@loicngr/kobo 2.1.2 → 2.1.5

package/dist/server/services/pr-checkout-service.js

@@ -1,7 +1,8 @@
-import { execFileSync } from 'node:child_process';
+import { execFile } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
+import { promisify } from 'node:util';
 import * as gitOps from '../utils/git-ops.js';
 import { GitConflictError } from '../utils/git-ops.js';
 import { withGitRepoLock } from '../utils/git-repo-lock.js';
@@ -41,23 +42,41 @@ const EMPTY_CHANGES = { present: false, modified: 0, staged: 0, untracked: 0 };
 // interactively over a pipe nobody can answer; the timeout is a backstop for
 // anything else that could still stall (a slow filesystem, a stuck lock).
 const GIT_TIMEOUT_MS = 60_000;
-function git(repoPath, args) {
-    return execFileSync('git', args, {
+const execFileAsync = promisify(execFile);
+async function runGitAsync(repoPath, args, timeout = GIT_TIMEOUT_MS) {
+    const { stdout } = await execFileAsync('git', args, {
         cwd: repoPath,
         encoding: 'utf-8',
-        stdio: ['pipe', 'pipe', 'pipe'],
-        timeout: GIT_TIMEOUT_MS,
-        env: { ...process.env, LC_ALL: 'C', LANG: 'C', GIT_TERMINAL_PROMPT: '0' },
-    }).trim();
+        timeout,
+        maxBuffer: 64 * 1024 * 1024,
+        env: gitOps.buildNonInteractiveGitEnv(),
+    });
+    return stdout.trim();
+}
+function readGitAsync(repoPath, args) {
+    return runGitAsync(repoPath, args, 15_000);
+}
+async function conflictedFilesAsync(repoPath) {
+    try {
+        return (await readGitAsync(repoPath, ['diff', '--name-only', '--diff-filter=U']))
+            .split('\n')
+            .map((file) => file.trim())
+            .filter(Boolean);
+    }
+    catch {
+        return [];
+    }
 }
 /** Compare the local branch against `origin/<branch>`. */
-function diagnoseBranch(projectPath, branch) {
-    if (!gitOps.localBranchExists(projectPath, branch))
+async function diagnoseBranch(projectPath, branch, localExists, remoteExists) {
+    if (!localExists)
         return { state: 'absent' };
-    if (!gitOps.listRemoteBranches(projectPath).includes(`origin/${branch}`))
+    if (!remoteExists)
         return { state: 'in-sync' };
-    const ahead = gitOps.getCommitCount(projectPath, branch, branch);
-    const behind = gitOps.getCommitsBehind(projectPath, branch, branch);
+    const [ahead, behind] = await Promise.all([
+        gitOps.getCommitCountAsync(projectPath, branch, branch),
+        gitOps.getCommitsBehindAsync(projectPath, branch, branch),
+    ]);
     if (ahead > 0 && behind > 0)
         return { state: 'diverged', ahead, behind };
     // Note: `hasCommonAncestor` below is what produces the `no-common-ancestor`
@@ -71,9 +90,9 @@ function diagnoseBranch(projectPath, branch) {
 }
 /** False when the local branch and its remote share no history at all — a name
  *  collision, not a divergence. Every realignment strategy is wrong for it. */
-function hasCommonAncestor(repoPath, branch) {
+async function hasCommonAncestor(repoPath, branch) {
     try {
-        git(repoPath, ['merge-base', branch, `origin/${branch}`]);
+        await readGitAsync(repoPath, ['merge-base', branch, `origin/${branch}`]);
         return true;
     }
     catch {
@@ -107,8 +126,8 @@ async function diagnoseWorktree(projectPath, branch, targetPath, attachedPaths)
     return { worktree: { state: 'none' }, blockers };
 }
 /** Count working-tree changes by category. */
-function diagnoseChanges(worktreePath) {
-    const status = gitOps.getWorkingTreeStatus(worktreePath);
+async function diagnoseChanges(worktreePath) {
+    const status = await gitOps.getWorkingTreeStatusAsync(worktreePath);
     const modified = status.modified ?? 0;
