@loicngr/kobo 1.11.13 → 1.11.15

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to Kōbō are documented here. The format is based on
 [Keep a Changelog](https://keepachangelog.com/). Each release is an `## <version>`
 section — the in-app "What's new" dialog reads this file.
 
+## 1.11.15
+
+- feat(agent): harden autonomous session lifecycle
+
+## 1.11.14
+
+- ⬆️ develop - refactor(deps): Bump SDKs + refactor shutdown + hardening sécurité
+
 ## 1.11.13
 
 - fix(engines): unstick agent sessions that never emit session:ended

package/dist/mcp-server/kobo-tasks-handlers.js

@@ -4,6 +4,7 @@ import { nanoid } from 'nanoid';
 import * as cronService from '../server/services/cron-service.js';
 import * as settingsService from '../server/services/settings-service.js';
 import { slugifyProjectName } from '../server/utils/project-slug.js';
+import { resolveExistingPathInside } from '../server/utils/safe-path.js';
 import { resolveWorkspaceWorktreePath } from '../server/utils/worktree-paths.js';
 /** Allowed task status values. */
 export const VALID_TASK_STATUSES = ['pending', 'in_progress', 'done'];
@@ -296,6 +297,7 @@ export function getTicketSourcesHandler(worktreePath) {
 export const DOCUMENT_DIRS = ['docs/plans', 'docs/superpowers', '.ai/thoughts'];
 /** Depth cap to keep recursion bounded even on pathological symlink loops. */
 const DOC_MAX_DEPTH = 8;
+const DOC_MAX_FILE_BYTES = 1024 * 1024;
 function walkMarkdownFiles(rootAbs, rootRel, out, depth = 0) {
     if (depth > DOC_MAX_DEPTH)
         return;
@@ -313,11 +315,13 @@ function walkMarkdownFiles(rootAbs, rootRel, out, depth = 0) {
         const relEntry = `${rootRel}/${entry}`;
         let stat;
         try {
-            stat = fs.statSync(absEntry);
+            stat = fs.lstatSync(absEntry);
         }
         catch {
             continue;
         }
+        if (stat.isSymbolicLink())
+            continue;
         if (stat.isDirectory()) {
             walkMarkdownFiles(absEntry, relEntry, out, depth + 1);
         }
@@ -336,7 +340,14 @@ export function listDocumentsHandler(worktreePath) {
         const absDir = path.join(worktreePath, dir);
         if (!fs.existsSync(absDir))
             continue;
-        walkMarkdownFiles(absDir, dir, documents);
+        try {
+            if (fs.lstatSync(absDir).isSymbolicLink())
+                continue;
+            walkMarkdownFiles(resolveExistingPathInside(worktreePath, absDir), dir, documents);
+        }
+        catch {
+            // A document directory outside the worktree is never eligible.
+        }
     }
     documents.sort((a, b) => new Date(b.modifiedAt).getTime() - new Date(a.modifiedAt).getTime());
     return documents;
@@ -361,7 +372,19 @@ export function readDocumentHandler(worktreePath, relPath) {
     if (!fs.existsSync(abs)) {
         throw new Error(`Document not found: ${normalized}`);
     }
-    return { path: normalized, content: fs.readFileSync(abs, 'utf-8') };
+    const lstat = fs.lstatSync(abs);
+    if (lstat.isSymbolicLink()) {
+        // Resolve for a consistent error if the link escapes; internal links are
+        // rejected too so list/read share the same no-symlink contract.
+        resolveExistingPathInside(worktreePath, abs);
+        throw new Error('Symbolic links are not allowed in documents');
+    }
+    const safeAbs = resolveExistingPathInside(worktreePath, abs);
+    const stat = fs.statSync(safeAbs);
+    if (stat.size > DOC_MAX_FILE_BYTES) {
+        throw new Error(`Document too large (max ${DOC_MAX_FILE_BYTES / 1024 / 1024} MB)`);
+    }
+    return { path: normalized, content: fs.readFileSync(safeAbs, 'utf-8') };
 }
 /**
  * Append a thought / decision / note to

