@agilemonster/mcp-server 1.0.16 → 1.0.21

package/dist/server.js

@@ -3,10 +3,17 @@ import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
 import { CallToolRequestSchema, ListToolsRequestSchema, ListPromptsRequestSchema, GetPromptRequestSchema, ListResourcesRequestSchema, ReadResourceRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
 import path from 'node:path';
 import fs from 'node:fs';
-import os from 'node:os';
-import { spawn, execSync } from 'node:child_process';
+import crypto from 'node:crypto';
+import { spawn, execSync, execFileSync } from 'node:child_process';
+import { isUtf8 } from 'node:buffer';
+import { fileURLToPath } from 'node:url';
 import { AgileMonsterClient, MCP_SERVER_VERSION } from './client.js';
 import { AGENT_GUIDELINES_MARKDOWN } from './guidelines.js';
+import { knownSecrets, redactResult } from './redact.js';
+import { describeProfile, methodLabel, normalizeMethod, resolveDeployProfile, } from './deploy-profile.js';
+import { addPendingVerification, getCardState, loadMemory, recordAttempt, removePendingVerification, setCardState, setExplicitProfile, } from './deploy-memory.js';
+import { checkCiOnce, describeFailureForHuman, ensureLocalGitExcludes, parseDeployDirective, runDeployment, } from './deploy-runner.js';
+import { addWellKnownToolDirs, agileMonsterHome, configureLogger, ensureUserPath, errorMessage, exec, log, readJson, which, writeJsonAtomic, } from './runtime.js';
 export function createServer(client = new AgileMonsterClient()) {
     const server = new Server({
         name: 'agilemonster-mcp-server',
@@ -110,7 +117,7 @@ Please strictly follow the Agile Monster Task Lifecycle Protocol:
     server.setRequestHandler(ListResourcesRequestSchema, async () => {
         return { resources };
     });
-    server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
+    const readResource = async (request) => {
         const { uri } = request.params;
         if (uri === 'agilemonster://guidelines/agents') {
             return {
@@ -127,7 +134,7 @@ Please strictly follow the Agile Monster Task Lifecycle Protocol:
             const projectConfig = client.loadProjectConfig();
             const projectName = projectConfig?.board_name || path.basename(process.cwd());
             const boardId = projectConfig?.board_id;
-            const context = await client.getContext(projectName, boardId);
+            const context = await client.getContext(projectName, boardId, undefined, AgileMonsterClient.detectInstalledAgents());
             return {
                 contents: [
                     {
@@ -135,7 +142,8 @@ Please strictly follow the Agile Monster Task Lifecycle Protocol:
                         mimeType: 'application/json',
                         text: JSON.stringify({
                             config_source: projectConfig ? '.agilemonster.json' : 'auto_matched',
-                            project_config: projectConfig,
+                            project_config: projectConfig ? { ...projectConfig, api_key: projectConfig.api_key ? '***' : undefined } : null,
+                            deploy_profile: currentDeployProfileSummary(client),
                             ...context,
                         }, null, 2),
                     },
@@ -143,7 +151,9 @@ Please strictly follow the Agile Monster Task Lifecycle Protocol:
             };
         }
         throw new Error(`Resource not found: ${uri}`);
-    });
+    };
+    // Every resource passes through one filter, so a credential can never reach an agent's context
+    server.setRequestHandler(ReadResourceRequestSchema, async (request) => redactResult(await readResource(request), knownSecrets(client.getApiKey())));
     // -------------------------------------------------------------------------
     // 3. Tools for Autonomous Agents
     // -------------------------------------------------------------------------
@@ -452,11 +462,61 @@ Please strictly follow the Agile Monster Task Lifecycle Protocol:
                 required: ['card_id'],
             },
         },
+        {
+            name: 'agilemonster_get_deploy_profile',
+            description: 'How THIS project is deployed: the route (GitHub Actions, local Docker Compose, deploy script, cloud CLI, manual), the exact command, confidence, the evidence behind it, alternatives found, and recent deployment history on this machine. Call this before deploying or before writing a deployment note, instead of guessing.',
+            inputSchema: {
+                type: 'object',
+                properties: {},
+            },
+        },
+        {
+            name: 'agilemonster_record_deployment',
+            description: 'Record how a deployment of this project actually went, so every future task (including cards started from the Agile Monster web app while no IDE is open) deploys the same proven way. Call it after you deploy successfully, when a deployment fails, or when the user tells you how the project is deployed (set pin=true).',
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    method: {
+                        type: 'string',
+                        description: 'One of: github_actions, docker_compose, deploy_script, cloud_cli, git_push, manual, none.',
+                    },
+                    command: {
+                        type: 'string',
+                        description: 'The exact command that deploys, if any (e.g. "docker compose -f infra/compose.yaml up -d --build", "./deploy/deploy.sh").',
+                    },
+                    live_url: {
+                        type: 'string',
+                        description: 'URL where the deployed result can be checked (production URL, or http://localhost:PORT for a local stack).',
+                    },
+                    success: {
+                        type: 'boolean',
+                        description: 'Whether the deployment succeeded (default true).',
+                    },
+                    error: {
+                        type: 'string',
+                        description: 'What went wrong, when success is false.',
+                    },
+                    pin: {
+                        type: 'boolean',
+                        description: 'true = the user confirmed this is THE way this project deploys; it then overrides auto-detection until changed.',
+                    },
+                    notes: {
+                        type: 'string',
+                        description: 'Anything a future agent must know (required env, order of steps, which branch deploys).',
+                    },
+                    card_id: {
+                        type: 'string',
+                        description: 'The card this deployment belongs to, if any.',
+                    },
+                },
+                required: ['method'],
+            },
+        },
     ];
     server.setRequestHandler(ListToolsRequestSchema, async () => {
         return { tools };
     });
-    server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    const callTool = async (request) => {
         const { name, arguments: args = {} } = request.params;
         const projectConfig = client.loadProjectConfig();
         try {
@@ -466,14 +526,15 @@ Please strictly follow the Agile Monster Task Lifecycle Protocol:
                         projectConfig?.board_name ||
                         path.basename(process.cwd());
                     const boardId = args.board_id || projectConfig?.board_id;
-                    const context = await client.getContext(projectName, boardId);
+                    const context = await client.getContext(projectName, boardId, undefined, AgileMonsterClient.detectInstalledAgents());
                     return {
                         content: [
                             {
                                 type: 'text',
                                 text: JSON.stringify({
                                     config_source: projectConfig ? '.agilemonster.json' : 'auto_matched',
-                                    project_config: projectConfig,
+                                    project_config: projectConfig ? { ...projectConfig, api_key: projectConfig.api_key ? '***' : undefined } : null,
+                                    deploy_profile: currentDeployProfileSummary(client),
                                     ...context,
                                 }, null, 2),
                             },
@@ -486,6 +547,8 @@ Please strictly follow the Agile Monster Task Lifecycle Protocol:
                     const provider = args.provider || projectConfig?.provider || 'antigravity';
                     const reviewList = args.review_list || projectConfig?.review_list;
                     const savedPath = client.saveProjectConfig({
+                        // Keep what bootstrap stored (API key, board name, done list ...): this call only re-points the binding
+                        ...(projectConfig || {}),
                         workspace_id: workspaceId,
                         board_id: boardId,
                         provider,
@@ -564,7 +627,7 @@ Please strictly follow the Agile Monster Task Lifecycle Protocol:
                         content: [
                             {
                                 type: 'text',
-                                text: `Task claimed successfully on board "${card.board_name || expectedBoardId}". Status is now "in_progress".\n${JSON.stringify(card, null, 2)}`,
+                                text: `Task claimed successfully on board "${card.board_name || expectedBoardId}". Status is now "in_progress".\n\n${deployGuidanceText(client)}\n\n${JSON.stringify(card, null, 2)}`,
                             },
                         ],
                     };
@@ -688,6 +751,102 @@ Please strictly follow the Agile Monster Task Lifecycle Protocol:
                         ],
                     };
                 }
+                case 'agilemonster_get_deploy_profile': {
+                    const root = projectRootFor(client);
+                    const memory = loadMemory(root);
+                    const profile = resolveDeployProfile(root, { memory });
+                    const history = memory.history.slice(-5).map((h) => ({
+                        at: h.at,
+                        method: h.method,
+                        ok: h.ok,
+                        pending: h.pending || undefined,
+                        commit: h.commit || undefined,
+                        error: h.error || undefined,
+                    }));
+                    return {
+                        content: [
+                            {
+                                type: 'text',
+                                text: `${describeProfile(profile)}\n\n` +
+                                    JSON.stringify({
+                                        project_path: root,
+                                        method: profile.method,
+                                        command: profile.command,
+                                        confidence: profile.confidence,
+                                        source: profile.source,
+                                        live_url: profile.liveUrl,
+                                        live_url_source: profile.liveUrlSource,
+                                        build_command: profile.buildCommand,
+                                        alternatives: profile.alternatives.map((a) => ({ method: a.method, command: a.command, score: a.score, evidence: a.evidence })),
+                                        recent_deployments: history,
+                                        notes_from_project_docs: profile.deploymentNotes || undefined,
+                                        pinned_notes: memory.explicit?.notes || undefined,
+                                    }, null, 2) +
+                                    `\n\nAfter you deploy, call agilemonster_record_deployment so the next task (including cards run from the web app) reuses what worked.`,
+                            },
+                        ],
+                    };
+                }
+                case 'agilemonster_record_deployment': {
+                    const root = projectRootFor(client);
+                    const method = normalizeMethod(args.method);
+                    if (!method) {
+                        return {
+                            isError: true,
+                            content: [
+                                {
+                                    type: 'text',
+                                    text: `Unknown deployment method "${String(args.method)}". Use one of: github_actions, docker_compose, deploy_script, cloud_cli, git_push, manual, none.`,
+                                },
+                            ],
+                        };
+                    }
+                    const command = typeof args.command === 'string' && args.command.trim() ? args.command.trim() : null;
+                    const liveUrl = typeof args.live_url === 'string' && /^https?:\/\//i.test(args.live_url.trim()) ? args.live_url.trim() : null;
+                    const success = args.success === undefined ? true : Boolean(args.success);
+                    const pin = Boolean(args.pin);
+                    const notes = typeof args.notes === 'string' ? args.notes.trim().slice(0, 600) : null;
+                    const errorText = typeof args.error === 'string' ? args.error.trim().slice(0, 600) : null;
+                    const cardId = typeof args.card_id === 'string' ? args.card_id : null;
+                    const provider = projectConfig?.provider || 'agent';
+                    if (pin) {
+                        setExplicitProfile(root, { method, command, live_url: liveUrl, notes, set_by: `${provider} (IDE session)` });
+                    }
+                    recordAttempt(root, {
+                        card_id: cardId,
+                        method,
+                        command,
+                        ok: success,
+                        kind: success ? null : 'reported_failure',
+                        error: errorText,
+                        live_url: liveUrl,
+                        reported_by: provider,
+                    });
+                    const synced = await client.reportDeployment({
+                        card_id: cardId,
+                        board_id: projectConfig?.board_id || null,
+                        project_path: root,
+                        method,
+                        command,
+                        live_url: liveUrl,
+                        ok: success,
+                        error: errorText,
+                        error_kind: success ? null : 'reported_failure',
+                        source: pin ? 'user' : 'verified',
+                    });
+                    const profile = resolveDeployProfile(root, { memory: loadMemory(root) });
+                    return {
+                        content: [
+                            {
+                                type: 'text',
+                                text: `Recorded ${success ? 'successful' : 'failed'} deployment via ${methodLabel(method)}${command ? ` (\`${command}\`)` : ''}` +
+                                    `${pin ? ' and pinned it as this project\'s deployment route' : ''}.` +
+                                    `${synced ? ' Synced to the Agile Monster board binding.' : ' Saved on this machine (the server did not accept the report; it will still be used locally).'}` +
+                                    `\n\nThe project now resolves to:\n${describeProfile(profile)}`,
+                            },
+                        ],
+                    };
+                }
                 default:
                     throw new Error(`Unknown tool: ${name}`);
             }
@@ -703,10 +862,55 @@ Please strictly follow the Agile Monster Task Lifecycle Protocol:
                 ],
             };
         }
-    });
+    };
+    // Every tool result (including errors) passes through the same filter as resources
+    server.setRequestHandler(CallToolRequestSchema, async (request) => redactResult(await callTool(request), knownSecrets(client.getApiKey())));
     return server;
 }
+/** The bound project folder for this MCP session (where .agilemonster.json lives), else the working directory. */
+function projectRootFor(client) {
+    const config = client.loadProjectConfig();
+    if (config?.project_path && fs.existsSync(config.project_path))
+        return config.project_path;
+    let dir = process.cwd();
+    while (dir !== path.parse(dir).root) {
+        if (fs.existsSync(path.join(dir, '.agilemonster.json')))
+            return dir;
+        dir = path.dirname(dir);
+    }
+    return process.cwd();
+}
+function currentDeployProfileSummary(client) {
+    try {
+        const root = projectRootFor(client);
+        const profile = resolveDeployProfile(root, { memory: loadMemory(root) });
+        return {
+            method: profile.method,
+            command: profile.command,
+            confidence: profile.confidence,
+            source: profile.source,
+            live_url: profile.liveUrl,
+            evidence: profile.evidence.slice(0, 3),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function deployGuidanceText(client) {
+    try {
+        const root = projectRootFor(client);
+        const profile = resolveDeployProfile(root, { memory: loadMemory(root) });
+        return (`How this project deploys (from project evidence and past deployments):\n${describeProfile(profile)}\n` +
+            `After deploying, call agilemonster_record_deployment so future tasks reuse what worked.`);
+    }
+    catch {
+        return 'Call agilemonster_get_deploy_profile to see how this project deploys.';
+    }
+}
 function sendDesktopNotification(title, message) {
+    if (process.env.AGILEMONSTER_NO_NOTIFY === '1')
+        return;
     if (process.platform === 'darwin') {
         try {
             const safeTitle = title.replace(/["\\]/g, '');
@@ -761,8 +965,31 @@ function syncIdeTaskRules(boardName, queuedCards) {
     }
     catch { }
 }
+/** Work in flight (card execution or deployment). Restarts for updates wait until this drops to zero. */
+let activeWork = 0;
+function exitWhenIdle(reason) {
+    const startedWaiting = Date.now();
+    const check = () => {
+        // Never kill a half-applied edit or a running deployment; give up waiting after 30 minutes.
