@jpcasabiancai/cayenne 0.5.12 → 0.5.14

package/dist/cli.js

@@ -1586,7 +1586,7 @@ var init_documents = __esm({
 
 // ../../packages/shared/src/protocol/events.ts
 import { z as z14 } from "zod";
-var SessionStatus, SessionEvent, SESSION_EVENT_NAME, sessionTopic, runnerTopic, terminalTopic, activityFeedTopic;
+var SessionStatus, RenewalReason, SessionEvent, SESSION_EVENT_NAME, sessionTopic, runnerTopic, terminalTopic, activityFeedTopic;
 var init_events = __esm({
   "../../packages/shared/src/protocol/events.ts"() {
     "use strict";
@@ -1600,6 +1600,13 @@ var init_events = __esm({
       "error",
       "archived"
     ]);
+    RenewalReason = z14.enum([
+      "autopilot_threshold",
+      "threshold",
+      "visibility",
+      "manual",
+      "compaction"
+    ]);
     SessionEvent = z14.discriminatedUnion("type", [
       z14.object({
         type: z14.literal("session.status"),
@@ -1654,7 +1661,16 @@ var init_events = __esm({
         segment: z14.number().int().nonnegative(),
         fromTokens: z14.number().int().optional(),
         toTokens: z14.number().int().optional(),
-        error: z14.string().optional()
+        error: z14.string().optional(),
+        // Added 2026-10-23 (Auto Pilot 03, D62); absent from runners ≤ 0.5.13.
+        reason: RenewalReason.optional()
+      }),
+      // Auto Pilot 03 (D62), protocol §3: sent once after `renewal { phase: 'done' }`, naming the new
+      // segment `n + 1` and why it renewed.
+      z14.object({
+        type: z14.literal("session.renewed"),
+        segment: z14.number().int().min(1),
+        reason: RenewalReason
       })
     ]);
     SESSION_EVENT_NAME = "evt";
@@ -2594,7 +2610,7 @@ var init_registry = __esm({
     "use strict";
     REDACTED = "[REDACTED]";
     MIN_SECRET_LENGTH = 16;
-    GITHUB_TOKEN_SHAPE = /(?:gh[pousr]_|github_pat_)[A-Za-z0-9_]{20,255}/;
+    GITHUB_TOKEN_SHAPE = /(?:ghs_[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+|(?:gh[pousr]_|github_pat_)[A-Za-z0-9_]{20,})/;
     GITHUB_TOKEN_SHAPES = new RegExp(GITHUB_TOKEN_SHAPE.source, "g");
     secrets = createSecretRegistry();
     isError = (value) => value instanceof Error || types.isNativeError(value);
@@ -3469,7 +3485,7 @@ function statusSummary(porcelain) {
   if (lines.length > MAX_STATUS_PATHS) out.push(`  \u2026 ${lines.length - MAX_STATUS_PATHS} more`);
   return out;
 }
-function buildAppendix(git, todos, docs, claims) {
+function buildAppendix(git, todos, docs, claims, extra = []) {
   const out = [APPENDIX_HEADING];
   if (git) {
     out.push(`Branch: ${git.branch === null ? "(detached or none)" : field(git.branch, CAP_PATH)}`);
@@ -3504,7 +3520,9 @@ function buildAppendix(git, todos, docs, claims) {
   } else {
     out.push("Active claims: none");
   }
-  return truncateHead(out.join("\n"), MAX_APPENDIX_TOKENS);
+  const tail = extra.map((section2) => `
+${section2}`).join("");
+  return `${truncateHead(out.join("\n"), MAX_APPENDIX_TOKENS - estimateTokens(tail))}${tail}`;
 }
 function captureHandoff(turn, clock, timeoutMs = HANDOFF_TIMEOUT_MS) {
   return new Promise((resolve7) => {
@@ -10052,7 +10070,7 @@ var init_token_client = __esm({
   "src/repos/token-client.ts"() {
     "use strict";
     init_src();
-    TOKEN_SHAPE = /^[A-Za-z0-9_]{20,255}$/;
+    TOKEN_SHAPE = /^[A-Za-z0-9_.-]{20,}$/;
     DEFAULT_TIMEOUT_MS = 9e4;
   }
 });
@@ -10335,6 +10353,49 @@ var init_attachments2 = __esm({
   }
 });
 
+// src/sessions/autopilot-runs.ts
+function autopilotRunsReader(db, log = logger) {
+  const running = (sessionId, columns) => db.from("autopilot_runs").select(columns).eq("session_id", sessionId).eq("status", "running").maybeSingle();
+  const failed6 = (sessionId, err) => {
+    const e = err;
+    log.warn({ sessionId, code: e?.code, err: e?.message }, "autopilot_runs read failed");
+  };
+  return {
+    isAutopilotRunning: async (sessionId) => {
+      try {
+        const { data, error } = await running(sessionId, "id");
+        if (error) throw error;
+        return data !== null;
+      } catch (err) {
+        failed6(sessionId, err);
+        return false;
+      }
+    },
+    /** Null too for a run `ownerId`, the session's owner, did not start. */
+    autopilotRun: async (sessionId, ownerId) => {
+      try {
+        const { data, error } = await running(sessionId, "objective, done_when, owner_id");
+        if (error) throw error;
+        if (!data || data.owner_id !== ownerId) return null;
