@grackle-ai/server 0.26.0 → 0.28.0

package/dist/utils/format-gh-error.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Translate a raw `gh` CLI error into a user-friendly message.
+ * The raw error is still logged server-side for diagnostics.
+ */
+export declare function formatGhError(err: unknown, operation: string): string;
+//# sourceMappingURL=format-gh-error.d.ts.map

package/dist/utils/format-gh-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"format-gh-error.d.ts","sourceRoot":"","sources":["../../src/utils/format-gh-error.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CA4BrE"}

package/dist/utils/format-gh-error.js

@@ -0,0 +1,30 @@
+/**
+ * Translate a raw `gh` CLI error into a user-friendly message.
+ * The raw error is still logged server-side for diagnostics.
+ */
+export function formatGhError(err, operation) {
+    const message = err instanceof Error ? err.message : String(err);
+    const rawStderr = err instanceof Error && "stderr" in err
+        ? err.stderr
+        : undefined;
+    const stderr = typeof rawStderr === "string" && rawStderr.length > 0
+        ? rawStderr
+        : Buffer.isBuffer(rawStderr) && rawStderr.length > 0
+            ? rawStderr.toString()
+            : "";
+    const code = err instanceof Error && "code" in err
+        ? String(err.code)
+        : "";
+    if (code === "ENOENT" || message.includes("ENOENT")) {
+        return "Could not find the `gh` CLI. Ensure GitHub CLI is installed and available on your system PATH, then restart the Grackle server.";
+    }
+    if (code === "EACCES" || message.includes("EACCES")) {
+        return "`gh` CLI found but not executable. Check file permissions.";
+    }
+    const combined = `${stderr} ${message}`.toLowerCase();
+    if (combined.includes("auth") || combined.includes("login")) {
+        return "GitHub CLI is not authenticated. Run `gh auth login` and restart.";
+    }
+    return `Failed to ${operation}: ${stderr || message}`;
+}
+//# sourceMappingURL=format-gh-error.js.map

package/dist/utils/format-gh-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"format-gh-error.js","sourceRoot":"","sources":["../../src/utils/format-gh-error.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY,EAAE,SAAiB;IAC3D,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,MAAM,SAAS,GACb,GAAG,YAAY,KAAK,IAAI,QAAQ,IAAI,GAAG;QACrC,CAAC,CAAE,GAAmC,CAAC,MAAM;QAC7C,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,MAAM,GACV,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QACnD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAClD,CAAC,CAAC,SAAS,CAAC,QAAQ,EAAE;YACtB,CAAC,CAAC,EAAE,CAAC;IACX,MAAM,IAAI,GACR,GAAG,YAAY,KAAK,IAAI,MAAM,IAAI,GAAG;QACnC,CAAC,CAAC,MAAM,CAAE,GAAiC,CAAC,IAAI,CAAC;QACjD,CAAC,CAAC,EAAE,CAAC;IAET,IAAI,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,OAAO,iIAAiI,CAAC;IAC3I,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,OAAO,4DAA4D,CAAC;IACtE,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC;IACtD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,OAAO,mEAAmE,CAAC;IAC7E,CAAC;IACD,OAAO,aAAa,SAAS,KAAK,MAAM,IAAI,OAAO,EAAE,CAAC;AACxD,CAAC"}

package/dist/utils/system-context.d.ts

@@ -1,3 +1,3 @@
 /** Build the system context string injected into task-spawned agent sessions. */
-export declare function buildTaskSystemContext(title: string, description: string, reviewNotes: string, canDecompose?: boolean): string;
+export declare function buildTaskSystemContext(title: string, description: string, notes: string, canDecompose?: boolean): string;
 //# sourceMappingURL=system-context.d.ts.map

package/dist/utils/system-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system-context.d.ts","sourceRoot":"","sources":["../../src/utils/system-context.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,OAAO,GAAG,MAAM,CA+C9H"}
+{"version":3,"file":"system-context.d.ts","sourceRoot":"","sources":["../../src/utils/system-context.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,OAAO,GAAG,MAAM,CA+CxH"}

package/dist/utils/system-context.js

@@ -1,9 +1,9 @@
