@prestyj/cli 5.2.0 → 5.3.1

package/dist/app-sidecar.js

@@ -13,6 +13,7 @@
  */
 import http from "node:http";
 import fs from "node:fs/promises";
+import { watch as fsWatch } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { randomUUID } from "node:crypto";
@@ -21,9 +22,12 @@ import { formatError } from "@prestyj/ai";
 import { runJsonMode } from "./modes/json-mode.js";
 import { AgentSession } from "./core/agent-session.js";
 import { buildNolanSystemPrompt, buildNolanAutopilotSystemPrompt } from "./core/nolan-prompt.js";
-import { buildNolanDigest, buildNolanAutopilotContext } from "./core/nolan-context.js";
+import { buildNolanDigest, buildNolanAutopilotContext, buildNolanAutopilotPlanContext, } from "./core/nolan-context.js";
 import { parseAutopilotVerdict } from "./core/autopilot-verdict.js";
-import { collectProjectContext } from "./system-prompt.js";
+import { isWorkflowCommandText, countAssistantMessages, shouldStartAutopilotCycle, extractTurnToolCalls, isMechanicalOnlyTurn, } from "./core/autopilot-gate.js";
+import { driveAutopilotCycle, frameAutopilotInjection } from "./core/autopilot-cycle.js";
+import { validateNolanModelPref, effectiveNolanModel, } from "./core/nolan-model.js";
+import { normalizeAutopilotMarkersForHistory, normalizeAppMarkersForHistory, normalizeNolanTurnsForHistory, restoreUserRow, restoreAssistantTexts, autopilotMarkerCopySeed, } from "./core/session-history.js";
 import { AuthStorage } from "./core/auth-storage.js";
 import { MOONSHOT_OAUTH_KEY, XIAOMI_CREDITS_KEY } from "@prestyj/core";
 import { loginAnthropic } from "./core/oauth/anthropic.js";
@@ -48,6 +52,11 @@ import { downscaleForPreview, validateVisionImage } from "./utils/image.js";
 import { startServeMode } from "./modes/serve-mode.js";
 import { loadTelegramConfig, saveTelegramConfig, verifyBotToken } from "./core/telegram-config.js";
 import { loadServers, addServer, removeServer, getServer, parseMcpAddCommand, MCPClientManager, McpOAuthStore, } from "./core/mcp/index.js";
+import { buildSnapshot, levelForXp, rankForLevel } from "./core/progress/ranks.js";
+import { loadProgress, peekProgress, updateProgress } from "./core/progress/store.js";
+import { awardPrompt, awardCommits } from "./core/progress/engine.js";
+import { detectNewCommits, repoKey } from "./core/progress/git-xp.js";
+import { rebuildFromSessions } from "./core/progress/rebuild.js";
 const ALL_PROVIDERS = [
     "anthropic",
     "xiaomi",
@@ -82,6 +91,7 @@ async function loadAppSettings() {
             // model/thinking handlers below).
             projectModels: raw.projectModels && typeof raw.projectModels === "object" ? raw.projectModels : undefined,
             autopilot: raw.autopilot && typeof raw.autopilot === "object" ? raw.autopilot : undefined,
+            nolanModels: raw.nolanModels && typeof raw.nolanModels === "object" ? raw.nolanModels : undefined,
         };
     }
     catch {
@@ -105,6 +115,24 @@ async function saveProjectModelPrefs(cwd, prefs) {
     s.projectModels = { ...(s.projectModels ?? {}), [key]: prefs };
     await saveAppSettings(s);
 }
+/** Read this project's persisted Nolan model override, if any. */
+async function loadNolanModelPref(cwd) {
+    const s = await loadAppSettings();
+    return s.nolanModels?.[projectModelKey(cwd)];
+}
+/** Persist (or with null, clear) this project's Nolan model override via
+ *  read-modify-write so the rest of the settings file is preserved. */
+async function saveNolanModelPref(cwd, pref) {
+    const s = await loadAppSettings();
+    const key = projectModelKey(cwd);
+    const next = { ...(s.nolanModels ?? {}) };
+    if (pref)
+        next[key] = pref;
+    else
+        delete next[key];
+    s.nolanModels = next;
+    await saveAppSettings(s);
+}
 /** Read this project's persisted autopilot flag (default off). */
 async function loadAutopilot(cwd) {
     const s = await loadAppSettings();
@@ -378,12 +406,23 @@ async function runJsonModeIfRequested() {
             model: { type: "string" },
             "max-turns": { type: "string" },
             "system-prompt": { type: "string" },
+            tools: { type: "string" },
             "prompt-cache-key": { type: "string" },
         },
         allowPositionals: true,
         strict: true,
     });
     const maxTurnsRaw = values["max-turns"];
+    // Optional tool allow-list forwarded by the subagent spawner from an agent
+    // definition's `tools:` frontmatter. Mirrors the identical parsing in
+    // cli.ts's `values.json` branch — keep both in sync (see subagent.ts).
+    const parsedTools = values.tools
+        ? values.tools
+            .split(",")
+            .map((t) => t.trim())
+            .filter(Boolean)
+        : [];
+    const allowedTools = parsedTools.length > 0 ? parsedTools : undefined;
     await runJsonMode({
         message: positionals[0] ?? "",
         provider: (values.provider ?? "anthropic"),
@@ -391,6 +430,7 @@ async function runJsonModeIfRequested() {
         cwd: process.cwd(),
         systemPrompt: values["system-prompt"],
         maxTurns: maxTurnsRaw ? parseInt(maxTurnsRaw, 10) : undefined,
+        allowedTools,
         promptCacheKey: values["prompt-cache-key"],
     }).catch((err) => {
         process.stderr.write((err instanceof Error ? err.message : String(err)) + "\n");
@@ -462,6 +502,13 @@ async function main() {
     // request to its window's session via the `x-gg-session` header (and the
     // `?session=` query for the SSE /events stream).
     const sessions = new Map();
+    // XP/rank progress — loaded once per daemon; awards fan out to every window.
+    // Each frame is tagged `origin: true` only for the session that earned the
+    // XP, so that window alone plays sounds/chips while the rest just re-render.
+    const progress = await createProgressManager(paths.agentDir, (snapshot, originId) => {
+        for (const ctx of sessions.values())
+            ctx.broadcast("progress", { ...snapshot, origin: ctx.id === originId });
+    });
     /** Resolve the target session id: the `x-gg-session` header, else a
      *  `?session=` query param (used by the SSE /events connection). */
     function sessionIdFromReq(req, url) {
@@ -505,7 +552,7 @@ async function main() {
                 const sessionPath = typeof body.sessionPath === "string" && body.sessionPath ? body.sessionPath : undefined;
                 const id = randomUUID();
                 try {
-                    const ctx = await createSession({ auth, paths }, { id, cwd: sessionCwd, sessionPath });
+                    const ctx = await createSession({ auth, paths, progress }, { id, cwd: sessionCwd, sessionPath });
                     sessions.set(id, ctx);
                     log("INFO", "app-sidecar", "session created", { id, cwd: sessionCwd });
                     daemonJson(res, 200, { sessionId: id });
@@ -530,6 +577,12 @@ async function main() {
             daemonJson(res, 200, { ok: true });
             return;
         }
+        // Progress is daemon-level so the Home screen can paint before a project
+        // session exists; per-session callers still work through the same endpoint.
+        if (method === "GET" && url === "/progress") {
+            daemonJson(res, 200, progress.snapshot());
+            return;
+        }
         // ── Per-session delegation ───────────────────────────────────────────
         const id = sessionIdFromReq(req, url);
         const ctx = id ? sessions.get(id) : undefined;
@@ -589,20 +642,107 @@ function lastAssistantText(messages) {
     return "";
 }
 /**
- * Assemble Nolan's context digest for one `@Nolan` question: project docs (up the
- * tree) + git/env + the build session's compaction summary + recent activity.