+        return {
+          objective: data.objective,
+          doneWhen: data.done_when,
+          unmetDoneWhen: data.done_when
+        };
+      } catch (err) {
+        failed6(sessionId, err);
+        return null;
+      }
+    }
+  };
+}
+var init_autopilot_runs = __esm({
+  "src/sessions/autopilot-runs.ts"() {
+    "use strict";
+    init_log();
+  }
+});
+
 // src/fs/list.ts
 import { readdirSync as readdirSync3, realpathSync as realpathSync12, statSync as statSync7 } from "fs";
 import { join as join22, relative as relative7, sep as sep10 } from "path";
@@ -10851,9 +10912,14 @@ var init_format = __esm({
 });
 
 // src/renewal/threshold.ts
-function renewThreshold(session) {
-  const { workspaceThreshold, window } = session;
-  if (!Number.isFinite(workspaceThreshold) || !Number.isFinite(window) || window <= 0) return null;
+function renewThreshold(s) {
+  const { window, workspaceThreshold } = s;
+  if (window === null || !Number.isFinite(window) || window <= 0) return null;
+  if (s.autopilot) {
+    const t2 = Math.floor(AUTOPILOT_WINDOW_SHARE * window);
+    return t2 > 0 ? t2 : null;
+  }
+  if (!Number.isFinite(workspaceThreshold)) return null;
   const t = Math.min(Math.floor(workspaceThreshold), Math.floor(WINDOW_SHARE * window));
   return t < MIN_RENEW_THRESHOLD ? null : t;
 }
@@ -10873,12 +10939,13 @@ function autoCompactWindowFor(window) {
   const above = Math.floor(WINDOW_SHARE * w) + AUTOCOMPACT_BUFFER + AUTOCOMPACT_MARGIN;
   return Math.min(w, Math.max(Math.floor(0.9 * w), above));
 }
-var MIN_RENEW_THRESHOLD, WINDOW_SHARE, KNOWN_CONTEXT_WINDOWS, AUTOCOMPACT_BUFFER, AUTOCOMPACT_MARGIN;
+var MIN_RENEW_THRESHOLD, WINDOW_SHARE, AUTOPILOT_WINDOW_SHARE, KNOWN_CONTEXT_WINDOWS, AUTOCOMPACT_BUFFER, AUTOCOMPACT_MARGIN;
 var init_threshold = __esm({
   "src/renewal/threshold.ts"() {
     "use strict";
     MIN_RENEW_THRESHOLD = 1e5;
     WINDOW_SHARE = 0.75;
+    AUTOPILOT_WINDOW_SHARE = 0.4;
     KNOWN_CONTEXT_WINDOWS = {
       "claude-opus-5-5": 1e6
     };
@@ -10888,13 +10955,26 @@ var init_threshold = __esm({
 });
 
 // src/renewal/rotation.ts
+function memberContinuation(lastMemberPrompt, mode) {
+  if (lastMemberPrompt === null) return null;
+  return { text: continuationText(lastMemberPrompt), auto: AUTO_CONTINUE_MODES.has(mode) };
+}
 function handoffBlock(segment, handoff) {
-  const frame = (body2) => `${HANDOFF_PREAMBLE}
+  const frame = (body) => `${HANDOFF_PREAMBLE}
 <handoff segment="${segment}">
-${body2}
+${body}
 </handoff>`;
-  const body = truncateHead(escapeAngles(handoff), HANDOFF_MAX_TOKENS - estimateTokens(frame("")));
-  return frame(body);
+  const max = HANDOFF_MAX_TOKENS - estimateTokens(frame(""));
+  const text3 = escapeAngles(handoff);
+  const at = text3.lastIndexOf(`
+
+${APPENDIX_HEADING}
+`);
+  const appendix = at < 0 ? "" : text3.slice(at);
+  if (at < 0 || estimateTokens(appendix) > 2 * MAX_APPENDIX_TOKENS) {
+    return frame(truncateHead(text3, max));
+  }
+  return frame(`${truncateHead(text3.slice(0, at), max - estimateTokens(appendix))}${appendix}`);
 }
 function continuationText(lastMemberPrompt) {
   const quoted3 = lastMemberPrompt.replace(/[«»]/g, '"');
@@ -10911,12 +10991,12 @@ function buildFirstInput(args) {
 ${args.queuedPrompt}`, send: "now" };
   }
   if (args.queuedPrompt !== null) return { text: block, send: "withNextPrompt" };
-  if (args.endedOnNudge && args.lastMemberPrompt !== null) {
+  if (args.endedOnNudge && args.continuation !== null) {
     return {
       text: `${block}
 
-${continuationText(args.lastMemberPrompt)}`,
-      send: AUTO_CONTINUE_MODES.has(args.mode) ? "now" : "continue"
+${args.continuation.text}`,
+      send: args.continuation.auto ? "now" : "continue"
     };
   }
   return { text: block, send: "withNextPrompt" };
@@ -10946,6 +11026,8 @@ var init_rotation = __esm({
       cost = 0;
       handoff = null;
       reason = "renewal";
+      why = "threshold";
+      plainRetry = false;
       /** Why a pending `requestRenew` was made: `manual` unless the runner asked for itself. */
       requested = "manual";
       constructor(options) {
@@ -10962,6 +11044,27 @@ var init_rotation = __esm({
       get enabled() {
         return this.threshold !== null;
       }
+      /**
+       * What decided the current (or last) renewal. A plain retry after a failure keeps it; a
+       * `requestRenew` that is due at that turn end names its own.
