@kylecheng3146/agent-ops 0.10.0 → 0.11.0

package/dist/packages/cli/src/commands/task.js

@@ -47,10 +47,10 @@ async function withEscape(envelope, escape, service) {
         ...facts.map(fact => `- ${fact.path}: ${fact.surface}`),
         ...(proof === undefined ? [] : [proof.status === "proven"
                 ? `Proof: rule ${proof.rule} replays at the escaped commit; backtest ${proof.backtest.fires}/${proof.backtest.commits} commits (${proof.backtest.rate}).`
-                : proof.status === "unproven" ? `Proof: ${proof.code} - ${proof.reason} Finish refuses this until a tracked rule proves it.`
+                : proof.status === "unproven" ? `Proof: ${proof.code} - ${proof.reason} Advisory: finish does not wait for it; add a tracked rule to prove it.`
                     : proof.status === "lesson" ? `Lesson (unproven, does not block): ${proof.reason}`
-                        : proof.check === null ? "Proof: ESCAPE_RULE_UNPROVEN - name the red-to-green check with --escape-promote <runnerId:checkId>."
-                            : `Proof: promoted check ${proof.check} must be a proven redCheckId of this task. Config proposal (not written):\n${JSON.stringify(proposal, null, 2)}`]),
+                        : proof.check === null ? "Proof: ESCAPE_RULE_UNPROVEN (advisory) - name the red-to-green check with --escape-promote <runnerId:checkId>."
+                            : `Proof: promoted check ${proof.check} should be a proven redCheckId of this task (advisory). Config proposal (not written):\n${JSON.stringify(proposal, null, 2)}`]),
         `Ledger record: ${escape.path} (commit it with the fix).`,
         escape.blame.length === 0 ? "Blame hints: none (the fix only adds lines; an omission has no author)."
             : `Blame hints (a hint only): ${escape.blame.map(hint => `${hint.commit.slice(0, 12)} (${hint.lines} line${hint.lines === 1 ? "" : "s"})`).join(", ")}`
@@ -98,7 +98,7 @@ function taskAction(args) {
             "complete",
             "create",
             "export",
-            "status", "revise", "replan", "pin-finding", "debug"
+            "status", "revise", "replan", "pin-finding"
         ].includes(args.action)) {
         throw new AgentOpsError("TASK_ACTION_INVALID", "A supported task action is required.");
     }
@@ -110,7 +110,7 @@ function taskEnvelope(action, code, message, record) {
         message,
         record,
         contractHash: taskContractHash(record.task),
-        text: renderTaskMarkdown(record) + "\nContract: " + taskContractHash(record.task) + (record.debug === undefined ? "" : "\nDEBUG: " + JSON.stringify(record.debug))
+        text: renderTaskMarkdown(record) + "\nContract: " + taskContractHash(record.task)
     });
 }
 function renderTaskList(records) {
@@ -129,8 +129,6 @@ export async function runTaskCommand(options) {
             if (options.args.title === undefined) {
                 throw new AgentOpsError("TASK_TITLE_REQUIRED", "Task creation requires --title.");
             }
-            if (options.args.debug)
-                await options.service.assertDebugBaseline();
             const worktree = sessionId === undefined || options.sessionWorktree === undefined
                 ? undefined
                 : await options.sessionWorktree(sessionId);
@@ -156,12 +154,6 @@ export async function runTaskCommand(options) {
                 requireSurface: true
             });
             const escape = origin === undefined ? undefined : await (worktree?.service ?? options.service).declareEscape(record.task.id);
-            // An explicit CLI DEBUG intake may be the only start signal on hosts
-            // without a prompt hook (notably agy). The native session owns the clock;
-            // foregroundStart is idempotent for a repeated hook or command.
-            if (options.args.debug && sessionId !== undefined) {
