@mjasnikovs/pi-task 0.18.41 → 0.18.43

package/README.md

@@ -63,7 +63,7 @@ A whole plan — `/task-auto` splits it into an ordered task list and runs each
 | `/task-resume [id]` | Resume the most recent (or named) unfinished task. |
 | `/task-cancel` | Cancel the running task (soft-terminal — still resumable). |
 | `/task-auto <feature>` | Plan a feature into a task list and run each title through `/task` in order (resumable). |
-| `/task-auto-resume` | Resume the active `/task-auto` run at the next unfinished task. |
+| `/task-auto-resume [--unattended]` | Resume the active `/task-auto` run at the next unfinished task. `--unattended` is the boot-hook form: in-flight runs only. |
 | `/task-auto-cancel` | Stop the `/task-auto` loop after the current task (still resumable). |
 | `/task-config` | Toggle pi-task settings in an editor dialog: remote server, compress reasoning, auto-commit, orientation, verify work, enforce guidelines, command timeout, stream watchdog, and the extension whitelist for child sessions. |
 | `/remote` | Show the QR code & URLs for the web view (`/remote stop` to stop). Answer grill questions, start tasks, and watch progress from your phone. |
@@ -100,6 +100,7 @@ A real feature is usually several tasks, not one. `/task-auto` is a thin planner
 - **Clarify first.** It asks the few clarifying questions whose answers change how the feature splits, then decomposes the answers into an ordered list of task titles written to `.pi-tasks/TASK_AUTO_NNNN.md`.
 - **Sequential, blocking.** Each title runs through `/task` to a spec, the spec is implemented, and the loop waits for that to finish before starting the next title. No overlap.
 - **Crash- and cancel-safe.** Progress is the markdown checkboxes in the AUTO file. `/task-auto-resume` (no id) automatically picks up the active run at the first unchecked title. If a title's `/task` run fails, the loop stops and leaves the run resumable.
+- **Restart-safe, unattended.** `/task-auto-resume --unattended` is the same resume with no human in the loop — for a boot hook or a container entrypoint. It continues **in-flight** runs only: a `failed` or `cancelled` run stopped for a reason a power cycle does not clear, so it is reported and left alone rather than re-entered against the same wall. Either way the resume banner states exactly what it measured — how long since the run last wrote, and that nothing was rolled back — and attributes no cause, because a stopped host, a hung child, and a slow task look identical from here. Pair it with `restart: unless-stopped` on long-running containers and an overnight outage costs minutes instead of the whole night.
 - **One commit per task.** When **auto-commit** is on (the default) and you're in a git repo, the working tree is snapshotted into a single commit after each title passes, so the run produces a clean per-task history. It's best-effort: outside a repo, with nothing to commit, or on any git error, the loop reports the reason and keeps going. Toggle it in `/task-config`.
 
 ## Remote — drive a task from your phone

package/dist/shared/child-process.js

@@ -276,11 +276,13 @@ export function runChild(spawn, invocation, cwd, signal, opts) {
                 {
                     ...opts,
                     onToolCall: call => {
-                        streamWatch.suspend();
+                        // Keyed: a child's tool batch runs in parallel too, so the
+                        // first result must not un-pause a still-running sibling.
+                        streamWatch.suspend(call.toolCallId);
                         return opts.onToolCall ? opts.onToolCall(call) : null;
                     },
                     onToolResult: r => {
-                        streamWatch.resume();
+                        streamWatch.resume(r.toolCallId);
                         opts.onToolResult?.(r);
                     }
                 }

