@kylecheng3146/agent-ops 0.3.4 → 0.3.6

package/dist/packages/cli/src/hook-process.js

@@ -10,7 +10,7 @@ import { redactSecrets } from "../../../runtime/src/security/redact.js";
 import { claudeStopRecursionMarker } from "../../../runtime/src/adapters/claude/input.js";
 import { HARNESS_IDS, harnessDescriptor } from "../../../runtime/src/install/harness.js";
 import { evaluateWorktreeWrite, resolveMainRoot } from "../../../runtime/src/parallel/guard.js";
-import { ensureSessionWorktree } from "../../../runtime/src/parallel/service.js";
+import { ensureSessionWorktree, recordSessionOrigin } from "../../../runtime/src/parallel/service.js";
 import { CompletionGateService } from "../../../runtime/src/hooks/completion-gate.js";
 import { TaskService } from "../../../runtime/src/task/service.js";
 import { FileTaskStore } from "../../../runtime/src/task/store.js";
@@ -354,6 +354,15 @@ export async function runHookProcess(argv, io, cliVersion, dependencies = {}) {
                         : async (sessionId) => (await ensureSessionWorktree(dependencies.worktree, { cwd: mainRoot, sessionId })).path);
             }
             : undefined;
+        if (hookEvent === "SessionStart" && config.worktree?.mode === "auto" &&
+            dependencies.worktree !== undefined && typeof parsedInput === "object" && parsedInput !== null) {
+            const fields = parsedInput;
+            const sessionId = harnessId === "agy" ? fields.conversationId : fields.session_id;
+            if (typeof sessionId === "string") {
+                // Advisory: a session that records nothing falls back to HEAD at add time.
+                await recordSessionOrigin(dependencies.worktree, { cwd: root, sessionId }).catch(() => undefined);
+            }
+        }
         const output = await runHookCommand({
             harness: harness,
             event: hookEvent,

package/dist/runtime/src/hooks/completion-gate.js

@@ -6,7 +6,7 @@ import { readPrivateFile, withPrivateFileLock, writePrivateFile } from "../secur
 import { checkTaskCompletionEvidence, findIncompleteSubtask } from "../task/completion.js";
 import { collectBaseChangePaths, collectChangeSurface } from "../verify/change-surface.js";
 import { calculateSourceFingerprint } from "../verify/source-fingerprint.js";
-import { readWorktreeRecord } from "../parallel/service.js";
+import { NOTES_REF, noteSessionLine, readWorktreeRecord } from "../parallel/service.js";
 const FINGERPRINT = /^[a-f0-9]{64}$/u;
 const SESSION = /^[^\0\r\n]{1,256}$/u;
 function gateDirectory(root) {
@@ -248,12 +248,32 @@ export class CompletionGateService {
             event.event === "command-batch" ? event.commands : [];
         return commands.some(({ command, args }) => [command, ...args].includes("allow-stop"));
     }
+    /**
+     * Whether `worktree finish` merged this session's reviewed work: a note
+     * naming the session on a commit HEAD contains, and nothing uncommitted on
+     * top. finish moves the task into that note, so the checkout has none left.
+     */
+    async #finishedByWorktree(sessionId) {
+        const runner = this.#options.gitRunner;
+        if ((await collectChangeSurface(runner)).paths.length > 0)
+            return false;
+        // ponytail: newest 500 commits only; older merges need a one-time allow-stop
+        const log = await runner.run(["log", `--notes=${NOTES_REF}`, "--format=%N%x00", "-n", "500", "HEAD"]);
+        if (log.exitCode !== 0)
+            return false;
+        const line = noteSessionLine(sessionId);
+        return new TextDecoder().decode(log.stdout).split("\0").some((note) => note.split("\n").includes(line));
+    }
     async #validateTask(sessionId) {
         let stored;
         try {
             stored = await this.#options.taskService.status({ sessionId });
         }
         catch (error) {
+            if (error instanceof AgentOpsError && error.code === "TASK_SESSION_UNATTACHED" &&
+                await this.#finishedByWorktree(sessionId)) {
+                return null;
+            }
             return error instanceof AgentOpsError && error.code === "TASK_SESSION_UNATTACHED"
                 ? gateResult("block", "FAIL", "COMPLETION_GATE_TASK_REQUIRED", `Attach this conversation to a formal task: agent-ops task create --title <title> --criterion <json> --criterion <json> (two to five criteria), then agent-ops task attach --task <task-id> --session ${shellQuote(sessionId)}.`)
                 : gateResult("block", "UNKNOWN", "COMPLETION_GATE_TASK_UNAVAILABLE", "Repair task state with agent-ops doctor before stopping.");