+       */
+      get cause() {
+        return this.why;
+      }
+      /** The current renewal is the one retry of a failed one, not asked for again (`cause` kept). */
+      get retrying() {
+        return this.plainRetry;
+      }
+      /**
+       * The threshold changed between turns (an Auto Pilot run started or stopped, Auto Pilot 03).
+       * The next `midTurn` and `turnEnd` go by it, except while `nudged`: the threshold that nudged
+       * stays until that turn end renews, since the model was already told the chat will. Returns
+       * the threshold in effect.
+       */
+      setThreshold(threshold) {
+        if (this.current !== "nudged") this.threshold = threshold;
+        return this.threshold;
+      }
       /** The mode changed (a `setMode` update or a mode command): the continuation follows it. */
       setMode(mode) {
         this.mode = mode;
@@ -11014,11 +11117,17 @@ var init_rotation = __esm({
           due = this.manual || this.current === "nudged" || input.tokens >= this.threshold;
         }
         if (!due) return [];
+        this.plainRetry = this.current === "failed" && !this.manual;
         if (this.current === "failed") {
           this.retryArmed = false;
+          if (this.manual) {
+            this.reason = this.requested;
+            this.why = this.requested === "manual" ? "manual" : "visibility";
+          }
         } else {
           this.endedOnNudge = this.current === "nudged";
           this.reason = this.manual ? this.requested : "renewal";
+          this.why = !this.manual ? "threshold" : this.requested === "manual" ? "manual" : "visibility";
         }
         this.manual = false;
         this.current = "handoff";
@@ -11068,9 +11177,8 @@ var init_rotation = __esm({
           segment: n,
           handoff: this.handoff.text,
           queuedPrompt: input.queuedPrompt,
-          lastMemberPrompt: input.lastMemberPrompt,
-          endedOnNudge: this.endedOnNudge,
-          mode: this.mode
+          continuation: input.autopilotContinuation ? { text: input.autopilotContinuation, auto: true } : memberContinuation(input.lastMemberPrompt, this.mode),
+          endedOnNudge: this.endedOnNudge
         });
         const actions = [
           {
@@ -12363,7 +12471,7 @@ function asInterrupted(row) {
     )
   };
 }
-var SESSION_FLAG_SETTINGS, SESSION_ASK_TOOLS, GUARD_FAILED, WRITE_TOOLS_MATCHER, CONTEXT_HOOK_TIMEOUT_MS, ASK_TOOL_REASON, CAYENNE_CHECK_MS, CAYENNE_CHECK_POLL_MS, CAYENNE_UNCONFIRMED, TOOL_FAILED, toResult, INTERRUPTED, STOPPED_TURN, ClaudeSession;
+var SESSION_FLAG_SETTINGS, SESSION_ASK_TOOLS, GUARD_FAILED, WRITE_TOOLS_MATCHER, CONTEXT_HOOK_TIMEOUT_MS, ASK_TOOL_REASON, CAYENNE_CHECK_MS, CAYENNE_CHECK_POLL_MS, CAYENNE_UNLISTED_POLL_MS, CAYENNE_UNCONFIRMED, TOOL_FAILED, toResult, INTERRUPTED, STOPPED_TURN, ClaudeSession;
 var init_session2 = __esm({
   "src/claude/session.ts"() {
     "use strict";
@@ -12386,6 +12494,7 @@ var init_session2 = __esm({
     ASK_TOOL_REASON = "This session was started from a task, so every shell command needs the member's approval.";
     CAYENNE_CHECK_MS = 1e4;
     CAYENNE_CHECK_POLL_MS = 100;
+    CAYENNE_UNLISTED_POLL_MS = 1e3;
     CAYENNE_UNCONFIRMED = "Refused: the cayenne MCP server is not confirmed as the runner\u2019s own.";
     TOOL_FAILED = "Cayenne could not answer this call.";
     toResult = (a) => ({
@@ -12665,15 +12774,21 @@ var init_session2 = __esm({
        *
        * Any other answer stops the session. A `cayenne` with another `serverInfo` or config type is a
        * foreign server (`CAYENNE_NAME_TAKEN`); one never confirmed (connected without `serverInfo`, a
-       * status other than `pending`, still pending or unlisted at the deadline, a status call that
-       * fails) ends with `CAYENNE_UNCONFIRMED_EXIT`, the reason logged at warn. Until confirmed,
-       * `canUseTool` refuses every `cayenne` tool. A session already stopping or ended is left alone.