- * Prepended to the user's question as Nolan's prompt body each turn.
+ * Assemble Nolan's context digest for one `@Nolan` question: git/env + the build
+ * session's compaction summary + recent activity. Prepended to the user's
+ * question as Nolan's prompt body each turn. Project docs (CLAUDE.md/AGENTS.md)
+ * are NOT here — they're folded into Nolan's cached system prompt once per
+ * session instead (see nolan-prompt.ts), so they hit the provider prompt cache
+ * instead of being re-sent uncached on every question. Workflow commands +
+ * autopilot-injected prompts are passed through so the digest labels them as
+ * what they are instead of user-authored asks.
  */
-async function buildNolanContext(buildSession, cwd, gitBranch, question) {
-    const projectContext = await collectProjectContext(cwd).catch(() => []);
+function buildNolanContext(buildSession, cwd, gitBranch, question, workflowCommands, injectedPrompts) {
     return buildNolanDigest({
         question,
-        projectContext,
         cwd,
         gitBranch,
         messages: buildSession.getMessages(),
+        workflowCommands,
+        injectedPrompts,
     });
 }
+async function createProgressManager(agentDir, broadcastAll) {
+    // Boot: recovery chain main → backup → one-time session-history rebuild → empty.
+    let file = await loadProgress({ rebuild: () => rebuildFromSessions() });
+    // Don't re-celebrate an old levelUp event on boot.
+    let lastSeenNonce = file.lastEvent?.nonce ?? null;
+    log("INFO", "app-sidecar", "progress loaded", {
+        xp: String(file.xp),
+        level: String(levelForXp(file.xp)),
+    });
+    function snapshot() {
+        return buildSnapshot(file);
+    }
+    async function awardRun(cwd, runStartedAt, originId) {
+        try {
+            const now = Date.now();
+            const updated = await updateProgress(async (f) => {
+                const levelBefore = levelForXp(f.xp);
+                awardPrompt(f, now, cwd);
+                // Commit XP: probe repo root + HEAD, then score lastHead..HEAD bounded
+                // by the run window. First sight of a repo records HEAD, scores nothing.
+                const probe = await detectNewCommits(cwd, undefined, runStartedAt);
+                if (probe) {
+                    const key = repoKey(probe.repoRoot);
+                    const lastHead = f.repos[key]?.lastHead;
+                    if (lastHead && lastHead !== probe.head) {
+                        const detected = await detectNewCommits(cwd, lastHead, runStartedAt);
+                        if (detected && detected.commits.length > 0) {
+                            awardCommits(f, detected.commits, now, cwd);
+                        }
+                    }
+                    f.repos[key] = { lastHead: probe.head };
+                }
+                // One combined lastEvent per run so other windows celebrate exactly once.
+                const levelAfter = levelForXp(f.xp);
+                const levelUp = levelAfter > levelBefore
+                    ? { from: levelBefore, to: levelAfter, rankName: rankForLevel(levelAfter).name }
+                    : null;
+                f.lastEvent = { nonce: randomUUID(), levelUp };
+                return { file: f, levelledUp: levelUp !== null };
+            });
+            file = updated;
+            lastSeenNonce = updated.lastEvent?.nonce ?? null;
+            broadcastAll(buildSnapshot(updated), originId);
+        }
+        catch (err) {
+            log("DEBUG", "app-sidecar", "progress award failed", {
+                message: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
+    // Watch ~/.gg (dir watch survives the atomic tmp+rename) for progress.json
+    // writes from other daemon processes; debounce, reload read-only, dedupe by nonce.
+    let watchDebounce = null;
+    try {
+        const watcher = fsWatch(agentDir, (_event, filename) => {
+            if (filename !== "progress.json")
+                return;
+            if (watchDebounce)
+                clearTimeout(watchDebounce);
+            watchDebounce = setTimeout(() => {
+                void (async () => {
+                    const reloaded = await peekProgress();
+                    if (!reloaded)
+                        return;
+                    const nonce = reloaded.lastEvent?.nonce ?? null;
+                    if (nonce === lastSeenNonce)
+                        return;
+                    file = reloaded;
+                    lastSeenNonce = nonce;
+                    broadcastAll(buildSnapshot(reloaded));
+                })();
+            }, 150);
+        });
+        watcher.unref();
+    }
+    catch (err) {
+        log("DEBUG", "app-sidecar", "progress watch unavailable", {
+            message: err instanceof Error ? err.message : String(err),
+        });
+    }
+    return { snapshot, awardRun };
+}
 /**
  * Build one in-process agent session: its AgentSession, SSE client set, event
  * bridge, task runner, auth/login bridge, and the full HTTP route table exposed
@@ -611,7 +751,7 @@ async function buildNolanContext(buildSession, cwd, gitBranch, question) {
  * logger, PATH, shared auth file, and radio live at the daemon level.
  */
 async function createSession(deps, opts) {
-    const { auth } = deps;
+    const { auth, progress } = deps;
     const paths = deps.paths;
     const cwd = opts.cwd;
     // Base host for parsing request-URL query params (value is irrelevant to
@@ -672,6 +812,16 @@ async function createSession(deps, opts) {
             ...(f.statusCode != null ? { statusCode: f.statusCode } : {}),
             ...(f.resetsAt != null ? { resetsAt: f.resetsAt } : {}),
         });
+        // Persist the error row (display-only marker) so a resumed session shows
+        // the same headline/message/guidance the live run did. Best-effort.
+        void session
+            .persistAppMarker("error", {
+            scope: type,
+            headline: f.headline,
+            ...(f.message ? { message: f.message } : {}),
+            guidance: f.guidance,
+        })
+            .catch(() => { });
     }
     // The session file path to resume (passed by the daemon's POST /session);
     // empty/unset starts a fresh session.
@@ -694,10 +844,27 @@ async function createSession(deps, opts) {
         // session plan state (rebuilds the system prompt + enforces read-only
         // tools) and surface the transition to the webview.
         onEnterPlan: async (reason) => {
+            // During a task run there is no human present to approve a plan, and a
+            // submitted plan would strand the task in-progress while the run-all loop
+            // advances to the next one. Decline plan mode so the agent implements the
+            // task directly — mirrors the TUI's isUnattendedRun guard (App.tsx). The
+            // enter_plan tool turns a false return into an "implement directly" hint.
+            if (taskRunActive)
+                return false;
             await session.setPlanMode(true);
             broadcast("plan_enter", { reason: reason ?? "" });
+            // Persist the plan-mode banner so a resumed session still shows it.
+            void session.persistAppMarker("plan", { reason: reason ?? "" }).catch(() => { });
         },
         onExitPlan: async (planPath) => {
+            // A model can call exit_plan even when enter_plan was declined. During a
+            // task run, never route the plan into review (no approver) — that would
+            // hang the task and stall run-all. Leave plan mode and tell it to build.
+            if (taskRunActive) {
+                await session.setPlanMode(false);
+                return ("Plan review is unavailable during a task run. Skip review and implement " +
+                    "the plan directly now: make the changes, verify them, then mark the task done.");
+            }
             await session.setPlanMode(false);
             // Surface the plan's path + markdown so the webview can show the review
             // modal (Accept / Feedback / Reject). Best-effort content read.
@@ -708,6 +875,12 @@ async function createSession(deps, opts) {
             catch {
                 content = "";
             }
+            // Record the submitted plan so the autopilot gate can route this turn
+            // into a PLAN review instead of a stale work review (plan mode is
+            // already false here, so the gate's planMode check alone never catches
+            // a submission). setPendingPlan bumps planGeneration, which invalidates
+            // any in-flight Nolan plan review racing a user action.
