@prestyj/cli 5.1.1 → 5.3.0

package/dist/app-sidecar.js

@@ -17,13 +17,18 @@ import os from "node:os";
 import path from "node:path";
 import { randomUUID } from "node:crypto";
 import { parseArgs } from "node:util";
+import { formatError } from "@prestyj/ai";
 import { runJsonMode } from "./modes/json-mode.js";
 import { AgentSession } from "./core/agent-session.js";
-import { buildNolanSystemPrompt } from "./core/nolan-prompt.js";
-import { buildNolanDigest } from "./core/nolan-context.js";
+import { buildNolanSystemPrompt, buildNolanAutopilotSystemPrompt } from "./core/nolan-prompt.js";
+import { buildNolanDigest, buildNolanAutopilotContext } from "./core/nolan-context.js";
+import { parseAutopilotVerdict } from "./core/autopilot-verdict.js";
+import { isWorkflowCommandText, countAssistantMessages, shouldStartAutopilotCycle, } from "./core/autopilot-gate.js";
+import { driveAutopilotCycle } from "./core/autopilot-cycle.js";
+import { validateNolanModelPref, effectiveNolanModel, } from "./core/nolan-model.js";
 import { collectProjectContext } from "./system-prompt.js";
 import { AuthStorage } from "./core/auth-storage.js";
-import { MOONSHOT_OAUTH_KEY } from "@prestyj/core";
+import { MOONSHOT_OAUTH_KEY, XIAOMI_CREDITS_KEY } from "@prestyj/core";
 import { loginAnthropic } from "./core/oauth/anthropic.js";
 import { loginOpenAI } from "./core/oauth/openai.js";
 import { loginGemini } from "./core/oauth/gemini.js";
@@ -38,7 +43,7 @@ import { getNextThinkingLevel, getSupportedThinkingLevels, isThinkingLevelSuppor
 import { PROMPT_COMMANDS } from "./core/prompt-commands.js";
 import { loadCustomCommands } from "./core/custom-commands.js";
 import { discoverProjects, listRecentSessions } from "./core/project-discovery.js";
-import { loadTasksSync, saveTasksSync, getNextPendingTask, markTaskInProgress, } from "./core/task-store.js";
+import { loadTasksSync, saveTasksSync, pruneDoneTasksSync, getNextPendingTask, markTaskInProgress, } from "./core/task-store.js";
 import { initLogger, log } from "./core/logger.js";
 import { RADIO_STATIONS, getCurrentStation, playRadio, stopRadio } from "./core/radio.js";
 import { enrichProcessPath } from "./core/shell-path.js";
@@ -79,6 +84,8 @@ async function loadAppSettings() {
             // Preserve the per-project map verbatim (validated + written by the
             // model/thinking handlers below).
             projectModels: raw.projectModels && typeof raw.projectModels === "object" ? raw.projectModels : undefined,
+            autopilot: raw.autopilot && typeof raw.autopilot === "object" ? raw.autopilot : undefined,
+            nolanModels: raw.nolanModels && typeof raw.nolanModels === "object" ? raw.nolanModels : undefined,
         };
     }
     catch {
@@ -102,6 +109,37 @@ async function saveProjectModelPrefs(cwd, prefs) {
     s.projectModels = { ...(s.projectModels ?? {}), [key]: prefs };
     await saveAppSettings(s);
 }
+/** Read this project's persisted Nolan model override, if any. */
+async function loadNolanModelPref(cwd) {
+    const s = await loadAppSettings();
+    return s.nolanModels?.[projectModelKey(cwd)];
+}
+/** Persist (or with null, clear) this project's Nolan model override via
+ *  read-modify-write so the rest of the settings file is preserved. */
+async function saveNolanModelPref(cwd, pref) {
+    const s = await loadAppSettings();
+    const key = projectModelKey(cwd);
+    const next = { ...(s.nolanModels ?? {}) };
+    if (pref)
+        next[key] = pref;
+    else
+        delete next[key];
+    s.nolanModels = next;
+    await saveAppSettings(s);
+}
+/** Read this project's persisted autopilot flag (default off). */
+async function loadAutopilot(cwd) {
+    const s = await loadAppSettings();
+    return s.autopilot?.[projectModelKey(cwd)] ?? false;
+}
+/** Persist this project's autopilot flag via read-modify-write so the rest of
+ *  the settings file (projectsRoot, model map, other projects) is preserved. */
+async function saveAutopilot(cwd, enabled) {
+    const s = await loadAppSettings();
+    const key = projectModelKey(cwd);
+    s.autopilot = { ...(s.autopilot ?? {}), [key]: enabled };
+    await saveAppSettings(s);
+}
 /**
  * Persist the active model selection to ~/.ezcoder/settings.json so it survives app
  * restarts. Mirrors the CLI's handleModelSelect persistence (App.tsx).