+       * status other than `pending`, still pending at the deadline, a status call that fails) ends with
+       * `CAYENNE_UNCONFIRMED_EXIT`, the reason logged at warn. Until confirmed, `canUseTool` refuses
+       * every `cayenne` tool. A session already stopping or ended is left alone.
+       *
+       * An unlisted `cayenne` is waited for, not stopped: the CLI answers `[]` before it registers its
+       * MCP servers, and on a slow network that took longer than the window (three chats killed
+       * 2026-10-21/22). Nothing answers under the name meanwhile, so no tool of it can be called.
        */
       async confirmCayenne(q) {
         let deadline;
+        let unlistedSince;
+        let unlistedWarned = false;
+        const warn = this.opts.log?.warn ?? ((obj, m) => logger.warn(obj, m));
         const end = (fatal, fields, msg) => {
           if (this.ending) return false;
-          const warn = this.opts.log?.warn ?? ((obj, m) => logger.warn(obj, m));
           warn({ providerSessionId: this.providerSessionId, ...fields }, msg);
           this.fatal = fatal;
           void this.stop();
@@ -12688,21 +12803,33 @@ var init_session2 = __esm({
           for (; ; ) {
             if (this.ending) return false;
             const statuses = await q.mcpServerStatus();
-            deadline ??= Date.now() + CAYENNE_CHECK_MS;
             const entry = statuses.find((s) => s.name === CAYENNE_SERVER);
-            const config2 = entry?.config;
-            const info = entry?.serverInfo;
+            if (!entry) {
+              unlistedSince ??= Date.now();
+              if (!unlistedWarned && Date.now() - unlistedSince >= CAYENNE_CHECK_MS) {
+                unlistedWarned = true;
+                warn(
+                  { providerSessionId: this.providerSessionId },
+                  "cayenne MCP server not listed yet; its tools stay refused until it is"
+                );
+              }
+              await new Promise((r) => setTimeout(r, CAYENNE_UNLISTED_POLL_MS));
+              continue;
+            }
+            deadline ??= Date.now() + CAYENNE_CHECK_MS;
+            const config2 = entry.config;
+            const info = entry.serverInfo;
             if (config2 !== void 0 && config2.type !== "sdk" || info !== void 0 && (info.name !== CAYENNE_SERVER || info.version !== this.cayenneVersion)) {
-              return end(CAYENNE_NAME_TAKEN, { scope: entry?.scope }, CAYENNE_NAME_TAKEN);
+              return end(CAYENNE_NAME_TAKEN, { scope: entry.scope }, CAYENNE_NAME_TAKEN);
             }
-            if (entry?.status === "connected") {
+            if (entry.status === "connected") {
               return info !== void 0 || unconfirmed("connected without serverInfo", entry.scope);
             }
-            if (entry && entry.status !== "pending") {
+            if (entry.status !== "pending") {
               return unconfirmed(`status ${entry.status}`, entry.scope);
             }
             if (Date.now() >= deadline) {
-              return unconfirmed(entry ? "still pending" : "not listed by mcpServerStatus");
+              return unconfirmed("still pending", entry.scope);
             }
             await new Promise((r) => setTimeout(r, CAYENNE_CHECK_POLL_MS));
           }
@@ -14889,6 +15016,50 @@ var init_materialise = __esm({
   }
 });
 
+// src/sessions/autopilot-renewal.ts
+function autopilotAppendix(run) {
+  const met = run.doneWhen.length - run.unmetDoneWhen.length;
+  const out = [
+    AUTOPILOT_HEADING,
+    `Objective: ${field(run.objective, CAP_OBJECTIVE)}`,
+    `Done-when items met: ${Math.max(0, met)} of ${run.doneWhen.length}`
+  ];
+  if (run.unmetDoneWhen.length) {
+    out.push("Done when (not yet met):");
+    for (const item of run.unmetDoneWhen) out.push(`- ${field(item, CAP_ITEM)}`);
+  } else {
+    out.push("Done when (not yet met): none");
+  }
+  const text3 = out.join("\n");
+  if (text3.length <= MAX_AUTOPILOT_APPENDIX) return text3;
+  const head = text3.slice(0, MAX_AUTOPILOT_APPENDIX - 2);
+  return `${head.slice(0, head.lastIndexOf("\n"))}