+            setPendingPlan(planPath, content);
             broadcast("plan_exit", { planPath, content });
             return "Plan submitted for user review. Wait for the user to approve, reject, or dismiss it before implementing.";
         },
@@ -780,6 +953,9 @@ async function createSession(deps, opts) {
     session.eventBus.on("compaction_end", (d) => broadcast("compaction_end", d));
     let running = false;
     let titleGenerated = false;
+    // Bumped by /cancel — a run whose cancel generation changed mid-flight was
+    // canceled and earns no XP.
+    let cancelGeneration = 0;
     // Autopilot (auto-review) toggle for THIS window's project. Loaded from
     // ezcoder-app.json on boot; flipped via POST /autopilot. When on, POST /prompt runs
     // runAutopilotCycle after the user's turn settles — Nolan auto-reviews the work
@@ -798,6 +974,45 @@ async function createSession(deps, opts) {
     let autopilotCancelled = false;
     // Hard cap on review→prompt→review rounds per user turn (loop safety).
     const MAX_AUTOPILOT_ROUNDS = 3;
+    // Prompt bodies Autopilot Nolan injected into the BUILD session this
+    // conversation. Passed into every Nolan digest so injected prompts render as
+    // "Nolan autopilot (injected)" instead of `**User:**` — otherwise multi-round
+    // cycles drift into Nolan reviewing against his own last prompt. Cleared
+    // whenever the conversation resets (new session / plan accept / task run).
+    let injectedAutopilotPrompts = [];
+    // The plan EZ Coder submitted via exit_plan that still awaits a decision
+    // (Nolan's auto-review in autopilot, or the user's modal). Path + the content
+    // read at submission time (fallback if the file becomes unreadable).
+    let pendingPlanPath = null;
+    let pendingPlanContent = "";
+    // Bumped on EVERY pending-plan set/clear. Nolan's plan review captures it
+    // before reviewing and re-checks it before acting on the verdict, so a user
+    // Accept/Reject racing an in-flight review always wins — the stale verdict
+    // is discarded silently.
+    let planGeneration = 0;
+    function setPendingPlan(planPath, content) {
+        pendingPlanPath = planPath;
+        pendingPlanContent = content;
+        planGeneration++;
+    }
+    function clearPendingPlan() {
+        if (pendingPlanPath === null)
+            return;
+        pendingPlanPath = null;
+        pendingPlanContent = "";
+        planGeneration++;
+    }
+    // Workflow (prompt-template) commands: built-in + the project's custom
+    // `.ezcoder/commands/*.md`. Used to gate autopilot off command turns and to label
+    // expanded templates in Nolan's digests. Loaded fresh so a newly added custom
+    // command is picked up without a restart (mirrors GET /commands).
+    async function loadWorkflowCommandSpecs() {
+        const custom = await loadCustomCommands(cwd).catch(() => []);
+        return [
+            ...PROMPT_COMMANDS.map((c) => ({ name: c.name, aliases: c.aliases, prompt: c.prompt })),
+            ...custom.map((c) => ({ name: c.name, aliases: [], prompt: c.prompt })),
+        ];
+    }
     // ── Telegram serve (remote control via Telegram) ───────────
     // A single embedded serve session lives in this sidecar process. Only the main
     // window's home screen exposes the controls, so there's one bot per app.
@@ -813,6 +1028,35 @@ async function createSession(deps, opts) {
     let nolanRunning = false;
     let pendingNolanModel = null;
     const nolanToolCallNames = new Map();
+    // Nolan's per-project model override. null → Nolan (chat + autopilot) follows GG
+    // Coder's model, including live switches (the historical behavior). Set → Nolan
+    // is pinned to his own model and EZ Coder switches no longer touch him. A
+    // stale persisted pin (model dropped from the registry / provider logged
+    // out) validates to null so Nolan degrades to following instead of erroring.
+    let nolanModelOverride = validateNolanModelPref(await loadNolanModelPref(cwd), {
+        modelExists: (id) => getModel(id) !== undefined,
+        providerConnected: () => true, // async auth checked below
+    });
+    if (nolanModelOverride && !(await auth.hasProviderAuth(nolanModelOverride.provider))) {
+        log("WARN", "app-sidecar", "ken model override provider not connected — following GG", {
+            provider: nolanModelOverride.provider,
+            model: nolanModelOverride.model,
+        });
+        nolanModelOverride = null;
+    }
+    /** The model Nolan uses next turn: the pin when set, else EZ Coder's. */
+    function nolanCurrentModel() {
+        if (nolanModelOverride)
+            return nolanModelOverride;
+        const st = session.getState();
+        return { provider: st.provider, model: st.model };
+    }
+    /** Footer payload: Nolan's effective model + whether it's a pin. Merged into
+     *  /state, the SSE ready frame, and every ken_model_change broadcast. */
+    function nolanStatePayload() {
+        const st = session.getState();
+        return effectiveNolanModel(nolanModelOverride, { provider: st.provider, model: st.model });
+    }
     async function syncNolanModel(provider, model) {
         if (nolanRunning) {
             pendingNolanModel = { provider, model };
@@ -829,16 +1073,19 @@ async function createSession(deps, opts) {
     async function ensureNolanSession() {
         if (nolanSession)
             return nolanSession;
-        const st = session.getState();
+        const target = nolanCurrentModel();
         const ken = new AgentSession({
-            provider: st.provider,
-            model: st.model,
+            provider: target.provider,
+            model: target.model,
             cwd,
-            systemPrompt: buildNolanSystemPrompt(),
+            systemPrompt: await buildNolanSystemPrompt(cwd),
             allowedTools: NOLAN_ALLOWED_TOOLS,
             allowedMcpServers: NOLAN_ALLOWED_MCP_SERVERS,
             transient: true,
             signal: nolanAbort.signal,
+            // Nolan's bursty, spread-out turns (chat) outlast the default 5-min cache
+            // TTL regardless of the user's global speedProfile pick.
+            forceLongCacheRetention: true,
         });
         await ken.initialize();
         // Bridge Nolan's bus to the shared SSE fan-out with ken_-prefixed types so the
@@ -863,7 +1110,10 @@ async function createSession(deps, opts) {
             broadcastError("nolan_error", "ken error", d.error);
         });
         nolanSession = ken;
-        log("INFO", "app-sidecar", "ken session ready", { provider: st.provider, model: st.model });
+        log("INFO", "app-sidecar", "ken session ready", {
+            provider: target.provider,
+            model: target.model,
+        });
         return ken;
     }
     // ── Autopilot Nolan (auto-reviewer) ──────────────────────────
@@ -892,24 +1142,27 @@ async function createSession(deps, opts) {
     async function ensureNolanAutoSession() {
         if (nolanAutoSession)
             return nolanAutoSession;
-        const st = session.getState();
+        const target = nolanCurrentModel();
         const ken = new AgentSession({
-            provider: st.provider,
-            model: st.model,
+            provider: target.provider,
+            model: target.model,
             cwd,
-            systemPrompt: buildNolanAutopilotSystemPrompt(),
+            systemPrompt: await buildNolanAutopilotSystemPrompt(cwd),
             allowedTools: NOLAN_ALLOWED_TOOLS,
             allowedMcpServers: NOLAN_ALLOWED_MCP_SERVERS,
             transient: true,
             signal: nolanAutoAbort.signal,
+            // Autopilot review rounds routinely span the injected EZ Coder run
+            // (often >5 min) regardless of the user's global speedProfile pick.
+            forceLongCacheRetention: true,
         });
         await ken.initialize();
         // Deliberately no bus bridge: the review is silent. Errors surface via the
         // runAutopilotReview try/catch as autopilot_error frames.
         nolanAutoSession = ken;
         log("INFO", "app-sidecar", "ken autopilot session ready", {
-            provider: st.provider,
-            model: st.model,
+            provider: target.provider,
+            model: target.model,
         });
         return ken;
     }
@@ -933,15 +1186,28 @@ async function createSession(deps, opts) {
     // run_start frame.
     async function runAgent(label, run) {
         running = true;
+        // Progress (Ranks): completed, non-canceled runs with ≥1 assistant turn earn
+        // XP — prompt + any commits authored during the run window.