 /** Build the system context string injected into task-spawned agent sessions. */
-export function buildTaskSystemContext(title, description, reviewNotes, canDecompose) {
+export function buildTaskSystemContext(title, description, notes, canDecompose) {
     const sections = [
         `## Task: ${title}`,
         description,
-        reviewNotes ? `## Review Feedback (from previous attempt)\n${reviewNotes}` : "",
+        notes ? `## Notes (from previous attempt or user feedback)\n${notes}` : "",
         `## Grackle Tools (MCP)`,
         `You have a "grackle" MCP server with tools for coordinating with other agents:`,
         `- **mcp__grackle__post_finding**: Share discoveries (architecture decisions, bugs, patterns) with other agents working on this project. Parameters: title (string), content (string), category (optional: architecture|api|bug|decision|dependency|pattern|general), tags (optional: string[]).`,

package/dist/utils/system-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"system-context.js","sourceRoot":"","sources":["../../src/utils/system-context.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,MAAM,UAAU,sBAAsB,CAAC,KAAa,EAAE,WAAmB,EAAE,WAAmB,EAAE,YAAsB;IACpH,MAAM,QAAQ,GAAa;QACzB,YAAY,KAAK,EAAE;QACnB,WAAW;QACX,WAAW,CAAC,CAAC,CAAC,+CAA+C,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;QAC/E,wBAAwB;QACxB,gFAAgF;QAChF,iSAAiS;QACjS,gJAAgJ;KACjJ,CAAC;IAEF,IAAI,YAAY,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CACX,8qBAA8qB,CAC/qB,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,IAAI,CACX,yBAAyB,EACzB,oKAAoK,EACpK,EAAE,EACF,+BAA+B,EAC/B,yCAAyC,EACzC,2MAA2M,EAC3M,mEAAmE,EACnE,4DAA4D,EAC5D,2JAA2J,EAC3J,EAAE,EACF,wBAAwB,EACxB,4IAA4I,EAC5I,0GAA0G,EAC1G,qJAAqJ,EACrJ,8CAA8C,EAC9C,gGAAgG,EAChG,EAAE,EACF,kEAAkE,EAClE,8DAA8D,EAC9D,EAAE,EACF,qKAAqK,EACrK,sIAAsI,EACtI,yTAAyT,EACzT,uGAAuG,EACvG,EAAE,EACF,8NAA8N,CAC/N,CAAC;IAEF,OAAO,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"system-context.js","sourceRoot":"","sources":["../../src/utils/system-context.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,MAAM,UAAU,sBAAsB,CAAC,KAAa,EAAE,WAAmB,EAAE,KAAa,EAAE,YAAsB;IAC9G,MAAM,QAAQ,GAAa;QACzB,YAAY,KAAK,EAAE;QACnB,WAAW;QACX,KAAK,CAAC,CAAC,CAAC,sDAAsD,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE;QAC1E,wBAAwB;QACxB,gFAAgF;QAChF,iSAAiS;QACjS,gJAAgJ;KACjJ,CAAC;IAEF,IAAI,YAAY,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CACX,8qBAA8qB,CAC/qB,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,IAAI,CACX,yBAAyB,EACzB,oKAAoK,EACpK,EAAE,EACF,+BAA+B,EAC/B,yCAAyC,EACzC,2MAA2M,EAC3M,mEAAmE,EACnE,4DAA4D,EAC5D,2JAA2J,EAC3J,EAAE,EACF,wBAAwB,EACxB,4IAA4I,EAC5I,0GAA0G,EAC1G,qJAAqJ,EACrJ,8CAA8C,EAC9C,gGAAgG,EAChG,EAAE,EACF,kEAAkE,EAClE,8DAA8D,EAC9D,EAAE,EACF,qKAAqK,EACrK,sIAAsI,EACtI,yTAAyT,EACzT,uGAAuG,EACvG,EAAE,EACF,8NAA8N,CAC/N,CAAC;IAEF,OAAO,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC"}

package/dist/ws-bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ws-bridge.d.ts","sourceRoot":"","sources":["../src/ws-bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAa,MAAM,IAAI,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,WAAW,CAAC;AAmDtD,wGAAwG;AACxG,wBAAgB,cAAc,CAC5B,UAAU,EAAE,UAAU,EACtB,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,GACvC,eAAe,CAuCjB"}
+{"version":3,"file":"ws-bridge.d.ts","sourceRoot":"","sources":["../src/ws-bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAa,MAAM,IAAI,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,WAAW,CAAC;AAuDtD,wGAAwG;AACxG,wBAAgB,cAAc,CAC5B,UAAU,EAAE,UAAU,EACtB,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,GACvC,eAAe,CAwCjB"}

package/dist/ws-bridge.js

@@ -7,13 +7,14 @@ import * as adapterManager from "./adapter-manager.js";
 import { reconnectOrProvision, } from "./adapters/adapter.js";
 import * as streamHub from "./stream-hub.js";
 import * as tokenBroker from "./token-broker.js";
+import * as credentialProviders from "./credential-providers.js";
 import * as projectStore from "./project-store.js";
 import * as taskStore from "./task-store.js";
 import * as findingStore from "./finding-store.js";