     const staged = status.staged ?? 0;
     const untracked = status.untracked ?? 0;
@@ -130,9 +149,9 @@ export function resolveWorkspaceState(workspaces, branch, projectPath) {
     return { state: 'active', id: match.id, name: match.name };
 }
 /** `git rev-parse <ref>`, or null when the ref does not resolve. */
-function safeRevParse(repoPath, ref) {
+async function safeRevParse(repoPath, ref) {
     try {
-        return git(repoPath, ['rev-parse', ref]);
+        return await readGitAsync(repoPath, ['rev-parse', ref]);
     }
     catch {
         return null;
@@ -140,8 +159,10 @@ function safeRevParse(repoPath, ref) {
 }
 /** Hash the observed state so `/resolve` can refuse a plan built on stale facts. */
 export async function computeFingerprint(report) {
-    const localHead = safeRevParse(report.projectPath, report.headBranch);
-    const remoteHead = safeRevParse(report.projectPath, `origin/${report.headBranch}`);
+    const [localHead, remoteHead] = await Promise.all([
+        safeRevParse(report.projectPath, report.headBranch),
+        safeRevParse(report.projectPath, `origin/${report.headBranch}`),
+    ]);
     const payload = JSON.stringify({
         contents: report.worktree.state === 'orphan' || report.worktree.state === 'attached'
             ? await fingerprintWorktree(report.worktree.path)
@@ -166,12 +187,15 @@ export async function computeFingerprint(report) {
 export async function diagnoseLocalState(projectPath, headBranch, worktreesPath, attachedPaths = new Map(), workspaces = []) {
     const targetWorktreePath = resolveWorkspaceWorktreePath(projectPath, headBranch, worktreesPath);
     const blockers = [];
-    const lockPath = gitOps.getIndexLockPath(projectPath);
+    const [lockPath, localExists, remoteBranches] = await Promise.all([
+        gitOps.getIndexLockPathAsync(projectPath),
+        gitOps.localBranchExistsAsync(projectPath, headBranch),
+        gitOps.listRemoteBranchesAsync(projectPath),
+    ]);
+    const remoteExists = remoteBranches.includes(`origin/${headBranch}`);
     if (lockPath)
         blockers.push({ kind: 'index-lock', lockPath });
-    if (gitOps.localBranchExists(projectPath, headBranch) &&
-        gitOps.listRemoteBranches(projectPath).includes(`origin/${headBranch}`) &&
-        !hasCommonAncestor(projectPath, headBranch)) {
+    if (localExists && remoteExists && !(await hasCommonAncestor(projectPath, headBranch))) {
         blockers.push({ kind: 'no-common-ancestor', branch: headBranch });
     }
     const { worktree, blockers: worktreeBlockers } = await diagnoseWorktree(projectPath, headBranch, targetWorktreePath, attachedPaths);
@@ -184,9 +208,9 @@ export async function diagnoseLocalState(projectPath, headBranch, worktreesPath,
         blockers,
         workspace: resolveWorkspaceState(workspaces, headBranch, projectPath),
         worktree,
-        localChanges: inspectPath ? diagnoseChanges(inspectPath) : EMPTY_CHANGES,
-        ongoingOperation: inspectPath ? gitOps.getOngoingGitOperation(inspectPath) : null,
-        branch: diagnoseBranch(projectPath, headBranch),
+        localChanges: inspectPath ? await diagnoseChanges(inspectPath) : EMPTY_CHANGES,
+        ongoingOperation: inspectPath ? await gitOps.getOngoingGitOperationAsync(inspectPath) : null,
+        branch: await diagnoseBranch(projectPath, headBranch, localExists, remoteExists),
     };
 }
 /**
@@ -198,18 +222,18 @@ export async function diagnoseLocalState(projectPath, headBranch, worktreesPath,
  * Operates on the repository's branch ref, so the caller must hold the repo lock
  * AND the branch must not be checked out anywhere (see the ordering note below).
