@mjasnikovs/pi-task 0.7.1 → 0.7.3

package/README.md

@@ -1,13 +1,15 @@
 <div align="center">
 
-# 🧩 pi-task
+<img src="./assets/pipeline.svg" alt="pi-task pipeline: a /task request runs through refine, research, grill, compose and critique, then the final spec is delivered to your main pi session in the same chat. Every phase boundary is persisted to .pi-tasks/TASK_NNNN.md, so the task is crash-safe and resumable." width="820"/>
+
+# <img src="./assets/pi-logo.svg" alt="" height="30" align="top"/> pi-task
 
 **Deterministic spec-orchestration for local models — with bundled web, docs, fetch, and worker sub-agent tools.**
 
 [![npm](https://img.shields.io/npm/v/@mjasnikovs/pi-task?color=cb3837&logo=npm)](https://www.npmjs.com/package/@mjasnikovs/pi-task)
 [![license](https://img.shields.io/badge/license-MIT-blue.svg)](./LICENSE)
 [![pi extension](https://img.shields.io/badge/pi-extension-7c3aed)](https://www.npmjs.com/package/@earendil-works/pi-coding-agent)
-[![tests](https://img.shields.io/badge/tests-533%20passing-3fb950)](#development)
+[![tests](https://img.shields.io/badge/tests-559%20passing-3fb950)](#development)
 [![types](https://img.shields.io/badge/TypeScript-strict-3178c6?logo=typescript&logoColor=white)](./tsconfig.json)
 
 </div>
@@ -16,24 +18,7 @@
 
 ## What it does
 
-Local models drift. Ask one to plan a non-trivial change and it skips context, hallucinates APIs, and forgets what you actually asked. `pi-task` fixes this by **not trusting a single prompt** — it drives your request through a fixed, persisted pipeline of small, verifiable steps, then hands the main session a clean spec to execute.
-
-```
-/task add rate-limiting to the public API
-        │
-        ▼
-  ┌──────────┐   ┌──────────┐   ┌──────────┐   ┌──────────┐   ┌──────────┐
-  │  refine  │──▶│ research │──▶│  grill   │──▶│ compose  │──▶│ critique │
-  └──────────┘   └──────────┘   └──────────┘   └──────────┘   └──────────┘
-   sharpen the    parallel        clarifying     assemble        triage +
-   raw prompt     sub-agents:     questions      the spec        rewrite if
-                  files · APIs ·  (auto- or                      the draft
-                  context ·       you answer)                    isn't clean
-                  tooling
-        │
-        ▼
-  final spec ──▶ main pi session   (you keep working in the same chat)
-```
+Local models drift. Ask one to plan a non-trivial change and it skips context, hallucinates APIs, and forgets what you actually asked. `pi-task` fixes this by **not trusting a single prompt** — it drives your request through a fixed, persisted pipeline of small, verifiable steps (shown above), then hands the main session a clean spec to execute.
 
 Every phase boundary is written to `.pi-tasks/TASK_NNNN.md`, so a task survives a crash, a restart, or a `/task-cancel` — pick it back up with `/task-resume`.
 
@@ -51,7 +36,7 @@ Every phase boundary is written to `.pi-tasks/TASK_NNNN.md`, so a task survives
 pi install npm:@mjasnikovs/pi-task
 ```
 
-> Requires [`pi`](https://www.npmjs.com/package/@earendil-works/pi-coding-agent) (the Earendil coding agent) ≥ 0.75.
+> Requires [`pi`](https://www.npmjs.com/package/@earendil-works/pi-coding-agent) (the Earendil coding agent) ≥ 0.78.
 
 ## Slash commands
 
@@ -82,22 +67,11 @@ The finished spec is delivered to your main `pi` conversation via `sendUserMessa
 
 A real feature is usually several tasks, not one. `/task-auto` is a thin planner on top of the single-task pipeline:
 
-```
-/task-auto add multi-tenant billing
-        │
-        ▼
-  ┌──────────┐   ┌──────────┐   ┌─────────────┐
-  │ clarify  │──▶│ decompose│──▶│ TASK_AUTO_…  │   resumable list of task titles
-  │ gray     │   │ → titles │   │ .md (titles) │
-  │ areas    │   └──────────┘   └──────┬───────┘
-  └──────────┘                         │
-                          ┌────────────▼─────────────┐
-                          │  for each unchecked title │
-                          │   → full /task pipeline    │  (spec + implement)
-                          │   → wait until it finishes │
-                          │   → check the box, next    │
-                          └────────────────────────────┘
-```
+<div align="center">
+
+<img src="./assets/task-auto.svg" alt="/task-auto plans a feature: it clarifies the gray areas, decomposes the answers into an ordered list of task titles written to TASK_AUTO_NNNN.md, then runs each unchecked title through the full /task pipeline one at a time, ticking the box before moving on." width="820"/>
+
+</div>
 
 - **It only produces titles.** All the depth — refine, research, grill, compose, critique — is `/task`'s job, run fresh per title. `/task-auto` never researches or specs anything itself.
 - **Clarify first.** It asks the few clarifying questions whose answers change how the feature splits, then decomposes the answers into an ordered list of task titles written to `.pi-tasks/TASK_AUTO_NNNN.md`.
@@ -149,9 +123,9 @@ Runs a Brave Search query and returns a compact markdown list (title · URL · s
 > **Requires** `BRAVE_SEARCH_API_KEY` (also accepted as `BRAVE_API_KEY`). Grab a free key at [api.search.brave.com/app/keys](https://api.search.brave.com/app/keys).
 
 ### `pi-worker-fetch`
-Fetches a URL, cleans the HTML to markdown ([Readability](https://github.com/mozilla/readability) + [Turndown](https://github.com/mixmark-io/turndown)), then hands it to an isolated child that extracts **only** the content answering your `query`. The parent never sees the raw page.
+Fetches a URL, cleans HTML to markdown ([Readability](https://github.com/mozilla/readability) + [Turndown](https://github.com/mixmark-io/turndown)), then hands it to an isolated child that extracts **only** the content answering your `query`. The parent never sees the raw page.
 
-- Only `text/html` responses — PDFs, JSON, etc. return a clear error.
+- HTML is cleaned; text formats (plain text, markdown, JSON, XML/feeds, `llms.txt`, …) pass through verbatim. Binary responses — PDFs, images, octet-streams — return a clear error.
 - Bodies over 2 MB are rejected.
 - The extraction child runs with `--no-tools` to mitigate visible-text prompt injection.
