@open-mercato/cezar 0.9.1 → 0.9.2

package/dist/workflows/run.js

@@ -2,7 +2,7 @@ import { randomUUID } from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
-import { parseAskMarker, stripAskMarker } from '../core/ask.js';
+import { parseAskMarkerResult, stripAskMarker, } from '../core/ask.js';
 import { onUsage, registerRunProcess, unregisterRunProcess } from '../core/process-usage.js';
 import { createRunner } from '../core/runner-factory.js';
 import { modelConflictsWithRunner } from '../core/model-presets.js';
@@ -14,7 +14,7 @@ import { materializeSkillDir } from '../skills-remote.js';
 import { seedAgentConfigLocalLayer } from '../agent-config/seed.js';
 import { loadConfig, resolveWorktreeRetention } from '../config.js';
 import { autosaveCommit, createWorktree, resolveBaseRef, worktreeDiff, worktreeShortstat } from '../git-worktree.js';
-import { getRepoInfo } from '../server/git.js';
+import { getHeadCommit, getRepoInfo } from '../server/git.js';
 import { loadWorkflows } from './load.js';
 import { reclaimWorktrees, rematerializeReclaimedWorktree } from '../runs/retention.js';
 import { extractTaskRefs, refineTaskRefs, titleRefNumber } from '../runs/task-refs.js';
@@ -77,6 +77,18 @@ function emitAskRequested(sink, ask) {
     sink.handle({ type: 'ask.requested', requestId, questions: ask.questions });
     return requestId;
 }
+/** A persisted, non-fatal explanation for protocol-shaped text that could not
+ * become an ask card. Never include the raw payload in this diagnostic. */
+function askMarkerRejection(result) {
+    if (result.kind === 'invalid-json') {
+        return 'structured question ignored — CEZ:ASK payload is not valid JSON';
+    }
+    if (result.kind !== 'invalid-structure')
+        return undefined;
+    const issue = result.issues[0];
+    const location = issue?.path.length ? ` at ${issue.path.join('.')}` : '';
+    return `structured question ignored — CEZ:ASK payload failed validation${location}${issue ? `: ${issue.message}` : ''}`;
+}
 /** Periodic "cezar autosave" commit in the task worktree (spec 006). */
 export const AUTOSAVE_INTERVAL_MS = 90_000;
 /** The periodic autosave timer is opt-in (#471): off, a task branch carries only the
@@ -89,6 +101,7 @@ export function periodicAutosaveEnabled(env = process.env) {
 /** Safety cap on autonomous auto-continues per run — stops a stuck agent from nudging forever. */
 const MAX_AUTO_CONTINUES = 40;
 const AUTONOMOUS_NUDGE = 'Continue working autonomously until the task is fully complete. Do not ask me for confirmation or clarification — make reasonable assumptions and proceed. When everything is done, end the session with your done signal.';
+const MONITORING_WAKE_NUDGE = 'Re-check the downstream work you were monitoring. Continue toward the task goal; emit CEZ:MONITORING again only if it is still pending.';
 /**
  * The effective "extra" system prompt for a run (spec §protocol v2, R2 2.3):
  * the per-run override (`POST /api/runs` `systemPrompt`) REPLACES the
@@ -171,6 +184,7 @@ const VARIANT_HINTS = {
     B: 'Approach hint: prefer the minimal, surgical change.',
     C: 'Approach hint: prefer a thorough, structural approach.',
 };
+const RESTART_CONTINUATION_PROMPT = 'The cezar process restarted while you were working on this task. Read the handoff file (CEZ_HANDOFF_FILE) to recover context, then continue the task from where you left off.';
 /**
  * The mini workflow engine: executes a `WorkflowDef` against a repo, one step
  * at a time, persisting every event to the RunStore (which the SSE endpoints
@@ -200,7 +214,13 @@ export class RunManager {
     // timeout already bounds how long a session can sit open. Invariant:
     // `waiting ⊆ active` — always cleared together via dropActive().
     waiting = new Set();
+    /** Durable monitoring subset. Only the configured number receives the waiting-slot exemption. */
+    monitoring = new Set();
     pendingJobs = new Map();
+    /** Interrupted agent turns recovered after a process restart. Unlike an
+     *  explicit user Continue, these are bulk scheduler work and must re-enter
+     *  through `pump()` so both workspace and per-project caps are honored. */
+    pendingContinuations = new Map();
     /** Per-run image counter behind `pasted-<n>` / `screenshot-<n>` (#472). Lives on
      *  the manager rather than the `ActiveRun` so a *queued* run — which has no
      *  `ActiveRun` at all — can persist attachments. Seeded lazily from disk. */
@@ -260,8 +280,9 @@ export class RunManager {
     dispose() {
         this.offUsage();
         this.offSemaphore();
-        for (const state of this.active.values()) {
+        for (const [runId, state] of this.active) {
             this.clearIdleTimer(state);
+            this.clearMonitoringWakeTimer(state, runId);
             this.clearAutosaveTimer(state);
             state.releaseRepoRoot?.();
             state.releaseRepoRoot = undefined;
@@ -271,6 +292,7 @@ export class RunManager {
         this.starting.clear();
         this.queue.length = 0;
         this.pendingJobs.clear();
+        this.pendingContinuations.clear();
         this.memoryPausing.clear();
         this.lastNamerKey.clear();
     }
@@ -354,6 +376,9 @@ export class RunManager {
             // auto-nudge reads `input.autonomous` (`execute`), but the record is the
             // only source those after-the-fact consumers have.
             autonomous: input.autonomous === true,
+            // Persist the explicit opt-out so queued-run restart recovery and the
+            // session Git routes can distinguish it from a removed isolated worktree.