package/dist/shared/stream-watchdog.d.ts

@@ -64,20 +64,39 @@ export declare class StreamWatchdog {
     private timer;
     private lastEvent;
     private armedMs;
-    /** True while a TOOL is executing: the model stream is legitimately idle then,
-     *  and that window belongs to the command watchdog, not to this one. Without
-     *  this, a 10-minute build would look identical to a hung stream. */
-    private suspended;
+    /**
+     * The tool calls currently executing. While ANY is running the model stream is
+     * legitimately idle, and that window belongs to the command watchdog, not to
+     * this one — without it a 10-minute build looks identical to a hung stream.
+     *
+     * A SET, not a boolean: pi runs a tool batch in parallel (agent-loop.js
+     * `executeToolCallsParallel` emits every tool_execution_start up front, then one
+     * end per call as each settles, and answers an immediate call inline while an
+     * earlier one is still running). A boolean would be cleared by the FIRST end and
+     * leave the still-running sibling — the long build — exposed to a false fire.
+     * Same per-toolCallId idiom the command watchdog uses.
+     */
+    private readonly active;
+    /** Nesting depth for callers that cannot supply an id, counted so an unkeyed
+     *  pair nests the same way a keyed one does. */
+    private keyless;
     private fired;
+    private get suspended();
     constructor(deps: StreamWatchdogDeps);
     /** Begin watching a model request. No-op when the watchdog is off or already armed. */
     start(): void;
     /** Any stream event of any kind: resets the idle clock. */
     note(): void;
-    /** A tool started executing — pause the idle clock until it ends. */
-    suspend(): void;
-    /** A tool finished — the stream is expected to resume; restart the clock. */
-    resume(): void;
+    /** A tool started executing — pause the idle clock until it (and every sibling
+     *  still running) ends. `key` is the tool call id where the caller has one. */
+    suspend(key?: string): void;
+    /**
+     * A tool finished. The clock only restarts once the LAST one does — a fast tool
+     * settling first says nothing about a sibling that is still running. Unmatched
+     * ends (a watchdog armed mid-batch never saw the start) are ignored rather than
+     * clearing the whole set.
+     */
+    resume(key?: string): void;
     /** Stop watching (turn/agent/session end, or child exit). Safe to call twice. */
     stop(): void;
     /** @internal Exposed for the poll callback and tests. */

package/dist/shared/stream-watchdog.js

@@ -59,11 +59,26 @@ export class StreamWatchdog {
     timer;
     lastEvent = 0;
     armedMs = 0;
-    /** True while a TOOL is executing: the model stream is legitimately idle then,
-     *  and that window belongs to the command watchdog, not to this one. Without
-     *  this, a 10-minute build would look identical to a hung stream. */
-    suspended = false;
+    /**
+     * The tool calls currently executing. While ANY is running the model stream is
+     * legitimately idle, and that window belongs to the command watchdog, not to
+     * this one — without it a 10-minute build looks identical to a hung stream.
+     *
+     * A SET, not a boolean: pi runs a tool batch in parallel (agent-loop.js
+     * `executeToolCallsParallel` emits every tool_execution_start up front, then one
+     * end per call as each settles, and answers an immediate call inline while an
+     * earlier one is still running). A boolean would be cleared by the FIRST end and
+     * leave the still-running sibling — the long build — exposed to a false fire.
+     * Same per-toolCallId idiom the command watchdog uses.
+     */
+    active = new Set();
+    /** Nesting depth for callers that cannot supply an id, counted so an unkeyed
+     *  pair nests the same way a keyed one does. */
+    keyless = 0;
     fired = false;
+    get suspended() {
+        return this.active.size > 0 || this.keyless > 0;
+    }
     constructor(deps) {
         this.deps = deps;
     }
@@ -80,7 +95,8 @@ export class StreamWatchdog {
             return;
         this.armedMs = ms;
         this.fired = false;
-        this.suspended = false;
+        this.active.clear();
+        this.keyless = 0;
         this.lastEvent = this.deps.now();
         this.timer = this.deps.schedule(() => this.check(), pollIntervalMs(ms));
     }
@@ -88,21 +104,35 @@ export class StreamWatchdog {
     note() {
         this.lastEvent = this.deps.now();
     }
-    /** A tool started executing — pause the idle clock until it ends. */
-    suspend() {
-        this.suspended = true;
+    /** A tool started executing — pause the idle clock until it (and every sibling
+     *  still running) ends. `key` is the tool call id where the caller has one. */
+    suspend(key) {
+        if (key === undefined)
+            this.keyless++;
+        else
+            this.active.add(key);
     }
-    /** A tool finished — the stream is expected to resume; restart the clock. */
-    resume() {
-        this.suspended = false;
-        this.note();
+    /**
+     * A tool finished. The clock only restarts once the LAST one does — a fast tool
+     * settling first says nothing about a sibling that is still running. Unmatched
+     * ends (a watchdog armed mid-batch never saw the start) are ignored rather than
+     * clearing the whole set.
+     */
+    resume(key) {
+        if (key === undefined)
+            this.keyless = Math.max(0, this.keyless - 1);
+        else
+            this.active.delete(key);
+        if (!this.suspended)
+            this.note();
     }
     /** Stop watching (turn/agent/session end, or child exit). Safe to call twice. */
     stop() {
         if (this.timer !== undefined)
             this.deps.cancel(this.timer);
         this.timer = undefined;
-        this.suspended = false;
+        this.active.clear();
+        this.keyless = 0;
     }
     /** @internal Exposed for the poll callback and tests. */
     check() {

