@open-mercato/cezar 0.9.1 → 0.9.2-pr710.1256

package/dist/todos.js

@@ -121,7 +121,7 @@ export async function removeTodo(dataDir, id) {
 /** The task text "▶ Run" turns an entry into: the suggested prompt (or the summary when the
  *  entry carries none), plus the suggested args as a trailing line. The single server-side
  *  source for `POST /api/todos/:id/start`; the cockpit's prefill copy
- *  (`web/app/src/routes/inbox.tsx`, #374) lives in another process and cannot import this, so
+ *  (`packages/web/src/routes/inbox.tsx`, #374) lives in another process and cannot import this, so
  *  the two are pinned to the shared cases in `test/fixtures/todo-task-text.json`. */
 export function todoTaskText(todo) {
     let task = (todo.suggestedPrompt ?? todo.summary).trim() || todo.summary;

package/dist/ui-state.d.ts

@@ -1,3 +1,4 @@
+import type { UiState } from './contract/index.js';
 /**
  * `.ai/cezar/ui-state.json` — small GUI preferences the cockpit persists (files, not a DB).
  * The server owns the schema and the writes (`PUT /api/ui-state` in `src/server/server.ts`);
@@ -8,5 +9,18 @@
  * `{}` — an absent preference, never a throw, never a blocked startup.
  */
 export declare function uiStatePath(repoRoot: string): string;
-/** Read `ui-state.json` on demand — never cached, never throws. */
-export declare function readUiState(repoRoot: string): Promise<Record<string, unknown>>;
+/**
+ * Read `ui-state.json` on demand — never cached, never throws.
+ *
+ * Typed by the CONTRACT (`UiState`), not by a loose record: `GET /api/v1/ui-state` answers this
+ * value verbatim, so a `Record<string, unknown>` here made the route name no key at all and the
+ * per-route parity guard vacuous — the same defect `healthSnapshot` had. `UiState` is a
+ * `z.looseObject`, so the index signature (and with it the round-trip promise of
+ * BACKWARD_COMPATIBILITY.md §3) survives; what it adds is the NAMES of the keys the server knows.
+ *
+ * The cast is unchanged in kind — the file is user-editable JSON and is deliberately NOT parsed
+ * through the schema, because a single malformed pref must not discard the whole bag (§3). What
+ * the type asserts is the wire shape the route promises; the write side (`PUT /ui-state`, validated
+ * by `uiStateBody`) is what actually enforces it.
+ */
+export declare function readUiState(repoRoot: string): Promise<UiState>;

package/dist/ui-state.js

@@ -12,7 +12,20 @@ import { join } from 'node:path';
 export function uiStatePath(repoRoot) {
     return join(repoRoot, '.ai/cezar', 'ui-state.json');
 }
-/** Read `ui-state.json` on demand — never cached, never throws. */
+/**
+ * Read `ui-state.json` on demand — never cached, never throws.
+ *
+ * Typed by the CONTRACT (`UiState`), not by a loose record: `GET /api/v1/ui-state` answers this
+ * value verbatim, so a `Record<string, unknown>` here made the route name no key at all and the
+ * per-route parity guard vacuous — the same defect `healthSnapshot` had. `UiState` is a
+ * `z.looseObject`, so the index signature (and with it the round-trip promise of
+ * BACKWARD_COMPATIBILITY.md §3) survives; what it adds is the NAMES of the keys the server knows.
+ *
+ * The cast is unchanged in kind — the file is user-editable JSON and is deliberately NOT parsed
+ * through the schema, because a single malformed pref must not discard the whole bag (§3). What
+ * the type asserts is the wire shape the route promises; the write side (`PUT /ui-state`, validated
+ * by `uiStateBody`) is what actually enforces it.
