fix: task execution pipeline — 5 bugs causing tasks to start but never complete

Bug 1 (CRITICAL): Session ID mismatch — executeTask() generated its own
sessionId while callers subscribed events on a different session.id. Events
never reached subscribers. Fix: executeTask now accepts an optional sessionId
from callers; both task-routes.js and slash-interceptor.js pass session.id.

Bug 2 (CRITICAL): Task History always showed 'No entity loaded' because
task-ui.js checked activeConfig.entityId which never exists. Fix: use
window.getActiveEntityId() instead.

Bug 3 (MAJOR): No Frontman/SSE bridge for slash command or API-initiated
tasks — only task-pipeline-bridge wired Frontman. Fix: expose taskFrontman
from chat-pipeline.js, add to server ctx, wire into slash-interceptor.js
and task-routes.js so SSE task_milestone/task_complete events reach clients.

Bug 6 (MODERATE): Hollow entity context — both slash-interceptor and
task-routes built stub entity objects with empty workspacePath. Fix: load
entity.json from disk via entityPaths to get real name and workspacePath.

Files changed:
- server/brain/tasks/task-executor.js — accept external sessionId param
- server/routes/slash-interceptor.js — entity profile loading, session ID
  pass-through, Frontman wiring
- server/routes/task-routes.js — entity profile loading, Frontman wiring
- server/services/chat-pipeline.js — expose taskFrontman in return value
- server/server.js — add taskFrontman getter to ctx
- client/js/apps/optional/task-ui.js — fix entity ID resolution

Tests: 2012/2012 (0 fail)

Author: VoardWalker-Code

CHANGELOG.md

@@ -6,6 +6,7 @@ Built with MA (Memory Architect v1).
 ## [Unreleased]
 
 ### Added
+- Server-Side Slash Command Interceptor: slash commands now work from ALL clients (entity chat, NekoCore OS chat, failsafe console) — new `project/server/routes/slash-interceptor.js` intercepts `/command` messages at the server level before they reach the LLM pipeline; supported commands: `/task <description>` (run generic task), `/project <description>` (run multi-phase project), `/skill <description>` (run skill-based task), `/websearch <query>` (web research), `/list` (task history), `/listactive` (running tasks), `/stop` (cancel current session); wired into `/api/chat` (entity chat) and `/api/nekocore/chat` (NekoCore OS chat) with fire-and-forget async execution for long-running tasks; registered in CORE_REGISTRY (301 entries); eliminates the need for separate client-side slash parsers — single server-side implementation serves all frontends.
 - Self-Repair Skill: teaches NekoCore how to diagnose and fix her own system — new `project/skills/self-repair/SKILL.md` provides complete self-healing knowledge: health scanner usage (`node scripts/health-scan.js` with `--json` and `--fix-list` modes via `cmd_run` tool), fixer generator usage (`node scripts/generate-fixer.js` to produce `neko_fixer.py`), all fixer modes (`--repair` for missing/empty files, `--force` for full DNA restore, `--verify` for hash check, `--list` for inventory), failsafe console location (`/failsafe.html`), CORE_REGISTRY as source of truth (300 entries), step-by-step diagnosis workflow (scan → categorize → repair strategy → verify), UI-broken recovery flow (direct user to failsafe), headless server recovery (SSH → fixer → start server → Telegram/failsafe chat), key file locations table, complete "fix yourself" sequence, and safety guardrails (what NOT to do); closes the self-healing loop: `neko_fixer.py --repair` → `failsafe.html` → "Neko, fix yourself" → she runs the health scanner and repairs what's broken.
 - Command Execution Tool (`cmd_run`): sandboxed shell execution for entities — new `project/server/integrations/cmd-executor.js` provides a secure command executor with a 20+ command whitelist (cargo, rustc, rustfmt, python, python3, pip, pip3, node, npm, npx, gcc, g++, make, cmake, go, git, cat, head, tail, wc, ls, dir, find, grep, type) each with restricted subcommand lists; BLOCKED_PATTERNS reject shell metacharacters (;&|`$), directory traversal (../), redirects, destructive commands (rm/del/format/shutdown/kill), and shell escape commands (curl/wget/powershell/cmd.exe/bash); `parseCommand()` tokenizer validates against whitelist + subcommands + blocked patterns; `execCommand()` uses `child_process.spawn` with `shell: false`, workspace jail (cwd locked to entity workspace), timeout enforcement (default 60s, max 300s), output truncation (16KB), and CI env vars (CI=true, NO_COLOR=1); wired through full pipeline: `chat-pipeline.js` → `task-pipeline-bridge.js` → `task-runner.js` → `workspace-tools.js`; added to CODE and PROJECT task types; `formatToolResults` outputs STDOUT/STDERR blocks with exit code and timeout indicator; 70 guard tests in `cmd-run-guards.test.js` covering whitelist validation, security rejection (17 attack vectors), exec validation, dispatch, task-type integration, skill structure, pipeline wiring, and CORE_REGISTRY coverage; enables entities to compile Rust, run Python scripts, execute Node.js, build C/C++, and use Git — all within a sandboxed workspace.
 - Rust Skill: comprehensive Rust programming skill for entities — new `project/skills/rust/SKILL.md` (~300 lines) provides cargo project lifecycle (build/run/test/check/clippy/fmt/init/new/add), file + cmd_run tool syntax, critical rules (complete files, read-before-edit, use cargo, read compiler errors), Rust patterns (structs, enums, traits, Result/?, iterators, collections), Cargo.toml patterns, common crates table (15 entries: serde, tokio, clap, reqwest, anyhow, thiserror, rand, regex, chrono, log, tracing, axum, sqlx, rayon, uuid), debugging workflow with error code table (E0382/E0308/E0502/E0433/E0599), testing patterns (unit + integration + doc tests), project scaffolding templates (CLI, library, web API), and explicit "what NOT to do" section.

