@hecer/yoke 1.9.0 → 1.11.0

package/dist/agents/supervision.js

@@ -0,0 +1,153 @@
+import { randomUUID } from 'node:crypto';
+import { mkdirSync, writeFileSync, renameSync, readFileSync, readdirSync, lstatSync } from 'node:fs';
+import { join } from 'node:path';
+import { processIncarnation } from './process-incarnation.js';
+import { loadConfig } from '../retrofit/config.js';
+export function supervisionLimits(cwd) {
+    const loop = loadConfig(cwd)?.loop;
+    return { totalMs: (loop?.maxCallMinutes ?? 30) * 60_000, progressMs: (loop?.progressTimeoutMinutes ?? 20) * 60_000 };
+}
+export function assertPreviousProvidersStopped(cwd) {
+    if (readSupervision(cwd, '').some(record => record.state === 'termination-unconfirmed' && record.liveness !== 'exited')) {
+        throw Error('A previous provider termination is unconfirmed; inspect owned process records before starting another worker');
+    }
+}
+/** Only provider error/tool-result envelopes are failure evidence; stderr MCP chatter is not. */
+export function inspectProviderEvent(line) {
+    let event;
+    try {
+        event = JSON.parse(line);
+    }
+    catch {
+        return {};
+    }
+    if (!event || typeof event !== 'object')
+        return {};
+    const item = event.item;
+    const failedCommand = event.type === 'item.completed' && item?.type === 'command_execution' && (item.status === 'failed' || (typeof item.exit_code === 'number' && item.exit_code !== 0));
+    const fatal = event.type === 'error' || event.type === 'turn.failed' || (event.type === 'result' && (event.is_error === true || event.status === 'error'));
+    if (failedCommand || fatal) {
+        const details = JSON.stringify(failedCommand ? item.aggregated_output : event.error ?? event.errors ?? event.result ?? event.message);
+        if (/CreateProcess(?:AsUserW|W)? failed|Failed to create unified exec process/iu.test(details ?? ''))
+            return { failure: 'worker-shell-spawn-failed' };
+        if (/AuthRequired|authentication failed|invalid api key|No access token|credentials (?:missing|not found)/iu.test(details ?? ''))
+            return { failure: 'provider-authentication-failed' };
+        if (fatal)
+            return { failure: 'provider-terminal-error' };
+    }
+    return { progress: (event.type === 'item.completed' && ((item?.type === 'command_execution' && item.exit_code === 0) || (item?.type === 'file_change' && item.status === 'completed')))
+            || (event.type === 'tool_result' && event.status === 'success')
+            || (event.type === 'user' && Array.isArray(event.message?.content) && event.message.content.some((part) => part.type === 'tool_result' && part.is_error === false)) };
+}
+export function inspectProviderDiagnostic(line) {
+    if (/\bERROR codex_core::tools::router: error=exec_command failed: CreateProcess\b/u.test(line) && /CreateProcess(?:AsUserW|W)? failed/u.test(line))
+        return 'worker-shell-spawn-failed';
+    // Unrelated rmcp/MCP authentication diagnostics are intentionally excluded.