package/dist/task/auto-io.d.ts

@@ -1,3 +1,5 @@
+import type { TaskState } from './task-types.js';
+import type { AutoResumeCandidate } from './resume-gap.js';
 export interface TaskEntry {
     index: number;
     title: string;
@@ -58,5 +60,18 @@ export declare function stampTaskInProgress(cwd: string, id: string, index: numb
  * next step by "first unchecked" rather than by a cached index.
  */
 export declare function insertTaskAfter(cwd: string, id: string, afterIndex: number, title: string): Promise<boolean>;
-/** Find the most-recently-updated resumable TASK_AUTO_* file, or null. */
+/**
+ * Find the most-recently-updated resumable TASK_AUTO_* file, with the state and
+ * last-write time the resume banner reports (see resume-gap.ts). Null when there
+ * is nothing resumable.
+ *
+ * `states` narrows which states count as resumable, and the UNATTENDED path passes
+ * UNATTENDED_STATES so the search answers the question that path actually asks —
+ * "is there an IN-FLIGHT run to pick up?". Selecting the newest human-resumable run
+ * and only then refusing it on state let one failed run shadow an in-flight one
+ * behind it: the boot hook refused every restart and the in-flight run stayed in
+ * exactly the dead air this feature exists to end.
+ */
+export declare function findResumableAutoDetailed(cwd: string, states?: readonly TaskState[]): Promise<AutoResumeCandidate | null>;
+/** Id-only form of {@link findResumableAutoDetailed}. */
 export declare function findResumableAuto(cwd: string): Promise<string | null>;