-                await (worktree?.service ?? options.service).debugService().foregroundStart(record.task.id, sessionId);
-            }
             const created = await withEscape(taskEnvelope(action, "TASK_CREATED", sessionId === undefined
                 ? `Created task ${record.task.id}.`
                 : record.task.parentTaskId === undefined
@@ -187,42 +179,6 @@ export async function runTaskCommand(options) {
                 }
             };
         }
-        if (action === "debug") {
-            const id = requireTaskId(options.args), service = options.service.debugService();
-            if (options.args.debugAction === "origin") {
-                const declared = await service.origin(id, await jsonFile(options.args.payloadFile));
-                return await withEscape(taskEnvelope(action, "TASK_DEBUG_ORIGIN_DECLARED", "Origin bound into the contract; re-verify, re-record the confirmed hypothesis, then review.", declared.record), declared.escape, options.service);
-            }
-            switch (options.args.debugAction) {
-                case "hypothesis":
-                    await service.hypothesis(id, await jsonFile(options.args.payloadFile));
-                    break;
-                case "strategy":
-                    await service.strategy(id, await jsonFile(options.args.payloadFile));
-                    break;
-                case "investigate":
-                    await service.investigate(id, options.args.commandId, options.trusted === true);
-                    break;
-                case "checkpoint":
-                    if (sessionId === undefined)
-                        throw new AgentOpsError("TASK_SESSION_REQUIRED", "Debug checkpoint requires a session.");
-                    await service.checkpoint(id, sessionId);
-                    break;
-                case "resume":
-                    if (sessionId === undefined)
-                        throw new AgentOpsError("TASK_SESSION_REQUIRED", "Debug resume requires a session.");
-                    await service.resume(id, sessionId);
-                    break;
-                case "extend":
-                    if (sessionId === undefined)
-                        throw new AgentOpsError("TASK_SESSION_REQUIRED", "Debug extension requires a native session.");
-                    await service.extend(id, sessionId, options.args.eventId);
-                    break;
-                case "status": break;
-                default: throw new AgentOpsError("TASK_DEBUG_ACTION_INVALID", "A supported debug operation is required.");
-            }
-            return taskEnvelope(action, "TASK_DEBUG_UPDATED", "Original issue debug state preserved.", await service.root(id));
-        }
         if (action === "revise") {
             const payload = options.args.criteriaFile === undefined ? undefined : await jsonFile(options.args.criteriaFile);
             if (payload !== undefined && !Array.isArray(payload))
@@ -235,7 +191,7 @@ export async function runTaskCommand(options) {
                 ...(origin === undefined ? {} : { origin }),
                 reason: options.args.reason, ...(options.args.baseline === undefined ? {} : { baseline: options.args.baseline })
             });
-            return await withEscape(taskEnvelope(action, "TASK_REVISED", "Contract revised; obtain new verification and fresh review.", record), origin === undefined ? undefined : await options.service.declareEscape(record.task.id), options.service);
+            return await withEscape(taskEnvelope(action, "TASK_REVISED", "Contract revised; obtain a fresh review, and new verification if the criteria or configuration changed.", record), origin === undefined ? undefined : await options.service.declareEscape(record.task.id), options.service);
         }
         if (action === "replan") {
             const payload = await jsonFile(options.args.planFile);