+    if (/^(?:Error: |error: )(?:authentication failed|invalid api key|No access token)/iu.test(line))
+        return 'provider-authentication-failed';
+    return undefined;
+}
+export function createSupervision(cwd, onFailure, onProgress = () => { }, attempt = 1) {
+    const id = randomUUID(), dir = join(cwd, '.yoke', 'supervision'), path = join(dir, id + '.json');
+    const now = () => new Date().toISOString();
+    const state = { id, supervisorPid: process.pid, startedAt: now(), heartbeatAt: now(), state: 'preflight', retry: Math.max(0, attempt - 1) };
+    let pending = '', stderrPending = '', terminal = false, failure;
+    const save = () => {
+        state.heartbeatAt = now();
+        mkdirSync(dir, { recursive: true });
+        const temp = path + '.tmp';
+        writeFileSync(temp, JSON.stringify(state));
+        renameSync(temp, path);
+    };
+    save();
+    const timer = setInterval(() => { if (!terminal)
+        save(); }, 5000);
+    timer.unref();
+    return {
+        state,
+        flush() { if (pending)
+            this.output('stdout', '\n'); if (stderrPending)
+            this.output('stderr', '\n'); },
+        start(pid, shell, incarnation) { state.childPid = pid; state.childIncarnation = incarnation; state.shell = shell; state.state = 'running'; save(); },
+        output(stream, text) {
+            state.lastOutputAt = now();
+            const lines = ((stream === 'stdout' ? pending : stderrPending) + text).split(/\r?\n/u);
+            const tail = lines.pop() ?? '';
+            if (stream === 'stdout')
+                pending = tail.length > 262144 ? '' : tail;
+            else
+                stderrPending = tail.length > 262144 ? '' : tail;
+            for (const line of lines) {
+                if (line.length > 262144)
+                    continue;
+                const result = stream === 'stdout' ? inspectProviderEvent(line) : { failure: inspectProviderDiagnostic(line) };
+                if (result.progress) {
+                    state.lastProgressAt = now();
+                    onProgress();
+                }
+                if (result.failure && !failure) {
+                    failure = result.failure;
+                    state.reason = failure;
+                    state.state = 'stopping';
+                    save();
+                    onFailure(failure);
+                }
+            }
+        },
+        stop(reason, confirmed = true) { terminal = true; clearInterval(timer); state.reason = failure ?? reason; state.state = confirmed ? 'stopped' : 'termination-unconfirmed'; save(); },
+        get failure() { return failure; },
+    };
+}
+export function readSupervision(root, since) {
+    const roots = [root];
+    try {
+        for (const name of readdirSync(join(root, '.yoke', 'worktrees')).slice(0, 100)) {
+            const path = join(root, '.yoke', 'worktrees', name);
+            if (lstatSync(path).isDirectory() && !lstatSync(path).isSymbolicLink())
+                roots.push(path);
+        }
+    }
+    catch { /* no isolated workers */ }
+    const records = [];
+    for (const cwd of roots) {
+        const dir = join(cwd, '.yoke', 'supervision');
+        try {
+            if (lstatSync(dir).isSymbolicLink())
+                continue;
+            for (const name of readdirSync(dir).filter(n => n.endsWith('.json')).slice(-200)) {
+                const path = join(dir, name), stat = lstatSync(path);
+                if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 8192)
+                    continue;
+                try {
+                    const record = JSON.parse(readFileSync(path, 'utf8'));
+                    if (typeof record.startedAt === 'string' && record.startedAt >= since && typeof record.heartbeatAt === 'string')
+                        records.push(record);
+                }
+                catch { /* incomplete/untrusted state */ }
+            }
+        }
+        catch { /* no process evidence */ }
+    }
+    return records.sort((a, b) => b.startedAt.localeCompare(a.startedAt)).slice(0, 20).map(record => ({ ...record, liveness: processLiveness(record) }));
+}
+const identities = new Map();
+function processLiveness(record) {
+    if (!Number.isInteger(record.childPid) || record.childPid <= 0)
+        return 'identity-unverified';
+    try {
+        process.kill(record.childPid, 0);
+    }
+    catch (error) {
+        return error.code === 'ESRCH' ? 'exited' : 'identity-unverified';
+    }
+    if (!record.childIncarnation)
+        return 'identity-unverified';
+    let identity = identities.get(record.childPid);
+    if (!identity || Date.now() - identity.at > 5000) {
+        identity = { at: Date.now(), value: processIncarnation(record.childPid) };
+        identities.set(record.childPid, identity);
+        if (identities.size > 100)
+            identities.delete(identities.keys().next().value);
+    }
+    return identity.value === record.childIncarnation ? 'alive' : 'identity-unverified';
+}

package/dist/agents/telemetry.js

@@ -45,6 +45,10 @@ export function parseProviderResult(agent, output) {
                 if (event.type === 'message' && event.role === 'assistant' && typeof event.content === 'string')
