beecork 1.5.0 → 1.7.0

package/dist/session/pending-dispatcher.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Polls `pending_messages` and dispatches each row by type.
+ *
+ * Replaces the inline `processPendingMessages` block that previously lived in
+ * TabManager. Two functional changes from that code:
+ *
+ *  1. Claim-before-dispatch (status='processing' set atomically before send).
+ *     The original poll-every-5s code re-picked the same row on every tick
+ *     while its dispatch was in flight — long Claude runs could re-fire the
+ *     same prompt many times.
+ *
+ *  2. Branch on type. The original consumer only recognized 'notification' and
+ *     fell through to "send as plain user prompt" for everything else, which
+ *     meant `type='media'` rows were handed to Claude as raw JSON and never
+ *     actually delivered to channels.
+ */
+import type { TabManager } from './manager.js';
+import type { ChannelRegistry } from '../channels/registry.js';
+export type NotifyFn = ((text: string) => Promise<void>) | null;
+export declare class PendingMessageDispatcher {
+    private tabManager;
+    private channels;
+    private onNotify;
+    private pollCount;
+    constructor(tabManager: TabManager, channels: ChannelRegistry, onNotify: NotifyFn);
+    /** Reset any rows stuck in 'processing' from a previous daemon run. */
+    recoverOnStart(): void;
+    /** Called on every daemon poll tick. */
+    tick(): void;
+    private dispatch;
+}

package/dist/session/pending-dispatcher.js

@@ -0,0 +1,120 @@
+/**
+ * Polls `pending_messages` and dispatches each row by type.
+ *
+ * Replaces the inline `processPendingMessages` block that previously lived in
+ * TabManager. Two functional changes from that code:
+ *
+ *  1. Claim-before-dispatch (status='processing' set atomically before send).
+ *     The original poll-every-5s code re-picked the same row on every tick
+ *     while its dispatch was in flight — long Claude runs could re-fire the
+ *     same prompt many times.
+ *
+ *  2. Branch on type. The original consumer only recognized 'notification' and
+ *     fell through to "send as plain user prompt" for everything else, which
+ *     meant `type='media'` rows were handed to Claude as raw JSON and never
+ *     actually delivered to channels.
+ */
+import { getDb } from '../db/index.js';
+import { logger } from '../util/logger.js';
+import { PendingMessageStore } from './pending-store.js';
+const POLL_LIMIT = 50;
+const CLEANUP_EVERY_N_TICKS = 100;
+export class PendingMessageDispatcher {
+    tabManager;
+    channels;
+    onNotify;
+    pollCount = 0;
+    constructor(tabManager, channels, onNotify) {
+        this.tabManager = tabManager;
+        this.channels = channels;
+        this.onNotify = onNotify;
+    }
+    /** Reset any rows stuck in 'processing' from a previous daemon run. */
+    recoverOnStart() {
+        PendingMessageStore.recoverProcessing();
+    }
+    /** Called on every daemon poll tick. */
+    tick() {
+        const db = getDb();
+        this.pollCount++;
+        if (this.pollCount % CLEANUP_EVERY_N_TICKS === 0) {
+            db.prepare("DELETE FROM pending_messages WHERE (status = 'done' OR status = 'failed') AND created_at < datetime('now', '-1 day')").run();
+        }
+        const claimed = PendingMessageStore.claimBatch(POLL_LIMIT, db);
+        for (const row of claimed) {
+            // Fire-and-forget per row — the row is already marked 'processing' so
+            // the next tick won't double-dispatch. The .finally() handles the
+            // terminal transition.
+            void this.dispatch(row);
+        }
+    }
+    async dispatch(row) {
+        try {
+            switch (row.type) {
+                case 'notification':
+                    await this.onNotify?.(row.message);
+                    break;
+                case 'media': {
+                    const payload = PendingMessageStore.parseMediaPayload(row.message);
+                    if (!payload) {
+                        logger.warn(`Pending media row ${row.id} has malformed payload, skipping`);
+                        break;
+                    }
+                    const attachment = inferAttachmentType(payload.filePath, payload.caption);
+                    await this.channels.broadcastMedia(attachment);
+                    break;
+                }
+                case 'user':
+                case 'delegation':
+                case 'delegation_result':
+                case 'replay': {
+                    if (!row.tabName) {
+                        logger.warn(`Pending row ${row.id} (type=${row.type}) has no tab_name, skipping`);
+                        break;
+                    }
+                    await this.tabManager.sendMessage(row.tabName, row.message);
+                    break;
+                }
+                default: {
+                    // Unknown discriminant — log and bail rather than fall through to
+                    // "send as a plain prompt" (which is how H5 ended up shipping).
+                    logger.warn(`Pending row ${row.id} has unknown type "${row.type}", marking failed`);
+                    PendingMessageStore.markFailed(row.id);
+                    return;
+                }
+            }
+            PendingMessageStore.markDone(row.id);
+        }
+        catch (err) {
+            logger.error(`Failed to process pending message ${row.id} (type=${row.type}):`, err);
+            await this.onNotify?.(`Pending message ${row.type === 'notification' ? '' : `for tab "${row.tabName}"`} failed: ${err instanceof Error ? err.message : String(err)}`).catch(() => { });
+            PendingMessageStore.markFailed(row.id);
+        }
+    }
+}
+/**
+ * Heuristic: derive a MediaAttachment from a file path so the channel's
+ * broadcastMedia knows whether to send as voice / image / video / document.
+ */
+function inferAttachmentType(filePath, caption) {
+    const ext = filePath.split('.').pop()?.toLowerCase() ?? '';
+    let type = 'document';
+    let mimeType = 'application/octet-stream';
+    if (['png', 'jpg', 'jpeg', 'gif', 'webp'].includes(ext)) {
+        type = 'image';
+        mimeType = `image/${ext === 'jpg' ? 'jpeg' : ext}`;
+    }
+    else if (['mp4', 'mov', 'webm', 'mkv'].includes(ext)) {
+        type = 'video';
+        mimeType = `video/${ext === 'mov' ? 'quicktime' : ext}`;
+    }
+    else if (['ogg', 'opus', 'oga'].includes(ext)) {
+        type = 'voice';
+        mimeType = 'audio/ogg';
+    }
+    else if (['mp3', 'm4a', 'wav', 'flac', 'aac'].includes(ext)) {
+        type = 'audio';
+        mimeType = `audio/${ext}`;
+    }
+    return { type, mimeType, filePath, caption };
+}

