opencode-supertask 0.1.40 → 0.1.41

package/dist/web/index.js

@@ -9100,8 +9100,8 @@ var require_CronFileParser = __commonJS({
        * @throws If file cannot be read
        */
       static parseFileSync(filePath) {
-        const { readFileSync: readFileSync4 } = __require("fs");
-        const data = readFileSync4(filePath, "utf8");
+        const { readFileSync: readFileSync3 } = __require("fs");
+        const data = readFileSync3(filePath, "utf8");
         return _CronFileParser.#parseContent(data);
       }
       /**
@@ -13085,14 +13085,14 @@ function mapRelationalRow(tablesConfig, tableConfig, row, buildQueryResultSelect
 // src/web/index.tsx
 import {
   existsSync as existsSync5,
-  mkdirSync as mkdirSync4,
-  readFileSync as readFileSync3,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync2,
   readdirSync,
   renameSync as renameSync2,
-  statSync as statSync4,
-  writeFileSync as writeFileSync3
+  statSync as statSync3,
+  writeFileSync as writeFileSync2
 } from "fs";
-import { homedir as homedir4 } from "os";
+import { homedir as homedir3 } from "os";
 import { basename as basename2, dirname as dirname4, join as join4 } from "path";
 
 // src/core/db/index.ts
@@ -16502,8 +16502,8 @@ var _sqlite = null;
 var _db = null;
 var _migrationRan = false;
 function getMigrationsFolder() {
-  const __dirname2 = dirname(fileURLToPath(import.meta.url));
-  let dir = __dirname2;
+  const __dirname = dirname(fileURLToPath(import.meta.url));
+  let dir = __dirname;
   for (let i = 0; i < 5; i++) {
     const candidate = join(dir, "drizzle", "meta", "_journal.json");
     if (existsSync(candidate)) {
@@ -16511,7 +16511,7 @@ function getMigrationsFolder() {
     }
     dir = dirname(dir);
   }
-  return join(__dirname2, "../../drizzle");
+  return join(__dirname, "../../drizzle");
 }
 function ensureGatewayLock(sqliteDb) {
   sqliteDb.exec(`
@@ -16667,7 +16667,7 @@ function cleanOutput(value) {
   return value.replace(ANSI_PATTERN, "").replace(/\r/g, "");
 }
 function runOpenCode(executable, args, cwd, timeoutMs) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve2, reject) => {
     const child = spawn(executable, args, {
       cwd,
       env: process.env,
@@ -16745,7 +16745,7 @@ function runOpenCode(executable, args, cwd, timeoutMs) {
         reject(new OpenCodeCommandExitError(`OpenCode ${args.join(" ")} \u5931\u8D25\uFF1A${detail}`));
         return;
       }
-      resolve3(cleanOutput(stdout));
+      resolve2(cleanOutput(stdout));
     });
   });
 }
@@ -16816,9 +16816,9 @@ async function loadOpenCodeCatalog(cwd, options = {}) {
   const executable = options.executable ?? process.env.SUPERTASK_OPENCODE_BIN ?? "opencode";
   const timeoutMs = options.timeoutMs ?? COMMAND_TIMEOUT_MS;
   const cacheKey = `${executable}\0${cwd}`;
-  const cached = catalogCache.get(cacheKey);
-  if (options.useCache !== false && cached && cached.expiresAt > Date.now()) {
-    return cached.result;
+  const cached2 = catalogCache.get(cacheKey);
+  if (options.useCache !== false && cached2 && cached2.expiresAt > Date.now()) {
+    return cached2.result;
   }
   const result = Promise.all([
     runOpenCode(executable, ["models", "--verbose"], cwd, timeoutMs).catch((error) => {
@@ -16859,6 +16859,59 @@ import { tmpdir } from "os";
 import { basename, dirname as dirname2, resolve } from "path";
 
 // src/core/process-control.ts
+var OS_COMMAND_TIMEOUT_MS = 2e3;
+var OS_COMMAND_MAX_OUTPUT_BYTES = 4 * 1024 * 1024;
+var OS_COMMAND_RESULT_MARKER = "\n\0supertask-os-command-result:";
+var BOUNDED_OS_COMMAND_RUNNER = `
+const { writeSync } = await import('fs');
+let child;
+try {
+    child = Bun.spawn(process.argv.slice(2), {
+        stdin: 'ignore',
+        stdout: 'pipe',
+        stderr: 'ignore',
+    });
+} catch {
+    process.exit(127);
+}
+const terminateGroup = () => {
+    if (process.platform !== 'win32') {
+        try {
+            process.kill(-process.pid, 'SIGKILL');
+        } catch {
+        }
+    }
+    try {
+        child.kill('SIGKILL');
+    } catch {
+    }
+    process.exit(1);
+};
+const timer = setTimeout(terminateGroup, ${OS_COMMAND_TIMEOUT_MS});
+try {
+    const chunks = [];
+    let outputBytes = 0;
+    const readOutput = async () => {
+        const reader = child.stdout.getReader();
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done) return;
+            outputBytes += value.byteLength;
+            if (outputBytes > ${OS_COMMAND_MAX_OUTPUT_BYTES}) terminateGroup();
+            chunks.push(value);
+        }
+    };
+    const [exitCode] = await Promise.all([child.exited, readOutput()]);
+    clearTimeout(timer);
+    for (const chunk of chunks) writeSync(1, chunk);
+    writeSync(1, ${JSON.stringify(OS_COMMAND_RESULT_MARKER)} + String(exitCode));
+    if (process.platform !== 'win32') terminateGroup();
+    process.exit(0);
+} catch {
+    clearTimeout(timer);
+    terminateGroup();
+}
+`;
 function isProcessAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
   try {
@@ -17425,7 +17478,7 @@ var TaskRunService = class {