 
@@ -179,7 +153,7 @@ Tasks are persisted to `<cwd>/.pi-tasks/TASK_NNNN.md`. Add `.pi-tasks/` to your
 
 ```sh
 bun install
-bun test src/      # 533 tests across 45 files
+bun test src/      # 559 tests across 46 files
 bun run lint       # prettier + eslint + tsc --noEmit
 bun run build      # tsc → dist/
 ```

package/assets/pi-logo.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 180 180" width="180" height="180" role="img" aria-label="pi-task logo">
+  <rect width="180" height="180" rx="38" fill="#1e1e2e"/>
+  <text x="90" y="130" font-family="Georgia, serif" font-size="100" text-anchor="middle" fill="#cba6f7">π</text>
+</svg>

package/assets/pipeline.svg

@@ -0,0 +1,90 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 900 396" width="900" height="396" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif" role="img" aria-label="pi-task pipeline: a /task request runs through refine, research, grill, compose and critique phases, then the final spec is delivered to your main pi session in the same chat. Every phase boundary is persisted to .pi-tasks/TASK_NNNN.md, so the task is crash-safe and resumable.">
+  <defs>
+    <marker id="ah" viewBox="0 0 10 10" refX="8.5" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
+      <path d="M0,0 L10,5 L0,10 z" fill="#6e7681"/>
+    </marker>
+    <style>
+      .title  { font-size:17px; font-weight:600; fill:#e6edf3; }
+      .cap    { font-size:11.5px; fill:#8b949e; }
+      .num    { font-size:11px; font-weight:700; }
+      .code   { font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace; }
+      .foot   { font-size:11.5px; fill:#768390; font-style:italic; }
+    </style>
+  </defs>
+
+  <rect x="6" y="6" width="888" height="384" rx="16" fill="#0d1117" stroke="#30363d" stroke-width="1.5"/>
+
+  <!-- input -->
+  <rect x="220" y="32" width="460" height="38" rx="19" fill="#161b22" stroke="#7c3aed" stroke-width="1.5"/>
+  <text x="450" y="57" text-anchor="middle" class="code" font-size="14"><tspan fill="#a371f7" font-weight="700">/task</tspan><tspan fill="#c9d1d9" dx="7">add rate-limiting to the public API</tspan></text>
+  <line x1="450" y1="70" x2="450" y2="106" stroke="#6e7681" stroke-width="1.5" marker-end="url(#ah)"/>
+
+  <!-- phase row -->
+  <!-- refine -->
+  <g>
+    <rect x="32" y="118" width="150" height="72" rx="10" fill="#161b22" stroke="#30363d"/>
+    <rect x="32" y="118" width="5" height="72" rx="2.5" fill="#58a6ff"/>
+    <text x="50" y="138" class="num" fill="#58a6ff">1</text>
+    <text x="107" y="161" text-anchor="middle" class="title">refine</text>
+  </g>
+  <text x="107" y="210" text-anchor="middle" class="cap">sharpen the</text>
+  <text x="107" y="225" text-anchor="middle" class="cap">raw prompt</text>
+
+  <!-- research -->
+  <g>
+    <rect x="203.5" y="118" width="150" height="72" rx="10" fill="#161b22" stroke="#30363d"/>
+    <rect x="203.5" y="118" width="5" height="72" rx="2.5" fill="#39c5cf"/>
+    <text x="221.5" y="138" class="num" fill="#39c5cf">2</text>
+    <text x="278.5" y="161" text-anchor="middle" class="title">research</text>
+  </g>
+  <text x="278.5" y="210" text-anchor="middle" class="cap">parallel sub-agents:</text>
+  <text x="278.5" y="225" text-anchor="middle" class="cap">files · APIs ·</text>
+  <text x="278.5" y="240" text-anchor="middle" class="cap">context · tooling</text>
+
+  <!-- grill -->
+  <g>
+    <rect x="375" y="118" width="150" height="72" rx="10" fill="#161b22" stroke="#30363d"/>
+    <rect x="375" y="118" width="5" height="72" rx="2.5" fill="#d29922"/>
+    <text x="393" y="138" class="num" fill="#d29922">3</text>
+    <text x="450" y="161" text-anchor="middle" class="title">grill</text>
+  </g>
+  <text x="450" y="210" text-anchor="middle" class="cap">clarifying Q&amp;A</text>
+  <text x="450" y="225" text-anchor="middle" class="cap">(auto, or you answer)</text>
+
+  <!-- compose -->
+  <g>
+    <rect x="546.5" y="118" width="150" height="72" rx="10" fill="#161b22" stroke="#30363d"/>
+    <rect x="546.5" y="118" width="5" height="72" rx="2.5" fill="#3fb950"/>
+    <text x="564.5" y="138" class="num" fill="#3fb950">4</text>
+    <text x="621.5" y="161" text-anchor="middle" class="title">compose</text>
+  </g>
+  <text x="621.5" y="210" text-anchor="middle" class="cap">assemble</text>
+  <text x="621.5" y="225" text-anchor="middle" class="cap">the spec</text>
+
+  <!-- critique -->
+  <g>
+    <rect x="718" y="118" width="150" height="72" rx="10" fill="#161b22" stroke="#30363d"/>
+    <rect x="718" y="118" width="5" height="72" rx="2.5" fill="#a371f7"/>
+    <text x="736" y="138" class="num" fill="#a371f7">5</text>
+    <text x="793" y="161" text-anchor="middle" class="title">critique</text>
+  </g>
+  <text x="793" y="210" text-anchor="middle" class="cap">triage, rewrite</text>
+  <text x="793" y="225" text-anchor="middle" class="cap">if not clean</text>
+
+  <!-- inter-phase arrows -->
+  <line x1="182"   y1="154" x2="201.5" y2="154" stroke="#6e7681" stroke-width="1.5" marker-end="url(#ah)"/>
+  <line x1="353.5" y1="154" x2="373"   y2="154" stroke="#6e7681" stroke-width="1.5" marker-end="url(#ah)"/>
+  <line x1="525"   y1="154" x2="544.5" y2="154" stroke="#6e7681" stroke-width="1.5" marker-end="url(#ah)"/>
+  <line x1="696.5" y1="154" x2="716"   y2="154" stroke="#6e7681" stroke-width="1.5" marker-end="url(#ah)"/>
+
+  <!-- to result -->
+  <line x1="450" y1="252" x2="450" y2="292" stroke="#6e7681" stroke-width="1.5" marker-end="url(#ah)"/>
+
+  <!-- result -->
+  <rect x="120" y="296" width="660" height="48" rx="12" fill="#0f261a" stroke="#2ea043" stroke-width="1.5"/>
+  <text x="450" y="318" text-anchor="middle" font-size="14" font-weight="600" fill="#e6edf3">final spec  →  delivered to your main <tspan class="code" fill="#7ee787">pi</tspan> session</text>
+  <text x="450" y="334" text-anchor="middle" class="cap">same chat — no handoff, no copy-paste</text>
+
+  <!-- footnote -->
+  <text x="450" y="372" text-anchor="middle" class="foot">every phase boundary is persisted to <tspan class="code" font-style="normal">.pi-tasks/TASK_NNNN.md</tspan> — crash-safe &amp; resumable</text>
+</svg>

package/assets/task-auto.svg

@@ -0,0 +1,65 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 900 332" width="900" height="332" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif" role="img" aria-label="/task-auto plans a feature: it clarifies the gray areas, decomposes the answers into an ordered list of task titles written to TASK_AUTO_NNNN.md, then runs each unchecked title through the full /task pipeline one at a time, ticking the box before moving on.">