package/dist/runtime/src/parallel/finish.js

@@ -5,8 +5,7 @@ import { AgentOpsError, resolveContainedPath } from "../fs/paths.js";
 import { currentGateFingerprint } from "../hooks/completion-gate.js";
 import { collectChangeSurface } from "../verify/change-surface.js";
 import { aggregateVerificationStatus, executeConfiguredCommand } from "../verify/command-executor.js";
-import { assertWorktreeName, readWorktreeRecord, removeCheckout, resolveCheckouts, worktreePath } from "./service.js";
-export const NOTES_REF = "agent-ops";
+import { assertWorktreeName, NOTES_REF, noteSessionLine, parseWorktreeListPorcelain, readWorktreeRecord, removeCheckout, resolveCheckouts, worktreePath } from "./service.js";
 const LOCK_NAME = "agent-ops-finish.lock";
 const LOCK_POLL_MS = 2_000;
 const LOCK_WAIT_MS = 30 * 60 * 1000;
@@ -180,6 +179,7 @@ function taskTree(tasks) {
 function noteText(record, tasks) {
     return [
         `worktree: ${record.name} (${record.branch})`,
+        noteSessionLine(record.sessionId),
         ...tasks.flatMap(({ task, depth }) => {
             const indent = "  ".repeat(depth);
             return [
@@ -191,8 +191,9 @@ function noteText(record, tasks) {
     ].join("\n");
 }
 /**
- * Brings a worktree's reviewed work into the branch the main checkout is on,
- * by fast-forward only, then retires the worktree. Run from the main checkout.
+ * Brings a worktree's reviewed work into its target branch by fast-forward
+ * only, then retires the worktree. Run from the main checkout, which may be on
+ * another branch: then only the target's ref moves.
  */
 export async function finishWorktree(deps, options) {
     const name = assertWorktreeName(options.name);
@@ -207,12 +208,24 @@ export async function finishWorktree(deps, options) {
     return await withFinishLock(deps, commonDir, async () => {
         const mainRunner = runner(deps, mainRoot);
         const worktreeRunner = runner(deps, record.path);
-        if ((await collectChangeSurface(mainRunner)).paths.length > 0) {
-            throw finishError("WORKTREE_MAIN_DIRTY", "The main checkout has uncommitted changes; a fast-forward would mix them in.");
-        }
         const onBranch = (await deps.git(mainRoot, ["symbolic-ref", "--short", "-q", "HEAD"])).stdout.trim();
-        if (onBranch !== record.targetBranch) {
-            throw finishError("WORKTREE_TARGET_MOVED", `The main checkout is on ${onBranch || "a detached HEAD"}; switch it back to ${record.targetBranch} to finish.`);
+        // On the target, the merge rewrites the checkout's files, so its changes
+        // would mix in. Anywhere else only the target's ref moves and the checkout
+        // is never touched.
+        const onTarget = onBranch === record.targetBranch;
+        if (onTarget) {
+            if ((await collectChangeSurface(mainRunner)).paths.length > 0) {
+                throw finishError("WORKTREE_MAIN_DIRTY", "The main checkout has uncommitted changes; a fast-forward would mix them in.");
+            }
+        }
+        else {
+            const listing = await deps.git(mainRoot, ["worktree", "list", "--porcelain"]);
+            const holder = listing.exitCode === 0
+                ? parseWorktreeListPorcelain(listing.stdout).find(({ branch }) => branch === record.targetBranch)
+                : undefined;
+            if (holder !== undefined) {
+                throw finishError("WORKTREE_BRANCH_CHECKED_OUT", `${record.targetBranch} is checked out at ${holder.path}; moving it would desync that checkout. Switch it away or finish from there.`);
+            }
         }
         if ((await collectChangeSurface(worktreeRunner)).paths.length > 0) {
             throw finishError("WORKTREE_DIRTY", `Commit or discard the uncommitted changes in ${record.path} first.`);
@@ -276,8 +289,17 @@ export async function finishWorktree(deps, options) {
         const mainConfig = await deps.loadConfig(mainRoot);
         const gateEnabled = mainConfig.features.completionGate.enabled;
         const before = gateEnabled ? await currentGateFingerprint(mainRoot, mainRunner) : "";
-        await git(deps, mainRoot, ["merge", "--ff-only", record.branch], "WORKTREE_MERGE_FAILED", `Git could not fast-forward ${record.targetBranch}.`);
-        const mergedHead = await git(deps, mainRoot, ["rev-parse", "HEAD"], "WORKTREE_LOG_FAILED", "Git could not read HEAD.");
+        let mergedHead;
+        if (onTarget) {
+            await git(deps, mainRoot, ["merge", "--ff-only", record.branch], "WORKTREE_MERGE_FAILED", `Git could not fast-forward ${record.targetBranch}.`);
+            mergedHead = await git(deps, mainRoot, ["rev-parse", "HEAD"], "WORKTREE_LOG_FAILED", "Git could not read HEAD.");
+        }
+        else {
+            // Compare-and-swap on the target's value read above: a target that moved
+            // since fails here instead of being overwritten.
+            mergedHead = await git(deps, mainRoot, ["rev-parse", "--verify", `${record.branch}^{commit}`], "WORKTREE_LOG_FAILED", `Git could not read ${record.branch}.`);
+            await git(deps, mainRoot, ["update-ref", "-m", `agent-ops finish ${record.branch}`, `refs/heads/${record.targetBranch}`, mergedHead, target], "WORKTREE_MERGE_FAILED", `Git could not fast-forward ${record.targetBranch}.`);
+        }
         // The merge happened; everything below is cleanup, reported, never undone.
         const warnings = [];
         const attempt = async (label, step) => {
@@ -292,8 +314,11 @@ export async function finishWorktree(deps, options) {
         if (gateEnabled) {
             await attempt("gate", async () => {
                 const mainGate = await deps.gate(mainRoot, mainConfig);
-                await mainGate.redirect(record.sessionId, null);
-                await mainGate.rebase(before, await currentGateFingerprint(mainRoot, mainRunner));
+                const after = await currentGateFingerprint(mainRoot, mainRunner);
+                await mainGate.rebase(before, after);
+                // rebase only moves baselines equal to `before`; a main that moved since
+                // this session began would leave it reading the merge as its own change.
+                await mainGate.seed(record.sessionId, after);
             });
         }
         await attempt("trust", async () => await deps.trust.revoke(record.path, worktreeConfig));

