pi-harness-runtime 1.1.34 → 1.1.37

package/harness/langchain/daemon.ts

@@ -29,7 +29,6 @@
 import { randomUUID } from "node:crypto";
 import {
 	existsSync,
-	mkdirSync,
 	readdirSync,
 	readFileSync,
 	writeFileSync,
@@ -90,6 +89,8 @@ export interface DaemonConfig {
 	costCapUsd?: number;
 	/** Surge (529/overloaded) retry policy. Default: 3→6→12 min, max 5 pauses */
 	surgePolicy?: Partial<SurgePolicy>;
+	/** Kill a task if it runs longer than this (ms). Prevents permanent freezes. Default: no timeout */
+	taskTimeoutMs?: number;
 	/** Use persistent file-based checkpointer for crash-resume. Default: false (MemorySaver). */
 	checkpointer?: boolean | string;
 	/** @internal Test injection — overrides dryRun/real deps entirely */
@@ -105,6 +106,16 @@ export interface DaemonConfig {
 		ntfyTopic?: string;
 		webhookUrl?: string;
 	};
+	/**
+	 * Path to a tunnel-start script (e.g. tailscale-tunnel.sh).
+	 * If set, the daemon health-checks the tunnel before each task and
+	 * auto-restarts it if the target port is unreachable.
+	 *
+	 * Set to "auto" to search for scripts/tailscale-tunnel.sh in the
+	 * project root, or give an absolute path.
+	 * Default: none (no tunnel management)
+	 */
+	tunnelCommand?: string;
 }
 
 // ─── TriggeredTask ──────────────────────────────────────────────────────────
@@ -199,6 +210,13 @@ function effectivePolicy(
 	return policy;
 }
 
+/** Rejects after `ms` milliseconds — used to time-box task execution. */
+function timeoutPromise(ms: number): Promise<never> {
+	return new Promise<never>((_, reject) =>
+		setTimeout(() => reject(new Error(`Task timed out after ${ms}ms`)), ms),
+	);
+}
+
 /** Wait (poll) for a human ack file or bus event. Returns true if approved. */
 async function waitForAck(
 	task: TriggeredTask,
@@ -498,7 +516,135 @@ class BdTasksWatcher {
 	}
 }
 