 import * as personaStore from "./persona-store.js";
 import { v4 as uuid } from "uuid";
 import { join } from "node:path";
-import { LOGS_DIR, DEFAULT_RUNTIME, DEFAULT_MODEL, eventTypeToString, } from "@grackle-ai/common";
+import { LOGS_DIR, DEFAULT_RUNTIME, DEFAULT_MODEL, SESSION_STATUS, TASK_STATUS, eventTypeToString, } from "@grackle-ai/common";
 import { grackleHome } from "./paths.js";
 import * as logWriter from "./log-writer.js";
 import { safeParseJsonArray } from "./json-helpers.js";
@@ -22,10 +23,11 @@ import { buildTaskSystemContext } from "./utils/system-context.js";
 import { slugify } from "./utils/slugify.js";
 import { processEventStream } from "./event-processor.js";
 import * as processorRegistry from "./processor-registry.js";
-import { broadcast, setWssInstance } from "./ws-broadcast.js";
+import { broadcast, setWssInstance, broadcastEnvironments, envRowToWs } from "./ws-broadcast.js";
 import { buildMcpServersJson } from "./grpc-service.js";
 import { computeTaskStatus } from "./compute-task-status.js";
 import { exec } from "./utils/exec.js";
+import { formatGhError } from "./utils/format-gh-error.js";
 const GH_CODESPACE_LIST_TIMEOUT_MS = 30_000;
 const GH_CODESPACE_CREATE_TIMEOUT_MS = 300_000;
 const GH_CODESPACE_LIST_LIMIT = 50;
@@ -43,6 +45,7 @@ export function createWsBridge(httpServer, verifyApiKey) {
             return;
         }
         const subscriptions = new Map();
+        // eslint-disable-next-line @typescript-eslint/no-misused-promises
         ws.on("message", async (data) => {
             try {
                 const msg = JSON.parse(data.toString());
@@ -66,25 +69,6 @@ export function createWsBridge(httpServer, verifyApiKey) {
     });
     return wss;
 }
-/** Map a database environment row to the WebSocket payload shape. */
-function envRowToWs(r) {
-    return {
-        id: r.id,
-        displayName: r.displayName,
-        adapterType: r.adapterType,
-        adapterConfig: r.adapterConfig,
-        defaultRuntime: r.defaultRuntime,
-        status: r.status,
-        bootstrapped: r.bootstrapped,
-    };
-}
-/** Broadcast the current environment list to all connected WebSocket clients. */
-function broadcastEnvironments() {
-    broadcast({
-        type: "environments",
-        payload: { environments: envRegistry.listEnvironments().map(envRowToWs) },
-    });
-}
 /** Safely parse an adapter config string, returning an empty object on failure. */
 function safeParseAdapterConfig(raw, environmentId) {
     try {
@@ -213,18 +197,13 @@ async function startTaskSession(ws, task, options) {
         return `Persona not found: ${resolvedPersonaId}`;
     }
     const sessionId = uuid();
-    const runtime = options?.runtime ||
-        persona?.runtime ||
-        env.defaultRuntime ||
-        DEFAULT_RUNTIME;
-    const model = options?.model ||
-        persona?.model ||
-        process.env.GRACKLE_DEFAULT_MODEL ||
-        DEFAULT_MODEL;
+    const runtime = options?.runtime || persona?.runtime || env.defaultRuntime || DEFAULT_RUNTIME;
+    const model = options?.model || persona?.model ||
+        process.env.GRACKLE_DEFAULT_MODEL || DEFAULT_MODEL;
     const maxTurns = persona?.maxTurns || 0;
     const logPath = join(grackleHome, LOGS_DIR, sessionId);
     const freshTask = taskStore.getTask(task.id) || task;
-    let systemContext = buildTaskSystemContext(freshTask.title, freshTask.description, freshTask.reviewNotes, freshTask.canDecompose);
+    let systemContext = buildTaskSystemContext(freshTask.title, freshTask.description, options?.notes || "", freshTask.canDecompose);
     if (persona) {
         systemContext = persona.systemPrompt + "\n\n" + systemContext;
     }
@@ -262,7 +241,7 @@ async function startTaskSession(ws, task, options) {
         maxTurns,
         branch: freshTask.branch,
         worktreeBasePath: freshTask.branch
-            ? process.env.GRACKLE_WORKTREE_BASE || "/workspace"
+            ? (project.worktreeBasePath || process.env.GRACKLE_WORKTREE_BASE || "/workspace")
             : "",
         systemContext,
