@astroanywhere/agent 0.3.1 → 0.3.3

package/dist/lib/task-executor.d.ts

@@ -40,6 +40,8 @@ export declare class TaskExecutor {
     private branchLockManager;
     /** Per-directory lock for serializing tasks on non-git directories (no worktree isolation). */
     private directoryLockManager;
+    /** Tasks claimed by submitTask() but not yet in runningTasks (closes TOCTOU dedup gap). */
+    private claimedTasks;
     private openclawBridge;
     private tasksByDirectory;
     private pendingSafetyChecks;

package/dist/lib/task-executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"task-executor.d.ts","sourceRoot":"","sources":["../../src/lib/task-executor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,KAAK,EAAE,IAAI,EAA4B,aAAa,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAI7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAsJ3D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,eAAe,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;CACtC;AAuBD,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,YAAY,CAAuC;IAC3D,OAAO,CAAC,SAAS,CAA+C;IAChE,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAiD;IACjE,OAAO,CAAC,WAAW,CAAU;IAC7B,OAAO,CAAC,YAAY,CAAC,CAAS;IAC9B,OAAO,CAAC,iBAAiB,CAAU;IACnC,OAAO,CAAC,UAAU,CAAkB;IACpC,OAAO,CAAC,WAAW,CAAU;IAC7B,OAAO,CAAC,UAAU,CAAU;IAC5B,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,YAAY,CAAkB;IACtC,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,iBAAiB,CAA2B;IACpD,+FAA+F;IAC/F,OAAO,CAAC,oBAAoB,CAA2B;IACvD,OAAO,CAAC,cAAc,CAA+B;IAGrD,OAAO,CAAC,gBAAgB,CAAuC;IAC/D,OAAO,CAAC,mBAAmB,CAA8C;IAEzE,gFAAgF;IAChF,OAAO,CAAC,iBAAiB,CASV;IAEf,gFAAgF;IAChF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,0BAA0B,CAAkB;gBAExD,OAAO,EAAE,mBAAmB;IAyBxC;;;OAGG;IACH,iBAAiB,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAW/C;;OAEG;IACG,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAsH3C;;OAEG;IACG,oBAAoB,CACxB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,GACtD,OAAO,CAAC,IAAI,CAAC;IAWhB;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAgCnC;;;OAGG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiErE;;OAEG;IACH,aAAa,IAAI;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAOpD;;OAEG;IACH,SAAS,IAAI,IAAI;IAmCjB;;OAEG;IACH,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAMxC;;;;;;OAMG;IACG,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,UAAQ,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAgCxI,kEAAkE;IAClE,OAAO,CAAC,kBAAkB;IAI1B,sDAAsD;IACtD,OAAO,CAAC,sBAAsB;IAS9B;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAU9B;;;;OAIG;YACW,sBAAsB;IA6HpC;;OAEG;YACW,kBAAkB;IAKhC;;OAEG;YACW,qBAAqB;IAkGnC;;OAEG;YACW,cAAc;IAY5B,+EAA+E;IAC/E,OAAO,CAAC,eAAe;IAIvB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAO1B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAY5B;;OAEG;IACH,OAAO,CAAC,yBAAyB;YAMnB,WAAW;YAqpBX,oBAAoB;IAsIlC;;;;OAIG;YACW,sBAAsB;YAmFtB,UAAU;IA6BxB,OAAO,CAAC,YAAY;CAuBrB"}
+{"version":3,"file":"task-executor.d.ts","sourceRoot":"","sources":["../../src/lib/task-executor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,KAAK,EAAE,IAAI,EAAwC,aAAa,EAAE,MAAM,aAAa,CAAC;AAC7F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAI7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAsJ3D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,eAAe,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;CACtC;AAuBD,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,YAAY,CAAuC;IAC3D,OAAO,CAAC,SAAS,CAA+C;IAChE,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAiD;IACjE,OAAO,CAAC,WAAW,CAAU;IAC7B,OAAO,CAAC,YAAY,CAAC,CAAS;IAC9B,OAAO,CAAC,iBAAiB,CAAU;IACnC,OAAO,CAAC,UAAU,CAAkB;IACpC,OAAO,CAAC,WAAW,CAAU;IAC7B,OAAO,CAAC,UAAU,CAAU;IAC5B,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,YAAY,CAAkB;IACtC,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,iBAAiB,CAA2B;IACpD,+FAA+F;IAC/F,OAAO,CAAC,oBAAoB,CAA2B;IACvD,2FAA2F;IAC3F,OAAO,CAAC,YAAY,CAA0B;IAC9C,OAAO,CAAC,cAAc,CAA+B;IAGrD,OAAO,CAAC,gBAAgB,CAAuC;IAC/D,OAAO,CAAC,mBAAmB,CAA8C;IAEzE,gFAAgF;IAChF,OAAO,CAAC,iBAAiB,CASV;IAEf,gFAAgF;IAChF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,0BAA0B,CAAkB;gBAExD,OAAO,EAAE,mBAAmB;IAyBxC;;;OAGG;IACH,iBAAiB,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAW/C;;OAEG;IACG,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAsI3C;;OAEG;IACG,oBAAoB,CACxB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,GACtD,OAAO,CAAC,IAAI,CAAC;IAWhB;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAgCnC;;;OAGG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiErE;;OAEG;IACH,aAAa,IAAI;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAOpD;;OAEG;IACH,SAAS,IAAI,IAAI;IAmCjB;;OAEG;IACH,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAMxC;;;;;;OAMG;IACG,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,UAAQ,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAgCxI,kEAAkE;IAClE,OAAO,CAAC,kBAAkB;IAI1B,sDAAsD;IACtD,OAAO,CAAC,sBAAsB;IAS9B;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAU9B;;;;OAIG;YACW,sBAAsB;IA6HpC;;OAEG;YACW,kBAAkB;IAKhC;;OAEG;YACW,qBAAqB;IAkGnC;;OAEG;YACW,cAAc;IAY5B,+EAA+E;IAC/E,OAAO,CAAC,eAAe;IAIvB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAO1B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAY5B;;OAEG;IACH,OAAO,CAAC,yBAAyB;YAMnB,WAAW;YAmtBX,oBAAoB;IAyIlC;;;;OAIG;YACW,sBAAsB;YAmFtB,UAAU;IA6BxB,OAAO,CAAC,YAAY;CAuBrB"}

package/dist/lib/task-executor.js

@@ -154,6 +154,8 @@ export class TaskExecutor {
     branchLockManager = new BranchLockManager();
     /** Per-directory lock for serializing tasks on non-git directories (no worktree isolation). */
     directoryLockManager = new BranchLockManager();
+    /** Tasks claimed by submitTask() but not yet in runningTasks (closes TOCTOU dedup gap). */
+    claimedTasks = new Set();
     openclawBridge = null;
     // Safety tracking
     tasksByDirectory = new Map(); // workdir -> taskIds
@@ -201,111 +203,126 @@ export class TaskExecutor {
      * Submit a task for execution (with safety checks)
      */
     async submitTask(task) {
-        // Skip workingDirectory resolution for lightweight text-only tasks (no file system access)
-        const isTextOnlyTask = task.type === 'summarize' || task.type === 'chat' || task.type === 'plan';
-        // Text-only tasks (plan/chat/summarize) can run without a working directory.
-        // For all others, resolve the directory or auto-provision one.
-        let resolvedWorkDir;
-        if (isTextOnlyTask && !task.workingDirectory) {
-            resolvedWorkDir = undefined;
+        // Dedup: reject if this task is already running OR claimed by a concurrent submitTask().
+        // runningTasks is only populated inside executeTask() (line ~1079), but submitTask()
+        // does async work (safety checks, git detection) before reaching executeTask(). Without
+        // claimedTasks, two rapid dispatches for the same taskId could both pass the runningTasks
+        // check and execute concurrently (TOCTOU race).
+        if (this.runningTasks.has(task.id) || this.claimedTasks.has(task.id)) {
+            console.warn(`[executor] Task ${task.id}: already running or claimed, skipping duplicate dispatch`);
+            return;
         }
-        else {
-            try {
-                resolvedWorkDir = resolveWorkingDirectory(task.workingDirectory, task.projectId);
+        this.claimedTasks.add(task.id);
+        try {
+            // Skip workingDirectory resolution for lightweight text-only tasks (no file system access)
+            const isTextOnlyTask = task.type === 'summarize' || task.type === 'chat' || task.type === 'plan';
+            // Text-only tasks (plan/chat/summarize) can run without a working directory.