                     fragments.push(event.content);
                 break;
+            case 'qwen':
+                if (event.type === 'message' && event.role === 'assistant' && typeof event.content === 'string')
+                    fragments.push(event.content);
+                break;
         }
     }
     const joined = parseJson(fragments.join(''));
@@ -130,6 +134,35 @@ export function parseProviderTelemetry(agent, lines) {
             if (aggregateCached !== undefined)
                 source.cached_input_tokens = aggregateCached;
         }
+        if (agent === 'qwen' && modelEntries.length > 0) {
+            reportedModels = modelEntries.map(([name]) => name);
+            model = firstModel?.[0];
+            const fields = {
+                input_tokens: ['input_tokens', 'inputTokens', 'promptTokenCount', 'input'],
+                output_tokens: ['output_tokens', 'outputTokens', 'candidatesTokenCount', 'output'],
+                cached_input_tokens: ['cached_input_tokens', 'cachedInputTokens', 'cachedContentTokenCount', 'cached'],
+                reasoning_output_tokens: ['reasoning_output_tokens', 'reasoningOutputTokens', 'thoughtsTokenCount', 'thoughts'],
+            };
+            const totals = {};
+            for (const [field, aliases] of Object.entries(fields)) {
+                const aggregate = aliases.map(key => finite(usage?.[key])).find(value => value !== undefined);
+                if (aggregate !== undefined) {
+                    totals[field] = aggregate;
+                    continue;
+                }
+                const values = modelEntries.map(([, value]) => {
+                    const entry = isRecord(value) ? value : {};
+                    const tokens = isRecord(entry.tokens) ? entry.tokens : entry;
+                    return aliases.map(key => finite(tokens[key])).find(value => value !== undefined);
+                });
+                if (values.every(value => value !== undefined))
+                    totals[field] = values.reduce((sum, value) => sum + value, 0);
+            }
+            source = { ...totals, ...usage };
+            const aggregateCached = finite(usage?.cached_input_tokens ?? usage?.cached);
+            if (aggregateCached !== undefined)
+                source.cached_input_tokens = aggregateCached;
+        }
         const inValue = finite(source?.input_tokens ?? source?.inputTokens ?? source?.prompt_tokens ?? source?.promptTokenCount ?? source?.input);
         const cachedValue = finite(source?.cached_input_tokens ?? source?.cache_read_input_tokens ?? source?.cachedInputTokens ?? source?.cachedContentTokenCount ?? source?.cached);
         const cacheWriteValue = finite(source?.cache_write_input_tokens ?? source?.cache_creation_input_tokens ?? source?.cacheWriteInputTokens ?? source?.cacheWrite);

package/dist/agents/windows-launch.js

@@ -0,0 +1,80 @@
+import { existsSync, readFileSync, realpathSync, statSync } from 'node:fs';
+import { delimiter, dirname, extname, isAbsolute, join, resolve } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { createRequire } from 'node:module';
+const file = (path) => { try {
+    return statSync(path).isFile();
+}
+catch {
+    return false;
+} };
+const pathValue = (env) => env[Object.keys(env).find(k => k.toLowerCase() === 'path') ?? 'PATH'] ?? '';
+/** Resolve npm launchers without cmd.exe argument concatenation. */
+export function resolveWindowsCommand(command, args, env = process.env) {
+    if (command === 'node' || command === process.execPath)
+        return { command: process.execPath, args: [...args] };
+    if (isAbsolute(command) && /\.(exe|com)$/iu.test(command))
+        return { command, args: [...args] };
+    const candidates = isAbsolute(command) || /[\\/]/u.test(command) ? [command]
+        : pathValue(env).split(';').filter(Boolean).flatMap(dir => extname(command) ? [join(dir, command)] : ['.exe', '.com', '.cmd', '.bat'].map(ext => join(dir, command + ext)));
+    const found = candidates.find(file);
+    if (!found)
+        throw Error(`Provider executable unavailable: ${command}`);
+    if (/\.(exe|com)$/iu.test(found))
+        return { command: found, args: [...args] };
+    const script = readFileSync(found, 'utf8');
+    const entry = script.match(/"%dp0%[\\/]([^"\r\n]+\.(?:m?js|cjs))"/iu)?.[1];
+    if (!entry)
+        throw Error('Unsupported Windows batch launcher; use a native executable or an npm-generated CLI launcher');
+    const target = resolve(dirname(found), ...entry.split(/[\\/]/u));
+    if (!file(target))
+        throw Error('Provider npm entry point is missing');
+    const localNode = join(dirname(found), 'node.exe');
+    return { command: file(localNode) ? localNode : process.execPath, args: [target, ...args] };
+}
+export function inaccessibleStoreShell(path) {
+    const bad = (p) => /[\\/]WindowsApps[\\/](?:Microsoft\.PowerShell[^\\/]*[\\/]|(?:pwsh|powershell)\.exe$)/iu.test(p);
+    if (bad(path))
+        return true;
+    try {
+        return bad(realpathSync(path));
+    }
+    catch {
+        return false;
+    }
+}
+export function windowsShellEnvironment(env = process.env) {
+    // Change only this provider's PATH. Never change machine/user configuration or permissions.