package/dist/runtime/src/parallel/service.js

@@ -1,10 +1,11 @@
 import { chmod, copyFile, lstat, mkdir, readFile, realpath, writeFile } from "node:fs/promises";
 import { basename, dirname, join, sep } from "node:path";
 import { calculateConfigHash } from "../config/hash.js";
+import { sha256 } from "../fs/hash.js";
 import { parseInstallManifest } from "../fs/manifest.js";
 import { AgentOpsError } from "../fs/paths.js";
 import { writeSessionMarker } from "../hooks/codex-loop.js";
-import { readPrivateFile, writePrivateFile } from "../security/permissions.js";
+import { readPrivateFile, withPrivateFileLock, writePrivateFile } from "../security/permissions.js";
 /**
  * One Git worktree per writing session, so parallel sessions stop sharing the
  * change surface every fingerprint is taken over. Worktrees live inside the
@@ -14,6 +15,10 @@ import { readPrivateFile, writePrivateFile } from "../security/permissions.js";
 export const WORKTREE_DIRECTORY = ".worktrees";
 export const WORKTREE_BRANCH_PREFIX = "agent-ops/";
 export const WORKTREE_RECORD_PATH = ".agent-ops/tasks/worktree.json";
+/** The notes ref `worktree finish` records a merge in. */
+export const NOTES_REF = "agent-ops";
+/** The note line binding a merge to the session that finished it. */
+export const noteSessionLine = (sessionId) => `session: ${sessionId}`;
 const EXCLUDE_LINE = `/${WORKTREE_DIRECTORY}/`;
 const NAME = /^[a-z0-9](?:[a-z0-9._-]{0,62}[a-z0-9])?$/u;
 const SESSION = /^[^\0\r\n]{1,256}$/u;
@@ -221,9 +226,11 @@ export async function removeCheckout(deps, record, force) {
     await git(deps, record.mainRoot, ["branch", force ? "-D" : "-d", record.branch], "WORKTREE_REMOVE_FAILED", `Git could not delete ${record.branch}.`);
 }
 /**
- * Creates `.worktrees/<name>` on `agent-ops/<name>` from `from` (default HEAD)
- * and makes it a working agent-ops checkout for `sessionId`. When the main
- * checkout is detached, `targetBranch` names the branch `finish` merges back
+ * Creates `.worktrees/<name>` on `agent-ops/<name>` from `from` and makes it a
+ * working agent-ops checkout for `sessionId`. With neither `from` nor
+ * `targetBranch`, the branch recorded when the session began is both; without
+ * a record, HEAD and its branch. When the main checkout is detached and
+ * nothing is recorded, `targetBranch` names the branch `finish` merges back
  * into. A branch already checked out in another worktree is rejected before
  * Git runs, so the failure names the conflicting path.
  */
@@ -240,15 +247,24 @@ export async function addWorktree(deps, options) {
     if (currentRoot !== mainRoot) {
         throw worktreeError("WORKTREE_NESTED", `Run worktree commands from the main checkout (${mainRoot}), not from inside a worktree.`);
     }
+    // Without an explicit target or base, the branch the main checkout was on
+    // when the session began, not the one it is on now: the user may have
+    // switched since.
+    const origin = options.targetBranch === undefined && options.from === undefined
+        ? await readSessionOrigin(mainRoot, sessionId) : null;
+    if (origin !== null &&
+        (await deps.git(mainRoot, ["show-ref", "--verify", "--quiet", `refs/heads/${origin}`])).exitCode !== 0) {
+        throw worktreeError("WORKTREE_ORIGIN_MISSING", `The session began on ${origin}, which no longer exists; pass --target-branch to agent-ops worktree add.`);
+    }
     const headRef = await deps.git(mainRoot, ["symbolic-ref", "--short", "-q", "HEAD"]);
-    const targetBranch = options.targetBranch ?? headRef.stdout.trim();
+    const targetBranch = options.targetBranch ?? origin ?? headRef.stdout.trim();
     if (targetBranch === "") {
         throw worktreeError("WORKTREE_TARGET_REQUIRED", "The main checkout is detached; pass --target-branch <branch> naming the branch finish merges back into.");
     }
     if (!TARGET_BRANCH.test(targetBranch)) {
         throw worktreeError("WORKTREE_TARGET_INVALID", `Invalid target branch ${targetBranch}; use 1-128 letters, digits, '.', '_', '/' or '-'.`);
     }
-    const fromRef = options.from ?? "HEAD";
+    const fromRef = options.from ?? (origin === null ? "HEAD" : `refs/heads/${origin}`);
     const base = await git(deps, mainRoot, ["rev-parse", "--verify", `${fromRef}^{commit}`], options.from === undefined ? "WORKTREE_NO_COMMIT" : "WORKTREE_BASE_INVALID", options.from === undefined
         ? "The main checkout has no commit to branch from."
         : `Cannot resolve --from ${options.from} to a commit.`);
@@ -344,3 +360,32 @@ export async function ensureSessionWorktree(deps, options) {
         return existing;
     return (await addWorktree(deps, { cwd: mainRoot, name, sessionId: options.sessionId })).record;
 }
+function sessionOriginPath(mainRoot, sessionId) {
+    return join(mainRoot, ".agent-ops", "tasks", "session-origin", sha256(sessionId));
+}
+/** The branch recorded when `sessionId` began, or null. */
+export async function readSessionOrigin(mainRoot, sessionId) {
+    const value = (await readPrivateFile(sessionOriginPath(mainRoot, sessionId), mainRoot).catch(() => null))?.trim();
+    return value !== undefined && TARGET_BRANCH.test(value) ? value : null;
+}
+/**
+ * Pins the branch the main checkout is on to `sessionId`, first write wins:
+ * SessionStart fires again on resume, compact and clear, by which time the
+ * user may have moved. Nothing is recorded from inside a worktree or on a
+ * detached HEAD, so a later add falls back to reading HEAD itself.
+ */
+export async function recordSessionOrigin(deps, options) {
+    if (!SESSION.test(options.sessionId))
+        return;
+    const { mainRoot, currentRoot } = await resolveCheckouts(deps, options.cwd);
+    if (currentRoot !== mainRoot)
+        return;
+    const branch = (await deps.git(mainRoot, ["symbolic-ref", "--short", "-q", "HEAD"])).stdout.trim();
+    if (!TARGET_BRANCH.test(branch))
+        return;
+    const path = sessionOriginPath(mainRoot, options.sessionId);
+    await withPrivateFileLock(path, mainRoot, async () => {
+        if (await readPrivateFile(path, mainRoot) === null)
+            await writePrivateFile(path, `${branch}\n`, mainRoot);
+    });
+}