         projectId: freshTask.projectId,
@@ -312,7 +291,7 @@ async function handleMessage(ws, msg, subscriptions) {
                 return;
             }
             const session = sessionStore.getSession(sessionId);
-            if (!session || !session.logPath) {
+            if (!session?.logPath) {
                 return;
             }
             const entries = logWriter.readLog(session.logPath);
@@ -386,8 +365,8 @@ async function handleMessage(ws, msg, subscriptions) {
         case "spawn": {
             const environmentId = msg.payload?.environmentId;
             const prompt = msg.payload?.prompt;
-            const model = msg.payload?.model || "";
-            const runtime = msg.payload?.runtime || "";
+            const model = msg.payload?.model || undefined;
+            const runtime = msg.payload?.runtime || undefined;
             const branch = msg.payload?.branch || "";
             const systemContext = msg.payload?.systemContext || "";
             const spawnPersonaId = msg.payload?.personaId || "";
@@ -418,7 +397,9 @@ async function handleMessage(ws, msg, subscriptions) {
                 return;
             }
             const sessionId = uuid();
+            // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- runtime/model may be undefined from WS payload
             const sessionRuntime = runtime || spawnPersona?.runtime || env.defaultRuntime || DEFAULT_RUNTIME;
+            // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
             const sessionModel = model || spawnPersona?.model || process.env.GRACKLE_DEFAULT_MODEL || DEFAULT_MODEL;
             const maxTurns = spawnPersona?.maxTurns || 0;
             const logPath = join(grackleHome, LOGS_DIR, sessionId);
@@ -435,7 +416,9 @@ async function handleMessage(ws, msg, subscriptions) {
                 model: sessionModel,
                 maxTurns,
                 branch,
-                worktreeBasePath: branch ? "/workspace" : "",
+                worktreeBasePath: branch
+                    ? ((typeof msg.payload?.worktreeBasePath === "string" ? msg.payload.worktreeBasePath.trim() : "") || process.env.GRACKLE_WORKTREE_BASE || "/workspace")
+                    : "",
                 systemContext: finalSystemContext,
             });
             processEventStream(conn.client.spawn(powerlineReq), {
@@ -448,7 +431,7 @@ async function handleMessage(ws, msg, subscriptions) {
                             sessionId,
                             eventType: "error",
                             timestamp: new Date().toISOString(),
-                            content: `Spawn failed: ${err}`,
+                            content: `Spawn failed: ${err instanceof Error ? err.message : String(err)}`,
                         },
                     });
                 },
@@ -473,11 +456,11 @@ async function handleMessage(ws, msg, subscriptions) {
                 });
                 return;
             }
-            if (session.status !== "waiting_input") {
+            if (session.status !== SESSION_STATUS.IDLE) {
                 sendWs(ws, {
                     type: "error",
                     payload: {
-                        message: `Session ${sessionId} is not currently waiting for input (status: ${session.status})`,
+                        message: `Session ${sessionId} is not currently idle (status: ${session.status})`,
                     },
                 });
                 return;
@@ -530,15 +513,15 @@ async function handleMessage(ws, msg, subscriptions) {
                     await conn.client.kill(create(powerline.SessionIdSchema, { id: sessionId }));
                 }
                 catch (err) {
-                    logger.warn({ sessionId, err }, "PowerLine kill failed — marking session killed anyway");
+                    logger.warn({ sessionId, err }, "PowerLine kill failed — marking session interrupted anyway");
                 }
             }
-            sessionStore.updateSession(sessionId, "killed");
+            sessionStore.updateSession(sessionId, SESSION_STATUS.INTERRUPTED);