WORKLOG.md

@@ -44,11 +44,11 @@ Emergency exception log:
 
 ---
 
-## Stop/Resume Snapshot — 2026-03-21 (Self-Repair Skill COMPLETE)
+## Stop/Resume Snapshot — 2026-03-21 (Server-Side Slash Interceptor COMPLETE)
 
 - **Current phase:** `Phase 4 — Feature work`
 - **Current slice:** `None — awaiting next plan`
-- **Last completed work:** `Self-repair skill (skills/self-repair/SKILL.md — teaches Neko how to diagnose, scan, and fix her own system); CORE_REGISTRY now 300 entries; 14 new guard tests; 2012/2012 (0 fail)`
+- **Last completed work:** `Server-side slash command interceptor (server/routes/slash-interceptor.js) — intercepts /command messages before LLM pipeline so slash commands work from all clients (entity chat, NekoCore OS, failsafe); wired into /api/chat and /api/nekocore/chat; CORE_REGISTRY now 301 entries; 2012/2012 (0 fail)`
 - **In-progress item:** `none`
 - **Blocking issue:** `none`
 - **Next action on resume:** `Pick up next plan or user request`
@@ -76,6 +76,22 @@ Boundary markers: [BOUNDARY_OK]
 
 ---
 
+## Session Ledger — 2026-03-21 (Server-Side Slash Interceptor)
+
+Status: `Complete`
+
+- **Purpose:** Make slash commands work from all clients (entity chat, NekoCore OS chat, failsafe console) by intercepting `/command` messages at the server level before the LLM pipeline.
+- Created `server/routes/slash-interceptor.js` (~210 lines) — server-side slash command detector and dispatcher: regex parser for `/command arg` syntax, handles `/task`, `/project`, `/skill`, `/websearch` (fire-and-forget async via task system), `/list` (task history), `/listactive` (running tasks), `/stop` (cancel active session); returns `{ handled, response }` so callers skip LLM when a slash command is detected
+- Wired into `server/routes/chat-routes.js` (`/api/chat`) — intercept call before LLM pipeline using `ctx.getActiveEntityId()` for entity resolution
+- Wired into `server/routes/nekocore-routes.js` (`/api/nekocore/chat`) — intercept call with hardcoded `'nekocore'` entity ID
+- Registered in CORE_REGISTRY — registry now 301 entries
+- Tests: 2012/2012 full suite (0 fail)
+- Pushed to `origin staging` (commit c3a0602)
+
+Boundary markers: [BOUNDARY_OK]
+
+---
+
 ## Session Ledger — 2026-03-21 (BIOS Completeness + Failsafe Console)
 