+            // For all others, resolve the directory or auto-provision one.
+            let resolvedWorkDir;
+            if (isTextOnlyTask && !task.workingDirectory) {
+                resolvedWorkDir = undefined;
             }
-            catch (err) {
-                // Fail fast with a clear error instead of entering the execution pipeline.
-                // Without this, tasks with non-existent directories become dead jobs.
-                const errorMsg = err instanceof Error ? err.message : String(err);
-                console.error(`[executor] Task ${task.id}: ${errorMsg}`);
-                this.wsClient.sendTaskResult({
-                    taskId: task.id,
-                    status: 'failed',
-                    error: errorMsg,
-                    completedAt: new Date().toISOString(),
-                });
-                this.wsClient.removeActiveTask(task.id);
+            else {
+                try {
+                    resolvedWorkDir = resolveWorkingDirectory(task.workingDirectory, task.projectId);
+                }
+                catch (err) {
+                    // Fail fast with a clear error instead of entering the execution pipeline.
+                    // Without this, tasks with non-existent directories become dead jobs.
+                    const errorMsg = err instanceof Error ? err.message : String(err);
+                    console.error(`[executor] Task ${task.id}: ${errorMsg}`);
+                    this.wsClient.sendTaskResult({
+                        taskId: task.id,
+                        status: 'failed',
+                        error: errorMsg,
+                        completedAt: new Date().toISOString(),
+                    });
+                    this.wsClient.removeActiveTask(task.id);
+                    return;
+                }
+            }
+            const normalizedTask = {
+                ...task,
+                workingDirectory: resolvedWorkDir ?? '',
+            };
+            // Determine if worktree isolation will be used for this task.
+            // Check git availability early: non-git directories cannot use git worktrees,
+            // so willUseWorktree must be false for them. Without this, the safety check
+            // thinks worktree isolation is active and allows parallel execution, but
+            // prepareTaskWorkspace() later falls back to direct in-place execution —
+            // causing file conflicts when multiple tasks run on the same non-git directory.
+            const isGitDir = !isTextOnlyTask && normalizedTask.workingDirectory && this.gitAvailable
+                ? await isGitRepo(normalizedTask.workingDirectory)
+                : false;
+            const willUseWorktree = this.useWorktree
+                && normalizedTask.useWorktree !== false
+                && normalizedTask.deliveryMode !== 'direct'
+                && (isGitDir || normalizedTask.deliveryMode === 'copy');
+            if (!isTextOnlyTask && task.skipSafetyCheck) {
+                // Server already approved safety for this directory — skip the prompt.
+                // Only init git when the original safety decision was 'init-git'.
+                // When safetyDecision is 'proceed' (user chose non-git direct execution)
+                // or undefined (builtin template, text-only, etc.), skip git init entirely.
+                if (normalizedTask.safetyDecision === 'init-git') {
+                    const needsGitInit = this.gitAvailable && !(await isGitRepo(normalizedTask.workingDirectory));
+                    if (needsGitInit) {
+                        await initializeGit(normalizedTask.workingDirectory);
+                    }
+                }
+                this.trackTaskDirectory(normalizedTask);
+                if (this.runningTasks.size < this.maxConcurrentTasks) {
+                    await this.executeTask(normalizedTask, false);
+                }
+                else {
+                    this.taskQueue.push(normalizedTask);
+                    this.wsClient.sendTaskStatus(normalizedTask.id, 'queued', 0, 'Waiting for available slot');
+                }
                 return;
             }
-        }
-        const normalizedTask = {
-            ...task,
-            workingDirectory: resolvedWorkDir ?? '',
-        };
-        // Determine if worktree isolation will be used for this task.
-        // Check git availability early: non-git directories cannot use git worktrees,
-        // so willUseWorktree must be false for them. Without this, the safety check
-        // thinks worktree isolation is active and allows parallel execution, but
-        // prepareTaskWorkspace() later falls back to direct in-place execution —
-        // causing file conflicts when multiple tasks run on the same non-git directory.