package/dist/packages/cli/src/commands/verify.js

@@ -96,12 +96,16 @@ export async function runVerifyCommand(options) {
     try {
         const taskId = await resolveTaskId(options), activity = options.activity;
         const report = publicReport(await withActivity(activity?.commonDir, { kind: "verify", root: activity?.root ?? "", taskId, ...(activity?.sessionId === undefined ? {} : { sessionId: activity.sessionId }) }, async () => await options.service.verify(taskId)));
-        const text = formatReport(report);
+        // A broken surface check must not hide the verification result.
+        const surface = options.surface === undefined ? [] : await options.surface(taskId).catch(() => []);
+        const text = formatReport(report) + surface.map(line => `${safe(line)}\n`).join("");
+        const advisory = surface.length === 0 ? {} : { surface };
         if (report.status === "PASS") {
             return okEnvelope("VERIFICATION_PASSED", {
                 message: "Required verification passed.",
                 report,
-                text
+                text,
+                ...advisory
             });
         }
         const code = report.status === "FAIL"
@@ -113,7 +117,7 @@ export async function runVerifyCommand(options) {
         return {
             code,
             status: "error",
-            data: { message, report, text },
+            data: { message, report, text, ...advisory },
             errors: [{ code, message }]
         };
     }

package/dist/packages/cli/src/context.js

@@ -9,7 +9,8 @@ import { mergeConfigLayers } from "../../../runtime/src/config/merge.js";
 import { AgentOpsError } from "../../../runtime/src/fs/paths.js";
 import { localStatePaths, readPrivateFile } from "../../../runtime/src/security/permissions.js";
 import { FileRunRepository } from "../../../runtime/src/run/service.js";
-import { readRunPolicy, runRuntimeHash } from "../../../runtime/src/run/policy.js";
+import { readRunPolicy, renewRunPolicy, runRuntimeHash } from "../../../runtime/src/run/policy.js";
+import { CLI_VERSION } from "./version.js";
 import { calculateTrustBinding, FileTrustStore } from "../../../runtime/src/security/trust.js";
 export const DEFAULT_CONFIG = {
     schemaVersion: 3,
@@ -83,6 +84,10 @@ export async function loadEffectiveConfig(root, scope, projectOverride) {
                     config: run.policy.config
                 }]);
     }
+    return await loadRepositoryConfig(root, scope, projectOverride);
+}
+/** Read the real config layers when checking renewal, without consulting the run overlay. */
+async function loadRepositoryConfig(root, scope, projectOverride) {
     const home = process.env.AGENT_OPS_HOME ?? homedir();
     const userPath = join(home, ".agent-ops", "config.json");
     const projectPath = join(scope === "user" ? root : projectConfigRoot(root), ".agent-ops", "config.json");
@@ -212,7 +217,7 @@ export async function repositoryTrust(root, config, cliVersion) {
     }
 }
 /** A run-private capability is usable only by its registered checkout or proof group. */
-export async function runPolicyContext(root) {
+export async function runPolicyContext(root, renew = false) {
     let common;
     try {
         common = execFileSync("git", ["rev-parse", "--path-format=absolute", "--git-common-dir"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], windowsHide: true }).trim();
@@ -250,10 +255,23 @@ export async function runPolicyContext(root) {
         throw new AgentOpsError("RUN_WORKER_STALE", "Run policy requires the current registered worker generation or proof process.");
     if (saved.status !== "active" || saved.disableRestart || saved.awaitingResume)
         throw new AgentOpsError("RUN_POLICY_DISABLED", "Run execution policy is inactive; explicit resume is required.");
-    const policy = await readRunPolicy(saved, await runRuntimeHash());
+    const state = renew ? await ensureRunPolicy(repository, saved) : saved;
+    const policy = await readRunPolicy(state, await runRuntimeHash());
     if (policy === null)
         return null;
-    return { repository, state: saved, policy, worker };
+    return { repository, state, policy, worker };
+}
+/** Only active execution paths call this; status, installation and recovery reads never renew. */
+export async function ensureRunPolicy(repository, state) {
+    if (state.policyBinding === undefined || Date.parse(state.policyBinding.expiresAt) > Date.now())
+        return state;
+    return await renewRunPolicy(repository, state.runId, { authority: async () => {
+            const config = (await loadRepositoryConfig(state.root, "project")).config;
+            const baseTrustBinding = await repositoryTrustBinding(state.root, config, CLI_VERSION);
+            const paths = localStatePaths(process.env.AGENT_OPS_HOME ?? homedir());
+            const trusted = (await new FileTrustStore(paths.trustStore, paths.anchorDirectory).status(baseTrustBinding)).status === "TRUSTED";
+            return { config, baseTrustBinding, trusted, runtimeHash: await runRuntimeHash() };
+        } });
 }
 export async function repositoryTrustBinding(root, config, cliVersion) {
     return await calculateTrustBinding({

package/dist/packages/cli/src/default-base.js

@@ -0,0 +1,26 @@
+import { readWorktreeRecord } from "../../../runtime/src/parallel/service.js";
+import { collectChangeSurface, resolveGitCommit } from "../../../runtime/src/verify/change-surface.js";
+/**
+ * The base verify and review use when `--base` is absent, so committed work is
+ * judged as a range without the agent having to copy it. A dirty tree keeps the
+ * working-tree mode; a session worktree compares against its merge-base with the
+ * target branch (which follows a finish rebase); elsewhere the task's creation
+ * commit counts when it is an ancestor of HEAD.
+ */
+export async function defaultBase(root, runner, createdSourceCommit) {
+    if ((await collectChangeSurface(runner)).paths.length > 0)
+        return undefined;
+    const head = await resolveGitCommit(runner, "HEAD");
+    const record = await readWorktreeRecord(root);
+    let base;
+    if (record !== null) {
+        const merge = await runner.run(["merge-base", "HEAD", record.targetBranch]);
+        base = merge.exitCode === 0 ? Buffer.from(merge.stdout).toString("utf8").trim() : record.base;
+    }
+    else {
+        const created = await createdSourceCommit().catch(() => undefined);
+        if (created !== undefined && (await runner.run(["merge-base", "--is-ancestor", created, "HEAD"])).exitCode === 0)
+            base = created;
+    }
+    return base === undefined || base === "" || base === head ? undefined : base;
+}