+ */
 export async function readUiState(repoRoot) {
     try {
         const parsed = JSON.parse(await readFile(uiStatePath(repoRoot), 'utf8'));

package/dist/ui-state.js.map

@@ -1 +1 @@
-{"version":3,"file":"ui-state.js","sourceRoot":"","sources":["../src/ui-state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,OAAO,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;AACtD,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB;IAChD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAClF,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"ui-state.js","sourceRoot":"","sources":["../src/ui-state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,OAAO,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB;IAChD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAClF,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/workflows/load.d.ts

@@ -1,4 +1,4 @@
-import { type WorkflowDef } from './types.js';
+import { type WorkflowDef } from './types.ts';
 export declare const WORKFLOWS_DIR = ".ai/cezar/workflows";
 export interface WorkflowLoadIssue {
     path: string;

package/dist/workflows/run.d.ts

@@ -1,9 +1,9 @@
-import type { RunnerId } from '../core/agent-runner.js';
-import type { ContentBlock } from '../core/agent-runner.js';
-import { type Skill } from '../skills.js';
-import type { QueuedMessage, RunRecord, RunStore } from '../runs/store.js';
-import { WorkspaceSemaphore } from '../workspace/semaphore.js';
-import { type WorkflowDef } from './types.js';
+import type { RunnerId } from '../core/agent-runner.ts';
+import type { ContentBlock } from '../core/agent-runner.ts';
+import { type Skill } from '../skills.ts';
+import type { QueuedMessage, RunRecord, RunStore } from '../runs/store.ts';
+import { WorkspaceSemaphore, type AccountHolds } from '../workspace/semaphore.ts';
+import { type WorkflowDef } from './types.ts';
 /** An interactive session that hears nothing from the user closes itself. */
 export declare const IDLE_TIMEOUT_MS: number;
 /**
@@ -20,11 +20,65 @@ export declare const AUTOSAVE_INTERVAL_MS = 90000;
  *  noise interleaving PR history. The flushes (`autosaveCommit` at turn end and before
  *  a draft PR) are NOT gated: the branch must still end holding the finished state. */
 export declare function periodicAutosaveEnabled(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Explicitly opt out of the repository-root lease for runs that execute in the
+ * current checkout. This covers explicit worktree opt-out, non-Git degradation,
+ * and continuations whose worktree cannot be restored (spec 006 hardening, #438).
+ * This is intentionally unsafe: concurrent agents may overwrite each other's
+ * files or Git state. Isolated worktree runs are unaffected.
+ */
+export declare function repositoryRootLockDisabled(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Auto-resume after a provider usage limit (spec 2026-08-03-auto-resume-after-usage-limit).
+ *
+ * The wait is the provider's own reset instant plus this grace: resuming AT the boundary races the
+ * provider's clock (and its rounding), and one failed resume costs the whole window over again.
+ * Thirty seconds is cheap next to five hours and long enough to be past any sane skew.
+ */
+export declare const AUTO_RESUME_GRACE_MS = 30000;
+/**
+ * Consecutive automatic resumes allowed without a human turn. A resume can only fire after a real
+ * reset instant, so this is not a throttle — it is the backstop for the pathological case (a
+ * provider that answers "limit reached, retry now" in a loop), and it is deliberately generous
+ * enough to sit through a couple of days of five-hour windows.
+ */
+export declare const MAX_AUTO_RESUMES = 12;
+/**
+ * How long a missed deadline stays worth acting on. The promise is "we pick this up when the
+ * window reopens" — kept across a restart or an overnight close, which is the case the feature
+ * exists for. A day later it is no longer that promise: the user has moved on, and a task
+ * springing back to life is a surprise rather than a service. Such a deadline is retired with a
+ * note instead of fired, so the only tasks a sweep can revive are ones someone is still waiting on.
+ */
+export declare const AUTO_RESUME_MISSED_WINDOW_MS: number;
+/**
+ * How often the queue checks that it is not wedged.
+ *
+ * A hold is the only thing in the engine that can make an idle queue CORRECT, so it is also the
+ * only thing that can make a wedged one look correct. This tick is the way out: cheap (a few
+ * in-memory checks), unref'd, and it only ever acts when idling has no justification left.
