wood-fired-tasks 2.1.1 → 2.2.0

package/dist/cli/commands/login.js

@@ -48,6 +48,7 @@ function emitJsonEvent(event) {
  */
 export async function runDeviceLogin(args) {
     const { baseUrl, clientId, hostname, tokenName, openBrowser: shouldOpenBrowser, isJson } = args;
+    const opener = args.opener ?? openBrowser;
     // 2. Request a device_code from the server.
     let codeResponse;
     try {
@@ -99,7 +100,7 @@ export async function runDeviceLogin(args) {
     }
     // 4. Best-effort browser launch (skipped if !openBrowser).
     if (shouldOpenBrowser) {
-        const opened = openBrowser(verification_uri_complete);
+        const opened = opener(verification_uri_complete);
         if (!isJson) {
             if (opened) {
                 process.stderr.write('(Opening browser...)\n');

package/dist/cli/commands/models.d.ts

@@ -1,5 +1,5 @@
 import { Command } from 'commander';
-import { type ModelPolicy } from '../../schemas/model-policy.schema.js';
+import { type ModelPolicy, type PipelineRole } from '../../schemas/model-policy.schema.js';
 /**
  * Configurable Task Models (Task 12) — CLI surface.
  *
@@ -14,9 +14,13 @@ import { type ModelPolicy } from '../../schemas/model-policy.schema.js';
  * `settings-set-models.ts`). They turn the flat Commander option bag into a
  * validated partial `ModelPolicy` (`ModelPolicySchema.parse`).
  */
-/** The three dispatch roles a policy can configure. */
+/**
+ * The three dispatch roles a policy can configure. Derived from the
+ * single-source `PIPELINE_ROLES` (task #929); kept under the CLI-local names
+ * so existing call sites are undisturbed.
+ */
 export declare const MODEL_ROLES: readonly ["execution", "validation", "planning"];
-export type ModelRole = (typeof MODEL_ROLES)[number];
+export type ModelRole = PipelineRole;
 /**
  * Register the per-role model flags on a Commander command:
  *   --<role>-<category> <model|auto>   (byCategory route)
@@ -41,4 +45,35 @@ export declare function buildModelPolicyFromOptions(options: Record<string, stri
  * `set-models` UX. Returns a schema-validated complete policy to persist.
  */
 export declare function mergeModelPolicies(existing: ModelPolicy | null | undefined, partial: ModelPolicy): ModelPolicy;
+/**
+ * Read `--json` off the GLOBAL program options for a set-models subcommand.
+ * The flag is registered on the root program, so subcommands must reach up via
+ * `optsWithGlobals()`. Shared by `project-set-models` / `settings-set-models`.
+ */
+export declare function resolveSetModelsJsonMode(command: Command): boolean;
+/**
+ * Outcome of {@link parseSetModelsOptions}: either a validated partial policy
+ * ready to merge+persist, or a `stop` sentinel meaning the command already
+ * emitted its message and set `process.exitCode = 1` — the caller just returns.
+ */
+export type ParseSetModelsResult = {
+    stop: true;
+} | {
+    stop: false;
+    policy: ModelPolicy;
+};
+/**
+ * Shared set-models preamble for `project-set-models` / `settings-set-models`:
+ *
+ *   1. Assemble + validate a partial policy from the flat option bag
+ *      (`buildModelPolicyFromOptions`). On a validation error, print it and
+ *      set `process.exitCode = 1`, returning `{ stop: true }`.
+ *   2. When no model flags were supplied, warn and set `process.exitCode = 1`,
+ *      returning `{ stop: true }`.
+ *   3. Otherwise return `{ stop: false, policy }`.
+ *
+ * Extracting this keeps the two commands' parse/validate/no-flags behavior and
+ * output byte-identical from one source.
+ */
+export declare function parseSetModelsOptions(options: Record<string, string | undefined>): ParseSetModelsResult;
 export declare const modelsCommand: Command;