-        const isGitDir = !isTextOnlyTask && normalizedTask.workingDirectory && this.gitAvailable
-            ? await isGitRepo(normalizedTask.workingDirectory)
-            : false;
-        const willUseWorktree = this.useWorktree
-            && normalizedTask.useWorktree !== false
-            && normalizedTask.deliveryMode !== 'direct'
-            && (isGitDir || normalizedTask.deliveryMode === 'copy');
-        if (!isTextOnlyTask && task.skipSafetyCheck) {
-            // Server already approved safety for this directory — skip the prompt.
-            // Only init git when the original safety decision was 'init-git'.
-            // When safetyDecision is 'proceed' (user chose non-git direct execution)
-            // or undefined (builtin template, text-only, etc.), skip git init entirely.
-            if (normalizedTask.safetyDecision === 'init-git') {
-                const needsGitInit = this.gitAvailable && !(await isGitRepo(normalizedTask.workingDirectory));
-                if (needsGitInit) {
-                    await initializeGit(normalizedTask.workingDirectory);
+            if (!isTextOnlyTask) {
+                // Perform safety check (worktree flag affects tier assignment)
+                const safetyCheck = await this.performSafetyCheck(normalizedTask, willUseWorktree);
+                // Handle safety tiers
+                if (safetyCheck.tier === WorkdirSafetyTier.UNSAFE) {
+                    // QUEUE: serial execution required (non-git parallel, or git + uncommitted + no worktree).
+                    // Instead of failing, queue the task and execute it once the current task
+                    // in this directory completes. Track it so further tasks also queue behind it.
+                    console.log(`[executor] Task ${normalizedTask.id}: queued for serial execution (${safetyCheck.parallelTaskCount} active in dir)`);
+                    this.trackTaskDirectory(normalizedTask);
+                    this.taskQueue.push(normalizedTask);
+                    const reason = safetyCheck.isGitRepo
+                        ? 'uncommitted changes without worktree isolation'
+                        : 'non-git directory';
+                    this.wsClient.sendTaskStatus(normalizedTask.id, 'queued', 0, `Waiting for ${safetyCheck.parallelTaskCount} task(s) in this directory to complete (serial execution: ${reason})`);
+                    return;
+                }
+                if (safetyCheck.tier === WorkdirSafetyTier.RISKY && !this.allowNonGit) {
+                    // PROMPT: risky conditions require user decision
+                    await this.requestSafetyDecision(normalizedTask, safetyCheck);
+                    // Execution will continue when decision is received
+                    return;
+                }
+                if (safetyCheck.tier === WorkdirSafetyTier.GUARDED) {
+                    // WARN: inform user but continue
+                    this.wsClient.sendTaskStatus(normalizedTask.id, 'queued', 0, safetyCheck.warning);
                 }
             }
-            this.trackTaskDirectory(normalizedTask);
+            // Track task by directory (skip for text-only tasks without a working directory)
+            if (normalizedTask.workingDirectory) {
+                this.trackTaskDirectory(normalizedTask);
+            }
+            // Check if we can run immediately
             if (this.runningTasks.size < this.maxConcurrentTasks) {
-                await this.executeTask(normalizedTask, false);
+                await this.executeTask(normalizedTask, this.useSandbox);
             }
             else {
+                // Queue the task
                 this.taskQueue.push(normalizedTask);
                 this.wsClient.sendTaskStatus(normalizedTask.id, 'queued', 0, 'Waiting for available slot');
             }
-            return;
-        }
-        if (!isTextOnlyTask) {
-            // Perform safety check (worktree flag affects tier assignment)
-            const safetyCheck = await this.performSafetyCheck(normalizedTask, willUseWorktree);
-            // Handle safety tiers
-            if (safetyCheck.tier === WorkdirSafetyTier.UNSAFE) {
-                // QUEUE: serial execution required (non-git parallel, or git + uncommitted + no worktree).
-                // Instead of failing, queue the task and execute it once the current task
-                // in this directory completes. Track it so further tasks also queue behind it.