package/dist/task/auto-io.js

@@ -194,8 +194,19 @@ export async function insertTaskAfter(cwd, id, afterIndex, title) {
     await setTaskSection(cwd, id, 'tasks', lines.join('\n'));
     return true;
 }
-/** Find the most-recently-updated resumable TASK_AUTO_* file, or null. */
-export async function findResumableAuto(cwd) {
+/**
+ * Find the most-recently-updated resumable TASK_AUTO_* file, with the state and
+ * last-write time the resume banner reports (see resume-gap.ts). Null when there
+ * is nothing resumable.
+ *
+ * `states` narrows which states count as resumable, and the UNATTENDED path passes
+ * UNATTENDED_STATES so the search answers the question that path actually asks —
+ * "is there an IN-FLIGHT run to pick up?". Selecting the newest human-resumable run
+ * and only then refusing it on state let one failed run shadow an in-flight one
+ * behind it: the boot hook refused every restart and the in-flight run stayed in
+ * exactly the dead air this feature exists to end.
+ */
+export async function findResumableAutoDetailed(cwd, states = RESUMABLE_STATES) {
     await ensureTasksDir(cwd);
     const entries = await fsp.readdir(tasksDir(cwd));
     const candidates = [];
@@ -208,15 +219,19 @@ export async function findResumableAuto(cwd) {
             const fm = parseFrontMatter(raw);
             if (!fm)
                 continue;
-            if (!RESUMABLE_STATES.includes(fm.state))
+            if (!states.includes(fm.state))
                 continue;
             const st = await fsp.stat(path.join(tasksDir(cwd), f));
-            candidates.push({ id: m[1], mtime: st.mtimeMs });
+            candidates.push({ id: m[1], state: fm.state, lastWriteMs: st.mtimeMs });
         }
         catch {
             /* skip unreadable */
         }
     }
-    candidates.sort((a, b) => b.mtime - a.mtime);
-    return candidates.length > 0 ? candidates[0].id : null;
+    candidates.sort((a, b) => b.lastWriteMs - a.lastWriteMs);
+    return candidates.length > 0 ? candidates[0] : null;
+}
+/** Id-only form of {@link findResumableAutoDetailed}. */
+export async function findResumableAuto(cwd) {
+    return (await findResumableAutoDetailed(cwd))?.id ?? null;
 }

package/dist/task/auto-orchestrator.js

@@ -14,7 +14,8 @@ import { renderInlineMarkdown, stripInlineMarkdown } from './inline-markdown.js'
 import { AUTO_CLARIFY_PROMPT, AUTO_DECOMPOSE_PROMPT, DECOMPOSE_COVERAGE_PROMPT } from './auto-prompts.js';
 import { GRILL_AUTO_ANSWER_PROMPT, GRILL_AUTO_FORMAT_HINT } from './prompts.js';
 import { isDuplicateQuestion, MAX_DUP_STRIKES, DUP_REPROMPT_HINT } from './question-dedup.js';
-import { allocateAutoId, buildAutoBody, parseDecomposeList, parseCoverageVerdict, parseTaskList, checkOffTask, stampTaskInProgress, insertTaskAfter, findResumableAuto } from './auto-io.js';
+import { allocateAutoId, buildAutoBody, parseDecomposeList, parseCoverageVerdict, parseTaskList, checkOffTask, stampTaskInProgress, insertTaskAfter, findResumableAutoDetailed } from './auto-io.js';
+import { decideResume, UNATTENDED_STATES } from './resume-gap.js';
 import { drainRepairQueue, mergeRepairCandidates, planHasRepairFor, parseRepairTitleFile, buildRepairTitle, buildRepairScopeFence, extractFailingCommand } from './root-cause-repair.js';
 import { writeTaskFile, readTaskFile, updateTaskFrontMatter, taskFilePath, tasksDir } from './task-io.js';
 import { readTextFile } from '../shared/fs-text.js';
@@ -1593,15 +1594,30 @@ async function handleTaskAuto(args, ctx) {
         disarmCancelListener();
     }
 }
-async function handleTaskAutoResume(_args, ctx) {
+async function handleTaskAutoResume(args, ctx) {
     await ctx.waitForIdle();
     const cwd = ctx.cwd;
-    const id = await findResumableAuto(cwd);
-    if (!id) {
-        ctx.ui.notify('No resumable /task-auto run.', 'info');
+    // `--unattended` is the boot-hook path: no human decided to continue this
+    // run, so it resumes in-flight states only and refuses the rest by name.
+    const unattended = /(^|\s)--unattended(\s|$)/.test(args);
+    // Unattended asks a narrower question — "is there an IN-FLIGHT run?" — so it
+    // searches those states directly. Picking the newest human-resumable run and
+    // refusing it on state let a failed run shadow an in-flight one behind it.
+    // With nothing in flight, fall back to the newest resumable run so the refusal
+    // still names it instead of claiming there is nothing here.
+    const eligible = unattended ?
+        await findResumableAutoDetailed(cwd, UNATTENDED_STATES)
+        : await findResumableAutoDetailed(cwd);
+    const candidate = eligible ?? (unattended ? await findResumableAutoDetailed(cwd) : null);
+    const decision = decideResume(candidate, Date.now(), unattended);
+    ctx.ui.notify(decision.banner, decision.level);
+    // An unattended refusal happens with nobody watching the terminal — the
+    // remote view is the only surface that will still be there in the morning.
+    if (unattended)
+        publishLifecycleNotice(decision.banner, decision.level);
+    if (!decision.resume || !candidate)
         return;
-    }
-    ctx.ui.notify(`Resuming ${id}…`, 'info');
+    const id = candidate.id;
     await updateTaskFrontMatter(cwd, id, { state: 'in_progress' });
     autoRunning = true;
     armTerminalCancel(ctx);
@@ -1670,7 +1686,8 @@ export function registerTaskAuto(pi) {
         handler: handleTaskAuto
     });
     registerBridgeCommand(pi, 'task-auto-resume', {
-        description: 'Resume the active /task-auto run.',
+        description: 'Resume the active /task-auto run. Usage: /task-auto-resume [--unattended] '
+            + '(--unattended is for boot hooks: in-flight runs only, never a failed one).',
         handler: handleTaskAutoResume
     });
     registerBridgeCommand(pi, 'task-auto-cancel', {