package/dist/cli/commands/models.js

@@ -1,9 +1,9 @@
 import { Command } from 'commander';
 import { listModels } from '../api/client.js';
-import { colorWarn } from '../output/formatters.js';
+import { colorError, colorWarn } from '../output/formatters.js';
 import { handleError } from '../output/error-handler.js';
 import { jsonOutput } from '../output/json-output.js';
-import { POWER_CATEGORIES, ModelPolicySchema, } from '../../schemas/model-policy.schema.js';
+import { PIPELINE_ROLES, POWER_CATEGORIES, ModelPolicySchema, } from '../../schemas/model-policy.schema.js';
 /**
  * Configurable Task Models (Task 12) — CLI surface.
  *
@@ -18,8 +18,12 @@ import { POWER_CATEGORIES, ModelPolicySchema, } from '../../schemas/model-policy
  * `settings-set-models.ts`). They turn the flat Commander option bag into a
  * validated partial `ModelPolicy` (`ModelPolicySchema.parse`).
  */
-/** The three dispatch roles a policy can configure. */
-export const MODEL_ROLES = ['execution', 'validation', 'planning'];
+/**
+ * The three dispatch roles a policy can configure. Derived from the
+ * single-source `PIPELINE_ROLES` (task #929); kept under the CLI-local names
+ * so existing call sites are undisturbed.
+ */
+export const MODEL_ROLES = PIPELINE_ROLES;
 /**
  * Register the per-role model flags on a Commander command:
  *   --<role>-<category> <model|auto>   (byCategory route)
@@ -106,6 +110,46 @@ export function mergeModelPolicies(existing, partial) {
     }
     return ModelPolicySchema.parse(merged);
 }
+/**
+ * Read `--json` off the GLOBAL program options for a set-models subcommand.
+ * The flag is registered on the root program, so subcommands must reach up via
+ * `optsWithGlobals()`. Shared by `project-set-models` / `settings-set-models`.
+ */
+export function resolveSetModelsJsonMode(command) {
+    const globalOpts = command.parent?.optsWithGlobals() || {};
+    return Boolean(globalOpts['json']);
+}
+/**
+ * Shared set-models preamble for `project-set-models` / `settings-set-models`:
+ *
+ *   1. Assemble + validate a partial policy from the flat option bag
+ *      (`buildModelPolicyFromOptions`). On a validation error, print it and
+ *      set `process.exitCode = 1`, returning `{ stop: true }`.
+ *   2. When no model flags were supplied, warn and set `process.exitCode = 1`,
+ *      returning `{ stop: true }`.
+ *   3. Otherwise return `{ stop: false, policy }`.
+ *
+ * Extracting this keeps the two commands' parse/validate/no-flags behavior and
+ * output byte-identical from one source.
+ */
+export function parseSetModelsOptions(options) {
+    let policy;
+    try {
+        policy = buildModelPolicyFromOptions(options);
+    }
+    catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        console.error(colorError(`Invalid model policy: ${msg}`));
+        process.exitCode = 1;
+        return { stop: true };
+    }
+    if (policy === undefined) {
+        console.log(colorWarn('No model flags specified. Use --help to see available options.'));
+        process.exitCode = 1;
+        return { stop: true };
+    }
+    return { stop: false, policy };
+}
 // ── `models list` ───────────────────────────────────────────
 const modelsListCommand = new Command('list')
     .description('List the available Claude model catalog (runtime-discovered)')

package/dist/cli/commands/project-set-models.js

@@ -1,9 +1,9 @@
 import { Command } from 'commander';
 import { getProject, updateProject } from '../api/client.js';
-import { formatProjectDetail, colorError, colorWarn, colorSuccess } from '../output/formatters.js';
+import { formatProjectDetail, colorError, colorSuccess } from '../output/formatters.js';
 import { handleError } from '../output/error-handler.js';
 import { jsonOutput } from '../output/json-output.js';
-import { addModelPolicyOptions, buildModelPolicyFromOptions, mergeModelPolicies, } from './models.js';
+import { addModelPolicyOptions, mergeModelPolicies, parseSetModelsOptions, resolveSetModelsJsonMode, } from './models.js';
 /**
  * Configurable Task Models (Task 12) — `tasks project-set-models <id> [flags]`.
  *
@@ -24,21 +24,10 @@ export const projectSetModelsCommand = addModelPolicyOptions(new Command('projec
             process.exitCode = 1;
             return;
         }
-        let modelPolicy;
-        try {
-            modelPolicy = buildModelPolicyFromOptions(options);
-        }
-        catch (error) {
-            const msg = error instanceof Error ? error.message : String(error);
-            console.error(colorError(`Invalid model policy: ${msg}`));
-            process.exitCode = 1;
-            return;
-        }
-        if (modelPolicy === undefined) {
-            console.log(colorWarn('No model flags specified. Use --help to see available options.'));
-            process.exitCode = 1;
+        const parsed = parseSetModelsOptions(options);
+        if (parsed.stop)
             return;
-        }
+        const modelPolicy = parsed.policy;
         // Fetch-merge-write: the server replaces the column wholesale, so merge
         // the partial flag policy over the stored one here to keep incremental
         // invocations non-destructive.
@@ -47,9 +36,7 @@ export const projectSetModelsCommand = addModelPolicyOptions(new Command('projec
             model_policy: mergeModelPolicies(current.model_policy ?? null, modelPolicy),
         };
         const project = await updateProject(id, updates);
-        const program = projectSetModelsCommand.parent;
-        const globalOpts = program?.optsWithGlobals() || {};
-        const isJsonMode = globalOpts['json'] || false;
+        const isJsonMode = resolveSetModelsJsonMode(projectSetModelsCommand);
         if (isJsonMode) {
             jsonOutput({ project }, { id: project.id });
         }