+        const runStartedAt = Date.now();
+        const cancelGenAtStart = cancelGeneration;
+        const assistantsBeforeRun = countAssistantMessages(session.getMessages());
+        let runSucceeded = false;
         broadcast("run_start", { text: label });
         try {
             await run();
+            runSucceeded = true;
         }
         catch (err) {
             broadcastError("error", "run failed", err);
         }
         finally {
             running = false;
+            if (runSucceeded &&
+                cancelGeneration === cancelGenAtStart &&
+                countAssistantMessages(session.getMessages()) > assistantsBeforeRun) {
+                // Fire-and-forget — XP must never delay or break run teardown.
+                void progress.awardRun(cwd, runStartedAt, opts.id);
+            }
             // A run may have switched branches (git checkout) or spawned/finished
             // background tasks — refresh the footer extras once it settles.
             gitBranch = await getGitBranch(cwd).catch(() => gitBranch);
@@ -974,17 +1240,20 @@ async function createSession(deps, opts) {
     // One review = prompt the nolanAuto session with the review digest, read its
     // final assistant text, parse a verdict. Returns null on failure (surfaced as
     // an autopilot_error frame) so the cycle stops rather than looping blind.
-    async function runAutopilotReview() {
+    // `originalRequest` is the user prompt that started the turn under review —
+    // pinned in the digest so it can't scroll out during multi-round cycles.
+    async function runAutopilotReview(originalRequest) {
         autopilotReviewing = true;
         broadcast("autopilot_review_start", {});
         try {
             const ken = await ensureNolanAutoSession();
-            const projectContext = await collectProjectContext(cwd).catch(() => []);
             const digest = buildNolanAutopilotContext({
-                projectContext,
                 cwd,
                 gitBranch,
                 messages: session.getMessages(),
+                originalRequest,
+                injectedPrompts: [...injectedAutopilotPrompts],
+                workflowCommands: await loadWorkflowCommandSpecs(),
             });
             await ken.prompt(digest);
             return parseAutopilotVerdict(lastAssistantText(ken.getMessages()));
@@ -1002,45 +1271,254 @@ async function createSession(deps, opts) {
                 await syncNolanAutoModel(pending.provider, pending.model);
         }
     }
+    // One PLAN review: like runAutopilotReview but the digest carries the
+    // submitted plan's markdown (`## Plan under review`) and the plan-review
+    // instruction — Nolan judges the plan itself, not finished work. Returns null
+    // on failure; a failure caused by the user's own action racing the review
+    // (cancel or a manual Accept/Reject that bumped planGeneration) stays
+    // SILENT — no autopilot_error — because the user's decision already won.
+    async function runAutopilotPlanReview(originalRequest) {
+        const planPath = pendingPlanPath;
+        if (planPath === null)
+            return null;
+        const genAtStart = planGeneration;
+        autopilotReviewing = true;
+        broadcast("autopilot_review_start", {});
+        try {
+            const ken = await ensureNolanAutoSession();
+            // Re-read the plan file (the run may have revised it in place); fall
+            // back to the content captured at exit_plan time.
+            const planContent = await fs.readFile(planPath, "utf-8").catch(() => pendingPlanContent);
+            const digest = buildNolanAutopilotPlanContext({
+                cwd,
+                gitBranch,
+                messages: session.getMessages(),
+                originalRequest,
+                injectedPrompts: [...injectedAutopilotPrompts],
+                workflowCommands: await loadWorkflowCommandSpecs(),
+                planContent,
+            });
+            await ken.prompt(digest);
+            if (autopilotCancelled || planGeneration !== genAtStart)
+                return null;
+            return parseAutopilotVerdict(lastAssistantText(ken.getMessages()));
+        }
+        catch (err) {
+            // User action mid-review (manual Accept aborts the nolanAuto run): drop
+            // the review silently — the user's decision supersedes Nolan's.
+            if (autopilotCancelled || planGeneration !== genAtStart)
+                return null;
+            broadcastError("autopilot_error", "autopilot plan review failed", err);
+            return null;
+        }
+        finally {
+            autopilotReviewing = false;
+            // Apply any model switch that landed mid-review.
+            const pending = pendingNolanAutoModel;
+            pendingNolanAutoModel = null;
+            if (pending)
+                await syncNolanAutoModel(pending.provider, pending.model);
+        }
+    }
+    // The prompt fed to the fresh session after a plan is accepted — the SAME
+    // string the webview sends on a manual Accept (see PlanReviewModal's accept
+    // handler in ezcoder-app/src/App.tsx). Keep the two in lockstep so auto- and
+    // manual approval produce identical implementation turns.
+    const IMPLEMENT_PLAN_PROMPT = "The plan has been approved. Implement it now, following each step in order.";
     // Drive the review→prompt→review loop for one finished user turn. Only ever
-    // called from POST /prompt after the user's own run resolves — never from the
-    // task runner, resume, /ken, or error paths, so there's no recursion and no
-    // guard tangle. Bounded by MAX_AUTOPILOT_ROUNDS and cancellable between steps.
-    async function runAutopilotCycle() {
+    // called after shouldStartAutopilotCycle approves the turn (POST /prompt or
+    // the stranded-queue drain) — never from the task runner, resume, /ken, or
+    // error paths, so there's no recursion and no guard tangle. The loop's
+    // control flow lives in driveAutopilotCycle (core/autopilot-cycle.ts) so
+    // every exit path is unit-tested; this only wires the real dependencies.
+    async function runAutopilotCycle(originalRequest) {
         if (!autopilot || autopilotCancelled)
             return;
         autopilotActive = true;
+        // Generation captured by the last plan review; acceptPlan re-checks it so
+        // a user Accept/Reject landing mid-review always wins.
+        let planGenAtReview = -1;
         try {
-            // Lean context per user turn: wipe prior review history so each new turn
-            // starts cheap, while within this cycle the few review messages persist so
-            // Nolan remembers what he already asked EZ Coder to fix.
-            await nolanAutoSession?.newSession().catch(() => { });
-            for (let round = 1; round <= MAX_AUTOPILOT_ROUNDS; round++) {
-                if (autopilotCancelled)
-                    return;
-                const verdict = await runAutopilotReview();
-                if (!verdict || autopilotCancelled)
-                    return;
-                if (verdict.kind === "all_clear") {
-                    broadcast("autopilot_done", {});
-                    return;
+            await driveAutopilotCycle({
+                // A plan-pending cycle needs extra rounds: approve+implement and the
+                // post-implement work review each consume one, so +2 keeps a real fix
+                // round available.
+                maxRounds: pendingPlanPath !== null ? MAX_AUTOPILOT_ROUNDS + 2 : MAX_AUTOPILOT_ROUNDS,
+                isCancelled: () => autopilotCancelled,
+                // An injected run entering plan mode WITHOUT submitting (enter_plan,
+                // no exit_plan) halts the cycle — Nolan never prompts into a read-only
+                // plan-mode session. A submitted plan takes the planPending branch.
+                isPlanMode: () => session.getPlanMode(),
+                planPending: () => pendingPlanPath !== null,
+                reviewPlan: async () => {
+                    planGenAtReview = planGeneration;
+                    return runAutopilotPlanReview(originalRequest);
+                },
+                // Auto-accept: the inlined POST /plan/accept body. Returns false when
+                // the plan generation moved since the review (user acted) — the cycle
+                // exits silently and the user's action stands.