package/dist/mcp-server/kobo-tasks-server.js

@@ -188,6 +188,21 @@ const WORKSPACE_SCOPED_TOOLS = [
         inputSchema: { type: 'object', properties: {}, required: [] },
         annotations: { readOnlyHint: true, openWorldHint: false },
     },
+    {
+        name: 'set_auto_loop',
+        description: 'Enable or disable auto-loop for THIS workspace. Read get_workspace_info first. Enable it only when the user explicitly asks for autonomous continuation and pending tasks remain; disable it only when the user explicitly asks. Kōbō resumes the next iteration automatically after a session ends while it is enabled.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                enabled: {
+                    type: 'boolean',
+                    description: 'True to enable auto-loop; false to disable it.',
+                },
+            },
+            required: ['enabled'],
+        },
+        annotations: { destructiveHint: false, openWorldHint: false },
+    },
     {
         name: 'set_workspace_agent_description',
         description: "Set or clear the workspace's agent-side description (≤ 200 chars). Pass an empty string to clear. The user sees this string under the workspace title in the sidebar (it takes precedence over the user-controlled `description` field). Plain text only. The current value is available via get_workspace_info as agentDescription. NOTE: there is a separate user-controlled `description` field — do NOT try to write it; it has no MCP tool.",
@@ -641,6 +656,18 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         if (name === 'get_workspace_info') {
             return ok(getWorkspaceInfoHandler(db, workspaceId));
         }
+        if (name === 'set_auto_loop') {
+            if (typeof a.enabled !== 'boolean')
+                return fail('enabled parameter is required and must be boolean');
+            try {
+                const method = a.enabled ? 'POST' : 'DELETE';
+                const result = await backendRequest(method, `/api/workspaces/${workspaceId}/auto-loop`);
+                return ok(result);
+            }
+            catch (err) {
+                return fail(err instanceof Error ? err.message : String(err));
+            }
+        }
         if (name === 'set_workspace_agent_description') {
             const description = a.description;
             if (typeof description !== 'string')

package/dist/server/db/migrations.js

@@ -591,6 +591,19 @@ export const migrations = [
       `);
         },
     },
+    {
+        version: 35,
+        name: 'add-agent-session-task-progress-baseline',
+        migrate: (db) => {
+            const table = db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'agent_sessions'").get();
+            if (!table)
+                return;
+            const columns = db.prepare('PRAGMA table_info(agent_sessions)').all();
+            if (!columns.some((column) => column.name === 'task_progress_baseline')) {
+                db.exec('ALTER TABLE agent_sessions ADD COLUMN task_progress_baseline TEXT');
+            }
+        },
+    },
 ];
 /** Current schema version — always equals the highest migration version. */
 export const SCHEMA_VERSION = migrations.length > 0 ? migrations[migrations.length - 1].version : 1;

package/dist/server/db/schema.js

@@ -62,7 +62,8 @@ export function initSchema(db) {
       model TEXT,
       started_at TEXT NOT NULL,
       ended_at TEXT,
-      name TEXT
+      name TEXT,
+      task_progress_baseline TEXT
     );
 
     CREATE TABLE IF NOT EXISTS ws_events (

package/dist/server/index.js

@@ -25,12 +25,12 @@ import templatesRouter from './routes/templates.js';
 import usageRoutes from './routes/usage.js';
 import voiceRouter from './routes/voice.js';
 import workspacesRouter from './routes/workspaces.js';
-import { getAvailableSkills, reconcileOrphanSessions, restoreRetryCountsFromDb, sendMessage, setBackendPort, startAgent, startWatchdog, stopAgent, stopWatchdog, } from './services/agent/orchestrator.js';
+import { getAvailableSkills, reconcileOrphanSessions, restoreRetryCountsFromDb, sendMessage, setBackendPort, startAgent, startWatchdog, stopAgent, stopAllAgents, stopWatchdog, } from './services/agent/orchestrator.js';
 import * as autoLoopService from './services/auto-loop-service.js';
 import { runContentMigrationIfNeeded } from './services/content-migration-service.js';
 import * as cronService from './services/cron-service.js';
 import { createDailyDbBackupIfNeeded, createPreMigrationBackup } from './services/db-backup-service.js';
-import { startDevServer, stopDevServer } from './services/dev-server-service.js';
+import { startDevServer, stopAllDevServers, stopDevServer } from './services/dev-server-service.js';
 import { authorizeWsUpgrade, generateToken, getLanUrls, resolveBindHost, resolveNetworkAccessEnvOverrides, } from './services/network-access-service.js';
 import { startPrWatcher, stopPrWatcher } from './services/pr-watcher-service.js';
 import * as quotaBackoffService from './services/quota-backoff-service.js';
@@ -42,7 +42,6 @@ import * as wakeupService from './services/wakeup-service.js';
 import { emit, emitEphemeral, handleConnection, setMessageHandler } from './services/websocket-service.js';
 import { getActiveSession, getWorkspace, updateWorkspaceStatus } from './services/workspace-service.js';
 import { getClientSpaPath, getDbPath, getKoboHome, getPackageVersion } from './utils/paths.js';
-import { initProcessCleanup, killAll as killAllTrackedProcesses } from './utils/process-tracker.js';
 console.log(`[kobo] Kōbō home: ${getKoboHome()}`);
 // Initialize DB + run migrations
 const db = getDb();
@@ -72,7 +71,6 @@ void createDailyDbBackupIfNeeded(db, getDbPath()).then((r) => {
     }
 });
 // Initialize process cleanup, agent watchdog, PR watcher, and wakeup rehydration
-initProcessCleanup();
 reconcileOrphanSessions();
 startWatchdog();
 wakeupService.rehydrate();
@@ -490,10 +488,10 @@ async function gracefulShutdown(signal) {
     catch {
         // Best-effort
     }
-    // Kill all tracked child processes (agents, dev servers)
+    // Stop managed agents and both direct/Docker dev servers before closing DB.
     try {
-        killAllTrackedProcesses();
-        console.log('[kobo] Tracked processes killed');
+        await Promise.all([stopAllAgents(), stopAllDevServers()]);
+        console.log('[kobo] Agents and dev servers stopped');
     }
     catch {
         // Best-effort