package/dist/session/pending-store.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Inter-process IPC store for the `pending_messages` table.
+ *
+ * Beecork uses this table as a shared queue between writers (MCP handlers,
+ * dashboard routes, watchers, delegations) and the daemon's poll loop. Before
+ * this module the writes were inline `INSERT INTO pending_messages` calls
+ * scattered across nine sites; the consumer in TabManager only branched on
+ * type='notification' which meant every other type fell through to "send as
+ * a plain user prompt" — including `type='media'` rows whose JSON envelope
+ * was being handed to Claude as text instead of being rendered.
+ *
+ * This store owns:
+ *   - the typed envelope (`PendingMessageType` union, no more magic strings)
+ *   - 3-state status (`pending` → `processing` → `done|failed`) so the 5s
+ *     poll loop doesn't re-dispatch long-running rows
+ *   - the `_notify` sentinel removal (notifications now use type alone,
+ *     tab_name is nullable)
+ *   - claim/recover semantics so a daemon crash mid-dispatch resets in-flight
+ *     rows back to pending after a 30-minute timeout
+ */
+import type Database from 'better-sqlite3';
+export type PendingMessageType = 'user' | 'notification' | 'media' | 'delegation' | 'delegation_result' | 'replay';
+export interface PendingRow {
+    id: number;
+    tabName: string | null;
+    message: string;
+    type: PendingMessageType;
+    status: 'pending' | 'processing' | 'done' | 'failed';
+    createdAt: string;
+}
+interface MediaPayload {
+    type: 'media';
+    filePath: string;
+    caption?: string;
+}
+export declare const PendingMessageStore: {
+    enqueueUser(tabName: string, message: string, db?: Database.Database): void;
+    enqueueNotification(message: string, db?: Database.Database): void;
+    enqueueMedia(tabName: string, payload: MediaPayload, db?: Database.Database): void;
+    enqueueDelegation(tabName: string, message: string, db?: Database.Database): void;
+    enqueueDelegationResult(tabName: string, message: string, db?: Database.Database): void;
+    enqueueReplay(tabName: string, message: string, db?: Database.Database): void;
+    /**
+     * Claim up to `limit` pending rows atomically. The rows are flipped to
+     * status='processing' inside a transaction so a second poll tick can't pick
+     * them up. Returns the claimed rows.
+     */
+    claimBatch(limit: number, db?: Database.Database): PendingRow[];
+    markDone(id: number, db?: Database.Database): void;
+    markFailed(id: number, db?: Database.Database): void;
+    /**
+     * Reset stuck `processing` rows back to `pending`. Run at daemon startup so
+     * a crash mid-dispatch doesn't leave rows permanently in-flight. The 30min
+     * window is well beyond the 30min subprocess runtime cap.
+     */
+    recoverProcessing(db?: Database.Database): number;
+    /** Parse a media row's message JSON. Returns null on malformed JSON. */
+    parseMediaPayload(message: string): MediaPayload | null;
+};
+export {};