package/dist/cli/commands/settings-set-models.js

@@ -1,9 +1,9 @@
 import { Command } from 'commander';
 import { getModelPolicyDefault, setModelPolicyDefault } from '../api/client.js';
-import { colorError, colorWarn, colorSuccess } from '../output/formatters.js';
+import { colorSuccess } from '../output/formatters.js';
 import { handleError } from '../output/error-handler.js';
 import { jsonOutput } from '../output/json-output.js';
-import { addModelPolicyOptions, buildModelPolicyFromOptions, mergeModelPolicies, } from './models.js';
+import { addModelPolicyOptions, mergeModelPolicies, parseSetModelsOptions, resolveSetModelsJsonMode, } from './models.js';
 /**
  * Configurable Task Models (Task 12) — `tasks settings-set-models [flags]`.
  *
@@ -16,28 +16,15 @@ import { addModelPolicyOptions, buildModelPolicyFromOptions, mergeModelPolicies,
  */
 export const settingsSetModelsCommand = addModelPolicyOptions(new Command('settings-set-models').description('Set the database-wide default model policy (per-role / per-category routing)')).action(async (options) => {
     try {
-        let modelPolicy;
-        try {
-            modelPolicy = buildModelPolicyFromOptions(options);
-        }
-        catch (error) {
-            const msg = error instanceof Error ? error.message : String(error);
-            console.error(colorError(`Invalid model policy: ${msg}`));
-            process.exitCode = 1;
-            return;
-        }
-        if (modelPolicy === undefined) {
-            console.log(colorWarn('No model flags specified. Use --help to see available options.'));
-            process.exitCode = 1;
+        const parsed = parseSetModelsOptions(options);
+        if (parsed.stop)
             return;
-        }
+        const modelPolicy = parsed.policy;
         // Fetch-merge-write: keep incremental invocations non-destructive (the
         // server replaces the stored default wholesale).
         const current = await getModelPolicyDefault();
         const persisted = await setModelPolicyDefault(mergeModelPolicies(current, modelPolicy));
-        const program = settingsSetModelsCommand.parent;
-        const globalOpts = program?.optsWithGlobals() || {};
-        const isJsonMode = globalOpts['json'] || false;
+        const isJsonMode = resolveSetModelsJsonMode(settingsSetModelsCommand);
         if (isJsonMode) {
             jsonOutput({ model_policy: persisted });
         }

package/dist/cli/commands/setup.d.ts

@@ -333,6 +333,14 @@ export interface RunSetupInteractiveOptions extends RunSetupOptions {
      * here without standing up a full device-flow server.
      */
     deviceLogin?: typeof runDeviceLogin;
+    /**
+     * Injectable browser opener forwarded to the device-flow login (replaces the
+     * former no-browser env bandaid). Defaults to undefined, so production
+     * uses the real {@link openBrowser}. Tests that drive the REAL device flow
+     * (without stubbing {@link deviceLogin}) pass a stub here so the suite never
+     * spawns a real browser on a DISPLAY-set desktop.
+     */
+    opener?: (url: string) => boolean;
     /**
      * Injectable manual-PAT persistence seam (#809). Defaults to
      * {@link persistManualPat} (validate the PAT against `GET /api/v1/me`, then

