@desplega.ai/agent-swarm 1.110.0 → 1.112.0

package/dist/{cli-8s0swp2t.js → cli-30d2ct3k.js}

@@ -1,16 +1,16 @@
 import {
   recordUnmappedIdentity
-} from "./cli-dhph6q98.js";
+} from "./cli-9p0qhead.js";
 import {
   findOrCreateUserByEmail,
   findUserByExternalId,
   linkIdentity
-} from "./cli-gb7dqnna.js";
+} from "./cli-7xkwgkrs.js";
 import {
   getKv,
   init_db,
   upsertKv
-} from "./cli-d8vmtyyr.js";
+} from "./cli-951w7c79.js";
 
 // src/slack/enrich.ts
 init_db();

package/dist/{cli-2h86bsfe.js → cli-3r5y6ayj.js}

@@ -1,6 +1,6 @@
 import {
   embedScript
-} from "./cli-dy01kwxk.js";
+} from "./cli-s9pj3c7z.js";
 import {
   computeContentHash,
   decryptSecret,
@@ -10,7 +10,7 @@ import {
   getSwarmConfigs,
   init_crypto,
   init_db
-} from "./cli-d8vmtyyr.js";
+} from "./cli-951w7c79.js";
 import {
   init_zod
 } from "./cli-q21d49ac.js";

package/dist/{cli-6ttdv68b.js → cli-52tbq17n.js}

@@ -3,7 +3,7 @@ import {
   init_date_utils,
   init_db,
   normalizeDateRequired
-} from "./cli-d8vmtyyr.js";
+} from "./cli-951w7c79.js";
 
 // src/be/db-queries/oauth.ts
 init_date_utils();

package/dist/{cli-k6ssh5dk.js → cli-56s4ehzw.js}

@@ -17,7 +17,7 @@ import {
   init_templates1 as init_templates,
   normalizeDateRequired,
   resolveTemplate
-} from "./cli-d8vmtyyr.js";
+} from "./cli-951w7c79.js";
 
 // src/be/db-queries/tracker.ts
 init_date_utils();

package/dist/{cli-m3enfr8q.js → cli-6wscj9z0.js}

@@ -1,7 +1,3 @@
-import {
-  getValidCodexOAuth,
-  persistCodexOAuth
-} from "./cli-amncg1dq.js";
 import {
   appendAssistantMessageDiagnostic,
   cleanupSessionResources,
@@ -15,6 +11,10 @@ import {
   SummaryWithRatingsSchema,
   buildSummaryWithRatingsPrompt
 } from "./cli-dcfyyh3t.js";
+import {
+  getValidCodexOAuth,
+  persistCodexOAuth
+} from "./cli-tk9vyqzh.js";
 import {
   init_zod
 } from "./cli-q21d49ac.js";

package/dist/{cli-5kav4x1a.js → cli-709t753c.js}

@@ -6,7 +6,7 @@ import {
   getDb,
   init_db,
   isSqliteVecAvailable
-} from "./cli-d8vmtyyr.js";
+} from "./cli-951w7c79.js";
 import {
   __esm,
   __export,
@@ -25,6 +25,10 @@ function isHybridSearchEnabled() {
   const val = process.env.MEMORY_HYBRID_SEARCH ?? "0";
   return val === "1" || val.toLowerCase() === "true";
 }
+function isGraphExpansionEnabled() {
+  const val = process.env.MEMORY_GRAPH_EXPANSION ?? "0";
+  return val === "1" || val.toLowerCase() === "true";
+}
 var TTL_DEFAULTS, GLOBAL_HALF_LIFE_OVERRIDE, GLOBAL_HALF_LIFE, RECENCY_DECAY_HALF_LIFE, RECENCY_DECAY_HALF_LIFE_DAYS, SOURCE_QUALITY_MULTIPLIER, MIN_SIMILARITY, ACCESS_BOOST_MAX_MULTIPLIER, ACCESS_BOOST_RECENCY_WINDOW_HOURS, CANDIDATE_SET_MULTIPLIER, EMBEDDING_DIMENSIONS, DEFAULT_EMBEDDING_MODEL = "openai/text-embedding-3-small", PROTECTED_SOURCES;
 var init_constants = __esm(() => {
   TTL_DEFAULTS = {
@@ -6599,6 +6603,7 @@ var init_reranker = __esm(() => {
 // src/be/memory/providers/sqlite-store.ts
 var exports_sqlite_store = {};
 __export(exports_sqlite_store, {
+  rowToCandidate: () => rowToCandidate,
   computeRrfScore: () => computeRrfScore,
   applyEditMode: () => applyEditMode,
   SqliteMemoryStore: () => SqliteMemoryStore
@@ -7362,4 +7367,4 @@ function getMemoryStore() {
   return memoryStore;
 }
 
