@prestyj/cli 5.3.0 → 5.4.0

package/dist/app-sidecar.js

@@ -13,6 +13,7 @@
  */
 import http from "node:http";
 import fs from "node:fs/promises";
+import { watch as fsWatch } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { randomUUID } from "node:crypto";
@@ -21,14 +22,14 @@ import { formatError } from "@prestyj/ai";
 import { runJsonMode } from "./modes/json-mode.js";
 import { AgentSession } from "./core/agent-session.js";
 import { buildNolanSystemPrompt, buildNolanAutopilotSystemPrompt } from "./core/nolan-prompt.js";
-import { buildNolanDigest, buildNolanAutopilotContext } from "./core/nolan-context.js";
+import { buildNolanDigest, buildNolanAutopilotContext, buildNolanAutopilotPlanContext, } from "./core/nolan-context.js";
 import { parseAutopilotVerdict } from "./core/autopilot-verdict.js";
-import { isWorkflowCommandText, countAssistantMessages, shouldStartAutopilotCycle, } from "./core/autopilot-gate.js";
-import { driveAutopilotCycle } from "./core/autopilot-cycle.js";
+import { isWorkflowCommandText, countAssistantMessages, shouldStartAutopilotCycle, extractTurnToolCalls, isMechanicalOnlyTurn, } from "./core/autopilot-gate.js";
+import { driveAutopilotCycle, frameAutopilotInjection } from "./core/autopilot-cycle.js";
 import { validateNolanModelPref, effectiveNolanModel, } from "./core/nolan-model.js";
-import { collectProjectContext } from "./system-prompt.js";
+import { normalizeAutopilotMarkersForHistory, normalizeAppMarkersForHistory, normalizeNolanTurnsForHistory, restoreUserRow, restoreAssistantTexts, autopilotMarkerCopySeed, } from "./core/session-history.js";
 import { AuthStorage } from "./core/auth-storage.js";
-import { MOONSHOT_OAUTH_KEY, XIAOMI_CREDITS_KEY } from "@prestyj/core";
+import { fetchSubscriptionUsage, MOONSHOT_OAUTH_KEY, SubscriptionUsageError, XIAOMI_CREDITS_KEY, } from "@prestyj/core";
 import { loginAnthropic } from "./core/oauth/anthropic.js";
 import { loginOpenAI } from "./core/oauth/openai.js";
 import { loginGemini } from "./core/oauth/gemini.js";
@@ -51,6 +52,11 @@ import { downscaleForPreview, validateVisionImage } from "./utils/image.js";
 import { startServeMode } from "./modes/serve-mode.js";
 import { loadTelegramConfig, saveTelegramConfig, verifyBotToken } from "./core/telegram-config.js";
 import { loadServers, addServer, removeServer, getServer, parseMcpAddCommand, MCPClientManager, McpOAuthStore, } from "./core/mcp/index.js";
+import { buildSnapshot, levelForXp, rankForLevel } from "./core/progress/ranks.js";
+import { loadProgress, peekProgress, updateProgress } from "./core/progress/store.js";
+import { awardPrompt, awardCommits } from "./core/progress/engine.js";
+import { detectNewCommits, repoKey } from "./core/progress/git-xp.js";
+import { rebuildFromSessions } from "./core/progress/rebuild.js";
 const ALL_PROVIDERS = [
     "anthropic",
     "xiaomi",
@@ -496,6 +502,77 @@ async function main() {
     // request to its window's session via the `x-gg-session` header (and the
     // `?session=` query for the SSE /events stream).
     const sessions = new Map();
+    // XP/rank progress — loaded once per daemon; awards fan out to every window.
+    // Each frame is tagged `origin: true` only for the session that earned the
+    // XP, so that window alone plays sounds/chips while the rest just re-render.
+    const progress = await createProgressManager(paths.agentDir, (snapshot, originId) => {
+        for (const ctx of sessions.values())
+            ctx.broadcast("progress", { ...snapshot, origin: ctx.id === originId });
+    });
+    const usageCache = new Map();
+    const usageRequests = new Map();
+    async function fetchUsageProvider(provider) {
+        const displayName = provider === "anthropic" ? "Anthropic" : "Codex";
+        if (!(await auth.hasProviderAuth(provider))) {
+            return { provider, displayName, connected: false, windows: [], fetchedAt: Date.now() };
+        }
+        try {
+            let credentials = await auth.resolveCredentials(provider);
+            try {
+                return { ...(await fetchSubscriptionUsage(provider, credentials)), connected: true };
+            }
+            catch (error) {
+                // A provider can revoke an access token before its stored expiry. Refresh
+                // once on 401, matching inference auth recovery, then retry the usage call.
+                if (error instanceof SubscriptionUsageError && error.status === 401) {
+                    credentials = await auth.resolveCredentials(provider, { forceRefresh: true });
+                    return { ...(await fetchSubscriptionUsage(provider, credentials)), connected: true };
+                }
+                throw error;
+            }
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            log("WARN", "app-sidecar", "subscription usage fetch failed", { provider, message });
+            const connected = await auth.hasProviderAuth(provider);
+            return {
+                provider,
+                displayName,
+                connected,
+                windows: [],
+                fetchedAt: Date.now(),
+                error: connected ? "Usage is temporarily unavailable." : undefined,
+            };
+        }
+    }
+    async function subscriptionUsage(provider) {
+        const cached = usageCache.get(provider);
+        if (cached && cached.expiresAt > Date.now())
+            return cached.result;
+        const inFlight = usageRequests.get(provider);
+        if (inFlight)
+            return inFlight;
+        const request = fetchUsageProvider(provider);
+        usageRequests.set(provider, request);
+        try {
+            const result = await request;
+            // Anthropic can return utilization before it assigns reset timestamps
+            // (notably before the account's first active request). Retry that partial
+            // snapshot quickly; complete snapshots keep the normal one-minute cache.