+    const paths = pathValue(env).split(';').filter(Boolean).filter(dir => !['pwsh.exe', 'powershell.exe'].some(name => inaccessibleStoreShell(join(dir, name))));
+    const nativePwsh = join(env.ProgramFiles ?? 'C:\\Program Files', 'PowerShell', '7', 'pwsh.exe');
+    const systemShell = join(env.SystemRoot ?? 'C:\\Windows', 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+    const shell = [...paths.map(p => join(p, 'pwsh.exe')), nativePwsh, ...paths.map(p => join(p, 'powershell.exe')), systemShell].find(p => file(p) && !inaccessibleStoreShell(p));
+    if (!shell)
+        throw Error('No native PowerShell available for sandbox preflight');
+    const next = { ...env };
+    for (const key of Object.keys(next))
+        if (key.toLowerCase() === 'path')
+            delete next[key];
+    next.PATH = [dirname(shell), ...paths].join(delimiter);
+    return { env: next, shell };
+}
+/** Model-free probe under the same Codex permission profile and isolated cwd. */
+export function prepareWindowsInvocation(inv, env = process.env) {
+    if (inv.command !== 'codex' || !inv.args.includes('exec') || inv.args.includes('--dangerously-bypass-approvals-and-sandbox'))
+        return { ...resolveWindowsCommand(inv.command, inv.args, env), env };
+    const prepared = windowsShellEnvironment(env);
+    const readOnly = inv.args.includes('read-only');
+    const config = ['--config', `shell_environment_policy.set.PATH=${JSON.stringify(prepared.env.PATH)}`];
+    const probe = resolveWindowsCommand('codex', ['sandbox', '-P', readOnly ? ':read-only' : ':workspace', '-C', inv.cwd, ...config, '--', prepared.shell, '-NoProfile', '-NonInteractive', '-Command', 'Write-Output YOKE_SHELL_OK'], prepared.env);
+    const compiled = fileURLToPath(new URL('../loop/watchdog.js', import.meta.url));
+    const watchdog = existsSync(compiled) ? [compiled] : ['--import', pathToFileURL(createRequire(import.meta.url).resolve('tsx')).href, fileURLToPath(new URL('../loop/watchdog.ts', import.meta.url))];
+    // The inner watchdog owns the native process tree. Killing only an npm wrapper
+    // on spawnSync timeout could otherwise leave the sandbox helper behind.