-export { CANDIDATE_SET_MULTIPLIER, EMBEDDING_DIMENSIONS, init_constants, cosineSimilarity, serializeEmbedding, deserializeEmbedding, init_embedding, rerank, init_reranker, getEmbeddingProvider, getMemoryStore };
+export { CANDIDATE_SET_MULTIPLIER, isGraphExpansionEnabled, EMBEDDING_DIMENSIONS, init_constants, cosineSimilarity, serializeEmbedding, deserializeEmbedding, init_embedding, computeScore, rerank, init_reranker, rowToCandidate, init_sqlite_store, getEmbeddingProvider, getMemoryStore };

package/dist/{cli-g44ffxk5.js → cli-76d1vtvq.js}

@@ -3,7 +3,7 @@ import {
   getAgentWorkingOnThread,
   getAllAgents,
   init_db
-} from "./cli-d8vmtyyr.js";
+} from "./cli-951w7c79.js";
 
 // src/slack/router.ts
 init_db();
@@ -181,6 +181,15 @@ ${bodyText}` : topText;
   }
   return bodyText || topText;
 }
+function parseSlackTs(input) {
+  const trimmed = input.trim();
+  if (/^\d{6,}\.\d{1,}$/.test(trimmed))
+    return trimmed;
+  const m = trimmed.match(/p?(\d{10})(\d{6})(?:\D|$)/);
+  if (m)
+    return `${m[1]}.${m[2]}`;
+  return trimmed;
+}
 
 // src/tasks/additive-buffer.ts
 function createAdditiveBuffer(options) {
@@ -252,4 +261,4 @@ function createAdditiveBuffer(options) {
   };
 }
 
-export { hasOtherUserMention, routeMessage, extractTaskFromMessage, extractSlackMessageText, createAdditiveBuffer };
+export { hasOtherUserMention, routeMessage, extractTaskFromMessage, extractSlackMessageText, parseSlackTs, createAdditiveBuffer };

package/dist/{cli-gb7dqnna.js → cli-7xkwgkrs.js}

@@ -1,7 +1,7 @@
 import {
   getDb,
   init_db
-} from "./cli-d8vmtyyr.js";
+} from "./cli-951w7c79.js";
 
 // src/be/users.ts
 init_db();

package/dist/{cli-kg9v8h1w.js → cli-8f0dwca2.js}

@@ -7,7 +7,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@desplega.ai/agent-swarm",
-    version: "1.110.0",
+    version: "1.112.0",
     description: "Multi-agent orchestration for Claude Code, Codex, Gemini CLI, and other AI coding assistants",
     license: "MIT",
     author: "desplega.sh <contact@desplega.sh>",

package/dist/{cli-zw3cmjh6.js → cli-94vzr3nq.js}

@@ -4,14 +4,14 @@ import {
   handleScheduleTrigger,
   runScript,
   startWorkflowExecution
-} from "./cli-3t97r3y1.js";
+} from "./cli-tg0f2wmz.js";
 import {
   getScript
-} from "./cli-2h86bsfe.js";
+} from "./cli-3r5y6ayj.js";
 import {
   createTaskWithSiblingAwareness,
   scheduleContextKey
-} from "./cli-8ps5wsk9.js";
+} from "./cli-0c3n0eba.js";
 import {
   getDb,
   getDueScheduledTasks,
@@ -21,7 +21,7 @@ import {
   init_telemetry,
   telemetry,
   updateScheduledTask
-} from "./cli-d8vmtyyr.js";
+} from "./cli-951w7c79.js";
 import {
   __commonJS,
   __require,

package/dist/{cli-d8vmtyyr.js → cli-951w7c79.js}

@@ -25,7 +25,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-kg9v8h1w.js";
+} from "./cli-8f0dwca2.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{cli-dhph6q98.js → cli-9p0qhead.js}