+            worktree: !group && input.worktree === false ? false : undefined,
             groupId: group?.groupId,
             variant: group?.variant,
             steps: workflow.steps.map((s) => ({ id: s.id, name: s.name ?? s.id, kind: stepKind(s) })),
@@ -405,7 +430,7 @@ export class RunManager {
         return VARIANT_LETTERS.slice(0, Math.min(Math.max(count, 1), VARIANT_LETTERS.length)).map((variant) => {
             const hint = VARIANT_HINTS[variant];
             const task = hint ? `${input.task}\n\n${hint}` : input.task;
-            return this.startRun(workflow, { ...input, task }, { groupId, variant });
+            return this.startRun(workflow, { ...input, task, worktree: undefined }, { groupId, variant });
         });
     }
     /**
@@ -418,7 +443,9 @@ export class RunManager {
      * `maxParallel`, including when other projects saturate the cap.
      */
     busySlots() {
-        return this.active.size + this.starting.size - this.waiting.size;
+        const ordinaryWaiting = this.waiting.size - this.monitoring.size;
+        const exemptMonitoring = Math.min(this.monitoring.size, this.semaphore.maxMonitoringSessions());
+        return this.active.size + this.starting.size - ordinaryWaiting - exemptMonitoring;
     }
     /** Epoch ms of this manager's oldest queued run (the semaphore's fairness
      *  key when a freed slot is broadcast), or null when nothing is queued.
@@ -454,6 +481,7 @@ export class RunManager {
      * root (spec 006 degradation rule), which is always the tighter bound.
      */
     async pump() {
+        this.reconcileMonitoringWakeTimers();
         // A pump requested while one is in flight can't just be dropped: the
         // in-flight pass may already have read capacity (it awaits `getRepoInfo`
         // before the first check), so a slot freed in that window would be lost
@@ -483,10 +511,28 @@ export class RunManager {
                     if (!runId)
                         break;
                     const job = this.pendingJobs.get(runId);
+                    const continuation = this.pendingContinuations.get(runId);
                     this.pendingJobs.delete(runId);
-                    if (!job)
+                    this.pendingContinuations.delete(runId);
+                    if (!job && !continuation)
                         continue;
                     this.starting.add(runId);
+                    if (continuation) {
+                        const hydrated = this.hydrateQueuedContinuation(runId, continuation);
+                        void this.runContinuation(runId, hydrated.stepId, hydrated.sessionId, hydrated.backend, hydrated.prompt, hydrated.images, hydrated.persistedImages, hydrated.persistedAttachments).catch((err) => {
+                            const message = err instanceof Error ? err.message : String(err);
+                            this.store.updateRun(runId, {
+                                status: 'failed',
+                                error: `continue crashed: ${message}`,
+                                finishedAt: new Date().toISOString(),
+                            });
+                            this.starting.delete(runId);
+                            this.dropActive(runId);
+                        });
+                        continue;
+                    }
+                    if (!job)
+                        continue;
                     // Rebuild the prompt from the store at the last instant (#472), so an edit
                     // or a stacked message that landed while the run waited is honored. Entered
                     // in the same synchronous tick as the `pendingJobs.delete` above, so no
@@ -532,6 +578,35 @@ export class RunManager {
             .sort((a, b) => a.createdAt.localeCompare(b.createdAt));
         for (const run of live) {
             if (run.status === 'queued') {
+                // A second restart can find a continuation that the first restart put
+                // behind a capacity gate. Its executable details are process-local,
+                // but the queued continue step and preceding provider session are
+                // durable, so reconstruct that job before considering workflow revival.
+                const queuedContinuation = [...run.steps]
+                    .reverse()
+                    .find((step) => step.status === 'pending' && step.id.startsWith('continue-'));
+                const sessionStep = queuedContinuation
+                    ? [...run.steps]
+                        .reverse()
+                        .find((step) => step.id !== queuedContinuation.id && step.sessionId)
+                    : undefined;
+                if (queuedContinuation && sessionStep?.sessionId) {
+                    const backend = run.runner ?? 'claude';
+                    const sessionBackend = sessionStep.backend ?? backend;
+                    this.pendingContinuations.set(run.id, {
+                        stepId: queuedContinuation.id,
+                        sessionId: sessionBackend === backend ? sessionStep.sessionId : undefined,
+                        backend,
+                        prompt: RESTART_CONTINUATION_PROMPT,
+                        images: [],
+                    });
+                    this.queue.push(run.id);
+                    this.store.appendEvent(run.id, {
+                        type: 'lifecycle',
+                        message: 'cezar restarted — interrupted continuation re-queued',
+                    });
+                    continue;
+                }
                 const workflow = await this.reviveWorkflow(run);
                 if (workflow) {
                     // Re-apply the inbox ceiling (#471). `execute()` gates again at spawn time, so the
@@ -559,6 +634,9 @@ export class RunManager {
                             // recovered queued autonomous run would run non-autonomously (no
                             // auto-nudge) and later wrongly park at `review`.
                             autonomous: run.autonomous,
+                            // Preserve an explicit worktree opt-out across a queued restart.