  */
-export function applyBranchStrategy(repoPath, branch, strategy) {
+export async function applyBranchStrategy(repoPath, branch, strategy) {
     const remoteRef = `origin/${branch}`;
     if (strategy === 'keep')
         return { strategy, backupBranch: null };
     if (strategy === 'fast-forward') {
-        git(repoPath, ['branch', '--force', branch, remoteRef]);
+        await runGitAsync(repoPath, ['branch', '--force', branch, remoteRef]);
         return { strategy, backupBranch: null };
     }
     if (strategy === 'reset-hard') {
         const backupBranch = `kobo-backup/${branch}-${Date.now()}`;
-        git(repoPath, ['branch', backupBranch, branch]);
-        git(repoPath, ['branch', '--force', branch, remoteRef]);
+        await runGitAsync(repoPath, ['branch', backupBranch, branch]);
+        await runGitAsync(repoPath, ['branch', '--force', branch, remoteRef]);
         return { strategy, backupBranch };
     }
     // strategy === 'rebase': `git rebase <upstream> <branch>` is shorthand for
@@ -219,14 +243,14 @@ export function applyBranchStrategy(repoPath, branch, strategy) {
     // can restore it once the rebase completes cleanly. If HEAD is detached,
     // `--abbrev-ref` returns the literal string "HEAD", which isn't a valid ref
     // to check back out — fall back to the SHA in that case.
-    const currentRef = git(repoPath, ['rev-parse', '--abbrev-ref', 'HEAD']);
-    const originalCheckout = currentRef === 'HEAD' ? git(repoPath, ['rev-parse', 'HEAD']) : currentRef;
+    const currentRef = await readGitAsync(repoPath, ['rev-parse', '--abbrev-ref', 'HEAD']);
+    const originalCheckout = currentRef === 'HEAD' ? await readGitAsync(repoPath, ['rev-parse', 'HEAD']) : currentRef;
     try {
-        git(repoPath, ['rebase', remoteRef, branch]);
+        await runGitAsync(repoPath, ['rebase', remoteRef, branch]);
     }
     catch (err) {
-        const conflicted = gitOps.getConflictedFiles(repoPath);
-        if (conflicted.length > 0 || gitOps.getOngoingGitOperation(repoPath) === 'rebase') {
+        const conflicted = await conflictedFilesAsync(repoPath);
+        if (conflicted.length > 0 || (await gitOps.getOngoingGitOperationAsync(repoPath)) === 'rebase') {
             // Leave the rebase in progress on `branch` so the caller can abort or
             // request agent-assisted resolution — do NOT restore the original checkout.
             throw new GitConflictError('rebase', conflicted);
@@ -235,7 +259,7 @@ export function applyBranchStrategy(repoPath, branch, strategy) {
         throw new Error(`Rebase of '${branch}' onto '${remoteRef}' failed: ${message}`);
     }
     // Clean rebase: restore the working copy to exactly what was checked out before.
-    git(repoPath, ['checkout', originalCheckout]);
+    await runGitAsync(repoPath, ['checkout', originalCheckout]);
     return { strategy, backupBranch: null };
 }
 /** The repository moved between diagnosis and resolution. */
@@ -272,7 +296,7 @@ function resolvePrCheckoutLocked(input, owner) {
             throw new Error('Stop the workspace agent before changing its checkout');
         const applied = [];
         // 1. Refresh, then refuse a plan built on facts that no longer hold.
-        gitOps.fetchSourceBranch(input.projectPath, input.headBranch);
+        await gitOps.fetchSourceBranchOrThrowAsync(input.projectPath, input.headBranch);
         applied.push({ kind: 'fetch', detail: `origin/${input.headBranch}` });
         const fresh = await diagnoseLocalState(input.projectPath, input.headBranch, input.worktreesPath, input.attachedPaths ?? new Map(), input.workspaces ?? []);
         if ((await computeFingerprint(fresh)) !== input.fingerprint)
@@ -288,7 +312,7 @@ function resolvePrCheckoutLocked(input, owner) {
         }
         // 2. Clear stale worktree metadata before anything needs the path.
         if (fresh.worktree.state === 'stale-metadata') {
-            git(input.projectPath, ['worktree', 'prune']);
+            await runGitAsync(input.projectPath, ['worktree', 'prune']);
             applied.push({ kind: 'prune-stale-worktree', detail: fresh.worktree.path });
         }
         const reuse = (fresh.worktree.state === 'orphan' || fresh.worktree.state === 'attached') &&
@@ -297,7 +321,7 @@ function resolvePrCheckoutLocked(input, owner) {
         // 3. In a reused worktree, settle the working tree before touching history.