package/dist/packages/cli/src/hook-process.js

@@ -14,7 +14,6 @@ import { evaluateWorktreeEnter } from "../../../runtime/src/parallel/enter.js";
 import { evaluateWorktreeWrite, resolveMainRoot } from "../../../runtime/src/parallel/guard.js";
 import { ensureSessionWorktree, recordSessionOrigin } from "../../../runtime/src/parallel/service.js";
 import { CompletionGateService } from "../../../runtime/src/hooks/completion-gate.js";
-import { closeDebugSession, debugStopGate, interruptDebugSession, routeDebugPrompt, startDebugSession } from "./debug-intake.js";
 import { TaskService } from "../../../runtime/src/task/service.js";
 import { FileTaskStore } from "../../../runtime/src/task/store.js";
 import { FileEvidenceStore } from "../../../runtime/src/verify/evidence.js";
@@ -269,8 +268,6 @@ async function closeOfficeSession(io, dependencies) {
                 root, harness: "claude", event: "SessionEnd", input, validated: true,
                 ...(typeof fields.session_id === "string" ? { sessionId: fields.session_id } : {})
             });
-        if (typeof fields.session_id === "string")
-            await closeDebugSession(root, fields.session_id, "claude").catch(() => undefined);
     }
     catch {
         // Office never blocks a session, least of all one that is ending.
@@ -307,12 +304,8 @@ async function promptSubmitted(harness, io, dependencies) {
         const prompt = fields.prompt;
         if (typeof prompt !== "string" || prompt.length === 0 || prompt.length > 64 * 1024 || prompt.includes("\0"))
             return 0;
-        if (evaluateGuardrail({ kind: "content", content: prompt, scope: root }).action !== "block") {
-            const context = await routeDebugPrompt(root, input, harness).catch(error => `DEBUG intake unavailable: ${error instanceof Error ? error.message : "preserve current state"}`);
-            if (context !== null)
-                io.writeStdout(harness === "claude" ? JSON.stringify({ hookSpecificOutput: { hookEventName: "UserPromptSubmit", additionalContext: context } }) : context + "\n");
+        if (evaluateGuardrail({ kind: "content", content: prompt, scope: root }).action !== "block")
             return 0;
-        }
         if (!config.profiles.includes("guardrails") && !config.profiles.includes("loop") && !config.profiles.includes("run"))
             return 0;
         const reason = "agent-ops blocked a suspected secret.";
@@ -329,28 +322,14 @@ async function promptSubmitted(harness, io, dependencies) {
 }
 export async function runHookProcess(argv, io, cliVersion, dependencies = {}) {
     const [harness, event] = argv;
-    if (harness === "codex" && event === "Interrupt") {
-        try {
-            const raw = await readStdin(io.stdin), input = parseInput(raw);
-            if (typeof input !== "object" || input === null || Array.isArray(input))
-                return 0;
-            const fields = input;
-            if (typeof fields.session_id !== "string" || fields.session_id.length === 0)
-                return 0;
-            const root = dependencies.root ?? (typeof fields.cwd === "string" ? fields.cwd : process.cwd());
-            await interruptDebugSession(root, fields.session_id, raw);
-        }
-        catch {
-            io.writeStdout(JSON.stringify({ systemMessage: "agent-ops: DEBUG interrupt progress could not be sealed; preserve the task and run agent-ops doctor before resuming." }));
-        }
+    // Pre-0.11 installs registered Interrupt only for DEBUG; it is now a no-op until update removes it.
+    if (harness === "codex" && event === "Interrupt")
         return 0;
-    }
     if (harness === "claude" && event === "SessionEnd")
         return await closeOfficeSession(io, dependencies);
     if ((harness === "claude" || harness === "codex") && event === "UserPromptSubmit")
         return await promptSubmitted(harness, io, dependencies);
-    // The generic completion gate requires an approval escape hatch. Codex
-    // only enforces DEBUG through runtime checkpoints and native human control.
+    // The generic completion gate requires an approval escape hatch, which Codex lacks.
     const completionGateInstalled = (harness === "agy" || harness === "claude") &&
         event === "Stop" &&
         argv.includes("--completion-gate");
@@ -400,18 +379,7 @@ export async function runHookProcess(argv, io, cliVersion, dependencies = {}) {
             }
         }
         let configOutcome = await hookConfigOutcome(root, dependencies.loadConfig);
-        const nativeStop = normalizeHookInput(harnessId, parsedInput);
-        if (harnessId === "codex" && hookEvent === "Stop" && configOutcome.kind === "invalid")
-            configOutcome = await hookConfigOutcome(root, dependencies.loadConfig);
         if (configOutcome.kind === "invalid") {
-            if (harnessId === "codex" && nativeStop?.event === "stop" && nativeStop.sessionId !== undefined) {
-                writeHookOutput(io, harnessDescriptor(harnessId).runtime.formatOutput("Stop", {
-                    action: "continue", status: "UNKNOWN", code: "TASK_DEBUG_GATE_UNAVAILABLE",
