@rubytech/taskmaster 1.0.71 → 1.0.73

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.71",
-  "commit": "7624a5101bfd932e2c75d9f4abdc62355e07cc46",
-  "builtAt": "2026-02-19T07:14:27.907Z"
+  "version": "1.0.73",
+  "commit": "6a5e6e9738063f5256b8adfab35b77b7e64da2be",
+  "builtAt": "2026-02-19T09:30:56.446Z"
 }

package/dist/daemon/systemd-unit.js

@@ -11,20 +11,29 @@ function renderEnvLines(env) {
         return [];
     return entries.map(([key, value]) => `Environment=${systemdEscapeArg(`${key}=${value?.trim() ?? ""}`)}`);
 }
-export function buildSystemdUnit({ description, programArguments, workingDirectory, environment, }) {
+export function buildSystemdUnit({ description, programArguments, workingDirectory, environment, execStartPre, startLimitBurst, startLimitIntervalSec, }) {
     const execStart = programArguments.map(systemdEscapeArg).join(" ");
     const descriptionLine = `Description=${description?.trim() || "Taskmaster Gateway"}`;
     const workingDirLine = workingDirectory
         ? `WorkingDirectory=${systemdEscapeArg(workingDirectory)}`
         : null;
     const envLines = renderEnvLines(environment);
+    const startLimitLines = [];
+    if (startLimitBurst != null) {
+        startLimitLines.push(`StartLimitBurst=${startLimitBurst}`);
+    }
+    if (startLimitIntervalSec != null) {
+        startLimitLines.push(`StartLimitIntervalSec=${startLimitIntervalSec}`);
+    }
     return [
         "[Unit]",
         descriptionLine,
         "After=network-online.target",
         "Wants=network-online.target",
+        ...startLimitLines,
         "",
         "[Service]",
+        execStartPre ? `ExecStartPre=${execStartPre}` : null,
         `ExecStart=${execStart}`,
         "Restart=always",
         "RestartSec=5",