         if (existingPath) {
             if (fresh.ongoingOperation && input.decisions.ongoingOperation === 'abort') {
-                gitOps.abortOngoingGitOperation(existingPath);
+                await runGitAsync(existingPath, [fresh.ongoingOperation, '--abort']);
                 applied.push({ kind: 'abort-operation', detail: fresh.ongoingOperation });
             }
             if (fresh.ongoingOperation && input.decisions.ongoingOperation !== 'abort') {
@@ -306,16 +330,29 @@ function resolvePrCheckoutLocked(input, owner) {
             if (fresh.localChanges.present) {
                 const choice = input.decisions.localChanges ?? 'keep';
                 if (choice === 'stash') {
-                    gitOps.stashPush(existingPath, `kobo-pr-checkout-${input.headBranch}`);
+                    await runGitAsync(existingPath, [
+                        'stash',
+                        'push',
+                        '--include-untracked',
+                        '-m',
+                        `kobo-pr-checkout-${input.headBranch}`,
+                    ]);
                     applied.push({ kind: 'stash-changes' });
                 }
                 else if (choice === 'commit') {
-                    gitOps.commitAllChanges(existingPath, `chore: save work before checking out ${input.headBranch}`);
+                    await runGitAsync(existingPath, ['add', '-A']);
+                    await runGitAsync(existingPath, ['commit', '-m', `chore: save work before checking out ${input.headBranch}`]);
                     applied.push({ kind: 'commit-changes' });
                 }
                 else if (choice === 'discard') {
                     // Deliberately a labelled stash, not `checkout -- .`: recoverable.
-                    gitOps.stashPush(existingPath, `kobo-pr-checkout-discard-${input.headBranch}`);
+                    await runGitAsync(existingPath, [
+                        'stash',
+                        'push',
+                        '--include-untracked',
+                        '-m',
+                        `kobo-pr-checkout-discard-${input.headBranch}`,
+                    ]);
                     applied.push({ kind: 'discard-changes', detail: 'kept as a labelled stash' });
                 }
             }
@@ -325,10 +362,10 @@ function resolvePrCheckoutLocked(input, owner) {
         const strategy = input.decisions.divergence ?? 'keep';
         if (strategy !== 'keep') {
             if (existingPath) {
-                alignInsideWorktree(input.projectPath, existingPath, input.headBranch, strategy, applied);
+                await alignInsideWorktree(input.projectPath, existingPath, input.headBranch, strategy, applied);
             }
             else {
-                const outcome = applyBranchStrategy(input.projectPath, input.headBranch, strategy);
+                const outcome = await applyBranchStrategy(input.projectPath, input.headBranch, strategy);
                 applied.push({ kind: 'align-branch', detail: outcome.backupBranch ?? strategy });
             }
         }
@@ -343,7 +380,7 @@ function resolvePrCheckoutLocked(input, owner) {
             const explicitPath = input.decisions.pathCollision?.worktreePath ?? null;
             if (explicitPath)
                 assertSafeExplicitWorktreePath(explicitPath);
-            const baseRef = gitOps.localBranchExists(input.projectPath, input.headBranch)
+            const baseRef = (await gitOps.localBranchExistsAsync(input.projectPath, input.headBranch))
                 ? input.headBranch
                 : `origin/${input.headBranch}`;
             const target = await createWorktreeUnlocked(input.projectPath, input.headBranch, baseRef, input.worktreesPath, undefined, explicitPath);
@@ -376,20 +413,20 @@ function resolvePrCheckoutLocked(input, owner) {
     });
 }
 /** Realign a branch from inside its own worktree, where ref surgery is refused. */
-function alignInsideWorktree(repoPath, worktreePath, branch, strategy, applied) {
+async function alignInsideWorktree(repoPath, worktreePath, branch, strategy, applied) {
     const remoteRef = `origin/${branch}`;
     if (strategy === 'fast-forward') {
-        git(worktreePath, ['merge', '--ff-only', remoteRef]);
+        await runGitAsync(worktreePath, ['merge', '--ff-only', remoteRef]);
         applied.push({ kind: 'align-branch', detail: 'fast-forward' });
         return;
     }
     if (strategy === 'rebase') {
         try {
-            git(worktreePath, ['rebase', remoteRef]);
+            await runGitAsync(worktreePath, ['rebase', remoteRef]);
         }
         catch (err) {
-            const conflicted = gitOps.getConflictedFiles(worktreePath);
-            if (conflicted.length > 0 || gitOps.getOngoingGitOperation(worktreePath) === 'rebase') {
+            const conflicted = await conflictedFilesAsync(worktreePath);
+            if (conflicted.length > 0 || (await gitOps.getOngoingGitOperationAsync(worktreePath)) === 'rebase') {
                 // Leave the rebase in progress so the caller can abort or request
                 // agent-assisted resolution — mirrors applyBranchStrategy's own rebase
                 // conflict handling and git-ops.ts's rebaseBranch.