package/dist/runtime/src/review/execute.js

@@ -1,17 +1,17 @@
 import { randomUUID } from "node:crypto";
-import { chmod, copyFile, lstat, mkdir, mkdtemp, realpath, rm, stat } from "node:fs/promises";
+import { chmod, copyFile, lstat, mkdir, mkdtemp, realpath, rm, stat, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { runVerificationCommand } from "../verify/spawn.js";
 import { redactSecrets } from "../security/redact.js";
-import { extractReviewObject } from "./extract.js";
+import { answeredNothing, conversationIdOf, deniedToolsOf, extractFinalMessage, extractJsonObject, extractReviewObject } from "./extract.js";
 import { buildTargetInvocation } from "./invocation.js";
 import { reviewReportResults, reviewReportStatus, validateReviewReport } from "./report.js";
 import { detectHostTarget, planReviewTargets } from "./roles.js";
 import { detectHostRestriction } from "./host-sandbox.js";
 import { buildAdversarialPrompt, buildReviewPrompt } from "./runner.js";
 import { MAX_ADVERSARIAL_PROMPT_BYTES } from "./runner.js";
-import { extractUsage } from "./usage.js";
+import { extractUsage, sumUsage } from "./usage.js";
 /**
  * Full repository reviews need far more headroom than the lightweight auth
  * probe. Five minutes was not enough: reviewing a real working tree, codex and
@@ -298,6 +298,43 @@ async function snapshotRepository(request, destination, options) {
     }
     return undefined;
 }
+/**
+ * What a lost turn is asked once, in its own conversation. The turn ended
+ * because a tool call was refused, and the reviewer already holds everything
+ * it inspected, so the cheapest recovery is to ask for the answer.
+ */
+/** A resumed turn only has to state an answer it already holds. */
+const NUDGE_TIMEOUT_MS = 300_000;
+const NUDGE_PROMPT = "Your previous turn ended without an answer because a tool call was refused. " +
+    "Do not call any tool. Using only what you have already inspected, reply now " +
+    "with the JSON object the schema requires and nothing else.";
+/**
+ * Keeps what a lost turn left behind. The attempt directory is removed on the
+ * way out and its log is the only record of what the turn spent its tokens on,
+ * so without this a lost turn cannot be diagnosed. Best effort: it returns the
+ * repository-relative directory, or undefined, and never changes the outcome.
+ */
+async function keepLostTurn(repositoryRoot, sessionId, log, stdout, nudge) {
+    // Named in the diagnostic, so it keeps `/` on every platform; `join` below
+    // turns it into the native path.
+    const relative = `.agent-ops/reviews/lost-turns/${sessionId}`;
+    try {
+        const directory = join(repositoryRoot, relative);
+        await mkdir(directory, { recursive: true });
+        await writeFile(join(directory, "stdout.json"), stdout);
+        if (log !== undefined) {
+            await copyFile(log, join(directory, "agy.log"));
+        }
+        if (nudge !== undefined) {
+            await writeFile(join(directory, "nudge-stdout.json"), nudge.stdout);
+            await copyFile(nudge.log, join(directory, "agy-nudge.log")).catch(() => { });
+        }
+        return relative;
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * One target's attempt at one prompt, in a throwaway home directory. Returns a
  * validated report or the reason this target produced no usable verdict; the
@@ -521,10 +558,88 @@ async function attemptTarget(request, options) {
                 payload !== undefined
                 ? ` (fields: ${Object.keys(payload).sort().join(", ")})`
                 : "";
-            return skip(reason, errors.length > 0
-                ? `${errors}${fields}`
-                : firstComplaint(spawned.stdout, spawned.stderr) ??
-                    "the answer carried no review report");
+            const lostTurn = payload === undefined && answeredNothing(target, spawned.stdout);
+            const denied = lostTurn ? deniedToolsOf(target, spawned.stdout) : [];
+            const conversationId = lostTurn ? conversationIdOf(target, spawned.stdout) : undefined;
+            let nudged;
+            let recovered;
+            if (conversationId !== undefined && request.resumeLostTurn !== false &&
+                !budgetSpent(options)) {
+                const nudgeLog = join(attemptDirectory, "agy-nudge.log");
+                const nudge = buildTargetInvocation({
+                    ...invocationRequest,
+                    prompt: NUDGE_PROMPT,
+                    conversationId,
+                    logFile: nudgeLog,
+                    repositoryRoot: snapshotRoot
+                });
+                if (nudge !== undefined) {
+                    options.onProgress?.(`${target}: turn ended without answering${denied.length > 0 ? ` (denied ${denied.join(", ")})` : ""} → resuming the conversation once`);