+        if (activeWork === 0 || Date.now() - startedWaiting > 30 * 60 * 1000) {
+            log.info('daemon.exit', { reason, waited_ms: Date.now() - startedWaiting });
+            process.exit(0);
+        }
+    };
+    check();
+    setInterval(check, 3000);
+}
 function triggerBackgroundSelfUpdate(targetVersion) {
     try {
+        // Guard against a restart loop: if we already tried to reach this version recently and are still
+        // older (e.g. the daemon runs from a source checkout, or npm has not published it yet), do not retry.
+        const attemptFile = path.join(agileMonsterHome(), 'update-attempt.json');
+        const target = targetVersion || 'latest';
+        const previous = readJson(attemptFile);
+        if (previous?.target === target && Date.now() - (previous.at || 0) < 6 * 60 * 60 * 1000) {
+            return;
+        }
+        writeJsonAtomic(attemptFile, { target, at: Date.now(), from: MCP_SERVER_VERSION });
         // 1. Ensure local .cursor/mcp.json and .mcp.json use @latest so next IDE reload uses latest
         const cwd = process.cwd();
         for (const rel of ['.cursor/mcp.json', '.mcp.json', '.vscode/mcp.json']) {
@@ -778,7 +1005,7 @@ function triggerBackgroundSelfUpdate(targetVersion) {
                 catch { }
             }
         }
-        // 2. Install @agilemonster/mcp-server@latest into global/npx cache and then exit(0) so launchd respawns the daemon cleanly
+        // 2. Install @agilemonster/mcp-server@latest into global/npx cache, then exit once idle so launchd respawns the daemon
         const child = spawn('sh', ['-c', 'npm install -g @agilemonster/mcp-server@latest >/dev/null 2>&1 || npx -y @agilemonster/mcp-server@latest --version >/dev/null 2>&1'], {
             stdio: 'ignore',
             detached: true,
@@ -790,72 +1017,138 @@ function triggerBackgroundSelfUpdate(targetVersion) {
                 agentName: 'Agile Monster Daemon',
                 model: 'system',
                 status: 'updated',
-                summary: `Automatically updated @agilemonster/mcp-server from v${MCP_SERVER_VERSION} to v${targetVersion || 'latest'} and restarted daemon via launchd.`,
+                summary: `Updated @agilemonster/mcp-server from v${MCP_SERVER_VERSION} to v${target} and restarting the daemon.`,
             });
-            setTimeout(() => {
-                process.exit(0);
-            }, 1500).unref();
+            setTimeout(() => exitWhenIdle('self-update'), 1500).unref();
         });
         child.unref();
     }
-    catch { }
+    catch (err) {
+        log.warn('daemon.self_update_failed', { error: errorMessage(err) });
+    }
 }
-function readProjectInstructionsContext(projectPath) {
+/**
+ * Context handed to the code model. Ordered so the most decisive facts come first (older backends keep
+ * only the first 4,000 characters): how the project ships, then the project's own memory/instructions.
+ */
+function readProjectInstructionsContext(projectPath, profile) {
     const sections = [];
-    for (const docName of ['CLAUDE.md', 'AGENTS.md', 'README.md']) {
+    const maxTotalChars = 12000;
+    if (profile) {
+        const notes = profile.deploymentNotes ? `\nFrom the project docs:\n${profile.deploymentNotes.slice(0, 700)}` : '';
+        sections.push(`=== How this project builds and deploys ===\n${describeProfile(profile)}${notes}`.slice(0, 1500));
+    }
+    const docCandidates = [
+        ['MEMORY.md', 2200],
+        ['CLAUDE.md', 2200],
+        ['AGENTS.md', 1200],
+        ['.cursorrules', 1000],
+        ['README.md', 2000],
+        ['.github/copilot-instructions.md', 1000],
+    ];
+    for (const [docName, cap] of docCandidates) {
         const docPath = path.join(projectPath, docName);
         if (fs.existsSync(docPath)) {
             try {
                 const raw = fs.readFileSync(docPath, 'utf8').trim();
                 if (raw.length > 0) {
-                    sections.push(`=== ${docName} ===\n${raw.slice(0, 1800)}`);
+                    sections.push(`=== ${docName} ===\n${raw.slice(0, cap)}`);
+                }
+            }
+            catch { }
+        }
+    }
+    const cursorRulesDir = path.join(projectPath, '.cursor', 'rules');
+    if (fs.existsSync(cursorRulesDir)) {
+        try {
+            const ruleFiles = fs
+                .readdirSync(cursorRulesDir)
+                .filter((f) => (f.endsWith('.md') || f.endsWith('.mdc')) && f !== 'agilemonster-queue.mdc');
+            for (const rf of ruleFiles.slice(0, 5)) {
+                try {
+                    const ruleContent = fs.readFileSync(path.join(cursorRulesDir, rf), 'utf8').trim();
+                    if (ruleContent) {
+                        sections.push(`=== .cursor/rules/${rf} ===\n${ruleContent.slice(0, 1200)}`);
+                    }
+                }
+                catch { }
+            }
+        }
+        catch { }
+    }
+    for (const sub of ['apps/web/README.md', 'apps/api/README.md', 'frontend/README.md', 'backend/README.md']) {
+        const subDoc = path.join(projectPath, sub);
+        if (fs.existsSync(subDoc)) {
+            try {
+                const raw = fs.readFileSync(subDoc, 'utf8').trim();
+                if (raw.length > 0) {
+                    sections.push(`=== ${sub} ===\n${raw.slice(0, 1200)}`);
                 }
             }
             catch { }
         }
-        if (sections.join('\n\n').length >= 3000)
-            break;
+    }
+    const pkgPath = path.join(projectPath, 'package.json');
+    if (fs.existsSync(pkgPath)) {
+        try {
+            const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+            const scripts = pkg?.scripts ? JSON.stringify(pkg.scripts, null, 2) : '';
+            const workspaces = pkg?.workspaces ? JSON.stringify(pkg.workspaces) : '';
+            if (scripts || workspaces) {
+                sections.push(`=== Project Scripts & Workspaces ===\n${scripts ? `scripts: ${scripts}\n` : ''}${workspaces ? `workspaces: ${workspaces}` : ''}`.slice(0, 1200));
+            }
+        }
+        catch { }
     }
     try {
-        const recentCommits = execSync('git log -n 4 --oneline', {
+        const recentCommits = execSync('git log -n 8 --oneline', {
             cwd: projectPath,
             encoding: 'utf8',
             stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: 5000,
         }).trim();
         if (recentCommits) {
             sections.push(`=== Recent Git Commits ===\n${recentCommits}`);
         }
     }
     catch { }
-    return sections.join('\n\n').slice(0, 3800);
+    return sections.join('\n\n').slice(0, maxTotalChars);
 }
 const activeAutonomousCards = new Set();
-function collectProjectSourceFiles(projectPath, keywords) {
-    const skipDirs = new Set([
-        'node_modules',
-        '.git',
-        'dist',
-        'build',
-        '.next',
-        '.nuxt',
-        '.dart_tool',
-        'vendor',
-        'coverage',
-        'ios',
-        'android',
-        'macos',
-        'linux',
-        'windows',
-        'web',
-        'public',
-        'assets',
-        'archive',
-        'backups',
-    ]);
-    const validExts = new Set(['.tsx', '.ts', '.jsx', '.js', '.dart', '.php', '.py', '.css', '.scss', '.html', '.vue']);
-    const results = [];
+const SOURCE_EXTS = new Set(['.tsx', '.ts', '.jsx', '.js', '.dart', '.php', '.py', '.css', '.scss', '.html', '.vue']);
+const SKIP_DIRS = new Set([
+    'node_modules',
+    '.git',
+    'dist',
+    'build',
+    '.next',
+    '.nuxt',
+    '.dart_tool',
+    'vendor',
+    'coverage',
+    'archive',
+    'backups',
+]);
+/** Every candidate source file in the project: Git's own view when available (honours .gitignore), else a bounded walk. */
+function listProjectFiles(projectPath) {
+    try {
+        if (fs.existsSync(path.join(projectPath, '.git'))) {
+            const out = execFileSync('git', ['ls-files', '-co', '--exclude-standard'], {
+                cwd: projectPath,
+                encoding: 'utf8',
+                stdio: ['ignore', 'pipe', 'ignore'],
+                timeout: 10000,
+                maxBuffer: 32 * 1024 * 1024,
+            });
+            const files = out.split('\n').map((l) => l.trim()).filter(Boolean);
+            if (files.length > 0)
+                return files;
+        }
+    }
+    catch { }
+    const found = [];
     const walk = (dir, depth) => {
-        if (depth > 6 || results.length > 600)
+        if (depth > 8 || found.length > 20000)
             return;
         let entries = [];
         try {
@@ -865,67 +1158,157 @@ function collectProjectSourceFiles(projectPath, keywords) {
             return;
         }
         for (const entry of entries) {
-            const name = entry.name;
-            if (name.startsWith('.'))
+            if (entry.name.startsWith('.'))
                 continue;
-            if (/backup|copy|\s\d+/i.test(name))
-                continue;
-            const full = path.join(dir, name);
+            const full = path.join(dir, entry.name);
             if (entry.isDirectory()) {
-                if (skipDirs.has(name.toLowerCase()))
-                    continue;
-                walk(full, depth + 1);
+                if (!SKIP_DIRS.has(entry.name.toLowerCase()))
+                    walk(full, depth + 1);
             }
             else if (entry.isFile()) {
-                const ext = path.extname(name).toLowerCase();
-                if (!validExts.has(ext))
-                    continue;
-                if (/\.(test|spec|min|d)\./i.test(name))
+                found.push(path.relative(projectPath, full).replace(/\\/g, '/'));
+            }
+        }
+    };
+    walk(projectPath, 0);
+    return found;
+}
+/**
+ * Which top-level folders and files the team has actually been working in lately, measured in commits
+ * (not file touches, so one bulk reformat of a legacy folder does not make it look active).
+ */
+function recentGitActivity(projectPath) {
+    const files = new Set();
+    const dirCommits = new Map();
+    try {
+        const out = execFileSync('git', ['log', '-n', '150', '--name-only', '--format=__AM_COMMIT__'], {
+            cwd: projectPath,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: 10000,
+            maxBuffer: 16 * 1024 * 1024,
+        });
+        for (const commit of out.split('__AM_COMMIT__')) {
+            const tops = new Set();
+            for (const line of commit.split('\n')) {
+                const rel = line.trim();
+                if (!rel)
                     continue;
-                const rel = path.relative(projectPath, full).replace(/\\/g, '/');
-                const lowerRel = rel.toLowerCase();
-                let score = 0;
+                files.add(rel);
+                if (rel.includes('/'))
+                    tops.add(rel.split('/')[0]);
+            }
+            for (const top of tops)
+                dirCommits.set(top, (dirCommits.get(top) || 0) + 1);
+        }
+    }
+    catch { }
+    let maxCommits = 0;
+    for (const n of dirCommits.values())
+        maxCommits = Math.max(maxCommits, n);
+    return { files, dirCommits, maxCommits };
+}
+export function collectProjectSourceFiles(projectPath, keywords) {
+    const isFlutterProject = fs.existsSync(path.join(projectPath, 'pubspec.yaml'));
+    const activity = recentGitActivity(projectPath);
+    let docsText = '';
+    for (const doc of ['CLAUDE.md', 'AGENTS.md', 'MEMORY.md', 'README.md']) {
+        try {
+            docsText += fs.readFileSync(path.join(projectPath, doc), 'utf8').slice(0, 20000).toLowerCase() + '\n';
+        }
+        catch { }
+    }
+    const candidates = [];
+    for (const rel of listProjectFiles(projectPath)) {
+        const segments = rel.split('/');
+        const name = segments[segments.length - 1];
+        const ext = path.extname(name).toLowerCase();
+        if (!SOURCE_EXTS.has(ext))
+            continue;
+        if (/\.(test|spec|min|d)\./i.test(name))
+            continue;
+        const dirsOnly = segments.slice(0, -1).map((s) => s.toLowerCase());
+        if (segments.some((s) => s.startsWith('.') || /backup|copy|\s\d+/i.test(s)))
+            continue;
+        if (dirsOnly.some((s) => SKIP_DIRS.has(s) || /blueprint|figma[-_]export|mockup|prototype/i.test(s)))
+            continue;
+        // In a Flutter app, the native platform runner folders are generated scaffolding, not the app's source
+        if (isFlutterProject && ['ios', 'android', 'macos', 'linux', 'windows', 'web'].includes(dirsOnly[0] || ''))
+            continue;
+        const lowerRel = rel.toLowerCase();
+        let score = 0;
+        if (/blueprint|figma-export|figma_export|mockup|prototype|sample|temp/i.test(lowerRel))
+            score -= 50;
+        // Active application directories, including suffixed monorepo folders (backend-php/, frontend-flutter/, …)
+        if (/^(apps|packages|src|lib|app|web|server|api|client|frontend[\w.-]*|backend[\w.-]*)\//i.test(lowerRel))
+            score += 35;
+        const top = dirsOnly[0] || '';
+        if (top) {
+            // Folders the project docs name explicitly are the live ones (`backend-php/` must not count as `backend/`)
+            if (new RegExp(`(^|[^\\w-])${top.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}/`).test(docsText))
+                score += 15;
+            // Rank top-level folders by how much of the recent history touched them: next to an active
+            // `backend-php/`, a `backend/` that one commit in 150 touched is legacy.