@@ -403,7 +440,7 @@ function alignInsideWorktree(repoPath, worktreePath, branch, strategy, applied)
     }
     // reset-hard
     const backupBranch = `kobo-backup/${branch}-${Date.now()}`;
-    git(repoPath, ['branch', backupBranch, branch]);
-    git(worktreePath, ['reset', '--hard', remoteRef]);
+    await runGitAsync(repoPath, ['branch', backupBranch, branch]);
+    await runGitAsync(worktreePath, ['reset', '--hard', remoteRef]);
     applied.push({ kind: 'align-branch', detail: backupBranch });
 }

package/dist/server/services/pr-watcher-service.js

@@ -261,13 +261,19 @@ export async function checkPrStatuses() {
                     ['extracting', 'brainstorming', 'executing', 'compacting'].includes(current.status) ||
                     hasController(ws.id))
                     return;
-                try {
-                    destroyTerminal(ws.id);
-                }
-                catch {
-                    // Terminal may not exist — ignore
-                }
-                const archived = archiveWorkspace(ws.id);
+                const archived = await withWorkspaceLifecycleGuard(ws.id, async () => {
+                    await destroyTerminal(ws.id);
+                    const latest = getWorkspace(ws.id);
+                    if (!latest ||
+                        check.invalidated ||
+                        latest.archivedAt ||
+                        hasController(ws.id) ||
+                        ['extracting', 'brainstorming', 'executing', 'compacting'].includes(latest.status))
+                        return null;
+                    return archiveWorkspace(ws.id);
+                });
+                if (!archived)
+                    return;
                 lastKnownPr.delete(ws.id);
                 emitEphemeral(ws.id, 'workspace:archived', {
                     reason: `PR ${pr.state.toLowerCase()}`,

package/dist/server/services/retention/worker.js

@@ -0,0 +1,40 @@
+import { parentPort, workerData } from 'node:worker_threads';
+import Database from 'better-sqlite3';
+import { countPrunableWsEvents, pruneWsEventsInBatches } from '../ws-events-retention-service.js';
+const port = parentPort;
+// The parent supplies the already-open database path, never a second home.
+const db = new Database(workerData.dbPath);
+db.pragma('journal_mode=WAL');
+db.pragma('foreign_keys=ON');
+db.pragma('busy_timeout=5000');
+let stopped = false;
+let queue = Promise.resolve();
+port.on('message', (message) => {
+    if (message.stop) {
+        stopped = true;
+        void queue.finally(() => {
+            db.close();
+            port.close();
+        });
+        return;
+    }
+    queue = queue.then(async () => {
+        if (stopped)
+            return;
+        try {
+            if (message.preview) {
+                const total = db.prepare('SELECT COUNT(*) AS count FROM ws_events').get().count;
+                const deletable = countPrunableWsEvents(db, message.config, message.nowMs);
+                port.postMessage({ id: message.id, result: { deletable, total } });
+            }
+            else {
+                const result = await pruneWsEventsInBatches(db, message.config, message.nowMs, () => stopped);
+                if (!stopped)
+                    port.postMessage({ id: message.id, result });
+            }
+        }
+        catch (error) {
+            port.postMessage({ id: message.id, error: error instanceof Error ? error.message : String(error) });
+        }
+    });
+});

package/dist/server/services/review-service.js

@@ -88,7 +88,7 @@ export async function startWorkspaceReview(id, input) {
             throw new ReviewRequestError('The current session cannot be resumed; start it before requesting an automatic return', 400);