+                            // Missing on older records means the default isolated mode.
+                            worktree: run.worktree,
                         }),
                     });
                     this.queue.push(run.id);
@@ -605,8 +683,8 @@ export class RunManager {
                 currentStepId: undefined,
             });
             const resumed = this.continueRun(run.id, {
-                text: 'The cezar process restarted while you were working on this task. Read the handoff file (CEZ_HANDOFF_FILE) to recover context, then continue the task from where you left off.',
-            });
+                text: RESTART_CONTINUATION_PROMPT,
+            }, true);
             this.store.appendEvent(run.id, {
                 type: 'lifecycle',
                 message: resumed.ok
@@ -618,10 +696,12 @@ export class RunManager {
     }
     /** The persisted definition when it looks sane, else the catalog by name. */
     async reviveWorkflow(run) {
+        // "Looks sane" is the STORE's job now: it parses `workflowDef` against the definition schema
+        // and `.catch`es a def that no longer fits to `undefined`, so anything present here already
+        // has the `steps` array the old inline `Array.isArray` check was asking for.
         const def = run.workflowDef;
-        if (def && Array.isArray(def.steps)) {
+        if (def)
             return def;
-        }
         const { workflows } = await loadWorkflows(this.repoRoot);
         return workflows.find((w) => w.name === run.workflow) ?? null;
     }
@@ -632,6 +712,9 @@ export class RunManager {
         if (state)
             state.releaseRepoRoot = undefined;
         this.waiting.delete(runId);
+        this.monitoring.delete(runId);
+        if (state)
+            this.clearMonitoringWakeTimer(state, runId);
         this.active.delete(runId);
         this.memoryPausing.delete(runId);
         this.lastNamerKey.delete(runId);
@@ -723,6 +806,7 @@ export class RunManager {
         if (queuedAt >= 0) {
             this.queue.splice(queuedAt, 1);
             this.pendingJobs.delete(runId);
+            this.pendingContinuations.delete(runId);
             this.store.updateRun(runId, { status: 'cancelled', finishedAt: new Date().toISOString() });
             this.store.appendEvent(runId, { type: 'lifecycle', message: 'cancelled while queued' });
             return true;
@@ -763,35 +847,13 @@ export class RunManager {
             .map((part) => part.trim())
             .filter((part) => part.length > 0)
             .join('\n\n');
-        const readImages = (urls, kind) => {
-            const images = [];
-            for (const url of urls) {
-                const name = url.split('/').pop();
-                if (!name || name.includes('..') || name.includes('/') || name.includes('\\'))
-                    continue;
-                try {
-                    const data = readFileSync(join(this.dataDir, 'runs', `${runId}-images`, name));
-                    images.push({
-                        type: 'image',
-                        source: { type: 'base64', media_type: mediaTypeFor(name), data: data.toString('base64') },
-                    });
-                }
-                catch {
-                    // Degrade, never fail the boot (AGENTS.md): the user deleted `.ai/cezar/`
-                    // or the file is unreadable — start with the text and say which image went.
-                    this.store.appendEvent(runId, {
-                        type: 'note',
-                        message: `${kind} attachment ${name} could not be read — starting without it`,
-                    });
-                }
-            }
-            return images;
-        };
         // Keep the original in-memory blocks for a live process (including the
         // best-effort case where persistence failed). Recovery has no such copy,
         // so rebuild it from the durable task-image URLs.
-        const images = input.images?.length ? input.images : readImages(run.taskImages ?? [], 'task');
-        const stackedImages = readImages(stack.flatMap((m) => m.images ?? []), 'queued');
+        const images = input.images?.length
+            ? input.images
+            : this.readPersistedImages(runId, run.taskImages ?? [], 'task').blocks;
+        const stackedImages = this.readPersistedImages(runId, stack.flatMap((m) => m.images ?? []), 'queued').blocks;
         return {
             ...input,
             task,
@@ -799,15 +861,67 @@ export class RunManager {
             ...(stackedImages.length ? { stackedImages } : { stackedImages: undefined }),
         };
     }
+    /** Apply edits and messages made while a restart continuation waits for
+     * capacity. The durable record remains the source of truth, just as it is for
+     * an ordinary queued workflow (#472), so a second restart reconstructs and
+     * hydrates the same amendments instead of dropping them. */
+    hydrateQueuedContinuation(runId, continuation) {
+        const run = this.store.getRun(runId);
+        if (!run) {
+            return { ...continuation, persistedImages: [], persistedAttachments: [] };
+        }
+        const stack = run.queuedMessages ?? [];
+        const amendedTask = [run.task, ...stack.map((message) => message.text)]
+            .map((part) => part.trim())
+            .filter((part) => part.length > 0)
+            .join('\n\n');
+        const prompt = amendedTask
+            ? `${continuation.prompt}\n\nCurrent task and queued updates:\n\n${amendedTask}`
+            : continuation.prompt;
+        const persisted = this.readPersistedImages(runId, stack.flatMap((message) => message.images ?? []), 'queued');
+        return {
+            ...continuation,
+            prompt,
+            persistedImages: persisted.blocks,
+            persistedAttachments: persisted.attachments,
+        };
+    }
+    readPersistedImages(runId, urls, kind) {
+        const blocks = [];
+        const attachments = [];
+        for (const url of urls) {
+            const name = url.split('/').pop();
+            if (!name || name.includes('..') || name.includes('/') || name.includes('\\'))
+                continue;
+            const path = join(this.dataDir, 'runs', `${runId}-images`, name);
+            try {
+                const data = readFileSync(path);
+                blocks.push({
+                    type: 'image',
+                    source: { type: 'base64', media_type: mediaTypeFor(name), data: data.toString('base64') },
+                });
+                attachments.push({ name, url, path });
+            }
+            catch {
+                // Degrade, never fail the boot (AGENTS.md): the user deleted `.ai/cezar/`
+                // or the file is unreadable — start with the text and say which image went.