package/dist/cli/commands/setup.js

@@ -720,6 +720,7 @@ export async function runRemoteOnboarding(options = {}) {
                 clientId: process.env['OIDC_DEVICE_CLIENT_ID'] ?? 'wft-cli',
                 hostname: os.hostname(),
                 openBrowser: true,
+                ...(options.opener !== undefined && { opener: options.opener }),
                 isJson: false,
             });
             deviceOk = result.ok;

package/dist/cli/commands/update.js

@@ -15,6 +15,8 @@ export const updateCommand = new Command('update')
     .option('-a, --assignee <name>', 'New assignee')
     .option('--due <date>', 'New due date (ISO8601)')
     .option('--tags <tags>', 'New tags (comma-separated, replaces existing)')
+    .option('--blocked-by <ids>', 'Blocking task IDs (comma-separated). Only valid with --status blocked: ' +
+    'adds the blocking dependency edge(s) and sets the status atomically')
     .action(async (idStr, options) => {
     try {
         // Parse and validate task ID
@@ -59,6 +61,24 @@ export const updateCommand = new Command('update')
         if (options.tags !== undefined) {
             updates.tags = options.tags.split(',').map((tag) => tag.trim());
         }
+        if (options.blockedBy !== undefined) {
+            // Task #1004: atomic block-with-dependency. Mirror the server's narrow
+            // semantics client-side so the misuse fails before the wire.
+            if (options.status !== 'blocked') {
+                console.error(colorError('--blocked-by is only valid together with --status blocked ' +
+                    '(the edge-add and the status flip commit atomically). ' +
+                    'To add edges without blocking, use `tasks dep-add` instead.'));
+                process.exitCode = 1;
+                return;
+            }
+            const blockedBy = options.blockedBy.split(',').map((s) => parseInt(s.trim(), 10));
+            if (blockedBy.length === 0 || blockedBy.some((n) => isNaN(n) || n <= 0)) {
+                console.error(colorError('Invalid --blocked-by: must be comma-separated positive task IDs'));
+                process.exitCode = 1;
+                return;
+            }
+            updates.blocked_by = blockedBy;
+        }
         // Check if any updates were specified
         if (Object.keys(updates).length === 0) {
             console.log(colorWarn('No updates specified. Use --help to see available options.'));

package/dist/events/event-bus.d.ts

@@ -1,4 +1,4 @@
-import { TaskEvent, ProjectEvent } from './types.js';
+import { TaskEvent, ProjectEvent, ClaimReleasedEvent } from './types.js';
 /**
  * Options for {@link EventBus.subscribe}.
  *
@@ -90,6 +90,7 @@ type AppEvents = {
     'task.deleted': TaskEvent;
     'task.status_changed': TaskEvent;
     'task.claimed': TaskEvent;
+    'task.claim_released': ClaimReleasedEvent;
     'project.created': ProjectEvent;
     'project.updated': ProjectEvent;
     'project.deleted': ProjectEvent;

package/dist/events/event-bus.js

@@ -178,6 +178,7 @@ export class EventBus {
                 this.emitter.listenerCount('task.deleted') +
                 this.emitter.listenerCount('task.status_changed') +
                 this.emitter.listenerCount('task.claimed') +
+                this.emitter.listenerCount('task.claim_released') +
                 this.emitter.listenerCount('project.created') +
                 this.emitter.listenerCount('project.updated') +
                 this.emitter.listenerCount('project.deleted'),