-                console.log(`[executor] Task ${normalizedTask.id}: queued for serial execution (${safetyCheck.parallelTaskCount} active in dir)`);
-                this.trackTaskDirectory(normalizedTask);
-                this.taskQueue.push(normalizedTask);
-                const reason = safetyCheck.isGitRepo
-                    ? 'uncommitted changes without worktree isolation'
-                    : 'non-git directory';
-                this.wsClient.sendTaskStatus(normalizedTask.id, 'queued', 0, `Waiting for ${safetyCheck.parallelTaskCount} task(s) in this directory to complete (serial execution: ${reason})`);
-                return;
-            }
-            if (safetyCheck.tier === WorkdirSafetyTier.RISKY && !this.allowNonGit) {
-                // PROMPT: risky conditions require user decision
-                await this.requestSafetyDecision(normalizedTask, safetyCheck);
-                // Execution will continue when decision is received
-                return;
-            }
-            if (safetyCheck.tier === WorkdirSafetyTier.GUARDED) {
-                // WARN: inform user but continue
-                this.wsClient.sendTaskStatus(normalizedTask.id, 'queued', 0, safetyCheck.warning);
-            }
-        }
-        // Track task by directory (skip for text-only tasks without a working directory)
-        if (normalizedTask.workingDirectory) {
-            this.trackTaskDirectory(normalizedTask);
-        }
-        // Check if we can run immediately
-        if (this.runningTasks.size < this.maxConcurrentTasks) {
-            await this.executeTask(normalizedTask, this.useSandbox);
         }
-        else {
-            // Queue the task
-            this.taskQueue.push(normalizedTask);
-            this.wsClient.sendTaskStatus(normalizedTask.id, 'queued', 0, 'Waiting for available slot');
+        finally {
+            this.claimedTasks.delete(task.id);
         }
     }
     /**
@@ -554,11 +571,11 @@ export class TaskExecutor {
             text: (data) => {
                 this.wsClient.sendTaskText(taskId, data, textSequence++);
             },
-            toolUse: (toolName, toolInput) => {
-                this.wsClient.sendTaskToolUse(taskId, toolName, toolInput);
+            toolUse: (toolName, toolInput, toolUseId) => {
+                this.wsClient.sendTaskToolUse(taskId, toolName, toolInput, toolUseId);
             },
-            toolResult: (toolName, result, success) => {
-                this.wsClient.sendTaskToolResult(taskId, toolName, result, success);
+            toolResult: (toolName, result, success, toolUseId) => {
+                this.wsClient.sendTaskToolResult(taskId, toolName, result, success, toolUseId);
             },
             fileChange: (path, action, linesAdded, linesRemoved, diff) => {
                 this.wsClient.sendTaskFileChange(taskId, path, action, linesAdded, linesRemoved, diff);
@@ -885,13 +902,13 @@ export class TaskExecutor {
                 resetIdleTimeout();
                 this.wsClient.sendTaskText(normalizedTask.id, data, textSequence++);
             },
-            toolUse: (toolName, toolInput) => {
+            toolUse: (toolName, toolInput, toolUseId) => {
                 resetIdleTimeout();
-                this.wsClient.sendTaskToolUse(normalizedTask.id, toolName, toolInput);
+                this.wsClient.sendTaskToolUse(normalizedTask.id, toolName, toolInput, toolUseId);
             },
-            toolResult: (toolName, result, success) => {
+            toolResult: (toolName, result, success, toolUseId) => {
                 resetIdleTimeout();
-                this.wsClient.sendTaskToolResult(normalizedTask.id, toolName, result, success);
+                this.wsClient.sendTaskToolResult(normalizedTask.id, toolName, result, success, toolUseId);
             },
             fileChange: (path, action, linesAdded, linesRemoved, diff) => {
                 resetIdleTimeout();
@@ -920,15 +937,36 @@ export class TaskExecutor {
         };
         this.runningTasks.set(normalizedTask.id, runningTask);
         this.wsClient.addActiveTask(normalizedTask.id);
+        // Task-level heartbeat: send a lightweight text event every 30s to keep the
+        // server's activity timer alive. This prevents the server's startup timeout
+        // from resetting the node to "planned" while we're doing workspace prep,
+        // delivery, cleanup, or any other long-running phase. The server only resets
+        // hasReceivedEvent from execution events (text, tool_use, etc.) — without
+        // this heartbeat, phases that don't produce those events (git operations,
+        // worktree creation, PR delivery) leave the server blind.
+        // 30s aligns with the server's heartbeat check interval and is well under
+        // the 3-minute startup timeout (STARTUP_TIMEOUT_MS in dispatch.ts).