+            const missingReset = result.connected &&
+                result.windows.length > 0 &&
+                result.windows.some((window) => window.resetsAt === undefined);
+            usageCache.set(provider, {
+                result,
+                expiresAt: Date.now() + (missingReset ? 10_000 : 60_000),
+            });
+            return result;
+        }
+        finally {
+            if (usageRequests.get(provider) === request)
+                usageRequests.delete(provider);
+        }
+    }
     /** Resolve the target session id: the `x-gg-session` header, else a
      *  `?session=` query param (used by the SSE /events connection). */
     function sessionIdFromReq(req, url) {
@@ -539,7 +616,7 @@ async function main() {
                 const sessionPath = typeof body.sessionPath === "string" && body.sessionPath ? body.sessionPath : undefined;
                 const id = randomUUID();
                 try {
-                    const ctx = await createSession({ auth, paths }, { id, cwd: sessionCwd, sessionPath });
+                    const ctx = await createSession({ auth, paths, progress }, { id, cwd: sessionCwd, sessionPath });
                     sessions.set(id, ctx);
                     log("INFO", "app-sidecar", "session created", { id, cwd: sessionCwd });
                     daemonJson(res, 200, { sessionId: id });
@@ -564,6 +641,31 @@ async function main() {
             daemonJson(res, 200, { ok: true });
             return;
         }
+        // Progress is daemon-level so the Home screen can paint before a project
+        // session exists; per-session callers still work through the same endpoint.
+        if (method === "GET" && url === "/progress") {
+            daemonJson(res, 200, progress.snapshot());
+            return;
+        }
+        // Subscription quota is account-wide, not project/session-specific. OAuth
+        // tokens stay in this daemon; only the active provider's normalized snapshot
+        // reaches the webview.
+        if (method === "GET" && (url === "/usage" || url.startsWith("/usage?"))) {
+            void (async () => {
+                const provider = new URL(url, `http://${host}`).searchParams.get("provider");
+                if (provider !== "anthropic" && provider !== "openai") {
+                    daemonJson(res, 400, { error: "unsupported usage provider" });
+                    return;
+                }
+                daemonJson(res, 200, await subscriptionUsage(provider));
+            })().catch((error) => {
+                log("ERROR", "app-sidecar", "subscription usage request failed", {
+                    message: error instanceof Error ? error.message : String(error),
+                });
+                daemonJson(res, 500, { error: "Usage is temporarily unavailable." });
+            });
+            return;
+        }
         // ── Per-session delegation ───────────────────────────────────────────
         const id = sessionIdFromReq(req, url);
         const ctx = id ? sessions.get(id) : undefined;
@@ -623,17 +725,18 @@ function lastAssistantText(messages) {
     return "";
 }
 /**
- * Assemble Nolan's context digest for one `@Nolan` question: project docs (up the
- * tree) + git/env + the build session's compaction summary + recent activity.
- * Prepended to the user's question as Nolan's prompt body each turn. Workflow
- * commands + autopilot-injected prompts are passed through so the digest
- * labels them as what they are instead of user-authored asks.
+ * Assemble Nolan's context digest for one `@Nolan` question: git/env + the build
+ * session's compaction summary + recent activity. Prepended to the user's
+ * question as Nolan's prompt body each turn. Project docs (CLAUDE.md/AGENTS.md)
+ * are NOT here — they're folded into Nolan's cached system prompt once per
+ * session instead (see nolan-prompt.ts), so they hit the provider prompt cache
+ * instead of being re-sent uncached on every question. Workflow commands +
+ * autopilot-injected prompts are passed through so the digest labels them as
+ * what they are instead of user-authored asks.
  */
-async function buildNolanContext(buildSession, cwd, gitBranch, question, workflowCommands, injectedPrompts) {
-    const projectContext = await collectProjectContext(cwd).catch(() => []);
+function buildNolanContext(buildSession, cwd, gitBranch, question, workflowCommands, injectedPrompts) {
     return buildNolanDigest({
         question,
-        projectContext,
         cwd,
         gitBranch,
         messages: buildSession.getMessages(),
@@ -641,6 +744,88 @@ async function buildNolanContext(buildSession, cwd, gitBranch, question, workflo
         injectedPrompts,
     });
 }
+async function createProgressManager(agentDir, broadcastAll) {
+    // Boot: recovery chain main → backup → one-time session-history rebuild → empty.
+    let file = await loadProgress({ rebuild: () => rebuildFromSessions() });
+    // Don't re-celebrate an old levelUp event on boot.