package/dist/session/pending-store.js

@@ -0,0 +1,118 @@
+/**
+ * Inter-process IPC store for the `pending_messages` table.
+ *
+ * Beecork uses this table as a shared queue between writers (MCP handlers,
+ * dashboard routes, watchers, delegations) and the daemon's poll loop. Before
+ * this module the writes were inline `INSERT INTO pending_messages` calls
+ * scattered across nine sites; the consumer in TabManager only branched on
+ * type='notification' which meant every other type fell through to "send as
+ * a plain user prompt" — including `type='media'` rows whose JSON envelope
+ * was being handed to Claude as text instead of being rendered.
+ *
+ * This store owns:
+ *   - the typed envelope (`PendingMessageType` union, no more magic strings)
+ *   - 3-state status (`pending` → `processing` → `done|failed`) so the 5s
+ *     poll loop doesn't re-dispatch long-running rows
+ *   - the `_notify` sentinel removal (notifications now use type alone,
+ *     tab_name is nullable)
+ *   - claim/recover semantics so a daemon crash mid-dispatch resets in-flight
+ *     rows back to pending after a 30-minute timeout
+ */
+import { getDb } from '../db/index.js';
+import { logger } from '../util/logger.js';
+function rowToPending(r) {
+    return {
+        id: r.id,
+        tabName: r.tab_name,
+        message: r.message,
+        type: r.type || 'user',
+        status: r.status || 'pending',
+        createdAt: r.created_at,
+    };
+}
+const STALE_PROCESSING_MS = 30 * 60 * 1000; // 30 minutes
+// Private INSERT helper — all five enqueue* methods were the same INSERT with
+// different literals. Notification rows use '' for tab_name since the consumer
+// branches on type rather than reading the tab.
+function insertPending(db, tabName, message, type) {
+    db.prepare('INSERT INTO pending_messages (tab_name, message, type, status) VALUES (?, ?, ?, ?)').run(tabName, message, type, 'pending');
+}
+export const PendingMessageStore = {
+    enqueueUser(tabName, message, db = getDb()) {
+        insertPending(db, tabName, message, 'user');
+    },
+    enqueueNotification(message, db = getDb()) {
+        insertPending(db, '', message, 'notification');
+    },
+    enqueueMedia(tabName, payload, db = getDb()) {
+        insertPending(db, tabName, JSON.stringify(payload), 'media');
+    },
+    enqueueDelegation(tabName, message, db = getDb()) {
+        insertPending(db, tabName, message, 'delegation');
+    },
+    enqueueDelegationResult(tabName, message, db = getDb()) {
+        insertPending(db, tabName, message, 'delegation_result');
+    },
+    enqueueReplay(tabName, message, db = getDb()) {
+        insertPending(db, tabName, message, 'replay');
+    },
+    /**
+     * Claim up to `limit` pending rows atomically. The rows are flipped to
+     * status='processing' inside a transaction so a second poll tick can't pick
+     * them up. Returns the claimed rows.
+     */
+    claimBatch(limit, db = getDb()) {
+        const claim = db.transaction((max) => {
+            const rows = db
+                .prepare("SELECT id, tab_name, message, type, status, created_at FROM pending_messages WHERE status = 'pending' ORDER BY created_at ASC LIMIT ?")
+                .all(max);
+            if (rows.length === 0)
+                return [];
+            const stmt = db.prepare("UPDATE pending_messages SET status = 'processing' WHERE id = ? AND status = 'pending'");
+            const claimed = [];
+            for (const r of rows) {
+                const result = stmt.run(r.id);
+                if (result.changes > 0)
+                    claimed.push(rowToPending(r));
+            }
+            return claimed;
+        });
+        return claim(limit);
+    },
+    markDone(id, db = getDb()) {
+        db.prepare("UPDATE pending_messages SET status = 'done', processed = 1 WHERE id = ?").run(id);
+    },
+    markFailed(id, db = getDb()) {
+        // 'failed' rows are kept for diagnostics until the periodic cleanup sweeps
+        // them. They are NOT re-dispatched — preserves the original "no infinite
+        // retries" policy while keeping the row visible for postmortem queries.
+        db.prepare("UPDATE pending_messages SET status = 'failed', processed = 1 WHERE id = ?").run(id);
+    },
+    /**
+     * Reset stuck `processing` rows back to `pending`. Run at daemon startup so
+     * a crash mid-dispatch doesn't leave rows permanently in-flight. The 30min
+     * window is well beyond the 30min subprocess runtime cap.
+     */
+    recoverProcessing(db = getDb()) {
+        const result = db
+            .prepare(`UPDATE pending_messages SET status = 'pending'
+       WHERE status = 'processing' AND created_at < datetime('now', '-' || ? || ' seconds')`)
+            .run(Math.floor(STALE_PROCESSING_MS / 1000));
+        if (result.changes > 0) {
+            logger.warn(`Recovered ${result.changes} stuck pending_messages rows from 'processing' state`);
+        }
+        return result.changes;
+    },
+    /** Parse a media row's message JSON. Returns null on malformed JSON. */
+    parseMediaPayload(message) {
+        try {
+            const parsed = JSON.parse(message);
+            if (parsed?.type === 'media' && typeof parsed.filePath === 'string')
+                return parsed;
+            return null;
+        }
+        catch {
+            return null;
+        }
+    },
+};