         const worktreePath = workspace.worktreePath;
         try {
-            await execFileAsync('git', ['fetch', 'origin', workspace.sourceBranch], { cwd: worktreePath });
+            await gitOps.fetchSourceBranchOrThrowAsync(worktreePath, workspace.sourceBranch);
         }
         catch (err) {
             console.warn(`[start-review] git fetch failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -97,15 +97,19 @@ export async function startWorkspaceReview(id, input) {
         try {
             const { stdout } = await execFileAsync('git', ['rev-parse', `origin/${workspace.sourceBranch}`], {
                 cwd: worktreePath,
+                timeout: 15_000,
+                env: gitOps.buildNonInteractiveGitEnv(),
             });
             baseCommit = stdout.trim();
         }
         catch (err) {
             throw new Error(`Cannot resolve base commit for branch ${workspace.sourceBranch}: ${err instanceof Error ? err.message : String(err)}`);
         }
-        const commits = gitOps.getCommitsBetween(worktreePath, workspace.sourceBranch, workspace.workingBranch);
-        const committedStats = gitOps.getDiffStatsBetween(worktreePath, workspace.sourceBranch, workspace.workingBranch);
-        const workingTreeStats = gitOps.getWorkingTreeDiffStats(worktreePath);
+        const [commits, committedStats, workingTreeStats] = await Promise.all([
+            gitOps.getCommitsBetweenAsync(worktreePath, workspace.sourceBranch, workspace.workingBranch),
+            gitOps.getDiffStatsBetweenAsync(worktreePath, workspace.sourceBranch, workspace.workingBranch),
+            gitOps.getWorkingTreeDiffStatsAsync(worktreePath),
+        ]);
         const diffStats = workingTreeStats.trim()
             ? `${committedStats}\n\n— Working tree (uncommitted) —\n${workingTreeStats}`
             : committedStats;

package/dist/server/services/session-event-metrics.js

@@ -0,0 +1,43 @@
+/**
+ * Recompute one session's persisted metrics from the events that remain, on an
+ * explicit database handle.
+ *
+ * Until v36 an `AFTER DELETE ... FOR EACH ROW` trigger did this per deleted
+ * row, re-aggregating the whole session every time — 79.7 s for 20 000 events,
+ * with the SQLite write lock held throughout. The trigger is gone; every code
+ * path that deletes `agent:event` rows while KEEPING the session calls this
+ * once, at the end of its transaction.
+ */
+export function recomputeSessionMetricsOn(db, workspaceId, sessionId) {
+    db.prepare('DELETE FROM session_event_metrics WHERE workspace_id = ? AND session_id = ?').run(workspaceId, sessionId);
+    db.prepare(`INSERT INTO session_event_metrics (
+       workspace_id, session_id, tool_calls, errors, input_tokens, output_tokens
+     )
+     SELECT
+       e.workspace_id,
+       e.session_id,
+       SUM(CASE WHEN json_extract(e.payload, '$.kind') = 'tool:call' THEN 1 ELSE 0 END),
+       SUM(CASE
+         WHEN json_extract(e.payload, '$.kind') = 'error'
+           OR (json_extract(e.payload, '$.kind') = 'tool:result'
+             AND json_extract(e.payload, '$.isError') = 1)
+         THEN 1 ELSE 0
+       END),
+       MAX(CASE
+         WHEN json_extract(e.payload, '$.kind') = 'usage'
+           AND json_type(e.payload, '$.inputTokens') IN ('integer', 'real')
+         THEN CAST(json_extract(e.payload, '$.inputTokens') AS INTEGER) ELSE 0
+       END),
+       MAX(CASE
+         WHEN json_extract(e.payload, '$.kind') = 'usage'
+           AND json_type(e.payload, '$.outputTokens') IN ('integer', 'real')
+         THEN CAST(json_extract(e.payload, '$.outputTokens') AS INTEGER) ELSE 0
+       END)
+     FROM ws_events e
+     JOIN agent_sessions s ON s.id = e.session_id AND s.workspace_id = e.workspace_id
+     WHERE e.workspace_id = ?
+       AND e.session_id = ?