+    let lastSeenNonce = file.lastEvent?.nonce ?? null;
+    log("INFO", "app-sidecar", "progress loaded", {
+        xp: String(file.xp),
+        level: String(levelForXp(file.xp)),
+    });
+    function snapshot() {
+        return buildSnapshot(file);
+    }
+    async function awardRun(cwd, runStartedAt, originId) {
+        try {
+            const now = Date.now();
+            const updated = await updateProgress(async (f) => {
+                const levelBefore = levelForXp(f.xp);
+                awardPrompt(f, now, cwd);
+                // Commit XP: probe repo root + HEAD, then score lastHead..HEAD bounded
+                // by the run window. First sight of a repo records HEAD, scores nothing.
+                const probe = await detectNewCommits(cwd, undefined, runStartedAt);
+                if (probe) {
+                    const key = repoKey(probe.repoRoot);
+                    const lastHead = f.repos[key]?.lastHead;
+                    if (lastHead && lastHead !== probe.head) {
+                        const detected = await detectNewCommits(cwd, lastHead, runStartedAt);
+                        if (detected && detected.commits.length > 0) {
+                            awardCommits(f, detected.commits, now, cwd);
+                        }
+                    }
+                    f.repos[key] = { lastHead: probe.head };
+                }
+                // One combined lastEvent per run so other windows celebrate exactly once.
+                const levelAfter = levelForXp(f.xp);
+                const levelUp = levelAfter > levelBefore
+                    ? { from: levelBefore, to: levelAfter, rankName: rankForLevel(levelAfter).name }
+                    : null;
+                f.lastEvent = { nonce: randomUUID(), levelUp };
+                return { file: f, levelledUp: levelUp !== null };
+            });
+            file = updated;
+            lastSeenNonce = updated.lastEvent?.nonce ?? null;
+            broadcastAll(buildSnapshot(updated), originId);
+        }
+        catch (err) {
+            log("DEBUG", "app-sidecar", "progress award failed", {
+                message: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
+    // Watch ~/.gg (dir watch survives the atomic tmp+rename) for progress.json
+    // writes from other daemon processes; debounce, reload read-only, dedupe by nonce.
+    let watchDebounce = null;
+    try {
+        const watcher = fsWatch(agentDir, (_event, filename) => {
+            if (filename !== "progress.json")
+                return;
+            if (watchDebounce)
+                clearTimeout(watchDebounce);
+            watchDebounce = setTimeout(() => {
+                void (async () => {
+                    const reloaded = await peekProgress();
+                    if (!reloaded)
+                        return;
+                    const nonce = reloaded.lastEvent?.nonce ?? null;
+                    if (nonce === lastSeenNonce)
+                        return;
+                    file = reloaded;
+                    lastSeenNonce = nonce;
+                    broadcastAll(buildSnapshot(reloaded));
+                })();
+            }, 150);
+        });
+        watcher.unref();
+    }
+    catch (err) {
+        log("DEBUG", "app-sidecar", "progress watch unavailable", {
+            message: err instanceof Error ? err.message : String(err),
+        });
+    }
+    return { snapshot, awardRun };
+}
 /**
  * Build one in-process agent session: its AgentSession, SSE client set, event
  * bridge, task runner, auth/login bridge, and the full HTTP route table exposed
@@ -649,7 +834,7 @@ async function buildNolanContext(buildSession, cwd, gitBranch, question, workflo
  * logger, PATH, shared auth file, and radio live at the daemon level.
  */
 async function createSession(deps, opts) {
-    const { auth } = deps;
+    const { auth, progress } = deps;
     const paths = deps.paths;
     const cwd = opts.cwd;
     // Base host for parsing request-URL query params (value is irrelevant to
@@ -686,6 +871,32 @@ async function createSession(deps, opts) {
         for (const c of clients)
             c.res.write(frame);
     }
+    // Replace CLI-specific guidance (slash commands, CLI tool names) with
+    // desktop-app equivalents so the webview never shows "run ezcoder login".
+    // Applied to BOTH the message and guidance fields — the auth "Not logged in…
+    // Run "ezcoder login"" string lives in `message`, not `guidance`.
+    function desktopGuidance(guidance) {
+        return (guidance
+            // Auth: `Run "ezcoder login"` / `Run 'ezcoder login'` / `Run `ezcoder login``
+            // (any quote style, or none) → button. Do this first so the whole phrase
+            // is rewritten cleanly instead of leaving a dangling `Run "…"`.
+            .replaceAll(/Run ["'`]?ezcoder login["'`]?/gi, "Use the Login to AI Providers button")
+            // Any remaining bare mention.
+            .replaceAll(/ezcoder login/gi, "the Login to AI Providers button")
+            // /compact: the app has NO manual compact command or button — it only
+            // auto-compacts (and now auto-recovers on overflow). If this guidance is
+            // reached, auto-compaction already couldn't reduce enough, so the only
+            // real affordance is a fresh session. Don't tell the user to run a
+            // command that doesn't exist in the app.
+            .replaceAll(/Run \/compact to shrink history, or start a new session\./gi, "Start a new session to reset the context.")
+            // /model: handle each phrasing pattern
+            .replaceAll(/switch to claude-fable-5 with \/model/gi, "switch to claude-fable-5 using the model selector")
+            .replaceAll(/Switch with \/model\./gi, "Switch using the model selector.")
+            .replaceAll(/try a different model with \/model\./gi, "try a different model using the model selector.")
