opencode-supertask 0.1.40 → 0.1.41

package/dist/gateway/index.js

@@ -6110,8 +6110,8 @@ import { homedir } from "os";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
 function getMigrationsFolder() {
-  const __dirname2 = dirname(fileURLToPath(import.meta.url));
-  let dir = __dirname2;
+  const __dirname = dirname(fileURLToPath(import.meta.url));
+  let dir = __dirname;
   for (let i = 0; i < 5; i++) {
     const candidate = join(dir, "drizzle", "meta", "_journal.json");
     if (existsSync(candidate)) {
@@ -6119,7 +6119,7 @@ function getMigrationsFolder() {
     }
     dir = dirname(dir);
   }
-  return join(__dirname2, "../../drizzle");
+  return join(__dirname, "../../drizzle");
 }
 function ensureGatewayLock(sqliteDb) {
   sqliteDb.exec(`
@@ -6598,13 +6598,23 @@ var init_task_service = __esm({
           });
           const maxRetries = normalizedData.maxRetries ?? task.maxRetries ?? 3;
           const exhausted = task.status === "failed" && (task.retryCount ?? 0) > maxRetries;
-          return tx.update(tasks2).set({
+          const updated = tx.update(tasks2).set({
             ...normalizedData,
             ...exhausted ? {
               status: "dead_letter",
               retryAfter: null
             } : {}
           }).where(eq(tasks2.id, id)).returning().get() ?? null;
+          if (exhausted && updated) {
+            const finishedAt = /* @__PURE__ */ new Date();
+            tx.update(tasks2).set({
+              status: "dead_letter",
+              finishedAt,
+              retryAfter: null,
+              resultLog: `\u4F9D\u8D56\u4EFB\u52A1 #${id} \u5DF2\u8FDB\u5165\u4E0D\u53EF\u6062\u590D\u7EC8\u6001`
+            }).where(blockedDependentsOf(id)).run();
+          }
+          return updated;
         }, { behavior: "immediate" });
       }
       static validateNewTask(data) {
@@ -6625,7 +6635,7 @@ var init_task_service = __esm({
           throw new Error(`${name} \u5FC5\u987B\u662F ${min} \u5230 ${max} \u4E4B\u95F4\u7684\u6574\u6570`);
         }
       }
-      static async next(scope = {}) {
+      static buildRunnableTaskWhere(scope) {
         const baseConditions = [...this.buildScopeWhere(scope)];
         const nowMs = Date.now();
         const retryAfterFilter = or(
@@ -6660,40 +6670,43 @@ var init_task_service = __esm({
         if (batchFilter) {
           conditions.push(batchFilter);
         }
-        const result = await db.select().from(tasks2).where(and(
+        return and(
           ...conditions,
           or(
             isNull(tasks2.dependsOn),
             sql`EXISTS (
-                        SELECT 1 FROM tasks AS dependency_task
-                        WHERE dependency_task.id = ${tasks2.dependsOn}
-                          AND dependency_task.status = 'done'
-                          AND dependency_task.cwd IS ${tasks2.cwd}
-                    )`
+                    SELECT 1 FROM tasks AS dependency_task
+                    WHERE dependency_task.id = ${tasks2.dependsOn}
+                      AND dependency_task.status = 'done'
+                      AND dependency_task.cwd IS ${tasks2.cwd}
+                )`
           ),
           or(
             isNull(tasks2.batchId),
             sql`trim(${tasks2.batchId}, ${TASK_BATCH_TRIM_CHARACTERS}) = ''`,
             sql`NOT EXISTS (
-                        SELECT 1 FROM tasks AS running_batch_task
-                        WHERE trim(running_batch_task.batch_id, ${TASK_BATCH_TRIM_CHARACTERS})
-                            = trim(${tasks2.batchId}, ${TASK_BATCH_TRIM_CHARACTERS})
-                          AND (
-                              running_batch_task.status = 'running'
-                              OR EXISTS (
-                                  SELECT 1 FROM task_runs AS running_batch_run
-                                  WHERE running_batch_run.task_id = running_batch_task.id
-                                    AND running_batch_run.status = 'running'
-                              )
+                    SELECT 1 FROM tasks AS running_batch_task
+                    WHERE trim(running_batch_task.batch_id, ${TASK_BATCH_TRIM_CHARACTERS})
+                        = trim(${tasks2.batchId}, ${TASK_BATCH_TRIM_CHARACTERS})
+                      AND (
+                          running_batch_task.status = 'running'
+                          OR EXISTS (
+                              SELECT 1 FROM task_runs AS running_batch_run
+                              WHERE running_batch_run.task_id = running_batch_task.id
+                                AND running_batch_run.status = 'running'
                           )
-                        )`
+                      )
+                    )`
           ),
           sql`NOT EXISTS (
-                    SELECT 1 FROM task_runs AS candidate_active_run
-                    WHERE candidate_active_run.task_id = ${tasks2.id}
-                      AND candidate_active_run.status = 'running'
-                )`
-        )).orderBy(
+                SELECT 1 FROM task_runs AS candidate_active_run
+                WHERE candidate_active_run.task_id = ${tasks2.id}
+                  AND candidate_active_run.status = 'running'
+            )`
+        );
+      }
+      static async next(scope = {}) {
+        const result = await db.select().from(tasks2).where(this.buildRunnableTaskWhere(scope)).orderBy(
           desc(tasks2.urgency),
           desc(tasks2.importance),
           asc(tasks2.createdAt),
@@ -6701,6 +6714,22 @@ var init_task_service = __esm({
         ).limit(1);
         return result[0] ?? null;
       }
+      static async claimNext(scope = {}) {
+        return db.transaction((tx) => {
+          const candidate = tx.select().from(tasks2).where(this.buildRunnableTaskWhere(scope)).orderBy(
+            desc(tasks2.urgency),
+            desc(tasks2.importance),
+            asc(tasks2.createdAt),
+            asc(tasks2.id)
+          ).limit(1).get();
+          if (!candidate) return null;
+          return tx.update(tasks2).set({
+            status: "running",
+            startedAt: /* @__PURE__ */ new Date(),
+            finishedAt: null
+          }).where(eq(tasks2.id, candidate.id)).returning().get() ?? null;
+        }, { behavior: "immediate" });
+      }
       static async countRunning(scope = {}) {
         const scopeConditions = scope.legacyCwd ? [sql`${tasks2.cwd} IS NULL OR trim(${tasks2.cwd}) = ''`] : this.buildScopeWhere(scope);
         if (scope.batchId !== void 0) {
@@ -7361,9 +7390,34 @@ var init_launch_protocol = __esm({
 });
 
 // src/core/process-control.ts
-import { spawnSync } from "child_process";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { basename, dirname as dirname2, resolve } from "path";
+function runBoundedOsCommand(command, args, captureOutput = true) {
+  const result = Bun.spawnSync({
