@justjoshn/pi-pstack 0.15.36-pi.12 → 0.15.36-pi.13

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## [0.15.36-pi.13] - 2026-11-04
+
+- Parse leading word intervals and preserve multiline prompts in `/loop`.
+- Run different loop prompts independently. Return loop IDs and require an explicit ID for ambiguous wake or stop operations.
+- Restore writable tools after leaving a planning branch with no recorded tool loadout.
+- Preserve plan todo dependencies and project phases. Import unfinished root todos when building and synchronize later status updates without rewriting the rest of the plan file.
+- Preserve completion when a reviewed plan omits a todo's optional status. Insert the missing field without rewriting existing metadata, comments, line endings, or body text.
+- Persist plan-imported todos through native Pi branch entries so they survive a restart. Worktree plan builders import their own lists before the first request and retain the plan association on resume. Readonly resumes cannot synchronize plan files.
+- Serialize Task stale-lock recovery with token-directory leases. Treat unreaped Linux zombies as exited writers.
+- Open PR review canvases with the system browser instead of assuming Cursor's in-app browser.
+- Keep Unix sockets blocked in the readonly shell. Refuse a missing seccomp helper instead of allowing a host service to change state on the command's behalf. Linux hosts that refuse the helper's nested namespaces cannot run readonly shell commands.
+- Correct Benny's credential-isolation gate. Readonly children still inherit environment variables and can read credential files. Setup fails closed without separate isolation, and operational runs keep analysis and code work in the coordinator when isolation is unavailable.
+
 ## [0.15.36-pi.12] - 2026-11-04
 
 Each item below was checked against Cursor CLI 2026.10.22 with pstack and cursor-team-kit loaded, through its bundle and live runs. `parity/pi-pstack-behavior-parity/` in the repository records the evidence and the decisions.

package/README.md

@@ -13,7 +13,7 @@ pi-pstack is pstack 0.15.36 for Pi 1.5.0: rigorous agent workflows (`/poteto-mod
    pi install ./extensions/pi-pstack
    ```
 
-   Pi does not install dependencies for a local package, so `bun install` (or `npm install` in `extensions/pi-pstack`) fetches the one runtime dependency, `@anthropic-ai/sandbox-runtime`, which the read-only shell loads (readonly subagents and `/plan`). Without it everything else works, and a read-only shell command fails instead of running unsandboxed. On Linux the sandbox also needs `bubblewrap`, `socat`, and `ripgrep` (`sudo apt install bubblewrap socat ripgrep`), and Ubuntu 24.04 and later need the user-namespace change under Limits. macOS uses the built-in `sandbox-exec`. pi-pstack needs Node 22.19 or newer. To try it for one session without installing, run `pi -e ./extensions/pi-pstack`. To install the published package instead, run `pi install npm:@justjoshn/pi-pstack`.
+   Pi does not install dependencies for a local package, so `bun install` (or `npm install` in `extensions/pi-pstack`) fetches `@anthropic-ai/sandbox-runtime` for the read-only shell (readonly subagents and `/plan`) and `yaml` for plan metadata. If sandbox-runtime is missing, a read-only shell command fails instead of running unsandboxed. On Linux the sandbox also needs `bubblewrap`, `socat`, and `ripgrep` (`sudo apt install bubblewrap socat ripgrep`), and Ubuntu 24.04 and later need the user-namespace change under Limits. macOS uses the built-in `sandbox-exec`. pi-pstack needs Node 22.19 or newer. To try it for one session without installing, run `pi -e ./extensions/pi-pstack`. To install the published package instead, run `pi install npm:@justjoshn/pi-pstack`.
    Installing loads pi-pstack's tools and system-prompt sections at once, but no skill runs until you invoke it. 61 workflow skills stay out of the model's automatic skill list. Setup, create-skill, and the team-kit shipping and review skills (`deslop`, `control-cli`, `control-ui`, CI and PR helpers, and the rest of that set) can load from your words alone.
 2. Run `/setup-pstack`. It lists the models the `Task` tool can use, asks for a reasoning budget, maps a model to each role, and writes the model rule. A new rule applies from the next request.
 3. Start real work with `/poteto-mode`, a goal, and a check that can pass or fail.
@@ -28,8 +28,8 @@ Remove the package with `pi remove ./extensions/pi-pstack`. Its state lives in `
 |---|---|
 | `/poteto-mode <task>` | The skill attaches to that one message. Every skill Pi loaded works this way: pstack's (`/how`, `/why`, `/arena`, `/interrogate`, `/principle-prove-it-works`, `/deslop`) and your own, such as a `/<handle>-mode` skill from `/automate-me`. `/skill:<name>` works too. |
 | `/mode poteto-mode [task]` | Keeps the skill in context on every turn until you leave the mode: the skill rides every request in its own system-prompt section, which Pi re-sends only when it changes. The first request after entry says the user entered the mode, later requests carry a reminder that names the skill file, and the request after `/mode off` or a switch to another mode says the user left it. The footer shows a badge with the skill's `icon` and `color` metadata, such as a yellow `♛ mode: poteto-mode` (other skills get `⚡`). `/mode off` exits and `/mode` reports. Any loaded skill can back a mode. |
-| `/plan [task]` | Plan mode: the agent researches with read-only tools (`read`, `grep`, `find`, `ls`, the sandboxed `bash_readonly`, `AskQuestion`, `TodoWrite`, `agent_status`, `Task`, whose launches run readonly: a fresh one runs here with no worktree, and a resume or fork stays where its agent ran, and `stop_agent`), asks its clarifying questions early, and presents the plan with `CreatePlan` (`plan`, `name`, `overview`, `todos`). `CreatePlan` writes the plan file under `<pstack dir>/plans/` (`<name>-<8 hex>.plan.md`: the chat id in a comment, the todos as front matter, then the plan), one file per plan name in a chat. `edit` and `write` work on markdown files only, so the agent refines the plan in its file. After a run that saved a plan, an interactive session asks `Yes, build locally`, `Yes, build in cloud` (in a git repository: a background isolated worker builds it on its own branch), or `No, propose changes`. `/plan build` builds the saved plan too, and `/plan off` restores your tools. A bare `/plan` enters plan mode. The footer shows `plan`. |
-| `/loop 30m <prompt>` | Runs the prompt now, then again every 30 minutes from each fire, so a long run does not push the next tick out. A tick that comes due while a run is still going fires once when that run settles; several missed ticks still fire once. The interval can come first or last, written as `30m`, `10 minutes`, or `every 10 minutes`. Without an interval the agent picks each wake with the `Loop` tool, and the loop ends when it picks none and no background subagent is still running. `/loop stop` or Escape during a run ends it. The prompt can be a skill command, such as `/loop 1h /poteto-mode run the audit tick`. When a playbook says to arm `/loop`, the agent starts it with the `Loop` tool. Intervals go up to 24 days. |
+| `/plan [task]` | Plan mode: the agent researches with read-only tools (`read`, `grep`, `find`, `ls`, the sandboxed `bash_readonly`, `AskQuestion`, `TodoWrite`, `agent_status`, `Task`, whose launches run readonly: a fresh one runs here with no worktree, and a resume or fork stays where its agent ran, and `stop_agent`), asks its clarifying questions early, and presents the plan with `CreatePlan` (`plan`, `name`, `overview`, `todos`, `is_project`, `phases`). `CreatePlan` writes the plan file under `<pstack dir>/plans/` (`<name>-<8 hex>.plan.md`: the chat id in a comment, the todos as front matter, then the plan), one file per plan name in a chat. Todo dependencies and project phases stay in the file. Building imports the file's unfinished root todos into the session, including edits made during review. Worktree builders import their own lists before the first model request and retain the associated plan on resume. Later writable `TodoWrite` status updates synchronize those root todos without rewriting other metadata or the plan body. An omitted status imports as pending and is inserted when the todo is updated. A readonly resume keeps its todo changes inside the session. `edit` and `write` work on markdown files only, so the agent refines the plan in its file. After a run that saved a plan, an interactive session asks `Yes, build locally`, `Yes, build in cloud` (in a git repository: a background isolated worker builds it on its own branch), or `No, propose changes`. `/plan build` builds the saved plan too, and `/plan off` restores your tools. A bare `/plan` enters plan mode. The footer shows `plan`. |
+| `/loop 30m <prompt>` | Runs the prompt now, then again every 30 minutes from each fire, so a long run does not push the next tick out. A tick that comes due while a run is still going fires once when that run settles; several missed ticks still fire once. The interval can come first or last, written as `30m`, `10 minutes`, or `every 10 minutes`. Without an interval the agent picks each wake with the `Loop` tool, and the loop ends when it picks none and no background subagent is still running. Different prompts create independent loops. The same prompt replaces its schedule. `/loop` lists them. `/loop stop` ends the only loop, or `/loop stop <id>` selects one when several are running. Escape during a run ends the session's loops. `Loop` results include the loop ID in text and details; pass `loop_id` to wake, stop, or replace one of several loops. The prompt can be a skill command, such as `/loop 1h /poteto-mode run the audit tick`. When a playbook says to arm `/loop`, the agent starts it with the `Loop` tool. Intervals go up to 24 days. |
 | `/routines` | Lists webhook routines with their URL, credential file, and status. |
 | `/setup-pstack` | Configures the per-role models. |
 | `/poteto-help <question>` | Answers a question about pstack and hands you a prompt to send. |
@@ -40,7 +40,7 @@ Remove the package with `pi remove ./extensions/pi-pstack`. Its state lives in `
 
