@mjasnikovs/pi-task 0.24.1 → 0.24.3

package/dist/shared/child-process.d.ts

@@ -165,6 +165,16 @@ export declare class JsonEventSink {
      * model/provider failed (disconnect, fetch failed, socket hang up, 5xx)
      * after pi exhausted its internal retries. Holds the provider's errorMessage
      * so callers can report the real cause instead of an empty completion.
+     *
+     * CLEARED when a LATER agent_end delivers assistant text: pi retries a failed
+     * turn itself (`auto_retry_start`) and each attempt emits its own agent_end,
+     * so a recovered blip arrives as agent_end(stopReason "error", empty) followed
+     * by agent_end(text). Measured live against a proxy that drops the first
+     * connection: pi makes up to 4 attempts over ~15s, and on attempts 1–3 the
+     * child returns the real answer WITH the dead first attempt's errorMessage
+     * still in the stream. Latching that would report a failure for a run that
+     * succeeded. An error AFTER the last text-bearing turn still latches — that
+     * one really did lose the tail of the work.
      */
     modelError: string | undefined;
     private textDeltaAccum;

package/dist/shared/child-process.js

@@ -30,6 +30,16 @@ export class JsonEventSink {
      * model/provider failed (disconnect, fetch failed, socket hang up, 5xx)
      * after pi exhausted its internal retries. Holds the provider's errorMessage
      * so callers can report the real cause instead of an empty completion.
+     *
+     * CLEARED when a LATER agent_end delivers assistant text: pi retries a failed
+     * turn itself (`auto_retry_start`) and each attempt emits its own agent_end,
+     * so a recovered blip arrives as agent_end(stopReason "error", empty) followed
+     * by agent_end(text). Measured live against a proxy that drops the first
+     * connection: pi makes up to 4 attempts over ~15s, and on attempts 1–3 the
+     * child returns the real answer WITH the dead first attempt's errorMessage
+     * still in the stream. Latching that would report a failure for a run that
+     * succeeded. An error AFTER the last text-bearing turn still latches — that
+     * one really did lose the tail of the work.
      */
     modelError = undefined;
     textDeltaAccum = '';
@@ -103,6 +113,10 @@ export class JsonEventSink {
             return;
         }
         if (t === 'agent_end' && Array.isArray(evt.messages)) {
+            // Errors latched by THIS batch describe a turn that failed AFTER the
+            // text found below it (the scan runs backwards), so they survive; only
+            // an error from an earlier agent_end is cleared by a later answer.
+            let latchedHere = false;
             for (let i = evt.messages.length - 1; i >= 0; i--) {
                 const m = evt.messages[i];
                 if (!m || m.role !== 'assistant')
@@ -117,6 +131,7 @@ export class JsonEventSink {
                     && m.errorMessage.length > 0
                     && this.modelError === undefined) {
                     this.modelError = m.errorMessage;
+                    latchedHere = true;
                 }
                 if (Array.isArray(m.content)) {
                     const texts = [];
@@ -127,6 +142,10 @@ export class JsonEventSink {
                     }
                     if (texts.length > 0) {
                         this.finalText = texts.join('');
+                        // This turn answered, so an error latched by an EARLIER
+                        // agent_end was a blip pi retried past — drop it.
+                        if (!latchedHere)
+                            this.modelError = undefined;
                         break;
                     }
                 }

package/dist/shared/command-watchdog.d.ts

@@ -96,8 +96,14 @@ export declare class CommandWatchdog {
     private fire;
 }
 /**
- * Real-clock schedule/cancel, unref'd so a pending watchdog timer can never
- * itself keep the process alive on exit. Shared by both adapters; tests
- * substitute a fake scheduler instead.
+ * Real-clock schedule/cancel. Shared by both adapters; tests substitute a fake
+ * scheduler instead.
+ *
+ * REF'd, for the same measured reason as the stream watchdog's poll (see
+ * realStreamTimerDeps): under Bun on windows an unref'd timer never fires once
+ * nothing ref'd is pending, and a child sitting in a hung command is exactly
+ * that state — so the unref disabled the guard in the one case it exists for.
+ * The timer is cleared when the tool ends and in runWorker's `finally`, so it
+ * cannot outlive the call it watches.
  */
 export declare const realTimerDeps: Pick<WatchdogDeps, 'schedule' | 'cancel'>;