package/dist/server/routes/export.js

@@ -5,7 +5,8 @@ import * as workspaceService from '../services/workspace-service.js';
 const app = new Hono();
 /** Quote a CSV cell when it contains a delimiter, quote, or newline (RFC 4180). */
 function csvCell(value) {
-    return /[",\r\n]/.test(value) ? `"${value.replace(/"/g, '""')}"` : value;
+    const safeValue = /^[\s]*[=+\-@]/.test(value) ? `'${value}` : value;
+    return /[",\r\n]/.test(safeValue) ? `"${safeValue.replace(/"/g, '""')}"` : safeValue;
 }
 function csvRow(values) {
     return values.map(csvCell).join(',');

package/dist/server/routes/workspaces.js

@@ -42,6 +42,7 @@ import * as worktreeService from '../services/worktree-service.js';
 import { resolveUniqueBranchAndPath } from '../utils/branch-resolver.js';
 import * as gitOps from '../utils/git-ops.js';
 import { slugifyProjectName } from '../utils/project-slug.js';
+import * as safePath from '../utils/safe-path.js';
 import { resolveSiblingWorkspaceWorktreePath } from '../utils/worktree-paths.js';
 /** Hono sub-router for workspace CRUD, tasks, agent lifecycle, git operations, and PR creation. */
 const app = new Hono();
@@ -2692,6 +2693,13 @@ app.get('/:id/diff-file', (c) => {
             return c.json({ error: `Workspace '${id}' not found` }, 404);
         }
         const worktreePath = workspace.worktreePath;
+        try {
+            safePath.assertPathInside(worktreePath, filePath);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return c.json({ error: message }, 400);
+        }
         if (c.req.query('mode') === 'commits') {
             const from = c.req.query('from');
             const to = c.req.query('to');
@@ -2750,6 +2758,13 @@ app.post('/:id/rollback-file', async (c) => {
         if (!filePath) {
             return c.json({ error: 'Missing or invalid `path` field' }, 400);
         }
+        try {
+            safePath.assertPathInside(workspace.worktreePath, filePath);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return c.json({ error: message }, 400);
+        }
         let target;
         try {
             target = gitOps.rollbackFile(workspace.worktreePath, workspace.workingBranch, filePath);