       }
       if (current.childPid != null) {
         throw new LegacyRunAbandonConflictError(
-          `run #${runId} \u5DF2\u8BB0\u5F55 child PID ${current.childPid}\uFF0C\u5FC5\u987B\u7531 Worker/Watchdog \u786E\u8BA4\u8FDB\u7A0B\u6811\u9000\u51FA`
+          `run #${runId} \u5DF2\u8BB0\u5F55 child PID ${current.childPid}\uFF0C\u5FC5\u987B\u7531 Worker/Watchdog \u786E\u8BA4\u53D7\u7BA1\u8FDB\u7A0B\u7EC4\u6392\u7A7A`
         );
       }
       if (current.workerPid != null && isProcessAlive(current.workerPid)) {
@@ -17623,13 +17676,23 @@ var TaskService = class {
       });
       const maxRetries = normalizedData.maxRetries ?? task.maxRetries ?? 3;
       const exhausted = task.status === "failed" && (task.retryCount ?? 0) > maxRetries;
-      return tx.update(tasks3).set({
+      const updated = tx.update(tasks3).set({
         ...normalizedData,
         ...exhausted ? {
           status: "dead_letter",
           retryAfter: null
         } : {}
       }).where(eq(tasks3.id, id)).returning().get() ?? null;
+      if (exhausted && updated) {
+        const finishedAt = /* @__PURE__ */ new Date();
+        tx.update(tasks3).set({
+          status: "dead_letter",
+          finishedAt,
+          retryAfter: null,
+          resultLog: `\u4F9D\u8D56\u4EFB\u52A1 #${id} \u5DF2\u8FDB\u5165\u4E0D\u53EF\u6062\u590D\u7EC8\u6001`
+        }).where(blockedDependentsOf(id)).run();
+      }
+      return updated;
     }, { behavior: "immediate" });
   }
   static validateNewTask(data) {
@@ -17650,7 +17713,7 @@ var TaskService = class {
       throw new Error(`${name} \u5FC5\u987B\u662F ${min} \u5230 ${max} \u4E4B\u95F4\u7684\u6574\u6570`);
     }
   }
-  static async next(scope = {}) {
+  static buildRunnableTaskWhere(scope) {
     const baseConditions = [...this.buildScopeWhere(scope)];
     const nowMs = Date.now();
     const retryAfterFilter = or(
@@ -17685,40 +17748,43 @@ var TaskService = class {
     if (batchFilter) {
       conditions.push(batchFilter);
     }
-    const result = await db.select().from(tasks3).where(and(
+    return and(
       ...conditions,
       or(
         isNull(tasks3.dependsOn),
         sql`EXISTS (
-                        SELECT 1 FROM tasks AS dependency_task
-                        WHERE dependency_task.id = ${tasks3.dependsOn}
-                          AND dependency_task.status = 'done'
-                          AND dependency_task.cwd IS ${tasks3.cwd}
-                    )`
+                    SELECT 1 FROM tasks AS dependency_task
+                    WHERE dependency_task.id = ${tasks3.dependsOn}
+                      AND dependency_task.status = 'done'
+                      AND dependency_task.cwd IS ${tasks3.cwd}
+                )`
       ),
       or(
         isNull(tasks3.batchId),
         sql`trim(${tasks3.batchId}, ${TASK_BATCH_TRIM_CHARACTERS}) = ''`,
         sql`NOT EXISTS (
-                        SELECT 1 FROM tasks AS running_batch_task
-                        WHERE trim(running_batch_task.batch_id, ${TASK_BATCH_TRIM_CHARACTERS})
-                            = trim(${tasks3.batchId}, ${TASK_BATCH_TRIM_CHARACTERS})
-                          AND (
-                              running_batch_task.status = 'running'
-                              OR EXISTS (
-                                  SELECT 1 FROM task_runs AS running_batch_run
-                                  WHERE running_batch_run.task_id = running_batch_task.id
-                                    AND running_batch_run.status = 'running'
-                              )
+                    SELECT 1 FROM tasks AS running_batch_task
+                    WHERE trim(running_batch_task.batch_id, ${TASK_BATCH_TRIM_CHARACTERS})
+                        = trim(${tasks3.batchId}, ${TASK_BATCH_TRIM_CHARACTERS})
+                      AND (
+                          running_batch_task.status = 'running'
+                          OR EXISTS (
+                              SELECT 1 FROM task_runs AS running_batch_run
+                              WHERE running_batch_run.task_id = running_batch_task.id
+                                AND running_batch_run.status = 'running'
                           )
-                        )`
+                      )
+                    )`
       ),
       sql`NOT EXISTS (
-                    SELECT 1 FROM task_runs AS candidate_active_run
-                    WHERE candidate_active_run.task_id = ${tasks3.id}
-                      AND candidate_active_run.status = 'running'
-                )`
-    )).orderBy(
+                SELECT 1 FROM task_runs AS candidate_active_run
+                WHERE candidate_active_run.task_id = ${tasks3.id}
+                  AND candidate_active_run.status = 'running'
+            )`
+    );
+  }
+  static async next(scope = {}) {
+    const result = await db.select().from(tasks3).where(this.buildRunnableTaskWhere(scope)).orderBy(
       desc(tasks3.urgency),
       desc(tasks3.importance),
       asc(tasks3.createdAt),
@@ -17726,6 +17792,22 @@ var TaskService = class {
