@mjasnikovs/pi-task 0.18.28 → 0.18.29

package/dist/shared/command-watchdog.d.ts

@@ -43,6 +43,14 @@ export interface WatchdogDeps {
     /** Invoked when a command overruns: each adapter aborts/kills here. */
     onFire: (toolCallId: string, toolName: string, timeoutMs: number) => void;
 }
+/**
+ * Stable substring of {@link reminderMessage}, used by the steer loop
+ * (orchestrator steerUntilDone) to recognise the watchdog's follow-up turn in
+ * the session entries — the artifact that distinguishes a watchdog abort from a
+ * human ESC. Interpolated into the message so the detector and the text cannot
+ * drift apart.
+ */
+export declare const WATCHDOG_CANCEL_MARKER = "was automatically cancelled \u2014 it looked stuck.";
 /**
  * MAIN-SESSION reminder, delivered as a follow-up turn after ctx.abort() has
  * cancelled the offending tool call. The session is still alive and remembers

package/dist/shared/command-watchdog.js

@@ -44,6 +44,14 @@ function correction() {
         + `timeout — set the bash tool's \`timeout\` parameter (in seconds) so it cannot hang `
         + `again — or break it into smaller steps. Do NOT simply retry the same unbounded command.`);
 }
+/**
+ * Stable substring of {@link reminderMessage}, used by the steer loop
+ * (orchestrator steerUntilDone) to recognise the watchdog's follow-up turn in
+ * the session entries — the artifact that distinguishes a watchdog abort from a
+ * human ESC. Interpolated into the message so the detector and the text cannot
+ * drift apart.
+ */
+export const WATCHDOG_CANCEL_MARKER = 'was automatically cancelled — it looked stuck.';
 /**
  * MAIN-SESSION reminder, delivered as a follow-up turn after ctx.abort() has
  * cancelled the offending tool call. The session is still alive and remembers
@@ -51,7 +59,7 @@ function correction() {
  */
 export function reminderMessage(toolName, timeoutMs) {
     return (`[SYSTEM] Your \`${toolName}\` call ran longer than ${minutes(timeoutMs)} `
-        + `and was automatically cancelled — it looked stuck. `
+        + `and ${WATCHDOG_CANCEL_MARKER} `
         + correction());
 }
 /**

package/dist/task/command-watchdog.d.ts

@@ -24,7 +24,11 @@ import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
  * them; their equivalent guard lives in runWorker (workers/pi-worker-core.ts)
  * and shares the same machine from shared/command-watchdog.ts.
  */
-export { CommandWatchdog, commandTimeoutHint, realTimerDeps, reminderMessage, type TimerHandle, type WatchdogDeps } from '../shared/command-watchdog.js';
+export { CommandWatchdog, commandTimeoutHint, realTimerDeps, reminderMessage, WATCHDOG_CANCEL_MARKER, type TimerHandle, type WatchdogDeps } from '../shared/command-watchdog.js';
+/** @internal Set by onFire when it aborts a turn. Exported for the adapter and tests. */
+export declare function noteWatchdogAbort(): void;
+/** True exactly once per watchdog abort; clears the flag. */
+export declare function consumeWatchdogAbort(): boolean;
 /**
  * Wire the watchdog into the main session. Only ever active in the host session
  * (children run `--no-extensions`), which is exactly where the observed hangs