+    const result = spawnSync(process.execPath, [...watchdog, '--idle-ms=30000', '--total-ms=30000', '--', probe.command, ...probe.args], { cwd: inv.cwd, env: prepared.env, shell: false, windowsHide: true, encoding: 'utf8', timeout: 90_000, maxBuffer: 64 * 1024 });
+    if (result.status !== 0 || !result.stdout?.includes('YOKE_SHELL_OK')) {
+        const signature = /CreateProcessAsUserW failed:\s*-?\d+/u.exec(result.stderr ?? '')?.[0];
+        throw Error(`Codex sandbox preflight failed (${signature ?? result.error?.code ?? result.status ?? 'no completion'}); no model started. Check native PowerShell and Codex sandbox setup.`);
+    }
+    return { ...resolveWindowsCommand(inv.command, [...inv.args, ...config], prepared.env), ...prepared };
+}

package/dist/canon/manifest.js

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 import { parse } from 'yaml';
 import { readFileSync } from 'node:fs';
-export const AgentSchema = z.enum(['claude', 'codex', 'gemini']);
+export const AgentSchema = z.enum(['claude', 'codex', 'gemini', 'qwen']);
 export const InvocationSchema = z.enum(['auto', 'manual']);
 export const SkillEntrySchema = z.object({
     id: z.string().min(1),

package/dist/change/inbox.js

@@ -1,4 +1,8 @@
 import { assessmentInstructions } from "../routing/assessment.js";
+import { bindAssessments, preparedProblems } from '../prd/assess.js';
+import { loadConfig } from '../retrofit/config.js';
+import { resolvePlanner } from '../routing/planning.js';
+import { readPlanningFile } from '../routing/contracts.js';
 import { randomUUID } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from 'node:fs';
@@ -88,13 +92,14 @@ export function pendingChanges(targetDir) {
         .map(name => ChangeRequestSchema.parse(JSON.parse(readFileSync(join(dir, name), 'utf8'))))
         .sort((a, b) => a.createdAt.localeCompare(b.createdAt) || a.id.localeCompare(b.id));
 }
-export function buildChangePrompt(request, proposalPath, stories) {
+export function buildChangePrompt(request, proposalPath, stories, brief = '') {
     return [
         'You are planning one newly requested product change for the Yoke autonomous loop.',
         `Change request ${request.id}: ${request.request}`,
         '',
         'Create an append-only proposal: add small new stories; never rewrite or delete existing stories.',
         assessmentInstructions,
+        ...(brief ? ['Approved planning brief:', brief] : []),
         `Existing story IDs: ${stories.map(story => story.id).join(', ') || '(none)'}`,
         'Every proposed story must have passes: false and 2-5 structured acceptance criteria.',
         'Every criterion must have a stable id, behavioral text, and one or more executable verify commands.',
@@ -128,6 +133,9 @@ function archiveRequest(targetDir, request) {
     rmSync(reviewFile(targetDir, request.id), { force: true });
 }
 export function runChangeApply(targetDir, opts) {
+    const config = loadConfig(targetDir);
+    const planner = resolvePlanner(config, opts.runner, opts.selection);
+    opts = { ...opts, runner: planner.agent, selection: planner.selection };
     let requests;
     try {
         requests = pendingChanges(targetDir);
@@ -170,15 +178,16 @@ export function runChangeApply(targetDir, opts) {
     if (!available(reviewer))
         return { ok: false, added: 0, summary: `reviewer CLI "${reviewer}" is unavailable`, changeId: request.id };
     const proposal = proposalFile(targetDir, request.id);
+    const brief = readPlanningFile(targetDir, '.yoke/plan.md', 80_000) ?? '';
     const plannerDir = changesDir(targetDir);
     mkdirSync(plannerDir, { recursive: true });
     rmSync(proposal, { force: true });
-    const base = agentInvocation(opts.runner, buildChangePrompt(request, proposal, existing), plannerDir, opts.permissions ?? 'safe', opts.selection);
+    const base = agentInvocation(opts.runner, buildChangePrompt(request, proposal, existing, brief), plannerDir, opts.permissions ?? 'safe', opts.selection);
     const invocation = buildWatchdogInvocation(base, opts.timeoutMs ?? 0);
     const result = (opts.run ?? runAgent)(invocation);
     if (!result.success)
         return { ok: false, added: 0, summary: `planner failed: ${result.summary}`, changeId: request.id };