+            .replaceAll(/Use \/model to switch/gi, "Use the model selector to switch")
+            // /help
+            .replaceAll(/see \/help/gi, "check the help menu"));
+    }
     // Turn any thrown value into the same clear headline/message/guidance shape
     // the TUI shows (see gg-ai's formatError) instead of a bare `err.message`, log
     // the full detail, and broadcast it under `type` ("error" or "nolan_error").
@@ -694,22 +905,34 @@ async function createSession(deps, opts) {
     // context that the CLI has always given.
     function broadcastError(type, logLabel, err) {
         const f = formatError(err);
+        const message = f.message ? desktopGuidance(f.message) : undefined;
+        const guidance = desktopGuidance(f.guidance);
         log("ERROR", "app-sidecar", logLabel, {
             headline: f.headline,
             source: f.source,
-            ...(f.message ? { message: f.message } : {}),
+            ...(message ? { message } : {}),
             ...(f.provider ? { provider: f.provider } : {}),
             ...(f.statusCode != null ? { statusCode: String(f.statusCode) } : {}),
             ...(f.requestId ? { requestId: f.requestId } : {}),
         });
         broadcast(type, {
             headline: f.headline,
-            ...(f.message ? { message: f.message } : {}),
-            guidance: f.guidance,
+            ...(message ? { message } : {}),
+            guidance,
             ...(f.provider ? { provider: f.provider } : {}),
             ...(f.statusCode != null ? { statusCode: f.statusCode } : {}),
             ...(f.resetsAt != null ? { resetsAt: f.resetsAt } : {}),
         });
+        // Persist the error row (display-only marker) so a resumed session shows
+        // the same headline/message/guidance the live run did. Best-effort.
+        void session
+            .persistAppMarker("error", {
+            scope: type,
+            headline: f.headline,
+            ...(message ? { message } : {}),
+            guidance,
+        })
+            .catch(() => { });
     }
     // The session file path to resume (passed by the daemon's POST /session);
     // empty/unset starts a fresh session.
@@ -732,10 +955,27 @@ async function createSession(deps, opts) {
         // session plan state (rebuilds the system prompt + enforces read-only
         // tools) and surface the transition to the webview.
         onEnterPlan: async (reason) => {
+            // During a task run there is no human present to approve a plan, and a
+            // submitted plan would strand the task in-progress while the run-all loop
+            // advances to the next one. Decline plan mode so the agent implements the
+            // task directly — mirrors the TUI's isUnattendedRun guard (App.tsx). The
+            // enter_plan tool turns a false return into an "implement directly" hint.
+            if (taskRunActive)
+                return false;
             await session.setPlanMode(true);
             broadcast("plan_enter", { reason: reason ?? "" });
+            // Persist the plan-mode banner so a resumed session still shows it.
+            void session.persistAppMarker("plan", { reason: reason ?? "" }).catch(() => { });
         },
         onExitPlan: async (planPath) => {
+            // A model can call exit_plan even when enter_plan was declined. During a
+            // task run, never route the plan into review (no approver) — that would
+            // hang the task and stall run-all. Leave plan mode and tell it to build.
+            if (taskRunActive) {
+                await session.setPlanMode(false);
+                return ("Plan review is unavailable during a task run. Skip review and implement " +
+                    "the plan directly now: make the changes, verify them, then mark the task done.");
+            }
             await session.setPlanMode(false);
             // Surface the plan's path + markdown so the webview can show the review
             // modal (Accept / Feedback / Reject). Best-effort content read.
@@ -746,6 +986,12 @@ async function createSession(deps, opts) {
             catch {
                 content = "";
             }
+            // Record the submitted plan so the autopilot gate can route this turn
+            // into a PLAN review instead of a stale work review (plan mode is
+            // already false here, so the gate's planMode check alone never catches
+            // a submission). setPendingPlan bumps planGeneration, which invalidates
+            // any in-flight Nolan plan review racing a user action.
+            setPendingPlan(planPath, content);
             broadcast("plan_exit", { planPath, content });
             return "Plan submitted for user review. Wait for the user to approve, reject, or dismiss it before implementing.";
         },
@@ -818,6 +1064,9 @@ async function createSession(deps, opts) {
     session.eventBus.on("compaction_end", (d) => broadcast("compaction_end", d));
     let running = false;
     let titleGenerated = false;
+    // Bumped by /cancel — a run whose cancel generation changed mid-flight was
+    // canceled and earns no XP.
+    let cancelGeneration = 0;
     // Autopilot (auto-review) toggle for THIS window's project. Loaded from
     // ezcoder-app.json on boot; flipped via POST /autopilot. When on, POST /prompt runs
     // runAutopilotCycle after the user's turn settles — Nolan auto-reviews the work
@@ -842,6 +1091,28 @@ async function createSession(deps, opts) {
     // cycles drift into Nolan reviewing against his own last prompt. Cleared
     // whenever the conversation resets (new session / plan accept / task run).
     let injectedAutopilotPrompts = [];
+    // The plan EZ Coder submitted via exit_plan that still awaits a decision
+    // (Nolan's auto-review in autopilot, or the user's modal). Path + the content
+    // read at submission time (fallback if the file becomes unreadable).
+    let pendingPlanPath = null;
+    let pendingPlanContent = "";
+    // Bumped on EVERY pending-plan set/clear. Nolan's plan review captures it
+    // before reviewing and re-checks it before acting on the verdict, so a user
+    // Accept/Reject racing an in-flight review always wins — the stale verdict
+    // is discarded silently.