package/dist/server/services/agent/engines/claude-code/engine.js

@@ -97,7 +97,9 @@ export function createClaudeCodeEngine() {
         async start(options, onEvent) {
             const abortController = new AbortController();
             const mapperState = createMapperState();
-            const activeSubagentToolCallIds = new Set();
+            // UI/tool ids can differ from the SDK task id. Key by the stable UI id
+            // so a terminal notification that omits task_id still clears the task.
+            const activeSubagentTaskIds = new Map();
             // Pending canUseTool callbacks, keyed by SDK ctx.toolUseID.
             const pendingResolvers = new Map();
             const isInteractive = options.agentPermissionMode === 'interactive';
@@ -232,6 +234,22 @@ export function createClaudeCodeEngine() {
             let iteratorRunning = false;
             let userInterrupted = false;
             let completedResponses = 0;
+            let turnCompletedEmittedForResponse = 0;
+            // `result` is the Claude Agent SDK's per-turn completion signal. Keep
+            // it distinct from iterator completion: the SDK may still drain
+            // informational events afterwards, while Kōbō must retain the session
+            // for orchestration and auto-loop until `session:ended`.
+            const emitTurnCompletedIfSettled = () => {
+                if (completedResponses === 0 ||
+                    completedResponses === turnCompletedEmittedForResponse ||
+                    activeSubagentTaskIds.size > 0 ||
+                    pendingResolvers.size > 0 ||
+                    inputStream.hasUnansweredInput(completedResponses)) {
+                    return;
+                }
+                turnCompletedEmittedForResponse = completedResponses;
+                safeEmit({ kind: 'turn:completed' });
+            };
             // Guard so the post-result drain watchdog and the natural loop exit (or
             // catch block) never both emit `session:ended` for the same run.
             let sessionEndedEmitted = false;
@@ -267,8 +285,12 @@ export function createClaudeCodeEngine() {
                         return;
                     }
                     console.warn(`[claude-engine] SDK stream inactive ${TEXT_IDLE_TIMEOUT_MS}ms after a text-only response — forcing session:ended`);
-                    const reason = userInterrupted ? 'killed' : mapperState.sawErrorResult ? 'error' : 'completed';
-                    emitSessionEnded(reason, reason === 'completed' ? 0 : null);
+                    if (userInterrupted)
+                        emitSessionEnded('killed', null);
+                    else if (mapperState.sawErrorResult)
+                        emitSessionEnded('error', null);
+                    else
+                        emitSessionEnded('watchdog', null);
                     abortController.abort();
                 }, TEXT_IDLE_TIMEOUT_MS);
                 textIdleTimer.unref?.();
@@ -278,8 +300,12 @@ export function createClaudeCodeEngine() {
                     return;
                 resultDrainTimer = setTimeout(() => {
                     console.warn(`[claude-engine] SDK generator still open ${RESULT_DRAIN_TIMEOUT_MS}ms after 'result' — forcing session:ended`);
-                    const reason = userInterrupted ? 'killed' : mapperState.sawErrorResult ? 'error' : 'completed';
-                    emitSessionEnded(reason, reason === 'completed' ? 0 : null);
+                    if (userInterrupted)
+                        emitSessionEnded('killed', null);
+                    else if (mapperState.sawErrorResult)
+                        emitSessionEnded('error', null);
+                    else
+                        emitSessionEnded('watchdog', null);
                     abortController.abort();
                 }, RESULT_DRAIN_TIMEOUT_MS);
                 resultDrainTimer.unref?.();
@@ -309,7 +335,7 @@ export function createClaudeCodeEngine() {
                     if (inputStream.hasUnansweredInput(completedResponses))
                         return;
                     console.warn(`[claude-engine] Subagent(s) still tracked active ${SUBAGENT_STALL_TIMEOUT_MS}ms after the last turn ended — forcing session drain.`);
-                    activeSubagentToolCallIds.clear();
+                    activeSubagentTaskIds.clear();
                     // This is a forced, unclean termination (the subagent may still be
                     // alive server-side) — never report it as a normal completion, so
                     // auto-loop doesn't treat an orphaned run as forward progress.
@@ -328,16 +354,16 @@ export function createClaudeCodeEngine() {
                             if (ev.kind !== 'subagent:progress')
                                 continue;
                             if (ev.status === 'running')
-                                activeSubagentToolCallIds.add(ev.toolCallId);
+                                activeSubagentTaskIds.set(ev.toolCallId, ev.taskId ?? ev.toolCallId);
                             else
-                                activeSubagentToolCallIds.delete(ev.toolCallId);
+                                activeSubagentTaskIds.delete(ev.toolCallId);
                         }
                         // The stall watchdog is only armed while we're waiting purely on
                         // background subagents (no further SDK turn expected unless one
                         // reports done). React the moment the last one clears instead of
                         // waiting for a 'result' message that may never come.
                         if (subagentStallTimer &&
-                            activeSubagentToolCallIds.size === 0 &&
+                            activeSubagentTaskIds.size === 0 &&
                             !inputStream.hasUnansweredInput(completedResponses)) {
                             clearSubagentStallWatchdog();
                             inputStream.close();
@@ -358,9 +384,10 @@ export function createClaudeCodeEngine() {
                         if (msg.type === 'result') {
                             clearTextIdleWatchdog();
                             completedResponses++;
+                            emitTurnCompletedIfSettled();
                             // A queued forced message starts the next response on this same SDK stream.
                             if (!inputStream.hasUnansweredInput(completedResponses)) {
-                                if (activeSubagentToolCallIds.size === 0) {
+                                if (activeSubagentTaskIds.size === 0) {
                                     clearSubagentStallWatchdog();
                                     inputStream.close();
                                     armResultDrainWatchdog();
@@ -454,7 +481,7 @@ export function createClaudeCodeEngine() {
                     // background subagent task keeps running unless told to stop via
                     // its own API, which would otherwise leave the Stop button
                     // appearing to do nothing for up to SUBAGENT_STALL_TIMEOUT_MS.
-                    for (const taskId of activeSubagentToolCallIds) {
+                    for (const taskId of activeSubagentTaskIds.values()) {
                         try {
                             void q.stopTask(taskId).catch(() => {
                                 /* best-effort */