+            if (activity.maxCommits >= 10) {
+                const commits = activity.dirCommits.get(segments[0]) || 0;
+                const share = commits / activity.maxCommits;
+                if (share < 0.06)
+                    score -= 30;
+                else
+                    score += Math.round(12 * share);
+            }
+        }
+        if (activity.files.has(rel))
+            score += 8;
+        for (const kw of keywords) {
+            if (kw.length >= 3 && lowerRel.includes(kw))
+                score += 25;
+        }
+        if (ext === '.tsx' || ext === '.jsx' || ext === '.dart' || ext === '.vue') {
+            if (/component|screen|widget|modal|page|view/.test(lowerRel))
+                score += 12;
+        }
+        if (ext === '.php' || ext === '.py' || ext === '.ts') {
+            if (/controller|service|route|model/.test(lowerRel))
+                score += 12;
+        }
+        candidates.push({ rel, score });
+    }
+    // Content keyword hits are the strongest signal but cost a file read: spend them on the best-looking files
+    candidates.sort((a, b) => b.score - a.score || a.rel.localeCompare(b.rel));
+    for (const c of candidates.slice(0, 1200)) {
+        const ext = path.extname(c.rel).toLowerCase();
+        if (!['.tsx', '.ts', '.dart', '.php', '.jsx', '.vue', '.py', '.js'].includes(ext))
+            continue;
+        try {
+            const full = path.join(projectPath, c.rel);
+            if (fs.statSync(full).size < 120000) {
+                const contentLower = fs.readFileSync(full, 'utf8').toLowerCase();
                 for (const kw of keywords) {
-                    if (kw.length >= 3 && lowerRel.includes(kw)) {
-                        score += 25;
-                    }
-                }
-                // Check file content for keyword hits on promising source files
-                if (ext === '.tsx' || ext === '.ts' || ext === '.dart' || ext === '.php' || ext === '.jsx') {
-                    try {
-                        const stat = fs.statSync(full);
-                        if (stat.size < 120000) {
-                            const contentLower = fs.readFileSync(full, 'utf8').toLowerCase();
-                            for (const kw of keywords) {
-                                if (kw.length >= 4 && contentLower.includes(kw)) {
-                                    score += 10;
-                                }
-                            }
-                        }
-                    }
-                    catch { }
+                    if (kw.length >= 4 && contentLower.includes(kw))
+                        c.score += 10;
                 }
-                // Bonus score for UI components / screens AND backend controllers / models
-                if (ext === '.tsx' || ext === '.jsx' || ext === '.dart' || ext === '.vue') {
-                    if (lowerRel.includes('component') || lowerRel.includes('screen') || lowerRel.includes('widget') || lowerRel.includes('modal') || lowerRel.includes('model')) {
-                        score += 8;
-                    }
-                }
-                if (ext === '.php' || ext === '.py' || ext === '.ts') {
-                    if (lowerRel.includes('controller') || lowerRel.includes('service') || lowerRel.includes('route')) {
-                        score += 10;
-                    }
-                }
-                results.push({ rel, score });
             }
         }
-    };
-    walk(projectPath, 0);
-    results.sort((a, b) => b.score - a.score || a.rel.localeCompare(b.rel));
-    return results.slice(0, 250).map((r) => r.rel);
+        catch { }
+    }
+    candidates.sort((a, b) => b.score - a.score || a.rel.localeCompare(b.rel));
+    return candidates.slice(0, 300).map((r) => r.rel);
+}
+/** Lock files are tiny, but they are written per card forever: drop the ones nobody can still be waiting on. */
+function pruneStaleLocks(maxAgeMs = 45 * 24 * 60 * 60 * 1000) {
+    try {
+        const dir = path.join(agileMonsterHome(), 'locks');
+        for (const name of fs.readdirSync(dir)) {
+            const file = path.join(dir, name);
+            if (Date.now() - fs.statSync(file).mtimeMs > maxAgeMs)
+                fs.rmSync(file, { force: true });
+        }
+    }
+    catch { }
 }
 function getAgileMonsterLocksDir() {
-    const dir = path.join(os.homedir(), '.agilemonster', 'locks');
+    const dir = path.join(agileMonsterHome(), 'locks');
     try {
         if (!fs.existsSync(dir)) {
             fs.mkdirSync(dir, { recursive: true });
@@ -936,9 +1319,8 @@ function getAgileMonsterLocksDir() {
 }
 /**
  * Append a live, human-readable IDE activity entry to `<projectPath>/.agilemonster/ACTIVITY.md`
- * (and exclude `.agilemonster/` in `.git/info/exclude` so it never pollutes `git status`).
- * Developers can open `.agilemonster/ACTIVITY.md` in their IDE at any time to see full agent
- * troubleshooting logs, files inspected, build verification output, and diffs.
+ * (kept out of Git via `.git/info/exclude`). Developers can open it in their IDE at any time to see
+ * agent troubleshooting logs, files inspected, build verification output, and diffs.
  */
 function appendIdeActivityLog(projectPath, entry) {
     try {
@@ -946,13 +1328,7 @@ function appendIdeActivityLog(projectPath, entry) {
         if (!fs.existsSync(amDir)) {
             fs.mkdirSync(amDir, { recursive: true });
         }
-        const gitExclude = path.join(projectPath, '.git', 'info', 'exclude');
-        if (fs.existsSync(gitExclude)) {
-            const exContent = fs.readFileSync(gitExclude, 'utf8');
-            if (!exContent.includes('.agilemonster/')) {
-                fs.appendFileSync(gitExclude, '\n.agilemonster/\n.agilemonster.json\n', 'utf8');
-            }
-        }
+        ensureLocalGitExcludes(projectPath);
         const logPath = path.join(amDir, 'ACTIVITY.md');
         const timestamp = new Date().toISOString().replace('T', ' ').slice(0, 19) + ' UTC';
         const header = !fs.existsSync(logPath)
@@ -975,6 +1351,382 @@ function appendIdeActivityLog(projectPath, entry) {
     }
     catch { }
 }
+function boundProfileOf(card) {
+    return {
+        deploy_method: card.deploy_method,
+        deploy_command: card.deploy_command,
+        live_url: card.live_url,
+        build_command: card.build_command,
+        deploy_source: card.deploy_source,
+    };
+}
+/** Feed the outcome back to the server so the board's binding converges on the route that really works. */
+async function reportOutcome(client, card, projectPath, res) {
+    if (res.method === 'none' || res.errorKind === 'needs_confirmation')
+        return;
+    await client.reportDeployment({
+        card_id: card.id,
+        board_id: card.board_id,
+        project_path: projectPath,
+        method: res.method,
+        command: res.command,
+        live_url: res.profile.liveUrlSource === 'guessed' ? null : res.profile.liveUrl,
+        ok: res.ok,
+        // "Pushed but not verified" must not be recorded as a proven route
+        pending: res.pending || res.unverified,
+        error: res.ok ? null : res.errorDetail.slice(0, 480),
+        error_kind: res.errorKind,
+        commit: res.commitHash || null,
+        source: res.profile.source === 'explicit' || res.profile.source === 'user' ? 'user' : 'verified',
+        evidence: res.profile.evidence.slice(0, 3),
+    });
+}
+const sha1 = (text) => crypto.createHash('sha1').update(text).digest('hex');
+function journalFile(cardId) {
+    return path.join(agileMonsterHome(), 'journal', `${cardId.replace(/[^a-zA-Z0-9-]/g, '')}.json`);
+}
+/** Record the pre-edit contents of every file touched so far (called after each write). */
+function journalEdits(cardId, projectPath, originals) {
+    try {
+        const files = {};
+        for (const [abs, original] of originals.entries()) {
+            let current = original;
+            try {
+                current = fs.readFileSync(abs, 'utf8');
+            }
+            catch { }
+            files[abs] = { original, edited_sha: sha1(current) };
+        }
+        writeJsonAtomic(journalFile(cardId), { card_id: cardId, project_path: projectPath, pid: process.pid, at: new Date().toISOString(), files });
+    }
+    catch (err) {
+        log.warn('journal.write_failed', { card: cardId, error: errorMessage(err) });
+    }
+}
+function clearEditJournal(cardId) {
+    try {
+        fs.rmSync(journalFile(cardId), { force: true });
+    }
+    catch { }
+}
+/**
+ * Roll back edits left behind by a worker that died mid-card. A file is only restored if it still holds
+ * exactly what that worker wrote — anything the developer touched since is left alone.
+ */
+export function recoverEditJournals() {
+    let restored = 0;
+    try {
+        const dir = path.join(agileMonsterHome(), 'journal');
+        if (!fs.existsSync(dir))
+            return 0;
+        for (const name of fs.readdirSync(dir)) {
+            if (!name.endsWith('.json'))
+                continue;
+            const file = path.join(dir, name);
+            const journal = readJson(file);
+            if (!journal?.files) {
+                fs.rmSync(file, { force: true });
+                continue;
+            }
+            if (journal.pid === process.pid || (journal.pid && isPidAlive(journal.pid)))
+                continue; // still being worked on
+            for (const [abs, entry] of Object.entries(journal.files)) {
+                try {
+                    if (sha1(fs.readFileSync(abs, 'utf8')) === entry.edited_sha) {
+                        fs.writeFileSync(abs, entry.original, 'utf8');
+                        restored++;
+                    }
+                }
+                catch { }
+            }
+            log.warn('journal.recovered', { card: journal.card_id, project: journal.project_path, files: Object.keys(journal.files).length });
+            fs.rmSync(file, { force: true });
+        }
+    }
+    catch (err) {
+        log.warn('journal.recover_failed', { error: errorMessage(err) });
+    }
+    return restored;
+}
+// ---------------------------------------------------------------------------
+// Who may steer deployments on this machine
+// ---------------------------------------------------------------------------
+const ownerIds = new WeakMap();
+/** The account whose API key this machine runs under. Only that person may choose or confirm what gets executed here. */
+function machineOwnerId(client) {
+    let cached = ownerIds.get(client);
+    if (!cached) {
+        cached = client
+            .me()
+            .then((me) => (me?.id ? String(me.id) : null))
+            .catch(() => null);
+        ownerIds.set(client, cached);
+        // Do not cache a failed lookup forever
+        void cached.then((id) => {
+            if (!id)
+                ownerIds.delete(client);
+        });
+    }
+    return cached;
+}
+async function withRetry(what, fn, attempts = 3) {
+    let lastError;
+    for (let i = 0; i < attempts; i++) {
+        try {
+            return await fn();
+        }
+        catch (err) {
+            lastError = err;
+            log.warn('api.retry', { what, attempt: i + 1, error: errorMessage(err) });
+            await new Promise((r) => setTimeout(r, 1500 * (i + 1)));
+        }
+    }
+    throw lastError;
+}
+/**
+ * A card whose TITLE is an operations request ("Restart the container", "Redeploy production").
+ * Anchored to the start of the title so "Add a restart button to the server page" is not one.
+ */
+export function isRedeployOnlyCard(card) {
+    return /^\s*(please\s+)?(restart|re-?deploy|rebuild|recreate|re-?start)\b[\s\S]{0,60}\b(containers?|docker|server|stack|prod(uction)?|app|site|services?)\b/i.test(card.title || '');
+}
+async function runRedeployOnlyCard(client, card, projectPath, provider, workerLabel, lockFile) {
+    await client.addProgress(card.id, provider, `This card asks for a deployment, not a code change. Redeploying \`${projectPath}\` now...`);
+    const res = await runDeployment({
+        projectPath,
+        title: card.title || 'redeploy',
+        cardId: card.id,
+        redeploy: true,
+        bound: boundProfileOf(card),
+    });
+    await reportOutcome(client, card, projectPath, res);
+    const blankState = (extra) => ({
+        stage: 'deploy_failed',
+        files: [],
+        summary: `Redeployed for "${card.title}".`,
+        verification_steps: '1. Check that the application is up and serving the latest version.',
+        diff: '',
+        commit: res.commitHash || null,
+        at: new Date().toISOString(),
+        attempts: 1,
+        ...extra,
+    });
+    if (!res.ok) {
+        setCardState(projectPath, card.id, blankState({
+            last_error: res.errorDetail,
+            pending_confirmation: res.errorKind === 'needs_confirmation' ? { method: res.method, command: res.command } : null,
+        }));
+        removeTaskLock(lockFile);
+        await client.askQuestion(card.id, provider, res.errorKind === 'needs_confirmation' ? describeFailureForHuman(res) : `The redeploy did not go through.\n\n${describeFailureForHuman(res)}`);
+        return false;
+    }
+    if (res.pending && res.pendingVerification)
+        addPendingVerification(projectPath, { ...res.pendingVerification, provider });
+    setCardState(projectPath, card.id, null);
+    appendIdeActivityLog(projectPath, {
+        cardId: card.id,
+        cardTitle: card.title,
+        agentName: workerLabel,
+        model: card.agent_model || 'auto',
+        status: 'review',
+        summary: res.deployedNote,
+    });
+    await client.submitReview(card.id, provider, res.deployedNote, '1. Check that the application is up and serving the latest version.', undefined, undefined, {
+        logText: `Redeploy for "${card.title}" in ${projectPath}\n${res.deployedNote}`,
+    });
+    writeTaskLock(lockFile, card, 'completed');
+    return true;
+}
+function latestHumanComment(comments) {
+    for (let i = comments.length - 1; i >= 0; i--) {
+        const c = comments[i];
+        const text = (c.text || '').trim();
+        if (!text)
+            continue;
+        if ((c.author_kind || 'member').toLowerCase() === 'agent')
+            continue;
+        if (/^(🤖|🛠️|✅|🚀|🔄|🛡️|🚨|⚠️|❓|⏳|📦)/u.test(text))
+            continue;
+        return c;
+    }
+    return null;
+}
+/** Server timestamps are UTC, with or without a zone suffix. Unknown formats count as "after" (fail open). */
+function commentIsAfter(comment, isoTime) {
+    const raw = (comment.created_at || '').trim();
+    if (!raw)
+        return true;
+    const normalized = /[zZ]|[+-]\d\d:?\d\d$/.test(raw) ? raw : `${raw.replace(' ', 'T')}Z`;
+    const at = Date.parse(normalized);
+    const ref = Date.parse(isoTime);
+    if (Number.isNaN(at) || Number.isNaN(ref))
+        return true;
+    return at >= ref - 2 * 60 * 1000; // tolerate clock skew between this machine and the server
+}
+function writeTaskLock(lockFile, card, status) {
+    try {
+        fs.writeFileSync(lockFile, JSON.stringify({
+            card_id: card.id,
+            card_updated_at: card.updated_at || '',
+            status,
+            [status === 'running' ? 'started_at' : 'completed_at']: new Date().toISOString(),
+        }), 'utf8');
+    }
+    catch { }
+}
+function removeTaskLock(lockFile) {
+    try {
+        if (fs.existsSync(lockFile))
+            fs.unlinkSync(lockFile);
+    }
+    catch { }
+}
+/**
+ * The code change for this card already exists — only its deployment failed. When the human replies
+ * ("retry", or "deploy: <method or command>"), redo ONLY the deployment. Previously the whole card was
+ * re-run from scratch, the model found nothing left to change, and the deploy was never retried.