             streamHub.publish(create(grackle.SessionEventSchema, {
                 sessionId,
                 type: grackle.EventType.STATUS,
                 timestamp: new Date().toISOString(),
-                content: "killed",
+                content: SESSION_STATUS.INTERRUPTED,
                 raw: "",
             }));
             // Broadcast task_updated so frontend re-fetches computed status
@@ -564,6 +547,7 @@ async function handleMessage(ws, msg, subscriptions) {
                         defaultEnvironmentId: r.defaultEnvironmentId,
                         status: r.status,
                         useWorktrees: r.useWorktrees,
+                        worktreeBasePath: r.worktreeBasePath,
                         createdAt: r.createdAt,
                         updatedAt: r.updatedAt,
                     })),
@@ -587,7 +571,7 @@ async function handleMessage(ws, msg, subscriptions) {
             }
             // useWorktrees defaults to true when not specified
             const createUseWorktrees = msg.payload?.useWorktrees ?? true;
-            projectStore.createProject(id, name, msg.payload?.description || "", msg.payload?.repoUrl || "", msg.payload?.defaultEnvironmentId || "", createUseWorktrees);
+            projectStore.createProject(id, name, msg.payload?.description || "", msg.payload?.repoUrl || "", msg.payload?.defaultEnvironmentId || "", createUseWorktrees, typeof msg.payload?.worktreeBasePath === "string" ? msg.payload.worktreeBasePath.trim() : "");
             const row = projectStore.getProject(id);
             broadcast({ type: "project_created", payload: { project: row } });
             break;
@@ -611,7 +595,7 @@ async function handleMessage(ws, msg, subscriptions) {
                 return;
             }
             const nameVal = typeof msg.payload?.name === "string" ? msg.payload.name : undefined;
-            if (nameVal !== undefined && nameVal.trim() === "") {
+            if (nameVal?.trim() === "") {
                 sendWs(ws, { type: "error", payload: { message: "Project name cannot be empty" } });
                 return;
             }
@@ -623,12 +607,14 @@ async function handleMessage(ws, msg, subscriptions) {
                 return;
             }
             const worktreesVal = typeof msg.payload?.useWorktrees === "boolean" ? msg.payload.useWorktrees : undefined;
+            const worktreeBasePathVal = typeof msg.payload?.worktreeBasePath === "string" ? msg.payload.worktreeBasePath : undefined;
             projectStore.updateProject(projectId, {
                 name: nameVal !== undefined ? nameVal.trim() : undefined,
                 description: descVal,
                 repoUrl: repoVal,
                 defaultEnvironmentId: envVal,
                 useWorktrees: worktreesVal,
+                worktreeBasePath: worktreeBasePathVal,
             });
             broadcast({ type: "project_updated", payload: { projectId } });
             break;
@@ -761,7 +747,6 @@ async function handleMessage(ws, msg, subscriptions) {
                             branch: r.branch,
                             latestSessionId: computed.latestSessionId,
                             dependsOn: safeParseJsonArray(r.dependsOn),
-                            reviewNotes: r.reviewNotes,
                             sortOrder: r.sortOrder,
                             createdAt: r.createdAt,
                             parentTaskId: r.parentTaskId,
@@ -827,7 +812,7 @@ async function handleMessage(ws, msg, subscriptions) {
                     sendWs(ws, { type: "error", payload: { message: `Session not found: ${lateBindSessionId}` } });
                     return;
                 }
-                const terminalStatuses = ["completed", "failed", "killed"];
+                const terminalStatuses = [SESSION_STATUS.COMPLETED, SESSION_STATUS.FAILED, SESSION_STATUS.INTERRUPTED];
                 if (terminalStatuses.includes(session.status)) {
                     sendWs(ws, {
                         type: "error",