package/dist/session/stale-session.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Detection + recovery for "Claude Code session not found / expired" errors.
+ *
+ * Extracted from TabManager.executeMessage so the two responsibilities
+ * (recognize the symptom, build the recovery prompt) live in one focused
+ * module instead of tangled inline with the subprocess callbacks.
+ */
+import type Database from 'better-sqlite3';
+import type { StreamResult } from '../types.js';
+import type { SendResult } from './manager.js';
+export interface StaleSessionRecovery {
+    newSessionId: string;
+    /** A prompt that wraps the original enrichedPrompt with the last few messages
+     * for context, since Claude Code lost the session and won't have any. */
+    contextPrompt: string;
+}
+export declare const StaleSessionDetector: {
+    /**
+     * Was this result an "I can't resume that session" failure?
+     *
+     * Covers both the legacy text-based error and the modern
+     * `error_during_execution` event shape.
+     */
+    isStale(result: SendResult, resultEvent: StreamResult | null, shouldResume: boolean, retryDepth: number): boolean;
+    /**
+     * Build a recovery prompt seeded with the tab's last 5 messages as context,
+     * and allocate a fresh session ID. Caller is responsible for updating the
+     * tab's session_id in the DB before retrying.
+     */
+    buildRecovery(tabId: string, enrichedPrompt: string, db: Database.Database): StaleSessionRecovery;
+};

package/dist/session/stale-session.js

@@ -0,0 +1,45 @@
+/**
+ * Detection + recovery for "Claude Code session not found / expired" errors.
+ *
+ * Extracted from TabManager.executeMessage so the two responsibilities
+ * (recognize the symptom, build the recovery prompt) live in one focused
+ * module instead of tangled inline with the subprocess callbacks.
+ */
+import { v4 as uuidv4 } from 'uuid';
+export const StaleSessionDetector = {
+    /**
+     * Was this result an "I can't resume that session" failure?
+     *
+     * Covers both the legacy text-based error and the modern
+     * `error_during_execution` event shape.
+     */
+    isStale(result, resultEvent, shouldResume, retryDepth) {
+        if (!result.error || !shouldResume || retryDepth !== 0)
+            return false;
+        if (/session (not found|expired|invalid)/i.test(result.text))
+            return true;
+        if (resultEvent?.subtype === 'error_during_execution' &&
+            resultEvent.errors?.some((e) => /no conversation found|session.*not found|session.*expired|session.*invalid/i.test(e))) {
+            return true;
+        }
+        return false;
+    },
+    /**
+     * Build a recovery prompt seeded with the tab's last 5 messages as context,
+     * and allocate a fresh session ID. Caller is responsible for updating the
+     * tab's session_id in the DB before retrying.
+     */
+    buildRecovery(tabId, enrichedPrompt, db) {
+        const recentMsgs = db
+            .prepare("SELECT role, content FROM messages WHERE tab_id = ? AND content != '' ORDER BY created_at DESC LIMIT 5")
+            .all(tabId);
+        const context = recentMsgs
+            .reverse()
+            .map((m) => `${m.role}: ${m.content.slice(0, 200)}`)
+            .join('\n');
+        const contextPrompt = context
+            ? `[Previous conversation context:\n${context}\n]\n\n${enrichedPrompt}`
+            : enrichedPrompt;
+        return { newSessionId: uuidv4(), contextPrompt };
+    },
+};

