, so they are independent. When two siblings changed the same file the summary emits `CONFLICT RISK` naming the overlap — the second `git merge` is a real 3-way and fails loudly, which is the safe outcome. The dangerous case is siblings touching *different* but coupled files: that merges clean and breaks at runtime. Nothing can detect it for you.
 
 **Dependencies are shared, not isolated.** `node_modules` is symlinked to the main checkout, so dependency writes escape the worktree: children are instructed never to install, upgrade, or delete deps. A task that genuinely needs a dependency change should edit the manifest and say so.
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@arhen/pi-core-subagent",
-	"version": "1.3.39",
+	"version": "1.3.41",
 	"type": "module",
 	"description": "pi extension: fast in-process subagents with a dependency-graph scheduler (needs edges gate tasks and carry upstream output into dependent prompts), plus background runs, intercom and agent-to-agent mailbox. Leader defines agents inline.",
 	"license": "MIT",

package/src/child.ts

@@ -1,5 +1,5 @@
 /**
- * Child-session tools + watchdog.
+ * Child-session tools.
  *
  * When `allowIntercom: true`, children get four talk tools:
  *   - ask_parent            blocking Q&A with the leader (parent)
@@ -107,49 +107,3 @@ export function createChildTools(taskId: string, handlers: ChildHandlers): ToolD
 		},
 	];
 }
-
-/**
- * Watchdog — a subagent is "stalled" when it produces no events for stallMs.
- * In-process AgentSessions have no process-exit signal, so we synthesize one
- * via event-heartbeat. Every relevant child event must call touch().
- */
-export interface Watchdog {
-	touch(): void;
-	readonly promise: Promise<never>;
-	dispose(): void;
-}
-
-export function createWatchdog(stallMs: number, label: string): Watchdog {
-	let lastEventAt = Date.now();
-	let disposed = false;
-	let timer: ReturnType<typeof setInterval> | undefined;
-
-	const promise = new Promise<never>((_, reject) => {
-		const interval = Math.max(1000, Math.min(5000, Math.floor(stallMs / 4)));
-		timer = setInterval(() => {
-			if (disposed) return;
-			if (Date.now() - lastEventAt > stallMs) {
-				disposed = true;
-				if (timer) clearInterval(timer);
-				timer = undefined;
-				reject(new Error(`${label} stalled: no activity for ${Math.round(stallMs / 1000)}s`));
-			}
-		}, interval);
-		timer.unref?.();
-	});
-
-	return {
-		touch() {
-			lastEventAt = Date.now();
-		},
-		promise,
-		dispose() {
-			if (disposed) return;
-			disposed = true;
-			if (timer) {
-				clearInterval(timer);
-				timer = undefined;
-			}
-		},
-	};
-}

package/src/format.ts

@@ -204,7 +204,12 @@ function worktreeLine(task: TaskSnapshot, siblings?: TaskSnapshot[]): string {
 			? ` (${task.changedFiles.length} file(s): ${truncateText(task.changedFiles.join(", "), 160)})`
 			: "";
 		parts.push(`Branch: ${task.branch}${files} — merge with \`git merge --no-ff ${task.branch}\` after review.`);
-		if (task.stackedOn) parts.push(`Stacked on ${task.stackedOn} — merge that branch FIRST.`);
+		// Stacked branches CONTAIN their upstream, so either merge order gives the
+		// same tree (merging this one pulls the upstream in; the upstream's own merge
+		// is then a no-op). Say that, rather than implying an ordering requirement.
+		if (task.stackedOn) {
+			parts.push(`Stacked on ${task.stackedOn} — contains that branch's commits, so merging this one brings both.`);
+		}
 		// Sibling branches are independent, not stacked: overlapping files mean the
 		// second merge is a real 3-way, and non-overlapping-but-coupled edits break
 		// silently. Both are computable from changedFiles, so say so.