 Status: `Complete`

project/client/js/apps/optional/task-ui.js

@@ -162,11 +162,11 @@ function _taskUIPushTelemetry(eventName, detail) {
 
 // ─── Task History Panel ───────────────────────────────────────────────────────
 async function openTaskHistory() {
-  // Resolve entityId from global config
+  // Resolve entityId from the global entity manager
   let entityId = null;
   try {
-    if (typeof activeConfig !== 'undefined' && activeConfig && activeConfig.entityId) {
-      entityId = activeConfig.entityId;
+    if (typeof window.getActiveEntityId === 'function') {
+      entityId = window.getActiveEntityId();
     }
   } catch (_) {}
 

project/server/brain/tasks/task-executor.js

@@ -25,6 +25,7 @@ const _pendingInputs = new Map();
  *   - allTools {Object} — all available tools { toolName: handler }
  *   - taskArchiveId {string?} — archive ID for step writes (optional)
  *   - archiveWriter {Object?} — task-archive-writer instance (optional)
+ *   - sessionId {string?} — external session ID (callers pass their own to keep event subscriptions aligned)
  *   - _runTaskFn {Function?} — override for testing; defaults to task-runner.runTask
  * @returns {Promise<Object>} { sessionId, steps, finalOutput, taskType, entityId, completedAt }
  */
@@ -39,6 +40,7 @@ async function executeTask(config) {
     allTools = {},
     taskArchiveId = null,
     archiveWriter = null,
+    sessionId: externalSessionId = null,
     _runTaskFn = null
   } = config;
 
@@ -50,10 +52,12 @@ async function executeTask(config) {
     throw new Error('executeTask: callLLM must be a function');
   }
 
-  // Generate unique session ID
-  const sessionId = typeof crypto.randomUUID === 'function'
-    ? crypto.randomUUID()
-    : `task-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+  // Use caller-supplied session ID when available, otherwise generate one
+  const sessionId = externalSessionId || (
+    typeof crypto.randomUUID === 'function'
+      ? crypto.randomUUID()
+      : `task-${Date.now()}-${Math.random().toString(36).slice(2)}`
+  );
 
   // Get module config for this task type
   const moduleConfig = taskModuleRegistry.getModule(taskType);

project/server/routes/slash-interceptor.js

@@ -22,6 +22,19 @@ const projectStore = require('../brain/tasks/task-project-store');
 const archiveWriter = require('../brain/tasks/task-archive-writer');
 const workspaceTools = require('../brain/workspace-tools');
 
+function _loadEntityProfile(entityId) {
+  const fs = require('fs');
+  const path = require('path');
+  try {
+    const entityPaths = require('../entityPaths');
+    const entityFile = path.join(entityPaths.getEntityRoot(entityId), 'entity.json');
+    if (fs.existsSync(entityFile)) {
+      return JSON.parse(fs.readFileSync(entityFile, 'utf8'));
+    }
+  } catch (_) {}
+  return {};
+}
+
 function _readAllSessionsForHistory() {
   const fs = require('fs');
   const path = require('path');
@@ -162,10 +175,21 @@ async function _runTask(userMessage, entityId, ctx, taskType, skill) {
       sharedContext: { taskContext: context }
     }, {});
 