+\u2026`;
+}
+function autopilotContinuation(run) {
+  let clean3 = run.objective.replace(CONTROL, " ").replace(/\s+/g, " ").trim().replace(/[«»]/g, '"');
+  if (clean3.length > CAP_OBJECTIVE) clean3 = `${clean3.slice(0, CAP_OBJECTIVE - 1)}\u2026`;
+  const quoted3 = escapeAngles(clean3);
+  return `Continue toward the objective the member set for Auto Pilot: \xAB${quoted3}\xBB. The handoff above is reference.`;
+}
+function renewalReason(p) {
+  if (p.manual) return "manual";
+  if (p.visibility) return "visibility";
+  if (p.compacted) return "compaction";
+  return p.autopilot ? "autopilot_threshold" : "threshold";
+}
+var AUTOPILOT_HEADING, MAX_AUTOPILOT_APPENDIX, CAP_OBJECTIVE, CAP_ITEM;
+var init_autopilot_renewal = __esm({
+  "src/sessions/autopilot-renewal.ts"() {
+    "use strict";
+    init_handoff();
+    AUTOPILOT_HEADING = "## Auto Pilot";
+    MAX_AUTOPILOT_APPENDIX = 2400;
+    CAP_OBJECTIVE = 800;
+    CAP_ITEM = 240;
+  }
+});
+
 // src/sessions/managed-git-guard.ts
 import { realpathSync as realpathSync15 } from "fs";
 import { isAbsolute as isAbsolute18, relative as relative11, resolve as resolve4, sep as sep15 } from "path";
@@ -15665,6 +15836,7 @@ var init_manager = __esm({
     init_registry();
     init_materialise();
     init_attachments2();
+    init_autopilot_renewal();
     init_managed_git_guard();
     init_relay();
     init_repo_settings();
@@ -15729,6 +15901,8 @@ var init_manager = __esm({
       pendingBlock: null,
       manualPending: false,
       lastPrompt: null,
+      autopilot: false,
+      cause: null,
       todos: null
     });
     scopeOf2 = (v) => v === "private" || v === "workspace" ? v : null;
@@ -15885,7 +16059,9 @@ var init_manager = __esm({
         try {
           this.assertNotRemoving(cwd);
         } catch (err) {
-          throw this.giveBack(repo?.creds, err);
+          const failure2 = this.giveBack(repo?.creds, err);
+          await this.recordStartFailure(sessionId);
+          throw failure2;
         }
         const started = this.markStarting(cwd, sessionId);
         const introspect = this.deps.introspect ?? ((dir, at) => introspectRepo(
@@ -15939,7 +16115,9 @@ var init_manager = __esm({
           );
         } catch (err) {
           this.discardSkills(sessionId);
-          throw this.giveBack(repo?.creds, err);
+          const failure2 = this.giveBack(repo?.creds, err);
+          await this.recordStartFailure(sessionId);
+          throw failure2;
         } finally {
           started();
         }
@@ -16109,9 +16287,18 @@ var init_manager = __esm({
             repo: { ownerId, repositoryId: repository.id, creds }
           };
         } catch (err) {
-          throw this.giveBack(creds, err);
+          const failure2 = this.giveBack(creds, err);
+          await this.recordStartFailure(sessionId);
+          throw failure2;
         }
       }
+      /** A failed first start has no live channel; persist its status without ending a live retry. */
+      async recordStartFailure(sessionId) {
+        if (this.live.has(sessionId)) return;
+        await this.updateSession(sessionId, { status: "error" }).catch(
+          (err) => this.deps.log.warn({ err, sessionId }, "failed startup status could not be recorded")
+        );
+      }
       /**
        * A repository chat's recorded worktree, proven as a resume needs it (§2.9): this runner's record,
        * still the same worktree, shaped `<root>/<owner>/<name>/.cayenne/worktrees/chat-<hex>` for this
@@ -16943,14 +17130,19 @@ var init_manager = __esm({
        * turns. Returns `{ scheduled: true }` at once and never waits for the renewal, so a
        * `session.permission.respond` or `session.interrupt` queued behind it in the session lane runs
        * while the renewal waits for the turn to end (§2.1). Progress goes out as `renewal` events.
-       * Refused when the effective threshold is below 100,000 tokens, and for a session that cannot be
-       * renewed (Codex: no hook can deny the handoff turn's tools; a backend without 0042).