-    if (readFileSync(prdPath, 'utf8') !== existingText) {
+    if (readFileSync(prdPath, 'utf8') !== existingText || (readPlanningFile(targetDir, '.yoke/plan.md', 80_000) ?? '') !== brief) {
         return {
             ok: false,
             added: 0,
@@ -221,12 +230,19 @@ export function runChangeApply(targetDir, opts) {
         }
         proposedIds.add(story.id);
     }
-    const appended = proposed.map(story => ({ ...story, sourceChange: request.id }));
+    let appended = proposed.map(story => ({ ...story, sourceChange: request.id }));
     const dependencyIssues = validateDependencies([...existing, ...appended]);
     if (dependencyIssues.length > 0) {
         return { ok: false, added: 0, summary: `invalid combined dependency graph: ${dependencyIssues.join('; ')}`, changeId: request.id };
     }
     const reviewPath = reviewFile(targetDir, request.id);
+    const bound = bindAssessments([...existing, ...appended], brief);
+    appended = bound.slice(existing.length).map(s => ({ ...s, sourceChange: request.id }));
+    if (config?.routing?.assessmentPolicy === 'prepared') {
+        const issues = preparedProblems(bound, brief).filter(issue => appended.some(s => issue.startsWith(s.id + ':')));
+        if (issues.length)
+            return { ok: false, added: 0, summary: issues.join('; '), changeId: request.id };
+    }
     rmSync(reviewPath, { force: true });
     const reviewBase = agentInvocation(reviewer, buildChangeReviewPrompt(request, reviewPath, appended), plannerDir, opts.permissions ?? 'safe', reviewer === opts.runner ? opts.selection : undefined);
     const reviewInvocation = buildWatchdogInvocation(reviewBase, opts.timeoutMs ?? 0);
@@ -234,7 +250,7 @@ export function runChangeApply(targetDir, opts) {
     if (!reviewResult.success) {
         return { ok: false, added: 0, summary: `coverage review failed: ${reviewResult.summary}`, changeId: request.id };
     }
-    if (readFileSync(prdPath, 'utf8') !== existingText) {
+    if (readFileSync(prdPath, 'utf8') !== existingText || (readPlanningFile(targetDir, '.yoke/plan.md', 80_000) ?? '') !== brief) {
         return {
             ok: false, added: 0,
             summary: 'PRD changed while the coverage reviewer was running; refusing to overwrite concurrent or out-of-contract edits',

package/dist/cli.js

@@ -13,6 +13,7 @@ import { runReview } from './review/command.js';
 import { scanDir } from './scan/design.js';
 import { runNew } from './new/command.js';
 import { runPrdDraft, runPrdCheck } from './prd/command.js';
+import { runPrdAssess } from './prd/assess.js';
 import { runLoopCleanup } from './loop/cleanup.js';
 import { runFlowSmoke } from './smoke/command.js';
 import { maybeNotifyUpdate, currentYokeVersion } from './update/check.js';
@@ -103,7 +104,7 @@ export function main(argv) {
     switch (cmd) {
         case 'setup': {
             const targetDir = rest.find(a => !a.startsWith('-')) ?? '.';
-            const valid = ['claude', 'codex', 'gemini'];
+            const valid = ['claude', 'codex', 'gemini', 'qwen'];
             const hostArg = rest.find(a => a.startsWith('--host='))?.slice('--host='.length);
             if (hostArg && !valid.includes(hostArg)) {
                 console.error(`Invalid --host value: ${hostArg}`);
@@ -225,7 +226,7 @@ export function main(argv) {
                 }
                 if (sub === 'run' || sub === 'resume') {
                     const provider = value('runner') ?? 'codex';
-                    if (!['codex', 'claude', 'gemini'].includes(provider))
+                    if (!['codex', 'claude', 'gemini', 'qwen'].includes(provider))
                         throw new Error('Unknown runner');
                     return runProjectGoal(targetDir, { provider: provider, selection: { model: value('model') } }).then(goal => {
                         console.log(JSON.stringify(goal));
@@ -268,7 +269,7 @@ export function main(argv) {
             const targetDir = rest.find(a => !a.startsWith('-')) ?? '.';
             const loop = rest.includes('--loop');
             const agentArg = rest.find(a => a.startsWith('--agent='))?.slice('--agent='.length);
-            const all = ['claude', 'codex', 'gemini'];
+            const all = ['claude', 'codex', 'gemini', 'qwen'];