+  <defs>
+    <marker id="ah2" viewBox="0 0 10 10" refX="8.5" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
+      <path d="M0,0 L10,5 L0,10 z" fill="#6e7681"/>
+    </marker>
+    <style>
+      .title  { font-size:17px; font-weight:600; fill:#e6edf3; }
+      .titlec { font-size:15px; font-weight:600; fill:#e6edf3; font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace; }
+      .cap    { font-size:11.5px; fill:#8b949e; }
+      .num    { font-size:11px; font-weight:700; }
+      .code   { font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace; }
+    </style>
+  </defs>
+
+  <rect x="6" y="6" width="888" height="320" rx="16" fill="#0d1117" stroke="#30363d" stroke-width="1.5"/>
+
+  <!-- input -->
+  <rect x="240" y="30" width="420" height="38" rx="19" fill="#161b22" stroke="#7c3aed" stroke-width="1.5"/>
+  <text x="450" y="55" text-anchor="middle" class="code" font-size="14"><tspan fill="#a371f7" font-weight="700">/task-auto</tspan><tspan fill="#c9d1d9" dx="7">add multi-tenant billing</tspan></text>
+  <line x1="450" y1="68" x2="450" y2="100" stroke="#6e7681" stroke-width="1.5" marker-end="url(#ah2)"/>
+
+  <!-- clarify -->
+  <g>
+    <rect x="32" y="110" width="200" height="72" rx="10" fill="#161b22" stroke="#30363d"/>
+    <rect x="32" y="110" width="5" height="72" rx="2.5" fill="#d29922"/>
+    <text x="50" y="130" class="num" fill="#d29922">1</text>
+    <text x="132" y="153" text-anchor="middle" class="title">clarify gray areas</text>
+  </g>
+  <text x="132" y="202" text-anchor="middle" class="cap">ask only what</text>
+  <text x="132" y="217" text-anchor="middle" class="cap">changes the split</text>
+
+  <!-- decompose -->
+  <g>
+    <rect x="350" y="110" width="200" height="72" rx="10" fill="#161b22" stroke="#30363d"/>
+    <rect x="350" y="110" width="5" height="72" rx="2.5" fill="#58a6ff"/>
+    <text x="368" y="130" class="num" fill="#58a6ff">2</text>
+    <text x="450" y="153" text-anchor="middle" class="title">decompose → titles</text>
+  </g>
+  <text x="450" y="202" text-anchor="middle" class="cap">ordered list of</text>
+  <text x="450" y="217" text-anchor="middle" class="cap">task titles only</text>
+
+  <!-- file -->
+  <g>
+    <rect x="668" y="110" width="200" height="72" rx="10" fill="#161b22" stroke="#30363d"/>
+    <rect x="668" y="110" width="5" height="72" rx="2.5" fill="#3fb950"/>
+    <text x="686" y="130" class="num" fill="#3fb950">3</text>
+    <text x="768" y="154" text-anchor="middle" class="titlec">TASK_AUTO_NNNN.md</text>
+  </g>
+  <text x="768" y="202" text-anchor="middle" class="cap">resumable checklist</text>
+  <text x="768" y="217" text-anchor="middle" class="cap">of titles</text>
+
+  <!-- arrows between -->
+  <line x1="232" y1="146" x2="348" y2="146" stroke="#6e7681" stroke-width="1.5" marker-end="url(#ah2)"/>
+  <line x1="550" y1="146" x2="666" y2="146" stroke="#6e7681" stroke-width="1.5" marker-end="url(#ah2)"/>
+
+  <!-- to loop -->
+  <line x1="768" y1="227" x2="768" y2="248" stroke="#6e7681" stroke-width="1.5"/>
+  <path d="M768,248 H450 V248" fill="none" stroke="#6e7681" stroke-width="1.5"/>
+  <line x1="450" y1="244" x2="450" y2="252" stroke="#6e7681" stroke-width="1.5" marker-end="url(#ah2)"/>
+
+  <!-- loop -->
+  <rect x="120" y="256" width="660" height="54" rx="12" fill="#0d1117" stroke="#a371f7" stroke-width="1.5"/>
+  <text x="450" y="278" text-anchor="middle" font-size="14" font-weight="600" fill="#e6edf3">↻  for each unchecked title</text>
+  <text x="450" y="296" text-anchor="middle" class="cap">run the full <tspan class="code" fill="#a371f7">/task</tspan> pipeline  →  implement  →  wait until done  →  tick the box  →  next</text>
+</svg>

package/dist/shared/leaked-tool-call.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Detect tool calls that leaked into a child's assistant *text* instead of
+ * being executed.
+ *
+ * Background: every child pi runs under `--mode json`; pi-task only ever treats
+ * a structured `tool_execution_start` event as a tool call (see
+ * shared/child-process.ts). When a local model emits a call in a markup dialect
+ * pi's harness doesn't recognise — e.g.
+ *
+ *     <tool_call>
+ *     <function=bash>
+ *     <parameter=command>grep …</parameter>
+ *     </function>
+ *     </tool_call>
+ *
+ * pi passes the raw markup through as ordinary assistant text. The command never
+ * runs, no event fires, and pi-task's guards (loop detector, widget) never see
+ * it. The phase then "passes" on its only gates (non-empty text + exit 0) and
+ * the unexecuted call flows downstream — a silently skipped beat.
+ *
+ * This is fundamentally an upstream mismatch (model output format ↔ pi's parser)
+ * that pi-task cannot fix. What it CAN do is notice the leaked markup and refuse
+ * to accept the turn, so the skip becomes visible instead of silent.
+ */
+export declare const MAX_LEAK_RETRIES = 2;
+/**
+ * Return the offending marker string if `text` contains a leaked tool call, or
+ * null if it looks clean. The marker is suitable for logging and for naming the
+ * problem back to the model in a re-prompt hint.
+ */
+export declare function detectLeakedToolCall(text: string): string | null;
+/**
+ * A correction hint to prepend to a re-spawn after a leak, naming the offending
+ * markup so the model stops repeating that exact mistake.
+ */
+export declare function leakedToolCallHint(marker: string): string;

package/dist/shared/leaked-tool-call.js

@@ -0,0 +1,60 @@
+/**
+ * Detect tool calls that leaked into a child's assistant *text* instead of
+ * being executed.
+ *
+ * Background: every child pi runs under `--mode json`; pi-task only ever treats
+ * a structured `tool_execution_start` event as a tool call (see
+ * shared/child-process.ts). When a local model emits a call in a markup dialect
+ * pi's harness doesn't recognise — e.g.
+ *
+ *     <tool_call>
+ *     <function=bash>
+ *     <parameter=command>grep …</parameter>
+ *     </function>
+ *     </tool_call>
+ *
+ * pi passes the raw markup through as ordinary assistant text. The command never
+ * runs, no event fires, and pi-task's guards (loop detector, widget) never see
+ * it. The phase then "passes" on its only gates (non-empty text + exit 0) and
+ * the unexecuted call flows downstream — a silently skipped beat.