+                acceptPlan: async () => {
+                    if (pendingPlanPath === null || planGeneration !== planGenAtReview)
+                        return false;
+                    const planPath = pendingPlanPath;
+                    try {
+                        await session.newSession();
+                        injectedAutopilotPrompts = [];
+                        titleGenerated = false;
+                        await session.setApprovedPlan(planPath);
+                    }
+                    catch (err) {
+                        broadcastError("autopilot_error", "autopilot plan accept failed", err);
+                        return false;
+                    }
+                    clearPendingPlan();
+                    // Ordering is load-bearing: the webview reads its still-open plan
+                    // modal state (step count) on autopilot_plan_accepted, and
+                    // session_reset clears it — accepted must land first.
+                    broadcast("autopilot_plan_accepted", {});
+                    broadcast("session_reset", {});
+                    // Persisted into the NEW session so a resume shows the marker.
+                    void session.persistAutopilotMarker("plan_approved");
+                    return true;
+                },
+                runImplement: () => {
+                    // Autopilot-injected run: frame it so EZ Coder knows no human is
+                    // watching the implementation. Record the framed string so Nolan's
+                    // digest labels it as injected, not as the user's ask. The run_start
+                    // label stays the clean prompt.
+                    const framed = frameAutopilotInjection(IMPLEMENT_PLAN_PROMPT);
+                    injectedAutopilotPrompts.push(framed);
+                    return runAgent(IMPLEMENT_PLAN_PROMPT, () => session.prompt(framed));
+                },
+                // Lean context per user turn: wipe prior review history so each new
+                // turn starts cheap, while within this cycle the few review messages
+                // persist so Nolan remembers what he already asked EZ Coder to fix.
+                resetReviewer: async () => {
+                    await nolanAutoSession?.newSession().catch(() => { });
+                },
+                review: () => runAutopilotReview(originalRequest),
+                // prompt → record the injected body (so later digests label it as
+                // Nolan's, not the user's), show a compact Nolan-tinted marker (not the
+                // prompt body), then feed EZ Coder bracketed by runAgent so the run
+                // streams normally; the shared finally never re-triggers autopilot,
+                // so this can't recurse.
+                onInjected: (body, round) => {
+                    // A revision injection supersedes the pending plan — if the run
+                    // resubmits via exit_plan, onExitPlan re-sets it (no-op for work-
+                    // branch injections, where nothing is pending).
+                    clearPendingPlan();
+                    // Record the FRAMED string (what actually lands in the build session,
+                    // see runPrompt) so Nolan's digest matches and labels it as injected.
+                    // The webview marker + persisted body stay the CLEAN prompt so the UI
+                    // shows Nolan's actual instruction, not the autopilot preamble.
+                    injectedAutopilotPrompts.push(frameAutopilotInjection(body));
+                    broadcast("autopilot_prompted", { round, body });
+                    void session.persistAutopilotMarker("prompted", { body });
+                },
+                // Autopilot-injected run: EZ Coder receives the framed prompt (no human
+                // is watching this turn) while run_start keeps the clean label.
+                runPrompt: (body) => runAgent(body, () => session.prompt(frameAutopilotInjection(body))),
+                emit: (event) => {
+                    // Persist the terminal verdict marker so a resumed session renders the
+                    // same Nolan bubble the live run showed instead of dropping it or
+                    // falling back to the raw verdict text (e.g. ALL_CLEAR).
+                    if (event.type === "autopilot_done") {
+                        // Broadcast the SAME copySeed the persisted marker will produce on
+                        // resume, so the live all-clear wording matches the resumed one
+                        // (computed before persist — same synchronous message count).
+                        const seed = autopilotMarkerCopySeed({
+                            version: 1,
+                            phase: "done",
+                            afterMessageCount: session.getMessages().filter((m) => m.role !== "system").length,
+                        });
+                        broadcast(event.type, { ...event.data, copySeed: seed });
+                        void session.persistAutopilotMarker("done");
+                        return;
+                    }
+                    broadcast(event.type, event.data);
+                    if (event.type === "autopilot_human") {
+                        void session.persistAutopilotMarker("human", { reason: event.data.reason });
+                    }
+                    else if (event.type === "autopilot_capped") {
+                        void session.persistAutopilotMarker("capped");
+                    }
+                    // autopilot_ignored renders nothing live, so nothing is persisted either.
+                },
+            });
+        }
+        finally {
+            autopilotActive = false;
+        }
+    }
+    // ── Stranded-queue drain ───────────────────────────────
+    // A prompt POSTed while an autopilot cycle is between injected runs (build
+    // idle, Nolan reviewing) queues — but the queue only drains INTO a running
+    // turn as steering. If the cycle ends without another run (ALL_CLEAR /
+    // IGNORE / HUMAN / error), that message would sit stranded until the next
+    // unrelated prompt, then land mislabeled as "concurrent steering" of an
+    // unrelated run. Drain it here as a fresh turn of its own (with its own
+    // gated review). Also covers the non-autopilot tail window: a message queued
+    // after the run's last steering drain but before run_end.
+    let drainingStrandedQueue = false;
+    async function runStrandedQueue() {
+        if (drainingStrandedQueue)
+            return;
+        drainingStrandedQueue = true;
+        try {
+            for (;;) {
+                if (running || autopilotActive)
+                    return;
+                const next = session.takeNextQueuedMessage();
+                if (!next)
+                    return;
+                broadcast("queued", { count: session.getQueuedCount() });
+                if (!next.text.trim() && next.attachments.length === 0)
+                    continue;
+                // A queued message draining as a fresh turn supersedes any pending
+                // plan, exactly like a direct POST /prompt turn.
+                clearPendingPlan();
+                const workflowCommand = next.attachments.length === 0 &&
+                    isWorkflowCommandText(next.text, await loadWorkflowCommandSpecs());
+                const assistantsBefore = countAssistantMessages(session.getMessages());
+                const messagesBefore = session.getMessages().length;
+                await runAgent(next.text, async () => {
+                    if (next.attachments.length > 0) {
+                        await session.promptWithAttachments(next.text, next.attachments);
+                    }
+                    else {
+                        await session.prompt(next.text);
+                    }
+                });
+                const decision = shouldStartAutopilotCycle({
+                    enabled: autopilot,
+                    cancelled: autopilotCancelled,
+                    planMode: session.getPlanMode(),
+                    // A submitted plan (exit_plan fired) routes into the PLAN review
+                    // branch — the cycle reviews the plan itself instead of skipping.
+                    planPending: pendingPlanPath !== null,
+                    workflowCommand,
+                    assistantMessagesAdded: countAssistantMessages(session.getMessages()) - assistantsBefore,
+                    // Skip the review API call outright for turns that only started a
+                    // background process (dev server/watcher), ran a read-only lookup, or
+                    // committed/pushed — Nolan's autopilot contract already IGNOREs these,
+                    // so there's no reason to pay for that verdict.
+                    mechanicalOnly: isMechanicalOnlyTurn(extractTurnToolCalls(session.getMessages(), messagesBefore)),
+                });
+                if (decision.start) {
+                    log("INFO", "app-sidecar", "autopilot cycle starting (queued turn)", {
+                        kind: decision.kind,
+                    });
+                    await runAutopilotCycle(next.text);
                 }
-                if (verdict.kind === "human") {
-                    broadcast("autopilot_human", { reason: verdict.reason });
-                    return;
+                else if (autopilot) {
+                    log("INFO", "app-sidecar", "autopilot skipped (queued turn)", {
+                        reason: decision.reason,
+                    });
                 }
-                // prompt → show a compact Nolan-tinted marker (not the prompt body), then
-                // feed EZ Coder. Bracketed by runAgent so the run streams normally; the
-                // shared finally no longer re-triggers autopilot, so this can't recurse.