+ */
+export declare const QUEUE_WATCHDOG_MS = 60000;
+/**
+ * Which agent ACCOUNT a run's work runs on — the thing a provider usage limit actually closes
+ * (spec 2026-08-03-auto-resume-after-usage-limit).
+ *
+ * Backend plus agent account, because those are the two axes a limit is scoped to: a Claude
+ * limit must never stall a Codex task, and a second Claude login is a second budget. A record
+ * that names no runner has not started yet and will take the configured default, which is what
+ * `fallbackRunner` carries; a run that HAS started always carries its resolved runner (execute
+ * persists it), and only started runs can be holding.
+ */
+export declare function runAccountKey(run: Pick<RunRecord, 'runner' | 'agentProfile'>, fallbackRunner: RunnerId): string;
 export interface StartRunInput {
     task: string;
     model?: string;
     /** Agent backend chosen for this task (GUI). Unset = the config default. */
     runner?: RunnerId;
+    /** Agent account for this task (spec 2026-07-29-agent-profiles), applying to steps that run
+     *  on `runner`. Unset = the project's own selection. Persisted on the record so the choice
+     *  survives into resume and Continue, and so the thread can say which account did the work. */
+    agentProfile?: string;
     /** Screenshots pasted into the new-task form — persisted when the run is
      *  created and delivered once, with the first agent step's opening message. */
     images?: ContentBlock[];
@@ -33,9 +87,8 @@ export interface StartRunInput {
      *  `resolveExtraSystemPrompt` for the precedence contract. */
     systemPrompt?: string;
     /** Composer opt-out (#worktree-toggle): `false` runs the task in the repo
-     *  working tree instead of an isolated worktree — for read-only skills that
-     *  don't need a branch. Undefined/`true` keeps the default per-task worktree.
-     *  Ignored for variants (they always isolate). */
+     *  working tree instead of an isolated worktree. Undefined/`true` keeps the
+     *  default per-task worktree. Ignored for variants (they always isolate). */
     worktree?: boolean;
     /** Autonomous mode (#autonomous): the run never parks at `waiting` for the
      *  user — turn-ends auto-continue until the agent signals done or the safety
@@ -69,6 +122,15 @@ export declare function resolveExtraSystemPrompt(override: string | undefined, c
  * divider the skill+handoff composition has always used.
  */
 export declare function composeSystemPrompt(...parts: Array<string | undefined>): string;
+/**
+ * The directories a spawned agent may reach outside its worktree: the run-state
+ * folder that holds its handoff file, plus its own temp directory when this run
+ * got one (#785). Handing an agent a `TMPDIR` its file tools are not allowed to
+ * write would trade one silent failure for another, so the two travel together;
+ * under `CEZ_AGENT_TMPDIR=0` there is no per-run directory and the list is
+ * exactly what it always was.
+ */
+export declare function agentDirectories(runsDir: string, env: Record<string, string>): string[];
 /**
  * Materialized pasted attachment: the on-disk name/serving-URL pair the
  * transcript already used, plus the absolute path that lets the agent
@@ -123,7 +185,13 @@ export declare class RunManager {
     private readonly queue;
     private readonly starting;
     private readonly waiting;
+    /** Durable monitoring subset. Only the configured number receives the waiting-slot exemption. */
+    private readonly monitoring;
     private readonly pendingJobs;
+    /** Interrupted agent turns recovered after a process restart. Unlike an
+     *  explicit user Continue, these are bulk scheduler work and must re-enter
+     *  through `pump()` so both workspace and per-project caps are honored. */
+    private readonly pendingContinuations;
     /** Per-run image counter behind `pasted-<n>` / `screenshot-<n>` (#472). Lives on
      *  the manager rather than the `ActiveRun` so a *queued* run — which has no
      *  `ActiveRun` at all — can persist attachments. Seeded lazily from disk. */
@@ -131,14 +199,21 @@ export declare class RunManager {
     /** Messages that landed in the dequeue → session-open gap (#472), flushed as
      *  ordinary follow-up turns the moment the session opens. In-memory only. */
     private readonly deferredMessages;
+    /** Armed usage-limit resumes, keyed by run id (spec
+     *  2026-08-03-auto-resume-after-usage-limit). The DEADLINE itself lives on the record
+     *  (`autoResumeAt`) — this map holds only the process-local timer, so a restart rebuilds it
+     *  from the record rather than losing the wait. Runs here are `failed` and therefore NOT in
+     *  `active`, which is why the timer cannot live on an `ActiveRun` like the monitoring one. */
+    private readonly autoResumeTimers;
     private pumping;
     /** A pump that arrived while one was in flight — replayed by `pump()`'s own
      *  loop so a slot freed mid-sweep is never a lost wakeup. */
     private pumpAgain;
     /**
      * Runs normally isolate in worktrees and may execute in parallel. When that
-     * isolation is unavailable (or explicitly disabled), serialize access to
-     * `repoRoot` so two agents can never edit/revert the same files (#438).