+    cmd: [
+      process.execPath,
+      "-e",
+      BOUNDED_OS_COMMAND_RUNNER,
+      "supertask-os-command",
+      command,
+      ...args
+    ],
+    detached: process.platform !== "win32",
+    maxBuffer: OS_COMMAND_MAX_OUTPUT_BYTES + 1024,
+    stdin: "ignore",
+    stdout: "pipe",
+    stderr: "ignore"
+  });
+  const output = new TextDecoder().decode(result.stdout);
+  const markerIndex = output.lastIndexOf(OS_COMMAND_RESULT_MARKER);
+  if (markerIndex < 0) return { status: null, stdout: "" };
+  const statusText2 = output.slice(markerIndex + OS_COMMAND_RESULT_MARKER.length);
+  if (!/^\d+$/.test(statusText2)) return { status: null, stdout: "" };
+  return {
+    status: Number(statusText2),
+    stdout: captureOutput ? output.slice(0, markerIndex) : ""
+  };
+}
 function isSafePid(pid) {
   return Number.isInteger(pid) && pid > 1 && pid !== process.pid;
 }
@@ -7400,12 +7454,10 @@ function inspectSpawnedProcessTreePresence(pid) {
   }
 }
 function inspectUnixProcess(pid) {
-  const result = spawnSync("ps", ["-o", "pgid=", "-o", "command=", "-p", String(pid)], {
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "ignore"],
-    timeout: OS_COMMAND_TIMEOUT_MS,
-    killSignal: "SIGKILL"
-  });
+  const result = runBoundedOsCommand(
+    "ps",
+    ["-o", "pgid=", "-o", "command=", "-p", String(pid)]
+  );
   if (result.status !== 0) return null;
   const match2 = result.stdout.trim().match(/^(\d+)\s+(.+)$/s);
   if (!match2) return null;
@@ -7413,30 +7465,18 @@ function inspectUnixProcess(pid) {
 }
 function inspectWindowsCommand(pid) {
   const script = `(Get-CimInstance Win32_Process -Filter "ProcessId = ${pid}").CommandLine`;
-  const result = spawnSync(
+  const result = runBoundedOsCommand(
     "powershell.exe",
-    ["-NoProfile", "-NonInteractive", "-Command", script],
-    {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
-      timeout: OS_COMMAND_TIMEOUT_MS,
-      killSignal: "SIGKILL"
-    }
+    ["-NoProfile", "-NonInteractive", "-Command", script]
   );
   if (result.status !== 0) return null;
   return result.stdout.trim() || null;
 }
 function inspectWindowsProcessTree(rootPid) {
   const script = `$root=${rootPid}; $all=@(Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId); $ids=New-Object 'System.Collections.Generic.HashSet[int]'; [void]$ids.Add($root); do { $added=$false; foreach($p in $all) { if($ids.Contains([int]$p.ParentProcessId) -and $ids.Add([int]$p.ProcessId)) { $added=$true } } } while($added); $all | Where-Object { $ids.Contains([int]$_.ProcessId) } | Select-Object -ExpandProperty ProcessId`;
-  const result = spawnSync(
+  const result = runBoundedOsCommand(
     "powershell.exe",
-    ["-NoProfile", "-NonInteractive", "-Command", script],
-    {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
-      timeout: OS_COMMAND_TIMEOUT_MS,
-      killSignal: "SIGKILL"
-    }
+    ["-NoProfile", "-NonInteractive", "-Command", script]
   );
   if (result.status !== 0) return null;
   return result.stdout.split(/\s+/).filter(Boolean).map(Number).filter((pid) => Number.isInteger(pid) && pid > 0);
@@ -7507,11 +7547,7 @@ function signalRecordedProcessTreeWithResult(pid, signal, expectedExecutable, la
     }
     const args = ["/PID", String(pid), "/T"];
     if (signal === "SIGKILL") args.push("/F");
-    const status = spawnSync("taskkill", args, {
-      stdio: "ignore",
-      timeout: OS_COMMAND_TIMEOUT_MS,
-      killSignal: "SIGKILL"
-    }).status;
+    const status = runBoundedOsCommand("taskkill", args, false).status;
     if (status === 0) return "signalled";
     return isProcessAlive(pid) ? "signal-failed" : absentLeaderResult(pid);
   }
@@ -7540,12 +7576,64 @@ async function waitForSpawnedProcessTreeExit(pid, timeoutMs = 5e3) {
   }
   return inspectSpawnedProcessTreePresence(pid) === "not-running";
 }
-var OS_COMMAND_TIMEOUT_MS;
+var OS_COMMAND_TIMEOUT_MS, OS_COMMAND_MAX_OUTPUT_BYTES, OS_COMMAND_RESULT_MARKER, BOUNDED_OS_COMMAND_RUNNER;
 var init_process_control = __esm({
   "src/core/process-control.ts"() {
     "use strict";
     init_launch_protocol();
     OS_COMMAND_TIMEOUT_MS = 2e3;
+    OS_COMMAND_MAX_OUTPUT_BYTES = 4 * 1024 * 1024;
+    OS_COMMAND_RESULT_MARKER = "\n\0supertask-os-command-result:";
+    BOUNDED_OS_COMMAND_RUNNER = `
+const { writeSync } = await import('fs');
+let child;
+try {
+    child = Bun.spawn(process.argv.slice(2), {
+        stdin: 'ignore',
+        stdout: 'pipe',
+        stderr: 'ignore',
+    });
+} catch {
+    process.exit(127);
+}
+const terminateGroup = () => {
+    if (process.platform !== 'win32') {
+        try {
+            process.kill(-process.pid, 'SIGKILL');
+        } catch {
+        }
+    }
+    try {
+        child.kill('SIGKILL');
+    } catch {
+    }
+    process.exit(1);
+};
+const timer = setTimeout(terminateGroup, ${OS_COMMAND_TIMEOUT_MS});
+try {
+    const chunks = [];
+    let outputBytes = 0;
+    const readOutput = async () => {
+        const reader = child.stdout.getReader();
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done) return;
+            outputBytes += value.byteLength;
+            if (outputBytes > ${OS_COMMAND_MAX_OUTPUT_BYTES}) terminateGroup();
+            chunks.push(value);
+        }
+    };
+    const [exitCode] = await Promise.all([child.exited, readOutput()]);
+    clearTimeout(timer);
+    for (const chunk of chunks) writeSync(1, chunk);
+    writeSync(1, ${JSON.stringify(OS_COMMAND_RESULT_MARKER)} + String(exitCode));
+    if (process.platform !== 'win32') terminateGroup();
+    process.exit(0);
+} catch {
+    clearTimeout(timer);
+    terminateGroup();
+}
+`;
   }
 });
 
@@ -7697,7 +7785,7 @@ var init_task_run_service = __esm({
           }
           if (current.childPid != null) {
             throw new LegacyRunAbandonConflictError(
-              `run #${runId} \u5DF2\u8BB0\u5F55 child PID ${current.childPid}\uFF0C\u5FC5\u987B\u7531 Worker/Watchdog \u786E\u8BA4\u8FDB\u7A0B\u6811\u9000\u51FA`
+              `run #${runId} \u5DF2\u8BB0\u5F55 child PID ${current.childPid}\uFF0C\u5FC5\u987B\u7531 Worker/Watchdog \u786E\u8BA4\u53D7\u7BA1\u8FDB\u7A0B\u7EC4\u6392\u7A7A`
             );
           }
           if (current.workerPid != null && isProcessAlive(current.workerPid)) {
@@ -16941,8 +17029,8 @@ var require_CronFileParser = __commonJS({
        * @throws If file cannot be read
        */
       static parseFileSync(filePath) {
-        const { readFileSync: readFileSync5 } = __require("fs");
-        const data = readFileSync5(filePath, "utf8");
+        const { readFileSync: readFileSync4 } = __require("fs");
+        const data = readFileSync4(filePath, "utf8");
         return _CronFileParser.#parseContent(data);
       }
       /**
@@ -17387,32 +17475,6 @@ var init_job_templates = __esm({
   }
 });
 
-// src/core/package-version.ts