-                broadcast("autopilot_prompted", { round, body: verdict.body });
-                await runAgent(verdict.body, () => session.prompt(verdict.body));
-                if (autopilotCancelled)
-                    return;
             }
-            broadcast("autopilot_capped", { rounds: MAX_AUTOPILOT_ROUNDS });
         }
         finally {
-            autopilotActive = false;
+            drainingStrandedQueue = false;
         }
     }
     // ── Task runner (project task list → sessions) ──────────────
@@ -1048,17 +1526,34 @@ async function createSession(deps, opts) {
     // completion hint instructing the agent to mark the task done via the tasks
     // tool. Run-all advances to the next pending task after each run finishes.
     let taskRunAll = false;
+    // True for the duration of any task run (single or run-all). The plan-mode
+    // callbacks read this to decline plan mode when no human is present to
+    // approve a plan, so tasks implement directly instead of hanging on review.
+    let taskRunActive = false;
     async function runTaskById(taskId) {
         const task = loadTasksSync(cwd).find((t) => t.id === taskId || t.id.startsWith(taskId));
         if (!task)
             return false;
+        taskRunActive = true;
+        try {
+            return await runTaskByIdInner(task);
+        }
+        finally {
+            taskRunActive = false;
+        }
+    }
+    async function runTaskByIdInner(task) {
         // Fresh session per task so one task's context never bleeds into the next.
         await session.newSession();
+        injectedAutopilotPrompts = [];
+        clearPendingPlan();
         titleGenerated = false;
         broadcast("session_reset", {});
         markTaskInProgress(cwd, task.id);
         broadcast("tasks_list", { tasks: loadTasksSync(cwd) });
         broadcast("task_start", { id: task.id, title: task.title });
+        // Persist the task header so a resumed task session shows what ran.
+        void session.persistAppMarker("task", { title: task.title }).catch(() => { });
         const shortId = task.id.slice(0, 8);
         const completionHint = `\n\n---\nWhen you have fully completed this task, call the tasks tool to mark it done:\n` +
             `tasks({ action: "done", id: "${shortId}" })`;
@@ -1164,10 +1659,15 @@ async function createSession(deps, opts) {
                 supportedThinkingLevels: getSupportedThinkingLevels(st.provider, st.model),
                 supportsVideo: getModel(st.model)?.supportsVideo ?? false,
                 autopilot,
+                ...nolanStatePayload(),
                 ...footerExtras(),
             });
             return;
         }
+        if (method === "GET" && url === "/progress") {
+            json(res, 200, progress.snapshot());
+            return;
+        }
         if (method === "GET" && (url === "/events" || url.startsWith("/events?"))) {
             res.writeHead(200, {
                 "content-type": "text/event-stream",
@@ -1188,6 +1688,7 @@ async function createSession(deps, opts) {
                     supportedThinkingLevels: getSupportedThinkingLevels(st.provider, st.model),
                     supportsVideo: getModel(st.model)?.supportsVideo ?? false,
                     autopilot,
+                    ...nolanStatePayload(),
                     ...footerExtras(),
                 },
             })}\n\n`);
@@ -1346,8 +1847,11 @@ async function createSession(deps, opts) {
                 // they were recorded after, so each lands right after that message. A
                 // turn becomes two wire rows: the `@Nolan` question (user) + Nolan's reply
                 // (assistant), both flagged `ken` so the webview tints them.
+                // Deduped; stale anchors are clamped to the last message (Nolan turns
+                // carry real conversation, so they render at the end instead of
+                // vanishing).
                 const nolanByCount = new Map();
-                for (const turn of session.getNolanTurns()) {
+                for (const turn of normalizeNolanTurnsForHistory(session.getNolanTurns(), messages.filter((m) => m.role !== "system").length)) {
                     const list = nolanByCount.get(turn.afterMessageCount) ?? [];
                     list.push(turn);
                     nolanByCount.set(turn.afterMessageCount, list);
@@ -1362,9 +1866,103 @@ async function createSession(deps, opts) {
                         history.push({ role: "assistant", text: turn.reply, ken: true });
                     }
                 };
+                // Autopilot verdict markers to interleave, same anchor scheme as Nolan
+                // turns — each becomes a single assistant row the webview renders
+                // exactly like the live `autopilot` item (never a raw verdict string).
+                // Compact/continuation rewrites can carry old markers whose original
+                // afterMessageCount is beyond the restored message list; dropping those
+                // prevents stale all-clear bubbles from bunching at the bottom on resume.
+                const restoredMessageCount = messages.filter((m) => m.role !== "system").length;
+                const autopilotByCount = new Map();
+                for (const marker of normalizeAutopilotMarkersForHistory(session.getAutopilotMarkers(), restoredMessageCount)) {
+                    const list = autopilotByCount.get(marker.afterMessageCount) ?? [];
+                    list.push(marker);
+                    autopilotByCount.set(marker.afterMessageCount, list);
+                }
+                const flushAutopilot = (count) => {
+                    const markers = autopilotByCount.get(count);
+                    if (!markers)
+                        return;
+                    autopilotByCount.delete(count);
+                    for (const marker of markers) {
+                        history.push({
+                            role: "assistant",
+                            text: "",
+                            autopilot: {
+                                phase: marker.phase,
+                                ...(marker.reason !== undefined ? { reason: marker.reason } : {}),
+                                ...(marker.body !== undefined ? { body: marker.body } : {}),
+                                copySeed: marker.copySeed,
+                            },
+                        });
+                    }
+                };
+                // App transcript markers (plan banner / task header / error rows /
+                // user-bubble hints), same anchor scheme. user_hint markers don't
+                // become rows — they decorate the user row at their anchor instead.
+                const appMarkersByCount = new Map();
+                const userHintByCount = new Map();
+                // Compaction-count markers pair with compacted summary rows in file
+                // order (FIFO), not by anchor — the summary user message is what
+                // positions the notice.
+                const compactionCounts = [];
+                for (const marker of normalizeAppMarkersForHistory(session.getAppMarkers(), restoredMessageCount)) {
+                    if (marker.kind === "user_hint") {
+                        userHintByCount.set(marker.afterMessageCount, marker.data);
+                        continue;
+                    }
+                    if (marker.kind === "compaction") {
+                        const d = marker.data;
+                        if (typeof d.originalCount === "number" && typeof d.newCount === "number") {
+                            compactionCounts.push({ originalCount: d.originalCount, newCount: d.newCount });
+                        }
+                        continue;
+                    }
+                    const list = appMarkersByCount.get(marker.afterMessageCount) ?? [];
+                    list.push(marker);
+                    appMarkersByCount.set(marker.afterMessageCount, list);
+                }
+                const flushAppMarkers = (count) => {
+                    const markers = appMarkersByCount.get(count);
+                    if (!markers)
+                        return;
+                    appMarkersByCount.delete(count);
+                    for (const marker of markers) {
+                        const d = marker.data;
+                        if (marker.kind === "plan") {
+                            history.push({
+                                role: "assistant",
+                                text: "",
+                                plan: { reason: typeof d.reason === "string" ? d.reason : "" },
+                            });
+                        }
+                        else if (marker.kind === "task") {
+                            history.push({
+                                role: "assistant",
+                                text: "",
+                                task: { title: typeof d.title === "string" ? d.title : "" },
+                            });
+                        }
+                        else if (marker.kind === "error" && typeof d.headline === "string") {
+                            history.push({
+                                role: "assistant",
+                                text: "",
+                                error: {
+                                    scope: typeof d.scope === "string" ? d.scope : "error",
+                                    headline: d.headline,
+                                    ...(typeof d.message === "string" ? { message: d.message } : {}),
+                                    ...(typeof d.guidance === "string" ? { guidance: d.guidance } : {}),
+                                },
+                            });
+                        }
+                    }
+                };
                 let nonSystemCount = 0;
-                // Turns recorded before any build message (anchor 0) render at the top.
+                // Turns/markers recorded before any build message (anchor 0) render at
+                // the top.
                 flushNolan(0);
+                flushAutopilot(0);
+                flushAppMarkers(0);
                 for (const msg of messages) {
                     if (msg.role === "system")
                         continue;
@@ -1414,30 +2012,54 @@ async function createSession(deps, opts) {
                         }
                         continue;
                     }
-                    // User or assistant message — existing text/hook/command/compacted
-                    // extraction, plus sub-agent group detection for assistant tool_calls.