 | Feature | Behavior |
 |---|---|
-| `Task` (`description`, `prompt`, `subagent_type`, `model`, `run_in_background`, `resume`, `fork`, `fork_turns`, `readonly`, `file_attachments`, `environment`, `cloud_base_branch`) | Starts a separate `pi --mode rpc` process per subagent, so this Pi process can steer and abort it. Foreground calls return the response and an agent ID. Background calls return at once, and a `<system_notification>` with a `<task>` block arrives after your turn ends, titled by the first line of the prompt (80 characters at most) and followed by a request to do any follow-up work; the notification card shows the call's `description`. Print and JSON runs wait for pending notifications before exiting, unless aborted. Several calls in one message run in parallel. A subagent's own subagents cannot spawn more, and every subagent is told to spawn none unless asked. A run lock per agent ID keeps out a second writer, even from another Pi process (Limits notes the stale-lock race). Children inherit the parent's project-trust decision. Foreground usage counts toward the session totals. The Task card leads with the call's `description`, then the agent type and the model that ran, and while a foreground child works it shows its last few tool steps and latest line instead of a blank wait. |
+| `Task` (`description`, `prompt`, `subagent_type`, `model`, `run_in_background`, `resume`, `fork`, `fork_turns`, `readonly`, `file_attachments`, `environment`, `cloud_base_branch`) | Starts a separate `pi --mode rpc` process per subagent, so this Pi process can steer and abort it. Foreground calls return the response and an agent ID. Background calls return at once, and a `<system_notification>` with a `<task>` block arrives after your turn ends, titled by the first line of the prompt (80 characters at most) and followed by a request to do any follow-up work; the notification card shows the call's `description`. Print and JSON runs wait for pending notifications before exiting, unless aborted. Several calls in one message run in parallel. A subagent's own subagents cannot spawn more, and every subagent is told to spawn none unless asked. A run lock per agent ID keeps out a second writer, even from another Pi process. A token-directory lease serializes stale-lock recovery while the PID file identifies the transcript writer. Children inherit the parent's project-trust decision. Foreground usage counts toward the session totals. The Task card leads with the call's `description`, then the agent type and the model that ran, and while a foreground child works it shows its last few tool steps and latest line instead of a blank wait. |
 | `resume` | Sends a follow-up to an idle agent with its context, model, type, and directory. The root chat can resume or fork a descendant that a worktree worker started inside that worktree, and the descendant still runs where it first ran. On an agent running in this Pi process, it delivers the prompt as a steer and returns at once. A readonly or plan-mode call cannot steer a writable agent. An agent running in another Pi process is refused. This is how a playbook "messages" a worker. Pi's own `/resume` command reopens a chat session instead. |
 | `fork` | Starts a new agent whose transcript begins as a copy of an idle agent's transcript, in that agent's directory (its worktree for an isolated worker), so it sees the built checkout and uncommitted changes. Type, model, and readonly default from the source; readonly can be added, never lifted. `fork_turns: N` (only with `fork`) copies just the first N user turns. `fork` excludes `resume`, `environment`, and `cloud_base_branch`. Pi's own `/fork` command branches the chat session instead. |
 | `stop_agent` | `agent_id`. Stops a running subagent. One this Pi process owns gets an RPC abort, then a kill after a grace period. One another of your Pi processes owns gets a signal to the live pid in its run lock. An idle or finished agent is left alone, and the result says so. |
@@ -48,8 +48,8 @@ Remove the package with `pi remove ./extensions/pi-pstack`. Its state lives in `
 | Subagent types | The built-in `generalPurpose` (default) and `explore` (a file-search specialist the caller tells how thorough to be, with `grep`, `find`, and `ls` on and no `Task`), then `poteto-agent` (a background delegate that reads poteto-mode first), `ci-watcher` (a background PR check watcher), `comment-sicko`, and `thermo-nuclear-code-quality-review`, the last four read from `agents/*.md`. Unknown types fail with the list. |
 | Models | A Pi model spec such as `claude-opus-5-5:xhigh` or `xai/grok-4.7:high`, model parameters such as `claude-opus-5-5[effort=high]` or `grok-4.7[fast=true]` (picks a listed `-fast` id of that model), `fast` for the parent model's listed `-fast` variant when it has one, else the parent model, or `inherit`, `inherit-parent`, `auto`, or nothing for the parent model. A model Pi does not list, or a thinking level the model does not support, fails with the allowed list. A bare model id that several providers offer resolves to the parent chat's provider when it offers that id, and otherwise fails with the choices. Older rules that wrote `claude-opus-5-5-xhigh` still resolve. The system prompt's `pstack_subagents` section lists the types, the parent model, and the models with their levels. |
 | Isolated workers (`environment: "cloud"`) | The subagent runs in a new git worktree at `<pstack dir>/workspaces/<workspace folder>/worktrees/<agent id>` on branch `pstack/<agent id>`, from `cloud_base_branch` (`origin/<branch>` when that remote-tracking ref exists, else a local branch or other ref) or your HEAD commit, so uncommitted changes do not reach it. The result and the card name the branch to merge, and `resume` and `fork` run in the same worktree. It fails clearly outside a git repository, in a repository with no commits, or when the base does not resolve. The worker shares the root chat's workspace state, so it sees the same projects, stores, and subagent transcripts. It also shares this machine's ports, processes, writable caches, simulators, and credentials. Assign separate ports, output directories, and writable caches to concurrent runtime lanes. `swarm` and `orchestrate` spawn worktree workers by default. |
-| `readonly: true` | The child gets `read`, `grep`, `find`, `ls`, `TodoWrite`, and a read-only `bash`, and no MCP. That shell runs each command in an OS sandbox ([`@anthropic-ai/sandbox-runtime`](https://github.com/anthropics/sandbox-runtime): `sandbox-exec` on macOS, bubblewrap on Linux) that blocks every file write and all network access, so `git log` works and `touch` or `curl` fail. Where no sandbox can start, the command fails rather than running unsandboxed. |
-| `TodoWrite` | `todos` with `id`, `content`, `status`, and `merge`. Its description says when to keep a list, the four states, and one task in progress at a time. The list follows the session branch, shows above the editor, and rides every request's system prompt. |
+| `readonly: true` | The child gets `read`, `grep`, `find`, `ls`, `TodoWrite`, and a read-only `bash`, and no MCP. That shell runs each command in an OS sandbox ([`@anthropic-ai/sandbox-runtime`](https://github.com/anthropics/sandbox-runtime): `sandbox-exec` on macOS, bubblewrap on Linux) that blocks every file write and all network access, so `git log` works and `touch` or `curl` fail. Where no sandbox can start, the command fails rather than running unsandboxed. Readonly is not credential isolation. The child still inherits environment variables and can read credential files through its read tools. |
+| `TodoWrite` | `todos` with `id`, `content`, `status`, and `merge`. Its description says when to keep a list, the four states, and one task in progress at a time. The list follows the session branch, shows above the editor, and rides every request's system prompt. Plan-imported lists persist as branch entries. Their dependencies survive status-only updates, and matching plan-file statuses are synchronized. |
 | `AskQuestion` | `title`, and per question `id`, `prompt`, `options` (at least two, each `id`, `label`, optional `description`), and `allow_multiple`, through Pi's select dialog. It is for decisions only the user can make, and a recommended option goes first with `(Recommended)`. Every question ends with `Other: (type to answer)`; a typed answer comes back as `other` with its text. In print and JSON runs, including subagents, each question comes back skipped. |
 | Always-applied rules | The two team-kit rules are in `pstack_host` as their shipped text on every request, alongside the same rules as hidden skills. |
 | The model rule | `<pstack dir>/pstack-models.md`, plain Markdown with one line per role, added to every request's system prompt. A `pstack-models.mdc` from an earlier version is moved there once, without its frontmatter, and kept as `pstack-models.mdc.migrated`. |
@@ -78,10 +78,10 @@ Subagent transcripts are Pi sessions in `<pstack dir>/workspaces/<workspace fold
 - Depth limits apply to `Task`. A writable subagent can still start `pi` through `bash`, and that process is outside the depth limit and parent watchdog.
 - A child loads your installed extensions plus this package. If you run one checkout with `-e` while a different checkout of pi-pstack is installed, the child loads both and fails on duplicate tools; use one copy, or a separate `PI_CODING_AGENT_DIR`, as `live:e2e` does.
 - Subagents run headless in RPC mode, so an extension that asks for permission through a dialog cannot ask there.
-- The read-only shell sandboxes shell subprocesses only, and is verified on macOS and on the Ubuntu CI runner. On Linux it needs `bubblewrap`, `socat`, and `ripgrep`. Ubuntu 24.04 and later restrict unprivileged user namespaces: either add an AppArmor profile that grants `userns` to `bwrap`, or run `sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0`, which lifts the restriction for every program on the machine. The policy sets `allowAllUnixSockets: true` so Linux skips `apply-seccomp`, whose nested userns fails on GitHub-hosted runners; filesystem write denial and network denial still come from bubblewrap.
+- The read-only shell sandboxes shell subprocesses only. Earlier macOS and Ubuntu CI runs do not verify the stricter Unix-socket policy. On Linux it needs `bubblewrap`, `socat`, and `ripgrep`. Ubuntu 24.04 and later restrict unprivileged user namespaces: either add an AppArmor profile that grants `userns` to `bwrap`, or run `sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0`, which lifts the restriction for every program on the machine. Unix sockets stay blocked because a host socket service can mutate files or access the network on a command's behalf. Linux also needs sandbox-runtime's bundled `apply-seccomp` helper and permission to create its nested user, PID, and mount namespaces. A missing helper or a namespace refusal blocks the shell command. The shell never falls back to permitting host sockets. Do not treat a readonly child as a credential boundary. Environment variables and readable credential files are still available to its read tools.
 - Whether a model follows a playbook is the model's call.
 - Workspace folders follow Pi's session-folder naming, so two paths that differ only by `/` versus `-` share a folder. Resume and fork refuse an agent whose record names the other directory, except that a record created inside this workspace's own worktrees belongs to this workspace. Subscription reads and mutations also reject a registry owned by the other workspace.
-- The run lock that keeps one writer per agent ID names the process writing the transcript. A lock file without a readable pid counts as held; the error names the file to delete. `agent_status` shows such an agent as `idle`. A lock whose pid is dead is taken over, and two processes that take over the same stale lock at the same moment can both succeed.
+- The run lock that keeps one writer per agent ID names the process writing the transcript. A lock file without a readable pid counts as held; the error names the file to delete. `agent_status` shows such an agent as `idle`. A token-directory lease beside the PID file serializes stale-lock recovery. A dead process or an unreaped Linux zombie does not count as a live writer. Older installed versions without the lease do not participate in this protection.
 - `skills/poteto-mode/scripts/watch-pr` needs Bun and installs its one dependency on first run. `check-plan.mjs` needs only Node. `worktree-audit.sh` needs `rg` and `jq`, and works with BSD (macOS) or GNU `stat` and `date`.
 - `statechart` runs `skills/statechart/scripts/statechart` on Node 22.18 to 22.x, Node 23.6 or later, Bun 1.1.5 or later, or Deno 2.0 or later. The first run installs TLC and Java through [mise](https://mise.jdx.dev/) and needs the network. Without a SPEC it prints `Give one SPEC.tla.` and its usage, then exits 2.
 