+     * isolation is unavailable (or explicitly disabled), access to `repoRoot` is
+     * serialized by default so two agents cannot edit/revert the same files
+     * (#438). `CEZ_DISABLE_REPO_LOCK=1` deliberately bypasses this safety lease.
      */
     private repoRootTail;
     /** `.ai/cezar` — where the per-task handoff files and todos.json live. */
@@ -149,6 +224,13 @@ export declare class RunManager {
     /** Unsubscribe handle for the constructor's `onUsage` subscription — released
      *  by dispose() so a torn-down manager stops receiving sampler ticks. */
     private readonly offUsage;
+    /** The stalled-queue watchdog (see `rescueStalledQueue`). */
+    private readonly queueWatchdog;
+    /** Set by the watchdog for exactly one sweep: ignore the usage-limit hold and make progress. */
+    private forceNextPump;
+    /** Runs the watchdog started despite the hold. The spawn-time gate (`requeueWhileHeld`) would
+     *  otherwise hand them straight back and the rescue would undo itself in a millisecond. */
+    private readonly forceStarted;
     /** The workspace-wide parallel-cap semaphore + cached resource config
      *  (spec 2026-07-20, step 2.5). Boot constructs ONE and every manager shares
      *  it; the private fallback keeps single-manager callers and tests working. */
@@ -186,8 +268,33 @@ export declare class RunManager {
      *  key would let a value inherited from *this* process through — a nested
      *  cezar (an agent running `cez serve`/`cez run`/the test suite) would then
      *  write follow-ups into the parent's inbox despite the opt-out. Empty is the
-     *  established "absent" spelling — consumers guard with `if (todosFile)`. */
+     *  established "absent" spelling — consumers guard with `if (todosFile)`.
+     *
+     *  `TMPDIR`/`TEMP`/`TMP` (#785) point at this run's own scratch directory
+     *  instead of the machine-wide one every agent used to share. Created and
+     *  write-probed here, on the last common path before a spawn, so an unusable
+     *  temp directory throws `AgentTempDirError` at the caller rather than
+     *  turning into empty command output inside a running agent. */
     private agentEnv;
+    /**
+     * `agentEnv` plus the agent-account variable for the profile this STEP runs under (spec
+     * 2026-07-29-agent-profiles), and the id it resolved to so the caller can record it.
+     *
+     * Resolved per step, not per run, because a workflow can mix backends: an override naming a
+     * Claude account says nothing about which Codex account a codex step should use. Resolution
+     * order, most specific first:
+     *
+     *   1. the step's ALREADY-RECORDED `profileId` — a resume or Continue must reattach to the
+     *      account that created the session, whatever the project has since been switched to;
+     *   2. the run's composer override, but only for steps on the run's own runner;
+     *   3. the project's stored selection, and failing that the discovered default.
+     *
+     * Read fresh every time. `~/.cezar/config.json` is shared by every cezar process on this
+     * machine, so a cached snapshot is a staleness bug, and one small JSON read is free next to
+     * spawning a CLI. Never throws: an unreadable home degrades to the default profile, which is
+     * exactly the behaviour that predates profiles.