@@ -362,12 +400,23 @@ async function runJsonModeIfRequested() {
             model: { type: "string" },
             "max-turns": { type: "string" },
             "system-prompt": { type: "string" },
+            tools: { type: "string" },
             "prompt-cache-key": { type: "string" },
         },
         allowPositionals: true,
         strict: true,
     });
     const maxTurnsRaw = values["max-turns"];
+    // Optional tool allow-list forwarded by the subagent spawner from an agent
+    // definition's `tools:` frontmatter. Mirrors the identical parsing in
+    // cli.ts's `values.json` branch — keep both in sync (see subagent.ts).
+    const parsedTools = values.tools
+        ? values.tools
+            .split(",")
+            .map((t) => t.trim())
+            .filter(Boolean)
+        : [];
+    const allowedTools = parsedTools.length > 0 ? parsedTools : undefined;
     await runJsonMode({
         message: positionals[0] ?? "",
         provider: (values.provider ?? "anthropic"),
@@ -375,6 +424,7 @@ async function runJsonModeIfRequested() {
         cwd: process.cwd(),
         systemPrompt: values["system-prompt"],
         maxTurns: maxTurnsRaw ? parseInt(maxTurnsRaw, 10) : undefined,
+        allowedTools,
         promptCacheKey: values["prompt-cache-key"],
     }).catch((err) => {
         process.stderr.write((err instanceof Error ? err.message : String(err)) + "\n");
@@ -575,9 +625,11 @@ function lastAssistantText(messages) {
 /**
  * Assemble Nolan's context digest for one `@Nolan` question: project docs (up the
  * tree) + git/env + the build session's compaction summary + recent activity.
- * Prepended to the user's question as Nolan's prompt body each turn.
+ * Prepended to the user's question as Nolan's prompt body each turn. Workflow
+ * commands + autopilot-injected prompts are passed through so the digest
+ * labels them as what they are instead of user-authored asks.
  */
-async function buildNolanContext(buildSession, cwd, gitBranch, question) {
+async function buildNolanContext(buildSession, cwd, gitBranch, question, workflowCommands, injectedPrompts) {
     const projectContext = await collectProjectContext(cwd).catch(() => []);
     return buildNolanDigest({
         question,
@@ -585,6 +637,8 @@ async function buildNolanContext(buildSession, cwd, gitBranch, question) {
         cwd,
         gitBranch,
         messages: buildSession.getMessages(),
+        workflowCommands,
+        injectedPrompts,
     });
 }
 /**
@@ -632,6 +686,31 @@ async function createSession(deps, opts) {
         for (const c of clients)
             c.res.write(frame);
     }
+    // Turn any thrown value into the same clear headline/message/guidance shape
+    // the TUI shows (see gg-ai's formatError) instead of a bare `err.message`, log
+    // the full detail, and broadcast it under `type` ("error" or "nolan_error").
+    // Without this the webview only ever saw a raw provider string like
+    // `400 {"code":"400",...}` with no "is this me or them / when does it reset"
+    // context that the CLI has always given.
+    function broadcastError(type, logLabel, err) {
+        const f = formatError(err);
+        log("ERROR", "app-sidecar", logLabel, {
+            headline: f.headline,
+            source: f.source,
+            ...(f.message ? { message: f.message } : {}),
+            ...(f.provider ? { provider: f.provider } : {}),
+            ...(f.statusCode != null ? { statusCode: String(f.statusCode) } : {}),
+            ...(f.requestId ? { requestId: f.requestId } : {}),
+        });
+        broadcast(type, {
+            headline: f.headline,
+            ...(f.message ? { message: f.message } : {}),
+            guidance: f.guidance,
+            ...(f.provider ? { provider: f.provider } : {}),
+            ...(f.statusCode != null ? { statusCode: f.statusCode } : {}),
+            ...(f.resetsAt != null ? { resetsAt: f.resetsAt } : {}),
+        });
+    }
     // The session file path to resume (passed by the daemon's POST /session);
     // empty/unset starts a fresh session.
     const resumeSessionPath = opts.sessionPath;
@@ -680,7 +759,7 @@ async function createSession(deps, opts) {
     let gitIsRepo = await isGitRepo(cwd).catch(() => false);
     function currentContextWindow() {
         const st = session.getState();
-        return getContextWindow(st.model, { provider: st.provider });
+        return getContextWindow(st.model, { provider: st.provider, accountId: st.accountId });
     }
     // Shared shape merged into /state + the SSE `ready` frame so the footer can
     // render context %, branch, and tasks immediately on connect.
@@ -731,9 +810,7 @@ async function createSession(deps, opts) {
     session.eventBus.on("turn_end", (d) => broadcast("turn_end", d));
     session.eventBus.on("agent_done", (d) => broadcast("agent_done", d));
     session.eventBus.on("error", (d) => {
-        const message = d.error instanceof Error ? d.error.message : String(d.error);
-        log("ERROR", "app-sidecar", "agent error", { message });
-        broadcast("error", { message });
+        broadcastError("error", "agent error", d.error);
     });
     session.eventBus.on("model_change", (d) => broadcast("model_change", d));
     session.eventBus.on("hook", (d) => broadcast("hook", d));
@@ -741,6 +818,41 @@ async function createSession(deps, opts) {
     session.eventBus.on("compaction_end", (d) => broadcast("compaction_end", d));
     let running = false;
     let titleGenerated = false;
+    // Autopilot (auto-review) toggle for THIS window's project. Loaded from
+    // ezcoder-app.json on boot; flipped via POST /autopilot. When on, POST /prompt runs
+    // runAutopilotCycle after the user's turn settles — Nolan auto-reviews the work
+    // and drives the review→prompt→review loop.