package/automations/benny/FOR_AGENTS.md

@@ -27,7 +27,7 @@ i want two pi automations that work together in one slack issue channel. each on
 
 - i want the source channel and root thread coordinates to stay immutable for the whole run.
 - i treat utility and debug bots as evidence, not delegation or fix ownership.
-- i allow subagents to help, but they cannot post to slack or receive slack credentials. analysis subagents run as `Task` with `readonly: true`, which gives them no mcp servers and no network.
+- i allow subagents to help, but they cannot post to slack or receive slack credentials. analysis subagents run as `Task` with `readonly: true`. readonly removes mcp tools and restricts shell operations, but does not isolate credentials. when separate credential isolation cannot be proven, keep the work in the coordinator.
 - i want this entire pack committed at `.pi/automations/benny/` in the target repository. its `SKILL.md` files are direct automation instructions, not skills pi discovers.
 - i want pi-pstack installed in pi for shared dependencies such as `how`, `why`, `tdd`, `unslop`, and the required principle skills.
 - i want each subscription prompt to read its operational file directly from the target repository. i do not want pi-pstack package paths, copied excerpts, or slash-skill discovery.

package/automations/benny/skills/reproduce-and-fix-issues/SKILL.md

@@ -16,8 +16,8 @@ Load the external Benny configuration supplied by the automation. If the config,
 - Never post a root message in the source channel.
 - Preflight the source parent before every source-thread post.
 - The coordinator is the only Slack poster.
-- Delegated analysis workers are read-only and return findings or media notes. In Pi, start each one with `Task` and `readonly: true`, which gives it no MCP servers and a shell with no network.
-- A fix-phase code worker may edit only when its environment provably excludes Slack credentials and every Slack write action. Otherwise the coordinator edits. A writable Pi subagent inherits the session's MCP servers and environment, so it qualifies only when the Pi process that owns the subscriptions loads no Slack MCP server with write tools and has no Slack token in its environment.
+- Delegated analysis workers are read-only and return findings or media notes. `Task` with `readonly: true` removes MCP tools and restricts shell operations, but still inherits environment credentials and can read credential files. Launch a child only after separate credential isolation is proven. Otherwise do the work in the coordinator.
+- A fix-phase code worker may edit only when its environment and readable files provably exclude Slack credentials and every Slack write action. Otherwise the coordinator edits. A writable Pi subagent also inherits the session's MCP servers. Absence of a Slack MCP server or an environment token alone is not proof of credential isolation.
 - Every child prompt must explicitly forbid every Slack MCP write tool (`mcp__<slack-server>__*` tools that post, edit, react, or upload), `chat.postMessage`, and all other Slack writes.
 - Never give a child a Slack token, posting instructions, source coordinates for posting, or permission to report externally.
 - If a child needs Slack write access to run, do not launch it.
@@ -36,7 +36,7 @@ Load the external Benny configuration supplied by the automation. If the config,
 Before making a work list or delegating:
 