package/dist/task/final-gate-progress.js

@@ -51,12 +51,28 @@ const VOLATILE = [
     [/\bpids?\s*[:=]?\s*\d+/g, '<pid>'],
     [/(?:127\.0\.0\.1|localhost|0\.0\.0\.0|\[::1\]):\d+/g, '<addr>'],
     [/\bport\s*[:=]?\s*\d{2,5}\b/g, '<port>'],
-    [/:\d{2,5}\b/g, ':<port>'],
     // Long hex / uuid-ish ids (sha, container id, request id).
     [/\b0x[0-9a-f]+\b/g, '<hex>'],
     [/\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/g, '<uuid>'],
     [/\b[0-9a-f]{7,40}\b/g, '<hex>']
 ];
+/**
+ * A bare `:NNNN` port, which the localhost/`port N` rules above do not reach (a
+ * failure that just says "no listener on :3000").
+ *
+ * NOT applied when the colon follows a SOURCE LOCATION — `src/db.ts:41`,
+ * `Cart.tsx:88:12`. A failure detail embeds the failing command's output tail
+ * verbatim (final-gate.ts `r.tail`), and tsc/eslint/bun-test tails are mostly
+ * file:line. Collapsing those made two DIFFERENT defects in one file — the second
+ * uncovered by fixing the first — compare equal, which reads as non-progress and
+ * demotes a genuinely fixable check to UNOBSERVED debt. A moved error is progress.
+ */
+const BARE_PORT = /(\S*?):(\d{2,5})\b/g;
+/** A path (has a separator) or a filename with an extension ⇒ a source location. */
+const SOURCE_LOCATION = /[/\\]|\.[a-z][a-z0-9]{0,4}$/;
+function collapseBarePorts(s) {
+    return s.replace(BARE_PORT, (whole, prefix) => SOURCE_LOCATION.test(prefix) ? whole : `${prefix}:<port>`);
+}
 /**
  * Comparison key for a gate failure entry: lowercased, volatile substrings erased,
  * whitespace collapsed. Two entries with the same key are "the same failure" for
@@ -66,6 +82,7 @@ export function normalizeFailureDetail(detail) {
     let s = detail.toLowerCase();
     for (const [re, repl] of VOLATILE)
         s = s.replace(re, repl);
+    s = collapseBarePorts(s);
     return s.replace(/\s+/g, ' ').trim();
 }
 /** The ranked-first failure of a gate outcome (the list is ranked most load-bearing