-// ─── Loop Daemon ────────────────────────────────────────────────────────────
+// ─── Tunnel Health Monitor ───────────────────────────────────────────────────
+
+/**
+ * Monitors the health of a SSH tunnel (e.g. tailscale-tunnel.sh) and
+ * auto-restarts it if the target port becomes unreachable.
+ *
+ * This prevents the daemon from freezing when the tunnel drops silently —
+ * a common cause of tasks that appear to hang forever.
+ */
+class TunnelMonitor {
+	private readonly scriptPath: string;
+	private readonly checkIntervalMs: number;
+	private readonly targetHost: string;
+	private readonly targetPort: number;
+	private running = false;
+	private timer?: ReturnType<typeof setTimeout>;
+	private consecutiveFailures = 0;
+	private readonly maxConsecutiveFailures = 2;
+
+	constructor(scriptPath: string, opts: {
+		checkIntervalMs?: number;
+		targetHost?: string;
+		targetPort?: number;
+	} = {}) {
+		this.scriptPath = scriptPath;
+		this.checkIntervalMs = opts.checkIntervalMs ?? 30_000; // 30s default
+		this.targetHost = opts.targetHost ?? "127.0.0.1";
+		this.targetPort = opts.targetPort ?? 5433;
+	}
+
+	start(): void {
+		this.running = true;
+		console.log(
+			`[tunnel-monitor] Starting — script=${this.scriptPath}, check every ${this.checkIntervalMs / 1000}s, target=${this.targetHost}:${this.targetPort}`,
+		);
+		this._check();
+	}
+
+	stop(): void {
+		this.running = false;
+		if (this.timer) {
+			clearTimeout(this.timer);
+			this.timer = undefined;
+		}
+		console.log("[tunnel-monitor] Stopped.");
+	}
+
+	/**
+	 * Run a health check and restart if the port is down.
+	 * Returns true if the tunnel is healthy.
+	 */
+	async checkAndFix(): Promise<boolean> {
+		const healthy = await this._isPortOpen();
+		if (healthy) {
+			this.consecutiveFailures = 0;
+			return true;
+		}
+
+		this.consecutiveFailures++;
+		console.warn(
+			`[tunnel-monitor] Port ${this.targetHost}:${this.targetPort} unreachable (failure #${this.consecutiveFailures})`,
+		);
+
+		if (this.consecutiveFailures >= this.maxConsecutiveFailures) {
+			console.warn(`[tunnel-monitor] Tunnel appears down — restarting...`);
+			await this._restartTunnel();
+			this.consecutiveFailures = 0;
+		}
+
+		return false;
+	}
+
+	private async _check(): Promise<void> {
+		if (!this.running) return;
+		await this.checkAndFix();
+		this.timer = setTimeout(() => this._check(), this.checkIntervalMs);
+	}
+
+	private async _isPortOpen(): Promise<boolean> {
+		const { createConnection } = await import("node:net");
+		return new Promise((resolve) => {
+			const socket = createConnection({
+				host: this.targetHost,
+				port: this.targetPort,
+				timeout: 2_000, // 2s timeout — just checking reachability
+			});
+			socket.on("connect", () => {
+				socket.destroy();
+				resolve(true);
+			});
+			socket.on("timeout", () => {
+				socket.destroy();
+				resolve(false);
+			});
+			socket.on("error", () => {
+				resolve(false);
+			});
+		});
+	}
+
+	private async _restartTunnel(): Promise<void> {
+		const { exec } = await import("node:child_process");
+		const { promisify } = await import("node:util");
+		const execAsync = promisify(exec);
+
+		try {
+			// Stop first
+			await execAsync(`bash "${this.scriptPath}" stop 2>/dev/null`, {
+				timeout: 10_000,
+			}).catch(() => {}); // ignore errors on stop
+
+			// Small delay before restart
+			await new Promise((r) => setTimeout(r, 1_000));
+
+			// Start
+			const { stdout, stderr } = await execAsync(
+				`bash "${this.scriptPath}" start 2>&1`,
+				{ timeout: 30_000 },
+			);
+			console.log(`[tunnel-monitor] Restart output: ${stdout.trim() || stderr.trim() || "ok"}`);
+		} catch (err) {
+			console.error(
+				`[tunnel-monitor] Restart failed: ${err instanceof Error ? err.message : String(err)}`,
+			);
+		}
+	}
+}
+
+// ─── Loop Daemon ───────────────────────────────────────────────────────────
 
 /**
  * The main daemon class. Coordinates watchers, leasing, loop execution, and
@@ -521,6 +667,7 @@ export class LoopDaemon {
 	private readonly inboxWatcher: InboxWatcher;
 	private readonly busWatcher: BusWatcher;
 	private readonly bdWatcher: BdTasksWatcher;
+	private readonly tunnelMonitor: TunnelMonitor | null;
 
 	/** Currently running tasks (taskId → RunningTask) */
 	private readonly running = new Map<string, RunningTask>();
@@ -537,10 +684,13 @@ export class LoopDaemon {
 			approvalPolicy: config.approvalPolicy ?? "never",
 			dryRun: config.dryRun ?? false,
 			costCapUsd: config.costCapUsd ?? undefined,
+			surgePolicy: config.surgePolicy,
+			taskTimeoutMs: config.taskTimeoutMs,
+			checkpointer: config.checkpointer,
 			sources: config.sources ?? ["inbox", "bus"],
 			workspace: config.workspace ?? getHerdrWorkspace(),
 			notificationConfig: config.notificationConfig ?? undefined,
-			checkpointer: config.checkpointer,
+			tunnelCommand: config.tunnelCommand,
 		} as Required<DaemonConfig>;
 
 		this.agentId = this.config.agentId;
@@ -571,6 +721,13 @@ export class LoopDaemon {
 		this.busWatcher = new BusWatcher(this.bus, this.config.pollMs);
 		this.bdWatcher = new BdTasksWatcher(this.config.pollMs);
 
+		// Tunnel monitor — only active when a tunnel script is configured
+		if (this.config.tunnelCommand) {
+			this.tunnelMonitor = new TunnelMonitor(this.config.tunnelCommand);
+		} else {
+			this.tunnelMonitor = null;
+		}
+
 		// Reap stale leases from previous runs
 		const reclaimed = this.leaseManager.recoverOnStartup();
 		if (reclaimed.length > 0) {
@@ -604,6 +761,8 @@ export class LoopDaemon {
 			this.bdWatcher.start((t) => this._onTriggered(t));
 		}
 