 1. Require the trigger channel to equal the configured source channel.
-2. Set `SOURCE_THREAD_TS` to `trigger.thread_ts` when present. Otherwise use `trigger.ts`.
+2. Set `SOURCE_THREAD_TS` to `trigger.thread_ts` when present. Otherwise use `trigger.message_ts`, then `trigger.ts`.
 3. Require a nonempty `SOURCE_THREAD_TS`.
 4. Store `SOURCE_CHANNEL_ID` and `SOURCE_THREAD_TS` as immutable values.
 5. Read the source thread and verify its root has those exact coordinates.

package/automations/benny/skills/setup-benny/SKILL.md

@@ -38,7 +38,7 @@ If this file is already being read from the target destination, treat the copy a
 
 Confirm that pi-pstack is installed in Pi. A personal install (`pi install <path-to-pi-pstack>`) serves every repository on this machine. A project install (`pi install -l <path-to-pi-pstack>`) writes the target repository's `.pi/settings.json`; preserve every unrelated setting and package entry when that file exists, and validate it after editing.
 
-This setup session must run in the target repository, because a `Task` subagent starts in its parent's working directory. If it does not, stop and tell the user to start Pi in the target repository and point it at `FOR_AGENTS.md` again. Start a fresh `Task` subagent with `readonly: true`. Ask it to resolve `<SKILLS>` from its own system prompt and read each required `<SKILLS>/<name>/SKILL.md` file below. It must report each absolute path and confirm the file's frontmatter names the required skill. Hidden skills need not appear in Pi's automatic skill catalog.
+This setup session must run in the target repository, because a `Task` subagent starts in its parent's working directory. If it does not, stop and tell the user to start Pi in the target repository and point it at `FOR_AGENTS.md` again. Before the dependency check, prove that its child cannot read Slack credentials from the inherited environment or files. `readonly: true` removes MCP tools and restricts shell operations, but does not remove credentials or restrict the `read` tool. If credential isolation is unavailable, stop setup before starting a child or enabling subscriptions. Otherwise start a fresh `Task` subagent with `readonly: true`. Ask it to resolve `<SKILLS>` from its own system prompt and read each required `<SKILLS>/<name>/SKILL.md` file below. It must report each absolute path and confirm the file's frontmatter names the required skill. Hidden skills need not appear in Pi's automatic skill catalog.
 
 - `how`
 - `why`
@@ -132,7 +132,7 @@ The repro automation needs:
 - `gh` authenticated for the repository, so `gh pr create --draft` can open a draft pull request
 - The configured control-adapter skill
 
-Prefer the configured Slack MCP tools for reads and posts. The optional `BENNY_SLACK_BOT_TOKEN` may fill a narrow gap such as editing one operations status message or downloading an attachment. Store the value in a secret manager or the owning session's environment, not in YAML. A writable subagent inherits that environment, which is one reason Benny's workers run readonly.
+Prefer the configured Slack MCP tools for reads and posts. The optional `BENNY_SLACK_BOT_TOKEN` may fill a narrow gap such as editing one operations status message or downloading an attachment. Store the value in a secret manager or the owning session's environment, not in YAML. Every subagent inherits that environment, including readonly children. Removing a token from the prompt does not remove it from the process or make credential files unreadable. Unless separate credential isolation is established, keep analysis and code work in the coordinator.
 
 Do not use undocumented integration endpoints.
 
@@ -247,7 +247,7 @@ Verify:
 3. Repro accepts the marker only from the configured triage identity.
 4. Repro keeps the same immutable source coordinates.
 5. No source-channel root message appears.
-6. A delegated worker cannot use any Slack write action: it runs as a `readonly` `Task`, so it has no MCP tools.
+6. Every delegated worker has verified credential isolation as well as no Slack write actions. `readonly: true` alone is insufficient. If that isolation is unavailable, the coordinator performs the work without an analysis or code child.
 7. Missing coordinates, a deleted parent, or a failed preflight produces no post and no tracker issue.
 8. A second fire, or a repeated webhook POST, for the same report does no work, because the ledger already lists it.
 

package/automations/benny/skills/triage-issue-reports/SKILL.md

@@ -19,7 +19,7 @@ Load the external Benny configuration supplied by the automation. If the config
 - If the parent is missing, deleted, inaccessible, or uncertain, stop with no writes.
 - Post one substantive verdict. Do not narrate progress.
 - The coordinator is the only Slack poster.
-- Delegated workers return findings only. They must be read-only and receive no Slack credentials or write actions. In Pi, start each one with `Task` and `readonly: true`: a readonly subagent gets no MCP servers, and its shell can neither write files nor reach the network.
+- Delegated workers return findings only. They must be read-only and receive no Slack credentials or write actions. In Pi, `Task` with `readonly: true` removes MCP tools and restricts shell operations, but still inherits environment credentials and can read credential files. Launch a child only after separate credential isolation is proven. Otherwise do the work in the coordinator.
 - Every child prompt must forbid every Slack MCP write tool (`mcp__<slack-server>__*` tools that post, edit, react, or upload), `chat.postMessage`, and every other Slack write.
 - If worker isolation cannot enforce those limits, do the work in the coordinator.
 - Never create an issue that cannot link back to the source thread.
@@ -33,7 +33,7 @@ Before making a work list or delegating:
 
 1. Read `source_channel_id` from the trigger.
 2. Require it to equal the configured source channel.
-3. Set `SOURCE_THREAD_TS` to `trigger.thread_ts` when present. Otherwise use `trigger.ts`.
+3. Set `SOURCE_THREAD_TS` to `trigger.thread_ts` when present. Otherwise use `trigger.message_ts`, then `trigger.ts`.
 4. Require a nonempty `SOURCE_THREAD_TS`.
 5. Store `SOURCE_CHANNEL_ID` and `SOURCE_THREAD_TS` as immutable values.
 6. Read the thread and verify that its root has exactly those coordinates.

package/docs/parity-status.md

@@ -8,7 +8,7 @@ This page records what `pi-pstack` reproduces from Cursor `pstack` 0.15.36 and i
 - Installed Cursor CLI at the time of the reference capture: `2026.10.22-27dcf5f`.
 - Native implementation: this package, which pins its upstream provenance in `package.json.pstackSource`.
 
-A path and byte comparison of the tracked trees shows every pstack skill, both pstack agents, all 18 team-kit skills, both team-kit agents, and both team-kit rules in this package. Seventeen team-kit skill files are byte-identical; `workflow-from-chats` describes Pi paths instead of Cursor paths. The changed pstack files are host translations. One upstream paragraph has no counterpart: `poteto-help`'s Claude Code install path and its `docs/harness/claude-code.md` adapter, because this package targets Pi only. The two non-portable frontmatter keys Cursor ships (`icon`/`color` on `poteto-mode`, `paths` on `typescript-best-practices`) are kept under `metadata`, the Agent Skills extension point. The port reads `icon` and `color` for the mode badge. `paths` stays as metadata only, because Cursor loads a `paths` skill that sets `disable-model-invocation` only when it is invoked by name. team-kit's thermo-nuclear agent changes only where it names the plugin that ships its rubric.
+A path and byte comparison of the tracked trees shows every pstack skill, both pstack agents, all 18 team-kit skills, both team-kit agents, and both team-kit rules in this package. Sixteen team-kit skill files are byte-identical. `workflow-from-chats` describes Pi paths instead of Cursor paths, and `pr-review-canvas` opens a system browser instead of Cursor's in-app browser. The changed pstack files are host translations. One upstream paragraph has no counterpart: `poteto-help`'s Claude Code install path and its `docs/harness/claude-code.md` adapter, because this package targets Pi only. The two non-portable frontmatter keys Cursor ships (`icon`/`color` on `poteto-mode`, `paths` on `typescript-best-practices`) are kept under `metadata`, the Agent Skills extension point. The port reads `icon` and `color` for the mode badge. `paths` stays as metadata only, because Cursor loads a `paths` skill that sets `disable-model-invocation` only when it is invoked by name. team-kit's thermo-nuclear agent changes only where it names the plugin that ships its rubric.
 