+ *
+ * Returns 'continue' when the reply is new code feedback and the normal flow should run.
+ */
+async function resumeFailedDeployment(client, card, projectPath, provider, workerLabel, state, lockFile) {
+    let human = null;
+    try {
+        human = latestHumanComment(await client.listComments(card.id));
+    }
+    catch (err) {
+        log.warn('card.comments_unavailable', { card: card.id, error: errorMessage(err) });
+    }
+    // Only a reply written AFTER the failure/question counts. An older comment is never re-applied as an instruction.
+    const reply = human && commentIsAfter(human, state.at) ? human : null;
+    const parsed = reply ? parseDeployDirective(reply.text) : null;
+    // A fresh reply that is not about deploying is new feedback on the code: run the full flow.
+    if (reply && !parsed)
+        return 'continue';
+    const pendingRoute = state.pending_confirmation || null;
+    const choosesRoute = Boolean(parsed && (parsed.method || parsed.liveUrl || pendingRoute));
+    if (choosesRoute) {
+        // Choosing or confirming a route decides what is executed on THIS computer, so it has to come from the
+        // person whose account this machine runs under — not from anyone who can comment on the board.
+        const ownerId = await machineOwnerId(client);
+        const authorId = reply?.user_id ? String(reply.user_id) : '';
+        if (!ownerId || !authorId || authorId !== ownerId) {
+            removeTaskLock(lockFile);
+            setCardState(projectPath, card.id, { ...state, at: new Date().toISOString() });
+            await client.askQuestion(card.id, provider, 'I can only take deployment instructions (which route or command to run) from the person whose computer runs this agent. Please ask them to reply here with `deploy: <method or command>`, or to confirm with **yes**.');
+            return 'failed';
+        }
+    }
+    if (pendingRoute && !parsed) {
+        // Re-queued without an answer (card dragged, reassigned, comments unreadable): asking is still pending.
+        // Nothing is ever confirmed on the human's behalf.
+        removeTaskLock(lockFile);
+        setCardState(projectPath, card.id, { ...state, at: new Date().toISOString() });
+        await client.askQuestion(card.id, provider, `I still need an answer before I deploy this project for the first time. Reply \`deploy: ${pendingRoute.command || pendingRoute.method}\` to confirm, \`deploy: manual\` if you deploy it yourself, or tell me the right route.`);
+        return 'failed';
+    }
+    // No fresh reply at all: a re-queue of a deploy-failed card means "try the same deployment again".
+    let directive = parsed || { retry: true, method: null, command: null, liveUrl: null };
+    // "yes" / "retry" from the owner in answer to "may I deploy with X?" confirms X
+    if (parsed && !directive.method && pendingRoute) {
+        const confirmed = normalizeMethod(pendingRoute.method);
+        if (confirmed)
+            directive = { ...directive, method: confirmed, command: pendingRoute.command };
+    }
+    if (directive.method) {
+        setExplicitProfile(projectPath, {
+            method: directive.method,
+            command: directive.command,
+            live_url: directive.liveUrl,
+            notes: `confirmed on card "${card.title}"`,
+            set_by: 'the machine owner',
+        });
+    }
+    await client.addProgress(card.id, provider, directive.method
+        ? `Got it — deploying with **${methodLabel(directive.method)}**${directive.command ? ` (\`${directive.command}\`)` : ''}. I've saved this as the deployment route for this project, so future cards use it automatically.`
+        : 'Retrying the deployment of the change I already made (no code is being regenerated).');
+    const res = await runDeployment({
+        projectPath,
+        title: card.title || 'update',
+        cardId: card.id,
+        files: state.files,
+        redeploy: true,
+        bound: boundProfileOf(card),
+        override: directive.method ? { method: directive.method, command: directive.command } : null,
+    });
+    await reportOutcome(client, card, projectPath, res);
+    if (!res.ok) {
+        setCardState(projectPath, card.id, {
+            ...state,
+            attempts: state.attempts + 1,
+            last_error: res.errorDetail,
+            at: new Date().toISOString(),
+            pending_confirmation: res.errorKind === 'needs_confirmation' ? { method: res.method, command: res.command } : null,
+        });
+        removeTaskLock(lockFile);
+        appendIdeActivityLog(projectPath, {
+            cardId: card.id,
+            cardTitle: card.title,
+            agentName: workerLabel,
+            model: card.agent_model || 'auto',
+            status: 'deploy_failed',
+            summary: `Deployment retry failed: ${res.errorDetail.slice(0, 500)}`,
+            files: state.files,
+        });
+        await client.askQuestion(card.id, provider, res.errorKind === 'needs_confirmation'
+            ? describeFailureForHuman(res)
+            : `The deployment still did not go through, so this card stays in progress.\n\n${describeFailureForHuman(res)}`);
+        return 'failed';
+    }
+    if (res.pending && res.pendingVerification) {
+        addPendingVerification(projectPath, { ...res.pendingVerification, provider });
+    }
+    setCardState(projectPath, card.id, null);
+    const summary = `${state.summary}\n\n${res.deployedNote}`.trim();
+    appendIdeActivityLog(projectPath, {
+        cardId: card.id,
+        cardTitle: card.title,
+        agentName: workerLabel,
+        model: card.agent_model || 'auto',
+        status: 'review',
+        summary,
+        files: state.files,
+    });
+    await client.submitReview(card.id, provider, summary, state.verification_steps, undefined, undefined, {
+        diffText: state.diff,
+        logText: `Deployment retried for "${card.title}" in ${projectPath}\n${res.deployedNote}`,
+        filesModified: state.files.join(', '),
+    });
+    writeTaskLock(lockFile, card, 'completed');
+    sendDesktopNotification('Agile Monster -> Ready for Review', `Deployed "${card.title}" and moved it to Testing / Review.`);
+    return 'done';
+}
+/** Find the nearest package.json (walking up from each changed front-end file) that has a build script and installed deps. */
+function frontendBuildDirs(projectPath, modifiedFiles) {
+    const root = path.resolve(projectPath);
+    const dirs = [];
+    for (const rel of modifiedFiles) {
+        if (!/\.(tsx?|jsx?|vue|css|scss)$/i.test(rel))
+            continue;
+        let dir = path.dirname(path.resolve(root, rel));
+        while (dir.startsWith(root)) {
+            const pkgJson = path.join(dir, 'package.json');
+            if (fs.existsSync(pkgJson)) {
+                try {
+                    const pkg = JSON.parse(fs.readFileSync(pkgJson, 'utf8'));
+                    if (pkg?.scripts?.build && fs.existsSync(path.join(dir, 'node_modules')) && !dirs.includes(dir)) {
+                        dirs.push(dir);
+                    }
+                }
+                catch { }
+                break;
+            }
+            if (dir === root)
+                break;
+            dir = path.dirname(dir);
+        }
+    }
+    return dirs;
+}
 export async function executeQueuedCardAutonomously(client, card, projectPath) {
     if (!projectPath || !fs.existsSync(projectPath))
         return false;
@@ -1001,23 +1753,42 @@ export async function executeQueuedCardAutonomously(client, card, projectPath) {
                 return false;
             }
         }
-        fs.writeFileSync(lockFile, JSON.stringify({
-            card_id: card.id,
-            card_updated_at: cardUpdatedAt,
-            status: 'running',
-            started_at: new Date().toISOString(),
-        }), 'utf8');
+        writeTaskLock(lockFile, card, 'running');
     }
     catch {
         return false;
     }
     activeAutonomousCards.add(card.id);
+    activeWork++;
     const provider = card.agent_provider || 'cursor';
     const workerLabel = card.agent_display_name || provider;
+    // Original contents of every file this run touches, so an interrupted run never leaves half-applied edits behind
+    const originalContents = new Map();
+    let editsHandedOff = false;
+    log.info('card.start', { card: card.id, title: card.title, project: projectPath, provider });
     try {
         // 1. Claim the card (automatically moves it from ToDo -> In Progress on the board!)
         await client.claimTask(card.id, provider, `auto-pulse-${Date.now()}`, card.board_id);
         sendDesktopNotification(`Agile Monster -> ${workerLabel}`, `Claimed & moved to In Progress: "${card.title}"`);
+        // 1b. Deploy-only resume: the change exists, only shipping it is outstanding
+        const priorState = getCardState(projectPath, card.id);
+        let carryOverFiles = [];
+        if (priorState?.stage === 'deploy_failed') {
+            const outcome = await resumeFailedDeployment(client, card, projectPath, provider, workerLabel, priorState, lockFile);
+            if (outcome !== 'continue')
+                return outcome === 'done';
+            // The human sent new code feedback instead: keep the earlier files in the commit set and run normally
+            carryOverFiles = priorState.files;
+        }
+        else if (priorState) {
+            // Rework of a change that is still waiting for approval: the earlier files must ship together with the new ones
+            carryOverFiles = priorState.files;
+        }
+        // "Restart the container" / "Redeploy production" cards ask for a deployment, not for a code change
+        if (isRedeployOnlyCard(card)) {
+            return await runRedeployOnlyCard(client, card, projectPath, provider, workerLabel, lockFile);
+        }
+        const profile = resolveDeployProfile(projectPath, { bound: boundProfileOf(card), memory: loadMemory(projectPath) });
         await client.addProgress(card.id, provider, `Autonomous background runner claimed task in \`${projectPath}\` and moved card to **In Progress**. Scanning repository files...`);
         // 2. Build keyword list from card title + description and collect project source files
         const rawText = `${card.title || ''} ${card.description || ''}`.toLowerCase();
@@ -1027,18 +1798,22 @@ export async function executeQueuedCardAutonomously(client, card, projectPath) {
             .filter((w) => w.length >= 3 && !stopWords.has(w))));
         const fileIndex = collectProjectSourceFiles(projectPath, keywords);
         if (fileIndex.length === 0) {
-            await client.addProgress(card.id, provider, `Card is now **In Progress**, but no matching source files were found in \`${projectPath}\`.`);
+            removeTaskLock(lockFile);
+            await client.askQuestion(card.id, provider, `I could not find any source files to work on in \`${projectPath}\`. Is this the right folder for the "${card.board_name || 'this'}" board? If not, connect the correct project folder in the board's AI Agents settings and reply here.`);
             return false;
         }
         // 3. Ask Agile Monster Autonomous Step to pick the 1-6 most relevant files
-        const projectContext = readProjectInstructionsContext(projectPath);
+        const projectContext = readProjectInstructionsContext(projectPath, profile);
         const selectionRes = await client.autonomousStep({
             card_id: card.id,
             action: 'select_files',
             file_index: fileIndex,
             project_context: projectContext,
         });
-        const selectedFiles = (selectionRes.target_files || selectionRes.selected_files || []).slice(0, 6);
+        // The model may only choose from the files it was offered: a path it made up (../../.ssh/…, .env) is dropped
+        const selectedFiles = (selectionRes.target_files || selectionRes.selected_files || [])
+            .filter((f) => typeof f === 'string' && fileIndex.includes(f))
+            .slice(0, 6);
         if (selectedFiles.length === 0) {
             selectedFiles.push(...fileIndex.slice(0, 4));
         }
@@ -1061,12 +1836,17 @@ export async function executeQueuedCardAutonomously(client, card, projectPath) {
             const full = path.join(projectPath, rel);
             if (fs.existsSync(full)) {
                 try {
-                    filesPayload[rel] = fs.readFileSync(full, 'utf8');
+                    const raw = fs.readFileSync(full);
+                    // A file that is not valid UTF-8 would be silently corrupted by a text round-trip: leave it alone
+                    if (isUtf8(raw))
+                        filesPayload[rel] = raw.toString('utf8');
                 }
                 catch { }
             }
         }
         if (Object.keys(filesPayload).length === 0) {
+            removeTaskLock(lockFile);
+            await client.askQuestion(card.id, provider, 'I could not read the files I selected for this task. Could you point me at the page, screen or file this should change?');
             return false;
         }
         await client.addProgress(card.id, provider, `Selected target files for implementation: ${Object.keys(filesPayload)
@@ -1081,11 +1861,7 @@ export async function executeQueuedCardAutonomously(client, card, projectPath) {
         });
         // Gate A: Strict truth — if the model is not confident / cannot find the target, ask the human instead of guessing
         if (editsRes.needs_clarification && (editsRes.clarification_question || '').trim() !== '') {
-            try {
-                if (fs.existsSync(lockFile))
-                    fs.unlinkSync(lockFile);
-            }
-            catch { }
+            removeTaskLock(lockFile);
             appendIdeActivityLog(projectPath, {
                 cardId: card.id,
                 cardTitle: card.title,
@@ -1098,116 +1874,148 @@ export async function executeQueuedCardAutonomously(client, card, projectPath) {
             await client.askQuestion(card.id, provider, (editsRes.clarification_question || '').trim());
             return false;
         }
-        const applyEditsPass = (editsList) => {
+        // Only the files that were actually sent to the model may be edited (never .git/, never a path it invented)
+        const editableFiles = new Set(Object.keys(filesPayload));
+        const projectRoot = fs.realpathSync(projectPath);
+        /**
+         * Apply one set of edits. Returns the files changed and a reason for every edit that could not be applied.
+         * A set of edits is one coordinated change: the caller ships it only if ALL of it applied.