+    let planGeneration = 0;
+    function setPendingPlan(planPath, content) {
+        pendingPlanPath = planPath;
+        pendingPlanContent = content;
+        planGeneration++;
+    }
+    function clearPendingPlan() {
+        if (pendingPlanPath === null)
+            return;
+        pendingPlanPath = null;
+        pendingPlanContent = "";
+        planGeneration++;
+    }
     // Workflow (prompt-template) commands: built-in + the project's custom
     // `.ezcoder/commands/*.md`. Used to gate autopilot off command turns and to label
     // expanded templates in Nolan's digests. Loaded fresh so a newly added custom
@@ -918,11 +1189,14 @@ async function createSession(deps, opts) {
             provider: target.provider,
             model: target.model,
             cwd,
-            systemPrompt: buildNolanSystemPrompt(),
+            systemPrompt: await buildNolanSystemPrompt(cwd),
             allowedTools: NOLAN_ALLOWED_TOOLS,
             allowedMcpServers: NOLAN_ALLOWED_MCP_SERVERS,
             transient: true,
             signal: nolanAbort.signal,
+            // Nolan's bursty, spread-out turns (chat) outlast the default 5-min cache
+            // TTL regardless of the user's global speedProfile pick.
+            forceLongCacheRetention: true,
         });
         await ken.initialize();
         // Bridge Nolan's bus to the shared SSE fan-out with ken_-prefixed types so the
@@ -984,11 +1258,14 @@ async function createSession(deps, opts) {
             provider: target.provider,
             model: target.model,
             cwd,
-            systemPrompt: buildNolanAutopilotSystemPrompt(),
+            systemPrompt: await buildNolanAutopilotSystemPrompt(cwd),
             allowedTools: NOLAN_ALLOWED_TOOLS,
             allowedMcpServers: NOLAN_ALLOWED_MCP_SERVERS,
             transient: true,
             signal: nolanAutoAbort.signal,
+            // Autopilot review rounds routinely span the injected EZ Coder run
+            // (often >5 min) regardless of the user's global speedProfile pick.
+            forceLongCacheRetention: true,
         });
         await ken.initialize();
         // Deliberately no bus bridge: the review is silent. Errors surface via the
@@ -1020,15 +1297,28 @@ async function createSession(deps, opts) {
     // run_start frame.
     async function runAgent(label, run) {
         running = true;
+        // Progress (Ranks): completed, non-canceled runs with ≥1 assistant turn earn
+        // XP — prompt + any commits authored during the run window.
+        const runStartedAt = Date.now();
+        const cancelGenAtStart = cancelGeneration;
+        const assistantsBeforeRun = countAssistantMessages(session.getMessages());
+        let runSucceeded = false;
         broadcast("run_start", { text: label });
         try {
             await run();
+            runSucceeded = true;
         }
         catch (err) {
             broadcastError("error", "run failed", err);
         }
         finally {
             running = false;
+            if (runSucceeded &&
+                cancelGeneration === cancelGenAtStart &&
+                countAssistantMessages(session.getMessages()) > assistantsBeforeRun) {
+                // Fire-and-forget — XP must never delay or break run teardown.
+                void progress.awardRun(cwd, runStartedAt, opts.id);
+            }
             // A run may have switched branches (git checkout) or spawned/finished
             // background tasks — refresh the footer extras once it settles.
             gitBranch = await getGitBranch(cwd).catch(() => gitBranch);
@@ -1068,9 +1358,7 @@ async function createSession(deps, opts) {
         broadcast("autopilot_review_start", {});
         try {
             const ken = await ensureNolanAutoSession();
-            const projectContext = await collectProjectContext(cwd).catch(() => []);
             const digest = buildNolanAutopilotContext({
-                projectContext,
                 cwd,
                 gitBranch,
                 messages: session.getMessages(),
@@ -1094,6 +1382,60 @@ async function createSession(deps, opts) {
                 await syncNolanAutoModel(pending.provider, pending.model);
         }
     }
+    // One PLAN review: like runAutopilotReview but the digest carries the
+    // submitted plan's markdown (`## Plan under review`) and the plan-review
+    // instruction — Nolan judges the plan itself, not finished work. Returns null
+    // on failure; a failure caused by the user's own action racing the review
+    // (cancel or a manual Accept/Reject that bumped planGeneration) stays
+    // SILENT — no autopilot_error — because the user's decision already won.
+    async function runAutopilotPlanReview(originalRequest) {
+        const planPath = pendingPlanPath;
+        if (planPath === null)
+            return null;
+        const genAtStart = planGeneration;
+        autopilotReviewing = true;
+        broadcast("autopilot_review_start", {});
+        try {
+            const ken = await ensureNolanAutoSession();
+            // Re-read the plan file (the run may have revised it in place); fall
+            // back to the content captured at exit_plan time.
+            const planContent = await fs.readFile(planPath, "utf-8").catch(() => pendingPlanContent);
+            const digest = buildNolanAutopilotPlanContext({
+                cwd,
+                gitBranch,
+                messages: session.getMessages(),
+                originalRequest,
+                injectedPrompts: [...injectedAutopilotPrompts],
+                workflowCommands: await loadWorkflowCommandSpecs(),
+                planContent,
+            });
+            await ken.prompt(digest);
+            if (autopilotCancelled || planGeneration !== genAtStart)
+                return null;
+            return parseAutopilotVerdict(lastAssistantText(ken.getMessages()));
+        }
+        catch (err) {
+            // User action mid-review (manual Accept aborts the nolanAuto run): drop
+            // the review silently — the user's decision supersedes Nolan's.