package/dist/daemon/systemd.js

@@ -5,9 +5,10 @@ import { promisify } from "node:util";
 import { colorize, isRich, theme } from "../terminal/theme.js";
 import { formatGatewayServiceDescription, LEGACY_GATEWAY_SYSTEMD_SERVICE_NAMES, resolveGatewaySystemdServiceName, } from "./constants.js";
 import { parseKeyValueOutput } from "./runtime-parse.js";
-import { resolveHomeDir } from "./paths.js";
+import { resolveGatewayStateDir, resolveHomeDir } from "./paths.js";
 import { enableSystemdUserLinger, readSystemdUserLingerStatus, } from "./systemd-linger.js";
 import { buildSystemdUnit, parseSystemdEnvAssignment, parseSystemdExecStart, } from "./systemd-unit.js";
+import { installWatchdog } from "./watchdog.js";
 const execFileAsync = promisify(execFile);
 const toPosixPath = (value) => value.replace(/\\/g, "/");
 const formatLine = (label, value) => {
@@ -150,16 +151,35 @@ export async function installSystemdService({ env, stdout, programArguments, wor
     await assertSystemdAvailable();
     const unitPath = resolveSystemdUnitPath(env);
     await fs.mkdir(path.dirname(unitPath), { recursive: true });
+    // Install watchdog: startup-check script + known-good version baseline.
+    const stateDir = resolveGatewayStateDir(env);
+    const currentVersion = environment?.TASKMASTER_SERVICE_VERSION ?? env.TASKMASTER_SERVICE_VERSION;
+    let watchdogScriptPath = null;
+    try {
+        const watchdog = await installWatchdog({
+            stateDir,
+            currentVersion: currentVersion ?? "0.0.0",
+        });
+        watchdogScriptPath = watchdog.scriptPath;
+    }
+    catch {
+        // Non-critical — gateway still starts, just without crash-loop protection.
+        stdout.write("Warning: watchdog script installation failed; auto-rollback will not be available.\n");
+    }
     const serviceDescription = description ??
         formatGatewayServiceDescription({
             profile: env.TASKMASTER_PROFILE,
-            version: environment?.TASKMASTER_SERVICE_VERSION ?? env.TASKMASTER_SERVICE_VERSION,
+            version: currentVersion,
         });
     const unit = buildSystemdUnit({
         description: serviceDescription,
         programArguments,
         workingDirectory,
         environment,
+        // '-' prefix: don't fail the unit if the script errors.
+        execStartPre: watchdogScriptPath ? `-${watchdogScriptPath}` : null,
+        startLimitBurst: 5,
+        startLimitIntervalSec: 120,
     });
     await fs.writeFile(unitPath, unit, "utf8");
     const serviceName = resolveGatewaySystemdServiceName(env.TASKMASTER_PROFILE);
@@ -181,6 +201,66 @@ export async function installSystemdService({ env, stdout, programArguments, wor
     stdout.write(`${formatLine("Installed systemd service", unitPath)}\n`);
     return { unitPath };
 }
+/**
+ * Refresh the systemd unit file to include watchdog directives.
+ *
+ * Reads the existing unit to extract ExecStart, WorkingDirectory, and
+ * Environment, then rebuilds the unit with ExecStartPre (watchdog script),
+ * StartLimitBurst, and StartLimitIntervalSec.
+ *
+ * Called from:
+ * - The update handler (before restart) — ensures the restarted process
+ *   immediately has watchdog protection.
+ * - Gateway startup (fire-and-forget) — handles the transition case where
+ *   old code updated to new code without knowing about the watchdog.
+ *
+ * No-op on non-Linux platforms or when no unit file exists.
+ */
+export async function refreshSystemdServiceUnit(params) {
+    if (process.platform !== "linux")
+        return { refreshed: false };
+    const { env } = params;
+    const unitPath = resolveSystemdUnitPath(env);
+    // Read existing unit — if it doesn't exist, nothing to refresh.
+    const existing = await readSystemdServiceExecStart(env);
+    if (!existing)
+        return { refreshed: false };
+    // Install watchdog files (preserves existing known-good version).
+    const stateDir = resolveGatewayStateDir(env);
+    const version = params.version ??
+        existing.environment?.TASKMASTER_SERVICE_VERSION ??
+        env.TASKMASTER_SERVICE_VERSION;
+    let watchdogScriptPath = null;
+    try {
+        const watchdog = await installWatchdog({
+            stateDir,
+            currentVersion: version ?? "0.0.0",
+        });
+        watchdogScriptPath = watchdog.scriptPath;
+    }
+    catch {
+        return { refreshed: false };
+    }
+    // Rebuild the unit with watchdog directives.
+    const description = formatGatewayServiceDescription({
+        profile: env.TASKMASTER_PROFILE,
+        version,
+    });
+    const unit = buildSystemdUnit({
+        description,
+        programArguments: existing.programArguments,
+        workingDirectory: existing.workingDirectory,
+        environment: existing.environment,
+        execStartPre: watchdogScriptPath ? `-${watchdogScriptPath}` : null,
+        startLimitBurst: 5,
+        startLimitIntervalSec: 120,
+    });
+    await fs.mkdir(path.dirname(unitPath), { recursive: true });
+    await fs.writeFile(unitPath, unit, "utf8");
+    // Reload so systemd picks up the new unit before the next restart.
+    await execSystemctl(["--user", "daemon-reload"]);
+    return { refreshed: true };
+}
 export async function uninstallSystemdService({ env, stdout, }) {
     await assertSystemdAvailable();
     const serviceName = resolveGatewaySystemdServiceName(env.TASKMASTER_PROFILE);