package/dist/server/services/agent/engines/claude-code/event-mapper.js

@@ -192,7 +192,8 @@ export function mapSdkMessage(msg, state) {
             return events;
         }
         if (subtype === 'task_started' || subtype === 'task_progress' || subtype === 'task_notification') {
-            const toolCallId = typeof parsed.tool_use_id === 'string' ? parsed.tool_use_id : undefined;
+            const taskId = typeof parsed.task_id === 'string' ? parsed.task_id : undefined;
+            const toolCallId = typeof parsed.tool_use_id === 'string' ? parsed.tool_use_id : taskId;
             if (toolCallId) {
                 const usage = parsed.usage;
                 // Unlike task_started/task_progress (in-flight signals), task_notification
@@ -204,6 +205,7 @@ export function mapSdkMessage(msg, state) {
                 events.push({
                     kind: 'subagent:progress',
                     toolCallId,
+                    ...(taskId ? { taskId } : {}),
                     status: isDone ? 'done' : 'running',
                     description: typeof parsed.description === 'string' ? parsed.description : undefined,
                     taskType: typeof parsed.task_type === 'string' ? parsed.task_type : undefined,

package/dist/server/services/agent/engines/claude-code/options-builder.js

@@ -2,7 +2,7 @@ const KOBO_MCP_BRIEF = [
     '[Kōbō MCP] This workspace exposes a dedicated MCP server with tools prefixed `kobo__`.',
     'Non-interactive mode: this session runs via the Claude Agent SDK in single-shot mode. To ask the user a question, call the `AskUserQuestion` tool — Kōbō will pause the session, collect the answer asynchronously, and resume.',
     '⚠️ HARD RULE — emit AT MOST ONE `AskUserQuestion` tool call per turn, and emit it ALONE (no other tool calls in the same response). The Claude Agent SDK rejects parallel defers: a second `AskUserQuestion` in the same turn breaks the pause mechanism, makes both calls fail with "AskUserQuestion fails", and the user sees the panel arrive only at the end of the turn (if at all). If you have N questions, group them as a multi-question array inside ONE call: `AskUserQuestion({ questions: [{ question: "Q1", options: [...] }, { question: "Q2", options: [...] }] })`. After invoking it, STOP — do not emit any other tool call. Wait for the resume.',
-    'Plan mode: when running with `permissionMode: plan`, the read-only restriction applies to MCP tools too. For Kōbō: `kobo__list_*`, `kobo__read_document`, `kobo__search_codebase`, `kobo__get_*` are fine; `kobo__mark_task_done`, `kobo__log_thought`, `kobo__set_workspace_status` are mutations and must wait until the plan is approved.',
+    'Plan mode: when running with `permissionMode: plan`, the read-only restriction applies to MCP tools too. For Kōbō: `kobo__list_*`, `kobo__read_document`, `kobo__search_codebase`, `kobo__get_*` are fine; `kobo__mark_task_done`, `kobo__log_thought`, `kobo__set_workspace_status`, `kobo__set_auto_loop` are mutations and must wait until the plan is approved.',
     'Conventions — read these BEFORE starting work, not as a fallback:',
     '• `kobo__list_tasks` first on any non-trivial turn, then `kobo__mark_task_done` as each item completes.',
     '• `kobo__list_documents` / `kobo__read_document` to discover existing plans and specs under docs/ and .ai/thoughts/ before writing new ones.',
@@ -10,6 +10,7 @@ const KOBO_MCP_BRIEF = [
     '• `kobo__search_codebase` to recall prior chat history (conversations, not source — use Grep for source).',
     '• `kobo__read_workspace_events_csv` to read paginated user/agent history from this workspace across sessions when prior context is useful. Use `limit` + `offset` (and optional `session_id`) instead of loading everything.',
     '• `kobo__get_workspace_info` / `kobo__get_git_info` / `kobo__get_ticket` for context.',
+    '• If `kobo__get_workspace_info` reports `autoLoop: false`, call `kobo__set_auto_loop({ enabled: true })` only when the user explicitly asks for autonomous continuation; never disable it unless explicitly asked.',
     '• `kobo__set_workspace_status` when the mission is done or irrecoverably blocked. Never set `idle` while this session is active; use AskUserQuestion for clarification, or end the turn.',
     '• `kobo__schedule_wakeup` / `kobo__cancel_wakeup` to schedule (or cancel) a follow-up session — prefer these over the built-in `ScheduleWakeup` tool.',
     'Each tool carries its own "WHEN to use" guidance in its description — follow it.',