 ## Native translations
 
@@ -45,6 +45,24 @@ A live Cursor CLI session with both plugins loaded produced these contracts.
 
 Pi returns the child's final text with a transcript path and usage, and reports background completion as a `pstack/task` notification. The payload shape differs because the hosts are different; the observable workflow, a subagent result arriving after the parent turn, is preserved.
 
+## Reconstruction repairs in 0.15.36-pi.13
+
+The repository's `parity/pstack-reconstruction-2026-11-04/` holds the reference inventory, baseline and treatment receipts, and decision log. These repairs do not establish that every workflow has been observed on both hosts.
+
+The pre-bump PR-preparation run, `pr-make-verify.txt`, exits at pi-pstack's coverage suite with 680 passing tests and five failing positive readonly-shell checks. Lint, typecheck, mechanisms, toolchain, and test conventions pass before that stop. No later package result is inferred. `pr-preparation.md` records the focused checks, local review, and publication redactions.
+
+The later [Linux CI run at `83cf4d9b`](https://github.com/just-joshn/pi-customizations/actions/runs/41885522222/job/126768816594) passes all 685 package tests and 367 statechart tests on Ubuntu 24.04. This includes successful restricted commands and the host Unix-socket regression. The workflow pins Ubuntu 24.04 after `ubuntu-latest` selected Ubuntu 26.04 and the helper refused nested namespace setup. The sandbox policy and assertions are unchanged. This result does not resolve startup on Ubuntu 26.04 or replace the failed local full-repository receipt.
+
+- Leading word intervals such as `/loop every 10 minutes check CI` set the cadence instead of becoming part of the submitted prompt. Interval extraction preserves internal newlines.
+- Different loop prompts run independently. Each `Loop` result includes an ID in text and details. With several loops running, `loop_id` selects a wake, stop, or replacement, and `/loop stop <id>` selects a command-line stop. Re-arming the same prompt replaces its schedule. Real Pi RPC regressions observe both prompts repeating and one continuing after the other stops.
+- Leaving a planning branch restores the pre-plan tools when Pi has no recorded system-message tool loadout to replay. Both the recorded and unrecorded cases run through real Pi tree navigation.
+- `CreatePlan` preserves todo dependencies, `is_project`, and project phases in the plan file. Building loads unfinished root todos from that file, including review edits. Imported lists survive a Pi restart. Worktree builders import their own lists before their first model request and restore the plan association on resume. Writable `TodoWrite` updates synchronize matching root statuses while preserving quotes, comments, custom metadata, and the plan body. Readonly resumes update only the session list. `plan-worker-baseline.txt` and `plan-worker-treatment.txt` record the actual Pi RPC regression.
+- A reviewed todo without a status imports as pending and now records later completion in the saved file. The synchronizer inserts only the missing field. Unit regressions cover block and flow mappings, trailing commas, and CRLF. An actual Pi RPC regression covers the same edit. `plan-missing-status-baseline.txt` and `plan-missing-status-treatment.txt` retain the failing and passing cases.
+- Task stale-lock recovery uses the same token-directory lease as subscription ownership. A two-process regression forces the former check-to-remove race and observes one owner after the repair. Task status also treats an unreaped Linux zombie as exited rather than blocking recovery indefinitely. Older versions without the lease do not participate in this protection.
+- `pr-review-canvas` names the system browser and `control-ui` instead of assuming Cursor's in-app browser. This is an instruction translation, not evidence that a real model completed a canvas review.
+- A readonly Pi child reached a disposable Unix socket and caused its unsandboxed server to modify a file. The shell now keeps Unix sockets blocked and refuses a missing seccomp helper. The Linux host used for this audit refuses the helper's nested namespace setup, so the treatment proves failure-closed behavior, not successful restricted command execution. `readonly-boundary-baseline.txt`, `readonly-boundary-treatment.txt`, and `package-suite-readonly-strict.txt` retain the evidence. The latter has 675 passing tests and five failing positive shell checks. The earlier full repository pass predates this safety change.
+- A fake Slack token remained readable in a readonly child's inherited environment. Benny's instructions now require separate credential isolation rather than inferring it from readonly tools. Setup stops without that proof, and operational runs keep analysis and code work in the coordinator. This instruction repair is not a live Slack integration test.
+
 ## Repairs in 0.15.36-pi.12
 
 A fresh reverse engineering of Cursor CLI 2026.10.22 with pstack and cursor-team-kit loaded found these differences. The repository's `parity/pi-pstack-behavior-parity/` holds the findings, the decision trail, and `probe-cursor.sh`, which reruns every Cursor probe. Each change has a test that failed on the earlier code.
@@ -101,9 +119,9 @@ These are not closed by extension code.
 - **Background workers stop when the chat exits.** A Pi subagent is a child process of the chat, so quitting or shutting the session stops the agents it started and reports how many. Whether a Cursor background subagent outlives its parent is unobserved; the CLI changelog says cancelling the prompt stops its subagents, and only the cloud-agent product promises work after the laptop closes. A `new_session` subscription fire is Pi's one detached path, and it starts a fresh run rather than continuing a subagent.
 - **A mode's skill rides the system prompt.** Cursor attaches the skill to the user message that enters the mode and keeps it durable in the conversation; its notices travel in user-message fields. Pi carries the skill and the notices in system-prompt sections, which reach the model on every request and survive compaction, so the model sees the same text in a different place.
 - **A fork needs an idle source.** Cursor exposes `fork` only on its internal and cloud-agent protos, never on the CLI Task schema, and no doc states whether a fork may start while the source runs. A Pi fork runs in the source's directory or worktree, so a running source is refused; the orchestrate playbook says to wait for its completion notification.
+- **Linux readonly shells require nested namespace support.** The stricter policy must block host Unix sockets as well as IP traffic and filesystem writes. On a host that refuses sandbox-runtime's seccomp helper, the command does not run. Earlier checks that permitted all Unix sockets are not evidence for this policy. Readonly also does not isolate environment credentials or files readable through the ordinary read tools.
 - **Plan mode's restriction is stricter than the host's.** Cursor's plan mode keeps every tool and restricts by instruction: edit only markdown files, run only read-only commands. Pi enforces the same rules with a tool allowlist, markdown-only `edit` and `write`, and a sandboxed shell that also denies network, so `gh`, `curl`, and package queries can fail while planning. Allowing network in a read-only shell would also open a path for remote changes, so the sandbox keeps it closed.
 - **The plan review is a dialog, not a card.** Cursor renders the plan with a build menu. Pi shows the same three choices in a select dialog after the run that saved the plan, and "build in cloud" starts a background isolated worktree worker, Pi's counterpart to a cloud agent, rather than a remote VM.
-- **One loop at a time.** Cursor's local `/loop` runs one shell loop per purpose, so several can run at once. pi-pstack runs one loop per session; a new `/loop` or `Loop` call replaces the running one. pstack's playbooks arm one audit loop at a time.
 - **benny's default cadence still needs its owning session open.** `wake_self` timers and webhook routines park while the owner is offline. A timer or webhook routine created with `sessionStrategy: "new_session"` runs detached with no chat open, but a detached run is one-shot: it must do the work in that run, because a background `Task` ends with it. Cursor automations run in the cloud and can hand work to anything. So benny keeps `wake_self` by default and setup names the tradeoff before switching.
 - **A routines listener is local, one port per workspace.** Cursor hosts each routine URL. Pi binds a loopback port per workspace, so two workspaces serve routines at once only because the default port falls back to an ephemeral one that the workspace then reuses and reports. A sender outside the machine still needs its own forwarding path.
 - **Cloud execution is local.** Cursor documents cloud VMs for its cloud product, but the inspected CLI schema omits `environment` and a requested cloud Task ran on the same machine and directory. Pi's `environment: "cloud"` goes further with a git worktree and a separate local process. Neither runs with the laptop off or provides a remote VM.
@@ -114,11 +132,22 @@ These are not closed by extension code.
 - **Hosted guidance and pages are outside the package.** MCP providers, ticket trackers, browsers, simulators, and Tailscale remain the user's own dependencies, as they are for Cursor.
 - **Background usage cannot enter parent totals.** Pi exposes no API that adds a later notification's usage to the parent session. It stays in the notification details and the child transcript.
 