+    let autopilot = await loadAutopilot(cwd);
+    // True while an autopilot review is in flight (used to defer nolanAuto model
+    // switches, like nolanRunning does for chat Nolan, and to drive the spinner).
+    let autopilotReviewing = false;
+    // True for the WHOLE autopilot cycle (reviews + injected runs). The build
+    // `running` flag is false during the review windows between injected runs, so
+    // this is the extra guard that makes a user /prompt queue as steering instead
+    // of starting a run that would collide with an injected one on the same
+    // session (AgentSession.prompt has no concurrency guard).
+    let autopilotActive = false;
+    // Set by /cancel to break out of an in-flight autopilot cycle between steps.
+    let autopilotCancelled = false;
+    // Hard cap on review→prompt→review rounds per user turn (loop safety).
+    const MAX_AUTOPILOT_ROUNDS = 3;
+    // Prompt bodies Autopilot Nolan injected into the BUILD session this
+    // conversation. Passed into every Nolan digest so injected prompts render as
+    // "Nolan autopilot (injected)" instead of `**User:**` — otherwise multi-round
+    // cycles drift into Nolan reviewing against his own last prompt. Cleared
+    // whenever the conversation resets (new session / plan accept / task run).
+    let injectedAutopilotPrompts = [];
+    // Workflow (prompt-template) commands: built-in + the project's custom
+    // `.ezcoder/commands/*.md`. Used to gate autopilot off command turns and to label
+    // expanded templates in Nolan's digests. Loaded fresh so a newly added custom
+    // command is picked up without a restart (mirrors GET /commands).
+    async function loadWorkflowCommandSpecs() {
+        const custom = await loadCustomCommands(cwd).catch(() => []);
+        return [
+            ...PROMPT_COMMANDS.map((c) => ({ name: c.name, aliases: c.aliases, prompt: c.prompt })),
+            ...custom.map((c) => ({ name: c.name, aliases: [], prompt: c.prompt })),
+        ];
+    }
     // ── Telegram serve (remote control via Telegram) ───────────
     // A single embedded serve session lives in this sidecar process. Only the main
     // window's home screen exposes the controls, so there's one bot per app.
@@ -756,6 +868,35 @@ async function createSession(deps, opts) {
     let nolanRunning = false;
     let pendingNolanModel = null;
     const nolanToolCallNames = new Map();
+    // Nolan's per-project model override. null → Nolan (chat + autopilot) follows GG
+    // Coder's model, including live switches (the historical behavior). Set → Nolan
+    // is pinned to his own model and EZ Coder switches no longer touch him. A
+    // stale persisted pin (model dropped from the registry / provider logged
+    // out) validates to null so Nolan degrades to following instead of erroring.
+    let nolanModelOverride = validateNolanModelPref(await loadNolanModelPref(cwd), {
+        modelExists: (id) => getModel(id) !== undefined,
+        providerConnected: () => true, // async auth checked below
+    });
+    if (nolanModelOverride && !(await auth.hasProviderAuth(nolanModelOverride.provider))) {
+        log("WARN", "app-sidecar", "ken model override provider not connected — following GG", {
+            provider: nolanModelOverride.provider,
+            model: nolanModelOverride.model,
+        });
+        nolanModelOverride = null;
+    }
+    /** The model Nolan uses next turn: the pin when set, else EZ Coder's. */
+    function nolanCurrentModel() {
+        if (nolanModelOverride)
+            return nolanModelOverride;
+        const st = session.getState();
+        return { provider: st.provider, model: st.model };
+    }
+    /** Footer payload: Nolan's effective model + whether it's a pin. Merged into
+     *  /state, the SSE ready frame, and every ken_model_change broadcast. */
+    function nolanStatePayload() {
+        const st = session.getState();
+        return effectiveNolanModel(nolanModelOverride, { provider: st.provider, model: st.model });
+    }
     async function syncNolanModel(provider, model) {
         if (nolanRunning) {
             pendingNolanModel = { provider, model };
@@ -772,10 +913,10 @@ async function createSession(deps, opts) {
     async function ensureNolanSession() {
         if (nolanSession)
             return nolanSession;
-        const st = session.getState();
+        const target = nolanCurrentModel();
         const ken = new AgentSession({
-            provider: st.provider,
-            model: st.model,
+            provider: target.provider,
+            model: target.model,
             cwd,
             systemPrompt: buildNolanSystemPrompt(),
             allowedTools: NOLAN_ALLOWED_TOOLS,
@@ -803,12 +944,60 @@ async function createSession(deps, opts) {
         ken.eventBus.on("server_tool_call", (d) => broadcast("nolan_server_tool_call", d));
         ken.eventBus.on("turn_end", (d) => broadcast("nolan_turn_end", d));
         ken.eventBus.on("error", (d) => {
-            const message = d.error instanceof Error ? d.error.message : String(d.error);
-            log("ERROR", "app-sidecar", "ken error", { message });
-            broadcast("nolan_error", { message });
+            broadcastError("nolan_error", "ken error", d.error);
         });
         nolanSession = ken;
-        log("INFO", "app-sidecar", "ken session ready", { provider: st.provider, model: st.model });
+        log("INFO", "app-sidecar", "ken session ready", {
+            provider: target.provider,
+            model: target.model,
+        });
+        return ken;
+    }
+    // ── Autopilot Nolan (auto-reviewer) ──────────────────────────
+    // A THIRD read-only AgentSession, separate from chat Nolan. In autopilot mode
+    // Nolan silently reviews each finished EZ Coder turn and returns a verdict
+    // (PROMPT / ALL_CLEAR / HUMAN). Its bus is intentionally NOT bridged to the
+    // nolan_* chat bubbles — the review is silent; we read its final assistant text
+    // and parse it. Uses the lean autopilot system prompt + the same read-only
+    // tools. Created lazily on the first autopilot cycle.