package/dist/events/sse-manager.d.ts

@@ -34,7 +34,7 @@ export declare class SSEManager {
     private heartbeatInterval?;
     private createdAt;
     private totalEventsSent;
-    constructor(maxBufferSize?: number, bufferTtlMs?: number, // 5 minutes
+    constructor(maxBufferSize?: number, bufferTtlMs?: number, // 10 minutes — keep >= maxConnectionAgeMs
     heartbeatIntervalMs?: number, // 30 seconds
     maxConnectionAgeMs?: number, // 10 minutes
     maxConnectionsPerKey?: number, maxConnectionsPerIp?: number, maxConnections?: number);
@@ -56,13 +56,42 @@ export declare class SSEManager {
         apiKeyFingerprint: string;
         ip: string;
     }): void;
+    /**
+     * Remove a connection from the broadcast map WITHOUT touching the socket.
+     *
+     * task #1001: this is only safe when the peer socket is already gone — it
+     * is the cleanup callback for the raw `close`/`error` events registered in
+     * `addConnection`. Every server-initiated eviction (age-out, send failure,
+     * heartbeat failure, shutdown) MUST go through `closeConnection` instead,
+     * which ends the stream so the client observes a FIN and reconnects.
+     */
     removeConnection(connectionId: string): void;
+    /**
+     * task #1001: server-initiated eviction. Removes the connection from the
+     * broadcast map AND closes the underlying stream so the client sees the
+     * connection end and its reconnect logic fires (EventSource-style clients
+     * reconnect with `Last-Event-Id` and resume via `replayEvents`).
+     *
+     * Before this fix, the age-out path in the heartbeat sweep called
+     * `removeConnection` only — the map entry vanished but the TCP socket
+     * stayed open with no events, no pings and no FIN, so clients went
+     * silently deaf after maxConnectionAgeMs (reproduced 3x in the Tiny
+     * Worlds orchestration pilot, 2026-06-10).
+     */
+    private closeConnection;
     broadcast(event: EventPayload<unknown>): void;
     private matchesFilters;
     private sendEvent;
     private replayEvents;
     private pruneEventBuffer;
     private startHeartbeat;
+    /**
+     * One heartbeat tick: ping every live connection and evict connections
+     * past maxConnectionAgeMs. Extracted from the setInterval callback so
+     * integration tests can drive a sweep deterministically without faking
+     * 30s of wall-clock time against a real listening socket (task #1001).
+     */
+    private heartbeatSweep;
     shutdown(): void;
     /**
      * Check if SSE manager is healthy (has active heartbeat)