+ *
+ * This is fundamentally an upstream mismatch (model output format ↔ pi's parser)
+ * that pi-task cannot fix. What it CAN do is notice the leaked markup and refuse
+ * to accept the turn, so the skip becomes visible instead of silent.
+ */
+// A child that wrote a tool call as plain text (wrong dialect, never executed)
+// gets re-prompted with a correction hint up to this many times before the
+// caller gives up. Mirrors MAX_LOOP_RESTARTS: 3 attempts total.
+export const MAX_LEAK_RETRIES = 2;
+// The Hermes-style wrapper a leaked call is most often wrapped in. pi-task never
+// legitimately emits this tag, so its presence alone is a confident signal.
+const TOOL_CALL_WRAPPER = /<tool_call\b[^>]*>/i;
+// The "XML function call" dialect: <function=name> … <parameter=key>. Either tag
+// alone is too weak (a stray "<function=x>" can appear in prose or source), so we
+// require the structural pair before flagging it.
+const FUNCTION_TAG = /<function=[\w.-]+\s*>/i;
+const PARAMETER_TAG = /<parameter=[\w.-]+\s*>/i;
+/**
+ * Return the offending marker string if `text` contains a leaked tool call, or
+ * null if it looks clean. The marker is suitable for logging and for naming the
+ * problem back to the model in a re-prompt hint.
+ */
+export function detectLeakedToolCall(text) {
+    const wrapper = TOOL_CALL_WRAPPER.exec(text);
+    if (wrapper)
+        return wrapper[0];
+    const fn = FUNCTION_TAG.exec(text);
+    if (fn && PARAMETER_TAG.test(text))
+        return fn[0];
+    return null;
+}
+/**
+ * A correction hint to prepend to a re-spawn after a leak, naming the offending
+ * markup so the model stops repeating that exact mistake.
+ */
+export function leakedToolCallHint(marker) {
+    return (`[SYSTEM NOTE: Your previous turn wrote a tool call as plain text (\`${marker}\`) `
+        + `instead of invoking the tool — so it never ran and you proceeded without its result. `
+        + `Invoke tools through the native tool-calling mechanism; never type `
+        + `<tool_call>/<function=…>/<parameter=…> markup into your answer.]`);
+}

package/dist/task/auto-io.d.ts

@@ -13,5 +13,12 @@ export declare function parseTaskList(body: string): TaskEntry[];
 export declare function buildAutoBody(feature: string, clarifications: string, titles: string[]): string;
 /** Check off the Nth checkbox line, stamping the produced TASK_NNNN id. */
 export declare function checkOffTask(cwd: string, id: string, index: number, producedId: string, title: string): Promise<void>;
+/**
+ * Stamp the inner TASK_NNNN id onto the Nth (still-unchecked) entry the moment
+ * the inner task is allocated. This links the AUTO entry to its in-progress
+ * inner task so /task-auto-resume can continue it from its saved phase instead
+ * of starting a brand-new task — matching how /task-resume behaves.
+ */
+export declare function stampTaskInProgress(cwd: string, id: string, index: number, producedId: string, title: string): Promise<void>;
 /** Find the most-recently-updated resumable TASK_AUTO_* file, or null. */
 export declare function findResumableAuto(cwd: string): Promise<string | null>;

package/dist/task/auto-io.js

@@ -53,17 +53,15 @@ export function parseTaskList(body) {
             continue;
         const done = m[1].toLowerCase() === 'x';
         const rest = m[2].trim();
-        if (done) {
-            const idm = PRODUCED_ID_RE.exec(rest);
-            if (idm) {
-                entries.push({ index, title: idm[2].trim(), done: true, producedId: idm[1] });
-            }
-            else {
-                entries.push({ index, title: rest, done: true });
-            }
+        // A line carries a stamped TASK_NNNN id both when done (the completed
+        // inner task) and when merely started — an unchecked, stamped line is an
+        // in-progress entry whose inner task can be resumed.
+        const idm = PRODUCED_ID_RE.exec(rest);
+        if (idm) {
+            entries.push({ index, title: idm[2].trim(), done, producedId: idm[1] });
         }
         else {
-            entries.push({ index, title: rest, done: false });
+            entries.push({ index, title: rest, done });
         }
         index++;
     }
@@ -76,8 +74,8 @@ export function buildAutoBody(feature, clarifications, titles) {
         + `## clarifications\n\n${clarifications.trim() || '(none)'}\n\n`
         + `## tasks\n\n${tasks}\n`);
 }
-/** Check off the Nth checkbox line, stamping the produced TASK_NNNN id. */
-export async function checkOffTask(cwd, id, index, producedId, title) {
+/** Rewrite the Nth checkbox line of the "## tasks" section in place. */
+async function rewriteTaskLine(cwd, id, index, render, label) {
     const { body } = await readTaskFile(cwd, id);
     const section = extractSection(body, 'tasks') ?? '';
     const lines = section.split('\n');
@@ -87,15 +85,28 @@ export async function checkOffTask(cwd, id, index, producedId, title) {
             continue;
         seen++;
         if (seen === index) {
-            lines[i] = producedId ? `- [x] ${producedId}  ${title}` : `- [x] ${title}`;
+            lines[i] = render();
             break;
         }
     }
     if (seen < index) {
-        throw new Error(`checkOffTask: index ${index} out of range in ${id} (only ${seen + 1} checkboxes found)`);
+        throw new Error(`${label}: index ${index} out of range in ${id} (only ${seen + 1} checkboxes found)`);
     }
     await setTaskSection(cwd, id, 'tasks', lines.join('\n'));
 }
+/** Check off the Nth checkbox line, stamping the produced TASK_NNNN id. */
+export async function checkOffTask(cwd, id, index, producedId, title) {
+    await rewriteTaskLine(cwd, id, index, () => (producedId ? `- [x] ${producedId}  ${title}` : `- [x] ${title}`), 'checkOffTask');
+}
+/**
+ * Stamp the inner TASK_NNNN id onto the Nth (still-unchecked) entry the moment
+ * the inner task is allocated. This links the AUTO entry to its in-progress
+ * inner task so /task-auto-resume can continue it from its saved phase instead
+ * of starting a brand-new task — matching how /task-resume behaves.