-import { existsSync as existsSync4, readFileSync as readFileSync2 } from "fs";
-import { dirname as dirname4, join as join4 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
-function getPackageVersion() {
-  let directory = dirname4(fileURLToPath4(import.meta.url));
-  for (let depth = 0; depth < 5; depth += 1) {
-    const packagePath = join4(directory, "package.json");
-    if (existsSync4(packagePath)) {
-      try {
-        const pkg = JSON.parse(readFileSync2(packagePath, "utf8"));
-        if (typeof pkg.version === "string") return pkg.version;
-      } catch {
-        return "0.0.0";
-      }
-    }
-    directory = dirname4(directory);
-  }
-  return "0.0.0";
-}
-var init_package_version = __esm({
-  "src/core/package-version.ts"() {
-    "use strict";
-  }
-});
-
 // node_modules/hono/dist/compose.js
 var compose;
 var init_compose = __esm({
@@ -19670,7 +19732,7 @@ function cleanOutput(value) {
   return value.replace(ANSI_PATTERN, "").replace(/\r/g, "");
 }
 function runOpenCode(executable, args, cwd, timeoutMs) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve3, reject) => {
     const child = spawn2(executable, args, {
       cwd,
       env: process.env,
@@ -19748,7 +19810,7 @@ function runOpenCode(executable, args, cwd, timeoutMs) {
         reject(new OpenCodeCommandExitError(`OpenCode ${args.join(" ")} \u5931\u8D25\uFF1A${detail}`));
         return;
       }
-      resolve4(cleanOutput(stdout));
+      resolve3(cleanOutput(stdout));
     });
   });
 }
@@ -19819,9 +19881,9 @@ async function loadOpenCodeCatalog(cwd, options = {}) {
   const executable = options.executable ?? process.env.SUPERTASK_OPENCODE_BIN ?? "opencode";
   const timeoutMs = options.timeoutMs ?? COMMAND_TIMEOUT_MS;
   const cacheKey = `${executable}\0${cwd}`;
-  const cached = catalogCache.get(cacheKey);
-  if (options.useCache !== false && cached && cached.expiresAt > Date.now()) {
-    return cached.result;
+  const cached2 = catalogCache.get(cacheKey);
+  if (options.useCache !== false && cached2 && cached2.expiresAt > Date.now()) {
+    return cached2.result;
   }
   const result = Promise.all([
     runOpenCode(executable, ["models", "--verbose"], cwd, timeoutMs).catch((error) => {
@@ -20296,464 +20358,106 @@ var init_database_maintenance_service = __esm({
   }
 });
 
-// src/daemon/management-lock.ts
-import { Database as Database4 } from "bun:sqlite";
-var init_management_lock = __esm({
-  "src/daemon/management-lock.ts"() {
-    "use strict";
-  }
-});
-
-// src/daemon/pm2.ts
-import { execSync, spawnSync as spawnSync2 } from "child_process";
-import {
-  accessSync,
-  chmodSync as chmodSync2,
-  constants,
-  existsSync as existsSync6,
-  mkdirSync as mkdirSync3,
-  readFileSync as readFileSync3,
-  rmSync,
-  statSync as statSync3,
-  writeFileSync as writeFileSync2
-} from "fs";
-import { homedir as homedir3, userInfo } from "os";
-import { delimiter, dirname as dirname6, isAbsolute as isAbsolute2, join as join5, resolve as resolve3 } from "path";
+// src/web/gateway-diagnostic.ts
+import { spawn as spawn3 } from "child_process";
+import { existsSync as existsSync6 } from "fs";
+import { dirname as dirname6, join as join5 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
-import { Database as Database5 } from "bun:sqlite";
-function runtimeHome(env) {
-  return resolve3(env.HOME || homedir3());
-}
-function runtimePath(value, cwd) {
-  return resolve3(cwd, value);
-}
-function versionFile(env = process.env, cwd = process.cwd()) {
-  return env.SUPERTASK_VERSION_FILE ? runtimePath(env.SUPERTASK_VERSION_FILE, cwd) : join5(runtimeHome(env), ".local/share/opencode/supertask-gateway-version");
-}
-function getRunningVersion(env = process.env, cwd = process.cwd()) {
-  try {
-    const path = versionFile(env, cwd);
-    if (!existsSync6(path)) return null;
-    return readFileSync3(path, "utf-8").trim() || null;
-  } catch {
-    return null;
-  }
-}
-function packageVersionFromGatewayEntry(gatewayEntry) {
-  if (gatewayEntry === null) return null;
-  let directory = dirname6(gatewayEntry);
-  for (let depth = 0; depth < 6; depth += 1) {
-    const packagePath = join5(directory, "package.json");
-    if (existsSync6(packagePath)) {
-      try {
-        const pkg = JSON.parse(readFileSync3(packagePath, "utf8"));
-        if (pkg.name === "opencode-supertask" && typeof pkg.version === "string") {
-          return pkg.version;
-        }
-      } catch {
-      }
-    }
-    const parent = dirname6(directory);
-    if (parent === directory) break;
-    directory = parent;
-  }
-  return null;
-}
-function resolveRuntimeExecutable(command, env, cwd) {
-  if (isAbsolute2(command) || command.includes("/")) return runtimePath(command, cwd);
-  for (const entry of (env.PATH ?? "").split(delimiter)) {
-    if (!entry) continue;
-    const candidate = resolve3(cwd, entry, command);
+function killDiagnosticGroup(pid) {
+  if (process.platform !== "win32") {
     try {
-      accessSync(candidate, constants.X_OK);
-      return candidate;
+      process.kill(-pid, "SIGKILL");
+      return;
     } catch {
     }
   }
-  return command;
-}
-function runtimeScope(runtime) {
-  const { cwd, env } = runtime;
-  const home = runtimeHome(env);
-  return {
-    cwd: resolve3(cwd),
-    databasePath: env.SUPERTASK_DB_PATH ? runtimePath(env.SUPERTASK_DB_PATH, cwd) : join5(home, ".local/share/opencode/tasks.db"),
-    configPath: env.SUPERTASK_CONFIG_PATH ? runtimePath(env.SUPERTASK_CONFIG_PATH, cwd) : join5(home, ".config/opencode/supertask.json"),
-    opencodePath: resolveRuntimeExecutable(env.SUPERTASK_OPENCODE_BIN ?? "opencode", env, cwd),
-    home,
-    pm2Home: env.PM2_HOME ? runtimePath(env.PM2_HOME, cwd) : join5(home, ".pm2"),
-    managementLockPath: canonicalManagementLockPath(env, cwd)
-  };
-}
-function scopesMatch(left, right) {
-  return left.databasePath === right.databasePath && left.configPath === right.configPath && left.opencodePath === right.opencodePath && left.home === right.home && left.pm2Home === right.pm2Home && left.managementLockPath === right.managementLockPath;
-}
-function currentScope() {
-  return runtimeScope({ cwd: process.cwd(), env: process.env });
-}
-function diagnoseOpenCodeRuntime(runtime = {
-  cwd: process.cwd(),
-  env: process.env
-}) {
-  const executable = runtimeScope(runtime).opencodePath;
-  const result = spawnSync2(executable, ["--version"], {
-    cwd: runtime.cwd,
-    env: runtime.env,
-    encoding: "utf8",
-    timeout: 1e4,
-    killSignal: "SIGKILL"
-  });
-  const ok = result.status === 0 && result.error === void 0;
-  return {
-    ok,
-    executable,
-    version: ok ? result.stdout.trim() || result.stderr.trim() || null : null,
-    error: ok ? null : result.error?.message || result.stderr.trim() || result.stdout.trim() || `exit code ${result.status}`
-  };
-}
-function getGatewayDiagnostic(options = {}) {