+## Session probes on 2026-11-04 (continuation)
+
+These observations update earlier open notes. They do not make the package VERIFIED.
+
+- Cursor's live `TodoWrite` accepted a one-item write even though the published schema sets `minItems: 2` and requires `content` and `status` on every item. Pi keeps `minItems: 1` and status-only merges, which matches that runtime behavior. Evidence: this session's `CallDynamicTool` one-item call, plus `test/e2e/todo.e2e.test.ts` merge updates.
+- On this Linux host, `kernel.apparmor_restrict_unprivileged_userns=1`. Socket-restricted sandbox commands fail in `apply-seccomp` while writing `/proc/self/setgroups`. The same sandbox with `allowAllUnixSockets: true` runs under bubblewrap and denies writes. Docker and passwordless sudo were unavailable here, so the positive restricted path remains a host blocker. CI on Ubuntu 24.04 still owns that green path.
+- Benny operational skills now resolve `SOURCE_THREAD_TS` from `thread_ts`, then `message_ts`, then `ts`, so the documented webhook payload works when `thread_ts` is empty. Upstream Cursor skills still name only `trigger.ts`. Completeness audit: `parity/pstack-reconstruction-2026-11-04/session-2026-11-04T19-completeness.json`.
+- The sibling `cursor-sdk` plugin remains out of scope. No pstack skill or agent references it.
+
 ## Open evidence
 
 The following were not observed end to end and are not claimed.
 
 - A real model following every ported skill on both hosts.
+- Cursor's project-phase execution UI and per-phase build behavior. Pi preserves phase metadata but does not reproduce that UI.
+- Hosted cloud plan execution's full todo lifecycle and simultaneous independent builders updating one plan. Native worktree startup, resume, dependency retention, writable status synchronization, and readonly non-synchronization have actual Pi RPC evidence.
 - Authenticated MCP exchanges and provider-specific tool behavior.
 - A successful live Cursor run for each workflow after the reference capture.
 - Reboot survival through a real launchd or systemd unit on both platforms.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@justjoshn/pi-pstack",
-  "version": "0.15.36-pi.12",
+  "version": "0.15.36-pi.13",
   "description": "pstack 0.15.36 for Pi with its soft-dependency team-kit skills vendored in: rigorous agent workflows and principles as Pi skills, with the host features they use: subagents, todos, modes, plan mode, the model rule, /loop, subscriptions and routines, AskQuestion, SwitchMode, image generation, and visualize",
   "type": "module",
   "license": "MIT",
@@ -64,7 +64,8 @@
     "live:e2e": "node scripts/live-e2e.mjs"
   },
   "dependencies": {
-    "@anthropic-ai/sandbox-runtime": "0.0.79"
+    "@anthropic-ai/sandbox-runtime": "0.0.79",
+    "yaml": "2.9.0"
   },
   "peerDependencies": {
     "@earendil-works/pi-ai": "*",

package/skills/pr-review-canvas/SKILL.md

@@ -157,7 +157,7 @@ Since renderer.js loads in `<head>`, you can also call `renderDiff(target, lines
    ```bash
    cd /tmp && python3 -m http.server 8432 --bind 127.0.0.1
    ```
-   Run this backgrounded, then navigate the in-app browser to `http://127.0.0.1:8432/pr-review-{number}.html`.
+   Run this backgrounded. Open `http://127.0.0.1:8432/pr-review-{number}.html` in the system browser with `xdg-open` on Linux or `open` on macOS. Pi has no in-app browser. For automated inspection, use the `control-ui` skill and a local browser harness. If no graphical browser is available, report that limit and give the URL.
 
    **Why a fixed port and `cd /tmp`:** Background shells have no TTY, so Python buffers its startup message ("Serving HTTP on...") indefinitely — using port 0 means you can never read which port was chosen. And `--directory /tmp` works but `cd /tmp` is more robust across Python versions. If port 8432 is taken, try 8433, 8434, etc.
 

package/skills/statechart/scripts/test/cli.test.ts

@@ -454,7 +454,16 @@ for (const signal of ["SIGINT", "SIGTERM"] satisfies NodeJS.Signals[]) {
       signalWhile(signal, () => ({
         dir: gridCase(150),
         reached: (parent) => {
-          for (const f of fs.readdirSync(parent, { recursive: true, encoding: "utf8" }))
+          // The command creates and replaces draft trees while it writes. A recursive
+          // readdir can see a draft entry that is gone before Node descends into it.
+          let files: string[];
+          try {
+            files = fs.readdirSync(parent, { recursive: true, encoding: "utf8" });
+          } catch (error) {
+            if ((error as NodeJS.ErrnoException).code === "ENOENT") return false;
+            throw error;
+          }
+          for (const f of files)
             if (
               path.basename(f) === "chart.mmd" &&
               fs.statSync(path.join(parent, f), { throwIfNoEntry: false })?.size

package/src/child-env.ts

@@ -7,6 +7,7 @@ export const READONLY_ENV = 'PI_PSTACK_READONLY';
 export const ROOT_STORE_ENV = 'PI_PSTACK_ROOT_STORE';
 export const WORKSPACE_ENV = 'PI_PSTACK_WORKSPACE_STATE';
 export const ROOT_WORKSPACE_ENV = 'PI_PSTACK_ROOT_WORKSPACE';
+export const BUILD_PLAN_ENV = 'PI_PSTACK_BUILD_PLAN';
 
 export interface ChildIdentity {
   depth: number;
@@ -18,6 +19,7 @@ export interface ChildIdentity {
   workspaceState: string | undefined;
   /** The main chat's working directory, which authorizes every record stored in its shared workspace. */
   rootWorkspace: string | undefined;
+  buildPlan: string | undefined;
 }
 
 function read(): ChildIdentity {
@@ -31,6 +33,7 @@ function read(): ChildIdentity {
     rootStore: process.env[ROOT_STORE_ENV] || undefined,
     workspaceState: process.env[WORKSPACE_ENV] || undefined,
     rootWorkspace: process.env[ROOT_WORKSPACE_ENV] || undefined,
+    buildPlan: process.env[BUILD_PLAN_ENV] || undefined,
   };
 }
 
@@ -42,6 +45,7 @@ delete process.env[READONLY_ENV];
 delete process.env[ROOT_STORE_ENV];
 delete process.env[WORKSPACE_ENV];
 delete process.env[ROOT_WORKSPACE_ENV];
+delete process.env[BUILD_PLAN_ENV];
 