package/dist/daemon/watchdog.js

@@ -0,0 +1,193 @@
+import { randomBytes } from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+const WATCHDOG_DIRNAME = "watchdog";
+const CRASH_COUNT_FILENAME = "crash-count";
+const KNOWN_GOOD_VERSION_FILENAME = "known-good-version";
+const STARTUP_CHECK_FILENAME = "startup-check.sh";
+/** Default number of consecutive startup failures before rollback is attempted. */
+export const DEFAULT_CRASH_THRESHOLD = 3;
+// ---------------------------------------------------------------------------
+// Paths
+// ---------------------------------------------------------------------------
+export function resolveWatchdogDir(stateDir) {
+    return path.join(stateDir, WATCHDOG_DIRNAME);
+}
+export function resolveCrashCountPath(stateDir) {
+    return path.join(resolveWatchdogDir(stateDir), CRASH_COUNT_FILENAME);
+}
+export function resolveKnownGoodVersionPath(stateDir) {
+    return path.join(resolveWatchdogDir(stateDir), KNOWN_GOOD_VERSION_FILENAME);
+}
+export function resolveStartupCheckScriptPath(stateDir) {
+    return path.join(resolveWatchdogDir(stateDir), STARTUP_CHECK_FILENAME);
+}
+// ---------------------------------------------------------------------------
+// Atomic file write
+// ---------------------------------------------------------------------------
+/** Write-then-rename to avoid partial writes on power loss or kill. */
+async function atomicWriteFile(filePath, content) {
+    const tmp = `${filePath}.tmp${randomBytes(4).toString("hex")}`;
+    await fs.writeFile(tmp, content, "utf-8");
+    await fs.rename(tmp, filePath);
+}
+// ---------------------------------------------------------------------------
+// Crash counter
+// ---------------------------------------------------------------------------
+export async function readCrashCount(stateDir) {
+    try {
+        const raw = await fs.readFile(resolveCrashCountPath(stateDir), "utf-8");
+        const parsed = Number.parseInt(raw.trim(), 10);
+        return Number.isFinite(parsed) && parsed >= 0 ? parsed : 0;
+    }
+    catch {
+        return 0;
+    }
+}
+export async function writeCrashCount(stateDir, count) {
+    const dir = resolveWatchdogDir(stateDir);
+    await fs.mkdir(dir, { recursive: true });
+    await atomicWriteFile(resolveCrashCountPath(stateDir), `${Math.max(0, Math.floor(count))}\n`);
+}
+export async function resetCrashCount(stateDir) {
+    await writeCrashCount(stateDir, 0);
+}
+// ---------------------------------------------------------------------------
+// Known-good version
+// ---------------------------------------------------------------------------
+export async function readKnownGoodVersion(stateDir) {
+    try {
+        const raw = await fs.readFile(resolveKnownGoodVersionPath(stateDir), "utf-8");
+        const version = raw.trim();
+        return version || null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function writeKnownGoodVersion(stateDir, version) {
+    const dir = resolveWatchdogDir(stateDir);
+    await fs.mkdir(dir, { recursive: true });
+    await atomicWriteFile(resolveKnownGoodVersionPath(stateDir), `${version.trim()}\n`);
+}
+// ---------------------------------------------------------------------------
+// Startup-check shell script
+// ---------------------------------------------------------------------------
+/** Escape a string for use in a bash single-quoted literal. */
+function bashSingleQuote(value) {
+    return `'${value.replace(/'/g, "'\\''")}'`;
+}
+/**
+ * Generate the content of the startup-check.sh script.
+ *
+ * This script runs as ExecStartPre in the systemd unit. On every gateway
+ * start attempt it increments a crash counter. When the counter reaches the
+ * threshold it rolls back to the last known-good version via npm.
+ *
+ * The script always exits 0 so that ExecStart proceeds regardless — even if
+ * the rollback itself fails, the gateway should still attempt to start (and
+ * systemd's StartLimitBurst will eventually stop retrying).
+ */
+export function buildStartupCheckScript(params) {
+    const threshold = Math.max(1, Math.floor(params.threshold ?? DEFAULT_CRASH_THRESHOLD));
+    const watchdogDir = resolveWatchdogDir(params.stateDir);
+    const counterFile = resolveCrashCountPath(params.stateDir);
+    const knownGoodFile = resolveKnownGoodVersionPath(params.stateDir);
+    // Sentinel lives in the state dir root (same location as restart-sentinel.ts).
+    const sentinelFile = path.join(params.stateDir, "restart-sentinel.json");
+    // All paths are single-quoted to prevent shell injection from TASKMASTER_STATE_DIR.
+    return `#!/bin/bash
+# Taskmaster startup watchdog — auto-rollback on crash loop.
+# Generated by "taskmaster daemon install". Do not edit manually.
+# This script runs as ExecStartPre before each gateway start.
+# It must always exit 0 so ExecStart proceeds.
+
+COUNTER_FILE=${bashSingleQuote(counterFile)}
+KNOWN_GOOD_FILE=${bashSingleQuote(knownGoodFile)}
+SENTINEL_FILE=${bashSingleQuote(sentinelFile)}
+WATCHDOG_DIR=${bashSingleQuote(watchdogDir)}
+THRESHOLD=${threshold}
+
+mkdir -p "$WATCHDOG_DIR" 2>/dev/null || true
+
+# Read current crash count.
+count=0
+if [ -f "$COUNTER_FILE" ]; then
+  count=$(cat "$COUNTER_FILE" 2>/dev/null || echo 0)
+  # Guard against non-numeric content.
+  if ! [ "$count" -eq "$count" ] 2>/dev/null; then
+    count=0
+  fi
+fi
+
+if [ "$count" -ge "$THRESHOLD" ]; then
+  # Crash loop detected — attempt rollback.
+  version=""
+  if [ -f "$KNOWN_GOOD_FILE" ]; then
+    version=$(cat "$KNOWN_GOOD_FILE" 2>/dev/null || true)
+  fi
+
+  if [ -n "$version" ]; then
+    echo "Watchdog: crash loop detected ($count consecutive failures)."
+    echo "Watchdog: rolling back to v$version..."
+
+    # Write a restart sentinel so the UI can report what happened.
+    ts=$(date +%s)000
+    cat > "$SENTINEL_FILE" <<SENTINEL || true
+{"version":1,"payload":{"kind":"update","status":"ok","ts":$ts,"message":"Auto-rollback to v$version after $count consecutive startup failures"}}
+SENTINEL
+
+    # Attempt install. Try without sudo first, fall back to sudo -n.
+    # Only reset the counter on success — if rollback fails, keep the counter
+    # at threshold so the next start retries immediately.
+    if npm install -g "@rubytech/taskmaster@$version" 2>/dev/null; then
+      echo "Watchdog: rollback to v$version succeeded."
+      printf '%s\\n' 0 > "$COUNTER_FILE.tmp" && mv "$COUNTER_FILE.tmp" "$COUNTER_FILE"
+    elif sudo -n npm install -g "@rubytech/taskmaster@$version" 2>/dev/null; then
+      echo "Watchdog: rollback to v$version succeeded (sudo)."
+      printf '%s\\n' 0 > "$COUNTER_FILE.tmp" && mv "$COUNTER_FILE.tmp" "$COUNTER_FILE"
+    else
+      echo "Watchdog: rollback to v$version FAILED. Gateway will attempt to start anyway."
+    fi
+  else
+    echo "Watchdog: crash loop detected but no known-good version recorded. Skipping rollback."
+    printf '%s\\n' 0 > "$COUNTER_FILE.tmp" && mv "$COUNTER_FILE.tmp" "$COUNTER_FILE" || true
+  fi
+else
+  # Not yet at threshold — increment counter (atomic via write-then-rename).
+  printf '%s\\n' "$((count + 1))" > "$COUNTER_FILE.tmp" && mv "$COUNTER_FILE.tmp" "$COUNTER_FILE" || true
+fi
+
+# Always exit 0 so ExecStart proceeds.
+exit 0
+`;
+}
+// ---------------------------------------------------------------------------
+// Install helper
+// ---------------------------------------------------------------------------
+/**
+ * Write the startup-check.sh script and conditionally set the known-good version.
+ *
+ * On first install (no existing known-good file), sets the current version as
+ * known-good and resets the crash counter. On subsequent calls (e.g., during a
+ * software update), only the script is regenerated — the known-good version and
+ * crash counter are preserved so the stability timer remains the sole authority
+ * for promoting a version to "known good."
+ */
+export async function installWatchdog(params) {
+    const { stateDir, currentVersion, threshold } = params;
+    const dir = resolveWatchdogDir(stateDir);
+    await fs.mkdir(dir, { recursive: true });
+    // Always regenerate the startup check script (picks up any logic changes).
+    const scriptPath = resolveStartupCheckScriptPath(stateDir);
+    const content = buildStartupCheckScript({ stateDir, threshold });
+    await fs.writeFile(scriptPath, content, { mode: 0o755 });
+    // Only set baseline known-good + reset counter on first install.
+    // On updates, the stability timer (60s) promotes the new version.
+    const existingKnownGood = await readKnownGoodVersion(stateDir);
+    if (existingKnownGood === null) {
+        await writeKnownGoodVersion(stateDir, currentVersion);
+        await resetCrashCount(stateDir);
+    }
+    return { scriptPath };
+}