+ */
+export async function stampTaskInProgress(cwd, id, index, producedId, title) {
+    await rewriteTaskLine(cwd, id, index, () => `- [ ] ${producedId}  ${title}`, 'stampTaskInProgress');
+}
 /** Find the most-recently-updated resumable TASK_AUTO_* file, or null. */
 export async function findResumableAuto(cwd) {
     await ensureTasksDir(cwd);

package/dist/task/auto-orchestrator.d.ts

@@ -7,7 +7,12 @@ import { type CommitResult } from './auto-commit.js';
  */
 export interface AutoDeps {
     runChild: (name: string, tools: string, prompt: string) => Promise<string>;
-    runTask: (ctx: ExtensionCommandContext, cwd: string, title: string) => Promise<RunSingleTaskResult>;
+    runTask: (ctx: ExtensionCommandContext, cwd: string, title: string, opts?: {
+        /** Resume this inner task id instead of allocating a fresh one. */
+        resumeId?: string;
+        /** Called with the inner task id once its file exists, before phases. */
+        onStart?: (taskId: string) => void | Promise<void>;
+    }) => Promise<RunSingleTaskResult>;
     /** Snapshot the working tree into one commit after a task passes. */
     commit: (cwd: string, message: string) => Promise<CommitResult>;
 }

package/dist/task/auto-orchestrator.js

@@ -11,7 +11,7 @@ import { runSingleTask } from './orchestrator.js';
 import { parseClarifyList, deriveTitle } from './parsers.js';
 import { renderInlineMarkdown, stripInlineMarkdown } from './inline-markdown.js';
 import { AUTO_CLARIFY_PROMPT, AUTO_DECOMPOSE_PROMPT } from './auto-prompts.js';
-import { allocateAutoId, buildAutoBody, parseDecomposeList, parseTaskList, checkOffTask, findResumableAuto } from './auto-io.js';
+import { allocateAutoId, buildAutoBody, parseDecomposeList, parseTaskList, checkOffTask, stampTaskInProgress, findResumableAuto } from './auto-io.js';
 import { writeTaskFile, readTaskFile, updateTaskFrontMatter } from './task-io.js';
 import { gitCommitAll } from './auto-commit.js';
 import { runPhaseChild, USER_CANCELLED } from './child-runner.js';
@@ -176,7 +176,11 @@ function defaultDeps(ctx, cwd, signal, title) {
                 stopLoader();
             }
         },
-        runTask: (c, cwd2, t) => runSingleTask(c, cwd2, t, { waitForImplementation: true }),
+        runTask: (c, cwd2, t, opts) => runSingleTask(c, cwd2, t, {
+            waitForImplementation: true,
+            resumeId: opts?.resumeId,
+            onStart: opts?.onStart
+        }),
         commit: (cwd2, message) => gitCommitAll(cwd2, message, signal)
     };
 }
@@ -208,7 +212,15 @@ export async function runAutoLoop(ctx, cwd, id, deps) {
                 return;
             }
             active.ui.notify(`${id}: task ${next.index + 1}/${entries.length} — ${next.title}`, 'info');
-            const res = await deps.runTask(active, cwd, next.title);
+            // If this entry already has a stamped inner id, it was started in a
+            // previous (interrupted) run — resume it from its saved phase rather
+            // than spawning a fresh task. Otherwise stamp the freshly-allocated id
+            // onto the entry the moment it exists, so an interruption here is
+            // resumable too. This mirrors /task-resume's continue-don't-restart.
+            const res = await deps.runTask(active, cwd, next.title, {
+                resumeId: next.producedId,
+                onStart: next.producedId ? undefined : (innerId => stampTaskInProgress(cwd, id, next.index, innerId, next.title))
+            });
             active = res.ctx ?? active;
             if (res.sessionCancelled) {
                 active.ui.notify(`${id} paused — could not start a session. Run /task-auto-resume to retry.`, 'warning');

package/dist/task/child-runner.d.ts

@@ -14,6 +14,8 @@ export interface PhaseRunResult {
     exitCode: number;
     stderr: string;
     loopHit?: LoopHit;
+    /** Set when the assistant text contains an unexecuted, leaked tool call. */
+    leakedToolCall?: string;
 }
 export declare function childArgs(tools: string, prompt: string): string[];
 export declare const USER_CANCELLED = "__user_cancelled__";
@@ -38,7 +40,13 @@ interface PhaseDeps {
     spawn?: SpawnFn;
 }
 export type { PhaseDeps };
-/** Run a child pi and return its assistant text. Throws if exit code != 0. */
+/**
+ * Run a child pi and return its assistant text. Throws if exit code != 0.
+ *
+ * If the child leaks a tool call as plain text (wrong dialect — never executed),
+ * re-prompt with a correction hint up to MAX_LEAK_RETRIES times; if it keeps
+ * leaking, throw LeakedToolCallError rather than returning the unexecuted call.
+ */
 export declare function runPhaseChild(deps: PhaseDeps, name: string, tools: string, prompt: string): Promise<string>;
 export declare function prependHint(hint: string | null, prompt: string): string;
 /**
@@ -64,3 +72,13 @@ export declare class LoopExhaustedError extends Error {
     readonly history: LoopHit[];
     constructor(phase: string, history: LoopHit[]);
 }
+/**
+ * Thrown when a phase child repeatedly wrote a tool call as plain text (a markup
+ * dialect pi's harness didn't parse) instead of invoking it. The call never ran,
+ * so the phase output is untrustworthy — fail loudly rather than check it off.
+ */
+export declare class LeakedToolCallError extends Error {
+    readonly phase: string;
+    readonly marker: string;
+    constructor(phase: string, marker: string);
+}

package/dist/task/child-runner.js

@@ -9,6 +9,7 @@ import { spawn } from 'node:child_process';
 import { getPiInvocation } from '../shared/pi-invocation.js';
 import { runChild as runChildUnified, CHILD_BASE_ARGS } from '../shared/child-process.js';
 import { LoopDetector } from './loop-detector.js';
+import { detectLeakedToolCall, leakedToolCallHint, MAX_LEAK_RETRIES } from '../shared/leaked-tool-call.js';
 import { readSection, setTaskSection } from './task-file.js';
 // ─── Loop detection constants ────────────────────────────────────────────────
 // Defined here (not in phases.ts) to avoid a circular dependency:
@@ -57,28 +58,52 @@ export async function runChild(cwd, tools, prompt, signal, onLine, onContextUsag
             return hit; // propagate to unified runner so it can kill
         }
     });
+    // Use `||` (not `??`) so an empty string from json-events mode falls
+    // back to raw stdout. Without this, a child that exits 0 but emits no
+    // assistant text (e.g. model API error swallowed in json mode) always
+    // fails with the unhelpful "X child produced no output" — the raw
+    // stdout/stderr that might contain the real error is discarded.
+    const text = result.text || result.stdout.trim();
     return {
-        // Use `||` (not `??`) so an empty string from json-events mode falls
-        // back to raw stdout. Without this, a child that exits 0 but emits no
-        // assistant text (e.g. model API error swallowed in json mode) always
-        // fails with the unhelpful "X child produced no output" — the raw
-        // stdout/stderr that might contain the real error is discarded.
-        text: result.text || result.stdout.trim(),
+        text,
         exitCode: result.exitCode,
         stderr: result.stderr.trim(),
-        loopHit
+        loopHit,
+        // A tool call the model wrote as text (wrong dialect) never executed and
+        // sailed past the structured-event guards above; flag it so the wrappers
+        // can re-prompt instead of accepting the unexecuted call. Only meaningful
+        // when the run otherwise succeeded — a loop kill truncates text mid-stream.
+        leakedToolCall: loopHit ? undefined : (detectLeakedToolCall(text) ?? undefined)
     };
 }
-/** Run a child pi and return its assistant text. Throws if exit code != 0. */
+/**
+ * Run a child pi and return its assistant text. Throws if exit code != 0.