             const agents = !agentArg || agentArg === 'all'
                 ? (agentArg === 'all' ? all : undefined)
                 : agentArg.split(',').filter((a) => all.includes(a));
@@ -467,10 +468,10 @@ export function main(argv) {
                     return 1;
                 }
                 const runnerArg = rest.find(a => a.startsWith('--runner='))?.slice('--runner='.length);
-                const valid = ['claude', 'codex', 'gemini'];
+                const valid = ['claude', 'codex', 'gemini', 'qwen'];
                 const agent = runnerArg && valid.includes(runnerArg) ? runnerArg : undefined;
                 if (runnerArg && !agent) {
-                    console.error(`Invalid --runner value: ${runnerArg} (expected claude|codex|gemini)`);
+                    console.error(`Invalid --runner value: ${runnerArg} (expected claude|codex|gemini|qwen)`);
                     return 1;
                 }
                 const isolate = rest.includes('--isolate') ? true : rest.includes('--no-isolate') ? false : undefined;
@@ -533,7 +534,7 @@ export function main(argv) {
             const idea = rest.find(a => a.startsWith('--idea='))?.slice('--idea='.length);
             const loop = rest.includes('--loop');
             const agentArg = rest.find(a => a.startsWith('--agent='))?.slice('--agent='.length);
-            const all = ['claude', 'codex', 'gemini'];
+            const all = ['claude', 'codex', 'gemini', 'qwen'];
             const agents = !agentArg || agentArg === 'all'
                 ? (agentArg === 'all' ? all : undefined)
                 : agentArg.split(',').filter((a) => all.includes(a));
@@ -550,16 +551,24 @@ export function main(argv) {
         case 'prd': {
             const sub = rest[0];
             const targetDir = rest.slice(1).find(a => !a.startsWith('-')) ?? '.';
+            if (sub === 'assess') {
+                const runner = rest.find(a => a.startsWith('--runner='))?.slice('--runner='.length);
+                if (runner && !['codex', 'claude', 'gemini', 'qwen'].includes(runner)) {
+                    console.error('Invalid planning runner');
+                    return 1;
+                }
+                return runPrdAssess(targetDir, { runner: runner, story: rest.find(a => a.startsWith('--story='))?.slice('--story='.length), reassess: rest.includes('--reassess') });
+            }
             if (sub === 'draft') {
                 const idea = rest.find(a => a.startsWith('--idea='))?.slice('--idea='.length);
                 if (!idea) {
                     console.error('usage: yoke prd draft [dir] --idea="..." [--runner=<claude|codex|gemini>] [--force] [--timeout=<minutes>]');
                     return 1;
                 }
-                const valid = ['claude', 'codex', 'gemini'];
+                const valid = ['claude', 'codex', 'gemini', 'qwen'];
                 const runnerArg = rest.find(a => a.startsWith('--runner='))?.slice('--runner='.length);
                 if (runnerArg && !valid.includes(runnerArg)) {
-                    console.error(`Invalid --runner value: ${runnerArg} (expected claude|codex|gemini)`);
+                    console.error(`Invalid --runner value: ${runnerArg} (expected claude|codex|gemini|qwen)`);
                     return 1;
                 }
                 const force = rest.includes('--force');
@@ -577,7 +586,7 @@ export function main(argv) {
             }
             if (sub === 'check')
                 return runPrdCheck(targetDir);
-            console.log('usage: yoke prd <draft|check> [dir] [--idea="..."] [--runner=<claude|codex|gemini>] [--force] [--timeout=<minutes>]');
+            console.log('usage: yoke prd <draft|check|assess> [dir] [--idea="..."] [--runner=<claude|codex|gemini>] [--story=<id>] [--reassess] [--force] [--timeout=<minutes>]');
             return 1;
         }
         case 'context': {
@@ -642,7 +651,7 @@ export function main(argv) {
             return runUpgrade();
         default:
             console.log('Project workflows: yoke check [dir] [--json|--protect] | goal set|run|resume|pause|status|handoff|budget [dir] | projects add|list|remove | dashboard [dir] [--port=N]');