+     */
+    private agentEnvForStep;
     startRun(workflow: WorkflowDef, input: StartRunInput, group?: {
         groupId: string;
         variant: string;
@@ -235,6 +342,22 @@ export declare class RunManager {
      * root (spec 006 degradation rule), which is always the tighter bound.
      */
     private pump;
+    /**
+     * Make one `queued` RECORD executable again — the engine half a queued run needs but does not
+     * persist (`pendingJobs` / `pendingContinuations` are process-local, the record is not).
+     *
+     * Two callers, one path: boot recovery re-adopts everything the previous process was holding,
+     * and the queue watchdog re-adopts anything the running process has somehow lost. A queued
+     * record with no work item behind it is invisible to `pump()` and would sit there for good,
+     * which is the worst failure this engine has — the task is neither running nor failed, just
+     * silently never going to happen.
+     *
+     * A continuation is reconstructed first: its executable details are gone, but the pending
+     * `continue-N` step and the session before it are durable, which is enough. Otherwise the
+     * workflow is revived from the record. A run that can be neither is failed loudly rather than
+     * left in the queue as a ghost.
+     */
+    private reviveQueuedRun;
     /**
      * Startup recovery (#367) — re-adopt runs that were live when the previous
      * cezar process exited (requires the store opened with `keepLive`):
@@ -251,6 +374,97 @@ export declare class RunManager {
     private reviveWorkflow;
     /** Remove a run from the live registries — keeps `waiting ⊆ active`. */
     private dropActive;
+    /**
+     * A run just failed: if the provider said "usage limit, back at T", promise to resume it at
+     * `T + AUTO_RESUME_GRACE_MS` instead of leaving the task dead until someone notices.
+     *
+     * Every refusal below is silent-but-honest — the run stays `failed` with its Continue button,
+     * which is exactly the pre-feature behavior — except the safety cap, which says so on the
+     * transcript, because a run that stops resuming itself needs to explain why.
+     */
+    private scheduleAutoResumeIfLimited;
+    /** Publish the deadline on the record (the cockpit's only source) and arm the timer for it. */
+    private armAutoResume;
+    /**
+     * The window has reopened. Re-check the record synchronously — hours may have passed, and the
+     * user may have continued, deleted or cancelled the run in them — then hand the resume to the
+     * ordinary queued-continuation path so it obeys both concurrency caps like any other work.
+     */
+    private fireAutoResume;
+    /**
+     * Make the armed timers agree with the records and the current setting. Runs on every `pump()`
+     * — which is where a settings change lands (a config PUT refreshes the shared semaphore, which
+     * pumps every manager) — and once from `recover()`.
+     *
+     * It is a RECONCILE rather than a one-shot restore because the deadline is durable state and
+     * the timer is not: a restart, a rebuilt project context, a manager disposed mid-wait, or a
+     * refusal all leave a record promising a resume that no timer is holding. Rebuilding from the
+     * record covers every one of those at once — the alternative is a hint counting down to a time
+     * that has already passed, which is exactly the failure this method exists to make impossible.
+     *
+     * Cheap: an in-memory scan, and arming is skipped for every run already held.
+     */
+    private reconcileAutoResumes;
+    /**
+     * Hand a run that has not spawned anything back to the queue, when the account it would run on
+     * went into a usage-limit hold (spec 2026-08-03-auto-resume-after-usage-limit).
+     *
+     * The dequeue-time gate in `pump()` cannot be the only one: a run can sit between dequeue and
+     * spawn for a long time — an in-place run waiting for the exclusive repo-root lease is the
+     * measured case — and the account can close in that gap. This is the last honest moment to
+     * refuse, because everything after it costs a real agent turn.
+     *
+     * "Untouched" is the contract: the run has created no session and no worktree, so it goes back
+     * as plain `queued` with its `startedAt` cleared, and `pump()` will pick it up when the window
+     * reopens. Returns true when the caller must abandon the run.