package/dist/gateway/server-methods/update.js

@@ -5,6 +5,7 @@ import { formatDoctorNonInteractiveHint, readRestartSentinel, writeRestartSentin
 import { checkUpdateStatus, compareSemverStrings } from "../../infra/update-check.js";
 import { normalizeUpdateChannel, resolveEffectiveUpdateChannel, } from "../../infra/update-channels.js";
 import { runGatewayUpdate } from "../../infra/update-runner.js";
+import { refreshSystemdServiceUnit } from "../../daemon/systemd.js";
 import { VERSION } from "../../version.js";
 import { ErrorCodes, errorShape, formatValidationErrors, validateUpdateRunParams, } from "../protocol/index.js";
 let lastUpdateResult = null;
@@ -228,15 +229,32 @@ export const updateHandlers = {
         const isGlobalInstall = result.mode === "npm" || result.mode === "pnpm" || result.mode === "bun";
         let restart;
         if (isGlobalInstall && result.status === "ok") {
-            // Respond first, then trigger full daemon restart after a short delay
+            // Respond first, then refresh the systemd unit (adds watchdog directives
+            // if missing) and trigger a full daemon restart after a short delay.
             const delayMs = restartDelayMs ?? 2000;
+            const afterVersion = result.after?.version ?? undefined;
             setTimeout(() => {
-                const attempt = triggerTaskmasterRestart();
-                if (!attempt.ok) {
-                    log.error(`daemon restart failed: ${attempt.detail ?? "unknown"}`);
-                    // Fall back to in-process restart
-                    scheduleGatewaySigusr1Restart({ delayMs: 0, reason: "update.run (fallback)" });
-                }
+                void (async () => {
+                    try {
+                        const refreshed = await refreshSystemdServiceUnit({
+                            env: process.env,
+                            version: typeof afterVersion === "string" ? afterVersion : undefined,
+                        });
+                        if (refreshed.refreshed) {
+                            log.info("refreshed systemd unit with watchdog directives");
+                        }
+                    }
+                    catch {
+                        // Non-critical — unit file just won't have watchdog directives
+                        // until the next `daemon install --force`.
+                    }
+                    const attempt = triggerTaskmasterRestart();
+                    if (!attempt.ok) {
+                        log.error(`daemon restart failed: ${attempt.detail ?? "unknown"}`);
+                        // Fall back to in-process restart
+                        scheduleGatewaySigusr1Restart({ delayMs: 0, reason: "update.run (fallback)" });
+                    }
+                })();
             }, delayMs);
             restart = { ok: true };
         }