     ).limit(1);
     return result[0] ?? null;
   }
+  static async claimNext(scope = {}) {
+    return db.transaction((tx) => {
+      const candidate = tx.select().from(tasks3).where(this.buildRunnableTaskWhere(scope)).orderBy(
+        desc(tasks3.urgency),
+        desc(tasks3.importance),
+        asc(tasks3.createdAt),
+        asc(tasks3.id)
+      ).limit(1).get();
+      if (!candidate) return null;
+      return tx.update(tasks3).set({
+        status: "running",
+        startedAt: /* @__PURE__ */ new Date(),
+        finishedAt: null
+      }).where(eq(tasks3.id, candidate.id)).returning().get() ?? null;
+    }, { behavior: "immediate" });
+  }
   static async countRunning(scope = {}) {
     const scopeConditions = scope.legacyCwd ? [sql`${tasks3.cwd} IS NULL OR trim(${tasks3.cwd}) = ''`] : this.buildScopeWhere(scope);
     if (scope.batchId !== void 0) {
@@ -18818,452 +18900,101 @@ function createTaskFromTemplate(templateId, options) {
   }, { behavior: "immediate" });
 }
 
-// src/daemon/pm2.ts
-import { execSync, spawnSync } from "child_process";
-import {
-  accessSync,
-  chmodSync as chmodSync2,
-  constants,
-  existsSync as existsSync4,
-  mkdirSync as mkdirSync3,
-  readFileSync as readFileSync2,
-  rmSync,
-  statSync as statSync3,
-  writeFileSync as writeFileSync2
-} from "fs";
-import { homedir as homedir3, userInfo } from "os";
-import { delimiter, dirname as dirname3, isAbsolute as isAbsolute2, join as join3, resolve as resolve2 } from "path";
+// src/web/gateway-diagnostic.ts
+import { spawn as spawn2 } from "child_process";
+import { existsSync as existsSync4 } from "fs";
+import { dirname as dirname3, join as join3 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { Database as Database5 } from "bun:sqlite";
-
-// src/daemon/management-lock.ts
-import { Database as Database4 } from "bun:sqlite";
-
-// src/daemon/pm2.ts
-var __dirname = dirname3(fileURLToPath2(import.meta.url));
-var PROCESS_NAME = "supertask-gateway";
-var MAC_LAUNCH_AGENT_LABEL = "com.supertask.pm2-resurrect";
-var GATEWAY_LOCK_STALE_MS = 3e4;
-function runtimeHome(env) {
-  return resolve2(env.HOME || homedir3());
-}
-function runtimePath(value, cwd) {
-  return resolve2(cwd, value);
-}
-function versionFile(env = process.env, cwd = process.cwd()) {
-  return env.SUPERTASK_VERSION_FILE ? runtimePath(env.SUPERTASK_VERSION_FILE, cwd) : join3(runtimeHome(env), ".local/share/opencode/supertask-gateway-version");
-}
-function getRunningVersion(env = process.env, cwd = process.cwd()) {
-  try {
-    const path = versionFile(env, cwd);
-    if (!existsSync4(path)) return null;
-    return readFileSync2(path, "utf-8").trim() || null;
-  } catch {
-    return null;
-  }
-}
-function packageVersionFromGatewayEntry(gatewayEntry) {
-  if (gatewayEntry === null) return null;
-  let directory = dirname3(gatewayEntry);
-  for (let depth = 0; depth < 6; depth += 1) {
-    const packagePath = join3(directory, "package.json");
-    if (existsSync4(packagePath)) {
-      try {
-        const pkg = JSON.parse(readFileSync2(packagePath, "utf8"));
-        if (pkg.name === "opencode-supertask" && typeof pkg.version === "string") {
-          return pkg.version;
-        }
-      } catch {
-      }
-    }
-    const parent = dirname3(directory);
-    if (parent === directory) break;
-    directory = parent;
-  }
-  return null;
-}
-function resolveRuntimeExecutable(command, env, cwd) {
-  if (isAbsolute2(command) || command.includes("/")) return runtimePath(command, cwd);
-  for (const entry of (env.PATH ?? "").split(delimiter)) {
-    if (!entry) continue;
-    const candidate = resolve2(cwd, entry, command);
+var CACHE_TTL_MS = 5e3;
+var DIAGNOSTIC_TIMEOUT_MS = 2e4;
+var cached = null;
+var pending = null;
+var activeProcessGroups = /* @__PURE__ */ new Set();
+function killDiagnosticGroup(pid) {
+  if (process.platform !== "win32") {
     try {
-      accessSync(candidate, constants.X_OK);
-      return candidate;
+      process.kill(-pid, "SIGKILL");
+      return;
     } catch {
     }
   }
-  return command;
-}
-function runtimeScope(runtime) {
-  const { cwd, env } = runtime;
-  const home = runtimeHome(env);
-  return {
-    cwd: resolve2(cwd),
-    databasePath: env.SUPERTASK_DB_PATH ? runtimePath(env.SUPERTASK_DB_PATH, cwd) : join3(home, ".local/share/opencode/tasks.db"),
-    configPath: env.SUPERTASK_CONFIG_PATH ? runtimePath(env.SUPERTASK_CONFIG_PATH, cwd) : join3(home, ".config/opencode/supertask.json"),
-    opencodePath: resolveRuntimeExecutable(env.SUPERTASK_OPENCODE_BIN ?? "opencode", env, cwd),
-    home,
-    pm2Home: env.PM2_HOME ? runtimePath(env.PM2_HOME, cwd) : join3(home, ".pm2"),
-    managementLockPath: canonicalManagementLockPath(env, cwd)
-  };
-}
-function scopesMatch(left, right) {
-  return left.databasePath === right.databasePath && left.configPath === right.configPath && left.opencodePath === right.opencodePath && left.home === right.home && left.pm2Home === right.pm2Home && left.managementLockPath === right.managementLockPath;