+     */
+    private requeueWhileHeld;
+    /**
+     * The failsafe: a queue must never be able to wedge.
+     *
+     * Everything else in this file makes an idle queue CORRECT under some condition — a slot cap, a
+     * repo-root lease, and now a usage-limit hold. That is also what makes a wedged queue look
+     * correct, and the hold has already produced one in the field: two resumes fired together, each
+     * holding the account the other was waiting on, and the whole workspace stopped with every task
+     * `queued`. That specific bug is fixed and tested, but "the queue stopped and nothing will ever
+     * restart it" is too expensive a failure mode to leave resting on any single fix being right.
+     *
+     * The test is deliberately about JUSTIFICATION rather than about any particular bug: idling is
+     * legitimate while work is running (here or in another project), or while a real appointment is
+     * still ahead — a scheduled resume that will fire and pump on its own. Anything else is a
+     * queue with work in it, nothing running anywhere, and no event coming to wake it. That gets one
+     * forced sweep, which starts work under the ordinary caps and lets the account's real state
+     * re-assert itself: if the window truly is shut, that task meets the limit and re-establishes an
+     * honest hold, with a real deadline behind it this time.
+     *
+     * Public so a test can drive the wedge directly instead of waiting out the interval.
+     */
+    rescueStalledQueue(now?: number): Promise<void>;
+    /**
+     * The accounts this project is currently holding: one key per run parked on a usage-limit
+     * resume that has not come due yet (spec 2026-08-03-auto-resume-after-usage-limit).
+     *
+     * Published to the shared semaphore so the hold spans PROJECTS — one Claude account can be
+     * driving tasks in three repos, and a limit closes it for all of them. Derived from the
+     * records on every ask rather than tracked as state: a deadline that passes, a resume that
+     * fires, a cancel, an archive and a delete all lift the hold with no bookkeeping.
+     *
+     * Deliberately excludes a deadline that has already passed — that run is about to resume, and
+     * holding the queue for it would only stall the very work the window reopened for.
+     */
+    accountHolds(now?: number): AccountHolds;
+    /**
+     * The PER-TASK off switch (`DELETE /api/v1/runs/:id/auto-resume`, and the archive route):
+     * stop resuming THIS task, without touching the workspace setting or any other task.
+     *
+     * Idempotent — a run with nothing pending answers the same way, because "this task will not
+     * resume itself" is equally true either way. Returns false only when the run does not exist,
+     * which is the route's 404.
+     */
+    cancelAutoResume(runId: string): boolean;
+    /** Retire a pending resume — timer, deadline and counter. The counter goes too because every
+     *  caller is a fresh epoch: a human Continue, or a resume that re-stamps its own count. */
+    private clearAutoResume;
     /** Reclaim finished worktrees beyond the keep-limit (#483) — directory only,
      *  `cez/<id8>` branch kept. Best-effort; a failure never affects run
      *  lifecycle. `review`/live runs are excluded by the selector. */
@@ -295,12 +509,18 @@ export declare class RunManager {
      * bound — asserted directly by a test.
      */
     private hydrateQueuedInput;
+    /** Apply edits and messages made while a restart continuation waits for
+     * capacity. The durable record remains the source of truth, just as it is for
+     * an ordinary queued workflow (#472), so a second restart reconstructs and
+     * hydrates the same amendments instead of dropping them. */
+    private hydrateQueuedContinuation;
+    private readPersistedImages;
     /**
      * Still waiting for a slot? Checked against the engine's own queue rather than
      * the record's `status` (#472): the record is written by `execute()` a tick
      * after `pump()` dequeues, so a status read can see `queued` for a run that has
-     * already started. `pendingJobs` is deleted synchronously at dequeue, so it is
-     * the authoritative answer for "can this prompt still be amended".
+     * already started. The pending maps are deleted synchronously at dequeue, so
+     * they are the authoritative answer for "can this prompt still be amended".