package/dist/gateway/server-watchdog.js

@@ -0,0 +1,70 @@
+import { resolveStateDir } from "../config/paths.js";
+import { refreshSystemdServiceUnit } from "../daemon/systemd.js";
+import { resolveWatchdogDir, resetCrashCount, writeKnownGoodVersion } from "../daemon/watchdog.js";
+import { VERSION } from "../version.js";
+import fs from "node:fs/promises";
+/** How long the gateway must run before we consider it stable. */
+const STABILITY_WINDOW_MS = 60_000;
+/**
+ * Schedule the watchdog stability confirmation.
+ *
+ * After running for 60 seconds without crashing, we:
+ * 1. Reset the crash counter to 0
+ * 2. Update the known-good version to the current version
+ *
+ * If the watchdog directory does not exist (e.g., macOS, or daemon not
+ * installed via systemd), this is a no-op.
+ *
+ * Returns a cleanup function that cancels the timer.
+ */
+export function scheduleWatchdogStabilityConfirmation(params) {
+    const stateDir = resolveStateDir();
+    const watchdogDir = resolveWatchdogDir(stateDir);
+    const timer = setTimeout(() => {
+        void (async () => {
+            // Only act if the watchdog directory exists (installed via systemd).
+            try {
+                await fs.access(watchdogDir);
+            }
+            catch {
+                return;
+            }
+            try {
+                await resetCrashCount(stateDir);
+                await writeKnownGoodVersion(stateDir, VERSION);
+                params.log.info(`watchdog: stable for ${STABILITY_WINDOW_MS / 1000}s — marked v${VERSION} as known-good`);
+            }
+            catch {
+                // Non-critical — worst case the counter stays at 1 and known-good
+                // version isn't updated, which is safe.
+            }
+        })();
+    }, STABILITY_WINDOW_MS);
+    return () => clearTimeout(timer);
+}
+/**
+ * Ensure the systemd unit file has watchdog directives.
+ *
+ * Handles the transition case: when old code (pre-watchdog) updated to new
+ * code, the unit file was not regenerated. This fire-and-forget call on
+ * startup detects the missing directives and adds them via daemon-reload.
+ * The directives take effect on the next restart.
+ *
+ * No-op on non-Linux platforms or when the unit already has the directives.
+ */
+export function ensureWatchdogUnitOnStartup(params) {
+    void (async () => {
+        try {
+            const result = await refreshSystemdServiceUnit({
+                env: process.env,
+                version: VERSION,
+            });
+            if (result.refreshed) {
+                params.log.info("watchdog: refreshed systemd unit with watchdog directives");
+            }
+        }
+        catch {
+            // Non-critical — unit stays as-is until next `daemon install --force`.
+        }
+    })();
+}