+            if (autopilotCancelled || planGeneration !== genAtStart)
+                return null;
+            broadcastError("autopilot_error", "autopilot plan review failed", err);
+            return null;
+        }
+        finally {
+            autopilotReviewing = false;
+            // Apply any model switch that landed mid-review.
+            const pending = pendingNolanAutoModel;
+            pendingNolanAutoModel = null;
+            if (pending)
+                await syncNolanAutoModel(pending.provider, pending.model);
+        }
+    }
+    // The prompt fed to the fresh session after a plan is accepted — the SAME
+    // string the webview sends on a manual Accept (see PlanReviewModal's accept
+    // handler in ezcoder-app/src/App.tsx). Keep the two in lockstep so auto- and
+    // manual approval produce identical implementation turns.
+    const IMPLEMENT_PLAN_PROMPT = "The plan has been approved. Implement it now, following each step in order.";
     // Drive the review→prompt→review loop for one finished user turn. Only ever
     // called after shouldStartAutopilotCycle approves the turn (POST /prompt or
     // the stranded-queue drain) — never from the task runner, resume, /ken, or
@@ -1104,14 +1446,61 @@ async function createSession(deps, opts) {
         if (!autopilot || autopilotCancelled)
             return;
         autopilotActive = true;
+        // Generation captured by the last plan review; acceptPlan re-checks it so
+        // a user Accept/Reject landing mid-review always wins.
+        let planGenAtReview = -1;
         try {
             await driveAutopilotCycle({
-                maxRounds: MAX_AUTOPILOT_ROUNDS,
+                // A plan-pending cycle needs extra rounds: approve+implement and the
+                // post-implement work review each consume one, so +2 keeps a real fix
+                // round available.
+                maxRounds: pendingPlanPath !== null ? MAX_AUTOPILOT_ROUNDS + 2 : MAX_AUTOPILOT_ROUNDS,
                 isCancelled: () => autopilotCancelled,
-                // An injected run entering plan mode halts the cycle (autopilot_human
-                // with the plan-hold reason) — Nolan never prompts into a read-only
-                // plan-mode session or answers the plan modal for the user.
+                // An injected run entering plan mode WITHOUT submitting (enter_plan,
+                // no exit_plan) halts the cycle — Nolan never prompts into a read-only
+                // plan-mode session. A submitted plan takes the planPending branch.
                 isPlanMode: () => session.getPlanMode(),
+                planPending: () => pendingPlanPath !== null,
+                reviewPlan: async () => {
+                    planGenAtReview = planGeneration;
+                    return runAutopilotPlanReview(originalRequest);
+                },
+                // Auto-accept: the inlined POST /plan/accept body. Returns false when
+                // the plan generation moved since the review (user acted) — the cycle
+                // exits silently and the user's action stands.
+                acceptPlan: async () => {
+                    if (pendingPlanPath === null || planGeneration !== planGenAtReview)
+                        return false;
+                    const planPath = pendingPlanPath;
+                    try {
+                        await session.newSession();
+                        injectedAutopilotPrompts = [];
+                        titleGenerated = false;
+                        await session.setApprovedPlan(planPath);
+                    }
+                    catch (err) {
+                        broadcastError("autopilot_error", "autopilot plan accept failed", err);
+                        return false;
+                    }
+                    clearPendingPlan();
+                    // Ordering is load-bearing: the webview reads its still-open plan
+                    // modal state (step count) on autopilot_plan_accepted, and
+                    // session_reset clears it — accepted must land first.
+                    broadcast("autopilot_plan_accepted", {});
+                    broadcast("session_reset", {});
+                    // Persisted into the NEW session so a resume shows the marker.
+                    void session.persistAutopilotMarker("plan_approved");
+                    return true;
+                },
+                runImplement: () => {
+                    // Autopilot-injected run: frame it so EZ Coder knows no human is
+                    // watching the implementation. Record the framed string so Nolan's
+                    // digest labels it as injected, not as the user's ask. The run_start
+                    // label stays the clean prompt.
+                    const framed = frameAutopilotInjection(IMPLEMENT_PLAN_PROMPT);
+                    injectedAutopilotPrompts.push(framed);
+                    return runAgent(IMPLEMENT_PLAN_PROMPT, () => session.prompt(framed));
+                },
                 // Lean context per user turn: wipe prior review history so each new
                 // turn starts cheap, while within this cycle the few review messages
                 // persist so Nolan remembers what he already asked EZ Coder to fix.
@@ -1125,11 +1514,47 @@ async function createSession(deps, opts) {
                 // streams normally; the shared finally never re-triggers autopilot,
                 // so this can't recurse.
                 onInjected: (body, round) => {
-                    injectedAutopilotPrompts.push(body);
+                    // A revision injection supersedes the pending plan — if the run
+                    // resubmits via exit_plan, onExitPlan re-sets it (no-op for work-
+                    // branch injections, where nothing is pending).
+                    clearPendingPlan();
+                    // Record the FRAMED string (what actually lands in the build session,
+                    // see runPrompt) so Nolan's digest matches and labels it as injected.