-}
-function currentScope() {
-  return runtimeScope({ cwd: process.cwd(), env: process.env });
-}
-function diagnoseOpenCodeRuntime(runtime = {
-  cwd: process.cwd(),
-  env: process.env
-}) {
-  const executable = runtimeScope(runtime).opencodePath;
-  const result = spawnSync(executable, ["--version"], {
-    cwd: runtime.cwd,
-    env: runtime.env,
-    encoding: "utf8",
-    timeout: 1e4,
-    killSignal: "SIGKILL"
-  });
-  const ok = result.status === 0 && result.error === void 0;
-  return {
-    ok,
-    executable,
-    version: ok ? result.stdout.trim() || result.stderr.trim() || null : null,
-    error: ok ? null : result.error?.message || result.stderr.trim() || result.stdout.trim() || `exit code ${result.status}`
-  };
-}
-function getGatewayDiagnostic(options = {}) {
-  const producerScope = currentScope();
-  if (!isPm2Installed()) {
-    return {
-      pm2Installed: false,
-      processFound: false,
-      status: null,
-      pid: null,
-      ready: false,
-      runningVersion: getRunningVersion(),
-      gatewayEntry: null,
-      gatewayPackageVersion: null,
-      logRotationInstalled: false,
-      startupConfigured: process.platform === "darwin" || process.platform === "linux" ? false : null,
-      currentScope: producerScope,
-      gatewayScope: null,
-      scopeMatches: false,
-      gatewayOpenCode: null
-    };
-  }
-  const processes = pm2JsonList();
-  const gateway = processes.find((item) => item.name === PROCESS_NAME);
-  const runtime = gatewayRuntimeFromProcess(gateway);
-  const gatewayEnv = runtime?.env ?? process.env;
-  const managedScope = runtime ? runtimeScope(runtime) : null;
-  const pid = typeof gateway?.pid === "number" ? gateway.pid : null;
-  const readyPath = managedScope?.databasePath ?? databasePath();
-  const lockedVersion = pid == null ? void 0 : gatewayVersionFromLock(pid, readyPath);
-  const gatewayEntry = runtime?.gatewayEntry ?? null;
-  return {
-    pm2Installed: true,
-    processFound: gateway != null,
-    status: gateway?.pm2_env?.status ?? null,
-    pid,
-    ready: pid != null && isGatewayReady(pid, readyPath),
-    runningVersion: lockedVersion === void 0 ? getRunningVersion(gatewayEnv, runtime?.cwd) : lockedVersion,
-    gatewayEntry,
-    gatewayPackageVersion: packageVersionFromGatewayEntry(gatewayEntry),
-    logRotationInstalled: processes.some((item) => item.name === "pm2-logrotate" && item.pm2_env?.status === "online"),
-    startupConfigured: process.platform === "darwin" ? isMacLaunchAgentConfigured(
-      gatewayEnv.PM2_HOME ?? join3(runtimeHome(gatewayEnv), ".pm2"),
-      runtime ?? void 0
-    ) : process.platform === "linux" ? isLinuxStartupConfigured(gatewayEnv, runtime?.cwd, runtime ?? void 0) : null,
-    currentScope: producerScope,
-    gatewayScope: managedScope,
-    scopeMatches: managedScope != null && scopesMatch(producerScope, managedScope),
-    gatewayOpenCode: runtime === null || !options.probeOpenCode ? null : diagnoseOpenCodeRuntime(runtime)
-  };
-}
-function pm2Bin(env = process.env) {
-  return env.SUPERTASK_PM2_BIN ?? (process.platform === "win32" ? "pm2.cmd" : "pm2");
-}
-function pm2CommandTimeoutMs(env = process.env) {
-  const configured = Number(env.SUPERTASK_PM2_COMMAND_TIMEOUT_MS ?? 15e3);
-  return Number.isFinite(configured) && configured > 0 ? configured : 15e3;
-}
-function resolvePm2Bin() {
-  const configured = pm2Bin();
-  if (isAbsolute2(configured)) return configured;
-  const result = spawnSync("which", [configured], { encoding: "utf8" });
-  const resolved = result.status === 0 ? result.stdout.trim().split("\n")[0] : "";
-  if (!resolved) throw new Error(`[supertask] \u65E0\u6CD5\u89E3\u6790 pm2 \u53EF\u6267\u884C\u6587\u4EF6: ${configured}`);
-  return resolved;
-}
-function launchAgentPath() {
-  return process.env.SUPERTASK_LAUNCH_AGENT_PATH ?? join3(runtimeHome(process.env), "Library/LaunchAgents", `${MAC_LAUNCH_AGENT_LABEL}.plist`);
-}
-function launchctlBin() {
-  return process.env.SUPERTASK_LAUNCHCTL_BIN ?? "launchctl";
-}
-function xmlUnescape(value) {
-  return value.replaceAll("&apos;", "'").replaceAll("&quot;", '"').replaceAll("&gt;", ">").replaceAll("&lt;", "<").replaceAll("&amp;", "&");
-}
-function plistValue(contents, key) {
-  const escapedKey = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const match2 = contents.match(new RegExp(`<key>\\s*${escapedKey}\\s*</key>\\s*<string>([^<]*)</string>`));
-  return match2?.[1] ? xmlUnescape(match2[1]) : null;
-}
-function isMacLaunchAgentConfigured(expectedPm2Home, expectedRuntime) {
-  if (typeof process.getuid !== "function") return false;
-  const plistPath = launchAgentPath();
-  if (!existsSync4(plistPath)) return false;
   try {
-    const contents = readFileSync2(plistPath, "utf8");
-    const argumentsBlock = contents.match(
-      /<key>\s*ProgramArguments\s*<\/key>\s*<array>([\s\S]*?)<\/array>/
-    )?.[1];
-    const programArguments = argumentsBlock ? [...argumentsBlock.matchAll(/<string>([^<]*)<\/string>/g)].map((match2) => xmlUnescape(match2[1])) : [];