package/dist/task/resume-gap.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Resume gating & the honest resume banner.
+ *
+ * mx5 run 14 lost ~10 hours to dead air that looked like a stall: the host was
+ * powered off overnight, both containers stopped at 20:00Z, and the run picked
+ * up cleanly the moment they were restarted at 06:01Z. Nothing was wrong with
+ * the run — the only defect was that nobody could tell. Two things follow.
+ *
+ * (1) A restart-time resume can be automated (`restart: unless-stopped` on the
+ * containers plus a boot hook that runs `/task-auto-resume --unattended`), which
+ * turns that 10h of nothing into minutes.
+ *
+ * (2) An automated resume must not resume everything. `RESUMABLE_STATES`
+ * deliberately includes `failed` and `cancelled` because a HUMAN typing
+ * /task-auto-resume has decided to continue; a boot hook has decided nothing. A
+ * failed run stopped for a reason a power cycle does not clear, and re-entering
+ * it unattended burns the whole loop against the same wall. Unattended resume
+ * therefore covers in-flight states only (see UNATTENDED_STATES), and refuses
+ * the rest by name rather than silently doing nothing.
+ *
+ * The banner follows the honest-restart-hint rule (70a8497): say exactly what
+ * was observed and exactly what it does not tell you. All this process knows is
+ * when the AUTO file was last written — it cannot distinguish a stopped host
+ * from a hung child from a slow task, so it reports the gap and attributes no
+ * cause. It is equally careful about the tree: nothing is rolled back between
+ * the interruption and the resume.
+ */
+import type { TaskState } from './task-types.js';
+/** States an UNATTENDED resume may continue. In-flight only — see file header. */
+export declare const UNATTENDED_STATES: TaskState[];
+/** The most recent resumable AUTO run, with the two facts the banner needs. */
+export interface AutoResumeCandidate {
+    id: string;
+    state: TaskState;
+    /** AUTO-file mtime: the last moment the run demonstrably wrote progress. */
+    lastWriteMs: number;
+}
+export interface ResumeDecision {
+    /** Whether the caller should proceed with the resume. */
+    resume: boolean;
+    /** The line to show the user (and publish to the remote view). */
+    banner: string;
+    level: 'info' | 'warning';
+}
+/** Human gap, coarsest-two-units ("10h 1m", "45s", "2d 4h"). */
+export declare function formatGap(ms: number): string;
+/**
+ * Gate an incoming resume and phrase it. Pure: the caller supplies the candidate
+ * and the clock. `unattended` is the boot-hook path (`--unattended`), which is
+ * the only one that refuses on state.
+ */
+export declare function decideResume(candidate: AutoResumeCandidate | null, nowMs: number, unattended: boolean): ResumeDecision;