package/dist/task/command-watchdog.js

@@ -27,7 +27,31 @@ import { CommandWatchdog, realTimerDeps, reminderMessage } from '../shared/comma
  */
 // Re-exported so existing importers (and the machine's own tests) keep their
 // entry point while the implementation lives in shared/.
-export { CommandWatchdog, commandTimeoutHint, realTimerDeps, reminderMessage } from '../shared/command-watchdog.js';
+export { CommandWatchdog, commandTimeoutHint, realTimerDeps, reminderMessage, WATCHDOG_CANCEL_MARKER } from '../shared/command-watchdog.js';
+/**
+ * One-shot marker: the most recent turn abort was issued BY THE WATCHDOG, not by
+ * a human ESC. Both end the assistant turn with stopReason 'aborted' — the only
+ * signal steerUntilDone's wasInterrupted() can read — so without this flag the
+ * steer loop can win the race against the watchdog's queued follow-up turn and
+ * show a steering prompt to an empty room (wedging an unattended run).
+ *
+ * Set synchronously in onFire BEFORE ctx.abort(), so it is observable by the
+ * time any waitForIdle resolves; consumed (cleared) by the first reader. A stale
+ * flag (the aborted turn wasn't one the steer loop was watching) only costs the
+ * consumer a bounded wait before it falls back to prompting — it can never
+ * permanently suppress a human's steer prompt.
+ */
+let watchdogAbortPending = false;
+/** @internal Set by onFire when it aborts a turn. Exported for the adapter and tests. */
+export function noteWatchdogAbort() {
+    watchdogAbortPending = true;
+}
+/** True exactly once per watchdog abort; clears the flag. */
+export function consumeWatchdogAbort() {
+    const was = watchdogAbortPending;
+    watchdogAbortPending = false;
+    return was;
+}
 /**
  * Wire the watchdog into the main session. Only ever active in the host session
  * (children run `--no-extensions`), which is exactly where the observed hangs
@@ -46,8 +70,12 @@ export function registerCommandWatchdog(pi) {
             ctxByCall.delete(toolCallId);
             // Cancel the stuck command (kills the tool's whole process tree via
             // the turn's AbortSignal), then start a fresh turn telling the model
-            // to bound its next attempt.
-            ctx?.abort();
+            // to bound its next attempt. The flag must precede the abort so the
+            // steer loop can never observe the 'aborted' turn before the flag.
+            if (ctx) {
+                noteWatchdogAbort();
+                ctx.abort();
+            }
             pi.sendUserMessage(reminderMessage(toolName, timeoutMs), { deliverAs: 'followUp' });
         }
     });

package/dist/task/orchestrator.d.ts

@@ -212,6 +212,41 @@ export declare const MAX_COMPACTION_RESUMES = 20;
  * of resumes performed (0 when the turn did not end on a compaction).
  */
 export declare function resumeAcrossCompactions(ctx: SteerCtx): Promise<number>;
+/**
+ * Timing knobs for the watchdog-abort guard in {@link steerUntilDone}, injectable
+ * so tests exercise the grace expiry without a 10-second wait. `graceMs` bounds
+ * how long the loop waits for the watchdog's follow-up to be DELIVERED (not to
+ * finish — its turn may legitimately run for minutes afterwards); delivery is
+ * normally near-instant, so the grace only expires on a stale flag.
+ */
+export interface SteerWatchdogDeps {
+    consume: () => boolean;
+    graceMs: number;
+    pollMs: number;
+}
+/**
+ * After the implementation turn settles, honour a user ESC by letting them steer.
+ *
+ * `waitForIdle` resolves both on natural completion AND on an ESC (which aborts
+ * the turn → idle). When the last turn was aborted, the host's main input loop is
+ * blocked inside our command handler, so a message typed in the editor would only
+ * queue, never run (interactive-mode routes idle input through onInputCallback,
+ * which is unset while we hold the loop). We therefore solicit the steering text
+ * ourselves and feed it back as another turn via sendUserMessage — which runs to
+ * completion when the session is idle. Repeat until a turn finishes uninterrupted.
+ *
+ * A WATCHDOG abort also ends the turn with stopReason 'aborted' — indistinguishable
+ * from a human ESC by the session entries alone at that instant. The watchdog
+ * queues its own recovery follow-up, so prompting there would show a steering
+ * dialog to an empty room and wedge an unattended run on the race. The one-shot
+ * flag (set synchronously before the abort) routes that case to
+ * {@link awaitWatchdogFollowUp} instead; a stale flag degrades to a bounded wait
+ * followed by the ordinary prompt, never to a suppressed one.
+ *
+ * Returns true when the user declined to steer (empty/cancelled) and the run
+ * should pause; false when the implementation completed (steered or not).
+ */
+export declare function steerUntilDone(ctx: SteerCtx, promptSteer?: (ctx: ExtensionCommandContext) => Promise<string | undefined>, watchdog?: Partial<SteerWatchdogDeps>): Promise<boolean>;
 /**
  * Run one prompt through the full single-task pipeline in a fresh session and
  * deliver its spec. With waitForImplementation, block until the agent finishes