+         */
+        const applyEditsPass = async (editsList) => {
             const modFiles = [];
+            const failed = [];
             for (const edit of editsList) {
-                const relPath = edit.file || edit.path;
-                if (!relPath || !edit.search || typeof edit.replace !== 'string')
+                const relPath = (edit.file || edit.path || '').replace(/\\/g, '/').replace(/^\.\//, '');
+                if (!relPath || !edit.search || typeof edit.replace !== 'string') {
+                    failed.push(`${relPath || '(no file)'}: the edit was incomplete`);
                     continue;
-                const fullPath = path.resolve(projectPath, relPath);
-                if (!fullPath.startsWith(path.resolve(projectPath)))
+                }
+                if (!editableFiles.has(relPath)) {
+                    failed.push(`${relPath}: not one of the files provided`);
                     continue;
-                if (!fs.existsSync(fullPath))
+                }
+                const fullPath = path.resolve(projectPath, relPath);
+                let realPath = '';
+                try {
+                    realPath = fs.realpathSync(fullPath);
+                }
+                catch { }
+                if (!realPath || !(realPath === projectRoot || realPath.startsWith(projectRoot + path.sep))) {
+                    failed.push(`${relPath}: outside the project`);
                     continue;
+                }
                 const currentContent = fs.readFileSync(fullPath, 'utf8');
-                if (!originalContents.has(fullPath)) {
+                if (!currentContent.includes(edit.search)) {
+                    failed.push(`${relPath}: the \`search\` text was not found verbatim in the file`);
+                    continue;
+                }
+                const updatedContent = currentContent.replace(edit.search, () => edit.replace);
+                if (updatedContent === currentContent)
+                    continue; // nothing to do is not a failure
+                const countChar = (s, ch) => s.split(ch).length - 1;
+                const searchBraceDelta = countChar(edit.search, '{') - countChar(edit.search, '}');
+                const replaceBraceDelta = countChar(edit.replace, '{') - countChar(edit.replace, '}');
+                const searchParenDelta = countChar(edit.search, '(') - countChar(edit.search, ')');
+                const replaceParenDelta = countChar(edit.replace, '(') - countChar(edit.replace, ')');
+                if (searchBraceDelta !== replaceBraceDelta || searchParenDelta !== replaceParenDelta) {
+                    failed.push(`${relPath}: the replacement would leave braces or parentheses unbalanced`);
+                    continue;
+                }
+                if (!originalContents.has(fullPath))
                     originalContents.set(fullPath, currentContent);
+                fs.writeFileSync(fullPath, updatedContent, 'utf8');
+                journalEdits(card.id, projectPath, originalContents);
+                // Per-file syntax checks run without blocking the event loop (the worker heartbeat must keep ticking)
+                if (relPath.endsWith('.dart')) {
+                    const lint = await exec('dart', ['analyze', fullPath], { cwd: projectPath, timeoutMs: 40000 });
+                    if (!lint.ok && /\berror\s+[•-]/i.test(lint.stdout + lint.stderr)) {
+                        fs.writeFileSync(fullPath, currentContent, 'utf8');
+                        failed.push(`${relPath}: dart analyze reported an error after the edit: ${lint.tail.slice(0, 300)}`);
+                        continue;
+                    }
                 }
-                if (currentContent.includes(edit.search)) {
-                    const updatedContent = currentContent.replace(edit.search, edit.replace);
-                    if (updatedContent !== currentContent) {
-                        const countChar = (s, ch) => s.split(ch).length - 1;
-                        const searchBraceDelta = countChar(edit.search, '{') - countChar(edit.search, '}');
-                        const replaceBraceDelta = countChar(edit.replace, '{') - countChar(edit.replace, '}');
-                        const searchParenDelta = countChar(edit.search, '(') - countChar(edit.search, ')');
-                        const replaceParenDelta = countChar(edit.replace, '(') - countChar(edit.replace, ')');
-                        if (searchBraceDelta !== replaceBraceDelta || searchParenDelta !== replaceParenDelta) {
-                            continue;
-                        }
-                        fs.writeFileSync(fullPath, updatedContent, 'utf8');
-                        if (relPath.endsWith('.dart')) {
-                            try {
-                                execSync(`dart analyze "${fullPath}"`, {
-                                    cwd: projectPath,
-                                    stdio: ['ignore', 'pipe', 'pipe'],
-                                    timeout: 25000,
-                                });
-                            }
-                            catch (analyzeErr) {
-                                const out = String(analyzeErr?.stdout || '') + String(analyzeErr?.stderr || '');
-                                if (/\berror\s+[•-]/i.test(out)) {
-                                    fs.writeFileSync(fullPath, currentContent, 'utf8');
-                                    continue;
-                                }
-                            }
-                        }
-                        else if (relPath.endsWith('.php')) {
-                            try {
-                                execSync(`php -l "${fullPath}"`, {
-                                    cwd: projectPath,
-                                    stdio: ['ignore', 'pipe', 'pipe'],
-                                    timeout: 10000,
-                                });
-                            }
-                            catch {
-                                fs.writeFileSync(fullPath, currentContent, 'utf8');
-                                continue;
-                            }
-                        }
-                        if (!modFiles.includes(relPath)) {
-                            modFiles.push(relPath);
-                        }
+                else if (relPath.endsWith('.php')) {
+                    const lint = await exec('php', ['-l', fullPath], { cwd: projectPath, timeoutMs: 15000 });
+                    // exit code null = `php` is not installed here: that must not discard valid work
+                    if (!lint.ok && lint.code !== null && !lint.timedOut) {
+                        fs.writeFileSync(fullPath, currentContent, 'utf8');
+                        failed.push(`${relPath}: PHP syntax error after the edit: ${lint.tail.slice(0, 300)}`);
+                        continue;
                     }
                 }
+                if (!modFiles.includes(relPath))
+                    modFiles.push(relPath);
             }
-            return modFiles;
+            return { modFiles, failed };
         };
-        const originalContents = new Map();
-        const modifiedFiles = applyEditsPass(editsRes.edits || []);
-        // Pre-submit frontend build verification gate for root AND monorepo subdirectories (frontend/, web/, client/)
-        const verifyFrontendBuilds = () => {
-            const hasFrontendEdits = modifiedFiles.some((f) => /\.(tsx?|jsx?|vue|css)$/i.test(f));
-            if (!hasFrontendEdits)
-                return { ok: true };
-            const candidateDirs = [
-                projectPath,
-                path.join(projectPath, 'frontend'),
-                path.join(projectPath, 'web'),
-                path.join(projectPath, 'client'),
-            ];
-            for (const dir of candidateDirs) {
-                const pkgJsonPath = path.join(dir, 'package.json');
-                if (!fs.existsSync(pkgJsonPath) || !fs.existsSync(path.join(dir, 'node_modules')))
-                    continue;
+        const revertAll = () => {
+            for (const [fPath, orig] of originalContents.entries()) {
                 try {
-                    const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf8'));
-                    if (pkg?.scripts?.build) {
-                        const buildCmd = fs.existsSync(path.join(dir, 'pnpm-lock.yaml'))
-                            ? 'pnpm run build'
-                            : 'npm run build';
-                        execSync(buildCmd, {
-                            cwd: dir,
-                            stdio: ['ignore', 'pipe', 'pipe'],
-                            timeout: 60000,
-                        });
-                    }
+                    fs.writeFileSync(fPath, orig, 'utf8');
+                }
+                catch { }
+            }
+            originalContents.clear();
+            clearEditJournal(card.id);
+        };
+        // Never build on top of the developer's own uncommitted work in the same file: a whole-file commit would
+        // ship their half-finished changes under this card's name.
+        const targetFiles = Array.from(new Set((editsRes.edits || []).map((e) => (e.file || e.path || '').replace(/\\/g, '/').replace(/^\.\//, '')).filter((f) => editableFiles.has(f))));
+        if (targetFiles.length > 0) {
+            const status = await exec('git', ['--literal-pathspecs', 'status', '--porcelain', '--', ...targetFiles], { cwd: projectPath, timeoutMs: 20000 });
+            const dirty = status.ok
+                ? status.stdout
+                    .split('\n')
+                    .filter((l) => l.trim() && !l.startsWith('??'))
+                    .map((l) => l.slice(3).trim())
+                    .filter((f) => !carryOverFiles.includes(f))
+                : [];
+            if (dirty.length > 0) {
+                removeTaskLock(lockFile);
+                await client.askQuestion(card.id, provider, `I need to change ${dirty.map((f) => `\`${f}\``).join(', ')}, but ${dirty.length === 1 ? 'that file has' : 'those files have'} uncommitted changes in \`${projectPath}\` that are not mine. Committing my edit would also commit that unfinished work, so I stopped.\n\nCommit or stash those changes, then reply here and I will continue.`);
+                return false;
+            }
+        }
+        let pass = await applyEditsPass(editsRes.edits || []);
+        if (pass.failed.length > 0) {
+            // Half of a coordinated change is worse than none: undo it and give the model one chance to correct itself
+            revertAll();
+            editsRes = await client.autonomousStep({
+                card_id: card.id,
+                action: 'generate_edits',
+                files: {
+                    ...filesPayload,
+                    '__EDITS_THAT_DID_NOT_APPLY__.txt': `Your previous edits were NOT applied because some of them could not be applied, and a partial change must never ship:\n${pass.failed.join('\n')}\nReturn the complete set of edits again. Every \`search\` must be copied verbatim from the current file contents, and only files listed in \`files\` may be edited.`,
+                },
+                project_context: projectContext,
+            });
+            pass = await applyEditsPass(editsRes.edits || []);
+            if (pass.failed.length > 0) {
+                revertAll();
+                pass = { modFiles: [], failed: pass.failed };
+            }
+        }
+        const modifiedFiles = pass.modFiles;
+        const applyFailures = pass.failed;
+        // Pre-submit build gate: build the package that owns each changed front-end file (works for any monorepo layout)
+        const verifyFrontendBuilds = async () => {
+            for (const dir of frontendBuildDirs(projectPath, modifiedFiles)) {
+                const buildCmd = fs.existsSync(path.join(dir, 'pnpm-lock.yaml')) ? 'pnpm' : 'npm';
+                const res = await exec(buildCmd, ['run', 'build'], { cwd: dir, timeoutMs: 6 * 60 * 1000 });
+                if (res.timedOut) {
+                    // A slow build is not a compile error: do not throw the work away over it
+                    return { ok: true, note: `The build in \`${path.relative(projectPath, dir) || '.'}\` did not finish within 6 minutes, so it was not verified locally.` };
                 }
-                catch (buildErr) {
-                    const errOut = (String(buildErr?.stdout || '') + '\n' + String(buildErr?.stderr || '')).trim();
-                    return { ok: false, errorOutput: errOut.slice(-1500) };
+                if (!res.ok) {
+                    return { ok: false, errorOutput: `${res.stdout}\n${res.stderr}`.trim().slice(-1500) };
                 }
             }
             return { ok: true };
         };
-        let buildCheck = verifyFrontendBuilds();
+        let buildCheck = await verifyFrontendBuilds();
         if (!buildCheck.ok) {
             // Revert first pass, attach compiler error context, and do 1 self-correction pass
-            for (const [fPath, orig] of originalContents.entries()) {
-                try {
-                    fs.writeFileSync(fPath, orig, 'utf8');
-                }
-                catch { }
-            }
+            revertAll();
             modifiedFiles.length = 0;
             const retryFiles = {
                 ...filesPayload,
@@ -1219,329 +2027,176 @@ export async function executeQueuedCardAutonomously(client, card, projectPath) {
                 files: retryFiles,
                 project_context: projectContext,
             });
-            const retryMods = applyEditsPass(editsRes.edits || []);
-            modifiedFiles.push(...retryMods);
-            buildCheck = verifyFrontendBuilds();
-            if (!buildCheck.ok) {
-                for (const [fPath, orig] of originalContents.entries()) {
-                    try {
-                        fs.writeFileSync(fPath, orig, 'utf8');
-                    }
-                    catch { }
+            const retryPass = await applyEditsPass(editsRes.edits || []);
+            if (retryPass.failed.length > 0) {
+                revertAll();
+                applyFailures.push(...retryPass.failed);
+            }
+            else {
+                modifiedFiles.push(...retryPass.modFiles);
+                buildCheck = await verifyFrontendBuilds();
+                if (!buildCheck.ok) {
+                    revertAll();
+                    modifiedFiles.length = 0;
                 }
-                modifiedFiles.length = 0;
             }
         }
-        if (modifiedFiles.length > 0) {
-            let rawDiff = '';
-            try {
-                const quotedFiles = modifiedFiles.map((f) => `"${f.replace(/"/g, '\\"')}"`).join(' ');
-                rawDiff = execSync(`git diff -- ${quotedFiles}`, {
-                    cwd: projectPath,
-                    encoding: 'utf8',
-                    stdio: ['ignore', 'pipe', 'ignore'],
-                }).trim();
-            }
-            catch { }
-            // Gate C: Commit, push, and run the project's defined deployment pipeline, then VERIFY it actually succeeded.
-            // If deploy_stage is 'done' or 'manual', only commit locally-verified changes and defer deployment to approval.
-            const deployStage = (card.deploy_stage || 'review').toLowerCase();
-            const deployInfo = deployStage === 'review'
-                ? await runProjectDeploymentPipeline(projectPath, card.title || 'update', card.id.slice(0, 8), false, card)
-                : { ok: true, commitHash: '', branch: '', deployedNote: '', errorDetail: '' };
+        if (modifiedFiles.length === 0) {
+            removeTaskLock(lockFile);
+            revertAll();
+            const buildNote = buildCheck && !buildCheck.ok && buildCheck.errorOutput
+                ? `\n\nThe attempted change did not compile, so it was reverted. Last build error:\n${buildCheck.errorOutput.split('\n').filter((l) => /error/i.test(l)).slice(0, 4).join('\n').slice(0, 600)}`
+                : applyFailures.length > 0
+                    ? `\n\nThe change I generated could not be applied cleanly, so nothing was modified:\n${applyFailures.slice(0, 4).map((f) => `- ${f}`).join('\n').slice(0, 700)}`
+                    : '';
+            await client.askQuestion(card.id, provider, `I inspected ${Object.keys(filesPayload)
+                .map((f) => `\`${f}\``)
+                .join(', ')} but could not make a verified change automatically.${buildNote}\n\nCould you describe exactly where in the app this should appear (page or screen name) and what you expect to see?`);
+            return false;
+        }
+        const commitFiles = Array.from(new Set([...carryOverFiles, ...modifiedFiles]));
+        let rawDiff = '';
+        try {
+            rawDiff = (await exec('git', ['--literal-pathspecs', 'diff', '--', ...modifiedFiles], { cwd: projectPath, timeoutMs: 20000 })).stdout.trim();
+        }
+        catch { }
+        const baseSummary = editsRes.summary ||
+            `Updated ${modifiedFiles.join(', ')} to complete "${card.title}".`;
+        const plainSummary = baseSummary.replace(/```[\s\S]*?```/g, '').trim() + (buildCheck.note ? `\n\n${buildCheck.note}` : '');
+        const verificationSteps = Array.isArray(editsRes.verification_steps)
+            ? editsRes.verification_steps.map((s, i) => `${i + 1}. ${s}`).join('\n')
+            : (typeof editsRes.verification_steps === 'string' && editsRes.verification_steps.trim() !== ''
+                ? editsRes.verification_steps
+                : `1. Check the live update for "${card.title}".\n2. Click **Approve & Deploy to Done** when verified.`);
+        const cardState = (stage, extra = {}) => ({
+            stage,
+            files: commitFiles,
+            summary: plainSummary,
+            verification_steps: verificationSteps,
+            diff: rawDiff.slice(0, 20000),
+            commit: null,
+            at: new Date().toISOString(),
+            attempts: 1,
+            ...extra,
+        });
+        // Gate C: commit ONLY the files changed for this card, run the project's real deployment route, and VERIFY it.