+                    const nudgeWatch = watchForStall(nudgeLog, options.signal, stallIdleMs);
+                    let second;
+                    try {
+                        second = await runVerificationCommand({
+                            id: `review-${request.label}-nudge`,
+                            command: nudge.command,
+                            args: [...nudge.args],
+                            cwd: executionDirectory,
+                            required: true,
+                            evidence: { kind: "exit-code" },
+                            timeoutMs: stageTimeout(options, NUDGE_TIMEOUT_MS)
+                        }, {
+                            cwd: executionDirectory,
+                            ...(options.runner === undefined ? {} : { runner: options.runner }),
+                            ...(options.outputLimitBytes === undefined
+                                ? {}
+                                : { outputLimitBytes: options.outputLimitBytes }),
+                            stdin: nudge.stdin,
+                            env: environment,
+                            replaceEnv: true,
+                            signal: nudgeWatch.signal,
+                            onActivity: nudgeWatch.beat
+                        });
+                    }
+                    finally {
+                        nudgeWatch.stop();
+                    }
+                    usage = sumUsage(usage, extractUsage(target, second.stdout, second.stderr));
+                    throwIfInterrupted(target, options, second.failureClass);
+                    nudged = { log: nudgeLog, stdout: second.stdout };
+                    if (!nudgeWatch.stalled() && second.failureClass === "none" &&
+                        !second.stdoutTruncated) {
+                        // A resumed agy turn states its answer in `response` and carries no
+                        // `structured_output`; validateReviewReport stays the authority.
+                        const finalMessage = extractFinalMessage(target, second.stdout);
+                        const answer = extractReviewObject(target, second.stdout) ??
+                            (finalMessage === undefined ? undefined : extractJsonObject(finalMessage));
+                        const checked = answer === undefined
+                            ? undefined
+                            : validateReviewReport(answer, request.expectedCriterionIds, request.changedFiles);
+                        if (checked?.ok) {
+                            recovered = checked.value;
+                        }
+                    }
+                }
+            }
+            const kept = lostTurn
+                ? await keepLostTurn(request.repositoryRoot, sessionId, agyLog, spawned.stdout, nudged)
+                : undefined;
+            if (recovered !== undefined) {
+                options.onProgress?.(`${target}: the resumed conversation answered${kept === undefined ? "" : `; lost turn kept at ${kept}`}`);
+                return { kind: "verdict", report: recovered, sessionId, metrics: metrics() };
+            }
+            return {
+                ...skip(reason, lostTurn
+                    ? "the reviewer ended its turn without answering (empty response, no structured output" +
+                        (denied.length > 0 ? `; denied ${denied.join(", ")}` : "") +
+                        ")" +
+                        (kept === undefined ? "" : `; kept ${kept}`)
+                    : errors.length > 0
+                        ? `${errors}${fields}`
+                        : firstComplaint(spawned.stdout, spawned.stderr) ??
+                            "the answer carried no review report"),
+                ...(lostTurn ? { transient: true } : {})
+            };
         }
         return {
             kind: "verdict",
@@ -539,7 +654,8 @@ async function attemptTarget(request, options) {
 }
 /**
  * `attemptTarget`, retried once in a fresh session when the service dropped
- * the call. Only once: a service that is down stays down.
+ * the call or agy ended its turn without answering. Only once: a service that
+ * is down stays down.
  */
 async function attemptTargetWithRetry(request, options) {
     const first = await attemptTarget(request, options);
@@ -547,7 +663,7 @@ async function attemptTargetWithRetry(request, options) {
         return first;
     }
     options.onProgress?.(`${request.target}: ${first.diagnostic} → retrying once`);
-    return attemptTarget(request, options);
+    return attemptTarget({ ...request, resumeLostTurn: false }, options);
 }
 /** Builds the `execute` callback with one necessary and one adversarial review. */
 export function createReviewExecutor(options) {