@@ -857,8 +842,8 @@ async function handleMessage(ws, msg, subscriptions) {
                 });
                 break;
             }
-            // Only allow editing pending/assigned tasks (non-late-bind path)
-            if (!["pending", "assigned"].includes(existingTask.status)) {
+            // Only allow editing not_started tasks (non-late-bind path)
+            if (existingTask.status !== TASK_STATUS.NOT_STARTED) {
                 sendWs(ws, {
                     type: "error",
                     payload: { message: `Task ${updateTaskId} cannot be edited (status: ${existingTask.status})` },
@@ -879,7 +864,7 @@ async function handleMessage(ws, msg, subscriptions) {
                         .filter((d) => d !== updateTaskId)),
                 ]
                 : safeParseJsonArray(existingTask.dependsOn);
-            taskStore.updateTask(updateTaskId, updatedTitle, updatedDescription, existingTask.status, updatedDependsOn, existingTask.reviewNotes);
+            taskStore.updateTask(updateTaskId, updatedTitle, updatedDescription, existingTask.status, updatedDependsOn);
             const updatedRow = taskStore.getTask(updateTaskId);
             broadcast({
                 type: "task_updated",
@@ -908,7 +893,7 @@ async function handleMessage(ws, msg, subscriptions) {
             {
                 const taskSessions = sessionStore.listSessionsForTask(taskId);
                 const { status: effectiveStatus } = computeTaskStatus(task.status, taskSessions);
-                if (!["pending", "assigned", "failed"].includes(effectiveStatus)) {
+                if (![TASK_STATUS.NOT_STARTED, TASK_STATUS.FAILED].includes(effectiveStatus)) {
                     sendWs(ws, {
                         type: "error",
                         payload: {
@@ -930,80 +915,88 @@ async function handleMessage(ws, msg, subscriptions) {
                 model: msg.payload?.model,
                 personaId: msg.payload?.personaId || undefined,
                 environmentId: msg.payload?.environmentId || undefined,
+                notes: msg.payload?.notes || undefined,
             });
             if (startError) {
                 sendWs(ws, { type: "error", payload: { message: startError } });
             }
             break;
         }
-        case "approve_task": {
+        case "complete_task": {
             const taskId = msg.payload?.taskId;
             if (!taskId)
                 return;
-            taskStore.markTaskCompleted(taskId, "done");
+            taskStore.markTaskComplete(taskId, TASK_STATUS.COMPLETE);
             const task = taskStore.getTask(taskId);
             const unblocked = task ? taskStore.checkAndUnblock(task.projectId) : [];
             sendWs(ws, {
-                type: "task_approved",
+                type: "task_completed",
                 payload: {
                     taskId,
                     unblockedTaskIds: unblocked.map((t) => t.id),
                 },
             });
+            if (task) {
+                broadcast({
+                    type: "task_completed",
+                    payload: { taskId, projectId: task.projectId },
+                });
+            }
             break;
         }
-        case "reject_task": {
+        case "resume_task": {
             const taskId = msg.payload?.taskId;
-            const reviewNotes = msg.payload?.reviewNotes || "";
             if (!taskId)
                 return;
             const task = taskStore.getTask(taskId);
-            if (!task)
+            if (!task) {
+                sendWs(ws, { type: "error", payload: { message: `Task not found: ${taskId}` } });
+                return;
+            }
+            const latestSession = sessionStore.getLatestSessionForTask(taskId);
+            if (!latestSession) {
+                sendWs(ws, { type: "error", payload: { message: `Task ${taskId} has no sessions to resume` } });
                 return;
-            // Use computed status (derived from session history) since the stored
-            // status is never explicitly set to "review".