-                    remedy: "DEBUG remains incomplete: configuration failed after one targeted reload. Preserve the task, evidence and budgets; fix .agent-ops/config.json and run agent-ops doctor. No completion is attested."
-                }));
-                await closeDebugSession(root, nativeStop.sessionId, harnessId).catch(() => undefined);
-                return 0;
-            }
             if (completionGateInstalled) {
                 writeHookOutput(io, harnessDescriptor(harness).runtime.formatOutput("Stop", {
                     action: "block",
@@ -434,15 +402,6 @@ export async function runHookProcess(argv, io, cliVersion, dependencies = {}) {
             return 0;
         }
         const config = configOutcome.config;
-        if (harnessId === "codex" && hookEvent === "Stop" && nativeStop !== null && config.features.debug?.enabled === true) {
-            const result = await debugStopGate(root, config).handle(nativeStop);
-            if (result !== null) {
-                writeHookOutput(io, harnessDescriptor(harnessId).runtime.formatOutput("Stop", result));
-                if (result.action === "continue" && nativeStop.sessionId !== undefined)
-                    await closeDebugSession(root, nativeStop.sessionId, harnessId).catch(() => undefined);
-                return 0;
-            }
-        }
         if (completionGateInstalled && !config.features.completionGate.enabled) {
             writeHookOutput(io, harnessDescriptor(harness).runtime.formatOutput("Stop", {
                 action: "block",
@@ -457,8 +416,6 @@ export async function runHookProcess(argv, io, cliVersion, dependencies = {}) {
             : await dependencies.trust(root, config, cliVersion);
         const trusted = trustStatus === "TRUSTED";
         const normalized = normalizeHookInput(harnessId, parsedInput);
-        if (normalized?.event === "session-start" && normalized.sessionId !== undefined)
-            await startDebugSession(root, normalized.sessionId, harnessId).catch(() => undefined);
         if (dependencies.office !== undefined && config.features.office?.enabled === true) {
             if (normalized !== null) {
                 const phase = officePhaseHint(normalized) ?? (harnessId === "codex" ? officeLoopPhaseHint(parsedInput, root) : undefined);
@@ -554,43 +511,22 @@ export async function runHookProcess(argv, io, cliVersion, dependencies = {}) {
                 await recordSessionOrigin(dependencies.worktree, { cwd: root, sessionId }).catch(() => undefined);
             }
         }
-        let hookResult;
-        // Without the gate, DEBUG still refuses a Stop that has no valid stop
-        // checkpoint. Its own failure stays advisory, so it never blocks other work.
-        const debugStop = completionGate === undefined && hookEvent === "Stop" && normalized !== null &&
-            (harnessId === "agy" || harnessId === "claude" || harnessId === "codex") && config.features.debug?.enabled === true
-            ? await debugStopGate(root, config).handle(normalized)
-            : null;
-        if (debugStop !== null)
-            hookResult = debugStop;
-        const output = debugStop !== null
-            ? harnessDescriptor(harnessId).runtime.formatOutput("Stop", debugStop)
-            : await runHookCommand({
-                harness: harness,
-                event: hookEvent,
-                stdin: rawInput,
-                input: parsedInput,
-                config,
-                trusted,
-                onResult: result => { hookResult = result; },
-                ...(worktreeGuard === undefined ? {} : { worktreeGuard }),
-                ...(worktreeEnter === undefined ? {} : { worktreeEnter }),
-                ...(dependencies.advisory === undefined
-                    ? {}
-                    : { advisory: dependencies.advisory }),
-                ...(stopVerification === undefined ? {} : { stopVerification }),
-                ...(completionGate === undefined ? {} : { completionGate })
-            });
+        const output = await runHookCommand({
+            harness: harness,
+            event: hookEvent,
+            stdin: rawInput,
+            input: parsedInput,
+            config,
+            trusted,
+            ...(worktreeGuard === undefined ? {} : { worktreeGuard }),
+            ...(worktreeEnter === undefined ? {} : { worktreeEnter }),
+            ...(dependencies.advisory === undefined
+                ? {}
+                : { advisory: dependencies.advisory }),
+            ...(stopVerification === undefined ? {} : { stopVerification }),
+            ...(completionGate === undefined ? {} : { completionGate })
+        });
         writeHookOutput(io, output);
-        // A Stop can be advisory or gated, but the foreground clock only ends on
-        // the same trusted idle model_stop that the native decision accepted.
-        if (normalized?.event === "stop" &&
-            normalized.sessionId !== undefined &&
-            normalized.terminationReason === "model_stop" &&
-            normalized.fullyIdle === true &&
-            hookResult?.action === "continue") {
-            await closeDebugSession(root, normalized.sessionId, harnessId).catch(() => undefined);
-        }
     }
     catch {
         if (completionGateInstalled) {