package/dist/gateway/server.impl.js

@@ -48,6 +48,7 @@ import { hasConnectedMobileNode } from "./server-mobile-nodes.js";
 import { resolveSessionKeyForRun } from "./server-session-key.js";
 import { startGatewaySidecars } from "./server-startup.js";
 import { logGatewayStartup } from "./server-startup-log.js";
+import { ensureWatchdogUnitOnStartup, scheduleWatchdogStabilityConfirmation, } from "./server-watchdog.js";
 import { startGatewayTailscaleExposure } from "./server-tailscale.js";
 import { loadGatewayTlsRuntime } from "./server/tls.js";
 import { createWizardSessionTracker } from "./server-wizard-sessions.js";
@@ -399,6 +400,8 @@ export async function startGatewayServer(port = 18789, opts = {}) {
         isNixMode,
     });
     scheduleGatewayUpdateCheck({ cfg: cfgAtStart, log, isNixMode });
+    const cancelWatchdogStability = scheduleWatchdogStabilityConfirmation({ log });
+    ensureWatchdogUnitOnStartup({ log });
     const tailscaleCleanup = await startGatewayTailscaleExposure({
         tailscaleMode,
         resetOnExit: tailscaleConfig.resetOnExit,
@@ -502,6 +505,7 @@ export async function startGatewayServer(port = 18789, opts = {}) {
                 stopDiagnosticHeartbeat();
             }
             stopLicenseRevalidation();
+            cancelWatchdogStability();
             if (skillsRefreshTimer) {
                 clearTimeout(skillsRefreshTimer);
                 skillsRefreshTimer = null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/taskmaster",
-  "version": "1.0.71",
+  "version": "1.0.73",
   "description": "AI-powered business assistant for small businesses",
   "publishConfig": {
     "access": "public"
@@ -77,12 +77,66 @@
     "dist/filler/**",
     "dist/license/**"
   ],
+  "scripts": {
+    "dev": "node scripts/run-node.mjs",
+    "postinstall": "node scripts/postinstall.js",
+    "prepack": "pnpm build && pnpm ui:build",
+    "docs:list": "node scripts/docs-list.js",
+    "docs:bin": "node scripts/build-docs-list.mjs",
+    "docs:dev": "cd docs && mint dev",
+    "docs:build": "cd docs && pnpm dlx --reporter append-only mint broken-links",
+    "build": "tsc -p tsconfig.json && node --import tsx scripts/canvas-a2ui-copy.ts && node --import tsx scripts/copy-hook-metadata.ts && node --import tsx scripts/write-build-info.ts",
+    "plugins:sync": "node --import tsx scripts/sync-plugin-versions.ts",
+    "release:check": "node --import tsx scripts/release-check.ts",
+    "ui:install": "node scripts/ui.js install",
+    "ui:dev": "node scripts/ui.js dev",
+    "ui:build": "node scripts/ui.js build",
+    "start": "node scripts/run-node.mjs",
+    "taskmaster": "node scripts/run-node.mjs",
+    "gateway:watch": "node scripts/watch-node.mjs gateway --force",
+    "logs": "npx tsx scripts/session-viewer.ts",
+    "gateway:dev": "TASKMASTER_SKIP_CHANNELS=1 node scripts/run-node.mjs --dev gateway",
+    "gateway:dev:reset": "TASKMASTER_SKIP_CHANNELS=1 node scripts/run-node.mjs --dev gateway --reset",
+    "tui": "node scripts/run-node.mjs tui",
+    "tui:dev": "TASKMASTER_PROFILE=dev node scripts/run-node.mjs tui",
+    "taskmaster:rpc": "node scripts/run-node.mjs agent --mode rpc --json",
+    "lint": "oxlint --type-aware src test",
+    "lint:fix": "pnpm format:fix && oxlint --type-aware --fix src test",
+    "format": "oxfmt --check src test",
+    "format:fix": "oxfmt --write src test",
+    "test": "node scripts/test-parallel.mjs",
+    "test:watch": "vitest",
+    "test:ui": "pnpm --dir ui test",
+    "test:force": "node --import tsx scripts/test-force.ts",
+    "test:coverage": "vitest run --coverage",
+    "test:e2e": "vitest run --config vitest.e2e.config.ts",
+    "test:live": "TASKMASTER_LIVE_TEST=1 vitest run --config vitest.live.config.ts",
+    "test:docker:onboard": "bash scripts/e2e/onboard-docker.sh",
+    "test:docker:gateway-network": "bash scripts/e2e/gateway-network-docker.sh",
+    "test:docker:live-models": "bash scripts/test-live-models-docker.sh",
+    "test:docker:live-gateway": "bash scripts/test-live-gateway-models-docker.sh",
+    "test:docker:qr": "bash scripts/e2e/qr-import-docker.sh",
+    "test:docker:doctor-switch": "bash scripts/e2e/doctor-install-switch-docker.sh",
+    "test:docker:plugins": "bash scripts/e2e/plugins-docker.sh",
+    "test:docker:cleanup": "bash scripts/test-cleanup-docker.sh",
+    "test:docker:all": "pnpm test:docker:live-models && pnpm test:docker:live-gateway && pnpm test:docker:onboard && pnpm test:docker:gateway-network && pnpm test:docker:qr && pnpm test:docker:doctor-switch && pnpm test:docker:plugins && pnpm test:docker:cleanup",
+    "test:all": "pnpm lint && pnpm build && pnpm test && pnpm test:e2e && pnpm test:live && pnpm test:docker:all",
+    "test:install:e2e": "bash scripts/test-install-sh-e2e-docker.sh",