+    // Resolve entity profile from disk for workspace path and identity
+    const entityProfile = _loadEntityProfile(entityId);
+
     const runConfig = {
+      sessionId: session.id,
       taskType: classification.taskType,
       userMessage,
-      entity: { id: entityId, name: 'Entity', persona: null, mood: null, relationship: null, workspacePath: '' },
+      entity: {
+        id: entityId,
+        name: entityProfile.name || 'Entity',
+        persona: entityProfile.personality_traits || null,
+        mood: null,
+        relationship: null,
+        workspacePath: entityProfile.workspacePath || ''
+      },
       contextSnippets: context.snippets || [],
       callLLM: ctx.callLLMWithRuntime,
       runtime: {},
@@ -175,6 +199,17 @@ async function _runTask(userMessage, entityId, ctx, taskType, skill) {
       ...(skill ? { skill } : {})
     };
 
+    // Wire Frontman for SSE feedback if available on ctx
+    if (ctx.taskFrontman && typeof ctx.taskFrontman.startSession === 'function') {
+      ctx.taskFrontman.startSession({
+        sessionId: session.id,
+        entityId,
+        entity: runConfig.entity,
+        relationshipSignal: 'neutral',
+        runtime: {}
+      });
+    }
+
     // Subscribe to task events for session tracking
     const handler = (event) => {
       if (!event || !event.type) return;

project/server/routes/task-routes.js

@@ -24,6 +24,19 @@ function createTaskRoutes(ctx) {
     return (body && body.entityId) || (ctx.getActiveEntityId ? ctx.getActiveEntityId() : null);
   }
 
+  function _loadEntityProfile(entityId) {
+    const fs = require('fs');
+    const path = require('path');
+    try {
+      const entityPaths = require('../entityPaths');
+      const entityFile = path.join(entityPaths.getEntityRoot(entityId), 'entity.json');
+      if (fs.existsSync(entityFile)) {
+        return JSON.parse(fs.readFileSync(entityFile, 'utf8'));
+      }
+    } catch (_) {}
+    return {};
+  }
+
   function _readAllSessionsForHistory() {
     const fs = require('fs');
     const path = require('path');
@@ -157,16 +170,20 @@ function createTaskRoutes(ctx) {
         }
       }, _sessionOpts());
 
+      // Resolve entity profile from disk for workspace path and identity
+      const entityProfile = _loadEntityProfile(entityId);
+
       const runConfig = {
+        sessionId: session.id,
         taskType: classification.taskType,
         userMessage,
         entity: {
           id: entityId,
-          name: body.entityName || 'Entity',
-          persona: body.persona || null,
+          name: body.entityName || entityProfile.name || 'Entity',
+          persona: body.persona || entityProfile.persona || null,
           mood: body.mood || null,
           relationship: body.relationship || null,
-          workspacePath: body.workspacePath || ''
+          workspacePath: body.workspacePath || entityProfile.workspacePath || ''
         },
         contextSnippets: context.snippets || [],
         callLLM: ctx.callLLMWithRuntime,
@@ -181,6 +198,17 @@ function createTaskRoutes(ctx) {
 
       const unsubscribe = _attachEventSync(session.id);
 
+      // Wire Frontman for SSE feedback if available on ctx
+      if (ctx.taskFrontman && typeof ctx.taskFrontman.startSession === 'function') {
+        ctx.taskFrontman.startSession({
+          sessionId: session.id,
+          entityId,
+          entity: runConfig.entity,
+          relationshipSignal: 'neutral',
+          runtime: body.runtime || {}
+        });
+      }
+
       const asyncMode = body.async === true;
       if (asyncMode) {
         setImmediate(async () => {

project/server/server.js

@@ -690,6 +690,7 @@ const ctx = {
   gracefulShutdown(src) { return gracefulShutdown(src); },
   webFetch,
   authService,
+  get taskFrontman() { return chatPipeline.taskFrontman; },
 };
 
 const lifecycle = createRuntimeLifecycle({

project/server/services/chat-pipeline.js

@@ -1120,7 +1120,7 @@ function createChatPipeline(deps) {
     return { finalResponse, innerDialog: null, memoryConnections: [] };
   }
 
-  return { processChatMessage, processSingleLlmChatMessage, processPendingSkillApproval };
+  return { processChatMessage, processSingleLlmChatMessage, processPendingSkillApproval, taskFrontman };
 }
 
 module.exports = createChatPipeline;