+                this.store.appendEvent(runId, {
+                    type: 'note',
+                    message: `${kind} attachment ${name} could not be read — starting without it`,
+                });
+            }
+        }
+        return { blocks, attachments };
+    }
     /**
      * Still waiting for a slot? Checked against the engine's own queue rather than
      * the record's `status` (#472): the record is written by `execute()` a tick
      * after `pump()` dequeues, so a status read can see `queued` for a run that has
-     * already started. `pendingJobs` is deleted synchronously at dequeue, so it is
-     * the authoritative answer for "can this prompt still be amended".
+     * already started. The pending maps are deleted synchronously at dequeue, so
+     * they are the authoritative answer for "can this prompt still be amended".
      */
     isQueued(runId) {
-        return this.pendingJobs.has(runId);
+        return this.pendingJobs.has(runId) || this.pendingContinuations.has(runId);
     }
     /** Split `ContentBlock[]` into the persisted shape a stacked message holds. */
     toQueuedMessage(runId, content) {
@@ -987,6 +1101,18 @@ export class RunManager {
      * then offers "Continue" instead.
      */
     sendMessage(runId, content) {
+        const delivered = this.deliverMessage(runId, content, true);
+        if (delivered) {
+            const state = this.active.get(runId);
+            if (state)
+                state.monitoringWakeups = 0;
+            this.store.updateRun(runId, { monitoringWakeCapReached: undefined });
+        }
+        return delivered;
+    }
+    /** Shared live-session delivery. Synthetic scheduler prompts reuse lifecycle
+     * bookkeeping without masquerading as user-authored transcript messages. */
+    deliverMessage(runId, content, userAuthored) {
         const state = this.active.get(runId);
         if (!state?.session?.open || state.cancelled)
             return false;
@@ -997,27 +1123,32 @@ export class RunManager {
         // Persist the attached images so the thread can render them (not just count them) — the same
         // on-disk store + `/images/` route the agent's own screenshots use. `pasted` prefix marks
         // these as user attachments (vs. agent tool screenshots) on disk (#357).
-        const persisted = content
+        const persisted = userAuthored ? content
             .filter((b) => b.type === 'image')
             .map((b) => this.persistImage(runId, b.source.media_type, b.source.data, 'pasted'))
-            .filter((saved) => saved !== null);
+            .filter((saved) => saved !== null) : [];
         const images = persisted.map((saved) => saved.url);
-        this.store.appendEvent(runId, {
-            type: 'user-message',
-            stepId: state.currentStepId,
-            text,
-            imageCount: content.filter((b) => b.type === 'image').length,
-            images,
-        });
+        if (userAuthored) {
+            this.store.appendEvent(runId, {
+                type: 'user-message',
+                stepId: state.currentStepId,
+                text,
+                imageCount: content.filter((b) => b.type === 'image').length,
+                images,
+            });
+        }
         // Tell the agent where the pasted files live on disk (#357): the base64 blocks below still
         // ride along so the model can *view* them, but a real path is what lets it *operate* on them
         // (save, `cp`, attach to a GitHub issue/PR) — and it's the only usable reference on backends
         // (codex, opencode) that drop image blocks entirely before reaching the model.
-        const deliverable = persisted.length ? [...content, pastedAttachmentsNote(persisted)] : content;
+        const expanded = userAuthored ? expandRegistrySlashSkill(content, state.skills ?? []) : content;
+        const deliverable = persisted.length ? [...expanded, pastedAttachmentsNote(persisted)] : expanded;
         const delivered = state.session.sendMessage(deliverable);
         if (delivered) {
             this.clearIdleTimer(state);
+            this.clearMonitoringWakeTimer(state, runId);
             this.waiting.delete(runId); // resumed — the run counts against slots again
+            this.monitoring.delete(runId);
             // Clear any `monitoring` activity — the agent is actively working again
             // (spec 2026-07-18-subagent-monitoring-status, #490).
             this.store.updateRun(runId, { status: 'running', activity: undefined });
@@ -1054,7 +1185,10 @@ export class RunManager {
      * behaves exactly like an interactive step: `waiting` after each turn,
      * messages via sendMessage, closed by finish/idle/cancel.