+    let nolanAutoSession = null;
+    let nolanAutoAbort = new AbortController();
+    let pendingNolanAutoModel = null;
+    async function syncNolanAutoModel(provider, model) {
+        if (autopilotReviewing) {
+            pendingNolanAutoModel = { provider, model };
+            return;
+        }
+        if (!nolanAutoSession)
+            return;
+        const st = nolanAutoSession.getState();
+        if (st.provider === provider && st.model === model)
+            return;
+        await nolanAutoSession.switchModel(provider, model);
+        log("INFO", "app-sidecar", "ken autopilot session model synced", { provider, model });
+    }
+    async function ensureNolanAutoSession() {
+        if (nolanAutoSession)
+            return nolanAutoSession;
+        const target = nolanCurrentModel();
+        const ken = new AgentSession({
+            provider: target.provider,
+            model: target.model,
+            cwd,
+            systemPrompt: buildNolanAutopilotSystemPrompt(),
+            allowedTools: NOLAN_ALLOWED_TOOLS,
+            allowedMcpServers: NOLAN_ALLOWED_MCP_SERVERS,
+            transient: true,
+            signal: nolanAutoAbort.signal,
+        });
+        await ken.initialize();
+        // Deliberately no bus bridge: the review is silent. Errors surface via the
+        // runAutopilotReview try/catch as autopilot_error frames.
+        nolanAutoSession = ken;
+        log("INFO", "app-sidecar", "ken autopilot session ready", {
+            provider: target.provider,
+            model: target.model,
+        });
         return ken;
     }
     // Resumed session: if it already has a conversation, generate its title now so
@@ -836,9 +1025,7 @@ async function createSession(deps, opts) {
             await run();
         }
         catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            broadcast("error", { message });
-            log("ERROR", "app-sidecar", "run failed", { message });
+            broadcastError("error", "run failed", err);
         }
         finally {
             running = false;
@@ -847,6 +1034,14 @@ async function createSession(deps, opts) {
             gitBranch = await getGitBranch(cwd).catch(() => gitBranch);
             gitIsRepo = await isGitRepo(cwd).catch(() => gitIsRepo);
             broadcast("run_end", {});
+            // Autopilot's review loop is driven explicitly from POST /prompt (see
+            // runAutopilotCycle), NOT from this shared finally — that keeps the
+            // injected EZ Coder runs this cycle triggers from recursively re-entering
+            // the loop through the same bracket.
+            // The agent may have marked project tasks done during the run — prune the
+            // completed ones so they drop out of the Tasks modal automatically (users
+            // never have to delete finished tasks by hand).
+            broadcast("tasks_list", { tasks: pruneDoneTasksSync(cwd) });
             // Queue drains into the run as steering, so it's empty by run_end —
             // sync the webview indicator.
             broadcast("queued", { count: session.getQueuedCount() });
@@ -862,6 +1057,141 @@ async function createSession(deps, opts) {
             }
         }
     }
+    // ── Autopilot orchestration ─────────────────────────────────
+    // One review = prompt the nolanAuto session with the review digest, read its
+    // final assistant text, parse a verdict. Returns null on failure (surfaced as
+    // an autopilot_error frame) so the cycle stops rather than looping blind.
+    // `originalRequest` is the user prompt that started the turn under review —
+    // pinned in the digest so it can't scroll out during multi-round cycles.
+    async function runAutopilotReview(originalRequest) {
+        autopilotReviewing = true;
+        broadcast("autopilot_review_start", {});
+        try {
+            const ken = await ensureNolanAutoSession();
+            const projectContext = await collectProjectContext(cwd).catch(() => []);
+            const digest = buildNolanAutopilotContext({
+                projectContext,
+                cwd,
+                gitBranch,
+                messages: session.getMessages(),
+                originalRequest,
+                injectedPrompts: [...injectedAutopilotPrompts],
+                workflowCommands: await loadWorkflowCommandSpecs(),
+            });
+            await ken.prompt(digest);
+            return parseAutopilotVerdict(lastAssistantText(ken.getMessages()));
+        }
+        catch (err) {
+            broadcastError("autopilot_error", "autopilot review failed", err);
+            return null;
+        }
+        finally {
+            autopilotReviewing = false;
+            // Apply any model switch that landed mid-review.