-  const producerScope = currentScope();
-  if (!isPm2Installed()) {
-    return {
-      pm2Installed: false,
-      processFound: false,
-      status: null,
-      pid: null,
-      ready: false,
-      runningVersion: getRunningVersion(),
-      gatewayEntry: null,
-      gatewayPackageVersion: null,
-      logRotationInstalled: false,
-      startupConfigured: process.platform === "darwin" || process.platform === "linux" ? false : null,
-      currentScope: producerScope,
-      gatewayScope: null,
-      scopeMatches: false,
-      gatewayOpenCode: null
-    };
-  }
-  const processes = pm2JsonList();
-  const gateway = processes.find((item) => item.name === PROCESS_NAME);
-  const runtime = gatewayRuntimeFromProcess(gateway);
-  const gatewayEnv = runtime?.env ?? process.env;
-  const managedScope = runtime ? runtimeScope(runtime) : null;
-  const pid = typeof gateway?.pid === "number" ? gateway.pid : null;
-  const readyPath = managedScope?.databasePath ?? databasePath();
-  const lockedVersion = pid == null ? void 0 : gatewayVersionFromLock(pid, readyPath);
-  const gatewayEntry = runtime?.gatewayEntry ?? null;
-  return {
-    pm2Installed: true,
-    processFound: gateway != null,
-    status: gateway?.pm2_env?.status ?? null,
-    pid,
-    ready: pid != null && isGatewayReady(pid, readyPath),
-    runningVersion: lockedVersion === void 0 ? getRunningVersion(gatewayEnv, runtime?.cwd) : lockedVersion,
-    gatewayEntry,
-    gatewayPackageVersion: packageVersionFromGatewayEntry(gatewayEntry),
-    logRotationInstalled: processes.some((item) => item.name === "pm2-logrotate" && item.pm2_env?.status === "online"),
-    startupConfigured: process.platform === "darwin" ? isMacLaunchAgentConfigured(
-      gatewayEnv.PM2_HOME ?? join5(runtimeHome(gatewayEnv), ".pm2"),
-      runtime ?? void 0
-    ) : process.platform === "linux" ? isLinuxStartupConfigured(gatewayEnv, runtime?.cwd, runtime ?? void 0) : null,
-    currentScope: producerScope,
-    gatewayScope: managedScope,
-    scopeMatches: managedScope != null && scopesMatch(producerScope, managedScope),
-    gatewayOpenCode: runtime === null || !options.probeOpenCode ? null : diagnoseOpenCodeRuntime(runtime)
-  };
-}
-function pm2Bin(env = process.env) {
-  return env.SUPERTASK_PM2_BIN ?? (process.platform === "win32" ? "pm2.cmd" : "pm2");
-}
-function pm2CommandTimeoutMs(env = process.env) {
-  const configured = Number(env.SUPERTASK_PM2_COMMAND_TIMEOUT_MS ?? 15e3);
-  return Number.isFinite(configured) && configured > 0 ? configured : 15e3;
-}
-function resolvePm2Bin() {
-  const configured = pm2Bin();
-  if (isAbsolute2(configured)) return configured;
-  const result = spawnSync2("which", [configured], { encoding: "utf8" });
-  const resolved = result.status === 0 ? result.stdout.trim().split("\n")[0] : "";
-  if (!resolved) throw new Error(`[supertask] \u65E0\u6CD5\u89E3\u6790 pm2 \u53EF\u6267\u884C\u6587\u4EF6: ${configured}`);
-  return resolved;
-}
-function launchAgentPath() {
-  return process.env.SUPERTASK_LAUNCH_AGENT_PATH ?? join5(runtimeHome(process.env), "Library/LaunchAgents", `${MAC_LAUNCH_AGENT_LABEL}.plist`);
-}
-function launchctlBin() {
-  return process.env.SUPERTASK_LAUNCHCTL_BIN ?? "launchctl";
-}
-function xmlUnescape(value) {
-  return value.replaceAll("&apos;", "'").replaceAll("&quot;", '"').replaceAll("&gt;", ">").replaceAll("&lt;", "<").replaceAll("&amp;", "&");
-}
-function plistValue(contents, key) {
-  const escapedKey = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const match2 = contents.match(new RegExp(`<key>\\s*${escapedKey}\\s*</key>\\s*<string>([^<]*)</string>`));
-  return match2?.[1] ? xmlUnescape(match2[1]) : null;
-}
-function isMacLaunchAgentConfigured(expectedPm2Home, expectedRuntime) {
-  if (typeof process.getuid !== "function") return false;
-  const plistPath = launchAgentPath();
-  if (!existsSync6(plistPath)) return false;
   try {
-    const contents = readFileSync3(plistPath, "utf8");
-    const argumentsBlock = contents.match(
-      /<key>\s*ProgramArguments\s*<\/key>\s*<array>([\s\S]*?)<\/array>/
-    )?.[1];
-    const programArguments = argumentsBlock ? [...argumentsBlock.matchAll(/<string>([^<]*)<\/string>/g)].map((match2) => xmlUnescape(match2[1])) : [];
-    const bunPath = programArguments[0];
-    const supervisorEntry = programArguments[1];
-    const pm2Path = programArguments[2];
-    const pm2Home = plistValue(contents, "PM2_HOME");
-    const managementLock = plistValue(contents, "SUPERTASK_PM2_MANAGEMENT_LOCK");
-    if (!bunPath || !supervisorEntry || !pm2Path || !pm2Home || !managementLock) return false;
-    if (expectedPm2Home && pm2Home !== expectedPm2Home) return false;
-    const expectedManagementLock = expectedRuntime ? managementLockPath(expectedRuntime.env, expectedRuntime.cwd) : process.env.SUPERTASK_PM2_MANAGEMENT_LOCK ? managementLockPath() : join5(expectedPm2Home ?? currentScope().pm2Home, "supertask-gateway.manage.sqlite");
-    if (managementLock !== expectedManagementLock) return false;
-    accessSync(bunPath, constants.X_OK);
-    accessSync(supervisorEntry, constants.R_OK);
-    accessSync(pm2Path, constants.X_OK);
-    if (spawnSync2(bunPath, ["--version"], {
-      stdio: "ignore",
-      timeout: pm2CommandTimeoutMs(),
-      killSignal: "SIGKILL"
-    }).status !== 0) return false;
-    if (spawnSync2(pm2Path, ["--version"], {
-      stdio: "ignore",
-      env: { ...process.env, PM2_HOME: pm2Home },
-      timeout: pm2CommandTimeoutMs(),
-      killSignal: "SIGKILL"
-    }).status !== 0) return false;
-    const loaded = spawnSync2(
-      launchctlBin(),
-      ["print", `gui/${process.getuid()}/${MAC_LAUNCH_AGENT_LABEL}`],
-      {
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"],
-        timeout: pm2CommandTimeoutMs(),
-        killSignal: "SIGKILL"
-      }
-    );
-    if (loaded.status !== 0) return false;
-    if (!loaded.stdout.includes("state = running")) return false;
-    if (!loaded.stdout.includes(`path = ${plistPath}`)) return false;
-    if (!loaded.stdout.includes(`program = ${bunPath}`)) return false;
-    const dumpPath = join5(pm2Home, "dump.pm2");
-    const dump = JSON.parse(readFileSync3(dumpPath, "utf8"));
-    if (!Array.isArray(dump)) return false;
-    const gateway = dump.find((item) => item.name === PROCESS_NAME);
-    const dumpRuntime = gatewayRuntimeFromProcess(gateway);
-    if (!dumpRuntime || !hasRestorableSavedGatewayRuntime(gateway)) return false;
-    return expectedRuntime === void 0 || dumpRuntime.gatewayEntry === expectedRuntime.gatewayEntry && dumpRuntime.bunPath === expectedRuntime.bunPath && dumpRuntime.cwd === expectedRuntime.cwd && scopesMatch(runtimeScope(dumpRuntime), runtimeScope(expectedRuntime));
+    process.kill(pid, "SIGKILL");
   } catch {
-    return false;
   }
 }
-function systemctlBin(env = process.env) {