package/dist/events/sse-manager.js

@@ -20,7 +20,19 @@ export class SSEManager {
     heartbeatInterval;
     createdAt = Date.now();
     totalEventsSent = 0;
-    constructor(maxBufferSize = 100, bufferTtlMs = 5 * 60 * 1000, // 5 minutes
+    constructor(maxBufferSize = 100, 
+    // task #1001: bufferTtlMs MUST be >= maxConnectionAgeMs. When a
+    // connection is aged out (closeConnection → stream FIN), the client
+    // reconnects with `Last-Event-Id` and expects the buffer to still hold
+    // every event it could have missed during its previous connection's
+    // lifetime. The old default (5 min) was SMALLER than the 10-min age
+    // window, so a quiet client whose last event predated the TTL hit a
+    // replay gap on every forced reconnect. The defaults are the production
+    // values (server.ts passes `undefined` for both), so aligning here
+    // aligns prod. Residual gap risk: maxBufferSize (100 events) can still
+    // truncate under high event rate regardless of TTL — that case is
+    // covered by the explicit `replay-gap` control event (task #206).
+    bufferTtlMs = 10 * 60 * 1000, // 10 minutes — keep >= maxConnectionAgeMs
     heartbeatIntervalMs = 30000, // 30 seconds
     maxConnectionAgeMs = 10 * 60 * 1000, // 10 minutes
     // task #185: per-key, per-IP and global concurrent connection caps.
@@ -87,9 +99,53 @@ export class SSEManager {
         reply.raw.on('close', () => this.removeConnection(connectionId));
         reply.raw.on('error', () => this.removeConnection(connectionId));
     }
+    /**
+     * Remove a connection from the broadcast map WITHOUT touching the socket.
+     *
+     * task #1001: this is only safe when the peer socket is already gone — it
+     * is the cleanup callback for the raw `close`/`error` events registered in
+     * `addConnection`. Every server-initiated eviction (age-out, send failure,
+     * heartbeat failure, shutdown) MUST go through `closeConnection` instead,
+     * which ends the stream so the client observes a FIN and reconnects.
+     */
     removeConnection(connectionId) {
         this.connections.delete(connectionId);
     }
+    /**
+     * task #1001: server-initiated eviction. Removes the connection from the
+     * broadcast map AND closes the underlying stream so the client sees the
+     * connection end and its reconnect logic fires (EventSource-style clients
+     * reconnect with `Last-Event-Id` and resume via `replayEvents`).
+     *
+     * Before this fix, the age-out path in the heartbeat sweep called
+     * `removeConnection` only — the map entry vanished but the TCP socket
+     * stayed open with no events, no pings and no FIN, so clients went
+     * silently deaf after maxConnectionAgeMs (reproduced 3x in the Tiny
+     * Worlds orchestration pilot, 2026-06-10).
+     */
+    closeConnection(connectionId) {
+        const conn = this.connections.get(connectionId);
+        this.connections.delete(connectionId);
+        if (!conn)
+            return;
+        try {
+            // Prefer the SSE plugin's close (runs its cleanup + ends the raw
+            // response). `reply.sse` can be absent at runtime (the events route
+            // guards on it), and unit-test mocks may omit either surface — fall
+            // back to ending the raw response directly.
+            if (conn.reply.sse && typeof conn.reply.sse.close === 'function') {
+                conn.reply.sse.close();
+            }
+            else if (typeof conn.reply.raw?.end === 'function') {
+                conn.reply.raw.end();
+            }
+        }
+        catch {
+            // The peer socket may already be destroyed (close racing a network
+            // error). Safe to swallow: the map entry is gone and the raw
+            // `close`/`error` handlers have done (or will do) their cleanup.
+        }
+    }
     broadcast(event) {
         const eventId = this.nextEventId++;
         // Add to buffer for Last-Event-ID replay
@@ -131,8 +187,12 @@ export class SSEManager {
             this.totalEventsSent++;
         })
             .catch(() => {
-            // Connection likely closed, remove it
-            this.removeConnection(conn.id);
+            // Send failed — the peer socket usually errored already (the raw
+            // `error` handler runs cleanup), but close defensively so a failure
+            // that did NOT originate from the socket still ends the stream
+            // instead of leaving the peer attached to a deregistered connection.
+            // `closeConnection` is idempotent vs. an already-dead socket.
+            this.closeConnection(conn.id);
         });
     }
     replayEvents(connectionId, fromEventId) {
@@ -163,7 +223,8 @@ export class SSEManager {
                     }),
                 })
                     .catch(() => {
-                    this.removeConnection(connectionId);
+                    // Same rationale as sendEvent: close, don't just deregister.
+                    this.closeConnection(connectionId);
                 });
             }
         }
@@ -184,26 +245,47 @@ export class SSEManager {
         this.eventBuffer = this.eventBuffer.filter((e) => new Date(e.event.timestamp).getTime() > cutoff);
     }
     startHeartbeat() {
-        this.heartbeatInterval = setInterval(() => {
-            const now = Date.now();
-            for (const conn of this.connections.values()) {
-                // Send heartbeat ping (fire-and-forget)
-                conn.reply.sse.send({ event: 'ping', data: '' }).catch(() => {
-                    // Connection closed, remove it
-                    this.removeConnection(conn.id);
-                });
-                // Enforce max connection age
-                const age = now - conn.createdAt.getTime();
-                if (age > this.maxConnectionAgeMs) {
-                    this.removeConnection(conn.id);
-                }
+        this.heartbeatInterval = setInterval(() => this.heartbeatSweep(), this.heartbeatIntervalMs);
+    }
+    /**
+     * One heartbeat tick: ping every live connection and evict connections
+     * past maxConnectionAgeMs. Extracted from the setInterval callback so
+     * integration tests can drive a sweep deterministically without faking
+     * 30s of wall-clock time against a real listening socket (task #1001).
+     */
+    heartbeatSweep() {
+        const now = Date.now();
+        for (const conn of this.connections.values()) {
+            // Enforce max connection age FIRST. task #1001: this must CLOSE the
+            // stream, not just drop the map entry — otherwise the client keeps an
+            // open TCP connection receiving no events, no pings and no FIN, and
+            // its reconnect logic never fires. Closing makes the client reconnect
+            // with `Last-Event-Id` and resume via the replay buffer (whose TTL is
+            // aligned to this window — see the constructor note on bufferTtlMs).
+            const age = now - conn.createdAt.getTime();
+            if (age > this.maxConnectionAgeMs) {
+                this.closeConnection(conn.id);
+                continue; // No point pinging a stream we just ended.
             }
-        }, this.heartbeatIntervalMs);
+            // Send heartbeat ping (fire-and-forget)
+            conn.reply.sse.send({ event: 'ping', data: '' }).catch(() => {
+                // Ping failed — close defensively (idempotent vs. dead socket),
+                // same rationale as sendEvent.
+                this.closeConnection(conn.id);
+            });
+        }
     }
     shutdown() {
         if (this.heartbeatInterval) {
             clearInterval(this.heartbeatInterval);
         }
+        // task #1001: close every stream instead of just clearing the map —
+        // clearing alone left peers attached to a server that would never send
+        // them another byte. (In practice Fastify's own close tears sockets
+        // down too; this makes the manager correct independent of that.)
+        for (const connectionId of [...this.connections.keys()]) {
+            this.closeConnection(connectionId);
+        }
         this.connections.clear();
         this.eventBuffer = [];
     }