package/dist/packages/cli/src/office-entry.js

@@ -5,7 +5,7 @@ import { rm } from "node:fs/promises";
 import { createHash } from "node:crypto";
 import { spawn } from "node:child_process";
 import { collectOfficeBuilding } from "../../../runtime/src/office/collect.js";
-import { claimOffice, createOfficeServer, ensureOffice, legacyOfficeHome, officeRecordPath, readLiveOffice, officeUrl, releaseOffice, userOfficeHome } from "../../../runtime/src/office/server.js";
+import { claimOffice, createOfficeServer, ensureOffice, legacyOfficeHome, officeRecordPath, readLiveOffice, readOfficeRecord, officeUrl, userOfficeHome } from "../../../runtime/src/office/server.js";
 import { registerOfficeRepo } from "../../../runtime/src/office/repos.js";
 import { recordOfficeSession, recordOfficeSessionPhase } from "../../../runtime/src/office/sessions.js";
 import { resolveCheckouts } from "../../../runtime/src/parallel/service.js";
@@ -254,7 +254,6 @@ export async function serveOffice(cwd, onUrl = () => { }, openBrowser) {
     }, 15_000);
     await idle;
     clearInterval(timer);
-    await releaseOffice(home, record);
     await office.close();
 }
 /** Reuse the user's live server or start one under launchd; null where launchd is unavailable. */
@@ -267,10 +266,13 @@ export async function ensureBackgroundOffice(cwd, launchd = new LaunchdControlle
     const live = await readLiveOffice(home);
     if (live !== null)
         return officeUrl(live);
+    let previousUrl = null;
     let started = false;
     const args = [entry, mainRoot];
     if (!launchd.supported) {
         const url = await ensureOffice(home, async () => {
+            const previous = await readOfficeRecord(home);
+            previousUrl = previous === null ? null : officeUrl(previous);
             started = true;
             await new Promise((resolve, reject) => {
                 const child = spawn(process.execPath, args, { cwd: mainRoot, detached: true, stdio: "ignore", windowsHide: true });
@@ -278,7 +280,7 @@ export async function ensureBackgroundOffice(cwd, launchd = new LaunchdControlle
                 child.once("spawn", () => { child.unref(); resolve(); });
             });
         });
-        if (started && openBrowser !== undefined)
+        if (started && url !== previousUrl && openBrowser !== undefined)
             void openBrowser(url).catch(() => undefined);
         return url;
     }
@@ -289,6 +291,8 @@ export async function ensureBackgroundOffice(cwd, launchd = new LaunchdControlle
         cwd: mainRoot, pathEnvironment: process.env.PATH
     });
     const url = await ensureOffice(home, async () => {
+        const previous = await readOfficeRecord(home);
+        previousUrl = previous === null ? null : officeUrl(previous);
         started = true;
         // The descriptor write anchors on this directory, so it must exist first.
         await ensurePrivateDirectory(privateDirectory, home.anchor);
@@ -297,7 +301,7 @@ export async function ensureBackgroundOffice(cwd, launchd = new LaunchdControlle
         await launchd.bootout(descriptor).catch(() => { });
         await launchd.bootstrap(descriptor);
     });
-    if (started && openBrowser !== undefined)
+    if (started && url !== previousUrl && openBrowser !== undefined)
         void openBrowser(url).catch(() => undefined);
     return url;
 }

package/dist/packages/cli/src/owned-run-step.js

@@ -4,13 +4,13 @@ import { AgentOpsError } from "../../../runtime/src/fs/paths.js";
 import { nativeProcessIdentity, NativeRunTransport } from "../../../runtime/src/run/transport.js";
 import { ClaudeGoalHost } from "../../../runtime/src/run/hosts/claude.js";
 import { CodexGoalHost } from "../../../runtime/src/run/hosts/codex.js";
-import { activeWallTimeMs } from "../../../runtime/src/run/scheduler.js";
+import { remainingRunTimeMs } from "../../../runtime/src/run/scheduler.js";
 import { runPolicyContext } from "./context.js";
 /** Native-issued proof commands use the same dormant group as final evidence. */
 export async function runOwnedLocalProof(argv) {
     if (!["verify", "review", "batch"].includes(argv[0] ?? "") || argv.includes("--help") || process.env.AGENT_OPS_RUN_PROOF_PID !== undefined)
         return null;
-    const context = await runPolicyContext(process.cwd());
+    const context = await runPolicyContext(process.cwd(), true);
     if (context === null)
         return null;
     const { repository, state, worker } = context;
@@ -22,7 +22,7 @@ export async function runOwnedLocalProof(argv) {
         if (existing.processAlive)
             throw new AgentOpsError("RUN_WORKER_PROOF_ACTIVE", "A registered proof command is already running for this worker.");
     }
-    const remaining = state.budget.limitMs - activeWallTimeMs(state.budget.activeIntervals, Date.now());
+    const remaining = remainingRunTimeMs(state);
     if (remaining <= 0)
         throw new AgentOpsError("RUN_BUDGET_EXHAUSTED", "No active run time remains for local proof.");
     const cli = fileURLToPath(new URL("./bin.js", import.meta.url));
@@ -34,7 +34,7 @@ export async function runOwnedLocalProof(argv) {
             process.kill(process.platform === "win32" ? child.pid : -child.pid, "SIGKILL");
         }
         catch { } };
-    const deadline = setTimeout(kill, remaining);
+    const deadline = Number.isFinite(remaining) ? setTimeout(kill, remaining) : undefined;
     try {
         const identity = child.pid === undefined ? null : await nativeProcessIdentity(child.pid);
         if (identity === null)