-            console.log('usage: yoke <setup [dir] | new <dir> [--idea="..."] | validate [canonDir] | retrofit [targetDir] [--agent=claude,codex,gemini|all] [--code-graph=graphify|serena] [--loop] | change <add|status> [dir] | prd <draft|check> [dir] | loop <on|off|status|decision|answer|resume|run|cleanup> | context <init|status> | review [dir] [--reviewer=<claude|codex|gemini>] [--base=<ref>] [--focus="..."] | design-scan [dir] [--max=N] [--report] | flow-smoke [dir] [--url=<baseUrl>] [--label=<name>] | upgrade>');
+            console.log('usage: yoke <setup [dir] | new <dir> [--idea="..."] | validate [canonDir] | retrofit [targetDir] [--agent=claude,codex,gemini|all] [--code-graph=graphify|serena] [--loop] | change <add|status> [dir] | prd <draft|check|assess> [dir] | loop <on|off|status|decision|answer|resume|run|cleanup> | context <init|status> | review [dir] [--reviewer=<claude|codex|gemini>] [--base=<ref>] [--focus="..."] | design-scan [dir] [--max=N] [--report] | flow-smoke [dir] [--url=<baseUrl>] [--label=<name>] | upgrade>');
             return cmd ? 1 : 0;
     }
 }

package/dist/dashboard/discovery.js

@@ -0,0 +1,73 @@
+import { opendir, lstat, realpath } from 'node:fs/promises';
+import { delimiter, dirname, join, parse, resolve } from 'node:path';
+import { autoRegisterProject, listProjects } from './registry.js';
+const skip = new Set(['node_modules', 'vendor', 'dist', 'build', 'coverage', 'bench', 'fixtures']);
+export function discoveryRoots() {
+    const configured = process.env.YOKE_PROJECT_ROOTS?.split(delimiter).filter(Boolean);
+    const candidates = configured ?? [dirname(process.cwd()), ...listProjects().filter(p => !p.error).map(p => dirname(p.root))];
+    const roots = [...new Set(candidates.map(p => resolve(p)))].filter(p => p !== parse(p).root);
+    return roots.filter(p => !roots.some(other => other !== p && p.startsWith(other + (process.platform === 'win32' ? '\\' : '/'))));
+}
+/** Incremental traversal keeps directory IO out of the HTTP request path. */
+export function startProjectDiscovery(roots = discoveryRoots) {
+    let stopped = false;
+    let active;
+    let queue = [];
+    let visited = new Set();
+    let current;
+    const scan = async () => {
+        if (!queue.length && !current) {
+            queue = roots();
+            visited = new Set();
+        }
+        let budget = 500;
+        while (!stopped && budget-- > 0 && (current || queue.length)) {
+            if (!current) {
+                const path = queue.shift();
+                try {
+                    if ((await lstat(path)).isSymbolicLink())
+                        continue;
+                    const canonical = await realpath(path);
+                    const key = process.platform === 'win32' ? canonical.toLowerCase() : canonical;
+                    if (visited.has(key))
+                        continue;
+                    visited.add(key);
+                    autoRegisterProject(canonical);
+                    current = await opendir(canonical);
+                }
+                catch {
+                    continue;
+                }
+            }
+            try {
+                const entry = await current.read();
+                if (!entry) {
+                    await current.close();
+                    current = undefined;
+                    continue;
+                }
+                if (entry.isDirectory() && !entry.isSymbolicLink() && !entry.name.startsWith('.') && !skip.has(entry.name.toLowerCase()))
+                    queue.push(join(current.path, entry.name));
+            }
+            catch {
+                try {
+                    await current?.close();
+                }
+                catch { /* Already closed. */ }
+                current = undefined;
+            }
+        }
+    };
+    const tick = () => {
+        if (!active && !stopped)
+            active = scan().catch(() => { }).finally(() => { active = undefined; });
+        return active ?? Promise.resolve();
+    };
+    const timer = setInterval(() => { void tick(); }, 5000);
+    timer.unref();
+    void tick();
+    return { tick, get pending() { return queue.length + (current ? 1 : 0); }, async close() { stopped = true; clearInterval(timer); await active; try {
+            await current?.close();
+        }
+        catch { /* Already closed. */ } } };
+}