-    const bunPath = programArguments[0];
-    const supervisorEntry = programArguments[1];
-    const pm2Path = programArguments[2];
-    const pm2Home = plistValue(contents, "PM2_HOME");
-    const managementLock = plistValue(contents, "SUPERTASK_PM2_MANAGEMENT_LOCK");
-    if (!bunPath || !supervisorEntry || !pm2Path || !pm2Home || !managementLock) return false;
-    if (expectedPm2Home && pm2Home !== expectedPm2Home) return false;
-    const expectedManagementLock = expectedRuntime ? managementLockPath(expectedRuntime.env, expectedRuntime.cwd) : process.env.SUPERTASK_PM2_MANAGEMENT_LOCK ? managementLockPath() : join3(expectedPm2Home ?? currentScope().pm2Home, "supertask-gateway.manage.sqlite");
-    if (managementLock !== expectedManagementLock) return false;
-    accessSync(bunPath, constants.X_OK);
-    accessSync(supervisorEntry, constants.R_OK);
-    accessSync(pm2Path, constants.X_OK);
-    if (spawnSync(bunPath, ["--version"], {
-      stdio: "ignore",
-      timeout: pm2CommandTimeoutMs(),
-      killSignal: "SIGKILL"
-    }).status !== 0) return false;
-    if (spawnSync(pm2Path, ["--version"], {
-      stdio: "ignore",
-      env: { ...process.env, PM2_HOME: pm2Home },
-      timeout: pm2CommandTimeoutMs(),
-      killSignal: "SIGKILL"
-    }).status !== 0) return false;
-    const loaded = spawnSync(
-      launchctlBin(),
-      ["print", `gui/${process.getuid()}/${MAC_LAUNCH_AGENT_LABEL}`],
-      {
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"],
-        timeout: pm2CommandTimeoutMs(),
-        killSignal: "SIGKILL"
-      }
-    );
-    if (loaded.status !== 0) return false;
-    if (!loaded.stdout.includes("state = running")) return false;
-    if (!loaded.stdout.includes(`path = ${plistPath}`)) return false;
-    if (!loaded.stdout.includes(`program = ${bunPath}`)) return false;
-    const dumpPath = join3(pm2Home, "dump.pm2");
-    const dump = JSON.parse(readFileSync2(dumpPath, "utf8"));
-    if (!Array.isArray(dump)) return false;
-    const gateway = dump.find((item) => item.name === PROCESS_NAME);
-    const dumpRuntime = gatewayRuntimeFromProcess(gateway);
-    if (!dumpRuntime || !hasRestorableSavedGatewayRuntime(gateway)) return false;
-    return expectedRuntime === void 0 || dumpRuntime.gatewayEntry === expectedRuntime.gatewayEntry && dumpRuntime.bunPath === expectedRuntime.bunPath && dumpRuntime.cwd === expectedRuntime.cwd && scopesMatch(runtimeScope(dumpRuntime), runtimeScope(expectedRuntime));
+    process.kill(pid, "SIGKILL");
   } catch {
-    return false;
   }
 }
-function systemctlBin(env = process.env) {
-  return env.SUPERTASK_SYSTEMCTL_BIN ?? "systemctl";
+process.once("exit", () => {
+  for (const pid of activeProcessGroups) killDiagnosticGroup(pid);
+});
+function diagnosticEntry() {
+  const extension = import.meta.url.endsWith(".ts") ? "ts" : "js";
+  const moduleDir = dirname3(fileURLToPath2(import.meta.url));
+  const candidates = [
+    join3(moduleDir, `../daemon/gateway-diagnostic-runner.${extension}`),
+    join3(moduleDir, `../../src/daemon/gateway-diagnostic-runner.${extension}`)
+  ];
+  const entry = candidates.find((candidate) => existsSync4(candidate));
+  if (!entry) throw new Error(`Gateway diagnostic runner \u4E0D\u5B58\u5728\uFF1A${candidates.join(", ")}`);
+  return entry;
 }
-function isLinuxStartupConfigured(env = process.env, cwd = process.cwd(), expectedRuntime) {
-  const unit = env.SUPERTASK_PM2_SYSTEMD_UNIT ?? `pm2-${userInfo().username}.service`;
-  const enabled = spawnSync(systemctlBin(env), ["is-enabled", unit], {
-    encoding: "utf8",
-    env,
-    stdio: ["ignore", "pipe", "ignore"],
-    timeout: pm2CommandTimeoutMs(env),
-    killSignal: "SIGKILL"
-  });
-  if (enabled.status !== 0 || enabled.stdout.trim() !== "enabled") return false;
-  const contents = spawnSync(systemctlBin(env), ["cat", unit], {
-    encoding: "utf8",
-    env,
-    stdio: ["ignore", "pipe", "ignore"],
-    timeout: pm2CommandTimeoutMs(env),
-    killSignal: "SIGKILL"
+async function runGatewayDiagnostic() {
+  return new Promise((resolve2, reject) => {
+    const child = spawn2(process.execPath, [diagnosticEntry()], {
+      cwd: process.cwd(),
+      env: process.env,
+      detached: process.platform !== "win32",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    if (child.pid) activeProcessGroups.add(child.pid);
+    child.stdout?.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    child.once("error", reject);
+    child.once("close", (exitCode) => {
+      clearTimeout(timer);
+      if (child.pid) {
+        killDiagnosticGroup(child.pid);
+        activeProcessGroups.delete(child.pid);
+      }
+      if (timedOut) {
+        reject(new Error(`Gateway diagnostic runner \u8D85\u8FC7 ${DIAGNOSTIC_TIMEOUT_MS}ms \u672A\u5B8C\u6210`));
+        return;
+      }
+      if (exitCode !== 0) {
+        reject(new Error(stderr.trim() || `Gateway diagnostic runner \u9000\u51FA\u7801 ${exitCode}`));
+        return;
+      }
+      try {
+        resolve2(JSON.parse(stdout));