      */
-    continueRun(runId, opts = {}) {
+    continueRun(runId, opts = {}, 
+    /** Restart recovery may discover several interrupted tasks at once. Those
+     *  continuations are queued; an explicit user Continue remains immediate. */
+    deferForCapacity = false) {
         if (this.active.has(runId))
             return { ok: false, error: 'run is still active' };
         const run = this.store.getRun(runId);
@@ -1108,7 +1242,26 @@ export class RunManager {
         const continuations = run.steps.filter((s) => s.id.startsWith('continue-')).length;
         const stepId = `continue-${continuations + 1}`;
         this.store.addStep(runId, { id: stepId, name: 'Continue', kind: 'agent' });
-        void this.runContinuation(runId, stepId, resume ? sessionStep.sessionId : undefined, targetRunner, opts.text?.trim() || 'Continue.', opts.images ?? []).catch((err) => {
+        const prompt = opts.text?.trim() || 'Continue.';
+        const images = opts.images ?? [];
+        if (deferForCapacity) {
+            this.pendingContinuations.set(runId, {
+                stepId,
+                sessionId: resume ? sessionStep.sessionId : undefined,
+                backend: targetRunner,
+                prompt,
+                images,
+            });
+            this.queue.push(runId);
+            this.store.updateRun(runId, {
+                status: 'queued',
+                error: undefined,
+                finishedAt: undefined,
+                currentStepId: undefined,
+            });
+            return { ok: true };
+        }
+        void this.runContinuation(runId, stepId, resume ? sessionStep.sessionId : undefined, targetRunner, prompt, images).catch((err) => {
             const message = err instanceof Error ? err.message : String(err);
             this.store.updateRun(runId, {
                 status: 'failed',
@@ -1123,7 +1276,11 @@ export class RunManager {
     /** Screenshots pasted into the follow-up composer — delivered with the
      *  reopened session's opening message, exactly like a live-session
      *  message's attachments. */
-    images = []) {
+    images = [], 
+    /** Queued-message screenshots were persisted when they were enqueued and
+     *  reconstructed at dequeue. Keep them separate from fresh `images` so
+     *  opening a recovered continuation does not persist duplicate files. */
+    persistedImages = [], persistedAttachments = []) {
         // Continuation runs in the task's worktree when it still exists (spec
         // 006) — the resumed session sees exactly what the original run left.
         // Retention (#483) may have reclaimed this run's worktree directory while
@@ -1141,6 +1298,7 @@ export class RunManager {
             : this.repoRoot;
         const state = { cancelled: false, interrupt: () => undefined, cwd };
         this.active.set(runId, state);
+        this.starting.delete(runId);
         if (state.cwd === this.repoRoot) {
             this.store.appendEvent(runId, {
                 type: 'note',
@@ -1180,15 +1338,17 @@ export class RunManager {
         // images rather than a bare count, and handed to the agent BOTH as base64 blocks (so it can
         // view them) and as absolute paths appended to the prompt (so it can operate on them — and
         // because codex/opencode drop image blocks before they reach the model).
-        const attachments = images
+        const freshAttachments = images
             .filter((b) => b.type === 'image')
             .map((b) => this.persistImage(runId, b.source.media_type, b.source.data, 'pasted'))
             .filter((saved) => saved !== null);
+        const openingImages = [...images, ...persistedImages];
+        const attachments = [...freshAttachments, ...persistedAttachments];
         this.store.appendEvent(runId, {
             type: 'user-message',
             stepId,
             text: prompt,
-            imageCount: images.filter((b) => b.type === 'image').length,
+            imageCount: openingImages.filter((b) => b.type === 'image').length,
             ...(attachments.length ? { images: attachments.map((saved) => saved.url) } : {}),
         });
         let stepCost = 0;
@@ -1229,9 +1389,13 @@ export class RunManager {
                 const done = sessionOpen && DONE_MARKER_RE.test(turnText.trimEnd());
                 // `CEZ:ASK` → the user is genuinely blocked; wins over `CEZ:MONITORING`
                 // (a pending question is always attention), loses to `CEZ:DONE` (#473).
-                const ask = sessionOpen && !done ? parseAskMarker(turnText) : null;
+                const askResult = sessionOpen && !done ? parseAskMarkerResult(turnText) : undefined;
+                const ask = askResult?.kind === 'valid' ? askResult.request : null;
+                const askRejection = askResult ? askMarkerRejection(askResult) : undefined;
                 const monitoring = sessionOpen && !done && !ask && MONITORING_MARKER_RE.test(turnText.trimEnd());
                 turnText = '';
+                if (askRejection)
+                    this.store.appendEvent(runId, { type: 'note', message: askRejection, stepId });
                 if (done) {
                     // Goal achieved (agent contract, #347) — same as in runAgentStep.
                     this.store.appendEvent(runId, { type: 'lifecycle', message: 'goal achieved — session closed' });
@@ -1267,13 +1431,19 @@ export class RunManager {
                         if (monitoring) {
                             this.store.updateRun(runId, { status: 'running', activity: 'monitoring' });
                             this.store.updateStep(runId, stepId, { status: 'running' });
+                            this.monitoring.add(runId);
+                            this.clearIdleTimer(state);
+                            this.armMonitoringWakeTimer(runId, state);
                         }
                         else {
                             this.store.updateRun(runId, { status: 'waiting', activity: undefined });
                             this.store.updateStep(runId, stepId, { status: 'waiting' });
+                            this.monitoring.delete(runId);
+                            this.clearMonitoringWakeTimer(state, runId);
                         }
                         this.waiting.add(runId);
-                        this.armIdleTimer(runId, state);
+                        if (!monitoring)
+                            this.armIdleTimer(runId, state);
                         this.releaseSlot();
                     }
                 }
@@ -1321,13 +1491,15 @@ export class RunManager {
             return;
         }
         const runner = createRunner(continueBackend);
+        state.currentStepId = stepId;
+        this.beginUsageInvocation(runId, state, stepId);
         const session = runner.startSession({
             // The Continue step is a fresh agent session on the same run — the
             // run's extra system prompt (already resolved at execute time and
             // echoed on the record) rides along with the handoff contract.