package/dist/runtime/src/review/extract.js

@@ -50,6 +50,46 @@ export function extractFinalMessage(target, stdout) {
 export function extractJsonObject(text) {
     return parseObject(text.trim());
 }
+/**
+ * agy's plan mode can end its one `--print` turn without answering: a valid
+ * envelope with no `structured_output` and an empty `response`. That is a lost
+ * turn, not a verdict, so a fresh session is worth one retry. Anything the
+ * target did say, or any other target, is a real protocol failure instead.
+ */
+export function answeredNothing(target, stdout) {
+    if (target !== "agy") {
+        return false;
+    }
+    const envelope = parseObject(stdout);
+    if (envelope === undefined || envelope.structured_output !== undefined) {
+        return false;
+    }
+    const response = envelope.response;
+    return response === undefined ||
+        (typeof response === "string" && response.trim().length === 0);
+}
+/** The conversation a lost agy turn can be resumed in; agy alone reports one. */
+export function conversationIdOf(target, stdout) {
+    const id = target === "agy" ? parseObject(stdout)?.conversation_id : undefined;
+    return typeof id === "string" && id.length > 0 ? id : undefined;
+}
+/**
+ * The tools agy's print mode refused because nobody could confirm them. A turn
+ * that calls one ends there, which is what a lost turn is.
+ */
+export function deniedToolsOf(target, stdout) {
+    const denied = target === "agy" ? parseObject(stdout)?.denied_actions : undefined;
+    if (!Array.isArray(denied)) {
+        return [];
+    }
+    return denied.flatMap((action) => {
+        if (!isRecord(action)) {
+            return [];
+        }
+        const name = action.display_name ?? action.action;
+        return typeof name === "string" && name.length > 0 ? [name] : [];
+    });
+}
 /**
  * Review results use a strict native structured-output transport. Unlike the
  * legacy probe parser above, this path neither recovers fenced JSON nor accepts

package/dist/runtime/src/review/invocation.js

@@ -149,6 +149,9 @@ export function buildTargetInvocation(request) {
                 ? []
                 : ["--add-dir", request.repositoryRoot]),
             ...logArgs(request.target, request.logFile),
+            ...(request.target === "agy" && request.conversationId !== undefined
+                ? ["--conversation", request.conversationId]
+                : []),
             ...isolationArgs(request.target),
             ...shared
         ],

package/dist/runtime/src/review/usage.js

@@ -69,3 +69,22 @@ export function extractUsage(target, stdout, stderr) {
         ...defined("costUsd", count(envelope?.total_cost_usd))
     });
 }
+/** Two rounds of one attempt add up; a field only one round reported stays. */
+export function sumUsage(first, second) {
+    if (first === undefined || second === undefined) {
+        return first ?? second;
+    }
+    const add = (key) => {
+        const a = first[key];
+        const b = second[key];
+        return a === undefined && b === undefined ? {} : { [key]: (a ?? 0) + (b ?? 0) };
+    };
+    return {
+        ...add("inputTokens"),
+        ...add("outputTokens"),
+        ...add("cacheReadTokens"),
+        ...add("cacheWriteTokens"),
+        ...add("totalTokens"),
+        ...add("costUsd")
+    };
+}

package/docs/en/guides/configuration.md

@@ -92,6 +92,18 @@ would consume the following flag instead. It deliberately does not pass
 `--dangerously-skip-permissions`, which overrides the permission boundary, or
 `--disable-slash-commands`, which disables plan-mode behavior.
 