-            const taskSessions = sessionStore.listSessionsByTaskIds([taskId]);
-            const { status: effectiveStatus } = computeTaskStatus(task.status, taskSessions);
-            if (effectiveStatus !== "review") {
+            }
+            if (![SESSION_STATUS.INTERRUPTED, SESSION_STATUS.COMPLETED].includes(latestSession.status)) {
                 sendWs(ws, {
                     type: "error",
-                    payload: {
-                        message: `Task cannot be rejected (status: ${effectiveStatus})`,
-                    },
+                    payload: { message: `Latest session ${latestSession.id} is not resumable (status: ${latestSession.status})` },
                 });
                 return;
             }
-            // Preserve runtime/model from the previous session so the retry
-            // doesn't unexpectedly switch runtimes/models.
-            const previousSession = sessionStore.getLatestSessionForTask(task.id);
-            // Store review notes and reset status to "pending" so computeTaskStatus
-            // can derive the effective status from the new retry session.  We use
-            // "pending" rather than "assigned" because rejection + retry is an
-            // automated flow — "assigned" implies deliberate human assignment.
-            taskStore.updateTask(task.id, task.title, task.description, "pending", safeParseJsonArray(task.dependsOn), reviewNotes);
-            broadcast({
-                type: "task_rejected",
-                payload: { taskId, projectId: task.projectId },
-            });
-            // Auto-retry: start a new session with the review feedback
-            const freshTask = taskStore.getTask(taskId);
-            if (freshTask) {
-                const retryError = await startTaskSession(ws, freshTask, {
-                    runtime: previousSession?.runtime,
-                    model: previousSession?.model,
-                    environmentId: previousSession?.environmentId,
-                    personaId: previousSession?.personaId,
+            if (!latestSession.runtimeSessionId) {
+                sendWs(ws, {
+                    type: "error",
+                    payload: { message: `Latest session ${latestSession.id} has no runtime session ID — cannot resume` },
                 });
-                if (retryError) {
-                    // Retry failed — set status to "assigned" so the user can retry manually.
-                    logger.warn({ taskId, error: retryError }, "Auto-retry after rejection failed — task set to assigned");
-                    taskStore.updateTask(freshTask.id, freshTask.title, freshTask.description, "assigned", safeParseJsonArray(freshTask.dependsOn), freshTask.reviewNotes);
-                    broadcast({
-                        type: "task_updated",
-                        payload: { taskId, projectId: freshTask.projectId },
-                    });
-                }
+                return;
+            }
+            const env = envRegistry.getEnvironment(latestSession.environmentId);
+            if (!env) {
+                sendWs(ws, { type: "error", payload: { message: `Environment not found: ${latestSession.environmentId}` } });
+                return;
             }
+            const conn = await autoProvisionEnvironment(ws, latestSession.environmentId, env, { taskId });
+            if (!conn) {
+                return;
+            }
+            const powerlineReq = create(powerline.ResumeRequestSchema, {
+                sessionId: latestSession.id,
+                runtimeSessionId: latestSession.runtimeSessionId,
+                runtime: latestSession.runtime,
+            });
+            const logPath = latestSession.logPath || join(grackleHome, LOGS_DIR, latestSession.id);
+            processEventStream(conn.client.resume(powerlineReq), {
+                sessionId: latestSession.id,
+                logPath,
+                projectId: task.projectId,
+                taskId: task.id,
+            });
+            broadcast({
+                type: "task_started",
+                payload: { taskId: task.id, sessionId: latestSession.id, projectId: task.projectId },
+            });
             break;
         }
         case "delete_task": {