+            const pending = pendingNolanAutoModel;
+            pendingNolanAutoModel = null;
+            if (pending)
+                await syncNolanAutoModel(pending.provider, pending.model);
+        }
+    }
+    // Drive the review→prompt→review loop for one finished user turn. Only ever
+    // called after shouldStartAutopilotCycle approves the turn (POST /prompt or
+    // the stranded-queue drain) — never from the task runner, resume, /ken, or
+    // error paths, so there's no recursion and no guard tangle. The loop's
+    // control flow lives in driveAutopilotCycle (core/autopilot-cycle.ts) so
+    // every exit path is unit-tested; this only wires the real dependencies.
+    async function runAutopilotCycle(originalRequest) {
+        if (!autopilot || autopilotCancelled)
+            return;
+        autopilotActive = true;
+        try {
+            await driveAutopilotCycle({
+                maxRounds: MAX_AUTOPILOT_ROUNDS,
+                isCancelled: () => autopilotCancelled,
+                // An injected run entering plan mode halts the cycle (autopilot_human
+                // with the plan-hold reason) — Nolan never prompts into a read-only
+                // plan-mode session or answers the plan modal for the user.
+                isPlanMode: () => session.getPlanMode(),
+                // Lean context per user turn: wipe prior review history so each new
+                // turn starts cheap, while within this cycle the few review messages
+                // persist so Nolan remembers what he already asked EZ Coder to fix.
+                resetReviewer: async () => {
+                    await nolanAutoSession?.newSession().catch(() => { });
+                },
+                review: () => runAutopilotReview(originalRequest),
+                // prompt → record the injected body (so later digests label it as
+                // Nolan's, not the user's), show a compact Nolan-tinted marker (not the
+                // prompt body), then feed EZ Coder bracketed by runAgent so the run
+                // streams normally; the shared finally never re-triggers autopilot,
+                // so this can't recurse.
+                onInjected: (body, round) => {
+                    injectedAutopilotPrompts.push(body);
+                    broadcast("autopilot_prompted", { round, body });
+                },
+                runPrompt: (body) => runAgent(body, () => session.prompt(body)),
+                emit: (event) => broadcast(event.type, event.data),
+            });
+        }
+        finally {
+            autopilotActive = false;
+        }
+    }
+    // ── Stranded-queue drain ───────────────────────────────
+    // A prompt POSTed while an autopilot cycle is between injected runs (build
+    // idle, Nolan reviewing) queues — but the queue only drains INTO a running
+    // turn as steering. If the cycle ends without another run (ALL_CLEAR /
+    // IGNORE / HUMAN / error), that message would sit stranded until the next
+    // unrelated prompt, then land mislabeled as "concurrent steering" of an
+    // unrelated run. Drain it here as a fresh turn of its own (with its own
+    // gated review). Also covers the non-autopilot tail window: a message queued
+    // after the run's last steering drain but before run_end.
+    let drainingStrandedQueue = false;
+    async function runStrandedQueue() {
+        if (drainingStrandedQueue)
+            return;
+        drainingStrandedQueue = true;
+        try {
+            for (;;) {
+                if (running || autopilotActive)
+                    return;
+                const next = session.takeNextQueuedMessage();
+                if (!next)
+                    return;
+                broadcast("queued", { count: session.getQueuedCount() });
+                if (!next.text.trim() && next.attachments.length === 0)
+                    continue;
+                const workflowCommand = next.attachments.length === 0 &&
+                    isWorkflowCommandText(next.text, await loadWorkflowCommandSpecs());
+                const assistantsBefore = countAssistantMessages(session.getMessages());
+                await runAgent(next.text, async () => {
+                    if (next.attachments.length > 0) {
+                        await session.promptWithAttachments(next.text, next.attachments);
+                    }
+                    else {
+                        await session.prompt(next.text);
+                    }
+                });
+                const decision = shouldStartAutopilotCycle({
+                    enabled: autopilot,
+                    cancelled: autopilotCancelled,
+                    planMode: session.getPlanMode(),
+                    workflowCommand,
+                    assistantMessagesAdded: countAssistantMessages(session.getMessages()) - assistantsBefore,
+                });
+                if (decision.start) {
+                    await runAutopilotCycle(next.text);
+                }
+                else if (autopilot) {
+                    log("INFO", "app-sidecar", "autopilot skipped (queued turn)", {
+                        reason: decision.reason,
+                    });
+                }
+            }
+        }
+        finally {
+            drainingStrandedQueue = false;
+        }
+    }
     // ── Task runner (project task list → sessions) ──────────────
     // Mirrors the CLI's task flow: each task runs in its OWN fresh session, with a
     // completion hint instructing the agent to mark the task done via the tasks
@@ -873,6 +1203,7 @@ async function createSession(deps, opts) {
             return false;
         // Fresh session per task so one task's context never bleeds into the next.
         await session.newSession();
+        injectedAutopilotPrompts = [];
         titleGenerated = false;
         broadcast("session_reset", {});
         markTaskInProgress(cwd, task.id);
@@ -883,8 +1214,8 @@ async function createSession(deps, opts) {
             `tasks({ action: "done", id: "${shortId}" })`;
         await runAgent(task.title, () => session.prompt(task.prompt + completionHint));
         // The agent typically marks the task done via the tasks tool during the run;
-        // push the refreshed list so the webview's task modal reflects it.