+Agy can end its one `--print` turn without answering: print mode has nobody to
+confirm a tool call, so it refuses the call and the turn stops with an empty
+`response` and no `structured_output`. The refused tools are listed in the
+envelope's `denied_actions` and named in the diagnostic. agent-ops first resumes
+that same conversation once (`--conversation`) and asks for the answer without
+tools, then falls back to one fresh session. The lost turn's `agy.log` and
+`stdout.json` are kept under `.agent-ops/reviews/lost-turns/<sessionId>/`
+(local, git-ignored, never cleaned up automatically). If the denied tool is an
+MCP tool from your own agy configuration, disabling that server for agy
+(`agy mcp disable <name>`) removes the trigger; agent-ops does not change your
+agy configuration.
+
 Host network or loopback restrictions return `REVIEW_NOT_RUN` before any
 reviewer is started. The managed instructions require a trusted outer host
 runner to start the exact same command with both capabilities on its first
@@ -164,9 +176,15 @@ evidence. Give each editing conversation its own worktree instead:
   fails, the denial says why and falls back to the manual `worktree add`.
   Run `agent-ops update` once so the PreToolUse hook gets the 600-second
   timeout setup needs.
-- `add` creates `.worktrees/<name>` on branch `agent-ops/<name>` from the main
-  checkout's HEAD and excludes `/.worktrees/` through `.git/info/exclude`,
-  never `.gitignore`. It copies the ignored files agent-ops installed and any
+- `add` creates `.worktrees/<name>` on branch `agent-ops/<name>` and excludes
+  `/.worktrees/` through `.git/info/exclude`, never `.gitignore`. Its base and
+  its merge target are the branch the main checkout was on when the session
+  began: SessionStart records that branch once per session (resume, compact and
+  clear never overwrite it; nothing is recorded on a detached HEAD or from
+  inside a worktree), so switching branches mid-session does not retarget the
+  work. Without a record it reads the main checkout's HEAD at add time, an
+  explicit `--target-branch` or `--from` outranks the record, and a recorded
+  branch that no longer exists is an error naming `--target-branch`. It copies the ignored files agent-ops installed and any
   file matched by a root `.worktreeinclude` (gitignore syntax, for example
   `.env` or `local.properties`); a file Git already checked out is never
   overwritten. Trust is inherited only when the main checkout is trusted and
@@ -188,10 +206,20 @@ evidence. Give each editing conversation its own worktree instead:
   each task keeps its own review record, so a parent and a subtask reviewed
   on the same source do not overwrite each other.
 - `agent-ops worktree finish <name>` merges by fast-forward only, one finish
-  at a time. If the target moved, it rebases; a clean rebase whose own patch
+  at a time. When the main checkout is on the target branch the merge updates
+  its files, so uncommitted changes there block it. When the main checkout is
+  on another branch or detached, only the target's ref moves: the checkout, its
+  files and its uncommitted changes are left alone. A target checked out in
+  another worktree is refused, naming that path. If the target moved, it rebases; a clean rebase whose own patch
   is unchanged is re-verified before merging, and a conflict is reported with
   the `refs/notes/agent-ops` intent of the work that landed first. The note
-  records every task of the worktree, subtasks indented under their parent.
+  records every task of the worktree, subtasks indented under their parent,
+  and a `session: <id>` line naming the session that finished it. Finish
+  also resets that session's gate baseline to the merged source, so the
+  session can stop although the task now lives only in the note. As a
+  fallback, the gate lets an unattached session stop when the checkout is
+  clean and a note with its `session:` line sits within the newest 500
+  commits of `HEAD`; older merges need a one-time `allow-stop`.
 - `worktree list`, `resume <name> --session <id>` and `remove <name>` manage
   what is left; `remove --force` discards work and asks the user first.
   `doctor` reports worktrees idle for more than seven days.

package/docs/en/spec/delegation.md

@@ -35,7 +35,7 @@ Concurrent delegated writers MUST NOT share one working tree.
 Parallel editing conversations in one repository MUST each work in their own agent-ops worktree.
 
 - Trigger: `worktree.mode` is `auto`, or a second conversation will edit the repository while another is still open.
-- Action: Run `agent-ops worktree add <name> --session <id>` from the main checkout before the first edit, work only in the printed path, and merge with `agent-ops worktree finish <name>` after the task completes against the printed `--base`.
+- Action: Run `agent-ops worktree add <name> --session <id>` from the main checkout before the first edit, work only in the printed path, and merge with `agent-ops worktree finish <name>` after the task completes against the printed `--base`. The merge lands on the branch the main checkout was on when the session began, wherever that checkout is now.
 - Evidence: `agent-ops worktree list` shows one worktree per editing session, and each finish reports a fast-forward merge.
 - Positive: `Two conversations edit .worktrees/login and .worktrees/cart; each verifies, reviews and finishes on its own.`
 - Negative: `Two conversations edit the main checkout at once, so each one's verification and review is voided by the other's writes.`

package/docs/zh-TW/guides/configuration.md

@@ -81,6 +81,15 @@ Agy 的 prompt 會直接作為 `--print` 的值；裸用 `-p` 會誤吞下一個
 agent-ops 刻意不傳會繞過權限邊界的 `--dangerously-skip-permissions`，也不傳會
 使 plan mode 失效的 `--disable-slash-commands`。
 