             systemPrompt: composeSystemPrompt(record?.systemPrompt, generateFollowups ? HANDOFF_INSTRUCTIONS : HANDOFF_ONLY_INSTRUCTIONS),
             userPrompt: attachments.length ? `${prompt}\n\n${pastedAttachmentsText(attachments)}` : prompt,
-            ...(images.length ? { images } : {}),
+            ...(openingImages.length ? { images: openingImages } : {}),
             cwd: state.cwd,
             allowedTools: DEFAULT_ALLOWED_TOOLS,
             additionalDirectories: [join(this.dataDir, 'runs')],
@@ -1340,7 +1512,6 @@ export class RunManager {
         state.session = session;
         state.sessionEverOpened = true;
         this.flushDeferred(runId);
-        state.currentStepId = stepId;
         state.interrupt = () => session.interrupt();
         if (session.pid !== undefined)
             registerRunProcess(runId, session.pid);
@@ -1429,11 +1600,20 @@ export class RunManager {
         // established; only explicit opt-out and non-Git modes run in place.
         const repo = await getRepoInfo(this.repoRoot);
         if (repo && input.worktree === false) {
-            // Composer opt-out: run in the repo working tree, no branch/worktree
-            // (read-only skills — review, summarize — that never need isolation).
+            // Composer opt-out: run in the repo working tree, no branch/worktree. The
+            // repository-root lease serializes these runs so workflows cannot overlap.
+            // Pin the starting commit: the session's Changes and Commits views use it
+            // as their stable lower bound while reading the current working copy.
+            const startingCommit = await getHeadCommit(repo.root);
+            if (startingCommit)
+                this.store.updateRun(runId, { baseBranch: startingCommit });
             emit({ type: 'note', message: 'worktree off — running in the repo working tree' });
         }
         else if (repo) {
+            emit({
+                type: 'note',
+                message: `worktree on — using an isolated task worktree (${input.worktree === true ? 'explicit request' : 'default'})`,
+            });
             // Fork from the configured base branch (config.json `baseBranch`, e.g.
             // `develop`) — also the target of the eventual draft PR. Unresolvable
             // (typo, not fetched) → note + the currently checked-out branch.
@@ -1508,6 +1688,7 @@ export class RunManager {
         if (seeded)
             seedHandoffFile(this.dataDir, seeded);
         const skills = await discoverSkills(this.repoRoot);
+        state.skills = skills;
         const retriesUsed = new Map();
         let checkFailure = null;
         let runError = null;
@@ -1723,13 +1904,17 @@ export class RunManager {
                 const done = interactive && sessionOpen && DONE_MARKER_RE.test(turnText.trimEnd());
                 // `CEZ:ASK` → the user is blocked; wins over `CEZ:MONITORING`, loses to
                 // `CEZ:DONE` (#473).
-                const ask = interactive && sessionOpen && !done ? parseAskMarker(turnText) : null;
+                const askResult = interactive && sessionOpen && !done ? parseAskMarkerResult(turnText) : undefined;
+                const ask = askResult?.kind === 'valid' ? askResult.request : null;
+                const askRejection = askResult ? askMarkerRejection(askResult) : undefined;
                 const monitoring = interactive &&
                     sessionOpen &&
                     !done &&
                     !ask &&
                     MONITORING_MARKER_RE.test(turnText.trimEnd());
                 turnText = '';
+                if (askRejection)
+                    emit({ type: 'note', stepId: step.id, message: askRejection });
                 if (done) {
                     // Goal achieved (agent contract, #347): close the session instead
                     // of parking at `waiting` — the run completes and frees its slot.