-        broadcast("tasks_list", { tasks: loadTasksSync(cwd) });
+        // prune completed tasks and push the refreshed list so the modal drops them.
+        broadcast("tasks_list", { tasks: pruneDoneTasksSync(cwd) });
         return true;
     }
     async function runTasks(startId, all) {
@@ -982,6 +1313,8 @@ async function createSession(deps, opts) {
                 thinkingLevel: session.getThinkingLevel() ?? null,
                 supportedThinkingLevels: getSupportedThinkingLevels(st.provider, st.model),
                 supportsVideo: getModel(st.model)?.supportsVideo ?? false,
+                autopilot,
+                ...nolanStatePayload(),
                 ...footerExtras(),
             });
             return;
@@ -1005,6 +1338,8 @@ async function createSession(deps, opts) {
                     thinkingLevel: session.getThinkingLevel() ?? null,
                     supportedThinkingLevels: getSupportedThinkingLevels(st.provider, st.model),
                     supportsVideo: getModel(st.model)?.supportsVideo ?? false,
+                    autopilot,
+                    ...nolanStatePayload(),
                     ...footerExtras(),
                 },
             })}\n\n`);
@@ -1328,10 +1663,13 @@ async function createSession(deps, opts) {
                     json(res, 400, { error: "empty prompt" });
                     return;
                 }
-                if (running) {
-                    // Queue prompts as mid-run steering (mirrors the CLI). Attachments are
-                    // persisted to .gg/uploads first so the queued media rides the same
-                    // native-block path as a non-queued attachment prompt when it drains.
+                if (running || autopilotActive) {
+                    // Queue prompts as mid-run steering (mirrors the CLI). Also queue while
+                    // an autopilot cycle is active but between injected runs (build idle,
+                    // Nolan reviewing) so the message never starts a run that collides with
+                    // an injected one on the same session. Attachments are persisted to
+                    // .gg/uploads first so the queued media rides the same native-block
+                    // path as a non-queued attachment prompt when it drains.
                     const prepared = attachments.length > 0 ? await prepareAttachments(cwd, attachments) : [];
                     const count = session.queueMessage(text, prepared);
                     broadcast("queued", { count });
@@ -1339,6 +1677,16 @@ async function createSession(deps, opts) {
                     return;
                 }
                 json(res, 202, { accepted: true });
+                // Fresh user turn: clear any cancel flag left from a prior cycle so this
+                // turn's autopilot review can run.
+                autopilotCancelled = false;
+                // Gate inputs captured around the run: whether this turn is a workflow
+                // slash command (attachment prompts skip slash expansion entirely), and
+                // how many assistant messages the run actually adds. Computed even when
+                // autopilot is currently off — the toggle can flip ON mid-run, and the
+                // gate reads the post-run value.
+                const workflowCommand = attachments.length === 0 && isWorkflowCommandText(text, await loadWorkflowCommandSpecs());
+                const assistantsBefore = countAssistantMessages(session.getMessages());
                 await runAgent(text, async () => {
                     if (attachments.length > 0) {
                         // Persist each attachment under .ezcoder/uploads so files are inspectable
@@ -1354,6 +1702,31 @@ async function createSession(deps, opts) {
                         await session.prompt(text);
                     }
                 });
+                // After the user's run settles, kick off Nolan's auto-review loop — but
+                // only when the turn is actually reviewable (shouldStartAutopilotCycle):
+                // workflow commands (/compare, /bullet-proof, …) end with reports or
+                // A/B/C choices reserved for the USER; registry commands (/help) and
+                // failed runs add no assistant work to judge; a turn that ended in plan
+                // mode has a pending Accept/Reject modal Nolan must not preempt. This is
+                // the ONLY entry point into the cycle besides the stranded-queue drain —
+                // it drives any follow-up EZ Coder runs itself, so the shared runAgent
+                // finally never recurses.
+                const decision = shouldStartAutopilotCycle({
+                    enabled: autopilot,
+                    cancelled: autopilotCancelled,
+                    planMode: session.getPlanMode(),
+                    workflowCommand,
+                    assistantMessagesAdded: countAssistantMessages(session.getMessages()) - assistantsBefore,
+                });
+                if (decision.start) {
+                    await runAutopilotCycle(text);
+                }
+                else if (autopilot) {
+                    log("INFO", "app-sidecar", "autopilot skipped", { reason: decision.reason });
+                }
+                // A prompt sent while Nolan was reviewing (build idle) queued but had no
+                // run to steer into — run it now as a fresh turn so it never strands.