@@ -3,7 +3,7 @@ import {
   incrKv,
   init_db,
   upsertKv
-} from "./cli-d8vmtyyr.js";
+} from "./cli-951w7c79.js";
 
 // src/be/unmapped-identities.ts
 init_db();

package/dist/{cli-vfyhrk9k.js → cli-a5e8n5hg.js}

@@ -1,7 +1,7 @@
 import {
   init_package,
   package_default
-} from "./cli-kg9v8h1w.js";
+} from "./cli-8f0dwca2.js";
 
 // src/commands/shared/client-config.ts
 init_package();

package/dist/{cli-w6zp4qcx.js → cli-ceewqajw.js}

@@ -1,10 +1,6 @@
 import {
   summarizeSession
-} from "./cli-m3enfr8q.js";
-import {
-  extractChatgptUserId,
-  getValidCodexOAuth
-} from "./cli-amncg1dq.js";
+} from "./cli-6wscj9z0.js";
 import {
   createSwarmEventHandler
 } from "./cli-07er7wrs.js";
@@ -19,6 +15,11 @@ import {
   fetchRetrievalsForTask,
   postRatings
 } from "./cli-dcfyyh3t.js";
+import {
+  CodexOAuthRefreshError,
+  credentialsToAuthJson,
+  getValidCodexOAuth
+} from "./cli-tk9vyqzh.js";
 import {
   SessionErrorTracker,
   buildOtelTraceparentEnv
@@ -687,37 +688,6 @@ function computeCodexCostUsd(model, inputTokens, cachedInputTokens, outputTokens
   return inputCost + cachedCost + outputCost;
 }
 
-// src/providers/codex-oauth/auth-json.ts
-function authJsonToCredentialSelection(auth, slot = 0, total = 1) {
-  const userId = extractChatgptUserId(auth.tokens.access_token);
-  const suffixSource = userId ?? auth.tokens.account_id;
-  if (!userId) {
-    console.warn("[codex-oauth] No chatgpt_user_id in JWT — falling back to account_id for keySuffix derivation. " + "If two slots share an account, their suffixes will collide.");
-  }
-  return {
-    selected: auth.tokens.account_id,
-    index: slot,
-    total,
-    keySuffix: suffixSource.slice(-5),
-    keyType: "CODEX_OAUTH",
-    isRateLimitFallback: false
-  };
-}
-function credentialsToAuthJson(creds, opts = {}) {
-  const includeRefreshToken = opts.includeRefreshToken ?? true;
-  return {
-    auth_mode: "chatgpt",
-    OPENAI_API_KEY: null,
-    tokens: {
-      id_token: creds.access,
-      access_token: creds.access,
-      refresh_token: includeRefreshToken ? creds.refresh : "",
-      account_id: creds.accountId
-    },
-    last_refresh: new Date(creds.expires).toISOString()
-  };
-}
-
 // src/providers/codex-swarm-events.ts
 function createCodexSwarmEventHandler(opts) {
   return createSwarmEventHandler({
@@ -778,7 +748,23 @@ async function resolveCodexAuthMode(config, emit, deps = {}) {
   const slot = config.codexSlot ?? 0;
   const isPoolSlot = config.codexSlot !== undefined;
   if (config.apiUrl && config.apiKey && (currentMode !== "chatgpt" || isPoolSlot)) {
-    const oauthCreds = await getValidCodexOAuth(config.apiUrl, config.apiKey, slot);
+    let oauthCreds = null;
+    try {
+      oauthCreds = await getValidCodexOAuth(config.apiUrl, config.apiKey, slot);
+    } catch (err) {
+      if (isPoolSlot) {
+        throw new Error(buildPoolRevalidationFailureReason(err, slot));
+      }
+      const message = err instanceof Error ? err.message : String(err);
+      emit({
+        type: "raw_stderr",
+        content: `[codex] OAuth revalidation failed (non-fatal, non-pool auth): ${message}
+`
+      });
+    }
+    if (!oauthCreds && isPoolSlot) {
+      throw new Error(`[auth-error] Codex pool slot ${slot} revalidation failed: no credentials found in config store — the slot may have just been quarantined; re-run codex-login for this slot if this persists.`);
+    }
     if (oauthCreds) {
       try {
         const authJson = credentialsToAuthJson(oauthCreds, {
@@ -805,6 +791,16 @@ async function resolveCodexAuthMode(config, emit, deps = {}) {
   }
   return currentMode;
 }
+function buildPoolRevalidationFailureReason(err, slot) {
+  if (err instanceof CodexOAuthRefreshError) {
+    if (err.reason === "lock_timeout") {
+      return `[auth-error] Codex pool slot ${slot} [...${err.keySuffix}] revalidation failed: timed out waiting for the refresh lock — transient, will retry on next task.`;
+    }
+    return `[auth-error] Codex pool slot ${slot} [...${err.keySuffix}] revalidation failed: refresh rejected (${err.status ?? "unknown status"} ${err.body ?? ""}) — credential likely revoked; re-run codex-login for this slot.`;
+  }
+  const message = err instanceof Error ? err.message : String(err);
+  return `[auth-error] Codex pool slot ${slot} revalidation failed: ${message}`;
+}
 async function buildCodexConfig(config, model, emit) {
   const mcpServers = {};
   mcpServers["agent-swarm"] = {
@@ -1260,7 +1256,9 @@ class CodexSession {
       "invalid_api_key",
       "missing api key",
       "no api key",
-      "authentication failed"
+      "authentication failed",
+      "failed to refresh token",
+      "invalid 'refresh_token'"
     ];
     if (authPatterns.some((p) => normalized.includes(p))) {
       return {
@@ -1697,4 +1695,4 @@ class CodexAdapter {
   }
 }
 