package/dist/packages/cli/src/parallel-deps.js

@@ -9,7 +9,6 @@ import { FileTrustStore } from "../../../runtime/src/security/trust.js";
 import { TaskService } from "../../../runtime/src/task/service.js";
 import { FileTaskStore } from "../../../runtime/src/task/store.js";
 import { FileEvidenceStore } from "../../../runtime/src/verify/evidence.js";
-import { registeredRunProofRunner } from "../../../runtime/src/verify/spawn.js";
 import { loadEffectiveConfig, repositoryTrust, runPolicyContext, repositoryTrustBinding } from "./context.js";
 import { CLI_VERSION } from "./version.js";
 // Shared by the CLI and the hook entry point: Claude Code runs hooks through
@@ -84,7 +83,6 @@ export function worktreeDependencies() {
                 ...(noChangePaths === undefined ? {} : { noChangePaths }),
                 loadConfig: async () => (await loadEffectiveConfig(root, "project")).config
             } }),
-        processRunner: registeredRunProofRunner(),
         runSetup: async (cwd, step) => await new Promise((resolve) => {
             execFile(step.command, [...step.args], {
                 cwd,

package/dist/packages/cli/src/run-deps.js

@@ -18,9 +18,9 @@ import { NativeRunTransport } from "../../../runtime/src/run/transport.js";
 import { ClaudeGoalHost } from "../../../runtime/src/run/hosts/claude.js";
 import { CodexGoalHost } from "../../../runtime/src/run/hosts/codex.js";
 import { RunSupervisor } from "../../../runtime/src/run/supervisor.js";
-import { activeWallTimeMs } from "../../../runtime/src/run/scheduler.js";
+import { activeWallTimeMs, remainingRunTimeMs } from "../../../runtime/src/run/scheduler.js";
 import { bindRunPolicy, readRunPolicy, runRuntimeHash, runPolicyAssessment } from "../../../runtime/src/run/policy.js";
-import { repositoryTrustBinding } from "./context.js";
+import { repositoryTrustBinding, ensureRunPolicy } from "./context.js";
 import { CLI_VERSION } from "./version.js";
 import { calculateConfigHash, canonicalJson } from "../../../runtime/src/config/hash.js";
 import { discoverPendingPolicyTransition, renewBoundPolicyTransition, currentPolicyArtifact } from "../../../runtime/src/run/policy-transition.js";
@@ -30,6 +30,7 @@ import { RunControlService } from "../../../runtime/src/run/controls.js";
 import { recordRunPhase } from "../../../runtime/src/run/phase.js";
 /** Worktree construction happens before a native lease exists; it must never write global trust. */
 export async function runWorktreeDependencies(deps, state) {
+    state = await ensureRunPolicy(new FileRunRepository(join(state.commonDir, "agent-ops/runs"), state.commonDir), state);
     const policy = await readRunPolicy(state, await runRuntimeHash());
     if (policy === null || (await trustStore().status(policy.baseTrustBinding)).status !== "TRUSTED")
         throw new AgentOpsError("RUN_REPO_UNTRUSTED", "Run worktree setup requires the original trusted repository and current scoped policy.");
@@ -40,7 +41,9 @@ export async function runWorktreeDependencies(deps, state) {
             if (index < 0)
                 throw new AgentOpsError("RUN_SETUP_UNAUTHORIZED", "Setup must select an exact fixed policy capability.");
             const repository = new FileRunRepository(join(state.commonDir, "agent-ops/runs"), state.commonDir);
-            const current = (await repository.read(state.runId));
+            const current = await ensureRunPolicy(repository, (await repository.read(state.runId)));
+            if (current.policyBinding?.configHash !== state.policyBinding.configHash)
+                throw new AgentOpsError("RUN_SETUP_STALE", "Policy capability changed after setup was selected.");
             const coordinator = current.workers.find(w => w.workerId === current.coordinatorId);
             const command = canonicalJson(step), resource = canonicalJson({ checkout: root, capabilityId: "setup:" + index });
             const approved = await runPolicyAssessment(current, policy, "setup:" + index);
@@ -49,11 +52,11 @@ export async function runWorktreeDependencies(deps, state) {
                 command, resource, commandDigest: sha256(command), resourceDigest: sha256(resource), reason: approved?.reason ?? "The original user trust authorizes this fixed repository setup capability in an isolated checkout.",