package/dist/session/subprocess.d.ts

@@ -1,4 +1,6 @@
 import type { BeecorkConfig, StreamEvent } from '../types.js';
+/** Test-only — reset the existsSync cache between test runs that toggle the mock. */
+export declare function _resetMcpConfigExistsCacheForTests(): void;
 export interface SubprocessCallbacks {
     onEvent: (event: StreamEvent) => void;
     onExit: (code: number | null) => void;

package/dist/session/subprocess.js

@@ -3,14 +3,27 @@ import fs from 'node:fs';
 import { v4 as uuidv4 } from 'uuid';
 import { logger } from '../util/logger.js';
 import { getMcpConfigPath } from '../util/paths.js';
+// Cache the MCP-config existence check. The file is created at setup time and
+// stable for the daemon's lifetime; we don't need to stat() it per spawn.
+let mcpConfigExistsCache = null;
+function mcpConfigExists() {
+    if (mcpConfigExistsCache !== null)
+        return mcpConfigExistsCache;
+    mcpConfigExistsCache = fs.existsSync(getMcpConfigPath());
+    return mcpConfigExistsCache;
+}
+/** Test-only — reset the existsSync cache between test runs that toggle the mock. */
+export function _resetMcpConfigExistsCacheForTests() {
+    mcpConfigExistsCache = null;
+}
 const BEECORK_SYSTEM_PROMPT = `You are running inside Beecork, an always-on infrastructure for Claude Code.
 
 You have these special MCP tools available:
 - beecork_remember: Store important facts for future sessions (preferences, server addresses, decisions, outcomes)
 - beecork_recall: Search stored memories — ALWAYS call this at the start of complex tasks
-- beecork_cron_create: Schedule recurring tasks (types: "at" for one-time, "every" for interval like "30m", "cron" for expressions like "0 9 * * 1")
-- beecork_cron_list: List scheduled tasks
-- beecork_cron_delete: Remove a scheduled task
+- beecork_task_create: Schedule recurring tasks (types: "at" for one-time, "every" for interval like "30m", "cron" for expressions like "0 9 * * 1")
+- beecork_task_list: List scheduled tasks
+- beecork_task_delete: Remove a scheduled task
 - beecork_tab_create: Create a new virtual tab for parallel work
 - beecork_tab_list: List all tabs
 - beecork_send_message: Send a message to another tab
@@ -21,7 +34,7 @@ Guidelines:
 - You are running unattended. Be thorough and complete tasks fully.
 - Always call beecork_recall at the start of any task to check relevant memories.
 - Always call beecork_remember when you learn something important.
-- When asked for recurring tasks, use beecork_cron_create.
+- When asked for recurring tasks, use beecork_task_create.
 - Use beecork_notify for progress updates during long tasks.`;
 export class ClaudeSubprocess {
     tabName;
@@ -73,7 +86,11 @@ export class ClaudeSubprocess {
         this.proc.stderr.on('data', (chunk) => {
             const text = chunk.toString().trim();
             if (text) {
-                logger.debug(`[${this.tabName}] stderr: ${text.slice(0, 500)}`);
+                // claude prints auth failures, rate limits, license issues, and other
+                // operational errors to stderr. Surface at warn so they reach daemon.log
+                // at the default level — debugging "why did claude exit?" otherwise
+                // requires recompiling with a different log level.
+                logger.warn(`[${this.tabName}] claude stderr: ${text.slice(0, 500)}`);
             }
         });
         this.proc.on('error', (err) => {
@@ -120,7 +137,9 @@ export class ClaudeSubprocess {
             try {
                 proc.kill('SIGKILL');
             }
-            catch { /* already dead */ }
+            catch {
+                /* already dead */
+            }
         }, 5000);
     }
     get isRunning() {
@@ -132,14 +151,17 @@ export class ClaudeSubprocess {
     buildArgs(prompt, resume) {
         const args = [
             '-p',
-            '--output-format', 'stream-json',
+            '--output-format',
+            'stream-json',
             '--verbose',
             ...this.config.claudeCode.defaultFlags,
         ];
-        // Only add MCP config if the file exists
-        const mcpConfig = getMcpConfigPath();
-        if (fs.existsSync(mcpConfig)) {
-            args.push('--mcp-config', mcpConfig);
+        // Only add MCP config if the file exists. existsSync result is cached at
+        // module scope — the path is stable for the daemon's lifetime, so doing
+        // this once-per-process saves a syscall per claude spawn (every message,
+        // every task firing, every watcher trigger).
+        if (mcpConfigExists()) {
+            args.push('--mcp-config', getMcpConfigPath());
         }
         // Inject Beecork system context so Claude knows about available tools
         if (!resume) {