-export { authJsonToCredentialSelection, credentialsToAuthJson, checkCodexCredentials, resolveCodexAuthMode, buildCodexConfig, CodexSession, createInProcessCodexSession, resolveCodexRunnerArgv, CodexAdapter };
+export { checkCodexCredentials, resolveCodexAuthMode, buildCodexConfig, CodexSession, createInProcessCodexSession, resolveCodexRunnerArgv, CodexAdapter };

package/dist/{cli-r19ttke3.js → cli-h9jx5mag.js}

@@ -1,18 +1,18 @@
 import {
   createAdditiveBuffer,
   extractSlackMessageText
-} from "./cli-g44ffxk5.js";
+} from "./cli-76d1vtvq.js";
 import {
   getSlackApp,
   registerTreeMessage
-} from "./cli-4trfcacj.js";
+} from "./cli-hm27prrc.js";
 import {
   buildBufferFlushBlocks
 } from "./cli-6xd0bvf8.js";
 import {
   createTaskWithSiblingAwareness,
   slackContextKey
-} from "./cli-8ps5wsk9.js";
+} from "./cli-0c3n0eba.js";
 import {
   getLatestActiveTaskInThread,
   getLeadAgent,
@@ -20,7 +20,7 @@ import {
   init_db,
   init_registry,
   registerTemplate
-} from "./cli-d8vmtyyr.js";
+} from "./cli-951w7c79.js";
 
 // src/slack/event-dedup.ts
 var DEFAULT_TTL_MS = 300000;