+                await runStrandedQueue();
             });
             return;
         }
@@ -1384,7 +1757,7 @@ async function createSession(deps, opts) {
                 broadcast("nolan_run_start", { text });
                 try {
                     const ken = await ensureNolanSession();
-                    const digest = await buildNolanContext(session, cwd, gitBranch, text);
+                    const digest = await buildNolanContext(session, cwd, gitBranch, text, await loadWorkflowCommandSpecs(), injectedAutopilotPrompts);
                     await ken.prompt(digest);
                     // Record the turn against the BUILD session so it persists + survives
                     // resume (advisory custom entry, never an LLM message). Reply is Nolan's
@@ -1394,9 +1767,7 @@ async function createSession(deps, opts) {
                         await session.persistNolanTurn(text, reply);
                 }
                 catch (err) {
-                    const message = err instanceof Error ? err.message : String(err);
-                    log("ERROR", "app-sidecar", "ken run failed", { message });
-                    broadcast("nolan_error", { message });
+                    broadcastError("nolan_error", "ken run failed", err);
                 }
                 finally {
                     nolanRunning = false;
@@ -1418,6 +1789,24 @@ async function createSession(deps, opts) {
             json(res, 200, { cancelled: true });
             return;
         }
+        if (method === "POST" && url === "/autopilot") {
+            void readBody(req).then(async (raw) => {
+                let enabled;
+                try {
+                    enabled = Boolean(JSON.parse(raw).enabled);
+                }
+                catch {
+                    json(res, 400, { error: "invalid JSON body" });
+                    return;
+                }
+                autopilot = enabled;
+                await saveAutopilot(cwd, enabled);
+                log("INFO", "app-sidecar", "autopilot toggled", { enabled: String(enabled) });
+                broadcast("autopilot", { autopilot: enabled });
+                json(res, 200, { autopilot: enabled });
+            });
+            return;
+        }
         if (method === "POST" && url === "/enhance") {
             void readBody(req).then(async (raw) => {
                 let text;
@@ -1447,7 +1836,7 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "GET" && url === "/tasks") {
-            json(res, 200, { tasks: loadTasksSync(cwd) });
+            json(res, 200, { tasks: pruneDoneTasksSync(cwd) });
             return;
         }
         // ── Radio (app-wide) ──────────────────────────────────────
@@ -1651,7 +2040,12 @@ async function createSession(deps, opts) {
                 // new model's credentials, so switching to a just-added provider works.
                 await auth.reload();
                 await session.switchModel(target.provider, target.id);
-                await syncNolanModel(target.provider, target.id);
+                // Nolan follows EZ Coder's model only while un-pinned; a user-set Nolan
+                // override survives GG model switches untouched.
+                if (!nolanModelOverride) {
+                    await syncNolanModel(target.provider, target.id);
+                    await syncNolanAutoModel(target.provider, target.id);
+                }
                 // Clamp the reasoning level to what the new model supports (mirrors the
                 // CLI): keep thinking on at the first supported tier if it was on but
                 // the prior level is unsupported here; leave it off if it was off.
@@ -1678,6 +2072,12 @@ async function createSession(deps, opts) {
                 // model_change is emitted by switchModel; follow with thinking_change so
                 // the footer toggle reflects the new model's supported levels.
                 broadcast("thinking_change", payload);
+                // Un-pinned Nolan just followed the switch — update his footer chip too.
+                // When Nolan is pinned, his effective model did not change, so skip the
+                // no-op event (keeps footer/event tests from treating a GG switch as a
+                // Nolan switch).
+                if (!nolanModelOverride)
+                    broadcast("ken_model_change", nolanStatePayload());
                 // The new model usually has a different context window — push extras so
                 // the footer's context meter rescales immediately.
                 broadcast("extras", footerExtras());
@@ -1685,6 +2085,54 @@ async function createSession(deps, opts) {
             });
             return;
         }
+        // Set or clear Nolan's model pin. Body: { model: "<id>" } to pin, or
+        // { model: null } / "" to clear (Nolan resumes following EZ Coder). Applies
+        // to BOTH Nolan sessions (chat + autopilot reviewer); a switch landing while
+        // either is mid-run defers via the pending-model mechanics.
+        if (method === "POST" && url === "/ken/model") {
+            void readBody(req).then(async (raw) => {
+                let modelId;
+                try {
+                    const parsed = JSON.parse(raw).model;
+                    modelId = typeof parsed === "string" && parsed.trim() ? parsed.trim() : null;
+                }
+                catch {
+                    json(res, 400, { error: "invalid JSON body" });
+                    return;
+                }
+                if (modelId === null) {
+                    // Clear the pin → follow EZ Coder again, syncing both sessions back.