+        // With deploy_stage 'done' or 'manual' the change waits (uncommitted) for approval and deploys then.
+        const deployStage = (card.deploy_stage || 'review').toLowerCase();
+        let deployedNote = '';
+        // From here on the edits are owned by the card's saved state (deploy / approval), not by this run's revert safety net
+        editsHandedOff = true;
+        clearEditJournal(card.id);
+        if (deployStage === 'review') {
+            // Persist first: if this process dies mid-deploy, the re-queued card resumes with the deployment only
+            setCardState(projectPath, card.id, cardState('deploy_failed', { last_error: 'The deployment was interrupted before it finished.' }));
+            await client.addProgress(card.id, provider, `Change is ready. Deploying via **${methodLabel(profile.method)}** — ${profile.evidence[0] || 'best match found in the project'}.`);
+            const deployInfo = await runDeployment({
+                projectPath,
+                title: card.title || 'update',
+                cardId: card.id,
+                files: commitFiles,
+                bound: boundProfileOf(card),
+            });
+            await reportOutcome(client, card, projectPath, deployInfo);
             if (!deployInfo.ok) {
-                // Never claim success: keep card In Progress (waiting_for_input) with a plain-English diagnostic
-                try {
-                    if (fs.existsSync(lockFile))
-                        fs.unlinkSync(lockFile);
-                }
-                catch { }
-                const reason = (deployInfo.errorDetail || 'Unknown deployment error').slice(0, 700);
+                // Never claim success: keep the card with the human, and remember the change so a reply retries ONLY the deployment
+                setCardState(projectPath, card.id, cardState('deploy_failed', {
+                    commit: deployInfo.commitHash || null,
+                    last_error: deployInfo.errorDetail,
+                    pending_confirmation: deployInfo.errorKind === 'needs_confirmation' ? { method: deployInfo.method, command: deployInfo.command } : null,
+                }));
+                removeTaskLock(lockFile);
                 appendIdeActivityLog(projectPath, {
                     cardId: card.id,
                     cardTitle: card.title,
                     agentName: workerLabel,
                     model: card.agent_model || 'auto',
                     status: 'deploy_failed',
-                    summary: `Code change was made but deployment could not be verified: ${reason}`,
+                    summary: `Code change was made but deployment could not be verified: ${deployInfo.errorDetail.slice(0, 700)}`,
                     files: modifiedFiles,
                     diff: rawDiff,
                 });
-                await client.askQuestion(card.id, provider, `I made the code change (${modifiedFiles.join(', ')}), but the deployment could not be verified, so I kept this card in progress instead of moving it to Testing.\n\nWhat failed: ${reason}\n\nReply "retry" once the issue is fixed, or tell me how this project should be deployed.`);
+                const changed = modifiedFiles.map((f) => `\`${f}\``).join(', ');
+                await client.askQuestion(card.id, provider, deployInfo.errorKind === 'needs_confirmation'
+                    ? `I made the code change (${changed}). One question before I deploy this project for the first time:\n\n${describeFailureForHuman(deployInfo)}`
+                    : `I made the code change (${changed}), but the deployment could not be verified, so I kept this card in progress instead of moving it to Testing.\n\n${describeFailureForHuman(deployInfo)}`);
                 return false;
             }
-            const baseSummary = editsRes.summary ||
-                `Updated ${modifiedFiles.join(', ')} to complete "${card.title}".`;
-            const cleanPlainSummary = baseSummary.replace(/```[\s\S]*?```/g, '').trim() +
-                (deployInfo.deployedNote ? `\n\n${deployInfo.deployedNote}` : '');
-            const verificationSteps = editsRes.verification_steps ||
-                `1. Check the live update for "${card.title}".\n2. Click **Approve & Deploy to Done** when verified.`;
-            const logLines = [
-                `Claimed card "${card.title}" (${card.id}) in ${projectPath}`,
-                `Agent: ${workerLabel} | Model: ${card.agent_model || 'auto'}`,
-                `Selected files: ${Object.keys(filesPayload).join(', ')}`,
-                `Modified & verified files: ${modifiedFiles.join(', ')}`,
-                ...(deployInfo.deployedNote ? [`Deployment: ${deployInfo.deployedNote}`] : []),
-                `Summary: ${cleanPlainSummary}`,
-            ];
-            appendIdeActivityLog(projectPath, {
-                cardId: card.id,
-                cardTitle: card.title,
-                agentName: workerLabel,
-                model: card.agent_model || 'auto',
-                status: 'review',
-                summary: cleanPlainSummary,
-                files: modifiedFiles,
-                diff: rawDiff,
-            });
-            await client.submitReview(card.id, provider, cleanPlainSummary, verificationSteps, undefined, undefined, {
-                diffText: rawDiff,
-                logText: logLines.join('\n'),
-                filesModified: modifiedFiles.join(', '),
-            });
-            try {
-                fs.writeFileSync(lockFile, JSON.stringify({
-                    card_id: card.id,
-                    card_updated_at: cardUpdatedAt,
-                    status: 'completed',
-                    completed_at: new Date().toISOString(),
-                }), 'utf8');
+            if (deployInfo.pending && deployInfo.pendingVerification) {
+                addPendingVerification(projectPath, { ...deployInfo.pendingVerification, provider });
             }
-            catch { }
-            sendDesktopNotification(`Agile Monster -> Ready for Review`, `Completed "${card.title}" (${modifiedFiles.length} file(s) updated) and moved to Testing / Review!`);
-            return true;
+            setCardState(projectPath, card.id, null);
+            deployedNote = deployInfo.deployedNote;
         }
         else {
-            try {
-                if (fs.existsSync(lockFile))
-                    fs.unlinkSync(lockFile);
-            }
-            catch { }
-            const buildNote = buildCheck && !buildCheck.ok && buildCheck.errorOutput
-                ? `\n\nThe attempted change did not compile, so it was reverted. Last build error:\n${buildCheck.errorOutput.split('\n').filter((l) => /error/i.test(l)).slice(0, 4).join('\n').slice(0, 600)}`
-                : '';
-            await client.askQuestion(card.id, provider, `I inspected ${Object.keys(filesPayload)
-                .map((f) => `\`${f}\``)
-                .join(', ')} but could not make a verified change automatically.${buildNote}\n\nCould you describe exactly where in the app this should appear (page or screen name) and what you expect to see?`);
-            return false;
+            setCardState(projectPath, card.id, cardState('awaiting_approval'));
+            deployedNote =
+                deployStage === 'manual'
+                    ? '📦 **Changes saved locally** (not committed). This project is set to manual deployment.'
+                    : `📦 **Changes saved locally** (not committed yet). They will be committed and deployed via ${methodLabel(profile.method)} when you approve this card.`;
         }
+        const cleanPlainSummary = `${plainSummary}\n\n${deployedNote}`.trim();
+        const logLines = [
+            `Claimed card "${card.title}" (${card.id}) in ${projectPath}`,
+            `Agent: ${workerLabel} | Model: ${card.agent_model || 'auto'}`,
+            `Selected files: ${Object.keys(filesPayload).join(', ')}`,
+            `Modified & verified files: ${modifiedFiles.join(', ')}`,
+            `Deployment route: ${profile.method} (${profile.confidence} confidence, ${profile.source})`,
+            `Deployment: ${deployedNote}`,
+            `Summary: ${cleanPlainSummary}`,
+        ];
+        appendIdeActivityLog(projectPath, {
+            cardId: card.id,
+            cardTitle: card.title,
+            agentName: workerLabel,
+            model: card.agent_model || 'auto',
+            status: 'review',
+            summary: cleanPlainSummary,
+            files: modifiedFiles,
+            diff: rawDiff,
+        });
+        await client.submitReview(card.id, provider, cleanPlainSummary, verificationSteps, undefined, undefined, {
+            diffText: rawDiff,
+            logText: logLines.join('\n'),
+            filesModified: modifiedFiles.join(', '),
+        });
+        writeTaskLock(lockFile, card, 'completed');
+        sendDesktopNotification(`Agile Monster -> Ready for Review`, `Completed "${card.title}" (${modifiedFiles.length} file(s) updated) and moved to Testing / Review!`);
+        log.info('card.review', { card: card.id, files: modifiedFiles.length, deploy: profile.method });
+        return true;
     }
     catch (err) {
-        try {
-            if (fs.existsSync(lockFile))
-                fs.unlinkSync(lockFile);
+        removeTaskLock(lockFile);
+        // An interrupted run must not leave half-applied, uncommitted edits in the developer's working tree
+        const rolledBack = !editsHandedOff && originalContents.size > 0;
+        if (rolledBack) {
+            for (const [fPath, orig] of originalContents.entries()) {
+                try {
+                    fs.writeFileSync(fPath, orig, 'utf8');
+                }
+                catch { }
+            }
         }
-        catch { }
+        if (!editsHandedOff)
+            clearEditJournal(card.id);
+        log.error('card.failed', { card: card.id, project: projectPath, error: errorMessage(err), reverted: rolledBack });
         try {
-            await client.addProgress(card.id, provider, `Autonomous runner note: ${err?.message || String(err)}`);
+            await client.addProgress(card.id, provider, `Autonomous runner note: ${err?.message || String(err)}${rolledBack ? ' (partial edits were rolled back)' : ''}`);
         }
         catch { }
         return false;
     }
     finally {
         activeAutonomousCards.delete(card.id);
+        activeWork--;
     }
 }
 /**
- * Detect and execute the project's defined deployment pipeline, then VERIFY the result:
- * 1. Commits modified tracked files and pushes to `origin/<branch>`.
- * 2. Runs the configured/auto-detected deploy method:
- *    - `deploy_script` (e.g. `./deploy/deploy.sh --skip-preflight`): requires exit code 0.
- *    - `github_actions`: polls `gh run list --commit <sha>` until the workflow concludes; a failed run = not deployed.
- *    - `docker_compose`: runs the deploy command and checks `docker compose ps` for running containers.
- * 3. If a `live_url` is known, performs an HTTP smoke check (must return < 400).
- * Returns ok=false with a plain-English `errorDetail` whenever deployment cannot be proven.