package/dist/{cli-4trfcacj.js → cli-hm27prrc.js}

@@ -25,7 +25,7 @@ import {
   getTaskById,
   init_db,
   setSlackMessageTracking
-} from "./cli-d8vmtyyr.js";
+} from "./cli-951w7c79.js";
 import {
   require_receiver,
   require_sender,
@@ -54988,13 +54988,13 @@ async function initSlackApp() {
     socketMode: true,
     logLevel: import_bolt.LogLevel.DEBUG
   });
-  const { registerMessageHandler } = await import("./handlers-jj8rzetb.js");
-  const { registerCommandHandler } = await import("./commands-3fh75nzv.js");
-  const { registerActionHandlers } = await import("./actions-837ktebk.js");
+  const { registerMessageHandler } = await import("./handlers-sy64egg6.js");
+  const { registerCommandHandler } = await import("./commands-14g7taf4.js");
+  const { registerActionHandlers } = await import("./actions-eckb4g8r.js");
   registerMessageHandler(app);
   registerCommandHandler(app);
   registerActionHandlers(app);
-  const { createAssistant } = await import("./assistant-yhrta0c5.js");
+  const { createAssistant } = await import("./assistant-7255sbyw.js");
   app.assistant(createAssistant());
   return app;
 }

package/dist/{cli-gtt1f14h.js → cli-pt7c7qxz.js}

@@ -4,11 +4,11 @@ import {
   getNextResumeGeneration,
   getResumeGeneration,
   repointTrackerSyncBySwarmId
-} from "./cli-k6ssh5dk.js";
+} from "./cli-56s4ehzw.js";
 import {
   getExecutorRegistry,
   recoverIncompleteRuns
-} from "./cli-3t97r3y1.js";
+} from "./cli-tg0f2wmz.js";
 import {
   MAX_EMPTY_POLLS,
   assignUnassignedTaskPending,
@@ -44,7 +44,7 @@ import {
   resolveTemplate,
   supersedeTask,
   updateAgentStatus
-} from "./cli-d8vmtyyr.js";
+} from "./cli-951w7c79.js";
 
 // src/heartbeat/heartbeat.ts
 init_db();

package/dist/{cli-sjm0e1pa.js → cli-r1btc895.js}

@@ -1,13 +1,13 @@
 import {
   buildModelsDevSeedRows
-} from "./cli-3baz70yp.js";
+} from "./cli-rp8pca98.js";
 import {
   createLogEntry,
   getActivePricingRow,
   getDb,
   init_db,
   insertPricingRow
-} from "./cli-d8vmtyyr.js";
+} from "./cli-951w7c79.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{cli-3baz70yp.js → cli-rp8pca98.js}

@@ -1,7 +1,7 @@
 import {
   getDb,
   init_db
-} from "./cli-d8vmtyyr.js";
+} from "./cli-951w7c79.js";
 
 // src/be/seed-pricing.ts
 init_db();

package/dist/{cli-dy01kwxk.js → cli-s9pj3c7z.js}

@@ -4,11 +4,11 @@ import {
   getEmbeddingProvider,
   init_embedding,
   serializeEmbedding
-} from "./cli-5kav4x1a.js";
+} from "./cli-709t753c.js";
 import {
   getDb,
   init_db
-} from "./cli-d8vmtyyr.js";
+} from "./cli-951w7c79.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{cli-0pzg1f8z.js → cli-tch0ypp6.js}