 /** Variables for a child of this process at `depth` (an agent keeps the depth it was created at). */
 export function childVariables(agentType: string, depth: number, readonly: boolean, rootStore: string, workspaceState: string, rootWorkspace: string): Record<string, string> {

package/src/index.ts

@@ -103,7 +103,11 @@ export default function piPstack(pi: ExtensionAPI): void {
   });
 
   const mode = registerMode(pi);
-  const plan = registerPlanMode(pi, { buildInWorker: (planFile, request) => task.startBackground(`Build ${basename(planFile)}`, request, { environment: 'cloud' }) });
+  const plan = registerPlanMode(pi, {
+    ...(childIdentity.buildPlan === undefined ? {} : { buildPlan: childIdentity.buildPlan }),
+    setTodos: (items, ctx) => todos.replace(items, ctx),
+    buildInWorker: (planFile, request) => task.startBackground(`Build ${basename(planFile)}`, request, { environment: 'cloud', buildPlan: planFile }),
+  });
   registerVisualize(pi, { artifactsDir: (ctx) => artifactsDir(ctx.cwd, ctx.sessionManager.getSessionId()) });
   registerGenerateImage(pi, { artifactsDir: (ctx) => artifactsDir(ctx.cwd, ctx.sessionManager.getSessionId()), mayOffer: () => !childIdentity.readonly && !plan.enabled() });
   const ownType = agents.find((agent) => agent.type === childIdentity.agentType);
@@ -119,7 +123,7 @@ export default function piPstack(pi: ExtensionAPI): void {
     },
   });
   const loop = registerLoop(pi, { hasPendingWork: task.hasBackgroundWork });
-  const todos = registerTodoWrite(pi);
+  const todos = registerTodoWrite(pi, childIdentity.readonly ? {} : { onWrite: plan.syncTodos });
   registerAskQuestion(pi);
   if (childIdentity.parentPid !== undefined) watchParent(pi, childIdentity.parentPid);
   if (childIdentity.readonly) registerReadonlyShell(pi);

package/src/loop.ts

@@ -1,5 +1,7 @@
+import { randomUUID } from 'node:crypto';
+
 import type { ExtensionAPI, ExtensionCommandContext, ExtensionContext } from '@earendil-works/pi-coding-agent';
-import { Type } from 'typebox';
+import { type Static, Type } from 'typebox';
 import { isOneShot } from './modes.ts';
 
 const DAY_MS = 86_400_000;
@@ -30,19 +32,16 @@ function delayOf(text: string): number {
   return ms;
 }
 
-export type LoopCommand = { kind: 'status' } | { kind: 'stop' } | { kind: 'start'; prompt: string; intervalMs?: number } | { kind: 'error'; message: string };
+export type LoopCommand = { kind: 'status' } | { kind: 'stop'; loopId?: string } | { kind: 'start'; prompt: string; intervalMs?: number } | { kind: 'error'; message: string };
 
-/** The longest trailing phrase that parses as a duration, such as `5m`, `every 10 minutes`, or `1 hour 30 minutes`. */
-function trailingInterval(text: string): { prompt: string; intervalMs: number } | undefined {
-  const tokens = text.split(/\s+/);
-  for (let take = Math.min(6, tokens.length); take >= 1; take -= 1) {
-    const intervalMs = parseDuration(tokens.slice(-take).join(' '));
+function edgeInterval(text: string, edge: 'leading' | 'trailing'): { prompt: string; intervalMs: number } | undefined {
+  const tokens = [...text.matchAll(/\S+/g)];
+  for (let take = tokens.length; take >= 1; take -= 1) {
+    const start = edge === 'leading' ? 0 : (tokens[tokens.length - take]?.index ?? 0);
+    const end = edge === 'trailing' ? text.length : (tokens[take - 1]?.index ?? 0) + (tokens[take - 1]?.[0].length ?? 0);
+    const intervalMs = parseDuration(text.slice(start, end));
     if (intervalMs === undefined) continue;
-    const prompt = tokens
-      .slice(0, -take)
-      .join(' ')
-      .replace(/\s+every$/i, '')
-      .trim();
+    const prompt = (edge === 'leading' ? text.slice(end) : text.slice(0, start).replace(/\s+every\s*$/i, '')).trim();
     return { prompt, intervalMs };
   }
   return undefined;
@@ -51,20 +50,13 @@ function trailingInterval(text: string): { prompt: string; intervalMs: number }
 export function parseLoopArgs(args: string): LoopCommand {
   const trimmed = args.trim();
   if (trimmed === '') return { kind: 'status' };
-  if (trimmed === 'stop' || trimmed === 'off') return { kind: 'stop' };
-  const [, first = '', rest = ''] = /^(\S+)\s*([\s\S]*)$/.exec(trimmed) ?? [];
-  const leadMs = parseDuration(first) ?? (first.toLowerCase() === 'every' ? parseDuration(rest.split(/\s+/)[0] ?? '') : undefined);
-  if (leadMs !== undefined) {
-    if (leadMs > MAX_DELAY_MS) return { kind: 'error', message: TOO_LONG };
-    const after = first.toLowerCase() === 'every' ? rest.split(/\s+/).slice(1).join(' ') : rest;
-    return after.trim() === '' ? { kind: 'error', message: '/loop needs a prompt: /loop [interval] <prompt>' } : { kind: 'start', prompt: after.trim(), intervalMs: leadMs };
-  }
-  // Cursor accepts the interval at either end, including `every 10 minutes`, so both ends are tried before treating it as a prompt.
-  const trailing = trailingInterval(trimmed);
-  if (trailing !== undefined) {
-    if (trailing.intervalMs > MAX_DELAY_MS) return { kind: 'error', message: TOO_LONG };
-    if (trailing.prompt === '') return { kind: 'error', message: '/loop needs a prompt: /loop [interval] <prompt>' };
-    return { kind: 'start', prompt: trailing.prompt, intervalMs: trailing.intervalMs };
+  const stop = /^(?:stop|off)(?:\s+(\S+))?$/.exec(trimmed);
+  if (stop !== null) return { kind: 'stop', ...(stop[1] === undefined ? {} : { loopId: stop[1] }) };
+  const interval = edgeInterval(trimmed, 'leading') ?? edgeInterval(trimmed, 'trailing');
+  if (interval !== undefined) {
+    if (interval.intervalMs > MAX_DELAY_MS) return { kind: 'error', message: TOO_LONG };
+    if (interval.prompt === '') return { kind: 'error', message: '/loop needs a prompt: /loop [interval] <prompt>' };
+    return { kind: 'start', ...interval };
   }
   return { kind: 'start', prompt: trimmed };
 }
@@ -113,7 +105,7 @@ function createLoopController(pi: ExtensionAPI, options: LoopOptions) {
     if (loop === undefined) return;
     loop = { ...loop, iteration: loop.iteration + 1, due: false };
     // Expansion lets a loop run a skill or template each time.
-    pi.sendUserMessage(loop.prompt, { expandPromptTemplates: true });
+    pi.sendUserMessage(loop.prompt, { expandPromptTemplates: true, deliverAs: 'followUp' });
   };
   /**
    * A timer fired. A fixed loop keeps its wall-clock cadence, like Cursor's sleep-and-echo shell loop, so a long run
@@ -167,31 +159,77 @@ function createLoopController(pi: ExtensionAPI, options: LoopOptions) {
     loop = { ...rest, nextWakeMs: delayMs };
   };
   const section = () => (loop === undefined ? undefined : loopSection(loop));
-  return { notify, stop, settled, start, arm, status, wake, clear, section, active: () => loop !== undefined };
+  return { stop, settled, start, arm, status, wake, clear, section, prompt: () => loop?.prompt, active: () => loop !== undefined };
+}
+
+function createLoopRegistry(pi: ExtensionAPI, options: LoopOptions) {
+  const controllers = new Map<string, ReturnType<typeof createLoopController>>();
+  const entries = () => {
+    for (const [id, controller] of controllers) if (!controller.active()) controllers.delete(id);
+    return [...controllers];
+  };
+  const choose = (loopId?: string, prompt?: string) => {
+    const active = entries();
+    const existing = active.find(([id, controller]) => (loopId !== undefined ? id === loopId : prompt !== undefined ? controller.prompt() === prompt : active.length === 1));
+    if (existing !== undefined) return { loopId: existing[0], controller: existing[1] };
+    if (loopId !== undefined) throw new Error(`No running loop has id "${loopId}". /loop lists running loops.`);
+    if (prompt !== undefined) {
+      const id = randomUUID();
+      const controller = createLoopController(pi, options);
+      controllers.set(id, controller);
+      return { loopId: id, controller };
+    }
+    if (active.length === 0) throw new Error('No loop is running.');
+    throw new Error(`Several loops are running. Pass loop_id to choose one, or use /loop stop <id>. Running loops:\n${active.map(([id, controller]) => `${id} ${controller.status()}`).join('\n')}`);
+  };
+  const status = () => {
+    const active = entries();
+    if (active.length === 0) return 'No loop is running. Usage: /loop [interval] <prompt>, with the interval at either end; /loop stop ends one.';
+    return active.map(([id, controller]) => (active.length === 1 ? controller.status() : `${id} ${controller.status()}`)).join('\n');
+  };
+  const section = () => {
+    const active = entries();
+    if (active.length === 0) return undefined;
+    if (active.length === 1) return active[0]?.[1].section();
+    return [...active.map(([id, controller]) => `Loop ${id} runs ${JSON.stringify(controller.prompt())}.\n${controller.section()}`), 'Several loops are running. Pass loop_id with wake_in or stop so only the intended loop changes.'].join(
+      '\n\n',
+    );
+  };
+  return { choose, entries, status, section };
 }
 