package/src/manager.ts

@@ -17,7 +17,7 @@ import {
 } from "@earendil-works/pi-coding-agent";
 import type { TUI } from "@earendil-works/pi-tui";
 import { resolveAgentFile } from "./agentfile.ts";
-import { CHILD_TALK_TOOLS, type ChildHandlers, createChildTools, createWatchdog, type Watchdog } from "./child.ts";
+import { CHILD_TALK_TOOLS, type ChildHandlers, createChildTools } from "./child.ts";
 import {
 	activitySnippet,
 	describeCall,
@@ -56,16 +56,20 @@ import {
 
 export const DEFAULT_CONCURRENCY = 3;
 export const MAX_CONCURRENCY = 8;
-/** No default wall-clock cap: a subagent runs until its task is done, it stalls, or the user aborts. */
-/** Hard wall-clock ceiling per child. The stall watchdog is touched by every
- *  event, so a child stuck in a retry/compaction livelock emits forever and is
- *  never "stalled" — only a cap that events CANNOT reset bounds that. */
+/**
+ * Hard wall-clock ceiling per child — the ONLY liveness bound.
+ *
+ * There used to be a second one, an event-heartbeat "stall" watchdog. It was
+ * deleted: it was armed before the child session even existed, so the only
+ * window it could fire in was a slow startup (where firing is always wrong),
+ * and once events flowed it could never fire at all. Every observed firing
+ * across three releases was a false kill. A wedged child that emits events was
+ * always bounded by this cap alone; nothing else changed by removing it.
+ */
 const DEFAULT_RUNTIME_MS = 3_600_000; // 1 h
-/** Last-resort hang detector, not a latency budget. A healthy child can be
- *  silent for minutes (big-context upload, non-streamed reasoning, provider
- *  retry backoff), so this is deliberately far above any normal quiet window —
- *  killing a working child is much worse than waiting out a dead one. */
-const DEFAULT_STALL_MS = 900_000; // 15 min
+/** "Unlimited" still has a ceiling — an unbounded child pins hasActiveRun() and
+ *  its concurrency slot for the life of the session. */
+const UNLIMITED_RUNTIME_MS = 21_600_000; // 6 h
 /** Cap on a child's wait for reply_subagent — an ignored question must not pin the run open forever. */
 const PARENT_REPLY_TIMEOUT_MS = 600_000; // 10 min
 /** Intercom messages buffered per park before the followUp path takes over. */
@@ -241,7 +245,7 @@ export class SubagentManager {
 	private pendingReplies = new Map<string, PendingReply>();
 	private liveChildren = new Map<
 		string,
-		{ abort: () => void; dispose: () => void; touchWatchdog: () => void; steer: (message: string) => void }
+		{ abort: () => void; dispose: () => void; steer: (message: string) => void }
 	>();
 	private mailboxes: Mailbox = createMailbox();
 	/** Live worktrees by `${runId}:${taskId}` — lets cancel drop dirs and keeps
@@ -595,7 +599,6 @@ export class SubagentManager {
 	private makeChildHandlers(run: RunSnapshot, task: TaskSnapshot, ctx: ExtensionContext): ChildHandlers {
 		return {
 			onAskParent: async (_taskId, question) => {
-				const key = `${run.id}:${task.id}`;
 				// A tool call already in flight can reach here AFTER the task ended
 				// (abort/timeout/cancel). Reviving it would leave a "running" task in a
 				// finished run — hasActiveRun() then never clears.
@@ -603,7 +606,6 @@ export class SubagentManager {
 					return "(your task has already ended — stop work and return immediately)";