+        const TASK_HEARTBEAT_INTERVAL_MS = 30_000;
+        let heartbeatSeq = 0;
+        const taskHeartbeatTimer = setInterval(() => {
+            // Send directly via wsClient to keep the server's activity timer alive
+            // WITHOUT resetting the agent-side idle timeout. stream.text() calls
+            // resetIdleTimeout(), which would make a hung agent run until hard cap
+            // instead of idle-timing out after 15 minutes of no real activity.
+            // Heartbeat text is intentionally empty — it exists only to keep the
+            // server's activity timer alive, not to display anything to the user.
+            this.wsClient.sendTaskText(normalizedTask.id, '', -(++heartbeatSeq));
+        }, TASK_HEARTBEAT_INTERVAL_MS);
         // Text-only tasks (plan/chat/summarize) without a working directory skip workspace prep
         const isTextOnly = normalizedTask.type === 'summarize' || normalizedTask.type === 'chat' || normalizedTask.type === 'plan';
         let prepared;
         try {
             prepared = isTextOnly && !normalizedTask.workingDirectory
                 ? { workingDirectory: '', cleanup: async () => { } }
-                : await this.prepareTaskWorkspace(normalizedTask, stream);
+                : await this.prepareTaskWorkspace(normalizedTask, stream, abortController.signal);
         }
         catch (prepErr) {
+            clearInterval(taskHeartbeatTimer);
             this.runningTasks.delete(normalizedTask.id);
             this.untrackTaskDirectory(task);
             // Do NOT removeActiveTask here — the caller's catch will send
@@ -950,6 +988,11 @@ export class TaskExecutor {
         // Start the idle timer
         resetIdleTimeout();
         let keepBranch = false;
+        // Deferred result — sent AFTER cleanup to prevent auto-dispatch race.
+        // The server dispatches downstream tasks immediately on receiving the result,
+        // and the new task's createWorktree() would fight with this task's cleanupWorktree()
+        // over the same .git directory (concurrent git worktree prune, branch -D, etc.).
+        let pendingResult;
         try {
             // Notify task started
             this.wsClient.sendTaskStatus(task.id, 'running', 0, 'Starting');
@@ -1035,6 +1078,7 @@ export class TaskExecutor {
                 ? `[${task.shortProjectId}/${task.shortNodeId}] ${rawTitle}`
                 : rawTitle;
             if (prepared.branchName && result.status === 'completed') {
+                stream.text?.(`\n── [Astro] Delivering changes (mode: ${deliveryMode})...\n`);
                 this.wsClient.sendTaskStatus(task.id, 'running', 90, 'Delivering changes...');
                 // Build PR body: enrich with summary data when available
                 const prBodyParts = [];
@@ -1075,6 +1119,7 @@ export class TaskExecutor {
                         console.log(`[executor] Task ${task.id}: copy mode, worktree preserved at ${prepared.workingDirectory}`);
                     }
                     else if (deliveryMode === 'branch') {
+                        stream.text?.(`── [Astro] Merging into project branch ${prepared.projectBranch ?? 'local'}...\n`);
                         // Branch mode: commit locally, merge into project branch if available.
                         // The merge lock is held only during the squash-merge (seconds, not minutes),
                         // allowing tasks to execute in parallel. The squash merge naturally handles
@@ -1116,6 +1161,7 @@ export class TaskExecutor {
                                 if (mergeResult.merged) {
                                     result.deliveryStatus = 'success';
                                     result.commitAfterSha = mergeResult.commitSha;
+                                    stream.text?.(`── [Astro] Merged into ${prepared.projectBranch} (${mergeResult.commitSha?.slice(0, 7)})\n`);
                                     console.log(`[executor] Task ${task.id}: merged into ${prepared.projectBranch} (${mergeResult.commitSha})`);
                                     // Sync project worktree to reflect the merged changes on disk
                                     if (prepared.projectWorktreePath && prepared.projectBranch && prepared.gitRoot) {
@@ -1131,6 +1177,7 @@ export class TaskExecutor {
                                         : null;
                                     if (taskContext?.sessionId && this.isResumableAdapter(adapter) && attempt < MAX_MERGE_ATTEMPTS) {
                                         const conflictFiles = mergeResult.conflictFiles?.join(', ') ?? 'unknown files';
+                                        stream.text?.(`── [Astro] Merge conflict in: ${conflictFiles} — agent resolving (attempt ${attempt})...\n`);
                                         console.log(`[executor] Task ${task.id}: merge conflict (attempt ${attempt}), resuming ${adapter.name} to resolve: ${conflictFiles}`);
                                         this.wsClient.sendTaskStatus(task.id, 'running', 97, `Merge conflict — agent resolving (attempt ${attempt})...`);
                                         // Resume agent session with conflict resolution instructions.