+      } catch (error) {
+        reject(error);
+      }
+    });
+    const timer = setTimeout(() => {
+      timedOut = true;
+      if (child.pid) killDiagnosticGroup(child.pid);
+      else child.kill("SIGKILL");
+    }, DIAGNOSTIC_TIMEOUT_MS);
   });
-  if (contents.status !== 0) return false;
-  const expectedPm2Home = env.PM2_HOME ?? join3(runtimeHome(env), ".pm2");
-  if (!contents.stdout.includes("resurrect") || !contents.stdout.includes(expectedPm2Home)) {
-    return false;
-  }
-  try {
-    const dump = JSON.parse(readFileSync2(join3(expectedPm2Home, "dump.pm2"), "utf8"));
-    if (!Array.isArray(dump)) return false;
-    const gateway = dump.find((item) => item.name === PROCESS_NAME);
-    const runtime = gatewayRuntimeFromProcess(gateway);
-    if (!runtime || !hasRestorableSavedGatewayRuntime(gateway)) return false;
-    return runtime.cwd === resolve2(cwd) && scopesMatch(runtimeScope(runtime), runtimeScope({ cwd, env })) && (expectedRuntime === void 0 || runtime.gatewayEntry === expectedRuntime.gatewayEntry && runtime.bunPath === expectedRuntime.bunPath);
-  } catch {
-    return false;
-  }
 }
-function isPm2Installed(env = process.env) {
-  const result = spawnSync(pm2Bin(env), ["--version"], {
-    stdio: "ignore",
-    env,
-    shell: process.platform === "win32",
-    timeout: pm2CommandTimeoutMs(env),
-    killSignal: "SIGKILL"
+async function getDashboardGatewayDiagnostic(options = {}) {
+  if (!options.fresh && cached && cached.expiresAt > Date.now()) return cached.diagnostic;
+  if (!options.fresh && pending) return pending;
+  const operation = runGatewayDiagnostic().then((diagnostic) => {
+    cached = { expiresAt: Date.now() + CACHE_TTL_MS, diagnostic };
+    return diagnostic;
   });
-  return result.status === 0;
-}
-function resolveCommand(command) {
-  const lookup = process.platform === "win32" ? "where" : "which";
-  const result = spawnSync(lookup, [command], { encoding: "utf8" });
-  return result.status === 0 ? result.stdout.trim().split("\n")[0] || null : null;
-}
-function npmPreferredEnvironment() {
-  if (process.platform === "win32") return null;
-  const npm = resolveCommand("npm");
-  const node = resolveCommand("node");
-  if (!npm || !node) return null;
-  const command = resolvePm2Bin();
-  const path = [.../* @__PURE__ */ new Set([
-    dirname3(command),
-    dirname3(npm),
-    dirname3(node),
-    "/usr/local/bin",
-    "/usr/bin",
-    "/bin"
-  ])].join(delimiter);
-  return { command, env: { ...process.env, PATH: path } };
-}
-function pm2Exec(args, options = {}) {
-  const npmEnvironment = options.preferNpm ? npmPreferredEnvironment() : null;
-  const effectiveEnv = options.env ?? npmEnvironment?.env ?? process.env;
-  const result = spawnSync(npmEnvironment?.command ?? pm2Bin(effectiveEnv), args, {
-    stdio: ["pipe", "pipe", "pipe"],
-    encoding: "utf-8",
-    env: effectiveEnv,
-    shell: process.platform === "win32",
-    timeout: options.timeoutMs ?? pm2CommandTimeoutMs(effectiveEnv),
-    killSignal: "SIGKILL"
+  if (options.fresh) return operation;
+  pending = operation.finally(() => {
+    pending = null;
   });
-  const output = `${result.stdout ?? ""}${result.stderr ?? ""}`.trim();
-  if (result.error) return { ok: false, output: result.error.message };
-  return { ok: result.status === 0, output };
-}
-function requirePm2(args, action, options = {}) {
-  const result = pm2Exec(args, options);
-  if (!result.ok) throw new Error(`[supertask] ${action} failed: ${result.output || "unknown pm2 error"}`);
-  return result.output;
-}
-function pm2JsonList(env = process.env) {
-  const output = requirePm2(["jlist"], "pm2 jlist", { env });
-  try {
-    const parsed = JSON.parse(output);
-    if (!Array.isArray(parsed)) throw new Error("result is not an array");
-    return parsed;
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    throw new Error(`[supertask] Invalid pm2 jlist output: ${message}`);
-  }
-}
-function gatewayEntryFromProcess(processInfo) {
-  const args = processInfo?.pm2_env?.args ?? processInfo?.args;
-  const candidates = Array.isArray(args) ? [...args].reverse() : typeof args === "string" ? [args] : [];
-  const savedCwd = processInfo?.pm2_env?.pm_cwd ?? processInfo?.pm_cwd;
-  for (const candidate of candidates) {
-    const path = typeof savedCwd === "string" ? runtimePath(candidate, savedCwd) : candidate;
-    if (existsSync4(path)) return resolve2(path);
-  }
-  return null;
-}
-function gatewayEnvironmentFromProcess(processInfo) {
-  const saved = processInfo?.pm2_env?.env ?? processInfo?.env;
-  if (!saved) return { ...process.env };
-  const env = {};
-  for (const [key, value] of Object.entries(saved)) {
-    if (typeof value === "string") env[key] = value;
-  }
-  return env;
-}
-function gatewayRuntimeFromProcess(processInfo) {
-  const gatewayEntry = gatewayEntryFromProcess(processInfo);
-  if (!gatewayEntry) return null;
-  const savedBunPath = processInfo?.pm2_env?.pm_exec_path ?? processInfo?.pm_exec_path;
-  const savedCwd = processInfo?.pm2_env?.pm_cwd ?? processInfo?.pm_cwd;