+       * Refused when no threshold applies (below 100,000 tokens outside an Auto Pilot run), and for a
+       * session that cannot be renewed (Codex: no hook can deny the handoff turn's tools; a backend
+       * without 0042).
        */
       async requestRenewal(sessionId, createdBy) {
         const live = await this.ensureLive(sessionId, createdBy);
         this.assertCodexOwner(sessionId, createdBy);
         const r = live.renewal;
         if (!this.renewable(live)) throw new Error(RENEWAL_NOT_AVAILABLE);
+        if (r.machine && r.window !== null && !r.busy) {
+          r.autopilot = await this.autopilotRunning(sessionId);
+          await this.ensureMachine(sessionId, live, r.window);
+        }
         const machine = r.machine;
         if (machine && !machine.enabled) throw new Error(RENEWAL_NOT_AVAILABLE);
         if (r.busy) return { scheduled: true };
@@ -19275,8 +19467,9 @@ var init_manager = __esm({
        * failed turn, a pending permission), so they are never left waiting for a turn that won't come.
        */
       async turnEndRenewal(sessionId, live, r) {
-        const usage = await this.measure(sessionId, live);
         const rn = live.renewal;
+        if (this.renewable(live)) rn.autopilot = await this.autopilotRunning(sessionId);
+        const usage = await this.measure(sessionId, live);
         await this.noteScope(sessionId, live);
         if (rn.busy || live.stopping || live.dropping) return [];
         if (live.turns.owed > 0) return [];
@@ -19442,10 +19635,14 @@ var init_manager = __esm({
       async ensureMachine(sessionId, live, window) {
         const rn = live.renewal;
         if (rn.segment === null) return;
-        if (rn.machine && (rn.window === window || rn.machine.state !== "idle")) return;
         rn.workspaceThreshold ??= await this.workspaceThreshold();
+        const subject = { autopilot: rn.autopilot, workspaceThreshold: rn.workspaceThreshold };
+        if (rn.machine && rn.window !== null && (rn.window === window || rn.machine.state !== "idle")) {
+          rn.threshold = rn.machine.setThreshold(renewThreshold({ ...subject, window: rn.window }));
+          return;
+        }
         rn.window = window;
-        rn.threshold = renewThreshold({ workspaceThreshold: rn.workspaceThreshold, window });
+        rn.threshold = renewThreshold({ ...subject, window });
         rn.machine = new RenewalMachine({
           segment: rn.segment,
           threshold: rn.threshold,
@@ -19458,15 +19655,55 @@ var init_manager = __esm({
           if (rn.machine.enabled) {
             rn.machine.requestRenew("manual");
           } else {
-            await this.renewalEvent(sessionId, {
-              kind: "event",
-              phase: "failed",
-              segment: rn.segment,
-              error: RENEWAL_NOT_AVAILABLE
-            });
+            await this.renewalEvent(
+              sessionId,
+              { kind: "event", phase: "failed", segment: rn.segment, error: RENEWAL_NOT_AVAILABLE },
+              "manual"
+            );
           }
         }
       }
+      /**
+       * `ManagerDeps.isAutopilotRunning`; false when absent, when it rejects (logged), and when the
+       * runner no longer serves the session's owner: a run's continuation is a turn no command is
+       * behind, so it must not outlive the owner's place on the roster.
+       */
+      async autopilotRunning(sessionId) {
+        const ask2 = this.deps.isAutopilotRunning;
+        if (!ask2) return false;
+        try {
+          return await ask2(sessionId) === true && await this.servedOwner(sessionId) !== null;
+        } catch (err) {
+          this.deps.log.warn(
+            { sessionId, err: err instanceof Error ? err.message : String(err) },
+            "reading the Auto Pilot run failed; renewing as without one"
+          );
+          return false;
+        }
+      }
+      /**
+       * `ManagerDeps.autopilotRun`; null when absent, and when it rejects (logged with the error only,
+       * never the run's text).