 				}
 				this.updateTask(run, task, { status: "awaiting_parent" }, ctx);
-				this.liveChildren.get(key)?.touchWatchdog();
 				// While the leader is parked in await_subagent the question rides the wait
 				// (no steering queue, no turn boundary); otherwise it goes out as a notice.
 				// Either way the pending reply entry must exist, or reply_subagent has
@@ -611,24 +613,17 @@ export class SubagentManager {
 				if (!this.collectParked(run.id, { kind: "ask", taskId: task.id, agent: task.agent, text: question })) {
 					this.notifyParent(run, "asked", { taskId: task.id, question });
 				}
-				// A waiting child is not stalled — keep the watchdog fed until the reply.
-				// But the wait is BOUNDED: an unanswered question would otherwise keep the
-				// run non-terminal forever (widget never clears, run never settles).
-				const keepAlive = setInterval(() => this.liveChildren.get(key)?.touchWatchdog(), 30_000);
-				try {
-					const reply = await this.awaitParentReply(run.id, task.id, PARENT_REPLY_TIMEOUT_MS);
-					// Cancel wins over a reply that arrived in the same tick: never move a
-					// terminal task back to "running" (that would let a canceled task be
-					// reported as completed).
-					if (TERMINAL.includes(task.status)) {
-						return "(your task was canceled while you waited — stop work and return immediately)";
-					}
-					this.updateTask(run, task, { status: "running" }, ctx);
-					this.liveChildren.get(key)?.touchWatchdog();
-					return reply;
-				} finally {
-					clearInterval(keepAlive);
+				// The wait is BOUNDED: an unanswered question would otherwise keep the run
+				// non-terminal forever (widget never clears, run never settles).
+				const reply = await this.awaitParentReply(run.id, task.id, PARENT_REPLY_TIMEOUT_MS);
+				// Cancel wins over a reply that arrived in the same tick: never move a
+				// terminal task back to "running" (that would let a canceled task be
+				// reported as completed).
+				if (TERMINAL.includes(task.status)) {
+					return "(your task was canceled while you waited — stop work and return immediately)";
 				}
+				this.updateTask(run, task, { status: "running" }, ctx);
+				return reply;
 			},
 			onNotifyParent: (_taskId, message, level) => {
 				this.emit("subagent:intercom", { runId: run.id, taskId: task.id, kind: "notify", level, message });
@@ -706,14 +701,8 @@ export class SubagentManager {
 		task: TaskSnapshot,
 		ctx: ExtensionContext,
 		onUpdate: ((partial: any) => void) | undefined,
-		watchdog: Watchdog,
 		state: ChildEventState,
 	): void {
-		// ANY event is proof of life. The old allowlist ignored message_start,
-		// turn_start/end, compaction and auto-retry, so a child was killed during
-		// silent-but-healthy windows — context upload, a provider that doesn't
-		// stream reasoning, retry backoff — and surfaced as "Error: terminated".
-		watchdog.touch();
 		const active =
 			event.type === "message_update" ||
 			event.type === "message_end" ||
@@ -919,7 +908,6 @@ export class SubagentManager {
 		let unsubscribe: (() => void) | undefined;
 		let timeout: ReturnType<typeof setTimeout> | undefined;
 		let abortListener: (() => void) | undefined;
-		const watchdog = createWatchdog(DEFAULT_STALL_MS, `Subagent ${task.agent}`);
 		const childState: ChildEventState = {};
 