 type LoopController = ReturnType<typeof createLoopController>;
+type LoopRegistry = ReturnType<typeof createLoopRegistry>;
 
 const ONE_SHOT = '/loop needs an interactive or RPC session; print and JSON runs exit when the agent settles.';
 
-function handleLoopCommand(controller: LoopController, args: string, ctx: ExtensionCommandContext): void {
+function handleLoopCommand(registry: LoopRegistry, args: string, ctx: ExtensionCommandContext): void {
   const command = parseLoopArgs(args);
-  if (command.kind === 'status') controller.notify(ctx, controller.status());
-  else if (command.kind === 'stop') controller.stop(ctx, 'stopped by /loop stop.');
-  else if (command.kind === 'error') controller.notify(ctx, command.message);
-  else if (isOneShot(ctx.mode)) process.stderr.write(`${ONE_SHOT}\n`);
-  else controller.start(ctx, command.prompt, command.intervalMs);
+  try {
+    if (command.kind === 'status') ctx.ui.notify(registry.status(), 'info');
+    else if (command.kind === 'stop') registry.choose(command.loopId).controller.stop(ctx, 'stopped by /loop stop.');
+    else if (command.kind === 'error') ctx.ui.notify(command.message, 'error');
+    else if (isOneShot(ctx.mode)) process.stderr.write(`${ONE_SHOT}\n`);
+    else registry.choose(undefined, command.prompt).controller.start(ctx, command.prompt, command.intervalMs);
+  } catch (error) {
+    ctx.ui.notify(error instanceof Error ? error.message : String(error), 'error');
+  }
 }
 
 const LoopParams = Type.Object({
-  prompt: Type.Optional(Type.String({ description: 'Start (or replace) a loop that sends this prompt each run. It may be a skill or template command such as /poteto-mode <task>.' })),
+  loop_id: Type.Optional(Type.String({ description: 'Loop ID from an earlier Loop result. Required to wake, stop, or replace one loop when several are running. Omit with a new prompt to start an independent loop.' })),
+  prompt: Type.Optional(
+    Type.String({
+      description:
+        'Start a loop that sends this prompt each run. A different prompt starts an independent loop; the same prompt or an explicit loop_id replaces its earlier schedule. It may be a skill or template command such as /poteto-mode <task>.',
+    }),
+  ),
   interval: Type.Optional(Type.String({ description: 'With prompt: a fixed cadence such as 30m or 1h; the first run starts that long after this turn ends.' })),
   wake_in: Type.Optional(Type.String({ description: 'With prompt: the first run of an agent-paced loop. Alone: the next run of the running agent-paced loop. A duration such as 10m, at most 24d.' })),
   stop: Type.Optional(Type.Boolean({ description: 'End the loop once its goal is met.' })),
 });
 
-function loopToolText(controller: LoopController, params: { prompt?: string; interval?: string; wake_in?: string; stop?: boolean }, ctx: ExtensionContext): string {
-  if (isOneShot(ctx.mode)) throw new Error(`${ONE_SHOT} Do the work now instead of scheduling it.`);
+function loopToolText(controller: LoopController, params: Static<typeof LoopParams>, ctx: ExtensionContext): string {
   if (params.stop === true) {
     if (!controller.active()) throw new Error('No loop is running.');
     controller.stop(ctx, 'the agent ended it.');
@@ -215,32 +253,39 @@ function loopToolText(controller: LoopController, params: { prompt?: string; int
   return `Next loop run in ${formatMs(delay)}, after this turn ends.`;
 }
 
-function registerLoopTool(pi: ExtensionAPI, controller: LoopController): void {
+function registerLoopTool(pi: ExtensionAPI, registry: LoopRegistry): void {
   pi.registerTool({
     name: 'Loop',
     label: 'Loop',
-    description: '/loop for you: start a loop that re-sends a prompt at a fixed interval or at wakes you pick, schedule the next wake of an agent-paced loop, or stop the loop once its goal is met. Use it when a playbook says to arm /loop.',
+    description:
+      '/loop for you: start an independent loop that re-sends a prompt at a fixed interval or at wakes you pick, schedule its next wake, or stop it once its goal is met. Use it when a playbook says to arm /loop. Each result names the loop ID. With several loops running, pass loop_id to wake or stop the intended loop.',
     promptSnippet: 'Start a /loop, schedule its next wake, or stop it',
     parameters: LoopParams,
     annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: false },
     async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
-      return { content: [{ type: 'text', text: loopToolText(controller, params, ctx) }], details: undefined };
+      if (isOneShot(ctx.mode)) throw new Error(`${ONE_SHOT} Do the work now instead of scheduling it.`);
+      const { loopId, controller } = registry.choose(params.loop_id, params.prompt);
+      return { content: [{ type: 'text', text: `${loopToolText(controller, params, ctx)}\nLoop ID: ${loopId}` }], details: { loopId } };
     },
   });
 }
 
 /** /loop: run a prompt at a fixed interval, or at wakes the agent picks, until stopped. */
 export function registerLoop(pi: ExtensionAPI, options: LoopOptions): { section: () => string | undefined } {
-  const controller = createLoopController(pi, options);
+  const registry = createLoopRegistry(pi, options);
   pi.on('session_start', (_event, ctx) => {
     if (isOneShot(ctx.mode)) pi.setActiveTools(pi.getActiveTools().filter((name) => name !== 'Loop'));
   });
-  pi.on('agent_settled', (event, ctx) => controller.settled(ctx, event.aborted));
-  pi.on('session_shutdown', () => controller.clear());
+  pi.on('agent_settled', (event, ctx) => {
+    for (const [, controller] of registry.entries()) controller.settled(ctx, event.aborted);
+  });
+  pi.on('session_shutdown', () => {
+    for (const [, controller] of registry.entries()) controller.clear();
+  });
   pi.registerCommand('loop', {
-    description: 'Run a prompt repeatedly: /loop [interval] <prompt>, interval either end and like 30s, 5m, 1h, every 10 minutes (at most 24d); /loop stop',
-    handler: async (args, ctx) => handleLoopCommand(controller, args, ctx),
+    description: 'Run independent prompts repeatedly: /loop [interval] <prompt>, interval either end and like 30s, 5m, 1h, every 10 minutes (at most 24d); /loop lists them; /loop stop [id] stops one',
+    handler: async (args, ctx) => handleLoopCommand(registry, args, ctx),
   });
-  registerLoopTool(pi, controller);
-  return { section: controller.section };
+  registerLoopTool(pi, registry);
+  return { section: registry.section };
 }