@@ -1752,13 +1937,19 @@ export class RunManager {
                     if (monitoring) {
                         this.store.updateRun(runId, { status: 'running', activity: 'monitoring' });
                         this.store.updateStep(runId, step.id, { status: 'running' });
+                        this.monitoring.add(runId);
+                        this.clearIdleTimer(state);
+                        this.armMonitoringWakeTimer(runId, state);
                     }
                     else {
                         this.store.updateRun(runId, { status: 'waiting', activity: undefined });
                         this.store.updateStep(runId, step.id, { status: 'waiting' });
+                        this.monitoring.delete(runId);
+                        this.clearMonitoringWakeTimer(state, runId);
                     }
                     this.waiting.add(runId);
-                    this.armIdleTimer(runId, state);
+                    if (!monitoring)
+                        this.armIdleTimer(runId, state);
                     this.releaseSlot(); // the freed slot can start a queued run right away — in any project
                 }
                 // Cez's own heartbeat — the handoff stays current even when the
@@ -1790,6 +1981,8 @@ export class RunManager {
         }
         const runner = createRunner(stepBackend);
         let session;
+        state.currentStepId = step.id;
+        this.beginUsageInvocation(runId, state, step.id);
         try {
             session = runner.startSession({
                 // Skill body, then the run's extra prompt (POST override or config
@@ -1815,6 +2008,7 @@ export class RunManager {
             });
         }
         catch (err) {
+            state.currentStepId = undefined;
             return err instanceof Error ? err.message : String(err);
         }
         state.session = session;
@@ -1840,6 +2034,9 @@ export class RunManager {
         finally {
             this.recordUsagePeaks(runId);
             this.clearIdleTimer(state);
+            this.monitoring.delete(runId);
+            this.waiting.delete(runId);
+            this.clearMonitoringWakeTimer(state, runId);
             state.session = undefined;
             state.currentStepId = undefined;
             state.interrupt = () => undefined;
@@ -1863,16 +2060,90 @@ export class RunManager {
     /** Native backend asks arrive before turn-end. Persist and park immediately
      * so the cockpit shows attention and the run releases its workspace slot. */
     handleRunnerUiEvent(runId, state, sink, event) {
+        this.recordUsageUiEvent(runId, state, event);
         sink.handle(event);
         if (event.type !== 'ask.requested' || state.cancelled)
             return;
         this.clearIdleTimer(state);
+        this.monitoring.delete(runId);
+        this.clearMonitoringWakeTimer(state, runId);
         this.waiting.add(runId);
         this.store.updateRun(runId, { status: 'waiting', activity: undefined });
         if (state.currentStepId)
             this.store.updateStep(runId, state.currentStepId, { status: 'waiting' });
         this.releaseSlot();
     }
+    /** Persist the invocation checkpoint before launching a runner. A throw or
+     * process exit before `turn.started` therefore leaves a durable mismatch. */
+    beginUsageInvocation(runId, state, stepId) {
+        const step = this.store.getRun(runId)?.steps.find((candidate) => candidate.id === stepId);
+        if (!step)
+            return;
+        const epoch = (step.usageInvocationEpoch ?? 0) + 1;
+        this.persistUsageCheckpoint(runId, stepId, {
+            usageInvocationEpoch: epoch,
+            usageInvocationsStarted: (step.usageInvocationsStarted ?? 0) + 1,
+        });
+        state.usageInvocation = {
+            stepId,
+            epoch,
+            observed: false,
+            startedTurns: new Set(),
+            recordedTurns: new Set(),
+        };
+    }
+    /** Fold backend-neutral completed-turn usage into the current step exactly
+     * once. Invocation/turn counters are written before the event reaches the
+     * NDJSON sink so crashes cannot preserve a falsely complete subtotal. */
+    recordUsageUiEvent(runId, state, event) {
+        const invocation = state.usageInvocation;
+        if (!invocation)
+            return;
+        const step = this.store.getRun(runId)?.steps.find((candidate) => candidate.id === invocation.stepId);
+        if (!step)
+            return;
+        if (event.type === 'turn.started') {
+            if (invocation.startedTurns.has(event.turnId))
+                return;
+            invocation.startedTurns.add(event.turnId);
+            const firstObservedTurn = !invocation.observed;
+            invocation.observed = true;
+            this.persistUsageCheckpoint(runId, invocation.stepId, {
+                usageTurnsStarted: (step.usageTurnsStarted ?? 0) + 1,
+                ...(firstObservedTurn
+                    ? { usageInvocationsObserved: (step.usageInvocationsObserved ?? 0) + 1 }
+                    : {}),
+            });
+            return;
+        }
+        if (event.type !== 'turn.completed')
+            return;
+        if (!invocation.startedTurns.has(event.turnId) || invocation.recordedTurns.has(event.turnId))
+            return;
+        const input = event.usage?.input;
+        const output = event.usage?.output;
+        if (typeof input !== 'number' ||
+            !Number.isFinite(input) ||
+            input < 0 ||
+            typeof output !== 'number' ||
+            !Number.isFinite(output) ||
+            output < 0) {
+            return;
+        }
+        invocation.recordedTurns.add(event.turnId);
+        this.persistUsageCheckpoint(runId, invocation.stepId, {
+            inputTokens: (step.inputTokens ?? 0) + input,
+            outputTokens: (step.outputTokens ?? 0) + output,
+            usageTurnsRecorded: (step.usageTurnsRecorded ?? 0) + 1,
+        });
+    }
+    /** Usage completeness is a crash boundary, unlike high-frequency token
+     * snapshots: the checkpoint must reach `runs.json` before the runner starts
+     * or the matching UI event is persisted and forwarded. */
+    persistUsageCheckpoint(runId, stepId, patch) {
+        this.store.updateStep(runId, stepId, patch);
+        this.store.flush();
+    }
     /**
      * Turn-end bookkeeping (#389), shared by `runAgentStep` and
      * `runContinuation` — called (fire-and-forget) from every `turn-end` event:
@@ -1939,7 +2210,12 @@ export class RunManager {
             // deliberately NEVER a title source; see maybeRefreshTitle below. The
             // one exception is an explicit CEZ:TITLE declaration (applied above).
             if (run.worktreePath && existsSync(run.worktreePath)) {
-                const stat = await worktreeShortstat(run.worktreePath, run.baseBranch ?? 'HEAD');
+                // `taskBranch` is what keeps this number *this task's* (#751): a review/QA run
+                // repoints the worktree onto the branch under review, and without the branch to
+                // compare HEAD against, the stat would claim that whole branch's diff.
+                const stat = await worktreeShortstat(run.worktreePath, run.baseBranch ?? 'HEAD', {
+                    taskBranch: run.branch,
+                });
                 if (stat)
                     this.store.updateRun(runId, { diffStat: stat });
                 else
@@ -2096,7 +2372,10 @@ export class RunManager {
                     throw err;
                 }
                 this.queuedImageSeq.set(runId, seq);
-                return { name, url: `/api/runs/${runId}/images/${name}`, path };
+                // Versioned, because that is the only surface served now. The cockpit still upgrades
+                // the unversioned URLs sitting in OLD transcripts when it renders them
+                // (`resolveApiUrl`), but a URL minted today must be fetchable as written.