+		this.tunnelMonitor?.start();
+
 		console.log("[daemon] Started.");
 	}
 
@@ -615,6 +774,7 @@ export class LoopDaemon {
 		this.inboxWatcher.stop();
 		this.busWatcher.stop();
 		this.bdWatcher.stop();
+		this.tunnelMonitor?.stop();
 
 		// Release all held leases
 		for (const [taskId, _runningTask] of this.running) {
@@ -679,6 +839,14 @@ export class LoopDaemon {
 		const log = (msg: string) => console.log(`[${loopId}] ${msg}`);
 
 		try {
+			// ── Tunnel health check — self-heal before running a task ───────────────
+			if (this.tunnelMonitor) {
+				const tunnelOk = await this.tunnelMonitor.checkAndFix();
+				if (!tunnelOk) {
+					log("Tunnel health check failed — waiting for tunnel restart...");
+				}
+			}
+
 			// ── Gate check (I7) ──────────────────────────────────────────────
 			const policy = effectivePolicy(task, this.config);
 			if (policy === "always" || policy === "on_blocked") {
@@ -722,39 +890,59 @@ export class LoopDaemon {
 			log(
 				`Starting write-review loop (maxIterations=${this.config.maxIterations})`,
 			);
-			const checkpointer =
-				this.config.checkpointer === false
-					? false
-					: this.config.checkpointer === true ||
-							typeof this.config.checkpointer === "string"
-						? createLoopCheckpointer(
-								this.config.checkpointer === true
-									? this.bus.getWorkspace()
-									: (this.config.checkpointer as string),
-							)
-						: undefined; // default MemorySaver
+			const checkpointer = (() => {
+				if (this.config.checkpointer === false) return false;
+				if (this.config.checkpointer === true || typeof this.config.checkpointer === "string") {
+					return createLoopCheckpointer(
+						this.config.checkpointer === true
+							? this.bus.getWorkspace()
+						: (this.config.checkpointer as string),
+					);
+				}
+				return undefined; // default MemorySaver
+			})();
 			const loop: WriteReviewLoop = buildWriteReviewLoop(deps, { checkpointer });
 
-			const finalState = await invokeWithSurgeRetry(
-				() =>
-					loop.invoke(
-						{ request: task.request },
-						{ configurable: { thread_id: loopId } },
-					),
-				{
-					policy: this.config.surgePolicy,
-					onSurge: ({ attempt, delayMs }) =>
-						log(
-							`Provider surge (529) — resume in ${Math.round(delayMs / 1000)}s (attempt ${attempt})`,
+			const invokeTask = (signal?: AbortSignal) =>
+				invokeWithSurgeRetry(
+					() =>
+						loop.invoke(
+							{ request: task.request },
+							{ configurable: { thread_id: loopId }, signal },
 						),
-					onExhausted: () => {
-						this._notifyHumanReviewNeeded(
-							task,
-							"Provider surged past max surge attempts — task failed",
-						);
+					{
+						policy: this.config.surgePolicy,
+						onSurge: ({ attempt, delayMs }) =>
+							log(
+								`Provider surge (529) — resume in ${Math.round(delayMs / 1000)}s (attempt ${attempt})`,
+							),
+						onExhausted: () => {
+							this._notifyHumanReviewNeeded(
+								task,
+								"Provider surged past max surge attempts — task failed",
+							);
+						},
 					},
-				},
-			);
+				);
+
+			let finalState: Awaited<ReturnType<typeof invokeTask>>;
+			if (this.config.taskTimeoutMs) {
+				const ac = new AbortController();
+				const timeout = setTimeout(() => {
+					log(`Task timed out after ${this.config.taskTimeoutMs}ms — aborting`);
+					ac.abort();
+				}, this.config.taskTimeoutMs);
+				try {
+					finalState = await Promise.race([
+						invokeTask(ac.signal),
+						timeoutPromise(this.config.taskTimeoutMs),
+					]);
+				} finally {
+					clearTimeout(timeout);
+				}
+			} else {
+				finalState = await invokeTask();
+			}
 
 			const verdict = finalState.review?.verdict ?? "blocked";
 			const iterations = finalState.iteration ?? 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-harness-runtime",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "description": "[BETA] Codex-style /usage status + autonomous coding harness for pi. Not production ready — expect breaking changes.",
   "type": "module",
   "scripts": {

package/packages/a2a-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/a2a-adapter",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "type": "module",
   "description": "Google Agent-to-Agent (A2A) protocol adapter for pi-harness",
   "main": "dist/index.js",