package/dist/server/services/agent/engines/codex/engine.js

@@ -268,6 +268,8 @@ export function createCodexEngine() {
                                 armSubagentStallWatchdog();
                             }
                             else {
+                                if (n.turn?.status === 'completed')
+                                    safeEmit({ kind: 'turn:completed' });
                                 resolveTurnDone();
                             }
                         }

package/dist/server/services/agent/engines/codex/options-builder.js

@@ -1,12 +1,13 @@
 const CODEX_KOBO_MCP_BRIEF = [
     '[Kōbō MCP] This workspace exposes a dedicated MCP server named `kobo-tasks`. The Codex CLI surfaces its tools under the literal name `mcp__kobo-tasks__<tool>` — always use that full form when invoking them.',
-    'Plan mode: when running with a read-only sandbox, the read-only restriction applies to MCP tools too. Reads (`mcp__kobo-tasks__list_*`, `mcp__kobo-tasks__read_document`, `mcp__kobo-tasks__search_codebase`, `mcp__kobo-tasks__get_*`) are fine; mutations (`mcp__kobo-tasks__mark_task_done`, `mcp__kobo-tasks__log_thought`, `mcp__kobo-tasks__set_workspace_status`) must wait until the plan is approved.',
+    'Plan mode: when running with a read-only sandbox, the read-only restriction applies to MCP tools too. Reads (`mcp__kobo-tasks__list_*`, `mcp__kobo-tasks__read_document`, `mcp__kobo-tasks__search_codebase`, `mcp__kobo-tasks__get_*`) are fine; mutations (`mcp__kobo-tasks__mark_task_done`, `mcp__kobo-tasks__log_thought`, `mcp__kobo-tasks__set_workspace_status`, `mcp__kobo-tasks__set_auto_loop`) must wait until the plan is approved.',
     'Conventions — read these BEFORE starting work, not as a fallback:',
     '• `mcp__kobo-tasks__list_tasks` first on any non-trivial turn, then `mcp__kobo-tasks__mark_task_done` as each item completes.',
     '• `mcp__kobo-tasks__list_documents` / `mcp__kobo-tasks__read_document` to discover existing plans and specs under docs/ and .ai/thoughts/ before writing new ones.',
     '• `mcp__kobo-tasks__log_thought` to persist notable decisions to `.ai/thoughts/logs/<date>-<slug>.md`.',
     '• `mcp__kobo-tasks__search_codebase` to recall prior chat history (conversations, not source — use shell tools for source).',
     '• `mcp__kobo-tasks__get_workspace_info` / `mcp__kobo-tasks__get_git_info` / `mcp__kobo-tasks__get_ticket` for context.',
+    '• If `mcp__kobo-tasks__get_workspace_info` reports `autoLoop: false`, call `mcp__kobo-tasks__set_auto_loop({ enabled: true })` only when the user explicitly asks for autonomous continuation; never disable it unless explicitly asked.',
     '• `mcp__kobo-tasks__set_workspace_status` when the mission is done or irrecoverably blocked. Never set `idle` while this session is active; ask the user or end the turn instead.',
     '• `mcp__kobo-tasks__schedule_wakeup` / `mcp__kobo-tasks__cancel_wakeup` to schedule (or cancel) a follow-up session.',
     'Each tool carries its own "WHEN to use" guidance in its description — follow it.',

package/dist/server/services/agent/engines/types.js

@@ -2,6 +2,7 @@
 export const ALL_AGENT_EVENT_KINDS = [
     'session:started',
     'session:ended',
+    'turn:completed',
     'session:user-input-requested',
     'session:compacted',
     'session:compacting',