@@ -1037,12 +1030,12 @@ async function handleMessage(ws, msg, subscriptions) {
                         logger.warn({ taskId, sessionId: activeSession.id, err }, "Failed to kill session during task deletion");
                     }
                 }
-                sessionStore.updateSession(activeSession.id, "killed");
+                sessionStore.updateSession(activeSession.id, SESSION_STATUS.INTERRUPTED);
                 streamHub.publish(create(grackle.SessionEventSchema, {
                     sessionId: activeSession.id,
                     type: grackle.EventType.STATUS,
                     timestamp: new Date().toISOString(),
-                    content: "killed",
+                    content: SESSION_STATUS.INTERRUPTED,
                     raw: "",
                 }));
             }
@@ -1126,7 +1119,7 @@ async function handleMessage(ws, msg, subscriptions) {
             if (!taskId)
                 return;
             const task = taskStore.getTask(taskId);
-            if (!task || !task.branch) {
+            if (!task?.branch) {
                 sendWs(ws, {
                     type: "task_diff",
                     payload: { taskId, error: "No branch" },
@@ -1402,7 +1395,10 @@ async function handleMessage(ws, msg, subscriptions) {
                 logger.warn({ err }, "Failed to list codespaces");
                 sendWs(ws, {
                     type: "codespaces_list",
-                    payload: { codespaces: [], error: String(err) },
+                    payload: {
+                        codespaces: [],
+                        error: formatGhError(err, "list codespaces"),
+                    },
                 });
             }
             break;
@@ -1417,15 +1413,17 @@ async function handleMessage(ws, msg, subscriptions) {
                 return;
             }
             const trimmedRepo = repo.trim();
+            const machine = typeof msg.payload?.machine === "string"
+                ? msg.payload.machine.trim()
+                : "";
+            const createArgs = ["codespace", "create", "--repo", trimmedRepo];
+            if (machine) {
+                createArgs.push("--machine", machine);
+            }
             try {
-                const result = await exec("gh", [
-                    "codespace",
-                    "create",
-                    "--repo",
-                    trimmedRepo,
-                    "--machine",
-                    "basicLinux32gb",
-                ], { timeout: GH_CODESPACE_CREATE_TIMEOUT_MS });
+                const result = await exec("gh", createArgs, {
+                    timeout: GH_CODESPACE_CREATE_TIMEOUT_MS,
+                });
                 const codespaceName = result.stdout.trim();
                 sendWs(ws, {
                     type: "codespace_created",
@@ -1436,7 +1434,7 @@ async function handleMessage(ws, msg, subscriptions) {
                 logger.error({ err, repo }, "Failed to create codespace");
                 sendWs(ws, {
                     type: "codespace_create_error",
-                    payload: { message: String(err) },
+                    payload: { message: formatGhError(err, "create codespace") },
                 });
             }
             break;
@@ -1489,6 +1487,26 @@ async function handleMessage(ws, msg, subscriptions) {
             broadcast({ type: "token_changed" });
             break;
         }
+        case "get_credential_providers": {
+            const config = credentialProviders.getCredentialProviders();
+            sendWs(ws, {
+                type: "credential_providers",
+                payload: config,
+            });
+            break;
+        }
+        case "set_credential_providers": {
+            if (!credentialProviders.isValidCredentialProviderConfig(msg.payload)) {
+                sendWs(ws, { type: "error", payload: { message: "invalid credential provider config" } });
+                return;
+            }
+            credentialProviders.setCredentialProviders(msg.payload);
+            broadcast({
+                type: "credential_providers",
+                payload: credentialProviders.getCredentialProviders(),
+            });
+            break;
+        }
     }
 }
 function sendWs(ws, msg) {