package/packages/architecture-generator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/architecture-generator",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "description": "Generate ADR and Mermaid diagrams from project analysis",
   "type": "module",
   "main": "./dist/index.js",

package/packages/auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/auth",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "description": "pi-harness-runtime — auth",
   "type": "module",
   "main": "./dist/index.js",

package/packages/autonomous-refactor/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/autonomous-refactor",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "type": "module",
   "description": "Autonomous refactoring engine",
   "main": "dist/index.js",

package/packages/autonomous-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/autonomous-runtime",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "description": "Autonomous Operations Runtime — task inbox, lease management, and worker lifecycle (RFC-0101)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cache-strategy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/cache-strategy",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "type": "module",
   "description": "Smart caching with TTL and invalidation strategies (RFC-0022)",
   "main": "dist/index.js",

package/packages/capability-registry/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/capability-registry",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "description": "Capability Registry for pi-harness-runtime — tracks model capabilities and enables capability-based routing",
   "type": "module",
   "main": "./dist/index.js",

package/packages/checkpoint/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/checkpoint",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "description": "Enhanced checkpoint system with incremental snapshots, diff-based storage, and recovery strategies",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cli-plugin-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/cli-plugin-sdk",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "type": "module",
   "description": "CLI Plugin SDK for pi-harness — install, list, remove, update, invoke plugins",
   "main": "dist/index.js",

package/packages/clipboard/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/clipboard",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/clipboard-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/clipboard-plugin",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/code-generation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/code-generation",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "description": "Code generation pipeline for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/code-review/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/code-review",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "description": "Automated code review engine for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/codex-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/codex-adapter",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "type": "module",
   "description": "OpenAI Codex provider adapter for pi-harness",
   "main": "dist/index.js",

package/packages/config-capture/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/config-capture",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "description": "Auto-capture API-fetched configuration values to AGENTS.md",
   "type": "module",
   "main": "src/index.ts",

package/packages/context-compiler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/context-compiler",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "description": "Bounded context selection engine for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/context-discovery/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/context-discovery",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/context-manager/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/context-manager",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "description": "Context Window Manager — prevents model context overflow via compaction and resume prompts (RFC-0010)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cookie-sanitizer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/cookie-sanitizer",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "description": "pi-harness-runtime — cookie sanitizer (provider-quota cookie file normaliser)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cost-optimizer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/cost-optimizer",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "description": "Cost Optimizer for pi-harness-runtime — budget tracking, forecasting, and model selection optimization",
   "type": "module",
   "main": "./dist/index.js",

package/packages/dependency-analyzer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/dependency-analyzer",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/django-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/django-plugin",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "description": "Django framework analysis — models, management commands, settings",
   "type": "module",
   "main": "./dist/index.js",

package/packages/doc-generator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/doc-generator",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "description": "Auto-Doc Generator — generate documentation from source code (RFC-0014)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/evaluation-engine/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/evaluation-engine",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "description": "Evaluation engine for pi-harness runtime (RFC-0057)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/evaluation-runner/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/evaluation-runner",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "type": "module",
   "description": "Framework-agnostic evaluation framework for AI outputs (RFC-0020)",
   "main": "dist/index.js",

package/packages/event-bus/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/event-bus",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/event-store/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/event-store",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/experience-replay/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/experience-replay",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "description": "Experience replay for debugging and reproducibility (RFC-0059)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/feedback-collector/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/feedback-collector",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "type": "module",
   "description": "Collect and aggregate human/automated feedback (RFC-0021)",
   "main": "dist/index.js",

package/packages/file-copy-helper/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/file-copy-helper",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "description": "Injects cp/sudo cp rule when user asks to mimic/copy files",
   "type": "module",
   "main": "dist/index.js",

package/packages/framework-detector/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/framework-detector",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "description": "Framework detection system for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/framework-plugin-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/framework-plugin-sdk",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "description": "Framework plugin SDK for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/frappe-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/frappe-plugin",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "description": "Frappe/ERPNext framework analysis — DocTypes, hooks, bench sites, site config",
   "type": "module",
   "main": "./dist/index.js",

package/packages/generic-web-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/generic-web-plugin",
-  "version": "1.1.34",
+  "version": "1.1.37",
   "description": "Generic web framework analysis — REST/GraphQL endpoints, OpenAPI, auth",
   "type": "module",
   "main": "./dist/index.js",