-  return env.SUPERTASK_SYSTEMCTL_BIN ?? "systemctl";
+function diagnosticEntry() {
+  const extension = import.meta.url.endsWith(".ts") ? "ts" : "js";
+  const moduleDir = dirname6(fileURLToPath5(import.meta.url));
+  const candidates = [
+    join5(moduleDir, `../daemon/gateway-diagnostic-runner.${extension}`),
+    join5(moduleDir, `../../src/daemon/gateway-diagnostic-runner.${extension}`)
+  ];
+  const entry = candidates.find((candidate) => existsSync6(candidate));
+  if (!entry) throw new Error(`Gateway diagnostic runner \u4E0D\u5B58\u5728\uFF1A${candidates.join(", ")}`);
+  return entry;
 }
-function isLinuxStartupConfigured(env = process.env, cwd = process.cwd(), expectedRuntime) {
-  const unit = env.SUPERTASK_PM2_SYSTEMD_UNIT ?? `pm2-${userInfo().username}.service`;
-  const enabled = spawnSync2(systemctlBin(env), ["is-enabled", unit], {
-    encoding: "utf8",
-    env,
-    stdio: ["ignore", "pipe", "ignore"],
-    timeout: pm2CommandTimeoutMs(env),
-    killSignal: "SIGKILL"
-  });
-  if (enabled.status !== 0 || enabled.stdout.trim() !== "enabled") return false;
-  const contents = spawnSync2(systemctlBin(env), ["cat", unit], {
-    encoding: "utf8",
-    env,
-    stdio: ["ignore", "pipe", "ignore"],
-    timeout: pm2CommandTimeoutMs(env),
-    killSignal: "SIGKILL"
+async function runGatewayDiagnostic() {
+  return new Promise((resolve3, reject) => {
+    const child = spawn3(process.execPath, [diagnosticEntry()], {
+      cwd: process.cwd(),
+      env: process.env,
+      detached: process.platform !== "win32",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    if (child.pid) activeProcessGroups.add(child.pid);
+    child.stdout?.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    child.once("error", reject);
+    child.once("close", (exitCode) => {
+      clearTimeout(timer);
+      if (child.pid) {
+        killDiagnosticGroup(child.pid);
+        activeProcessGroups.delete(child.pid);
+      }
+      if (timedOut) {
+        reject(new Error(`Gateway diagnostic runner \u8D85\u8FC7 ${DIAGNOSTIC_TIMEOUT_MS}ms \u672A\u5B8C\u6210`));
+        return;
+      }
+      if (exitCode !== 0) {
+        reject(new Error(stderr.trim() || `Gateway diagnostic runner \u9000\u51FA\u7801 ${exitCode}`));
+        return;
+      }
+      try {
+        resolve3(JSON.parse(stdout));
+      } catch (error) {
+        reject(error);
+      }
+    });
+    const timer = setTimeout(() => {
+      timedOut = true;
+      if (child.pid) killDiagnosticGroup(child.pid);
+      else child.kill("SIGKILL");
+    }, DIAGNOSTIC_TIMEOUT_MS);
   });
-  if (contents.status !== 0) return false;
-  const expectedPm2Home = env.PM2_HOME ?? join5(runtimeHome(env), ".pm2");
-  if (!contents.stdout.includes("resurrect") || !contents.stdout.includes(expectedPm2Home)) {
-    return false;
-  }
-  try {
-    const dump = JSON.parse(readFileSync3(join5(expectedPm2Home, "dump.pm2"), "utf8"));
-    if (!Array.isArray(dump)) return false;
-    const gateway = dump.find((item) => item.name === PROCESS_NAME);
-    const runtime = gatewayRuntimeFromProcess(gateway);
-    if (!runtime || !hasRestorableSavedGatewayRuntime(gateway)) return false;
-    return runtime.cwd === resolve3(cwd) && scopesMatch(runtimeScope(runtime), runtimeScope({ cwd, env })) && (expectedRuntime === void 0 || runtime.gatewayEntry === expectedRuntime.gatewayEntry && runtime.bunPath === expectedRuntime.bunPath);
-  } catch {
-    return false;
-  }
 }
-function isPm2Installed(env = process.env) {
-  const result = spawnSync2(pm2Bin(env), ["--version"], {
-    stdio: "ignore",
-    env,
-    shell: process.platform === "win32",
-    timeout: pm2CommandTimeoutMs(env),
-    killSignal: "SIGKILL"
+async function getDashboardGatewayDiagnostic(options = {}) {
+  if (!options.fresh && cached && cached.expiresAt > Date.now()) return cached.diagnostic;
+  if (!options.fresh && pending) return pending;
+  const operation = runGatewayDiagnostic().then((diagnostic) => {
+    cached = { expiresAt: Date.now() + CACHE_TTL_MS, diagnostic };
+    return diagnostic;
   });
-  return result.status === 0;
-}
-function resolveCommand(command) {
-  const lookup = process.platform === "win32" ? "where" : "which";
-  const result = spawnSync2(lookup, [command], { encoding: "utf8" });
-  return result.status === 0 ? result.stdout.trim().split("\n")[0] || null : null;
-}
-function npmPreferredEnvironment() {
-  if (process.platform === "win32") return null;
-  const npm = resolveCommand("npm");
-  const node = resolveCommand("node");
-  if (!npm || !node) return null;
-  const command = resolvePm2Bin();
-  const path = [.../* @__PURE__ */ new Set([
-    dirname6(command),
-    dirname6(npm),
-    dirname6(node),
-    "/usr/local/bin",
-    "/usr/bin",
-    "/bin"
-  ])].join(delimiter);
-  return { command, env: { ...process.env, PATH: path } };
-}
-function pm2Exec(args, options = {}) {
-  const npmEnvironment = options.preferNpm ? npmPreferredEnvironment() : null;
-  const effectiveEnv = options.env ?? npmEnvironment?.env ?? process.env;
-  const result = spawnSync2(npmEnvironment?.command ?? pm2Bin(effectiveEnv), args, {
-    stdio: ["pipe", "pipe", "pipe"],
-    encoding: "utf-8",
-    env: effectiveEnv,
-    shell: process.platform === "win32",
-    timeout: options.timeoutMs ?? pm2CommandTimeoutMs(effectiveEnv),
-    killSignal: "SIGKILL"
+  if (options.fresh) return operation;
+  pending = operation.finally(() => {
+    pending = null;
   });
-  const output = `${result.stdout ?? ""}${result.stderr ?? ""}`.trim();
-  if (result.error) return { ok: false, output: result.error.message };
-  return { ok: result.status === 0, output };
-}
-function requirePm2(args, action, options = {}) {
-  const result = pm2Exec(args, options);
-  if (!result.ok) throw new Error(`[supertask] ${action} failed: ${result.output || "unknown pm2 error"}`);
-  return result.output;
-}
-function pm2JsonList(env = process.env) {
-  const output = requirePm2(["jlist"], "pm2 jlist", { env });
-  try {
-    const parsed = JSON.parse(output);
-    if (!Array.isArray(parsed)) throw new Error("result is not an array");
-    return parsed;
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    throw new Error(`[supertask] Invalid pm2 jlist output: ${message}`);
-  }
-}
-function gatewayEntryFromProcess(processInfo) {
-  const args = processInfo?.pm2_env?.args ?? processInfo?.args;
-  const candidates = Array.isArray(args) ? [...args].reverse() : typeof args === "string" ? [args] : [];
-  const savedCwd = processInfo?.pm2_env?.pm_cwd ?? processInfo?.pm_cwd;
-  for (const candidate of candidates) {
-    const path = typeof savedCwd === "string" ? runtimePath(candidate, savedCwd) : candidate;
-    if (existsSync6(path)) return resolve3(path);
-  }
-  return null;
-}
-function gatewayEnvironmentFromProcess(processInfo) {