+ *
+ * If the child leaks a tool call as plain text (wrong dialect — never executed),
+ * re-prompt with a correction hint up to MAX_LEAK_RETRIES times; if it keeps
+ * leaking, throw LeakedToolCallError rather than returning the unexecuted call.
+ */
 export async function runPhaseChild(deps, name, tools, prompt) {
-    const r = await runChild(deps.cwd, tools, prompt, deps.signal, deps.onChildOutput, deps.onContextUsage, undefined, deps.spawn);
-    if (r.exitCode !== 0) {
-        throw new Error(`${name} child failed: ${r.stderr || '(no stderr)'}`);
-    }
-    if (r.text.trim().length === 0) {
-        throw new Error(`${name} child produced no output${r.stderr ? ' — stderr: ' + r.stderr : ''}`);
+    let hint = null;
+    for (let attempt = 0; attempt <= MAX_LEAK_RETRIES; attempt++) {
+        const r = await runChild(deps.cwd, tools, prependHint(hint, prompt), deps.signal, deps.onChildOutput, deps.onContextUsage, undefined, deps.spawn);
+        if (r.exitCode !== 0) {
+            throw new Error(`${name} child failed: ${r.stderr || '(no stderr)'}`);
+        }
+        if (r.text.trim().length === 0) {
+            throw new Error(`${name} child produced no output${r.stderr ? ' — stderr: ' + r.stderr : ''}`);
+        }
+        if (r.leakedToolCall) {
+            if (attempt === MAX_LEAK_RETRIES) {
+                throw new LeakedToolCallError(name, r.leakedToolCall);
+            }
+            hint = leakedToolCallHint(r.leakedToolCall);
+            continue;
+        }
+        return r.text;
     }
-    return r.text;
+    // Unreachable: the loop returns clean text or throws on the final leak.
+    throw new LeakedToolCallError(name, '(unknown)');
 }
 function formatLoopHint(hit) {
     const argsStr = JSON.stringify(hit.call.args);
@@ -106,12 +131,13 @@ async function appendLoopEvent(cwd, taskId, phase, hit, strike, outcome) {
  */
 export async function runPhaseWithLoopGuard(deps, name, tools, buildPrompt) {
     const loopHistory = [];
+    // Carries the correction hint (loop OR leaked-tool-call) into the next strike.
+    let nextHint = null;
     for (let strike = 0; strike <= MAX_LOOP_RESTARTS; strike++) {
         if (deps.signal.aborted)
             throw new Error(USER_CANCELLED);
         const detector = new LoopDetector(LOOP_WINDOW, LOOP_THRESHOLD);
-        const hint = strike === 0 ? null : formatLoopHint(loopHistory[strike - 1]);
-        const prompt = buildPrompt(hint);
+        const prompt = buildPrompt(nextHint);
         const r = await runChild(deps.cwd, tools, prompt, deps.signal, deps.onChildOutput, deps.onContextUsage, call => detector.record(call), deps.spawn);
         if (deps.signal.aborted)
             throw new Error(USER_CANCELLED);
@@ -121,6 +147,7 @@ export async function runPhaseWithLoopGuard(deps, name, tools, buildPrompt) {
             await appendLoopEvent(deps.cwd, deps.taskId, name, r.loopHit, strike + 1, isLastStrike ? 'phase failed' : 'restarted with hint');
             if (isLastStrike)
                 throw new LoopExhaustedError(name, loopHistory);
+            nextHint = formatLoopHint(r.loopHit);
             continue;
         }
         if (r.exitCode !== 0) {
@@ -129,6 +156,13 @@ export async function runPhaseWithLoopGuard(deps, name, tools, buildPrompt) {
         if (r.text.trim().length === 0) {
             throw new Error(`${name} child produced no output${r.stderr ? ' — stderr: ' + r.stderr : ''}`);
         }
+        if (r.leakedToolCall) {
+            if (strike === MAX_LOOP_RESTARTS) {
+                throw new LeakedToolCallError(name, r.leakedToolCall);
+            }
+            nextHint = leakedToolCallHint(r.leakedToolCall);
+            continue;
+        }
         return r.text;
     }
     throw new LoopExhaustedError(name, loopHistory);
@@ -160,3 +194,20 @@ export class LoopExhaustedError extends Error {
         this.name = 'LoopExhaustedError';
     }
 }
+// ─── LeakedToolCallError ─────────────────────────────────────────────────────
+/**
+ * Thrown when a phase child repeatedly wrote a tool call as plain text (a markup
+ * dialect pi's harness didn't parse) instead of invoking it. The call never ran,
+ * so the phase output is untrustworthy — fail loudly rather than check it off.
+ */
+export class LeakedToolCallError extends Error {
+    phase;
+    marker;
+    constructor(phase, marker) {
+        super(`${phase} child wrote a tool call as text instead of invoking it `
+            + `(${marker.trim()}) — it never ran`);
+        this.phase = phase;
+        this.marker = marker;
+        this.name = 'LeakedToolCallError';
+    }
+}

package/dist/task/failure-classifier.js

@@ -4,7 +4,7 @@
  */
 import { updateTaskFrontMatter } from './task-file.js';
 import { flashTerminalWidget } from './widget.js';
-import { LoopExhaustedError, USER_CANCELLED } from './child-runner.js';
+import { LoopExhaustedError, LeakedToolCallError, USER_CANCELLED } from './child-runner.js';
 // ─── Classifier ──────────────────────────────────────────────────────────────
 export function classifyFailure(err, aborted) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -20,6 +20,15 @@ export function classifyFailure(err, aborted) {
             level: 'error'
         };
     }
+    if (err instanceof LeakedToolCallError) {
+        return {
+            state: 'failed',
+            reason: `leaked tool call in ${err.phase}: ${err.marker.trim()}`,
+            flash: 'leaked_tool_call',
+            notify: `failed: ${err.phase} wrote a tool call as text instead of running it — it never executed. Resume to retry.`,
+            level: 'error'
+        };
+    }
     if (msg === 'no_verify_block') {
         return {
             state: 'failed',

package/dist/task/orchestrator.d.ts

@@ -25,6 +25,7 @@ export declare class TaskRunner {
     private readonly _rawPrompt;
     private readonly _resumeId;
     private readonly _sendSpec;
+    private readonly _onStart;
     private readonly _abort;
     private readonly _startedAt;
     private readonly _widgetState;
@@ -40,7 +41,7 @@ export declare class TaskRunner {
      */
     private readonly _timings;
     private _currentPhaseChildren;
-    constructor(ctx: ExtensionCommandContext, cwd: string, rawPrompt: string, resumeId?: string, sendSpec?: (spec: string) => Promise<void>, spawnFn?: SpawnFn);
+    constructor(ctx: ExtensionCommandContext, cwd: string, rawPrompt: string, resumeId?: string, sendSpec?: (spec: string) => Promise<void>, spawnFn?: SpawnFn, onStart?: (taskId: string) => void | Promise<void>);
     get taskId(): string;
     get signal(): AbortSignal;
     /** Return the current widget state, or null if not started. */
@@ -64,6 +65,10 @@ export interface RunSingleTaskOptions {
     resumeId?: string;
     /** Test seam: spawn function forwarded to TaskRunner. */
     spawnFn?: SpawnFn;
+    /** Called with the resolved task id once its file exists, before any phase
+     *  work. Lets callers record the id (e.g. stamp the /task-auto entry) so an
+     *  interrupted run can be resumed instead of restarted. */
+    onStart?: (taskId: string) => void | Promise<void>;
 }
 export interface RunSingleTaskResult {
     taskId: string;

package/dist/task/orchestrator.js

@@ -45,6 +45,7 @@ export class TaskRunner {
     _rawPrompt;
     _resumeId;
     _sendSpec;
+    _onStart;
     _abort = new AbortController();
     _startedAt;
     _widgetState;
@@ -60,12 +61,13 @@ export class TaskRunner {
      */
     _timings = [];
     _currentPhaseChildren = null;
-    constructor(ctx, cwd, rawPrompt, resumeId, sendSpec, spawnFn) {
+    constructor(ctx, cwd, rawPrompt, resumeId, sendSpec, spawnFn, onStart) {
         this._ctx = ctx;
         this._cwd = cwd;
         this._rawPrompt = rawPrompt;
         this._resumeId = resumeId;
         this._sendSpec = sendSpec;
+        this._onStart = onStart;
         this._startedAt = Date.now();
         // We'll populate id/title/phase lazily in run().