@@ -1,11 +1,6 @@
 import {
-  authJsonToCredentialSelection,
-  checkCodexCredentials,
-  credentialsToAuthJson
-} from "./cli-w6zp4qcx.js";
-import {
-  loadAllCodexOAuthSlots
-} from "./cli-amncg1dq.js";
+  checkCodexCredentials
+} from "./cli-ceewqajw.js";
 import {
   checkClaudeManagedCredentials
 } from "./cli-2r7s8jhp.js";
@@ -23,7 +18,12 @@ import {
   withSpan,
   withSpanContext,
   writeSkillsToFilesystem
-} from "./cli-kna0r84e.js";
+} from "./cli-15598a4k.js";
+import {
+  authJsonToCredentialSelection,
+  credentialsToAuthJson,
+  loadAllCodexOAuthSlots
+} from "./cli-tk9vyqzh.js";
 import {
   checkClaudeCredentials
 } from "./cli-2fc97xm5.js";
@@ -40,10 +40,10 @@ import {
 import {
   ensure,
   initialize
-} from "./cli-zw3cmjh6.js";
+} from "./cli-94vzr3nq.js";
 import {
   validateJsonSchema
-} from "./cli-3t97r3y1.js";
+} from "./cli-tg0f2wmz.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
@@ -79,7 +79,7 @@ import {
   resolveTaskModelSelection,
   resolveTemplateAsync,
   telemetry
-} from "./cli-d8vmtyyr.js";
+} from "./cli-951w7c79.js";
 import {
   init_credentials,
   resolveCredentialPools
@@ -445,11 +445,11 @@ async function createProviderAdapter(provider) {
       return new ClaudeAdapter;
     }
     case "pi": {
-      const { PiMonoAdapter } = await import("./pi-mono-adapter-ayr3akk8.js");
+      const { PiMonoAdapter } = await import("./pi-mono-adapter-kxjxpfgy.js");
       return new PiMonoAdapter;
     }
     case "codex": {
-      const { CodexAdapter } = await import("./codex-adapter-ebs12jef.js");
+      const { CodexAdapter } = await import("./codex-adapter-5cmy858w.js");
       return new CodexAdapter;
     }
     case "claude-managed": {
@@ -1109,7 +1109,7 @@ async function checkProviderCredentials(provider, env, opts) {
     case "opencode":
       return checkOpencodeCredentials(env, opts);
     case "pi": {
-      const { checkPiMonoCredentials } = await import("./pi-mono-adapter-ayr3akk8.js");
+      const { checkPiMonoCredentials } = await import("./pi-mono-adapter-kxjxpfgy.js");
       return checkPiMonoCredentials(env, opts);
     }
     default:
@@ -1558,7 +1558,42 @@ async function listSwarmAutostashes(clonePath, role) {
     return [];
   }
 }
-async function refreshExistingRepoForTask(repoConfig, role) {
+var CONTINUATION_TASK_TYPES = new Set([
+  "resume",
+  "follow-up",
+  "reroute-decision",
+  "agentmail-reply",
+  "github-comment",
+  "github-review",
+  "gitlab-comment",
+  "gitlab-ci"
+]);
+var ACTIVE_PARENT_STATUSES = new Set(["pending", "in_progress", "offered", "paused"]);
+async function isFirstKickoffTask(task, fetchParentTaskStatus) {
+  if (task?.taskType && CONTINUATION_TASK_TYPES.has(task.taskType))
+    return false;
+  if (task?.parentTaskId && fetchParentTaskStatus) {
+    const parentStatus = await fetchParentTaskStatus(task.parentTaskId);
+    if (parentStatus && ACTIVE_PARENT_STATUSES.has(parentStatus))
+      return false;
+  }
+  return true;
+}
+async function fetchTaskStatus(apiUrl, apiKey, taskId) {
+  const headers = {};
+  if (apiKey)
+    headers.Authorization = `Bearer ${apiKey}`;
+  try {
+    const response = await fetch(`${apiUrl}/api/tasks/${taskId}`, { headers });
+    if (!response.ok)
+      return null;
+    const data = await response.json();
+    return data.status ?? null;
+  } catch {
+    return null;
+  }
+}
+async function refreshExistingRepoForTask(repoConfig, role, isFirstKickoff) {
   const { name, clonePath, defaultBranch } = repoConfig;
   const statusResult = await Bun.$`env -u GIT_DIR -u GIT_WORK_TREE -u GIT_INDEX_FILE -u GIT_PREFIX git -C ${clonePath} status --porcelain`.quiet();
   const statusOutput = statusResult.text().trim();
@@ -1575,13 +1610,24 @@ async function refreshExistingRepoForTask(repoConfig, role) {
       return `The repo "${name}" at ${clonePath} has uncommitted changes, but auto-stash failed: ${errorMsg}. A git pull was skipped to avoid losing work.`;