-  const savedEnv = gatewayEnvironmentFromProcess(processInfo);
-  if (typeof savedBunPath !== "string" || typeof savedCwd !== "string") return null;
-  try {
-    accessSync(savedBunPath, constants.X_OK);
-    if (!statSync3(savedCwd).isDirectory()) return null;
-    if (spawnSync(savedBunPath, ["--version"], {
-      stdio: "ignore",
-      env: savedEnv,
-      timeout: pm2CommandTimeoutMs(savedEnv),
-      killSignal: "SIGKILL"
-    }).status !== 0) return null;
-  } catch {
-    return null;
-  }
-  const killTimeout = processInfo?.pm2_env?.kill_timeout ?? processInfo?.kill_timeout;
-  return {
-    gatewayEntry,
-    bunPath: savedBunPath,
-    cwd: resolve2(savedCwd),
-    env: savedEnv,
-    killTimeoutMs: Number.isInteger(killTimeout) && killTimeout >= 5e3 ? killTimeout : void 0
-  };
-}
-function hasRestorableSavedGatewayRuntime(processInfo) {
-  return gatewayRuntimeFromProcess(processInfo) !== null;
-}
-function databasePath(env = process.env, cwd = process.cwd()) {
-  return env.SUPERTASK_DB_PATH ? runtimePath(env.SUPERTASK_DB_PATH, cwd) : join3(runtimeHome(env), ".local/share/opencode/tasks.db");
-}
-function isGatewayReady(expectedPid, path = databasePath()) {
-  if (!existsSync4(path)) return false;
-  let database = null;
-  try {
-    database = new Database5(path, { readonly: true });
-    const row = database.query(
-      "SELECT pid, heartbeat_at, ready_at FROM gateway_lock WHERE id = 1"
-    ).get();
-    if (!row || row.ready_at == null) return false;
-    if (expectedPid !== void 0 && row.pid !== expectedPid) return false;
-    const ageMs = Date.now() - row.heartbeat_at;
-    return ageMs >= -5e3 && ageMs < GATEWAY_LOCK_STALE_MS;
-  } catch {
-    return false;
-  } finally {
-    database?.close();
-  }
-}
-function gatewayVersionFromLock(expectedPid, path) {
-  if (!existsSync4(path)) return void 0;
-  let database = null;
-  try {
-    database = new Database5(path, { readonly: true });
-    const row = database.query(
-      "SELECT pid, version FROM gateway_lock WHERE id = 1"
-    ).get();
-    if (!row || row.pid !== expectedPid) return void 0;
-    return row.version;
-  } catch {
-    return void 0;
-  } finally {
-    database?.close();
-  }
-}
-function managementLockPath(env = process.env, cwd = process.cwd()) {
-  const override = env.SUPERTASK_PM2_MANAGEMENT_LOCK;
-  if (override) return runtimePath(override, cwd);
-  return join3(runtimeScope({ env, cwd }).pm2Home, "supertask-gateway.manage.sqlite");
-}
-function canonicalManagementLockPath(env = process.env, cwd = process.cwd()) {
-  const home = runtimeHome(env);
-  const pm2Home = env.PM2_HOME ? runtimePath(env.PM2_HOME, cwd) : join3(home, ".pm2");
-  return join3(pm2Home, "supertask-gateway.manage.sqlite");
+  return pending;
 }
 
 // src/web/ui.ts
@@ -19536,7 +19267,7 @@ var ZH = {
   "details.enabledYes": "\u5DF2\u542F\u7528",
   "details.enabledNo": "\u5DF2\u505C\u7528",
   "dialog.cancelTask": "\u53D6\u6D88\u4EFB\u52A1 #{id}\uFF1F",
-  "dialog.cancelTaskBody": "\u8FD0\u884C\u4E2D\u7684\u4EFB\u52A1\u4F1A\u5728\u4E0B\u4E00\u4E2A\u8F6E\u8BE2\u5468\u671F\u7EC8\u6B62\u5BF9\u5E94\u8FDB\u7A0B\u6811\u3002",
+  "dialog.cancelTaskBody": "\u8FD0\u884C\u4E2D\u7684\u4EFB\u52A1\u4F1A\u5728\u4E0B\u4E00\u4E2A\u8F6E\u8BE2\u5468\u671F\u7EC8\u6B62\u5BF9\u5E94\u7684\u53D7\u7BA1\u8FDB\u7A0B\u7EC4\u3002",
   "dialog.retryTask": "\u91CD\u8BD5\u4EFB\u52A1 #{id}\uFF1F",
   "dialog.retryTaskBody": "\u4EFB\u52A1\u5C06\u56DE\u5230\u5F85\u6267\u884C\u72B6\u6001\uFF0C\u5E76\u91CD\u7F6E\u81EA\u52A8\u91CD\u8BD5\u9884\u7B97\u3002",
   "dialog.deleteTask": "\u5220\u9664\u4EFB\u52A1 #{id}\uFF1F",
@@ -19841,7 +19572,7 @@ var EN = {
   "details.enabledYes": "Enabled",
   "details.enabledNo": "Disabled",
   "dialog.cancelTask": "Cancel task #{id}?",
-  "dialog.cancelTaskBody": "A running task will terminate its process tree on the next worker poll.",
+  "dialog.cancelTaskBody": "A running task will terminate its managed process group on the next worker poll.",
   "dialog.retryTask": "Retry task #{id}?",
   "dialog.retryTaskBody": "The task returns to pending and its automatic retry budget is reset.",
   "dialog.deleteTask": "Delete task #{id}?",
@@ -20652,6 +20383,7 @@ var TASK_STATUSES = /* @__PURE__ */ new Set([
   "cancelled"
 ]);
 var SESSION_ID_PATTERN = /^ses_[A-Za-z0-9_]+$/;
+var LOOPBACK_HOST_PATTERN = /^(?:localhost|127\.0\.0\.1|\[::1\])(?::([1-9]\d{0,4}))?$/i;
 var runtimeConfig = null;
 var restartScheduled = false;
 function setDashboardRuntimeConfig(config) {
@@ -20678,10 +20410,13 @@ function resolveDashboardConfigState(runtimeAvailable, restartRequired, managedR
 function isSafeDashboardRestartTarget(diagnostic, currentPid) {
   return diagnostic.pm2Installed && diagnostic.processFound && diagnostic.status === "online" && diagnostic.pid === currentPid && diagnostic.ready && diagnostic.scopeMatches;
 }
-function canRestartCurrentGateway() {
+async function canRestartCurrentGateway(fresh = false) {
   if (runtimeConfig === null) return false;