 		const key = `${run.id}:${task.id}`;
@@ -978,7 +966,7 @@ export class SubagentManager {
 			});
 
 			unsubscribe = child.subscribe((event: AgentSessionEvent) =>
-				this.onChildEvent(event, run, task, ctx, onUpdate, watchdog, childState),
+				this.onChildEvent(event, run, task, ctx, onUpdate, childState),
 			);
 
 			const abortChild = () => {
@@ -999,8 +987,7 @@ export class SubagentManager {
 			}
 			this.liveChildren.set(key, {
 				abort: () => void child?.abort(),
-				dispose: () => watchdog.dispose(),
-				touchWatchdog: () => watchdog.touch(),
+				dispose: () => child?.dispose(),
 				// Inject a steering message mid-run; queues as steer if the child is streaming.
 				steer: (message) =>
 					void child?.prompt(message, { streamingBehavior: "steer" }).catch((err) =>
@@ -1010,12 +997,12 @@ export class SubagentManager {
 					),
 			});
 
-			// auto-limit off = drop the DEFAULT ceiling, but never an explicit request:
-			// discarding the leader's own maxRuntimeMs removed the last escape from a
-			// livelocked child.
-			const maxRuntimeMs = input.maxRuntimeMs ?? (this.autoLimit ? DEFAULT_RUNTIME_MS : 0);
+			// The ceiling is the ONLY bound on a child that emits events forever (retry
+			// or tool-call livelock). So auto-limit off RAISES it, never removes it —
+			// removing it reproduced the immortal-child hang.
+			const maxRuntimeMs = input.maxRuntimeMs ?? (this.autoLimit ? DEFAULT_RUNTIME_MS : UNLIMITED_RUNTIME_MS);
 			const promptPromise = child.prompt(task.task, { source: "extension" });
-			const races: Promise<unknown>[] = [promptPromise, childFailurePromise, childEndPromise, watchdog.promise];
+			const races: Promise<unknown>[] = [promptPromise, childFailurePromise, childEndPromise];
 			if (maxRuntimeMs > 0) {
 				races.push(
 					new Promise<never>((_, reject) => {
@@ -1108,12 +1095,21 @@ export class SubagentManager {
 			} catch {
 				/* ignore */
 			}
+			// Publish whatever the child DID say before it was killed. A timeout or
+			// abort used to discard it, so a chain dependent received nothing at all
+			// while the child's partial work was still committed to its branch.
+			const salvaged =
+				task.finalText ||
+				truncateText(
+					(child?.messages as AssistantMessage[] | undefined)?.map(getFirstText).filter(Boolean).at(-1) || "",
+				);
 			this.updateTask(
 				run,
 				task,
 				{
 					status: aborted ? "aborted" : ((subagentStatus as TaskStatus) ?? "failed"),
 					error: err instanceof Error ? err.message : String(err),
+					finalText: salvaged || undefined,
 					endedAt: Date.now(),
 				},
 				ctx,
@@ -1127,7 +1123,6 @@ export class SubagentManager {
 			this.pendingReplies.delete(key);
 			abortListener?.();
 			unsubscribe?.();
-			watchdog.dispose();
 			if (timeout) clearTimeout(timeout);
 			child?.dispose();
 			// Failed/aborted: let the aborted child's last writes land (its tools may

package/src/worktree.ts

@@ -28,6 +28,11 @@ const BRANCH_PREFIX = "subagents/";
 const COMMIT_CONFIG = ["-c", "commit.gpgsign=false", "-c", "user.name=pi subagent", "-c", "user.email=subagent@local"];
 const GIT_TIMEOUT_MS = 120_000;
 const GIT_MAX_BUFFER = 32 * 1024 * 1024;
+/** Capture stderr instead of inheriting it. execFileSync only redirects stdout by
+ *  default, so git's progress chatter ("Preparing worktree (new branch ...)")
+ *  printed straight into the TUI and corrupted the rendered frame. Captured
+ *  stderr still reaches us on failure via the thrown error. */
+const GIT_STDIO: ("ignore" | "pipe")[] = ["ignore", "pipe", "pipe"];
 
 function git(root: string, args: string[]): string {
 	return gitRaw(root, args).trim();
@@ -39,6 +44,7 @@ function gitRaw(root: string, args: string[]): string {
 		encoding: "utf8",
 		timeout: GIT_TIMEOUT_MS,
 		maxBuffer: GIT_MAX_BUFFER,
+		stdio: GIT_STDIO,
 	});
 }
 
@@ -49,6 +55,7 @@ function gitIn(dir: string, args: string[]): string {
 		encoding: "utf8",
 		timeout: GIT_TIMEOUT_MS,
 		maxBuffer: GIT_MAX_BUFFER,
+		stdio: GIT_STDIO,
 	}).trim();
 }
 
@@ -269,9 +276,30 @@ export function cleanupMerged(root: string, opts: { skipBranches?: Set<string>;
 		cleaned += 1;
 	}
 	prune(root);
+	pruneEmptyRunDirs(root);
 	return cleaned;
 }
 
+/** Remove `<subagents>/<runId>/` once its task dirs are gone. Cleanup left these
+ *  behind forever, so `.git/subagents` grew one empty dir per run. */
+function pruneEmptyRunDirs(root: string): void {
+	const sub = subagentsDir(root);
+	if (!sub || !existsSync(sub)) return;
+	try {
+		for (const entry of readdirSync(sub, { withFileTypes: true })) {
+			if (!entry.isDirectory()) continue;
+			const runDir = join(sub, entry.name);
+			try {
+				if (readdirSync(runDir).length === 0) rmSync(runDir, { recursive: true, force: true });
+			} catch {
+				/* skip */
+			}
+		}
+	} catch {
+		/* best-effort */
+	}
+}
+
 /** Branch names currently checked out in any worktree, or undefined when git
  *  couldn't be asked — callers MUST treat undefined as "unknown", never as "none",
  *  or they will happily delete live checkouts. */