package/dist/session/tab-store.js

@@ -48,8 +48,7 @@ export const TabStore = {
         return row ? rowToTab(row) : undefined;
     },
     setStatus(name, status, db = getDb()) {
-        db.prepare('UPDATE tabs SET status = ?, last_activity_at = ?, pid = NULL WHERE name = ?')
-            .run(status, new Date().toISOString(), name);
+        db.prepare('UPDATE tabs SET status = ?, last_activity_at = ?, pid = NULL WHERE name = ?').run(status, new Date().toISOString(), name);
     },
     setIdleById(id, db = getDb()) {
         db.prepare("UPDATE tabs SET status = 'idle', pid = NULL WHERE id = ?").run(id);
@@ -59,7 +58,9 @@ export const TabStore = {
         db.prepare("UPDATE tabs SET status = 'stopped', pid = NULL WHERE name = ? AND status = 'running'").run(name);
     },
     setSystemPrompt(name, systemPrompt, db = getDb()) {
-        const result = db.prepare('UPDATE tabs SET system_prompt = ? WHERE name = ?').run(systemPrompt, name);
+        const result = db
+            .prepare('UPDATE tabs SET system_prompt = ? WHERE name = ?')
+            .run(systemPrompt, name);
         return result.changes > 0;
     },
     /** Delete a tab and all of its messages atomically. Returns true if it existed. */

package/dist/tasks/scheduler.d.ts

@@ -6,6 +6,7 @@ export declare class TaskScheduler {
     private onNotify;
     private nextRunAt;
     private running;
+    private failureCounts;
     private stopping;
     private store;
     constructor(tabManager: TabManager, onNotify: NotifyCallback | null);
@@ -24,6 +25,12 @@ export declare class TaskScheduler {
     /** Compute next run time in ms epoch, given a "from" anchor. Returns null if invalid. */
     private computeNextRun;
     private fireJob;
+    /**
+     * Track consecutive failures per task. After MAX_CONSECUTIVE_FAILURES the
+     * task is auto-disabled in the DB and a single "auto-disabled" notification
+     * is sent. Counter resets on the next successful fire.
+     */
+    private recordFailure;
     private handleSystemEvent;
 }
 /** Convert human interval (30m, 2h, 1d, 1h30m, 2w) to milliseconds */