   try {
-    return isSafeDashboardRestartTarget(getGatewayDiagnostic(), process.pid);
+    return isSafeDashboardRestartTarget(
+      await getDashboardGatewayDiagnostic({ fresh }),
+      process.pid
+    );
   } catch {
     return false;
   }
@@ -20700,7 +20435,7 @@ function listChildDirectories(path) {
     if (entry.isDirectory()) return [{ name: entry.name, path: entryPath, hidden: entry.name.startsWith(".") }];
     if (!entry.isSymbolicLink()) return [];
     try {
-      return statSync4(entryPath).isDirectory() ? [{ name: entry.name, path: entryPath, hidden: entry.name.startsWith(".") }] : [];
+      return statSync3(entryPath).isDirectory() ? [{ name: entry.name, path: entryPath, hidden: entry.name.startsWith(".") }] : [];
     } catch {
       return [];
     }
@@ -20861,6 +20596,14 @@ function resolveLocale(c) {
   return accepted.startsWith("en") ? "en" : "zh-CN";
 }
 app.use("*", async (c, next) => {
+  const requestHostname = new URL(c.req.url).hostname;
+  const hostHeader = c.req.header("Host");
+  const loopbackHosts = ["localhost", "127.0.0.1", "[::1]"];
+  const hostMatch = hostHeader?.match(LOOPBACK_HOST_PATTERN) ?? null;
+  const hostPort = hostMatch?.[1] === void 0 ? null : Number(hostMatch[1]);
+  if (!loopbackHosts.includes(requestHostname) || hostHeader !== void 0 && (!hostMatch || hostPort !== null && hostPort > 65535)) {
+    return c.json({ error: "invalid dashboard host" }, 421);
+  }
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("X-Frame-Options", "DENY");
@@ -20892,13 +20635,13 @@ app.get("/health", (c) => {
   return c.json(health, health.status === "ok" ? 200 : 503);
 });
 app.get("/api/filesystem/directories", (c) => {
-  const requestedPath = c.req.query("path")?.trim() || homedir4();
+  const requestedPath = c.req.query("path")?.trim() || homedir3();
   try {
     validateTaskWorkingDirectory(requestedPath);
     return c.json({
       path: requestedPath,
       parent: dirname4(requestedPath),
-      home: homedir4(),
+      home: homedir3(),
       directories: listChildDirectories(requestedPath)
     });
   } catch (error) {
@@ -20996,7 +20739,7 @@ function readCurrentConfig() {
   const configPath = getConfigPath();
   if (!existsSync5(configPath)) return {};
   try {
-    return JSON.parse(readFileSync3(configPath, "utf-8"));
+    return JSON.parse(readFileSync2(configPath, "utf-8"));
   } catch {
     return {};
   }
@@ -21004,9 +20747,9 @@ function readCurrentConfig() {
 function writeConfig(cfg) {
   const configPath = getConfigPath();
   const dir = dirname4(configPath);
-  if (!existsSync5(dir)) mkdirSync4(dir, { recursive: true });
+  if (!existsSync5(dir)) mkdirSync3(dir, { recursive: true });
   const tempPath = `${configPath}.${process.pid}.tmp`;
-  writeFileSync3(tempPath, JSON.stringify(cfg, null, 2) + "\n", { mode: 384 });
+  writeFileSync2(tempPath, JSON.stringify(cfg, null, 2) + "\n", { mode: 384 });
   renameSync2(tempPath, configPath);
 }
 function statCard(value, label, tone, cardIcon, delay = "") {
@@ -21372,7 +21115,7 @@ app.get("/system", async (c) => {
   const config = loadConfig();
   const activeConfig = runtimeConfig ?? config;
   const restartRequired = runtimeConfig !== null && !configsEqual(config, runtimeConfig);
-  const managedRestart = canRestartCurrentGateway();
+  const managedRestart = await canRestartCurrentGateway();
   const configState = resolveDashboardConfigState(
     runtimeConfig !== null,
     restartRequired,
@@ -21492,9 +21235,9 @@ app.get("/api/runs/:id/session-command", async (c) => {
   if (!isValidSessionId(run.sessionId)) return c.json({ error: "session unavailable" }, 409);
   return c.json({ command: sessionCommand(run.sessionId) });
 });
-app.get("/api/gateway/status", (c) => {
+app.get("/api/gateway/status", async (c) => {
   const savedConfig = loadConfig();
-  const managed = canRestartCurrentGateway();
+  const managed = await canRestartCurrentGateway();
   return c.json({
     pid: process.pid,
     managed,
@@ -21619,7 +21362,7 @@ app.put("/api/config", async (c) => {
     return c.json({
       success: true,
       restartRequired: runtimeConfig === null || !configsEqual(savedConfig, runtimeConfig),
-      managed: canRestartCurrentGateway()
+      managed: await canRestartCurrentGateway()
     });
   } catch (error) {
     return c.json({
@@ -21635,9 +21378,10 @@ app.post("/api/gateway/restart", async (c) => {
     return c.json({ error: "confirmation must be RESTART" }, 400);
   }
   if (restartScheduled) return c.json({ error: "restart already scheduled" }, 409);
-  if (!canRestartCurrentGateway()) {
+  if (!await canRestartCurrentGateway(true)) {
     return c.json({ error: "\u5F53\u524D Gateway \u4E0D\u662F\u7531\u5339\u914D\u8FD0\u884C\u4F5C\u7528\u57DF\u7684 PM2 \u8FDB\u7A0B\u6258\u7BA1\uFF0C\u65E0\u6CD5\u4ECE\u7F51\u9875\u5B89\u5168\u91CD\u542F" }, 409);
   }
+  if (restartScheduled) return c.json({ error: "restart already scheduled" }, 409);
   restartScheduled = true;
   const previousPid = process.pid;
   setTimeout(() => {