-                    const text = typeof msg.content === "string"
-                        ? msg.content
-                        : msg.content
-                            .map((c) => c.type === "text" && "text" in c && typeof c.text === "string" ? c.text : "")
-                            .join("");
-                    const images = typeof msg.content === "string"
-                        ? []
-                        : msg.content.flatMap((c) => c.type === "image" ? [`data:${c.mediaType};base64,${c.data}`] : []);
-                    const hook = msg.role === "user" ? detectHookKind(text) : null;
-                    const compacted = msg.role === "user" && !hook && text.startsWith("[Previous conversation summary]");
-                    const command = msg.role === "user" && !hook && !compacted
-                        ? detectPromptCommand(text, commandCandidates)
-                        : null;
-                    if (text.trim() || images.length > 0) {
-                        history.push({
-                            role: msg.role,
-                            text: command ?? text,
-                            images,
-                            hook,
-                            command: command !== null,
-                            compacted,
-                        });
+                    // User or assistant message — text/hook/command/compacted extraction,
+                    // plus sub-agent group detection for assistant tool_calls.
+                    if (msg.role === "user") {
+                        // Rebuild the live bubble: strip the steering wrapper, drop
+                        // attachment/file notes the model saw but the bubble never showed.
+                        const restored = restoreUserRow(msg.content);
+                        const text = restored.text;
+                        const hook = detectHookKind(text);
+                        const compacted = !hook && text.startsWith("[Previous conversation summary]");
+                        const command = !hook && !compacted ? detectPromptCommand(text, commandCandidates) : null;
+                        if (text.trim() || restored.images.length > 0) {
+                            const hint = userHintByCount.get(nonSystemCount);
+                            history.push({
+                                role: "user",
+                                text: command ?? text,
+                                images: restored.images,
+                                hook,
+                                command: command !== null,
+                                compacted,
+                                // Markers accumulate across continuation files (each rewrite
+                                // re-persists prior ones) but only the LATEST summary row
+                                // survives compaction — so consume from the newest end.
+                                ...(compacted && compactionCounts.length > 0
+                                    ? { compactionCounts: compactionCounts.pop() }
+                                    : {}),
+                                ...(hint?.nolanSent === true ? { nolanSent: true } : {}),
+                                ...(Array.isArray(hint?.enhancements) ? { enhancements: hint.enhancements } : {}),
+                            });
+                            // Live showed the video-capability warning right after the bubble.
+                            if (restored.videoWarning) {
+                                history.push({ role: "assistant", text: "", infoKind: "video_warning" });
+                            }
+                        }
+                    }
+                    else {
+                        // Assistant: one wire row per persisted text block — live streaming
+                        // splits bubbles at server_tool_call boundaries, and the persisted
+                        // content keeps those blocks separate.
+                        for (const blockText of restoreAssistantTexts(msg.content)) {
+                            history.push({
+                                role: "assistant",
+                                text: blockText,
+                                images: [],
+                                hook: null,
+                                command: false,
+                                compacted: false,
+                            });
+                        }
                     }
                     // Assistant tool_call blocks: detect sub-agent delegations.
                     if (msg.role === "assistant" && typeof msg.content !== "string") {
@@ -1458,14 +2080,21 @@ async function createSession(deps, opts) {
                             });
                         }
                     }
-                    // Interleave any Nolan turns recorded right after this message.
+                    // Interleave any Nolan turns / autopilot / app markers recorded right
+                    // after this message.
                     flushNolan(nonSystemCount);
+                    flushAutopilot(nonSystemCount);
+                    flushAppMarkers(nonSystemCount);
                 }
-                // Flush remaining Nolan turns whose anchor is at/after the message count
-                // (e.g. asked before any build message, or anchors beyond the current
-                // count after compaction shrank the history) so none are dropped.
+                // Flush remaining Nolan turns whose anchor is at/after the message count so
+                // none are dropped. Autopilot/app markers beyond the restored message
+                // count were already filtered above; any remaining marker here is valid.
                 for (const count of [...nolanByCount.keys()].sort((a, b) => a - b))
                     flushNolan(count);
+                for (const count of [...autopilotByCount.keys()].sort((a, b) => a - b))
+                    flushAutopilot(count);
+                for (const count of [...appMarkersByCount.keys()].sort((a, b) => a - b))
+                    flushAppMarkers(count);
                 json(res, 200, { history });
             })();
             return;
@@ -1498,10 +2127,12 @@ async function createSession(deps, opts) {
             void readBody(req).then(async (raw) => {
                 let text;
                 let attachments;
+                let meta;
                 try {
                     const body = JSON.parse(raw);
                     text = body.text ?? "";
                     attachments = Array.isArray(body.attachments) ? body.attachments : [];
+                    meta = typeof body.meta === "object" && body.meta !== null ? body.meta : undefined;
                 }
                 catch {
                     json(res, 400, { error: "invalid JSON body" });
@@ -1525,9 +2156,33 @@ async function createSession(deps, opts) {
                     return;
                 }
                 json(res, 202, { accepted: true });
+                // Webview display hint for this prompt's user bubble (nolanSent shimmer
+                // label / enhancer highlight segments). Anchored +1 so it attaches to
+                // the user message the prompt below is about to push. Queued prompts
+                // skip this (their position in the run is unpredictable).
+                if (meta && (meta.nolanSent === true || Array.isArray(meta.enhancements))) {
+                    void session
+                        .persistAppMarker("user_hint", {
+                        ...(meta.nolanSent === true ? { nolanSent: true } : {}),
+                        ...(Array.isArray(meta.enhancements) ? { enhancements: meta.enhancements } : {}),
+                    }, 1)
+                        .catch(() => { });
+                }
                 // Fresh user turn: clear any cancel flag left from a prior cycle so this
                 // turn's autopilot review can run.
                 autopilotCancelled = false;
+                // A typed message while a plan modal/review is pending (reject,
+                // feedback, anything) supersedes the pending plan — the bump also
+                // invalidates any in-flight Nolan plan review.
+                clearPendingPlan();
+                // Gate inputs captured around the run: whether this turn is a workflow
+                // slash command (attachment prompts skip slash expansion entirely), and
+                // how many assistant messages the run actually adds. Computed even when
+                // autopilot is currently off — the toggle can flip ON mid-run, and the
+                // gate reads the post-run value.
+                const workflowCommand = attachments.length === 0 && isWorkflowCommandText(text, await loadWorkflowCommandSpecs());
+                const assistantsBefore = countAssistantMessages(session.getMessages());
+                const messagesBefore = session.getMessages().length;
                 await runAgent(text, async () => {
                     if (attachments.length > 0) {
                         // Persist each attachment under .ezcoder/uploads so files are inspectable
@@ -1543,11 +2198,40 @@ async function createSession(deps, opts) {
                         await session.prompt(text);
                     }
                 });
-                // After the user's run settles, kick off Nolan's auto-review loop. This is
-                // the ONLY entry point into the cycle — it drives any follow-up EZ Coder
-                // runs itself, so the shared runAgent finally never recurses.
-                if (autopilot && !autopilotCancelled)
-                    await runAutopilotCycle();
+                // After the user's run settles, kick off Nolan's auto-review loop — but
+                // only when the turn is actually reviewable (shouldStartAutopilotCycle):
+                // workflow commands (/compare, /bullet-proof, …) end with reports or
+                // A/B/C choices reserved for the USER; registry commands (/help) and
+                // failed runs add no assistant work to judge; a turn that ended in plan
+                // mode has a pending Accept/Reject modal Nolan must not preempt. This is
+                // the ONLY entry point into the cycle besides the stranded-queue drain —
+                // it drives any follow-up EZ Coder runs itself, so the shared runAgent
+                // finally never recurses.