+                    nolanModelOverride = null;
+                    await saveNolanModelPref(cwd, null);
+                    const st = session.getState();
+                    await syncNolanModel(st.provider, st.model);
+                    await syncNolanAutoModel(st.provider, st.model);
+                    log("INFO", "app-sidecar", "ken model pin cleared — following GG", {
+                        provider: st.provider,
+                        model: st.model,
+                    });
+                }
+                else {
+                    const target = getModel(modelId);
+                    if (!target) {
+                        json(res, 404, { error: `unknown model: ${modelId}` });
+                        return;
+                    }
+                    nolanModelOverride = { provider: target.provider, model: target.id };
+                    await saveNolanModelPref(cwd, nolanModelOverride);
+                    await syncNolanModel(target.provider, target.id);
+                    await syncNolanAutoModel(target.provider, target.id);
+                    log("INFO", "app-sidecar", "ken model pinned", {
+                        provider: target.provider,
+                        model: target.id,
+                    });
+                }
+                const payload = nolanStatePayload();
+                broadcast("ken_model_change", payload);
+                json(res, 200, payload);
+            });
+            return;
+        }
         if (method === "POST" && url === "/kill") {
             void readBody(req).then(async (raw) => {
                 let id;
@@ -1733,6 +2181,13 @@ async function createSession(deps, opts) {
             running = false;
             // Stop a run-all sweep so the next pending task isn't auto-started.
             taskRunAll = false;
+            // Stop any in-flight autopilot cycle: flag it so the loop bails between
+            // steps, and abort a review that's mid-prompt on the nolanAuto session.
+            autopilotCancelled = true;
+            nolanAutoAbort.abort();
+            nolanAutoAbort = new AbortController();
+            nolanAutoSession?.setSignal(nolanAutoAbort.signal);
+            autopilotReviewing = false;
             // Drop any queued steering and return it so the webview can restore it to
             // the composer.
             const drained = session.drainQueue();
@@ -1749,6 +2204,7 @@ async function createSession(deps, opts) {
             void session
                 .newSession()
                 .then(() => {
+                injectedAutopilotPrompts = [];
                 broadcast("session_reset", {});
                 json(res, 200, { ok: true });
             })
@@ -1782,6 +2238,7 @@ async function createSession(deps, opts) {
                 }
                 try {
                     await session.newSession();
+                    injectedAutopilotPrompts = [];
                     titleGenerated = false;
                     await session.setApprovedPlan(planPath);
                     broadcast("session_reset", {});
@@ -1802,10 +2259,12 @@ async function createSession(deps, opts) {
             void readBody(req).then(async (raw) => {
                 let provider = "";
                 let key;
+                let variant;
                 try {
                     const body = JSON.parse(raw);
                     provider = body.provider ?? "";
                     key = (body.key ?? "").trim();
+                    variant = body.variant;
                 }
                 catch {
                     json(res, 400, { error: "invalid JSON body" });
@@ -1820,13 +2279,20 @@ async function createSession(deps, opts) {
                     json(res, 400, { error: "API key is required" });
                     return;
                 }
+                // Providers with multiple API-key variants (currently only Xiaomi: Token
+                // Plan vs. API Credits) store under the chosen variant's key/baseUrl,
+                // defaulting to the first variant. Single-variant providers fall back to
+                // the legacy provider-id storage key + flat apiKeyBaseUrl.
+                const chosenVariant = meta.apiKeyVariants?.find((v) => v.key === variant) ?? meta.apiKeyVariants?.[0];
+                const storageKey = chosenVariant?.key ?? provider;
+                const baseUrl = chosenVariant?.baseUrl ?? meta.apiKeyBaseUrl;
                 const creds = {
                     accessToken: key,
                     refreshToken: "",
                     expiresAt: Date.now() + 365 * 24 * 60 * 60 * 1000 * 100, // ~100y
-                    ...(meta.apiKeyBaseUrl ? { baseUrl: meta.apiKeyBaseUrl } : {}),
+                    ...(baseUrl ? { baseUrl } : {}),
                 };
-                await auth.setCredentials(provider, creds);
+                await auth.setCredentials(storageKey, creds);
                 broadcast("auth_done", { provider });
                 json(res, 200, { ok: true });
             });
@@ -1923,6 +2389,10 @@ async function createSession(deps, opts) {
                 // "disconnect" fully removes Kimi OAuth and the API key.
                 if (provider === "moonshot")
                     await auth.clearCredentials(MOONSHOT_OAUTH_KEY);
+                // Xiaomi's API Credits credential lives under a distinct key — clear it
+                // too so "disconnect" fully removes both the Token Plan and Credits keys.
+                if (provider === "xiaomi")
+                    await auth.clearCredentials(XIAOMI_CREDITS_KEY);
                 broadcast("auth_done", { provider });
                 json(res, 200, { ok: true });
             });
@@ -2206,7 +2676,9 @@ async function createSession(deps, opts) {
         for (const c of clients)
             c.res.end();
         nolanAbort.abort();
+        nolanAutoAbort.abort();
         await nolanSession?.dispose().catch(() => { });
+        await nolanAutoSession?.dispose().catch(() => { });
         await session.dispose().catch(() => { });
     }
     return {