- */
-async function runProjectDeploymentPipeline(projectPath, rawTitle, shortId, forceEmptyCommit = false, profile) {
-    const cleanTitle = (rawTitle || 'update').replace(/["`$\\\r\n]+/g, ' ').trim();
-    let branch = 'main';
-    let commitHash = '';
-    let fullSha = '';
-    const actions = [];
-    const run = (cmd, timeout = 45000) => execSync(cmd, { cwd: projectPath, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout }).trim();
-    const errText = (e) => (String(e?.stderr || '') + '\n' + String(e?.stdout || '') + '\n' + String(e?.message || ''))
-        .split('\n')
-        .map((l) => l.trim())
-        .filter((l) => l.length > 0)
-        .slice(-6)
-        .join(' | ')
-        .slice(0, 700);
-    const detected = AgileMonsterClient.inspectProjectProfile(projectPath, path.basename(projectPath));
-    const deployMethod = (profile?.deploy_method || detected.deploy_method || 'git_push').toLowerCase();
-    const deployCommand = profile?.deploy_command || detected.deploy_command || '';
-    const liveUrl = profile?.live_url || detected.live_url || '';
-    // Step 1: commit & push
-    try {
-        branch = run('git rev-parse --abbrev-ref HEAD') || 'main';
-        const statusOut = run('git status --porcelain -uno');
-        if (statusOut.length > 0) {
-            run('git add -u');
-            run(`git commit -m "feat: ${cleanTitle} [AM-${shortId}]"`);
-        }
-        else if (forceEmptyCommit) {
-            run(`git commit --allow-empty -m "chore: trigger redeploy [AM-${shortId}]"`);
-        }
-        fullSha = run('git rev-parse HEAD');
-        commitHash = fullSha.slice(0, 7);
-        if (fs.existsSync(path.join(projectPath, '.git')) && run('git remote').length > 0) {
-            try {
-                run(`git push origin ${branch}`, 60000);
-                actions.push(`pushed \`${commitHash}\` to \`origin/${branch}\``);
-            }
-            catch (pushErr) {
-                return {
-                    ok: false,
-                    commitHash,
-                    branch,
-                    deployedNote: '',
-                    errorDetail: `git push to origin/${branch} failed (check credentials or branch protection): ${errText(pushErr)}`,
-                };
-            }
-        }
-    }
-    catch (gitErr) {
-        return { ok: false, commitHash, branch, deployedNote: '', errorDetail: `Git commit failed: ${errText(gitErr)}` };
-    }
-    // Step 2: run & verify the deploy method
-    try {
-        if (deployMethod === 'deploy_script') {
-            const cmd = deployCommand && !deployCommand.includes('(')
-                ? deployCommand
-                : './deploy/deploy.sh';
-            const scriptPath = cmd.split(' ')[0];
-            const args = cmd.split(' ').slice(1).join(' ');
-            try {
-                run(`bash "${path.resolve(projectPath, scriptPath)}" ${args}`, 300000);
-            }
-            catch (dErr) {
-                return {
-                    ok: false,
-                    commitHash,
-                    branch,
-                    deployedNote: '',
-                    errorDetail: `Deploy script \`${cmd}\` exited with an error: ${errText(dErr)}`,
-                };
-            }
-            actions.push(`deployed via \`${cmd}\` (exit 0)`);
-        }
-        else if (deployMethod === 'github_actions') {
-            let hasGh = false;
-            try {
-                run('gh --version', 5000);
-                hasGh = true;
-            }
-            catch { }
-            if (!hasGh) {
-                actions.push('triggered GitHub Actions (could not verify: `gh` CLI not installed)');
-            }
-            else {
-                const deadline = Date.now() + 8 * 60 * 1000;
-                let verdict = 'none';
-                let failedName = '';
-                let runUrl = '';
-                // Give GitHub a moment to register the workflow run
-                await new Promise((r) => setTimeout(r, 8000));
-                while (Date.now() < deadline) {
-                    let runs = [];
-                    try {
-                        runs = JSON.parse(run(`gh run list --commit ${fullSha} --json status,conclusion,name,url --limit 10`, 20000) || '[]');
-                    }
-                    catch { }
-                    if (runs.length === 0) {
-                        verdict = 'none';
-                    }
-                    else if (runs.some((r) => r.status !== 'completed')) {
-                        verdict = 'pending';
-                    }
-                    else {
-                        const failed = runs.find((r) => r.conclusion !== 'success' && r.conclusion !== 'skipped');
-                        verdict = failed ? 'failure' : 'success';
-                        failedName = failed?.name || '';
-                        runUrl = (failed || runs[0])?.url || '';
-                        break;
-                    }
-                    if (verdict === 'none' && Date.now() > deadline - 7 * 60 * 1000)
-                        break; // no workflow for this commit after ~1 min
-                    await new Promise((r) => setTimeout(r, 15000));
-                }
-                if (verdict === 'failure') {
-                    return {
-                        ok: false,
-                        commitHash,
-                        branch,
-                        deployedNote: '',
-                        errorDetail: `GitHub Actions workflow "${failedName}" failed for commit ${commitHash}. ${runUrl}`.trim(),
-                    };
-                }
-                if (verdict === 'pending') {
-                    return {
-                        ok: false,
-                        commitHash,
-                        branch,
-                        deployedNote: '',
-                        errorDetail: `GitHub Actions for commit ${commitHash} was still running after 8 minutes. ${runUrl}`.trim(),
-                    };
-                }
-                actions.push(verdict === 'success'
-                    ? `GitHub Actions passed for \`${commitHash}\``
-                    : 'pushed (no GitHub Actions workflow ran for this commit)');
-            }
-        }
-        else if (deployMethod === 'docker_compose') {
-            const cmd = deployCommand || 'docker compose up -d --build';
-            try {
-                run(cmd, 600000);
-                const ps = run('docker compose ps --format json', 20000);
-                if (/"State"\s*:\s*"(exited|dead|restarting)"/i.test(ps)) {
-                    return { ok: false, commitHash, branch, deployedNote: '', errorDetail: 'A Docker container is not running after deploy (exited/restarting).' };
-                }
-            }
-            catch (dErr) {
-                return { ok: false, commitHash, branch, deployedNote: '', errorDetail: `Docker deploy failed: ${errText(dErr)}` };
-            }
-            actions.push('Docker containers rebuilt and running');
-        }
-    }
-    catch (anyErr) {
-        return { ok: false, commitHash, branch, deployedNote: '', errorDetail: errText(anyErr) };
-    }
-    // Step 3: live URL smoke check
-    if (liveUrl && /^https?:\/\//i.test(liveUrl)) {
-        let status = 0;
-        for (let attempt = 0; attempt < 3 && (status === 0 || status >= 400); attempt++) {
-            try {
-                const ctrl = new AbortController();
-                const t = setTimeout(() => ctrl.abort(), 15000);
-                const res = await fetch(liveUrl, { method: 'GET', redirect: 'follow', signal: ctrl.signal });
-                clearTimeout(t);
-                status = res.status;
-            }
-            catch {
-                status = 0;
-            }
-            if (status === 0 || status >= 400)
-                await new Promise((r) => setTimeout(r, 5000));
-        }
-        if (status === 0 || status >= 400) {
-            return {
-                ok: false,
-                commitHash,
-                branch,
-                deployedNote: '',
-                errorDetail: `Deployment finished, but ${liveUrl} returned ${status === 0 ? 'no response' : `HTTP ${status}`}.`,
-            };
-        }
-        actions.push(`verified live at ${liveUrl} (HTTP ${status})`);
-    }
-    const deployedNote = actions.length > 0
-        ? `🚀 **Deployed**: ${actions.join(', ')}.`
-        : `🚀 **Deployed**: commit \`${commitHash}\` on \`${branch}\`.`;
-    return { ok: true, commitHash, branch, deployedNote, errorDetail: '' };
-}
-/**
- * Deploy a card the human approved into Done (or flagged as `deploying`).
- * Idempotent: keyed on card ID only (never on `updated_at`, which changes whenever we post a comment),
- * so a card is deployed at most once unless the human explicitly re-triggers it into `deploying`.
+ * Finish a card the human approved into Done (or flagged as `deploying`).
+ * Idempotent: keyed on card ID only (never on `updated_at`, which changes whenever we post a comment).
+ *
+ * Approving a card that was already deployed and verified at review time only CONFIRMS it — it no longer
+ * triggers a second deployment (or an empty "redeploy" commit) for every approval.
  */
 export async function deployApprovedCardIfNeeded(client, card, projectPath) {
     if (!projectPath || !fs.existsSync(projectPath))
@@ -1557,71 +2212,233 @@ export async function deployApprovedCardIfNeeded(client, card, projectPath) {
             existing = { status: 'deployed' }; // unreadable lock: fail safe (never loop)
         }
     }
-    const explicitRedeploy = card.agent_status === 'deploying';
+    const awaitingDeploy = card.agent_status === 'deploying';
+    const priorAttempts = Number(existing?.attempts || 0);
     if (existing) {
-        // Already handled and the human has not explicitly asked for a re-deploy
-        if (!explicitRedeploy)
+        // Already handled and nobody is waiting on a deployment
+        if (!awaitingDeploy)
             return false;
-        // Re-deploy request already being processed / processed for this exact request
-        if (existing.redeploy_of === card.updated_at || existing.status === 'running') {
-            const age = Date.now() - (Date.parse(existing.started_at || '') || 0);
-            if (existing.status !== 'running' || age < 15 * 60 * 1000)
-                return false;
+        const age = Date.now() - (Date.parse(existing.started_at || '') || 0);
+        if (existing.status === 'waiting_ci') {
+            // re-check the pipeline on this pulse
+        }
+        else if (existing.status === 'running') {
+            if (age < 30 * 60 * 1000)
+                return false; // another run is (or was very recently) on it
+        }
+        else if (existing.status === 'failed') {
+            // The card is STILL waiting. Either the human approved again (card changed -> retry now), or we never
+            // managed to tell them (the API call failed): retry with a growing pause instead of going silent forever.
+            if (existing.redeploy_of === card.updated_at) {
+                if (priorAttempts >= 6)
+                    return false;
+                if (age < Math.min(60, 2 ** priorAttempts) * 60 * 1000)
+                    return false;
+            }
         }
+        else if (age < 60 * 1000) {
+            return false; // just finished; give the board a moment to reflect it
+        }
+        // status 'deployed' while the card still says "deploying": completing it failed last time, or the human
+        // asked again. Falling through confirms it (no second deployment when it already shipped).
     }
-    // Cards that were already deployed during the Review stage only need the Done confirmation, not another deploy
     const deployStage = (card.deploy_stage || 'review').toLowerCase();
     const provider = card.agent_provider || 'cursor';
-    const rawText = `${card.title || ''} ${card.description || ''}`;
-    const isContainerRestartCard = /\b(restart|redeploy|rebuild)\b.*\b(container|docker|server|prod)/i.test(rawText);
+    // Only a card that literally asks for a redeploy gets one; ordinary cards never trigger a second deployment
+    const isContainerRestartCard = isRedeployOnlyCard(card);
     const writeLock = (status, extra = {}) => {
         try {
             fs.writeFileSync(deployLock, JSON.stringify({
                 card_id: card.id,
                 status,
                 title: card.title,
-                redeploy_of: explicitRedeploy ? card.updated_at : null,
+                redeploy_of: awaitingDeploy ? card.updated_at : null,
                 started_at: new Date().toISOString(),
+                attempts: status === 'failed' ? priorAttempts + 1 : priorAttempts,
                 ...extra,
             }), 'utf8');
         }
         catch { }
     };
+    const confirmDone = async (msg, commit) => {
+        await withRetry('completeTask', () => client.completeTask(card.id, provider, msg));
+        writeLock('deployed', { commit: commit || null, completed_at: new Date().toISOString() });
+        setCardState(projectPath, card.id, null);
+        appendIdeActivityLog(projectPath, {
+            cardId: card.id,
+            cardTitle: card.title,
+            agentName: card.agent_display_name || provider,
+            model: card.agent_model || 'auto',
+            status: 'done',
+            summary: msg,
+        });
+    };
+    activeWork++;
     writeLock('running');
     try {
         if (deployStage === 'manual') {
+            // A human ships this project: nothing is waiting on us any more
+            setCardState(projectPath, card.id, null);
             writeLock('deployed', { note: 'manual deploy stage' });
             return false;
         }
-        if (deployStage === 'review' && !explicitRedeploy && !isContainerRestartCard) {
-            // Already deployed + verified before moving to Testing — nothing more to run.
-            writeLock('deployed', { note: 'deployed at review stage' });
+        const memory = loadMemory(projectPath);
+        const state = memory.cards[card.id] || null;
+        const stillPending = memory.pending.find((p) => p.card_id === card.id) || null;
+        const earlierSuccess = memory.deployed_cards[card.id] || null;
+        // The deployment started at review time is still running in CI: wait for its verdict rather than deploying again
+        if (stillPending && !isContainerRestartCard) {
+            const profile = resolveDeployProfile(projectPath, { bound: boundProfileOf(card), memory });
+            const check = await checkCiOnce(projectPath, stillPending.sha, stillPending.workflow_names, profile.workflows.some((w) => w.isDeploy && w.workflowRun));
+            if (check.verdict === 'success') {
+                removePendingVerification(projectPath, card.id);
+                recordAttempt(projectPath, { card_id: card.id, method: 'github_actions', ok: true, commit: stillPending.sha.slice(0, 7) });
+                if (awaitingDeploy) {
+                    await confirmDone(`🚀 **Deployed**: GitHub Actions deployment passed for \`${stillPending.sha.slice(0, 7)}\`. Confirmed and moved card to **Done**.`, stillPending.sha.slice(0, 7));
+                    return true;
+                }
+                writeLock('deployed', { note: 'verified after review' });
+                return false;
+            }
+            if (check.verdict === 'failure') {
+                removePendingVerification(projectPath, card.id);
+                writeLock('failed', { error: check.reason });
+                await withRetry('blockTask', () => client.blockTask(card.id, provider, `⚠️ The deployment for this card failed in GitHub Actions, so it was NOT marked as deployed.\n\nWhat failed: ${check.reason || 'the deployment workflow failed'} ${check.url || ''}${check.logTail ? `\nFailing step output: ${check.logTail}` : ''}\n\nFix the issue, then approve the card again to retry.`));
+                return false;
+            }
+            writeLock('waiting_ci', { sha: stillPending.sha });
             return false;
         }
-        const res = await runProjectDeploymentPipeline(projectPath, card.title || 'update', shortId, isContainerRestartCard, card);
+        if (!state) {
+            if (earlierSuccess) {
+                // This machine already shipped the card before it reached Testing — approval just confirms it.
+                if (awaitingDeploy) {
+                    await confirmDone(earlierSuccess.verified
+                        ? `🚀 **Deployed**: already live and verified at review time (commit \`${earlierSuccess.commit || 'n/a'}\`). Confirmed and moved card to **Done**.`
+                        : `📤 This change was already pushed at review time (commit \`${earlierSuccess.commit || 'n/a'}\`); its deployment could not be verified automatically. Moved card to **Done**.`, earlierSuccess.commit || undefined);
+                    return true;
+                }
+                writeLock('deployed', { note: 'deployed at review stage' });
+                return false;
+            }
+            if (!awaitingDeploy) {
+                // Already Done and nobody is waiting on a deployment: nothing to do.
+                writeLock('deployed', { note: 'no deployment requested' });
+                return false;
+            }
+            // Approved, but this machine has no record of deploying it (e.g. an IDE agent did the work):
+            // fall through and ship what is committed. Nothing new is committed on the card's behalf.