package/dist/task/resume-gap.js

@@ -0,0 +1,67 @@
+/** States an UNATTENDED resume may continue. In-flight only — see file header. */
+export const UNATTENDED_STATES = ['in_progress'];
+/**
+ * Below this the gap is ordinary hand-driven latency (you looked at the failure,
+ * then typed the command) and the unaccounted-time paragraph would be noise.
+ */
+const GAP_NARRATION_MS = 5 * 60_000;
+/** Human gap, coarsest-two-units ("10h 1m", "45s", "2d 4h"). */
+export function formatGap(ms) {
+    const s = Math.floor(ms / 1000);
+    if (s < 60)
+        return `${s}s`;
+    const m = Math.floor(s / 60);
+    if (m < 60)
+        return s % 60 === 0 ? `${m}m` : `${m}m ${s % 60}s`;
+    const h = Math.floor(m / 60);
+    if (h < 24)
+        return m % 60 === 0 ? `${h}h` : `${h}h ${m % 60}m`;
+    const d = Math.floor(h / 24);
+    return h % 24 === 0 ? `${d}d` : `${d}d ${h % 24}h`;
+}
+/**
+ * What the resume says about the time it was away. Attributes no cause: a gap
+ * is wall-clock silence, and this process cannot see which of the several very
+ * different explanations produced it.
+ */
+function gapClause(lastWriteMs, nowMs) {
+    const gap = nowMs - lastWriteMs;
+    const at = new Date(lastWriteMs).toISOString();
+    // A future mtime means the clock moved, not that the run wrote ahead of
+    // time; saying "0s ago" there would be the one thing this banner must not do.
+    if (gap < -60_000) {
+        return `its file is timestamped ${at}, which is in the future — the clock moved under it, so no gap can be measured`;
+    }
+    const shown = formatGap(Math.max(0, gap));
+    if (gap < GAP_NARRATION_MS)
+        return `last written ${shown} ago (${at})`;
+    return (`last written ${shown} ago (${at}). That gap is unaccounted-for wall time, not work: `
+        + `this process cannot tell a stopped host from a hung child from a slow task. `
+        + `Nothing was rolled back — the working tree is exactly as the interrupted run left it`);
+}
+/**
+ * Gate an incoming resume and phrase it. Pure: the caller supplies the candidate
+ * and the clock. `unattended` is the boot-hook path (`--unattended`), which is
+ * the only one that refuses on state.
+ */
+export function decideResume(candidate, nowMs, unattended) {
+    if (!candidate) {
+        return { resume: false, banner: 'No resumable /task-auto run.', level: 'info' };
+    }
+    const { id, state, lastWriteMs } = candidate;
+    if (unattended && !UNATTENDED_STATES.includes(state)) {
+        return {
+            resume: false,
+            banner: `Not auto-resuming ${id}: state=${state}. Unattended resume continues `
+                + `in-flight runs (${UNATTENDED_STATES.join(', ')}) only — a ${state} run stopped `
+                + `for a reason a restart does not clear. Look at it, then resume by hand with `
+                + `/task-auto-resume.`,
+            level: 'warning'
+        };
+    }
+    return {
+        resume: true,
+        banner: `Resuming ${id} (state=${state}) — ${gapClause(lastWriteMs, nowMs)}.`,
+        level: 'info'
+    };
+}

package/dist/task/stream-watchdog.js

@@ -68,16 +68,22 @@ export function registerStreamWatchdog(pi) {
     pi.on('message_start', (_e, ctx) => arm(ctx));
     pi.on('message_update', (_e, ctx) => arm(ctx));
     pi.on('message_end', (_e, ctx) => arm(ctx));
-    pi.on('tool_execution_start', (_e, ctx) => {
+    // Keyed by toolCallId: a tool BATCH runs in parallel, so the clock must stay
+    // paused until the last call settles, not the first (see StreamWatchdog.resume).
+    const callId = (e) => {
+        const id = e?.toolCallId;
+        return typeof id === 'string' && id.length > 0 ? id : undefined;
+    };
+    pi.on('tool_execution_start', (e, ctx) => {
         liveCtx = ctx;
-        watchdog.suspend();
+        watchdog.suspend(callId(e));
     });
     pi.on('tool_execution_update', (_e, ctx) => {
         liveCtx = ctx;
     });
-    pi.on('tool_execution_end', (_e, ctx) => {
+    pi.on('tool_execution_end', (e, ctx) => {
         liveCtx = ctx;
-        watchdog.resume();
+        watchdog.resume(callId(e));
     });
     // Nothing is streaming between agent loops; stop so no timer can fire into an
     // idle session (which would abort nothing and post a reminder to no one).

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@mjasnikovs/pi-task",
-    "version": "0.18.41",
+    "version": "0.18.43",
     "description": "Deterministic task planning and spec-orchestration for local models — crash-safe /task pipelines with verify/enforce gates, a real-time remote web view, and web/docs/fetch/worker subagent tools.",
     "type": "module",
     "main": "./dist/index.js",