package/dist/events/types.d.ts

@@ -3,7 +3,7 @@ import { Task, Project, TaskStatus } from '../types/task.js';
  * Event types for task lifecycle
  * Note: task.claimed is defined for type safety but emission deferred to Phase 15 (atomic claim endpoint)
  */
-export type TaskEventType = 'task.created' | 'task.updated' | 'task.deleted' | 'task.status_changed' | 'task.claimed';
+export type TaskEventType = 'task.created' | 'task.updated' | 'task.deleted' | 'task.status_changed' | 'task.claimed' | 'task.claim_released';
 /**
  * Event types for project lifecycle
  */
@@ -16,7 +16,7 @@ export type ProjectEventType = 'project.created' | 'project.updated' | 'project.
  * Keep this in sync with the union types above and with the eventBus.subscribe
  * calls in `src/api/server.ts`.
  */
-export declare const ALLOWED_EVENT_TYPES: readonly ["task.created", "task.updated", "task.deleted", "task.status_changed", "task.claimed", "project.created", "project.updated", "project.deleted"];
+export declare const ALLOWED_EVENT_TYPES: readonly ["task.created", "task.updated", "task.deleted", "task.status_changed", "task.claimed", "task.claim_released", "project.created", "project.updated", "project.deleted"];
 export type AllowedEventType = (typeof ALLOWED_EVENT_TYPES)[number];
 export declare function isAllowedEventType(value: string): value is AllowedEventType;
 /**
@@ -55,6 +55,23 @@ export interface EventPayload<T> {
 export type TaskEvent = EventPayload<Task & {
     tags: string[];
 }>;
+/**
+ * Task #1003: payload for `task.claim_released` — emitted by the
+ * ClaimReleaseService TTL sweep when a stale `in_progress` claim is
+ * auto-released back to `open`. Carries the full (post-release) task plus
+ * the claim's forensic trail so the former holder (and wft-router rules)
+ * can react: who held it, when the expired claim was taken, and when the
+ * sweep released it.
+ */
+export type ClaimReleasedEvent = EventPayload<Task & {
+    tags: string[];
+    /** Assignee that held the claim before the TTL sweep released it. */
+    previous_assignee: string;
+    /** The `claimed_at` timestamp that exceeded the TTL (pre-release value). */
+    expired_claimed_at: string;
+    /** When the sweep released the claim (ISO 8601). */
+    released_at: string;
+}>;
 /**
  * Project event
  */

package/dist/events/types.js

@@ -12,6 +12,7 @@ export const ALLOWED_EVENT_TYPES = [
     'task.deleted',
     'task.status_changed',
     'task.claimed',
+    'task.claim_released',
     'project.created',
     'project.updated',
     'project.deleted',

package/dist/index.d.ts

@@ -9,6 +9,7 @@ import { DependencyGraphService } from './services/dependency-graph.service.js';
 import { WorkflowEngine } from './services/workflow-engine.js';
 import { type SettingsService } from './services/settings.service.js';
 import { type ModelCatalogService } from './services/model-catalog.service.js';
+import { type ModelPolicyService } from './services/model-policy.service.js';
 import { type OidcConfig } from './services/oidc-client.js';
 import type Database from './db/driver.js';
 /**
@@ -70,6 +71,15 @@ export interface App {
      * is unreachable.
      */
     modelCatalogService: ModelCatalogService;
+    /**
+     * Configurable Task Models (task #931): the jobSize→category bijection +
+     * two-layer per-slot model resolver. Constructed ONCE here (like
+     * settingsService / modelCatalogService) and consumed by BOTH transports —
+     * the REST route (`GET /projects/:id/resolve-model` via the Fastify
+     * decoration) and the stdio MCP `resolve_model` tool — instead of each
+     * hand-wiring an identical dep bundle over fresh repositories.
+     */
+    modelPolicyService: ModelPolicyService;
     /**
      * Identity-foundation repositories (Phase 27) decorated onto the Fastify
      * instance by `createServer` so the Phase 28 auth chain at