         // Placeholder — real values set in run().
@@ -157,6 +159,11 @@ export class TaskRunner {
             };
             await writeTaskFile(cwd, fm, `\n## raw prompt\n\n${this._rawPrompt.trim() || '(none)'}\n`);
         }
+        // Surface the resolved id now that the task file exists, so callers (e.g.
+        // the /task-auto loop) can link this run to their own bookkeeping before
+        // any phase work — and recover it if the session dies mid-pipeline.
+        if (this._onStart)
+            await this._onStart(id);
         // Register as active.
         this._widgetState.taskId = id;
         this._widgetState.title = title;
@@ -279,7 +286,7 @@ export async function runSingleTask(ctx, cwd, rawPrompt, opts = {}) {
                 await newCtx.sendUserMessage(spec);
                 if (opts.waitForImplementation)
                     await newCtx.waitForIdle();
-            }, opts.spawnFn);
+            }, opts.spawnFn, opts.onStart);
             await runner.run();
             taskId = runner.taskId;
         }

package/dist/task/phases.js

@@ -233,6 +233,10 @@ export async function phaseResearch(deps, refined, researchDeps = {}) {
         if (result.text.trim().length === 0) {
             throw new Error(`Research ${name} worker produced no output`);
         }
+        if (result.leakedToolCall) {
+            throw new Error(`Research ${name} worker wrote a tool call as text instead of invoking it `
+                + `(${result.leakedToolCall.trim()}) — it never ran`);
+        }
     }
     return `FILES\n${files.text}\n\nAPIS\n${apis.text}\n\nCONTEXT\n${context.text}\n\nTOOLING\n${tooling.text}`;
 }

package/dist/workers/html-clean.js

@@ -1,3 +1,6 @@
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
 import { JSDOM } from 'jsdom';
 import { Readability } from '@mozilla/readability';
 import TurndownService from 'turndown';
@@ -29,8 +32,57 @@ export function cleanHtml(html, baseUrl) {
 }
 const DEFAULT_TIMEOUT_MS = 15_000;
 const DEFAULT_MAX_BYTES = 2 * 1024 * 1024; // 2 MB
-const PKG_VERSION = '0.2.0'; // bump in lockstep with package.json on release
+const PKG_VERSION = readPkgVersion();
 const USER_AGENT = `pi-worker/${PKG_VERSION} (+https://npmjs.com/package/@mjasnikovs/pi-worker)`;
+// Read the version from package.json at runtime so the User-Agent never drifts
+// out of sync with releases. Two levels up holds for both src/workers (tests)
+// and dist/workers (build) since tsc preserves the layout under rootDir.
+function readPkgVersion() {
+    try {
+        const here = dirname(fileURLToPath(import.meta.url));
+        const pkg = JSON.parse(readFileSync(join(here, '..', '..', 'package.json'), 'utf8'));
+        return typeof pkg.version === 'string' ? pkg.version : '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+// Decide how to handle a response based on its content-type. HTML is run through
+// the readability/turndown pipeline; text-ish formats (markdown, plain text,
+// JSON, XML/feeds) are already clean and pass through verbatim; binary formats
+// (PDF, images, octet-stream, …) are rejected. A missing content-type is treated
+// as text — many plain-text endpoints (llms.txt, robots.txt) omit the header.
+function classifyContentType(contentType) {
+    const mime = contentType.split(';')[0].trim().toLowerCase();
+    if (mime === '')
+        return 'text';
+    if (mime === 'text/html' || mime === 'application/xhtml+xml')
+        return 'html';
+    if (mime.startsWith('text/'))
+        return 'text';
+    if (mime === 'application/json' || mime.endsWith('+json'))
+        return 'text';
+    if (mime === 'application/xml' || mime.endsWith('+xml'))
+        return 'text';
+    if (mime === 'application/javascript' || mime === 'application/ecmascript')
+        return 'text';
+    return 'reject';
+}
+// Extract the charset from a content-type header, if present and supported by
+// TextDecoder; otherwise fall back to UTF-8 so non-UTF-8 pages aren't mangled.
+function decoderFor(contentType) {
+    const match = /charset=([^;]+)/i.exec(contentType);
+    const charset = match?.[1]?.trim().replace(/^["']|["']$/g, '');
+    if (charset) {
+        try {
+            return new TextDecoder(charset, { fatal: false });
+        }
+        catch {
+            // Unknown/unsupported label — fall through to UTF-8.
+        }
+    }
+    return new TextDecoder('utf-8', { fatal: false });
+}
 export class FetchAndCleanError extends Error {
     kind;
     cause;
@@ -77,15 +129,16 @@ export async function fetchAndClean(url, opts = {}) {
             throw new FetchAndCleanError(`Fetch failed: HTTP ${response.status} ${response.statusText} for ${url}`, 'http-error');
         }
         const contentType = response.headers.get('content-type') ?? '';
-        if (!contentType.toLowerCase().includes('text/html')) {
-            throw new FetchAndCleanError(`${url} is ${contentType || 'unknown content type'}, not HTML. pi-worker-fetch only reads HTML pages.`, 'not-html');
+        const kind = classifyContentType(contentType);
+        if (kind === 'reject') {
+            throw new FetchAndCleanError(`${url} is ${contentType || 'unknown content type'}, not a text or HTML page that pi-worker-fetch can read.`, 'not-html');
         }
         const reader = response.body?.getReader();
         if (!reader) {
             throw new FetchAndCleanError(`Could not fetch ${url}: empty response body`, 'network');
         }
-        const decoder = new TextDecoder('utf-8', { fatal: false });
-        let html = '';
+        const decoder = decoderFor(contentType);
+        let text = '';
         let bytesRead = 0;
         try {
             while (true) {
@@ -99,10 +152,10 @@ export async function fetchAndClean(url, opts = {}) {
                         internalController.abort();
                         break;
                     }
-                    html += decoder.decode(value, { stream: true });
+                    text += decoder.decode(value, { stream: true });
                 }
             }
-            html += decoder.decode();
+            text += decoder.decode();
         }
         catch (err) {
             if (sizeExceeded) {
@@ -119,8 +172,15 @@ export async function fetchAndClean(url, opts = {}) {
             throw new FetchAndCleanError(`${url} exceeds ${formatBytes(maxBytes)} size cap. Try a more specific URL.`, 'too-large');
         }
         const finalUrl = response.url || url;
-        const cleaned = cleanHtml(html, finalUrl);
-        return cleaned;
+        if (kind === 'html') {
+            return cleanHtml(text, finalUrl);
+        }
+        // text-ish formats are already clean — return them verbatim.