+    "test:install:smoke": "bash scripts/test-install-sh-docker.sh",
+    "test:install:e2e:openai": "TASKMASTER_E2E_MODELS=openai bash scripts/test-install-sh-e2e-docker.sh",
+    "test:install:e2e:anthropic": "TASKMASTER_E2E_MODELS=anthropic bash scripts/test-install-sh-e2e-docker.sh",
+    "protocol:gen": "node --import tsx scripts/protocol-gen.ts",
+    "protocol:check": "pnpm protocol:gen && git diff --exit-code -- dist/protocol.schema.json",
+    "canvas:a2ui:bundle": "bash scripts/bundle-a2ui.sh",
+    "check:loc": "node --import tsx scripts/check-ts-max-loc.ts --max 500"
+  },
   "keywords": [],
   "author": "",
   "license": "MIT",
   "engines": {
     "node": ">=22.12.0"
   },
+  "packageManager": "pnpm@10.23.0",
   "dependencies": {
     "@agentclientprotocol/sdk": "0.13.1",
     "@aws-sdk/client-bedrock": "^3.975.0",
@@ -172,6 +226,14 @@
     "vitest": "^4.0.18",
     "wireit": "^0.14.12"
   },
+  "pnpm": {
+    "minimumReleaseAge": 2880,
+    "overrides": {
+      "@sinclair/typebox": "0.34.47",
+      "hono": "4.11.4",
+      "tar": "7.5.4"
+    }
+  },
   "vitest": {
     "coverage": {
       "provider": "v8",
@@ -200,57 +262,5 @@
       "**/vendor/**",
       "dist/Taskmaster.app/**"
     ]
-  },
-  "scripts": {
-    "dev": "node scripts/run-node.mjs",
-    "postinstall": "node scripts/postinstall.js",
-    "docs:list": "node scripts/docs-list.js",
-    "docs:bin": "node scripts/build-docs-list.mjs",
-    "docs:dev": "cd docs && mint dev",
-    "docs:build": "cd docs && pnpm dlx --reporter append-only mint broken-links",
-    "build": "tsc -p tsconfig.json && node --import tsx scripts/canvas-a2ui-copy.ts && node --import tsx scripts/copy-hook-metadata.ts && node --import tsx scripts/write-build-info.ts",
-    "plugins:sync": "node --import tsx scripts/sync-plugin-versions.ts",
-    "release:check": "node --import tsx scripts/release-check.ts",
-    "ui:install": "node scripts/ui.js install",
-    "ui:dev": "node scripts/ui.js dev",
-    "ui:build": "node scripts/ui.js build",
-    "start": "node scripts/run-node.mjs",
-    "taskmaster": "node scripts/run-node.mjs",
-    "gateway:watch": "node scripts/watch-node.mjs gateway --force",
-    "logs": "npx tsx scripts/session-viewer.ts",
-    "gateway:dev": "TASKMASTER_SKIP_CHANNELS=1 node scripts/run-node.mjs --dev gateway",
-    "gateway:dev:reset": "TASKMASTER_SKIP_CHANNELS=1 node scripts/run-node.mjs --dev gateway --reset",
-    "tui": "node scripts/run-node.mjs tui",
-    "tui:dev": "TASKMASTER_PROFILE=dev node scripts/run-node.mjs tui",
-    "taskmaster:rpc": "node scripts/run-node.mjs agent --mode rpc --json",
-    "lint": "oxlint --type-aware src test",
-    "lint:fix": "pnpm format:fix && oxlint --type-aware --fix src test",
-    "format": "oxfmt --check src test",
-    "format:fix": "oxfmt --write src test",
-    "test": "node scripts/test-parallel.mjs",
-    "test:watch": "vitest",
-    "test:ui": "pnpm --dir ui test",
-    "test:force": "node --import tsx scripts/test-force.ts",
-    "test:coverage": "vitest run --coverage",
-    "test:e2e": "vitest run --config vitest.e2e.config.ts",
-    "test:live": "TASKMASTER_LIVE_TEST=1 vitest run --config vitest.live.config.ts",
-    "test:docker:onboard": "bash scripts/e2e/onboard-docker.sh",
-    "test:docker:gateway-network": "bash scripts/e2e/gateway-network-docker.sh",
-    "test:docker:live-models": "bash scripts/test-live-models-docker.sh",
-    "test:docker:live-gateway": "bash scripts/test-live-gateway-models-docker.sh",
-    "test:docker:qr": "bash scripts/e2e/qr-import-docker.sh",
-    "test:docker:doctor-switch": "bash scripts/e2e/doctor-install-switch-docker.sh",
-    "test:docker:plugins": "bash scripts/e2e/plugins-docker.sh",
-    "test:docker:cleanup": "bash scripts/test-cleanup-docker.sh",
-    "test:docker:all": "pnpm test:docker:live-models && pnpm test:docker:live-gateway && pnpm test:docker:onboard && pnpm test:docker:gateway-network && pnpm test:docker:qr && pnpm test:docker:doctor-switch && pnpm test:docker:plugins && pnpm test:docker:cleanup",
-    "test:all": "pnpm lint && pnpm build && pnpm test && pnpm test:e2e && pnpm test:live && pnpm test:docker:all",
-    "test:install:e2e": "bash scripts/test-install-sh-e2e-docker.sh",
-    "test:install:smoke": "bash scripts/test-install-sh-docker.sh",
-    "test:install:e2e:openai": "TASKMASTER_E2E_MODELS=openai bash scripts/test-install-sh-e2e-docker.sh",
-    "test:install:e2e:anthropic": "TASKMASTER_E2E_MODELS=anthropic bash scripts/test-install-sh-e2e-docker.sh",
-    "protocol:gen": "node --import tsx scripts/protocol-gen.ts",
-    "protocol:check": "pnpm protocol:gen && git diff --exit-code -- dist/protocol.schema.json",
-    "canvas:a2ui:bundle": "bash scripts/bundle-a2ui.sh",
-    "check:loc": "node --import tsx scripts/check-ts-max-loc.ts --max 500"
   }
-}
+}