-  const saved = processInfo?.pm2_env?.env ?? processInfo?.env;
-  if (!saved) return { ...process.env };
-  const env = {};
-  for (const [key, value] of Object.entries(saved)) {
-    if (typeof value === "string") env[key] = value;
-  }
-  return env;
-}
-function gatewayRuntimeFromProcess(processInfo) {
-  const gatewayEntry = gatewayEntryFromProcess(processInfo);
-  if (!gatewayEntry) return null;
-  const savedBunPath = processInfo?.pm2_env?.pm_exec_path ?? processInfo?.pm_exec_path;
-  const savedCwd = processInfo?.pm2_env?.pm_cwd ?? processInfo?.pm_cwd;
-  const savedEnv = gatewayEnvironmentFromProcess(processInfo);
-  if (typeof savedBunPath !== "string" || typeof savedCwd !== "string") return null;
-  try {
-    accessSync(savedBunPath, constants.X_OK);
-    if (!statSync3(savedCwd).isDirectory()) return null;
-    if (spawnSync2(savedBunPath, ["--version"], {
-      stdio: "ignore",
-      env: savedEnv,
-      timeout: pm2CommandTimeoutMs(savedEnv),
-      killSignal: "SIGKILL"
-    }).status !== 0) return null;
-  } catch {
-    return null;
-  }
-  const killTimeout = processInfo?.pm2_env?.kill_timeout ?? processInfo?.kill_timeout;
-  return {
-    gatewayEntry,
-    bunPath: savedBunPath,
-    cwd: resolve3(savedCwd),
-    env: savedEnv,
-    killTimeoutMs: Number.isInteger(killTimeout) && killTimeout >= 5e3 ? killTimeout : void 0
-  };
-}
-function hasRestorableSavedGatewayRuntime(processInfo) {
-  return gatewayRuntimeFromProcess(processInfo) !== null;
-}
-function databasePath(env = process.env, cwd = process.cwd()) {
-  return env.SUPERTASK_DB_PATH ? runtimePath(env.SUPERTASK_DB_PATH, cwd) : join5(runtimeHome(env), ".local/share/opencode/tasks.db");
-}
-function isGatewayReady(expectedPid, path = databasePath()) {
-  if (!existsSync6(path)) return false;
-  let database = null;
-  try {
-    database = new Database5(path, { readonly: true });
-    const row = database.query(
-      "SELECT pid, heartbeat_at, ready_at FROM gateway_lock WHERE id = 1"
-    ).get();
-    if (!row || row.ready_at == null) return false;
-    if (expectedPid !== void 0 && row.pid !== expectedPid) return false;
-    const ageMs = Date.now() - row.heartbeat_at;
-    return ageMs >= -5e3 && ageMs < GATEWAY_LOCK_STALE_MS;
-  } catch {
-    return false;
-  } finally {
-    database?.close();
-  }
-}
-function gatewayVersionFromLock(expectedPid, path) {
-  if (!existsSync6(path)) return void 0;
-  let database = null;
-  try {
-    database = new Database5(path, { readonly: true });
-    const row = database.query(
-      "SELECT pid, version FROM gateway_lock WHERE id = 1"
-    ).get();
-    if (!row || row.pid !== expectedPid) return void 0;
-    return row.version;
-  } catch {
-    return void 0;
-  } finally {
-    database?.close();
-  }
+  return pending;
 }
-function managementLockPath(env = process.env, cwd = process.cwd()) {
-  const override = env.SUPERTASK_PM2_MANAGEMENT_LOCK;
-  if (override) return runtimePath(override, cwd);
-  return join5(runtimeScope({ env, cwd }).pm2Home, "supertask-gateway.manage.sqlite");
-}
-function canonicalManagementLockPath(env = process.env, cwd = process.cwd()) {
-  const home = runtimeHome(env);
-  const pm2Home = env.PM2_HOME ? runtimePath(env.PM2_HOME, cwd) : join5(home, ".pm2");
-  return join5(pm2Home, "supertask-gateway.manage.sqlite");
-}
-var __dirname, PROCESS_NAME, MAC_LAUNCH_AGENT_LABEL, GATEWAY_LOCK_STALE_MS;
-var init_pm2 = __esm({
-  "src/daemon/pm2.ts"() {
+var CACHE_TTL_MS, DIAGNOSTIC_TIMEOUT_MS, cached, pending, activeProcessGroups;
+var init_gateway_diagnostic = __esm({
+  "src/web/gateway-diagnostic.ts"() {
     "use strict";
-    init_config();
-    init_package_version();
-    init_management_lock();
-    init_package_version();
-    __dirname = dirname6(fileURLToPath5(import.meta.url));
-    PROCESS_NAME = "supertask-gateway";
-    MAC_LAUNCH_AGENT_LABEL = "com.supertask.pm2-resurrect";
-    GATEWAY_LOCK_STALE_MS = 3e4;
+    CACHE_TTL_MS = 5e3;
+    DIAGNOSTIC_TIMEOUT_MS = 2e4;
+    cached = null;
+    pending = null;
+    activeProcessGroups = /* @__PURE__ */ new Set();
+    process.once("exit", () => {
+      for (const pid of activeProcessGroups) killDiagnosticGroup(pid);
+    });
   }
 });
 
@@ -21422,7 +21126,7 @@ var init_ui = __esm({
       "details.enabledYes": "\u5DF2\u542F\u7528",
       "details.enabledNo": "\u5DF2\u505C\u7528",
       "dialog.cancelTask": "\u53D6\u6D88\u4EFB\u52A1 #{id}\uFF1F",
-      "dialog.cancelTaskBody": "\u8FD0\u884C\u4E2D\u7684\u4EFB\u52A1\u4F1A\u5728\u4E0B\u4E00\u4E2A\u8F6E\u8BE2\u5468\u671F\u7EC8\u6B62\u5BF9\u5E94\u8FDB\u7A0B\u6811\u3002",
+      "dialog.cancelTaskBody": "\u8FD0\u884C\u4E2D\u7684\u4EFB\u52A1\u4F1A\u5728\u4E0B\u4E00\u4E2A\u8F6E\u8BE2\u5468\u671F\u7EC8\u6B62\u5BF9\u5E94\u7684\u53D7\u7BA1\u8FDB\u7A0B\u7EC4\u3002",
       "dialog.retryTask": "\u91CD\u8BD5\u4EFB\u52A1 #{id}\uFF1F",
       "dialog.retryTaskBody": "\u4EFB\u52A1\u5C06\u56DE\u5230\u5F85\u6267\u884C\u72B6\u6001\uFF0C\u5E76\u91CD\u7F6E\u81EA\u52A8\u91CD\u8BD5\u9884\u7B97\u3002",
       "dialog.deleteTask": "\u5220\u9664\u4EFB\u52A1 #{id}\uFF1F",
@@ -21727,7 +21431,7 @@ var init_ui = __esm({
       "details.enabledYes": "Enabled",
       "details.enabledNo": "Disabled",
       "dialog.cancelTask": "Cancel task #{id}?",
-      "dialog.cancelTaskBody": "A running task will terminate its process tree on the next worker poll.",
+      "dialog.cancelTaskBody": "A running task will terminate its managed process group on the next worker poll.",
       "dialog.retryTask": "Retry task #{id}?",
       "dialog.retryTaskBody": "The task returns to pending and its automatic retry budget is reset.",
       "dialog.deleteTask": "Delete task #{id}?",
@@ -22149,14 +21853,14 @@ __export(web_exports, {
 });
 import {
   existsSync as existsSync7,
-  mkdirSync as mkdirSync4,
-  readFileSync as readFileSync4,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync3,
   readdirSync,
   renameSync as renameSync2,
-  statSync as statSync4,
-  writeFileSync as writeFileSync3
+  statSync as statSync3,
+  writeFileSync as writeFileSync2
 } from "fs";
-import { homedir as homedir4 } from "os";
+import { homedir as homedir3 } from "os";
 import { basename as basename3, dirname as dirname7, join as join6 } from "path";
 function setDashboardRuntimeConfig(config) {
   runtimeConfig = config === null ? null : structuredClone(config);
@@ -22182,10 +21886,13 @@ function resolveDashboardConfigState(runtimeAvailable, restartRequired, managedR
 function isSafeDashboardRestartTarget(diagnostic, currentPid) {
   return diagnostic.pm2Installed && diagnostic.processFound && diagnostic.status === "online" && diagnostic.pid === currentPid && diagnostic.ready && diagnostic.scopeMatches;
 }
-function canRestartCurrentGateway() {
+async function canRestartCurrentGateway(fresh = false) {
   if (runtimeConfig === null) return false;