package/dist/server/services/agent/orchestrator.js

@@ -488,21 +488,77 @@ function reuseOrCreateFreshSession(workspaceId, existingSessionId, model, engine
     return agentSessionId;
 }
 const taskProgressSnapshots = new Map();
-function rememberTaskProgressSnapshot(workspaceId, agentSessionId) {
-    const workspaceSnapshots = taskProgressSnapshots.get(workspaceId) ?? new Map();
-    workspaceSnapshots.set(agentSessionId, {
+function createTaskProgressSnapshot(workspaceId) {
+    return {
         doneCount: getDoneTaskCount(workspaceId),
         stateSignature: getTaskStateSignature(workspaceId),
-    });
+    };
+}
+function rememberTaskProgressSnapshot(workspaceId, agentSessionId, snapshot = createTaskProgressSnapshot(workspaceId)) {
+    const workspaceSnapshots = taskProgressSnapshots.get(workspaceId) ?? new Map();
+    workspaceSnapshots.set(agentSessionId, snapshot);
     taskProgressSnapshots.set(workspaceId, workspaceSnapshots);
 }
+function parseTaskProgressSnapshot(value) {
+    if (!value)
+        return undefined;
+    try {
+        const parsed = JSON.parse(value);
+        if (typeof parsed.doneCount !== 'number' || typeof parsed.stateSignature !== 'string')
+            return undefined;
+        return { doneCount: parsed.doneCount, stateSignature: parsed.stateSignature };
+    }
+    catch {
+        return undefined;
+    }
+}
+function captureTaskProgressBaseline(workspaceId, agentSessionId) {
+    const snapshot = createTaskProgressSnapshot(workspaceId);
+    rememberTaskProgressSnapshot(workspaceId, agentSessionId, snapshot);
+    try {
+        getDb()
+            .prepare('UPDATE agent_sessions SET task_progress_baseline = ? WHERE id = ?')
+            .run(JSON.stringify(snapshot), agentSessionId);
+    }
+    catch (err) {
+        console.warn('[orchestrator] Failed to persist task progress baseline:', err);
+    }
+}
+function ensureTaskProgressBaseline(workspaceId, agentSessionId) {
+    if (taskProgressSnapshots.get(workspaceId)?.has(agentSessionId))
+        return;
+    try {
+        const row = getDb().prepare('SELECT task_progress_baseline FROM agent_sessions WHERE id = ?').get(agentSessionId);
+        if (row?.task_progress_baseline)
+            return;
+    }
+    catch {
+        // The in-memory fallback below is still useful in narrow unit-test and
+        // bootstrap windows where the persisted session row is unavailable.
+    }
+    captureTaskProgressBaseline(workspaceId, agentSessionId);
+}
 function consumeTaskProgressSnapshot(workspaceId, agentSessionId) {
     const workspaceSnapshots = taskProgressSnapshots.get(workspaceId);
-    const snapshot = workspaceSnapshots?.get(agentSessionId);
+    const memorySnapshot = workspaceSnapshots?.get(agentSessionId);
     workspaceSnapshots?.delete(agentSessionId);
     if (workspaceSnapshots?.size === 0)
         taskProgressSnapshots.delete(workspaceId);
-    return snapshot;
+    try {
+        const db = getDb();
+        const readAndClear = db.transaction((id) => {
+            const row = db.prepare('SELECT task_progress_baseline FROM agent_sessions WHERE id = ?').get(id);
+            db.prepare('UPDATE agent_sessions SET task_progress_baseline = NULL WHERE id = ?').run(id);
+            return row?.task_progress_baseline ?? null;
+        });
+        const persistedSnapshot = parseTaskProgressSnapshot(readAndClear(agentSessionId));
+        if (persistedSnapshot)
+            return persistedSnapshot;
+    }
+    catch (err) {
+        console.warn('[orchestrator] Failed to consume task progress baseline:', err);
+    }
+    return memorySnapshot;
 }
 function rememberResumeFailed(workspaceId, agentSessionId) {
     const workspaceSessions = resumeFailedSessions.get(workspaceId) ?? new Set();
@@ -588,10 +644,11 @@ function handleEvent(workspaceId, agentSessionId, sourceController, ev) {
     if (ev.kind === 'rate_limit') {
         latestRateLimitInfo.set(workspaceId, ev.info);
     }
-    // Snapshot the done-count at session start so the session:ended hook below
-    // can compute a delta for auto-loop stall detection.
+    // The normal start path captures this synchronously before engine.start.
+    // Keep an idempotent fallback for engines/tests that emit session:started
+    // without first going through startAgent.
     if (ev.kind === 'session:started') {
-        rememberTaskProgressSnapshot(workspaceId, agentSessionId);
+        ensureTaskProgressBaseline(workspaceId, agentSessionId);
     }
     // Legacy fallback: the built-in `ScheduleWakeup` tool (CLI tradition) isn't
     // declared by the SDK, so we intercept the tool:call event and apply the
@@ -700,12 +757,23 @@ function handleEvent(workspaceId, agentSessionId, sourceController, ev) {
         // its persisted prompts too, otherwise a reconnect resurrects a panel
         // whose backend callback has already been discarded.
         purgeAllPersistedUserInputRequests(workspaceId, agentSessionId);
+        // A watchdog end means Kōbō forced the stream closed after the engine