+                    // The webview marker + persisted body stay the CLEAN prompt so the UI
+                    // shows Nolan's actual instruction, not the autopilot preamble.
+                    injectedAutopilotPrompts.push(frameAutopilotInjection(body));
                     broadcast("autopilot_prompted", { round, body });
+                    void session.persistAutopilotMarker("prompted", { body });
+                },
+                // Autopilot-injected run: EZ Coder receives the framed prompt (no human
+                // is watching this turn) while run_start keeps the clean label.
+                runPrompt: (body) => runAgent(body, () => session.prompt(frameAutopilotInjection(body))),
+                emit: (event) => {
+                    // Persist the terminal verdict marker so a resumed session renders the
+                    // same Nolan bubble the live run showed instead of dropping it or
+                    // falling back to the raw verdict text (e.g. ALL_CLEAR).
+                    if (event.type === "autopilot_done") {
+                        // Broadcast the SAME copySeed the persisted marker will produce on
+                        // resume, so the live all-clear wording matches the resumed one
+                        // (computed before persist — same synchronous message count).
+                        const seed = autopilotMarkerCopySeed({
+                            version: 1,
+                            phase: "done",
+                            afterMessageCount: session.getMessages().filter((m) => m.role !== "system").length,
+                        });
+                        broadcast(event.type, { ...event.data, copySeed: seed });
+                        void session.persistAutopilotMarker("done");
+                        return;
+                    }
+                    broadcast(event.type, event.data);
+                    if (event.type === "autopilot_human") {
+                        void session.persistAutopilotMarker("human", { reason: event.data.reason });
+                    }
+                    else if (event.type === "autopilot_capped") {
+                        void session.persistAutopilotMarker("capped");
+                    }
+                    // autopilot_ignored renders nothing live, so nothing is persisted either.
                 },
-                runPrompt: (body) => runAgent(body, () => session.prompt(body)),
-                emit: (event) => broadcast(event.type, event.data),
             });
         }
         finally {
@@ -1160,9 +1585,13 @@ async function createSession(deps, opts) {
                 broadcast("queued", { count: session.getQueuedCount() });
                 if (!next.text.trim() && next.attachments.length === 0)
                     continue;
+                // A queued message draining as a fresh turn supersedes any pending
+                // plan, exactly like a direct POST /prompt turn.
+                clearPendingPlan();
                 const workflowCommand = next.attachments.length === 0 &&
                     isWorkflowCommandText(next.text, await loadWorkflowCommandSpecs());
                 const assistantsBefore = countAssistantMessages(session.getMessages());
+                const messagesBefore = session.getMessages().length;
                 await runAgent(next.text, async () => {
                     if (next.attachments.length > 0) {
                         await session.promptWithAttachments(next.text, next.attachments);
@@ -1175,10 +1604,21 @@ async function createSession(deps, opts) {
                     enabled: autopilot,
                     cancelled: autopilotCancelled,
                     planMode: session.getPlanMode(),
+                    // A submitted plan (exit_plan fired) routes into the PLAN review
+                    // branch — the cycle reviews the plan itself instead of skipping.
+                    planPending: pendingPlanPath !== null,
                     workflowCommand,
                     assistantMessagesAdded: countAssistantMessages(session.getMessages()) - assistantsBefore,
+                    // Skip the review API call outright for turns that only started a
+                    // background process (dev server/watcher), ran a read-only lookup, or
+                    // committed/pushed — Nolan's autopilot contract already IGNOREs these,
+                    // so there's no reason to pay for that verdict.
+                    mechanicalOnly: isMechanicalOnlyTurn(extractTurnToolCalls(session.getMessages(), messagesBefore)),
                 });
                 if (decision.start) {
+                    log("INFO", "app-sidecar", "autopilot cycle starting (queued turn)", {
+                        kind: decision.kind,
+                    });
                     await runAutopilotCycle(next.text);
                 }
                 else if (autopilot) {
@@ -1197,18 +1637,34 @@ async function createSession(deps, opts) {
     // completion hint instructing the agent to mark the task done via the tasks
     // tool. Run-all advances to the next pending task after each run finishes.
     let taskRunAll = false;
+    // True for the duration of any task run (single or run-all). The plan-mode
+    // callbacks read this to decline plan mode when no human is present to
+    // approve a plan, so tasks implement directly instead of hanging on review.
+    let taskRunActive = false;
     async function runTaskById(taskId) {
         const task = loadTasksSync(cwd).find((t) => t.id === taskId || t.id.startsWith(taskId));
         if (!task)
             return false;
+        taskRunActive = true;
+        try {
+            return await runTaskByIdInner(task);
+        }
+        finally {
+            taskRunActive = false;
+        }
+    }
+    async function runTaskByIdInner(task) {
         // Fresh session per task so one task's context never bleeds into the next.
         await session.newSession();
         injectedAutopilotPrompts = [];
+        clearPendingPlan();
         titleGenerated = false;
         broadcast("session_reset", {});
         markTaskInProgress(cwd, task.id);
         broadcast("tasks_list", { tasks: loadTasksSync(cwd) });
         broadcast("task_start", { id: task.id, title: task.title });
+        // Persist the task header so a resumed task session shows what ran.