package/dist/shared/command-watchdog.js

@@ -141,18 +141,17 @@ export class CommandWatchdog {
     }
 }
 /**
- * Real-clock schedule/cancel, unref'd so a pending watchdog timer can never
- * itself keep the process alive on exit. Shared by both adapters; tests
- * substitute a fake scheduler instead.
+ * Real-clock schedule/cancel. Shared by both adapters; tests substitute a fake
+ * scheduler instead.
+ *
+ * REF'd, for the same measured reason as the stream watchdog's poll (see
+ * realStreamTimerDeps): under Bun on windows an unref'd timer never fires once
+ * nothing ref'd is pending, and a child sitting in a hung command is exactly
+ * that state — so the unref disabled the guard in the one case it exists for.
+ * The timer is cleared when the tool ends and in runWorker's `finally`, so it
+ * cannot outlive the call it watches.
  */
 export const realTimerDeps = {
-    schedule: (fn, ms) => {
-        const handle = setTimeout(fn, ms);
-        if (typeof handle.unref === 'function') {
-            ;
-            handle.unref();
-        }
-        return handle;
-    },
+    schedule: (fn, ms) => setTimeout(fn, ms),
     cancel: handle => clearTimeout(handle)
 };

package/dist/shared/stream-watchdog.d.ts

@@ -103,9 +103,23 @@ export declare class StreamWatchdog {
     check(): void;
 }
 /**
- * Real-clock poll deps, unref'd so a pending watchdog poll can never itself keep
- * the process alive on exit. `schedule` returns a repeating interval — the
- * machine cancels it on stop/fire.
+ * Real-clock poll deps. `schedule` returns a repeating interval — the machine
+ * cancels it on stop/fire, and runChild's cleanup() stops the watchdog on every
+ * settle path (close, error, abort), so it cannot outlive the child it watches.
+ *
+ * The poll is REF'd, deliberately. It used to be unref'd, on the reasoning that a
+ * pending watchdog poll should never keep the process alive at exit — but under
+ * Bun on WINDOWS an unref'd timer does not fire at all once nothing ref'd is
+ * pending. Measured on a windows-latest runner (bun 1.3.14): an unref'd interval
+ * with nothing else pending never fired in 20s, while the identical ref'd one
+ * fired at 101ms; on linux both fire at 100ms.
+ *
+ * That state — no ref'd work outstanding — is EXACTLY the state this watchdog
+ * exists to police: a child whose model stream has gone silent. So the unref
+ * disabled the guard precisely when it was needed, and every stream-stall
+ * integration test hung forever on windows (CI runs 30476786365, 30477802633,
+ * 30478455402 — it hangs at v0.24.1 too, so this predates that release).
+ * A poll that can delay exit by one interval is the cheaper failure.
  */
 export declare const realStreamTimerDeps: Pick<StreamWatchdogDeps, 'now' | 'schedule' | 'cancel'>;
 /**

package/dist/shared/stream-watchdog.js

@@ -148,20 +148,27 @@ export class StreamWatchdog {
     }
 }
 /**
- * Real-clock poll deps, unref'd so a pending watchdog poll can never itself keep
- * the process alive on exit. `schedule` returns a repeating interval — the
- * machine cancels it on stop/fire.
+ * Real-clock poll deps. `schedule` returns a repeating interval — the machine
+ * cancels it on stop/fire, and runChild's cleanup() stops the watchdog on every
+ * settle path (close, error, abort), so it cannot outlive the child it watches.
+ *
+ * The poll is REF'd, deliberately. It used to be unref'd, on the reasoning that a
+ * pending watchdog poll should never keep the process alive at exit — but under
+ * Bun on WINDOWS an unref'd timer does not fire at all once nothing ref'd is
+ * pending. Measured on a windows-latest runner (bun 1.3.14): an unref'd interval
+ * with nothing else pending never fired in 20s, while the identical ref'd one
+ * fired at 101ms; on linux both fire at 100ms.
+ *
+ * That state — no ref'd work outstanding — is EXACTLY the state this watchdog
+ * exists to police: a child whose model stream has gone silent. So the unref
+ * disabled the guard precisely when it was needed, and every stream-stall
+ * integration test hung forever on windows (CI runs 30476786365, 30477802633,
+ * 30478455402 — it hangs at v0.24.1 too, so this predates that release).
+ * A poll that can delay exit by one interval is the cheaper failure.
  */
 export const realStreamTimerDeps = {
     now: () => Date.now(),
-    schedule: (fn, ms) => {
-        const handle = setInterval(fn, ms);
-        if (typeof handle.unref === 'function') {
-            ;
-            handle.unref();
-        }
-        return handle;
-    },
+    schedule: (fn, ms) => setInterval(fn, ms),
     cancel: handle => clearInterval(handle)
 };
 /**

package/dist/workers/pi-worker-core.d.ts

@@ -86,6 +86,16 @@ export interface RunWorkerInput {
      * 0 / omitted = off.
      */
     streamInactivityMs?: number;
+    /** Backoff sleep, injectable so tests don't wait out the real delays. */
+    sleepFor?: (ms: number) => Promise<void>;
+    /**
+     * Connection-error restart budget. Defaults to MAX_LOOP_RESTARTS, and even
+     * then the SHARED `restarts` counter is what actually binds — a worker that
+     * already spent the budget looping does not get extra lives here. 0 turns the
+     * retry off, which is how scripts/connection-retry-ab.ts gets a baseline arm
+     * out of a build that already ships the retry.
+     */
+    connectionRetries?: number;
 }
 export interface RunWorkerResult {
     text: string;