+        // failed to drain. It is neither a clean completion nor evidence of an
+        // agent stall. Move auto-loop work onto the existing persisted, bounded
+        // transient-retry path before lifecycle cleanup observes the status.
+        const watchdogRecovery = ev.reason === 'watchdog' && getWs(workspaceId)?.autoLoop === true;
+        if (watchdogRecovery) {
+            console.warn(`[auto-loop] watchdog recovery scheduled for workspace '${workspaceId}'`);
+            void handleTransientAutoLoopFailure(workspaceId);
+        }
         // Must run BEFORE autoLoopService.onSessionEnded → spawnNextIteration →
         // startAgent, otherwise startAgent throws "Agent already running" because
         // the just-ended controller is still in the map.
         const ownsWorkspaceLifecycle = onSessionEnded(workspaceId, agentSessionId, sourceController, ev.exitCode, ev.reason, isResumeFailed);
         if (!ownsWorkspaceLifecycle)
             return;
+        if (watchdogRecovery)
+            return;
         // resume_failed exits with an error but the workspace is fine (stale id
         // cleared, next iteration will start fresh) — report 'completed' to
         // auto-loop so it continues.
@@ -905,6 +973,9 @@ export function startAgent(workspaceId, workingDir, prompt, model, resume = fals
     else {
         agentSessionId = reuseOrCreateFreshSession(workspaceId, existingSessionId, model, engineId);
     }
+    // Persist before the asynchronous engine can emit its first event. This
+    // survives a Kōbō restart and does not depend on SDK system:init delivery.
+    captureTaskProgressBaseline(workspaceId, agentSessionId);
     const settings = ws ? readEffectiveSettingsSafe(ws.projectPath) : readEffectiveSettingsSafe(workingDir);
     const options = {
         workspaceId,
@@ -987,12 +1058,7 @@ export function interruptAgent(workspaceId, options = {}) {
         autoLoopService.disable(workspaceId, 'user-action');
     }
 }
-/** Gracefully stop an agent (the engine handles SIGTERM + SIGKILL). */
-export function stopAgent(workspaceId) {
-    const ctrl = controllers.get(workspaceId);
-    if (!ctrl) {
-        throw new Error(`No agent running for workspace '${workspaceId}'`);
-    }
+async function stopController(workspaceId, ctrl) {
     wakeupService.cancel(workspaceId, 'stopped');
     // If the session was waiting on a question/permission, normalize the state
     // synchronously so callers (archive, delete, manual stop) see a clean
@@ -1020,11 +1086,42 @@ export function stopAgent(workspaceId) {
     controllers.delete(workspaceId);
     // Manual stop should also drop any pending quota auto-resume.
     quotaBackoffService.cancel(workspaceId, 'user');
-    // Fire-and-forget: controller.stop is async but we don't block callers.
-    void ctrl.stop().catch((err) => {
+    await ctrl.stop();
+}
+/** Gracefully stop an agent (the engine handles SIGTERM + SIGKILL). */
+export function stopAgent(workspaceId) {
+    const ctrl = controllers.get(workspaceId);
+    if (!ctrl) {
+        throw new Error(`No agent running for workspace '${workspaceId}'`);
+    }
+    // Fire-and-forget: callers such as archive/delete must remain synchronous.
+    void stopController(workspaceId, ctrl).catch((err) => {
         console.error('[orchestrator] controller.stop failed:', err);
     });
 }
+/** Stop every live engine before process shutdown, with a bounded wait per engine. */
+export async function stopAllAgents(timeoutMs = 3_000) {
+    const stops = [...controllers.entries()].map(async ([workspaceId, ctrl]) => {
+        let timeout;
+        try {
+            await Promise.race([
+                stopController(workspaceId, ctrl),
+                new Promise((resolve) => {
+                    timeout = setTimeout(resolve, timeoutMs);
+                    timeout.unref?.();
+                }),
+            ]);
+        }
+        catch (err) {
+            console.error(`[orchestrator] Failed to stop '${workspaceId}' during shutdown:`, err);
+        }
+        finally {
+            if (timeout)
+                clearTimeout(timeout);
+        }
+    });
+    await Promise.all(stops);
+}
 /** Write a user message to the running agent. */
 export async function sendMessage(workspaceId, content, expectedSessionId) {
     const ctrl = controllers.get(workspaceId);

package/dist/server/services/auto-loop-service.js

@@ -123,6 +123,12 @@ export function onSessionEnded(workspaceId, reason, taskProgressDelta) {
     // will resume the deferred turn explicitly.
     if (row.status === 'awaiting-user')
         return;
+    // A watchdog denotes Kōbō's own forced recovery from a stuck engine stream.
+    // The orchestrator owns its bounded backoff/retry path; counting it as a
+    // normal no-progress iteration would falsely disable an otherwise healthy
+    // loop after three SDK teardown timeouts.
+    if (reason === 'watchdog')
+        return;
     if (reason === 'error') {
         disable(workspaceId, 'error');
         return;