+Agy 可能在唯一一輪 `--print` 中沒有回答就結束：print mode 沒有人可以確認工具呼叫，
+會拒絕該次呼叫並停止，`response` 為空且沒有 `structured_output`。被拒的工具列在
+信封的 `denied_actions`，並寫進診斷訊息。agent-ops 會先在同一個對話續問一次
+（`--conversation`，要求不用工具直接回答），失敗才退回一個全新的 session。lost turn 的
+`agy.log` 與 `stdout.json` 會保留在 `.agent-ops/reviews/lost-turns/<sessionId>/`
+（僅本機、被 git 忽略、不會自動清理）。若被拒的是你自己 agy 設定的 MCP 工具，
+對 agy 停用該 server（`agy mcp disable <name>`）即可移除觸發原因；agent-ops 不會
+更動你的 agy 設定。
+
 Host 缺少 network 或 loopback 權限時，會在啟動任何 reviewer 前回傳
 `REVIEW_NOT_RUN`。Managed 規則要求可信任的外部 host runner 在第一次呼叫時
 就用兩項權限啟動同一個完整指令；不要先在原 sandbox 執行再重試，因為那不算
@@ -145,9 +154,13 @@ fingerprint，因此兩個對話修改同一個 checkout 會互相作廢對方
   則作為每條命令的工作目錄）；同一 session 之後被拒絕時會重用它。
   建立失敗時，拒絕訊息會說明原因並退回手動 `worktree add`。需先執行一次
   `agent-ops update`，讓 PreToolUse hook 取得 setup 所需的 600 秒逾時。
-- `add` 從主 checkout 的 HEAD 建立 `.worktrees/<name>` 與 branch
-  `agent-ops/<name>`，並透過 `.git/info/exclude`（而非 `.gitignore`）排除
-  `/.worktrees/`。它會複製 agent-ops 安裝的 ignored 檔案，以及根目錄
+- `add` 建立 `.worktrees/<name>` 與 branch `agent-ops/<name>`，並透過
+  `.git/info/exclude`（而非 `.gitignore`）排除 `/.worktrees/`。它的 base 與合併
+  目標是 session 開始時主 checkout 所在的 branch：SessionStart 會為每個 session
+  記錄該 branch 一次（resume、compact、clear 都不會覆寫；detached HEAD 或在
+  worktree 內觸發時不記錄），所以中途切換 branch 不會改變工作的目標。沒有記錄時
+  會在 add 當下讀取主 checkout 的 HEAD；明確的 `--target-branch` 或 `--from`
+  優先於記錄；記錄的 branch 已不存在時會報錯，並提示使用 `--target-branch`。它會複製 agent-ops 安裝的 ignored 檔案，以及根目錄
   `.worktreeinclude`（gitignore 語法，例如 `.env` 或 `local.properties`）比對到
   的檔案；Git 已 checkout 的檔案一律不覆寫。只有主 checkout 已 trusted 且
   worktree 的 effective config 完全相同時才繼承 trust。
@@ -165,9 +178,17 @@ fingerprint，因此兩個對話修改同一個 checkout 會互相作廢對方
   維持附著在 task 樹最上層，且每個 task 各自保留 review 紀錄，所以在同一份原始碼上
   review 的 parent 與 subtask 不會互相覆蓋。
 - `agent-ops worktree finish <name>` 只以 fast-forward 合併，一次只執行一個
-  finish。Target 若已前進會先 rebase；沒有衝突且自身 patch 不變的 rebase 會先
+  finish。主 checkout 就在 target branch 上時，合併會更新它的檔案，所以那裡有未
+  commit 的變更會擋住合併；主 checkout 在其他 branch 或 detached 時，只移動
+  target 的 ref，checkout、檔案與未 commit 的變更都不會被動到。Target 若被其他
+  worktree checkout 則拒絕，並指出該路徑。Target 若已前進會先 rebase；沒有衝突且自身 patch 不變的 rebase 會先
   重新驗證再合併；衝突則連同先合併那份工作在 `refs/notes/agent-ops` 的意圖一起
-  回報。Note 會記錄 worktree 的每個 task，subtask 縮排在其 parent 之下。
+  回報。Note 會記錄 worktree 的每個 task，subtask 縮排在其 parent 之下，並附上
+  一行 `session: <id>`，標明完成這次 finish 的 session。Finish 也會把該 session
+  的 gate baseline 重設為合併後的原始碼，所以即使 task 現在只存在於 note 裡，
+  session 仍可停止。作為後備，gate 在 checkout 乾淨、且 `HEAD` 最近 500 個 commit
+  內有帶該 `session:` 行的 note 時，會讓未附著 task 的 session 停止；更舊的合併需要
+  一次性的 `allow-stop`。
 - `worktree list`、`resume <name> --session <id>` 與 `remove <name>` 管理剩下的
   worktree；`remove --force` 會丟棄工作，執行前會先詢問使用者。`doctor` 會回報
   閒置超過七天的 worktree。

package/docs/zh-TW/spec/delegation.md

@@ -37,7 +37,7 @@ English source version: 2026-09-24. Revalidate: when the English specification c
 同一個 repository 中並行修改檔案的對話 MUST 各自在自己的 agent-ops worktree 中工作。
 
 - Trigger: `worktree.mode` 為 `auto`，或另一個對話仍開著時，第二個對話也要修改這個 repository。
-- Action: 第一次修改前，在主 checkout 執行 `agent-ops worktree add <name> --session <id>`，只在印出的路徑中工作；task 以印出的 `--base` 完成後，用 `agent-ops worktree finish <name>` 合併。
+- Action: 第一次修改前，在主 checkout 執行 `agent-ops worktree add <name> --session <id>`，只在印出的路徑中工作；task 以印出的 `--base` 完成後，用 `agent-ops worktree finish <name>` 合併。合併目標是 session 開始時主 checkout 所在的 branch，不論該 checkout 現在在哪裡。
 - Evidence: `agent-ops worktree list` 顯示每個修改中的 session 各有一個 worktree，且每次 finish 都回報 fast-forward 合併。
 - Positive: `兩個對話分別修改 .worktrees/login 與 .worktrees/cart；各自驗證、review 並 finish。`
 - Negative: `兩個對話同時修改主 checkout，彼此的寫入讓對方的驗證與 review 全部作廢。`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kylecheng3146/agent-ops",
-  "version": "0.3.4",
+  "version": "0.3.6",
   "description": "Evidence-driven development loops for agy, Codex, Claude Code, and opencode",
   "type": "module",
   "license": "MIT",