+        }
+        const res = await runDeployment({
+            projectPath,
+            title: card.title || 'update',
+            cardId: card.id,
+            files: state?.files,
+            redeploy: isContainerRestartCard,
+            bound: boundProfileOf(card),
+        });
+        await reportOutcome(client, card, projectPath, res);
         if (!res.ok) {
             writeLock('failed', { error: res.errorDetail });
-            await client.blockTask(card.id, provider, `⚠️ Deployment could not be verified, so this card was NOT marked as deployed.\n\nWhat failed: ${res.errorDetail}\n\nFix the issue and move the card back to Done (or set it to Deploying) to retry.`);
+            // Keep what is needed so a reply ("retry" / "deploy: …") redoes only the deployment
+            setCardState(projectPath, card.id, {
+                stage: 'deploy_failed',
+                files: state?.files || [],
+                summary: state?.summary || `Deployment of "${card.title}".`,
+                verification_steps: state?.verification_steps || `1. Check the live update for "${card.title}".`,
+                diff: state?.diff || '',
+                commit: res.commitHash || null,
+                at: new Date().toISOString(),
+                attempts: (state?.attempts || 0) + 1,
+                last_error: res.errorDetail,
+                pending_confirmation: res.errorKind === 'needs_confirmation' ? { method: res.method, command: res.command } : null,
+            });
+            await withRetry('blockTask', () => client.blockTask(card.id, provider, res.errorKind === 'needs_confirmation'
+                ? `⚠️ This card is approved, but I need one answer before deploying this project for the first time.\n\n${describeFailureForHuman(res)}`
+                : `⚠️ Deployment could not be verified, so this card was NOT marked as deployed.\n\n${describeFailureForHuman(res)}`));
             return false;
         }
-        const msg = `${res.deployedNote} Confirmed and moved card to **Done**.`;
-        await client.completeTask(card.id, provider, msg);
-        writeLock('deployed', { commit: res.commitHash, completed_at: new Date().toISOString() });
-        appendIdeActivityLog(projectPath, {
-            cardId: card.id,
-            cardTitle: card.title,
-            agentName: card.agent_display_name || provider,
-            model: card.agent_model || 'auto',
-            status: 'done',
-            summary: msg,
-        });
+        if (res.pending && res.pendingVerification) {
+            addPendingVerification(projectPath, { ...res.pendingVerification, provider });
+            setCardState(projectPath, card.id, null);
+            writeLock('waiting_ci', { sha: res.fullSha });
+            await client.addProgress(card.id, provider, `${res.deployedNote} The card will move to **Done** once the pipeline passes.`);
+            return false;
+        }
+        let uncommittedNote = '';
+        if (!state?.files?.length) {
+            const dirty = (await exec('git', ['status', '--porcelain', '--untracked-files=no'], { cwd: projectPath, timeoutMs: 15000 })).stdout
+                .split('\n')
+                .filter((l) => l.trim()).length;
+            if (dirty > 0) {
+                uncommittedNote = ` Note: ${dirty} modified file(s) in the working tree are not committed, so they are NOT part of this deployment.`;
+            }
+        }
+        await confirmDone(`${res.deployedNote}${uncommittedNote} Confirmed and moved card to **Done**.`, res.commitHash);
         sendDesktopNotification(`Agile Monster -> Production Confirmed`, `Deployed "${card.title}" (${res.commitHash})`);
         return true;
     }
     catch (err) {
+        log.error('deploy.approved_failed', { card: card.id, project: projectPath, error: errorMessage(err) });
         writeLock('failed', { error: String(err?.message || err).slice(0, 500) });
         return false;
     }
+    finally {
+        activeWork--;
+    }
+}
+/**
+ * Deferred verification: deployments whose CI pipeline outlived our inline wait are re-checked on later
+ * pulses, and the card is told the real outcome (instead of the old "still running after 8 minutes" failure).
+ */
+async function processPendingVerifications(client, projectPaths) {
+    for (const projectPath of projectPaths) {
+        if (!projectPath || !fs.existsSync(projectPath))
+            continue;
+        const memory = loadMemory(projectPath);
+        if (memory.pending.length === 0)
+            continue;
+        const profile = resolveDeployProfile(projectPath, { memory });
+        const chained = profile.workflows.some((w) => w.isDeploy && w.workflowRun);
+        for (const p of memory.pending) {
+            try {
+                const ageMs = Date.now() - (Date.parse(p.started_at) || 0);
+                const check = await checkCiOnce(projectPath, p.sha, p.workflow_names, chained);
+                const short = p.sha.slice(0, 7);
+                if (check.verdict === 'success') {
+                    removePendingVerification(projectPath, p.card_id);
+                    recordAttempt(projectPath, { card_id: p.card_id, method: 'github_actions', ok: true, commit: short });
+                    await client.addProgress(p.card_id, p.provider, `🚀 **Deployed**: GitHub Actions deployment passed for \`${short}\`${check.url ? ` (${check.url})` : ''}. The change is live.`);
+                    await client.reportDeployment({ card_id: p.card_id, project_path: projectPath, method: 'github_actions', ok: true, commit: short, source: 'verified' });
+                }
+                else if (check.verdict === 'failure') {
+                    removePendingVerification(projectPath, p.card_id);
+                    const detail = `GitHub Actions: ${check.reason || 'the deployment workflow failed'} for commit ${short}. ${check.url || ''}${check.logTail ? `\nFailing step output: ${check.logTail}` : ''}`;
+                    recordAttempt(projectPath, { card_id: p.card_id, method: 'github_actions', ok: false, kind: 'ci_failed', error: detail, commit: short });
+                    setCardState(projectPath, p.card_id, {
+                        stage: 'deploy_failed',
+                        files: [],
+                        summary: `Deployment of "${p.card_title}" (commit ${short}).`,
+                        verification_steps: `1. Check the live update for "${p.card_title}".`,
+                        diff: '',
+                        commit: short,
+                        at: new Date().toISOString(),
+                        attempts: 1,
+                        last_error: detail,
+                    });
+                    await client.askQuestion(p.card_id, p.provider, `The deployment I started for this card did not succeed, so the change is NOT live yet.\n\nWhat failed: ${detail}\n\nFix the failing step and reply **retry**, or tell me the right route with \`deploy: <method or command>\`.`);
+                    await client.reportDeployment({ card_id: p.card_id, project_path: projectPath, method: 'github_actions', ok: false, error: detail.slice(0, 480), error_kind: 'ci_failed', commit: short });
+                }
+                else if (ageMs > 90 * 60 * 1000) {
+                    removePendingVerification(projectPath, p.card_id);
+                    await client.addProgress(p.card_id, p.provider, `I could not confirm the GitHub Actions deployment for \`${short}\` within 90 minutes${p.run_url ? ` (${p.run_url})` : ''}. Please check the pipeline before approving.`);
+                }
+            }
+            catch (err) {
+                log.warn('deploy.pending_check_failed', { card: p.card_id, project: projectPath, error: errorMessage(err) });
+            }
+        }
+    }
 }
 /**
  * Machine-wide single-worker election. Only ONE process per machine may claim, edit, or deploy cards.
@@ -1639,7 +2456,7 @@ function isPidAlive(pid) {
     }
 }
 export function acquireWorkerLock(role) {
-    const lockPath = path.join(os.homedir(), '.agilemonster', 'worker.lock.json');
+    const lockPath = path.join(agileMonsterHome(), 'worker.lock.json');
     try {
         fs.mkdirSync(path.dirname(lockPath), { recursive: true });
         let holder = null;
@@ -1672,11 +2489,17 @@ export function startBuiltInPullPulse(server, client, intervalMs = 20000, role =
     const notifiedCardIds = new Set();
     let updateTriggered = false;
     let pulseCount = 0;
+    let pulseRunning = false;
+    let holdsWorkerLock = false;
+    let journalsRecovered = false;
+    let consecutiveFailures = 0;
     const autoProvisionSavedBindings = (apiKey, bindings) => {
         for (const b of bindings) {
             const projPath = (b.project_path || '').trim();
             if (!projPath || !fs.existsSync(projPath))
                 continue;
+            // These files carry the personal API key: make sure no `git add -A` (ours or anyone's) can ever commit them
+            ensureLocalGitExcludes(projPath);
             const amConfigPath = path.join(projPath, '.agilemonster.json');
             let needsWrite = true;
             if (fs.existsSync(amConfigPath)) {
@@ -1724,11 +2547,21 @@ export function startBuiltInPullPulse(server, client, intervalMs = 20000, role =
                     if (!fs.existsSync(claudeMcp))
                         fs.writeFileSync(claudeMcp, mcpPayload, 'utf8');
                 }
-                catch { }
+                catch (err) {
+                    log.warn('binding.provision_failed', { project: projPath, error: errorMessage(err) });
+                }
             }
         }
     };
     const runPulse = async () => {
+        // A pulse can run for minutes while it builds and deploys. Never start a second one on top of it —
+        // just keep the worker lock fresh so no other process mistakes this one for dead and re-runs the same card.
+        if (pulseRunning) {
+            if (holdsWorkerLock)
+                acquireWorkerLock(role);
+            return;
+        }
+        pulseRunning = true;
         try {
             const config = client.loadProjectConfig();
             const apiKey = client.getApiKey();
@@ -1745,6 +2578,10 @@ export function startBuiltInPullPulse(server, client, intervalMs = 20000, role =
                 discoveredProjects: includeDiscovery ? client.discoverLocalProjects() : undefined,
                 discoveredModels: includeDiscovery ? client.discoverLocalAgentModels() : undefined,
             });
+            if (consecutiveFailures > 0) {
+                log.info('pulse.recovered', { after_failures: consecutiveFailures });
+                consecutiveFailures = 0;
+            }
             if (res.saved_bindings && res.saved_bindings.length > 0) {
                 autoProvisionSavedBindings(apiKey, res.saved_bindings);
             }
@@ -1765,8 +2602,13 @@ export function startBuiltInPullPulse(server, client, intervalMs = 20000, role =
                 }
             }
             // Zero-touch autonomous execution & deployment — ONLY the elected machine-wide worker may do this
-            const isWorker = acquireWorkerLock(role);
-            if (isWorker) {
+            holdsWorkerLock = acquireWorkerLock(role);
+            if (holdsWorkerLock && !journalsRecovered) {
+                journalsRecovered = true;
+                recoverEditJournals();
+                pruneStaleLocks();
+            }
+            if (holdsWorkerLock) {
                 const boundQueued = res.all_bound_queued_cards || [];
                 for (const qCard of boundQueued) {
                     const targetPath = (qCard.bound_project_path || '').trim() ||
@@ -1774,6 +2616,9 @@ export function startBuiltInPullPulse(server, client, intervalMs = 20000, role =
                     if (targetPath && fs.existsSync(targetPath)) {
                         await executeQueuedCardAutonomously(client, qCard, targetPath);
                     }
+                    else if (targetPath) {
+                        log.warn('card.project_missing', { card: qCard.id, project: targetPath });
+                    }
                 }
                 const boundDone = res.all_bound_done_cards || [];
                 for (const dCard of boundDone) {
@@ -1783,6 +2628,12 @@ export function startBuiltInPullPulse(server, client, intervalMs = 20000, role =
                         await deployApprovedCardIfNeeded(client, dCard, targetPath);
                     }
                 }
+                const knownPaths = new Set([config.project_path || process.cwd()]);
+                for (const b of res.saved_bindings || []) {
+                    if (b.project_path)
+                        knownPaths.add(b.project_path.trim());
+                }
+                await processPendingVerifications(client, Array.from(knownPaths));
             }
             if ((res.version?.force_update_requested || res.version?.update_available) &&
                 !updateTriggered &&
@@ -1791,8 +2642,16 @@ export function startBuiltInPullPulse(server, client, intervalMs = 20000, role =
                 triggerBackgroundSelfUpdate(res.version?.latest_version);
             }
         }
-        catch {
-            // Silent during background pulse
+        catch (err) {
+            // Background pulses must never crash the host, but a silent failure is undiagnosable: log the first
+            // one and then periodically while the outage lasts.
+            consecutiveFailures++;
+            if (consecutiveFailures === 1 || consecutiveFailures % 15 === 0) {
+                log.error('pulse.failed', { error: errorMessage(err), consecutive: consecutiveFailures });
+            }
+        }
+        finally {
+            pulseRunning = false;
         }
     };
     setTimeout(runPulse, 2500).unref();
@@ -1801,6 +2660,9 @@ export function startBuiltInPullPulse(server, client, intervalMs = 20000, role =
     return timer;
 }
 export async function runStdioServer() {
+    configureLogger({ echo: false }); // stdout is the MCP protocol channel
+    addWellKnownToolDirs();
+    void ensureUserPath(); // asks the login shell in the background; never delays the MCP handshake
     const client = new AgileMonsterClient();
     const server = createServer(client);
     const transport = new StdioServerTransport();
@@ -1808,21 +2670,39 @@ export async function runStdioServer() {
     startBuiltInPullPulse(server, client, 20000, 'stdio');
 }
 export async function runBackgroundPulseDaemon(intervalMs = 20000) {
+    configureLogger({ echo: false });
+    const addedPaths = await ensureUserPath();
     const client = new AgileMonsterClient();
     console.log(`[Agile Monster Pulse Daemon v${MCP_SERVER_VERSION}] Listening for queued agent tasks across all bound repositories (interval: ${intervalMs / 1000}s)...`);
+    log.info('daemon.start', {
+        version: MCP_SERVER_VERSION,
+        cwd: process.cwd(),
+        path_added: addedPaths,
+        tools: { docker: which('docker'), gh: which('gh'), git: which('git') },
+    });
+    process.on('unhandledRejection', (reason) => log.error('daemon.unhandled_rejection', { error: errorMessage(reason) }));
+    process.on('uncaughtException', (err) => {
+        // State is undefined after an uncaught exception: record it and let launchd/systemd start a clean process.
+        log.error('daemon.uncaught_exception', { error: errorMessage(err), stack: err instanceof Error ? err.stack : undefined });
+        process.exit(1);
+    });
     startBuiltInPullPulse(null, client, intervalMs, 'daemon');
-    const selfScript = process.argv[1] || '';
-    const initialMtime = selfScript && fs.existsSync(selfScript) ? fs.statSync(selfScript).mtimeMs : 0;
-    // Auto-restart daemon if mcp-server binary/dist on disk is updated (launchd KeepAlive respawns it cleanly)
+    // Watch dist/server.js for updates so launchd reloads new code after a rebuild — but only between jobs,
+    // never in the middle of an edit or a deployment.
+    const distFile = fileURLToPath(import.meta.url);
+    const initialMtime = fs.existsSync(distFile) ? fs.statSync(distFile).mtimeMs : 0;
+    let reloadPending = false;
     setInterval(() => {
         try {
-            if (selfScript && initialMtime > 0 && fs.existsSync(selfScript)) {
-                const curMtime = fs.statSync(selfScript).mtimeMs;
-                if (curMtime > initialMtime + 1000) {
-                    process.exit(0);
+            if (!reloadPending && initialMtime > 0 && fs.existsSync(distFile)) {
+                const curMtime = fs.statSync(distFile).mtimeMs;
+                if (curMtime > initialMtime + 500) {
+                    reloadPending = true;
+                    console.log(`[Agile Monster Pulse Daemon] dist/server.js updated on disk. Reloading new code once idle...`);
+                    exitWhenIdle('dist-updated');
                 }
             }
         }
         catch { }
-    }, 30000);
+    }, 10000);
 }