@@ -1179,6 +1226,7 @@ export class TaskExecutor {
                     }
                     else if (deliveryMode === 'push') {
                         // Push branch to remote, but don't create a PR — user creates PR manually
+                        stream.text?.(`── [Astro] Pushing branch ${prepared.branchName} to origin...\n`);
                         this.wsClient.sendTaskStatus(task.id, 'running', 95, 'Pushing branch...');
                         console.log(`[executor] Task ${task.id}: push mode, pushing branch ${prepared.branchName}`);
                         const prResult = await pushAndCreatePR(prepared.workingDirectory, {
@@ -1193,20 +1241,24 @@ export class TaskExecutor {
                             // Delivery failure — don't override execution status
                             result.deliveryStatus = 'failed';
                             result.deliveryError = `Push delivery failed: ${prResult.error}`;
+                            stream.text?.(`── [Astro] Push failed: ${prResult.error}\n`);
                             console.error(`[executor] Task ${task.id}: push delivery failed: ${prResult.error}`);
                         }
                         else if (prResult.pushed) {
                             result.deliveryStatus = 'success';
                             keepBranch = true;
+                            stream.text?.(`── [Astro] Branch pushed to origin: ${prepared.branchName}\n`);
                             console.log(`[executor] Task ${task.id}: branch pushed (${prepared.branchName})`);
                         }
                         else {
                             result.deliveryStatus = 'skipped';
+                            stream.text?.(`── [Astro] No changes to push\n`);
                             console.log(`[executor] Task ${task.id}: no changes to push`);
                         }
                     }
                     else {
                         // 'pr' — push + create PR, auto-merge into project branch if applicable
+                        stream.text?.(`── [Astro] Creating pull request for branch ${prepared.branchName}...\n`);
                         this.wsClient.sendTaskStatus(task.id, 'running', 94, 'Rebasing before push...');
                         // Pre-push rebase: if the target branch moved forward, rebase our task
                         // branch so the PR will be cleanly mergeable. The branch hasn't been
@@ -1239,6 +1291,7 @@ export class TaskExecutor {
                             result.commitBeforeSha = prResult.commitBeforeSha;
                             result.commitAfterSha = prResult.commitAfterSha;
                             keepBranch = true;
+                            stream.text?.(`── [Astro] Pull request created: ${prResult.prUrl}\n`);
                             if (prResult.autoMergeFailed) {
                                 // PR was created but auto-merge failed (likely conflict).
                                 // If the adapter supports session resume, ask the agent to
@@ -1250,6 +1303,7 @@ export class TaskExecutor {
                                     : null;
                                 if (prTaskContext?.sessionId && this.isResumableAdapter(adapter) && hasProjectBranch && prepared.branchName && prepared.baseBranch && prResult.prNumber && prepared.gitRoot) {
                                     for (let attempt = 1; attempt <= MAX_PR_MERGE_ATTEMPTS; attempt++) {
+                                        stream.text?.(`── [Astro] PR auto-merge failed — agent resolving conflict (attempt ${attempt})...\n`);
                                         console.log(`[executor] Task ${task.id}: PR auto-merge failed (attempt ${attempt}), resuming ${adapter.name} to resolve`);
                                         this.wsClient.sendTaskStatus(task.id, 'running', 97, `PR merge conflict — agent resolving (attempt ${attempt})...`);
                                         // Resume agent session — agent rebases and force-pushes.