   try {
-    return isSafeDashboardRestartTarget(getGatewayDiagnostic(), process.pid);
+    return isSafeDashboardRestartTarget(
+      await getDashboardGatewayDiagnostic({ fresh }),
+      process.pid
+    );
   } catch {
     return false;
   }
@@ -22204,7 +21911,7 @@ function listChildDirectories(path) {
     if (entry.isDirectory()) return [{ name: entry.name, path: entryPath, hidden: entry.name.startsWith(".") }];
     if (!entry.isSymbolicLink()) return [];
     try {
-      return statSync4(entryPath).isDirectory() ? [{ name: entry.name, path: entryPath, hidden: entry.name.startsWith(".") }] : [];
+      return statSync3(entryPath).isDirectory() ? [{ name: entry.name, path: entryPath, hidden: entry.name.startsWith(".") }] : [];
     } catch {
       return [];
     }
@@ -22442,7 +22149,7 @@ function readCurrentConfig() {
   const configPath = getConfigPath();
   if (!existsSync7(configPath)) return {};
   try {
-    return JSON.parse(readFileSync4(configPath, "utf-8"));
+    return JSON.parse(readFileSync3(configPath, "utf-8"));
   } catch {
     return {};
   }
@@ -22450,9 +22157,9 @@ function readCurrentConfig() {
 function writeConfig(cfg) {
   const configPath = getConfigPath();
   const dir = dirname7(configPath);
-  if (!existsSync7(dir)) mkdirSync4(dir, { recursive: true });
+  if (!existsSync7(dir)) mkdirSync3(dir, { recursive: true });
   const tempPath = `${configPath}.${process.pid}.tmp`;
-  writeFileSync3(tempPath, JSON.stringify(cfg, null, 2) + "\n", { mode: 384 });
+  writeFileSync2(tempPath, JSON.stringify(cfg, null, 2) + "\n", { mode: 384 });
   renameSync2(tempPath, configPath);
 }
 function statCard(value, label, tone, cardIcon, delay = "") {
@@ -22504,7 +22211,7 @@ function pagination(locale, basePath, page, pages, total, suffix = "") {
   const next = page < pages ? `<a class="btn" href="${basePath}?page=${page + 1}${suffix}">${t(locale, "pagination.next")}${icon("chevronRight")}</a>` : "";
   return `<div class="pagination">${previous}<span class="summary">${t(locale, "pagination.summary", { page, pages, total })}</span>${next}</div>`;
 }
-var app, LEGACY_PROJECT_FILTER, TASK_STATUSES, SESSION_ID_PATTERN, runtimeConfig, restartScheduled, dashboardApp, web_default;
+var app, LEGACY_PROJECT_FILTER, TASK_STATUSES, SESSION_ID_PATTERN, LOOPBACK_HOST_PATTERN, runtimeConfig, restartScheduled, dashboardApp, web_default;
 var init_web = __esm({
   "src/web/index.tsx"() {
     "use strict";
@@ -22521,7 +22228,7 @@ var init_web = __esm({
     init_config();
     init_health();
     init_job_templates();
-    init_pm2();
+    init_gateway_diagnostic();
     init_ui();
     app = new Hono2();
     LEGACY_PROJECT_FILTER = "__supertask_legacy__";
@@ -22534,9 +22241,18 @@ var init_web = __esm({
       "cancelled"
     ]);
     SESSION_ID_PATTERN = /^ses_[A-Za-z0-9_]+$/;
+    LOOPBACK_HOST_PATTERN = /^(?:localhost|127\.0\.0\.1|\[::1\])(?::([1-9]\d{0,4}))?$/i;
     runtimeConfig = null;
     restartScheduled = false;
     app.use("*", async (c, next) => {
+      const requestHostname = new URL(c.req.url).hostname;
+      const hostHeader = c.req.header("Host");
+      const loopbackHosts = ["localhost", "127.0.0.1", "[::1]"];
+      const hostMatch = hostHeader?.match(LOOPBACK_HOST_PATTERN) ?? null;
+      const hostPort = hostMatch?.[1] === void 0 ? null : Number(hostMatch[1]);
+      if (!loopbackHosts.includes(requestHostname) || hostHeader !== void 0 && (!hostMatch || hostPort !== null && hostPort > 65535)) {
+        return c.json({ error: "invalid dashboard host" }, 421);
+      }
       await next();
       c.header("X-Content-Type-Options", "nosniff");
       c.header("X-Frame-Options", "DENY");
@@ -22568,13 +22284,13 @@ var init_web = __esm({
       return c.json(health, health.status === "ok" ? 200 : 503);
     });
     app.get("/api/filesystem/directories", (c) => {
-      const requestedPath = c.req.query("path")?.trim() || homedir4();
+      const requestedPath = c.req.query("path")?.trim() || homedir3();
       try {
         validateTaskWorkingDirectory(requestedPath);
         return c.json({
           path: requestedPath,
           parent: dirname7(requestedPath),
-          home: homedir4(),
+          home: homedir3(),
           directories: listChildDirectories(requestedPath)
         });
       } catch (error) {
@@ -22908,7 +22624,7 @@ var init_web = __esm({
       const config = loadConfig();
       const activeConfig = runtimeConfig ?? config;
       const restartRequired = runtimeConfig !== null && !configsEqual(config, runtimeConfig);
-      const managedRestart = canRestartCurrentGateway();
+      const managedRestart = await canRestartCurrentGateway();
       const configState = resolveDashboardConfigState(
         runtimeConfig !== null,
         restartRequired,
@@ -23028,9 +22744,9 @@ var init_web = __esm({
       if (!isValidSessionId(run.sessionId)) return c.json({ error: "session unavailable" }, 409);
       return c.json({ command: sessionCommand(run.sessionId) });
     });
-    app.get("/api/gateway/status", (c) => {
+    app.get("/api/gateway/status", async (c) => {
       const savedConfig = loadConfig();
-      const managed = canRestartCurrentGateway();
+      const managed = await canRestartCurrentGateway();
       return c.json({
         pid: process.pid,
         managed,
@@ -23155,7 +22871,7 @@ var init_web = __esm({
         return c.json({
           success: true,
           restartRequired: runtimeConfig === null || !configsEqual(savedConfig, runtimeConfig),
-          managed: canRestartCurrentGateway()
+          managed: await canRestartCurrentGateway()
         });
       } catch (error) {
         return c.json({
@@ -23171,9 +22887,10 @@ var init_web = __esm({
         return c.json({ error: "confirmation must be RESTART" }, 400);
       }
       if (restartScheduled) return c.json({ error: "restart already scheduled" }, 409);
-      if (!canRestartCurrentGateway()) {
+      if (!await canRestartCurrentGateway(true)) {
         return c.json({ error: "\u5F53\u524D Gateway \u4E0D\u662F\u7531\u5339\u914D\u8FD0\u884C\u4F5C\u7528\u57DF\u7684 PM2 \u8FDB\u7A0B\u6258\u7BA1\uFF0C\u65E0\u6CD5\u4ECE\u7F51\u9875\u5B89\u5168\u91CD\u542F" }, 409);
       }
+      if (restartScheduled) return c.json({ error: "restart already scheduled" }, 409);
       restartScheduled = true;
       const previousPid = process.pid;
       setTimeout(() => {
@@ -23237,7 +22954,7 @@ function runCommandContext(executable, args, cwd) {
 function assertWorkerProcessIsolationSupported(platform = process.platform) {
   if (platform === "win32") {
     throw new Error(
-      "Windows Worker \u5DF2\u5B89\u5168\u7981\u7528\uFF1A\u5F53\u524D\u8FD0\u884C\u65F6\u65E0\u6CD5\u7528 Job Object \u8BC1\u660E\u6574\u4E2A OpenCode \u8FDB\u7A0B\u6811\u5DF2\u9000\u51FA"