package/dist/task/orchestrator.js

@@ -28,6 +28,7 @@ import { armImplWidget, disarmImplWidget, setupImplWidget } from './impl-widget.
 import { publishViewer, publishNotify, publishLifecycleNotice, registerBridgeCommand, getBridge, SessionUI } from '../remote/bridge.js';
 import { pushNotify } from '../remote/push.js';
 import { getConfig } from '../config/config.js';
+import { consumeWatchdogAbort, WATCHDOG_CANCEL_MARKER } from './command-watchdog.js';
 import { buildGateDeps } from './gate-deps.js';
 import { runGatesForTask } from './task-gates.js';
 import { parseVerifyBlock } from './spec-validation.js';
@@ -462,6 +463,67 @@ export async function resumeAcrossCompactions(ctx) {
     }
     return resumes;
 }
+/**
+ * True when the watchdog's reminder follow-up has been DELIVERED into the session
+ * after the aborted assistant turn but its own turn has not finished yet — the
+ * artifact that confirms a pending watchdog recovery. Scoped after the LAST
+ * assistant entry so an earlier fire's reminder (already answered by its own
+ * turn) never matches.
+ */
+function watchdogReminderDelivered(ctx) {
+    const entries = ctx.sessionManager.getEntries();
+    let lastAssistant = -1;
+    for (let i = 0; i < entries.length; i++) {
+        const e = entries[i];
+        if ('message' in e && 'role' in e.message && e.message.role === 'assistant') {
+            lastAssistant = i;
+        }
+    }
+    for (let i = lastAssistant + 1; i < entries.length; i++) {
+        const e = entries[i];
+        if (!('message' in e) || !('role' in e.message) || e.message.role !== 'user')
+            continue;
+        const content = e.message.content;
+        const text = typeof content === 'string' ? content
+            : Array.isArray(content) ?
+                content
+                    .map(b => b !== null && typeof b === 'object' && 'text' in b ?
+                    String(b.text)
+                    : '')
+                    .join(' ')
+                : '';
+        if (text.includes(WATCHDOG_CANCEL_MARKER))
+            return true;
+    }
+    return false;
+}
+const STEER_WATCHDOG_DEFAULTS = {
+    consume: consumeWatchdogAbort,
+    graceMs: 10_000,
+    pollMs: 100
+};
+/**
+ * Wait for a watchdog abort's queued follow-up turn instead of prompting. The
+ * abort and the reminder follow-up are two separate steps in the watchdog's
+ * onFire, so the steer loop can observe the aborted turn before the reminder is
+ * delivered — poll (bounded) until it lands or the follow-up turn has already
+ * completed. True = recovery observed, re-check the loop; false = grace expired
+ * with no reminder (stale flag) — fall back to the human prompt.
+ */
+async function awaitWatchdogFollowUp(ctx, wd) {
+    const deadline = Date.now() + wd.graceMs;
+    for (;;) {
+        if (!wasInterrupted(ctx))
+            return true; // follow-up turn already completed
+        if (watchdogReminderDelivered(ctx)) {
+            await ctx.waitForIdle(); // let the follow-up turn run to completion
+            return true;
+        }
+        if (Date.now() >= deadline)
+            return false;
+        await new Promise(r => setTimeout(r, wd.pollMs));
+    }
+}
 /**
  * After the implementation turn settles, honour a user ESC by letting them steer.
  *
@@ -473,10 +535,19 @@ export async function resumeAcrossCompactions(ctx) {
  * ourselves and feed it back as another turn via sendUserMessage — which runs to
  * completion when the session is idle. Repeat until a turn finishes uninterrupted.
  *
+ * A WATCHDOG abort also ends the turn with stopReason 'aborted' — indistinguishable
+ * from a human ESC by the session entries alone at that instant. The watchdog
+ * queues its own recovery follow-up, so prompting there would show a steering
+ * dialog to an empty room and wedge an unattended run on the race. The one-shot
+ * flag (set synchronously before the abort) routes that case to
+ * {@link awaitWatchdogFollowUp} instead; a stale flag degrades to a bounded wait
+ * followed by the ordinary prompt, never to a suppressed one.
+ *
  * Returns true when the user declined to steer (empty/cancelled) and the run
  * should pause; false when the implementation completed (steered or not).
  */
-async function steerUntilDone(ctx, promptSteer) {
+export async function steerUntilDone(ctx, promptSteer, watchdog) {
+    const wd = { ...STEER_WATCHDOG_DEFAULTS, ...watchdog };
     // Fan the prompt out through the bridge (local TUI input + remote browser
     // card, first answer wins) instead of a raw ctx.ui.input: an interrupt can
     // come from the remote Stop button just as well as a terminal ESC, and a
@@ -491,6 +562,8 @@ async function steerUntilDone(ctx, promptSteer) {
             allowSkip: true
         }));
     while (wasInterrupted(ctx)) {
+        if (wd.consume() && (await awaitWatchdogFollowUp(ctx, wd)))
+            continue;
         const steer = await ask(ctx);
         if (steer === undefined || steer.trim().length === 0)
             return true; // pause

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@mjasnikovs/pi-task",
-    "version": "0.18.28",
+    "version": "0.18.29",
     "description": "Deterministic task planning and spec-orchestration for local models — crash-safe /task pipelines with verify/enforce gates, a real-time remote web view, and web/docs/fetch/worker subagent tools.",
     "type": "module",
     "main": "./dist/index.js",