package/taskmaster-docs/USER-GUIDE.md

@@ -1121,6 +1121,50 @@ You need the IP address to connect from another device on your network (e.g., SS
 
 Once you have the IP, you can access the setup page at `http://<your-pi-ip>:18789/setup` or connect via SSH with `ssh admin@<your-pi-ip>`.
 
+### Enabling SSH on Your Pi
+
+SSH lets you connect to your Pi from another computer on the same network — no monitor or keyboard needed. Raspberry Pi OS has SSH turned off by default. To enable it:
+
+**Option 1: From the Pi desktop** (monitor + keyboard)
+
+1. Click the **Raspberry Pi menu** (top-left corner of the desktop)
+2. Go to **Preferences** → **Raspberry Pi Configuration**
+3. Click the **Interfaces** tab
+4. Set **SSH** to **Enabled**
+5. Click **OK**
+
+**Option 2: From the Pi terminal**
+
+1. Open Terminal (taskbar or Ctrl+Alt+T)
+2. Run:
+   ```
+   sudo systemctl enable --now ssh
+   ```
+
+**Option 3: Before first boot** (headless setup — no monitor needed)
+
+If you're setting up the Pi using Raspberry Pi Imager:
+
+1. In Raspberry Pi Imager, click the **gear icon** (or press Ctrl+Shift+X) before writing the SD card
+2. Check **Enable SSH** and set a password
+3. Write the SD card and boot the Pi
+
+Or, if the SD card is already written:
+
+1. Insert the SD card into your computer
+2. Create an empty file called `ssh` (no extension) in the **boot** partition
+3. Eject the card and boot the Pi
+
+**After enabling SSH**, connect from another computer:
+
+```
+ssh admin@taskmaster.local
+```
+
+Enter the password when prompted. The default password depends on how the Pi was set up — typically `taskmaster` for pre-installed devices, or whatever you chose during Raspberry Pi OS setup.
+
+> **Security tip:** Change the default password after your first SSH login by running `passwd` on the Pi.
+
 ---
 
 ## Public-Facing Messages (DM Policy)
@@ -1263,6 +1307,12 @@ If something goes wrong during the update:
 
 If the page loses connection during the update and doesn't reconnect within two minutes, refresh the page manually. If the gateway doesn't come back, try power-cycling your device (unplug and replug).
 
+### Automatic Recovery from Bad Updates
+
+On Raspberry Pi and Linux devices, Taskmaster includes an automatic safety net. If an update installs a version that crashes on startup, the system detects the crash loop and automatically rolls back to the previous working version. You don't need to do anything — the rollback happens on its own and the dashboard comes back online within about 30 seconds.
+
+After an automatic rollback, a banner on the Setup page shows what happened (e.g., "Auto-rollback to v1.0.70 after 3 consecutive startup failures"). You can try updating again later — the issue may be fixed in a newer version.
+
 > **Note:** Updates require an internet connection. The update process typically takes 30–60 seconds. Your assistant will be briefly unavailable during the restart.
 
 ---

package/templates/taskmaster/.gitignore

@@ -1 +0,0 @@
-.DS_Store