+      "Windows Worker \u5DF2\u5B89\u5168\u7981\u7528\uFF1A\u5F53\u524D\u8FD0\u884C\u65F6\u65E0\u6CD5\u7528 Job Object \u63D0\u4F9B\u7B49\u4EF7\u7684\u53D7\u7BA1\u8FDB\u7A0B\u9694\u79BB\u4E0E\u6392\u7A7A\u8BC1\u660E"
     );
   }
 }
@@ -23248,17 +22965,24 @@ var WorkerEngine = class {
   pollTimer = null;
   heartbeatTimer = null;
   pollCyclePromise = null;
+  shutdownDeadlineMs = null;
+  settlementRetryWakeups = /* @__PURE__ */ new Set();
   cfg;
   opencodeBin;
   maxOutputChars;
+  settlementRetryDelaysMs;
+  settlementRetryIntervalMs;
   constructor(cfg, options = {}) {
     this.cfg = cfg.worker;
     this.opencodeBin = options.opencodeBin ?? process.env.SUPERTASK_OPENCODE_BIN ?? "opencode";
     this.maxOutputChars = options.maxOutputChars ?? DEFAULT_MAX_OUTPUT_CHARS;
+    this.settlementRetryDelaysMs = options.settlementRetryDelaysMs ?? [250, 1e3, 4e3];
+    this.settlementRetryIntervalMs = options.settlementRetryIntervalMs ?? 5e3;
   }
   start() {
     assertWorkerProcessIsolationSupported();
     this.stopped = false;
+    this.shutdownDeadlineMs = null;
     markGatewayActivity("worker");
     this.poll();
     this.heartbeatTimer = setInterval(() => {
@@ -23267,6 +22991,8 @@ var WorkerEngine = class {
   }
   async stop(gracePeriodMs = 0) {
     this.stopped = true;
+    this.shutdownDeadlineMs = Date.now() + Math.max(0, gracePeriodMs);
+    for (const wake of [...this.settlementRetryWakeups]) wake();
     if (this.pollTimer) {
       clearTimeout(this.pollTimer);
       this.pollTimer = null;
@@ -23336,21 +23062,18 @@ var WorkerEngine = class {
       if (databaseRunningCount >= this.cfg.maxConcurrency) break;
       let task;
       try {
-        task = await TaskService.next({ excludedBatchIds: [...this.activeBatchIds] });
+        task = await TaskService.claimNext({ excludedBatchIds: [...this.activeBatchIds] });
       } catch (err) {
         this.logError("task claim failed", err);
         throw err;
       }
       if (!task) break;
-      if (this.stopped) break;
-      if (!await TaskService.start(task.id)) continue;
-      const batchId = normalizeTaskBatchId(task.batchId);
-      if (batchId) this.activeBatchIds.add(batchId);
       if (this.stopped) {
         await TaskService.resetRunningToPending([task.id]);
-        this.releaseBatch(task);
         break;
       }
+      const batchId = normalizeTaskBatchId(task.batchId);
+      if (batchId) this.activeBatchIds.add(batchId);
       let runId = null;
       try {
         const launchIdentity = `gateway-${process.pid}:launch:${randomUUID()}`;
@@ -23483,8 +23206,8 @@ var WorkerEngine = class {
       }
     });
     let spawnError = null;
-    const spawned = new Promise((resolve4, reject) => {
-      child.once("spawn", resolve4);
+    const spawned = new Promise((resolve3, reject) => {
+      child.once("spawn", resolve3);
       child.once("error", (error) => {
         spawnError = error;
         reject(error);
@@ -23532,10 +23255,10 @@ var WorkerEngine = class {
       return;
     }
     try {
-      await new Promise((resolve4, reject) => {
+      await new Promise((resolve3, reject) => {
         child.stdin.end("START\n", (error) => {
           if (error) reject(error);
-          else resolve4();
+          else resolve3();
         });
       });
     } catch (error) {
@@ -23561,7 +23284,7 @@ var WorkerEngine = class {
     if (!entry.guardianDrained) {
       const pid = entry.child.pid;
       const presence = pid == null ? spawnError == null ? "unknown" : "not-running" : inspectSpawnedProcessTreePresence(pid);
-      const message = "guardian \u672A\u63D0\u4F9B\u8FDB\u7A0B\u6811\u6392\u7A7A\u8BC1\u660E";
+      const message = "guardian \u672A\u63D0\u4F9B\u53D7\u7BA1\u8FDB\u7A0B\u7EC4\u6392\u7A7A\u8BC1\u660E";
       if (presence !== "not-running") {
         if (entry.timeoutTimer) {
           clearTimeout(entry.timeoutTimer);
@@ -23597,17 +23320,48 @@ var WorkerEngine = class {
       clearTimeout(entry.timeoutTimer);
       entry.timeoutTimer = null;
     }
-    const settlement = this.commitEntry(entry, code, failure).then(() => true).catch((error) => {
-      markGatewayFailure("worker", error);
-      this.logError("task settlement failed", error, entry.task.id);
-      return false;
-    }).finally(() => {
+    const settlement = this.commitEntryWithRetry(entry, code, failure).finally(() => {
       this.runningTasks.delete(entry.task.id);
       this.releaseBatch(entry.task);
     });
     entry.settlementPromise = settlement;
     return settlement;
   }
+  async commitEntryWithRetry(entry, code, failure) {
+    for (let attempt = 0; ; attempt += 1) {
+      try {
+        await this.commitEntry(entry, code, failure);
+        return true;
+      } catch (error) {
+        markGatewayFailure("worker", error);
+        const shortRetryDelayMs = this.settlementRetryDelaysMs[attempt];
+        let retryDelayMs = shortRetryDelayMs ?? this.settlementRetryIntervalMs;
+        if (this.stopped) {
+          const remainingMs = Math.max(0, (this.shutdownDeadlineMs ?? 0) - Date.now());
+          if (remainingMs === 0) return false;
+          retryDelayMs = Math.min(retryDelayMs, remainingMs);
+        }
+        this.logError(
+          `task settlement failed; retrying in ${retryDelayMs}ms`,
+          error,
+          entry.task.id
+        );
+        await this.waitForSettlementRetry(retryDelayMs);
+      }
+    }
+  }
+  waitForSettlementRetry(delayMs) {
+    return new Promise((resolve3) => {
+      let timer;
+      const finish = () => {
+        clearTimeout(timer);
+        this.settlementRetryWakeups.delete(finish);
+        resolve3();
+      };
+      timer = setTimeout(finish, delayMs);
+      this.settlementRetryWakeups.add(finish);
+    });
+  }
   async commitEntry(entry, code, failure) {
     const termination = entry.termination;
     if (termination?.kind === "shutdown") return;
@@ -24174,7 +23928,29 @@ init_db2();
 init_task_service();
 init_health();
 init_process_control();
-init_package_version();
+
+// src/core/package-version.ts
+import { existsSync as existsSync4, readFileSync as readFileSync2 } from "fs";
+import { dirname as dirname4, join as join4 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
+function getPackageVersion() {
+  let directory = dirname4(fileURLToPath4(import.meta.url));
+  for (let depth = 0; depth < 5; depth += 1) {
+    const packagePath = join4(directory, "package.json");
+    if (existsSync4(packagePath)) {
+      try {
+        const pkg = JSON.parse(readFileSync2(packagePath, "utf8"));
+        if (typeof pkg.version === "string") return pkg.version;
+      } catch {
+        return "0.0.0";
+      }
+    }
+    directory = dirname4(directory);
+  }
+  return "0.0.0";
+}
+
+// src/gateway/index.ts
 var STALE_THRESHOLD_MS = 3e4;
 async function runGatewayShutdownStep(failures, step, operation) {
   try {