+       */
+      async autopilotBrief(sessionId) {
+        const read2 = this.deps.autopilotRun;
+        if (!read2) return null;
+        try {
+          const owner2 = await this.servedOwner(sessionId);
+          return owner2 === null ? null : await read2(sessionId, owner2);
+        } catch (err) {
+          this.deps.log.warn(
+            { sessionId, err: err instanceof Error ? err.message : String(err) },
+            "reading the Auto Pilot run failed; renewing as without one"
+          );
+          return null;
+        }
+      }
+      /** The session's owner while this runner serves them, else null. Throws when unreadable. */
+      async servedOwner(sessionId) {
+        const owner2 = await this.sessionOwner(sessionId);
+        return this.serves(owner2) ? owner2 : null;
+      }
       /** `workspace_settings.renewal_threshold_tokens`; the column default when it cannot be read. */
       async workspaceThreshold() {
         const { data, error } = await this.deps.db.from("workspace_settings").select("renewal_threshold_tokens").eq("workspace_id", this.deps.workspaceId).maybeSingle();
@@ -19500,15 +19737,37 @@ var init_manager = __esm({
         rn.busy = true;
         try {
           if (!machine || n === null) return;
+          if (!machine.retrying || !rn.cause) {
+            const cause = machine.cause;
+            rn.cause = {
+              autopilot: rn.autopilot,
+              reason: renewalReason({
+                autopilot: rn.autopilot,
+                manual: cause === "manual",
+                visibility: cause === "visibility",
+                compacted: false
+              })
+            };
+          }
+          const reason = rn.cause.reason;
           let prompt = null;
           for (const a of start2) {
-            if (a.kind === "event") await this.renewalEvent(sessionId, a);
+            if (a.kind === "event") await this.renewalEvent(sessionId, a, reason);
             else if (a.kind === "runHandoffTurn") prompt = a.prompt;
           }
           if (prompt === null) return;
           const result = await this.runHandoffTurn(live, prompt);
           if (gone2()) return;
-          const handoff = await this.handoffFor(sessionId, live, n, result);
+          const autopilot = rn.cause.autopilot;
+          let run = autopilot ? await this.autopilotBrief(sessionId) : null;
+          if (gone2()) return;
+          const handoff = await this.handoffFor(
+            sessionId,
+            live,
+            n,
+            result,
+            run ? [autopilotAppendix(run)] : []
+          );
           try {
             for (const a of machine.handoffCaptured(handoff)) {
               if (a.kind === "saveHandoff") {
@@ -19518,7 +19777,7 @@ var init_manager = __esm({
                   () => this.deps.db.from("chat_segments").update({ handoff: a.handoff, handoff_source: a.handoffSource }).eq("session_id", sessionId).eq("idx", a.segment)
                 );
               } else if (a.kind === "event") {
-                await this.renewalEvent(sessionId, a);
+                await this.renewalEvent(sessionId, a, reason);
               } else if (a.kind === "startQuery") {
                 next = await this.startRenewedQuery(sessionId, live);
               }
@@ -19527,10 +19786,13 @@ var init_manager = __esm({
             const providerSessionId = next?.providerSessionId;
             if (!next || !providerSessionId) throw new Error("the new query has no session id");
             const first = rn.queued[0] ?? null;
+            if (run && !first && !await this.autopilotRunning(sessionId)) run = null;
+            if (gone2()) return;
             const actions = machine.queryStarted({
               providerSessionId,
               queuedPrompt: first?.text ?? null,
-              lastMemberPrompt: rn.lastPrompt
+              lastMemberPrompt: autopilot ? null : rn.lastPrompt,
+              autopilotContinuation: run ? this.secrets.redact(autopilotContinuation(run)) : null
             });
             await this.rotateSegment(sessionId, live, n, handoff.text, actions, next, first);
           } catch (err) {
@@ -19598,12 +19860,12 @@ var init_manager = __esm({
        * before the memory pipeline) or the segment's last messages; plus the deterministic appendix.
        * Scrubbed (D50) before it is stored and before it becomes segment `n + 1`'s first input.
        */
-      async handoffFor(sessionId, live, n, result) {
+      async handoffFor(sessionId, live, n, result, extra = []) {
         const fromModel = result.kind === "ok" && estimateTokens(result.text.trim()) >= MIN_HANDOFF_TOKENS;
         const messages = fromModel ? [] : await this.segmentMessages(sessionId, n);
         const ceiling = live.roots.find((root) => isAtOrBelow3(live.cwd, root)) ?? live.cwd;
         const git = await this.appendixGitState(live.cwd, ceiling).catch(() => null);
-        const appendix = buildAppendix(git, live.renewal.todos, [], []);
+        const appendix = buildAppendix(git, live.renewal.todos, [], [], extra);
         const handoff = resolveHandoff({ result, digest: null, messages, appendix });
         return { ...handoff, text: this.secrets.redact(handoff.text) };
       }
@@ -19751,7 +20013,8 @@ var init_manager = __esm({
             case "event":
               await this.renewalEvent(
                 sessionId,
-                a.phase === "done" ? { ...a, toTokens: await this.firstReading(next) } : a
+                a.phase === "done" ? { ...a, toTokens: await this.firstReading(next) } : a,
+                live.renewal.cause?.reason
               );
               break;
             default:
@@ -20025,7 +20288,8 @@ ${text3}`;
         if (machine.state !== "failed" && live.renewal.machine === machine) live.renewal.machine = null;
         for (const a of actions) {
           if (a.kind === "clearHandoff") await this.clearHandoff(sessionId, a.segment);
-          else if (a.kind === "event") await this.renewalEvent(sessionId, a);
+          else if (a.kind === "event")
+            await this.renewalEvent(sessionId, a, live.renewal.cause?.reason);
         }
         if (live.renewal.scopeRenewalOwed && live.renewal.queued.length > 0) {
           try {
@@ -20076,16 +20340,23 @@ ${text3}`;
           throw new Error(`PROVIDER_ERROR: ${what} failed: ${error.message}`);
         }
       }
-      /** A machine `event` action as a `renewal` session event (protocol §3). */
-      async renewalEvent(sessionId, a) {
+      /**
+       * A machine `event` action as a `renewal` session event (protocol §3), carrying the renewal's
+       * `reason` when it is known; `done` is followed by one `session.renewed` naming it.