     }
   }
+  const fetchSpec = `${defaultBranch}:refs/remotes/origin/${defaultBranch}`;
+  const remoteRef = `refs/remotes/origin/${defaultBranch}`;
   try {
-    console.log(`[${role}] Refreshing ${name} from origin/${defaultBranch}...`);
-    const fetchSpec = `${defaultBranch}:refs/remotes/origin/${defaultBranch}`;
-    const remoteRef = `refs/remotes/origin/${defaultBranch}`;
     await Bun.$`env -u GIT_DIR -u GIT_WORK_TREE -u GIT_INDEX_FILE -u GIT_PREFIX git -C ${clonePath} fetch origin ${fetchSpec}`.quiet();
-    await Bun.$`env -u GIT_DIR -u GIT_WORK_TREE -u GIT_INDEX_FILE -u GIT_PREFIX git -C ${clonePath} merge --no-edit --no-stat ${remoteRef}`.quiet();
-    console.log(`[${role}] Refreshed ${name}`);
+    if (isFirstKickoff) {
+      console.log(`[${role}] First kickoff for ${name} — resetting to ${remoteRef}...`);
+      try {
+        await Bun.$`env -u GIT_DIR -u GIT_WORK_TREE -u GIT_INDEX_FILE -u GIT_PREFIX git -C ${clonePath} checkout ${defaultBranch}`.quiet();
+      } catch {
+        await Bun.$`env -u GIT_DIR -u GIT_WORK_TREE -u GIT_INDEX_FILE -u GIT_PREFIX git -C ${clonePath} checkout -B ${defaultBranch} ${remoteRef}`.quiet();
+      }
+      await Bun.$`env -u GIT_DIR -u GIT_WORK_TREE -u GIT_INDEX_FILE -u GIT_PREFIX git -C ${clonePath} reset --hard ${remoteRef}`.quiet();
+      console.log(`[${role}] Reset ${name} to ${remoteRef}`);
+    } else {
+      console.log(`[${role}] Refreshing ${name} from ${remoteRef}...`);
+      await Bun.$`env -u GIT_DIR -u GIT_WORK_TREE -u GIT_INDEX_FILE -u GIT_PREFIX git -C ${clonePath} merge --no-edit --no-stat ${remoteRef}`.quiet();
+      console.log(`[${role}] Refreshed ${name}`);
+    }
     return null;
   } catch (err) {
     const errorMsg = scrubSecrets(err.message);
@@ -1611,7 +1657,7 @@ async function installRepoHooksForTask(repoConfig, role) {
     console.warn(`[${role}] Could not install git hooks for ${repoConfig.name}: ${errorMsg}`);
   }
 }
-async function ensureRepoForTask(repoConfig, role) {
+async function ensureRepoForTask(repoConfig, role, isFirstKickoff = false) {
   const { url, name, clonePath, defaultBranch } = repoConfig;
   try {
     const gitHeadExists = await Bun.file(`${clonePath}/.git/HEAD`).exists();
@@ -1632,7 +1678,7 @@ async function ensureRepoForTask(repoConfig, role) {
       console.log(`[${role}] Cloned ${name}`);
     } else {
       console.log(`[${role}] Repo ${name} already cloned at ${clonePath}`);
-      warning = await refreshExistingRepoForTask({ name, clonePath, defaultBranch }, role);
+      warning = await refreshExistingRepoForTask({ name, clonePath, defaultBranch }, role, isFirstKickoff);
     }
     await installRepoHooksForTask(repoConfig, role);
     const claudeMd = await readClaudeMd(clonePath, role);
@@ -4510,7 +4556,7 @@ ${additionalSystemPrompt}` : basePrompt;
             clonePath: `/workspace/personal/repos/${task.vcsRepo.split("/").pop() || task.vcsRepo}`,
             defaultBranch: "main"
           };
-          const repoContext = await ensureRepoForTask(effectiveConfig, role);
+          const repoContext = await ensureRepoForTask(effectiveConfig, role, false);
           if (repoContext?.clonePath) {
             resumeCwd = repoContext.clonePath;
           }
@@ -4740,7 +4786,8 @@ ${additionalSystemPrompt}` : basePrompt;
             clonePath: `/workspace/personal/repos/${taskVcsRepo.split("/").pop() || taskVcsRepo}`,
             defaultBranch: "main"
           };
-          const repoResult = await ensureRepoForTask(effectiveConfig, role);
+          const isFirstKickoff = await isFirstKickoffTask(taskObj, (parentTaskId) => fetchTaskStatus(apiUrl, apiKey, parentTaskId));
+          const repoResult = await ensureRepoForTask(effectiveConfig, role, isFirstKickoff);
           currentRepoContext = {
             ...repoResult,
             guidelines: repoConfig?.guidelines ?? null