      */
     private isQueued;
     /** Split `ContentBlock[]` into the persisted shape a stacked message holds. */
@@ -351,6 +571,9 @@ export declare class RunManager {
      * then offers "Continue" instead.
      */
     sendMessage(runId: string, content: ContentBlock[]): boolean;
+    /** Shared live-session delivery. Synthetic scheduler prompts reuse lifecycle
+     * bookkeeping without masquerading as user-authored transcript messages. */
+    private deliverMessage;
     /** Close the open session gracefully — the run then completes as `done`
      *  (or rests at `review` when the worktree holds changes, spec 009).
      *  On a run already resting at `review` (no session — the engine loop is
@@ -368,7 +591,10 @@ export declare class RunManager {
         images?: ContentBlock[];
         runner?: RunnerId;
         model?: string;
-    }): {
+    }, 
+    /** Restart recovery may discover several interrupted tasks at once. Those
+     *  continuations are queued; an explicit user Continue remains immediate. */
+    deferForCapacity?: boolean): {
         ok: boolean;
         error?: string;
     };
@@ -389,6 +615,17 @@ export declare class RunManager {
     /** Native backend asks arrive before turn-end. Persist and park immediately
      * so the cockpit shows attention and the run releases its workspace slot. */
     private handleRunnerUiEvent;
+    /** Persist the invocation checkpoint before launching a runner. A throw or
+     * process exit before `turn.started` therefore leaves a durable mismatch. */
+    private beginUsageInvocation;
+    /** Fold backend-neutral completed-turn usage into the current step exactly
+     * once. Invocation/turn counters are written before the event reaches the
+     * NDJSON sink so crashes cannot preserve a falsely complete subtotal. */
+    private recordUsageUiEvent;
+    /** Usage completeness is a crash boundary, unlike high-frequency token
+     * snapshots: the checkpoint must reach `runs.json` before the runner starts
+     * or the matching UI event is persisted and forwarded. */
+    private persistUsageCheckpoint;
     /**
      * Turn-end bookkeeping (#389), shared by `runAgentStep` and
      * `runContinuation` — called (fire-and-forget) from every `turn-end` event:
@@ -464,6 +701,9 @@ export declare class RunManager {
     private persistImage;
     private armIdleTimer;
     private clearIdleTimer;
+    private reconcileMonitoringWakeTimers;
+    private armMonitoringWakeTimer;
+    private clearMonitoringWakeTimer;
     /** Autosave-commit the worktree every 90 s while the run lives (spec 006).
      *  Opt-in via CEZ_AUTOSAVE=1 (#471) — see periodicAutosaveEnabled. */
     private armAutosave;
@@ -492,3 +732,24 @@ export declare function makeRunTitle(task: string, workflow: WorkflowDef): strin
  * they are materialized into the worktree separately (see the call site).
  */
 export declare function skillSystemPrompt(skill: Pick<Skill, 'name' | 'description' | 'body'> & Partial<Pick<Skill, 'path' | 'source'>>): string;
+/**
+ * Expand a registry-backed slash skill in one prompt string before it reaches a
+ * backend. Claude otherwise intercepts an unknown leading slash command, and
+ * Codex/OpenCode have no native slash-skill lookup at all (#676).
+ *
+ * Only a match at character zero counts, and unknown commands pass through
+ * byte-for-byte — a backend's OWN slash commands must keep working. The caller
+ * persists the original user text before applying this delivery-only rewrite.
+ *
+ * Both delivery seams route through here: live-session messages via
+ * `expandRegistrySlashSkill`, and a continuation's opening prompt, which becomes
+ * the session's `userPrompt` and never passes through `deliverMessage` at all
+ * (#811).
+ */
+export declare function expandRegistrySlashSkillText(text: string, skills: readonly Skill[]): string;
+/**
+ * `expandRegistrySlashSkillText` over a live chat message: only the first text
+ * block is eligible, and an unchanged block returns the caller's array
+ * identity untouched.
+ */
+export declare function expandRegistrySlashSkill(content: ContentBlock[], skills: readonly Skill[]): ContentBlock[];