+        return {
+            title: hostnameOf(finalUrl),
+            markdown: text.trim(),
+            finalUrl
+        };
     }
     finally {
         clearTimeout(timeoutHandle);
@@ -128,6 +188,14 @@ export async function fetchAndClean(url, opts = {}) {
             opts.signal.removeEventListener('abort', onUserAbort);
     }
 }
+function hostnameOf(url) {
+    try {
+        return new URL(url).hostname;
+    }
+    catch {
+        return url;
+    }
+}
 function describeError(err) {
     if (err instanceof Error)
         return err.message;

package/dist/workers/pi-worker-core.d.ts

@@ -24,5 +24,11 @@ export interface RunWorkerResult {
      * elapsed when the child never produced output.
      */
     workMs: number;
+    /**
+     * Set when the worker exhausted its re-prompts still leaking a tool call as
+     * text (wrong dialect, never executed). The caller must treat this as a
+     * failure rather than trusting the returned text.
+     */
+    leakedToolCall?: string;
 }
 export declare function runWorker(input: RunWorkerInput): Promise<RunWorkerResult>;

package/dist/workers/pi-worker-core.js

@@ -1,6 +1,7 @@
 import { getPiInvocation } from '../shared/pi-invocation.js';
 import { CHILD_BASE_ARGS, runChildDefault } from '../shared/child-process.js';
 import { LoopDetector } from '../task/loop-detector.js';
+import { detectLeakedToolCall, leakedToolCallHint, MAX_LEAK_RETRIES } from '../shared/leaked-tool-call.js';
 // `--mode json` makes pi emit structured events as they happen instead of
 // buffering the assistant text and flushing on exit. That matters for the
 // wait/work timing split: in text mode the first stdout chunk only arrives at
@@ -11,25 +12,39 @@ import { LoopDetector } from '../task/loop-detector.js';
 const DEFAULT_TOOLS = 'read,grep,find,ls';
 export async function runWorker(input) {
     const tools = input.tools ?? DEFAULT_TOOLS;
-    const childArgs = [...CHILD_BASE_ARGS, '--mode', 'json', '--tools', tools];
-    const invocation = getPiInvocation([...childArgs, input.prompt]);
-    const tStart = Date.now();
-    let tFirstByte = null;
-    const loopDetector = new LoopDetector(20, 5);
-    const result = await runChildDefault(invocation, input.cwd, input.signal, {
-        mode: 'json-events',
-        onFirstByte: () => (tFirstByte = Date.now()),
-        onToolCall: call => loopDetector.record(call)
-    }, input.spawn);
-    const tEnd = Date.now();
-    const waitMs = tFirstByte === null ? tEnd - tStart : tFirstByte - tStart;
-    const workMs = tFirstByte === null ? 0 : tEnd - tFirstByte;
-    return {
-        text: result.text ?? '',
-        exitCode: result.exitCode,
-        stderr: result.stderr.trim(),
-        aborted: result.aborted,
-        waitMs,
-        workMs
-    };
+    const baseArgs = [...CHILD_BASE_ARGS, '--mode', 'json', '--tools', tools];
+    let hint = null;
+    for (let attempt = 0;; attempt++) {
+        const prompt = hint === null ? input.prompt : `${hint}\n\n${input.prompt}`;
+        const invocation = getPiInvocation([...baseArgs, prompt]);
+        const tStart = Date.now();
+        let tFirstByte = null;
+        const loopDetector = new LoopDetector(20, 5);
+        const result = await runChildDefault(invocation, input.cwd, input.signal, {
+            mode: 'json-events',
+            onFirstByte: () => (tFirstByte = Date.now()),
+            onToolCall: call => loopDetector.record(call)
+        }, input.spawn);
+        const tEnd = Date.now();
+        const waitMs = tFirstByte === null ? tEnd - tStart : tFirstByte - tStart;
+        const workMs = tFirstByte === null ? 0 : tEnd - tFirstByte;
+        const text = result.text ?? '';
+        // Only treat output as a leak on a clean, complete run — a non-zero exit
+        // or abort yields partial text the caller already handles, and detecting
+        // there would just mislabel the real failure.
+        const leaked = result.exitCode === 0 && !result.aborted ? detectLeakedToolCall(text) : null;
+        if (leaked && attempt < MAX_LEAK_RETRIES) {
+            hint = leakedToolCallHint(leaked);
+            continue;
+        }
+        return {
+            text,
+            exitCode: result.exitCode,
+            stderr: result.stderr.trim(),
+            aborted: result.aborted,
+            waitMs,
+            workMs,
+            ...(leaked ? { leakedToolCall: leaked } : {})
+        };
+    }
 }

package/dist/workers/pi-worker-fetch.js

@@ -14,10 +14,11 @@ export function registerPiWorkerFetch(pi, internals = {}) {
     pi.registerTool({
         name: 'pi-worker-fetch',
         label: 'Pi Worker Fetch',
-        description: 'Fetch an HTML page, clean it to markdown, and hand it to an isolated '
-            + 'child Pi session that extracts ONLY content answering `query`. '
-            + 'Returns the focused answer. Use after `pi-worker-search` (or with a '
-            + 'known URL) to avoid stuffing raw HTML into the main context.',
+        description: 'Fetch a web page or text resource (HTML, markdown, plain text, JSON, '
+            + 'XML/feeds), clean HTML to markdown, and hand it to an isolated child '
+            + 'Pi session that extracts ONLY content answering `query`. Returns the '
+            + 'focused answer. Use after `pi-worker-search` (or with a known URL) to '
+            + 'avoid stuffing raw content into the main context.',
         parameters: Params,
         executionMode: 'parallel',
         async execute(_toolCallId, params, signal, _onUpdate, ctx) {

package/package.json

@@ -1,12 +1,13 @@
 {
     "name": "@mjasnikovs/pi-task",
-    "version": "0.7.1",
+    "version": "0.7.3",
     "description": "Deterministic spec-orchestration for local models, with a bundled real-time remote web view and web/docs/fetch/worker subagent tools.",
     "type": "module",
     "main": "./dist/index.js",
     "types": "./dist/index.d.ts",
     "files": [
         "dist",
+        "assets",
         "README.md",
         "LICENSE"
     ],