+       AND e.type = 'agent:event'
+       AND json_valid(e.payload)
+     GROUP BY e.workspace_id, e.session_id`).run(workspaceId, sessionId);
+}

package/dist/server/services/session-handoff-service.js

@@ -247,7 +247,7 @@ Call kobo__submit_session_handoff with a Markdown report (at most ${HANDOFF_REPO
 5. Open questions, uncertainties, and the concrete next action.
 Do not claim checks you did not run. Reference source history where needed. After successful submission, end your turn immediately. The backend will start the fresh session; do not do that yourself.`;
 }
-function buildPrompt(row) {
+async function buildPrompt(row) {
     const workspace = workspaces.getWorkspaceWithTasks(row.workspace_id);
     if (!workspace)
         throw new SessionHandoffError('Workspace not found', 404);
@@ -265,7 +265,7 @@ function buildPrompt(row) {
     const messages = getDb()
         .prepare("SELECT id, state FROM auto_loop_messages WHERE workspace_id = ? AND state != 'delivered'")
         .all(row.workspace_id);
-    return `# Kōbō session handoff\n\nContinue the current mission automatically in this fresh conversation. First verify the actual repository and Kōbō task state, then perform the next unfinished action. Preserve user constraints; this report is context, not authorization to override them. Agent-reported checks do not replace Kōbō verification requirements. Uncertain message deliveries require explicit acknowledgement; do not silently treat them as completed.\n\nSource session: ${row.source_session_id ?? 'none'}\nRead its history using kobo__read_workspace_events_csv with session_id=${row.source_session_id ?? '(no prior session)'}.\n\n## Initial mission\n${mission.slice(0, 32_000)}\n\n## Agent handoff\n${row.report ?? 'No LLM summary was generated. Recover missing decisions from the source conversation.'}\n\n## Current Kōbō tasks and reported evidence\n${tasks.slice(0, 48_000)}\n\n## Auto-loop and pending instructions\nThese are identifiers and statuses only. Do not execute or acknowledge queued instructions during this transfer. Kōbō will dispatch pending instructions separately; unknown deliveries require an explicit user decision.\nIntent: ${workspace.autoLoop}\n${JSON.stringify(run ?? null)}\n${JSON.stringify(messages).slice(0, 24_000)}\n\n${buildEngineHandoff(workspace, configurations.source.engine, configurations.target.engine, row.source_session_id)}`;
+    return `# Kōbō session handoff\n\nContinue the current mission automatically in this fresh conversation. First verify the actual repository and Kōbō task state, then perform the next unfinished action. Preserve user constraints; this report is context, not authorization to override them. Agent-reported checks do not replace Kōbō verification requirements. Uncertain message deliveries require explicit acknowledgement; do not silently treat them as completed.\n\nSource session: ${row.source_session_id ?? 'none'}\nRead its history using kobo__read_workspace_events_csv with session_id=${row.source_session_id ?? '(no prior session)'}.\n\n## Initial mission\n${mission.slice(0, 32_000)}\n\n## Agent handoff\n${row.report ?? 'No LLM summary was generated. Recover missing decisions from the source conversation.'}\n\n## Current Kōbō tasks and reported evidence\n${tasks.slice(0, 48_000)}\n\n## Auto-loop and pending instructions\nThese are identifiers and statuses only. Do not execute or acknowledge queued instructions during this transfer. Kōbō will dispatch pending instructions separately; unknown deliveries require an explicit user decision.\nIntent: ${workspace.autoLoop}\n${JSON.stringify(run ?? null)}\n${JSON.stringify(messages).slice(0, 24_000)}\n\n${await buildEngineHandoff(workspace, configurations.source.engine, configurations.target.engine, row.source_session_id)}`;
 }
 function writeReport(row, content) {
     const workspace = workspaces.getWorkspace(row.workspace_id);
@@ -368,14 +368,16 @@ async function startTarget(runtime) {
     if (runtime.cancelled || read(row.id).state === 'starting')
         return;
     clearTimer(runtime);
-    const prompt = buildPrompt(row);
+    state(row.id, 'starting');
+    const prompt = await buildPrompt(row);
+    if (runtime.cancelled || read(row.id).state !== 'starting')
+        return;
     writeReport(row, prompt);
     configure(row.workspace_id, map(row).target);
     const session = workspaces.createIdleSession(row.workspace_id);
     getDb()
         .prepare('UPDATE session_handoffs SET target_session_id = ?, generation_token = NULL WHERE id = ?')
         .run(session.id, row.id);
-    state(row.id, 'starting');
     let startError;
     const completed = () => {
         if (runtime.cancelled || read(row.id).state !== 'starting')