+                return { name, url: `/api/v1/runs/${runId}/images/${name}`, path };
             }
             return null;
         }
@@ -2123,6 +2402,68 @@ export class RunManager {
             state.idleTimer = undefined;
         }
     }
+    reconcileMonitoringWakeTimers() {
+        for (const runId of this.monitoring) {
+            const state = this.active.get(runId);
+            if (state)
+                this.armMonitoringWakeTimer(runId, state);
+        }
+    }
+    armMonitoringWakeTimer(runId, state) {
+        const minutes = this.semaphore.monitoringWakeIntervalMinutes();
+        if (minutes === null) {
+            this.clearMonitoringWakeTimer(state, runId);
+            return;
+        }
+        if ((state.monitoringWakeups ?? 0) >= MAX_AUTO_CONTINUES) {
+            this.clearMonitoringWakeTimer(state, runId);
+            if (!this.store.getRun(runId)?.monitoringWakeCapReached) {
+                this.store.updateRun(runId, { monitoringWakeCapReached: true });
+                this.store.appendEvent(runId, {
+                    type: 'note',
+                    message: `automatic monitoring wake-up cap reached (${MAX_AUTO_CONTINUES}); session remains parked`,
+                });
+            }
+            return;
+        }
+        if (state.monitoringWakeTimer && state.monitoringWakeIntervalMinutes === minutes)
+            return;
+        this.clearMonitoringWakeTimer(state, runId);
+        state.monitoringWakeIntervalMinutes = minutes;
+        this.store.updateRun(runId, { monitoringWakeCapReached: undefined });
+        const deadline = Date.now() + minutes * 60_000;
+        this.store.updateRun(runId, { monitoringWakeAt: new Date(deadline).toISOString() });
+        state.monitoringWakeTimer = setTimeout(() => {
+            state.monitoringWakeTimer = undefined;
+            this.store.updateRun(runId, { monitoringWakeAt: undefined });
+            if (!this.monitoring.has(runId) || !state.session?.open || state.cancelled)
+                return;
+            const wakeups = state.monitoringWakeups ?? 0;
+            if (wakeups >= MAX_AUTO_CONTINUES) {
+                this.store.updateRun(runId, { monitoringWakeCapReached: true });
+                this.store.appendEvent(runId, {
+                    type: 'note',
+                    message: `automatic monitoring wake-up cap reached (${MAX_AUTO_CONTINUES}); session remains parked`,
+                });
+                return;
+            }
+            state.monitoringWakeups = wakeups + 1;
+            this.store.appendEvent(runId, {
+                type: 'note',
+                message: `automatic monitoring wake-up (${state.monitoringWakeups}/${MAX_AUTO_CONTINUES})`,
+            });
+            this.deliverMessage(runId, [{ type: 'text', text: MONITORING_WAKE_NUDGE }], false);
+        }, Math.max(0, deadline - Date.now()));
+        state.monitoringWakeTimer.unref?.();
+    }
+    clearMonitoringWakeTimer(state, runId) {
+        if (state.monitoringWakeTimer)
+            clearTimeout(state.monitoringWakeTimer);
+        state.monitoringWakeTimer = undefined;
+        state.monitoringWakeIntervalMinutes = undefined;
+        if (runId)
+            this.store.updateRun(runId, { monitoringWakeAt: undefined });
+    }
     /** Autosave-commit the worktree every 90 s while the run lives (spec 006).
      *  Opt-in via CEZ_AUTOSAVE=1 (#471) — see periodicAutosaveEnabled. */
     armAutosave(state) {
@@ -2244,4 +2585,35 @@ export function skillSystemPrompt(skill) {
     lines.push('', 'Skill instructions:', skill.body.trim());
     return lines.join('\n');
 }
+/**
+ * Expand a registry-backed slash skill in a live chat message before it reaches
+ * a backend. Claude otherwise intercepts an unknown leading slash command, and
+ * Codex/OpenCode have no native slash-skill lookup at all (#676).
+ *
+ * Only the first text block is eligible, only at character zero, and unknown
+ * commands pass through byte-for-byte. The caller persists the original user
+ * content before applying this delivery-only rewrite.
+ */
+export function expandRegistrySlashSkill(content, skills) {
+    const textIndex = content.findIndex((block) => block.type === 'text');
+    if (textIndex < 0)
+        return content;
+    const block = content[textIndex];
+    if (!block || block.type !== 'text')
+        return content;
+    const match = /^\/([A-Za-z0-9][A-Za-z0-9._-]*)(?=\s|$)/.exec(block.text);
+    if (!match)
+        return content;
+    const skill = skills.find((candidate) => candidate.name === match[1]);
+    if (!skill)
+        return content;
+    const request = block.text.slice(match[0].length).trim();
+    const replacement = {
+        type: 'text',
+        text: request ? `${skillSystemPrompt(skill)}\n\nUser request:\n${request}` : skillSystemPrompt(skill),
+    };
+    const expanded = [...content];
+    expanded[textIndex] = replacement;
+    return expanded;
+}
 //# sourceMappingURL=run.js.map