+       */
+      async renewalEvent(sessionId, a, reason) {
         await this.broadcast(sessionId, {
           type: "renewal",
           phase: a.phase,
           segment: a.segment,
           ...a.fromTokens === void 0 ? {} : { fromTokens: a.fromTokens },
           ...a.toTokens === void 0 ? {} : { toTokens: a.toTokens },
-          ...a.error === void 0 ? {} : { error: this.cap(a.error) }
+          ...a.error === void 0 ? {} : { error: this.cap(a.error) },
+          ...reason === void 0 ? {} : { reason }
         });
+        if (a.phase === "done" && reason !== void 0) {
+          await this.broadcast(sessionId, { type: "session.renewed", segment: a.segment, reason });
+        }
       }
       /**
        * Expire a request the session settled itself, and say so when this write is what settled the
@@ -22404,7 +22675,9 @@ async function compose(cfg, lock, host, preflight) {
         publishWrites: makePublishWrites(db),
         poll: prPoll,
         gh: runGh
-      }
+      },
+      // Auto Pilot 03: an active run renews at 40% of the window and continues on its own.
+      ...autopilotRunsReader(db, logger)
     });
     let ownerServed = liveRoster.serves(identity.userId);
     let ownerTransition = Promise.resolve();
@@ -22794,6 +23067,7 @@ var init_start = __esm({
     init_roster();
     init_registry();
     init_attachments2();
+    init_autopilot_runs();
     init_handlers();
     init_manager();
     init_repo_sessions();
@@ -23163,7 +23437,9 @@ var isInside = (dir, path) => {
 };
 function isTemporary(path, tmpDir = tmpdir()) {
   const roots = [resolve(tmpDir), realOrSpelled(tmpDir)];
-  return [resolve(path), realOrSpelled(path)].some((p) => roots.some((root) => isInside(root, p)));
+  return [resolve(path), realOrSpelled(path)].some(
+    (p) => p.split(sep).includes("cmux-cli-shims") || roots.some((root) => isInside(root, p))
+  );
 }
 async function resolveClaude(exec4, tmpDir) {
   const candidates = await whichAll(exec4, "claude");
@@ -23180,8 +23456,9 @@ Put the claude CLI itself on PATH, or run this from another terminal: https://cl
     "claude CLI not found on PATH. The runner spawns it to run sessions.\nInstall it first: https://claude.com/claude-code"
   );
 }
-function buildPathEnv(nodePath, claudePath) {
+function buildPathEnv(nodePath, claudePath, codexPath) {
   const dirs = ["/usr/bin", "/bin", "/usr/sbin", "/sbin", dirname2(nodePath), dirname2(claudePath)];
+  if (codexPath) dirs.push(dirname2(codexPath));
   return [...new Set(dirs)].join(":");
 }
 function readInstalledVersion(appDir, pkg) {
@@ -23203,6 +23480,9 @@ function readInstallRecord(cayenneHome2) {
 }
 async function installApp(deps) {
   const claudePath = await resolveClaude(deps.exec, deps.tmpDir ?? tmpdir());
+  const codexPath = (await whichAll(deps.exec, "codex")).find(
+    (path) => !isTemporary(path, deps.tmpDir ?? tmpdir())
+  );
   const appDir = join6(deps.cayenneHome, "app");
   mkdirSync3(appDir, { recursive: true, mode: 448 });
   const install = await deps.exec("npm", [
@@ -23227,7 +23507,7 @@ async function installApp(deps) {
     claudePath,
     cliPath,
     appDir,
-    pathEnv: buildPathEnv(nodePath, claudePath),
+    pathEnv: buildPathEnv(nodePath, claudePath, codexPath),
     installedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   const binDir = join6(deps.cayenneHome, "bin");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jpcasabiancai/cayenne",
-  "version": "0.5.12",
+  "version": "0.5.14",
   "files": [
     "dist/cli.js"
   ],
@@ -33,7 +33,7 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "0.3.260",
+    "@anthropic-ai/claude-agent-sdk": "0.3.312",
     "@anthropic-ai/sdk": "0.123.0",
     "@modelcontextprotocol/sdk": "1.30.0",
     "@supabase/supabase-js": "2.115.0",