package/dist/workers/pi-worker-core.js

@@ -3,7 +3,7 @@ import { runChildDefault } from '../shared/child-process.js';
 import { CommandWatchdog, commandTimeoutHint, realTimerDeps } from '../shared/command-watchdog.js';
 import { childBaseArgs } from '../shared/child-extensions.js';
 import { LoopDetector } from '../task/loop-detector.js';
-import { LOOP_WINDOW, LOOP_THRESHOLD, MAX_LOOP_RESTARTS, formatLoopHint } from '../task/child-runner.js';
+import { LOOP_WINDOW, LOOP_THRESHOLD, MAX_LOOP_RESTARTS, formatLoopHint, isConnectionError, connectionRetryBackoffMs } from '../task/child-runner.js';
 import { detectLeakedToolCall, leakedToolCallHint, MAX_LEAK_RETRIES } from '../shared/leaked-tool-call.js';
 import { discoverModelEndpoints, probeModelEndpoints } from '../shared/model-endpoint.js';
 import { streamStallHint } from '../shared/stream-watchdog.js';
@@ -66,6 +66,7 @@ const STALL_AFTER_MS = 180_000;
 const WORKER_TIMEOUT_HINT = '[SYSTEM NOTE: Your previous attempt ran out of time before answering — you '
     + 'were exploring too long. Be decisive: do the minimum reads/greps needed, '
     + 'then write your answer now. Do not re-explore ground you have already covered.]';
+const defaultSleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));
 /**
  * Combine an external abort signal with an internal wall-clock timeout into one
  * signal, while keeping the two causes distinguishable: `timedOut()` is true
@@ -192,6 +193,9 @@ export async function runWorker(input) {
     // `restarts` (the shared budget) so a loop-caused restart doesn't shorten
     // the rope of a child that has never hung (see commandCeilingForAttempt).
     let hangKills = 0;
+    // Connection-error restarts specifically — drives the backoff schedule (and
+    // lets a harness set the budget to 0 without touching the shared counter).
+    let connRetries = 0;
     let leakRetries = 0;
     for (;;) {
         const prompt = hint === null ? input.prompt : `${hint}\n\n${input.prompt}`;
@@ -315,6 +319,36 @@ export async function runWorker(input) {
             restarts++;
             continue;
         }
+        // A connection-class model error is restartable on the same budget, exactly
+        // as runPhaseWithLoopGuard already treats it — a research worker had no such
+        // retry, so one dropped fetch failed the whole task at research while the
+        // identical blip in refine/compose was absorbed.
+        //
+        // What this can and cannot buy, measured (flaky proxy in front of the local
+        // llama-server, dropping every connection for a fixed outage window): pi
+        // retries a failed turn itself, 4 attempts over ~15s, and a run that
+        // recovers no longer reports modelError at all (see JsonEventSink). So a
+        // surfaced connection error means pi's own ~15s budget is already spent, and
+        // a re-spawn only helps when the outage outlasts it. It does: at a 20s
+        // outage the baseline never recovered and this policy always did, 0/8 → 8/8
+        // (Fisher p=0.00016), and the same at 35s. Below ~15s pi absorbs it alone —
+        // 8/8 both arms, so the retry neither helps nor costs there. Beyond ~46s
+        // (three spawns' combined budget) both arms fail. The price is paid only on
+        // a backend that is really gone: time-to-report goes ~15s → ~46s. Re-run:
+        // scripts/connection-retry-ab.ts.
+        //
+        // Connection class ONLY. Auth, bad request and context overflow still fail
+        // fast: re-issuing the same request cannot fix them, so spending the budget
+        // would only delay the report.
+        if (result.modelError
+            && isConnectionError(result.modelError)
+            && restarts < MAX_LOOP_RESTARTS
+            && connRetries < (input.connectionRetries ?? MAX_LOOP_RESTARTS)) {
+            await (input.sleepFor ?? defaultSleep)(connectionRetryBackoffMs(connRetries));
+            restarts++;
+            connRetries++;
+            continue;
+        }
         // Only treat output as a leak on a clean, complete run — a non-zero exit
         // or abort yields partial text the caller already handles, and detecting
         // there would just mislabel the real failure.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@mjasnikovs/pi-task",
-    "version": "0.24.1",
+    "version": "0.24.3",
     "description": "Deterministic task planning and spec-orchestration for local models — crash-safe /task pipelines with verify/enforce gates, a real-time remote web view, and web/docs/fetch/worker subagent tools.",
     "type": "module",
     "main": "./dist/index.js",