package/dist/tasks/scheduler.js

@@ -7,6 +7,12 @@ import { TaskStore } from './store.js';
 import { getCronReloadSignalPath, getLogsDir } from '../util/paths.js';
 import { logger } from '../util/logger.js';
 export const execAsync = promisify(exec);
+/**
+ * Disable a task after this many consecutive failures so a misconfigured
+ * cron doesn't fire (and notify) every interval indefinitely. Reset on
+ * success.
+ */
+const MAX_CONSECUTIVE_FAILURES = 5;
 export class TaskScheduler {
     tabManager;
     onNotify;
@@ -14,6 +20,8 @@ export class TaskScheduler {
     nextRunAt = new Map();
     // taskIds with an in-flight fireJob
     running = new Set();
+    // taskId -> consecutive failure count, used for auto-disable
+    failureCounts = new Map();
     stopping = false;
     store = new TaskStore();
     constructor(tabManager, onNotify) {
@@ -69,7 +77,9 @@ export class TaskScheduler {
             try {
                 fs.unlinkSync(signalPath);
             }
-            catch { /* race condition, ok */ }
+            catch {
+                /* race condition, ok */
+            }
             logger.info('Tasks: reload signal detected, reloading schedules');
             this.loadAndSchedule();
         }
@@ -124,11 +134,15 @@ export class TaskScheduler {
         try {
             switch (job.scheduleType) {
                 case 'cron':
-                    return CronExpressionParser.parse(job.schedule, { currentDate: new Date(fromMs) }).next().getTime();
+                    return CronExpressionParser.parse(job.schedule, { currentDate: new Date(fromMs) })
+                        .next()
+                        .getTime();
                 case 'every': {
                     const expr = intervalToCron(job.schedule);
                     if (expr) {
-                        return CronExpressionParser.parse(expr, { currentDate: new Date(fromMs) }).next().getTime();
+                        return CronExpressionParser.parse(expr, { currentDate: new Date(fromMs) })
+                            .next()
+                            .getTime();
                     }
                     const ms = intervalToMs(job.schedule);
                     return ms ? fromMs + ms : null;
@@ -169,6 +183,12 @@ export class TaskScheduler {
             const status = result.error ? 'ERROR' : 'SUCCESS';
             // Log result (status reflects subprocess exit / is_error, not just completion)
             await fs.promises.appendFile(logFile, `[${new Date().toISOString()}] ${status}: ${firstLine}\n`);
+            if (result.error) {
+                this.recordFailure(job);
+            }
+            else {
+                this.failureCounts.delete(job.id);
+            }
             // Notify (separate try/catch -- notification failure shouldn't be reported as job failure)
             try {
                 if (this.onNotify) {
@@ -188,10 +208,30 @@ export class TaskScheduler {
             const errMsg = err instanceof Error ? err.message : String(err);
             logger.error(`Task "${job.name}" failed:`, err);
             await fs.promises.appendFile(logFile, `[${new Date().toISOString()}] ERROR: ${errMsg}\n`);
+            this.recordFailure(job);
             try {
                 await this.onNotify?.(`[${job.name}] Failed -- ${errMsg}`);
             }
-            catch { /* notification best-effort */ }
+            catch {
+                /* notification best-effort */
+            }
+        }
+    }
+    /**
+     * Track consecutive failures per task. After MAX_CONSECUTIVE_FAILURES the
+     * task is auto-disabled in the DB and a single "auto-disabled" notification
+     * is sent. Counter resets on the next successful fire.
+     */
+    recordFailure(job) {
+        const count = (this.failureCounts.get(job.id) ?? 0) + 1;
+        this.failureCounts.set(job.id, count);
+        if (count >= MAX_CONSECUTIVE_FAILURES) {
+            logger.warn(`Task "${job.name}" hit ${count} consecutive failures — auto-disabling`);
+            this.store.update(job.id, { enabled: false });
+            this.nextRunAt.delete(job.id);
+            this.failureCounts.delete(job.id);
+            // Notify once. Subsequent enable + re-failure will trigger again.
+            this.onNotify?.(`Task "${job.name}" auto-disabled after ${count} consecutive failures. Re-enable from the dashboard or via beecork_task_update.`).catch(() => { });
         }
     }
     async handleSystemEvent(job) {
@@ -210,7 +250,7 @@ export class TaskScheduler {
 /** Parse a "1w2d3h45m"-style interval into its parts. Returns null on invalid input. */
 function parseInterval(interval) {
     const match = interval.match(/^(?:(\d+)w)?(?:(\d+)d)?(?:(\d+)h)?(?:(\d+)m)?$/);
-    if (!match || match.slice(1).every(g => g === undefined))
+    if (!match || match.slice(1).every((g) => g === undefined))
         return null;
     return {
         weeks: parseInt(match[1] || '0', 10),
@@ -225,7 +265,7 @@ export function intervalToMs(interval) {
     if (!parts)
         return null;
     const { weeks, days, hours, mins } = parts;
-    const totalMs = ((weeks * 7 * 24 * 60) + (days * 24 * 60) + (hours * 60) + mins) * 60 * 1000;
+    const totalMs = (weeks * 7 * 24 * 60 + days * 24 * 60 + hours * 60 + mins) * 60 * 1000;
     return totalMs > 0 ? totalMs : null;
 }
 /** Convert human interval (30m, 2h, 1d, 1h30m, 2w) to cron expression */