@@ -1307,15 +1361,18 @@ export class TaskExecutor {
                             result.deliveryStatus = 'failed';
                             result.deliveryError = `PR delivery failed: ${prResult.error}`;
                             keepBranch = prResult.pushed ?? false; // Keep branch if it was pushed
+                            stream.text?.(`── [Astro] PR delivery failed: ${prResult.error}\n`);
                             console.error(`[executor] Task ${task.id}: PR delivery failed: ${prResult.error}`);
                         }
                         else {
+                            stream.text?.(`── [Astro] No changes to deliver\n`);
                             console.log(`[executor] Task ${task.id}: no changes to push`);
                         }
                     }
                 }
                 catch (prError) {
                     const prMsg = prError instanceof Error ? prError.message : String(prError);
+                    stream.text?.(`── [Astro] Delivery failed: ${prMsg}\n`);
                     console.error(`[executor] Task ${task.id}: delivery (${deliveryMode}) failed: ${prMsg}`);
                     // Delivery failure — don't override execution status
                     result.deliveryStatus = 'failed';
@@ -1353,21 +1410,20 @@ export class TaskExecutor {
                 // Don't send final result — the SlurmJobMonitor will send it when jobs finish
             }
             else {
-                // Send final status + result
-                this.wsClient.sendTaskStatus(task.id, 'completed', 100, 'Task complete');
-                this.wsClient.sendTaskResult(result);
+                // Defer result to after cleanup (sent in the finally block).
+                pendingResult = result;
             }
         }
         catch (error) {
             // Unexpected error during execution
             const errorMsg = error instanceof Error ? error.message : String(error);
             console.error(`[executor] Task ${task.id}: execution error: ${errorMsg}`);
-            this.wsClient.sendTaskResult({
+            pendingResult = {
                 taskId: task.id,
                 status: 'failed',
                 error: errorMsg,
                 completedAt: new Date().toISOString(),
-            });
+            };
         }
         finally {
             clearTimeout(hardCapTimeoutId);
@@ -1378,6 +1434,9 @@ export class TaskExecutor {
             // (PR created or branch pushed), we preserve the git branch but still
             // remove the working copy — the branch lives on remote/local refs,
             // and re-execution will create a fresh worktree if needed.
+            if (prepared.branchName) {
+                stream.text?.(`\n── [Astro] Cleaning up worktree (branch: ${prepared.branchName})...\n`);
+            }
             if (this.preserveWorktrees) {
                 console.log(`[executor] Task ${task.id}: worktree preserved (debug mode)`);
                 // Still release directory locks even in debug mode to avoid deadlocks.
@@ -1404,6 +1463,18 @@ export class TaskExecutor {
                 console.log(`[executor] Task ${task.id}: cleaning up sandbox`);
                 await sandbox.cleanup();
             }
+            // Stop heartbeat — cleanup is done, we're about to send the result.
+            clearInterval(taskHeartbeatTimer);
+            // Send deferred result AFTER cleanup completes.
+            // This ensures the server's auto-dispatch doesn't start the next task
+            // while this task's worktree cleanup is still running on the same git repo.
+            // Without this, the new task's createWorktree() fights with cleanupWorktree()
+            // over the same .git directory (concurrent git worktree prune, branch -D, etc.).
+            if (pendingResult) {
+                const isSuccess = pendingResult.status !== 'failed';
+                this.wsClient.sendTaskStatus(task.id, isSuccess ? 'completed' : 'failed', 100, isSuccess ? 'Task complete' : 'Task failed');
+                this.wsClient.sendTaskResult(pendingResult);
+            }
             // Untrack task from directory
             this.untrackTaskDirectory(task);
             this.runningTasks.delete(task.id);
@@ -1420,7 +1491,7 @@ export class TaskExecutor {
             this.processQueue();
         }
     }
-    async prepareTaskWorkspace(task, stream) {
+    async prepareTaskWorkspace(task, stream, signal) {
         // Per-task explicit opt-out: user consciously chose to skip worktree
         if (task.useWorktree === false) {
             console.log(`[executor] Task ${task.id}: worktree explicitly disabled by user, using raw workdir: ${task.workingDirectory}`);
@@ -1523,6 +1594,8 @@ export class TaskExecutor {
                 projectBranch: task.projectBranch,
                 stdout: stream.stdout,
                 stderr: stream.stderr,
+                text: stream.text,
+                signal,
             });
             if (!worktree) {
                 throw new Error(`Worktree creation returned null for ${task.workingDirectory}. Cannot proceed without isolation.`);