                 result: "auto-approved", source: approved === null ? "repo-trust" : "coordinator-policy-review", policyArtifactDigest: current.policyBinding.artifactDigest,
                 policyConfigHash: current.policyBinding.configHash, runtimeHash: current.policyBinding.runtimeHash, expiresAt: current.policyBinding.expiresAt });
-            const remaining = current.budget.limitMs - activeWallTimeMs(current.budget.activeIntervals, Date.now());
+            const remaining = remainingRunTimeMs(current);
             if (remaining <= 0)
                 throw new AgentOpsError("RUN_BUDGET_EXHAUSTED", "No active time remains for setup.");
             const child = spawn(process.execPath, [fileURLToPath(new URL("./run-step-entry.js", import.meta.url)),
-                fileURLToPath(new URL("./run-setup-entry.js", import.meta.url)), state.commonDir, state.runId, root, String(index), state.policyBinding.artifactDigest], { cwd: root, env: process.env, detached: process.platform !== "win32", stdio: ["pipe", "pipe", "pipe"] });
+                fileURLToPath(new URL("./run-setup-entry.js", import.meta.url)), state.commonDir, state.runId, root, String(index), current.policyBinding.artifactDigest], { cwd: root, env: process.env, detached: process.platform !== "win32", stdio: ["pipe", "pipe", "pipe"] });
             let output = "";
             const completion = new Promise((resolve, reject) => { child.once("error", reject); child.once("close", resolve); });
             const kill = () => { if (child.pid !== undefined)
@@ -70,7 +73,7 @@ export async function runWorktreeDependencies(deps, state) {
                 if (identity === null)
                     throw new AgentOpsError("RUN_PROCESS_IDENTITY_REQUIRED", "Cannot register setup process identity.");
                 await repository.mutate(state.runId, saved => {
-                    if (saved.status !== "active" || saved.disableRestart || saved.proofProcess != null || saved.policyBinding?.artifactDigest !== state.policyBinding.artifactDigest)
+                    if (saved.status !== "active" || saved.disableRestart || saved.proofProcess != null || saved.policyBinding?.artifactDigest !== current.policyBinding.artifactDigest)
                         throw new AgentOpsError("RUN_SETUP_STALE", "Stop or another proof process raced setup registration.");
                     return { ...saved, proofProcess: { processId: child.pid, processIdentity: identity } };
                 });
@@ -206,7 +209,7 @@ export async function productionRunContext(cwd, options = {}) {
             throw cause;
         }
     };
-    const resume = async (runId) => {
+    const resume = async (runId, retryApprovalIds = [], upgradeBudget = true) => {
         const before = await service.status(runId);
         const runtimeHash = await runRuntimeHash();
         const policy = await readRunPolicy(before, before.policyBinding?.runtimeHash ?? runtimeHash, Date.now(), true);
@@ -233,7 +236,7 @@ export async function productionRunContext(cwd, options = {}) {
                 if (exists === null || (await collectChangeSurface(gitRunner(worker.worktree))).paths.length > 0)
                     throw new AgentOpsError("RUN_RECOVERY_DIRTY", "Commit or preserve every writer checkout before explicit resume.");
             }
-        const result = await service.resume(runId);
+        const result = await service.resume(runId, retryApprovalIds, upgradeBudget);
         try {
             if (pending !== null)
                 await renewPendingRunPolicy(repository, runId, pending);
@@ -308,7 +311,7 @@ export async function productionRunContext(cwd, options = {}) {
         await writePrivateFile(join(state.commonDir, "agent-ops", "runs", state.runId, "answers", sha256(questionId) + ".json"), JSON.stringify({ questionId, answer: answer.trim() }), state.commonDir);
         const result = await service.respond(runId, questionId, answer);
         try {
-            const resumed = await resume(runId);
+            const resumed = await resume(runId, [], false);
             return { ...result, state: resumed.state };
         }
         catch (cause) {