+                const decision = shouldStartAutopilotCycle({
+                    enabled: autopilot,
+                    cancelled: autopilotCancelled,
+                    planMode: session.getPlanMode(),
+                    // A submitted plan (exit_plan fired) routes into the PLAN review
+                    // branch — the cycle reviews the plan itself instead of skipping.
+                    planPending: pendingPlanPath !== null,
+                    workflowCommand,
+                    assistantMessagesAdded: countAssistantMessages(session.getMessages()) - assistantsBefore,
+                    // Skip the review API call outright for turns that only started a
+                    // background process (dev server/watcher), ran a read-only lookup, or
+                    // committed/pushed — Nolan's autopilot contract already IGNOREs these,
+                    // so there's no reason to pay for that verdict.
+                    mechanicalOnly: isMechanicalOnlyTurn(extractTurnToolCalls(session.getMessages(), messagesBefore)),
+                });
+                if (decision.start) {
+                    log("INFO", "app-sidecar", "autopilot cycle starting", { kind: decision.kind });
+                    await runAutopilotCycle(text);
+                }
+                else if (autopilot) {
+                    log("INFO", "app-sidecar", "autopilot skipped", { reason: decision.reason });
+                }
+                // A prompt sent while Nolan was reviewing (build idle) queued but had no
+                // run to steer into — run it now as a fresh turn so it never strands.
+                await runStrandedQueue();
             });
             return;
         }
@@ -1578,7 +2262,7 @@ async function createSession(deps, opts) {
                 broadcast("nolan_run_start", { text });
                 try {
                     const ken = await ensureNolanSession();
-                    const digest = await buildNolanContext(session, cwd, gitBranch, text);
+                    const digest = await buildNolanContext(session, cwd, gitBranch, text, await loadWorkflowCommandSpecs(), injectedAutopilotPrompts);
                     await ken.prompt(digest);
                     // Record the turn against the BUILD session so it persists + survives
                     // resume (advisory custom entry, never an LLM message). Reply is Nolan's
@@ -1861,8 +2545,12 @@ async function createSession(deps, opts) {
                 // new model's credentials, so switching to a just-added provider works.
                 await auth.reload();
                 await session.switchModel(target.provider, target.id);
-                await syncNolanModel(target.provider, target.id);
-                await syncNolanAutoModel(target.provider, target.id);
+                // Nolan follows EZ Coder's model only while un-pinned; a user-set Nolan
+                // override survives GG model switches untouched.
+                if (!nolanModelOverride) {
+                    await syncNolanModel(target.provider, target.id);
+                    await syncNolanAutoModel(target.provider, target.id);
+                }
                 // Clamp the reasoning level to what the new model supports (mirrors the
                 // CLI): keep thinking on at the first supported tier if it was on but
                 // the prior level is unsupported here; leave it off if it was off.
@@ -1889,6 +2577,12 @@ async function createSession(deps, opts) {
                 // model_change is emitted by switchModel; follow with thinking_change so
                 // the footer toggle reflects the new model's supported levels.
                 broadcast("thinking_change", payload);
+                // Un-pinned Nolan just followed the switch — update his footer chip too.
+                // When Nolan is pinned, his effective model did not change, so skip the
+                // no-op event (keeps footer/event tests from treating a GG switch as a
+                // Nolan switch).
+                if (!nolanModelOverride)
+                    broadcast("ken_model_change", nolanStatePayload());
                 // The new model usually has a different context window — push extras so
                 // the footer's context meter rescales immediately.
                 broadcast("extras", footerExtras());
@@ -1896,6 +2590,54 @@ async function createSession(deps, opts) {
             });
             return;
         }
+        // Set or clear Nolan's model pin. Body: { model: "<id>" } to pin, or
+        // { model: null } / "" to clear (Nolan resumes following EZ Coder). Applies
+        // to BOTH Nolan sessions (chat + autopilot reviewer); a switch landing while
+        // either is mid-run defers via the pending-model mechanics.
+        if (method === "POST" && url === "/ken/model") {
+            void readBody(req).then(async (raw) => {
+                let modelId;
+                try {
+                    const parsed = JSON.parse(raw).model;
+                    modelId = typeof parsed === "string" && parsed.trim() ? parsed.trim() : null;
+                }
+                catch {
+                    json(res, 400, { error: "invalid JSON body" });
+                    return;
+                }
+                if (modelId === null) {
+                    // Clear the pin → follow EZ Coder again, syncing both sessions back.
+                    nolanModelOverride = null;
+                    await saveNolanModelPref(cwd, null);
+                    const st = session.getState();
+                    await syncNolanModel(st.provider, st.model);
+                    await syncNolanAutoModel(st.provider, st.model);
+                    log("INFO", "app-sidecar", "ken model pin cleared — following GG", {
+                        provider: st.provider,
+                        model: st.model,
+                    });
+                }
+                else {
+                    const target = getModel(modelId);
+                    if (!target) {
+                        json(res, 404, { error: `unknown model: ${modelId}` });
+                        return;
+                    }
+                    nolanModelOverride = { provider: target.provider, model: target.id };
+                    await saveNolanModelPref(cwd, nolanModelOverride);
+                    await syncNolanModel(target.provider, target.id);
+                    await syncNolanAutoModel(target.provider, target.id);
+                    log("INFO", "app-sidecar", "ken model pinned", {
+                        provider: target.provider,
+                        model: target.id,
+                    });
+                }
+                const payload = nolanStatePayload();
+                broadcast("ken_model_change", payload);
+                json(res, 200, payload);
+            });
+            return;
+        }
         if (method === "POST" && url === "/kill") {
             void readBody(req).then(async (raw) => {
                 let id;
@@ -1938,12 +2680,14 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/cancel") {
+            cancelGeneration++;
             abort.abort();
             abort = new AbortController();
             session.setSignal(abort.signal);
             running = false;
             // Stop a run-all sweep so the next pending task isn't auto-started.
             taskRunAll = false;
+            taskRunActive = false;
             // Stop any in-flight autopilot cycle: flag it so the loop bails between
             // steps, and abort a review that's mid-prompt on the nolanAuto session.
             autopilotCancelled = true;
@@ -1967,6 +2711,8 @@ async function createSession(deps, opts) {
             void session
                 .newSession()
                 .then(() => {
+                injectedAutopilotPrompts = [];
+                clearPendingPlan();
                 broadcast("session_reset", {});
                 json(res, 200, { ok: true });
             })
@@ -1998,8 +2744,27 @@ async function createSession(deps, opts) {
                     json(res, 409, { error: "cannot accept a plan while the agent is running" });
                     return;
                 }
+                // Manual accept, possibly racing Nolan's autopilot plan review: the user
+                // always wins. Bump the plan generation (invalidates any in-flight
+                // review's verdict), stop the cycle, abort a mid-prompt review on the
+                // nolanAuto session, and clear the spinner — autopilot_ignored renders
+                // nothing, so no stale "approve or reject" bubble ever lands. The
+                // webview's follow-up "implement" /prompt arrives as a fresh turn
+                // (resetting autopilotCancelled), so the implementation still gets its
+                // normal post-run review; if it lands while the cycle is winding down
+                // it queues and runStrandedQueue drains it as a fresh turn.
+                clearPendingPlan();
+                autopilotCancelled = true;
+                nolanAutoAbort.abort();
+                nolanAutoAbort = new AbortController();
+                nolanAutoSession?.setSignal(nolanAutoAbort.signal);
+                if (autopilotReviewing) {
+                    autopilotReviewing = false;
+                    broadcast("autopilot_ignored", {});
+                }
                 try {
                     await session.newSession();
+                    injectedAutopilotPrompts = [];
                     titleGenerated = false;
                     await session.setApprovedPlan(planPath);
                     broadcast("session_reset", {});