+        void session.persistAppMarker("task", { title: task.title }).catch(() => { });
         const shortId = task.id.slice(0, 8);
         const completionHint = `\n\n---\nWhen you have fully completed this task, call the tasks tool to mark it done:\n` +
             `tasks({ action: "done", id: "${shortId}" })`;
@@ -1319,6 +1775,10 @@ async function createSession(deps, opts) {
             });
             return;
         }
+        if (method === "GET" && url === "/progress") {
+            json(res, 200, progress.snapshot());
+            return;
+        }
         if (method === "GET" && (url === "/events" || url.startsWith("/events?"))) {
             res.writeHead(200, {
                 "content-type": "text/event-stream",
@@ -1498,8 +1958,11 @@ async function createSession(deps, opts) {
                 // they were recorded after, so each lands right after that message. A
                 // turn becomes two wire rows: the `@Nolan` question (user) + Nolan's reply
                 // (assistant), both flagged `ken` so the webview tints them.
+                // Deduped; stale anchors are clamped to the last message (Nolan turns
+                // carry real conversation, so they render at the end instead of
+                // vanishing).
                 const nolanByCount = new Map();
-                for (const turn of session.getNolanTurns()) {
+                for (const turn of normalizeNolanTurnsForHistory(session.getNolanTurns(), messages.filter((m) => m.role !== "system").length)) {
                     const list = nolanByCount.get(turn.afterMessageCount) ?? [];
                     list.push(turn);
                     nolanByCount.set(turn.afterMessageCount, list);
@@ -1514,9 +1977,103 @@ async function createSession(deps, opts) {
                         history.push({ role: "assistant", text: turn.reply, ken: true });
                     }
                 };
+                // Autopilot verdict markers to interleave, same anchor scheme as Nolan
+                // turns — each becomes a single assistant row the webview renders
+                // exactly like the live `autopilot` item (never a raw verdict string).
+                // Compact/continuation rewrites can carry old markers whose original
+                // afterMessageCount is beyond the restored message list; dropping those
+                // prevents stale all-clear bubbles from bunching at the bottom on resume.
+                const restoredMessageCount = messages.filter((m) => m.role !== "system").length;
+                const autopilotByCount = new Map();
+                for (const marker of normalizeAutopilotMarkersForHistory(session.getAutopilotMarkers(), restoredMessageCount)) {
+                    const list = autopilotByCount.get(marker.afterMessageCount) ?? [];
+                    list.push(marker);
+                    autopilotByCount.set(marker.afterMessageCount, list);
+                }
+                const flushAutopilot = (count) => {
+                    const markers = autopilotByCount.get(count);
+                    if (!markers)
+                        return;
+                    autopilotByCount.delete(count);
+                    for (const marker of markers) {
+                        history.push({
+                            role: "assistant",
+                            text: "",
+                            autopilot: {
+                                phase: marker.phase,
+                                ...(marker.reason !== undefined ? { reason: marker.reason } : {}),
+                                ...(marker.body !== undefined ? { body: marker.body } : {}),
+                                copySeed: marker.copySeed,
+                            },
+                        });
+                    }
+                };
+                // App transcript markers (plan banner / task header / error rows /
+                // user-bubble hints), same anchor scheme. user_hint markers don't
+                // become rows — they decorate the user row at their anchor instead.
+                const appMarkersByCount = new Map();
+                const userHintByCount = new Map();
+                // Compaction-count markers pair with compacted summary rows in file
+                // order (FIFO), not by anchor — the summary user message is what
+                // positions the notice.
+                const compactionCounts = [];
+                for (const marker of normalizeAppMarkersForHistory(session.getAppMarkers(), restoredMessageCount)) {
+                    if (marker.kind === "user_hint") {
+                        userHintByCount.set(marker.afterMessageCount, marker.data);
+                        continue;
+                    }
+                    if (marker.kind === "compaction") {
+                        const d = marker.data;
+                        if (typeof d.originalCount === "number" && typeof d.newCount === "number") {
+                            compactionCounts.push({ originalCount: d.originalCount, newCount: d.newCount });
+                        }
+                        continue;
+                    }
+                    const list = appMarkersByCount.get(marker.afterMessageCount) ?? [];
+                    list.push(marker);
+                    appMarkersByCount.set(marker.afterMessageCount, list);
+                }
+                const flushAppMarkers = (count) => {
+                    const markers = appMarkersByCount.get(count);
+                    if (!markers)
+                        return;
+                    appMarkersByCount.delete(count);
+                    for (const marker of markers) {
+                        const d = marker.data;
+                        if (marker.kind === "plan") {
+                            history.push({
+                                role: "assistant",
+                                text: "",
+                                plan: { reason: typeof d.reason === "string" ? d.reason : "" },
+                            });
+                        }
+                        else if (marker.kind === "task") {
+                            history.push({
+                                role: "assistant",
+                                text: "",
+                                task: { title: typeof d.title === "string" ? d.title : "" },
+                            });
+                        }
+                        else if (marker.kind === "error" && typeof d.headline === "string") {
+                            history.push({
+                                role: "assistant",
+                                text: "",
+                                error: {
+                                    scope: typeof d.scope === "string" ? d.scope : "error",
+                                    headline: d.headline,
+                                    ...(typeof d.message === "string" ? { message: d.message } : {}),
+                                    ...(typeof d.guidance === "string" ? { guidance: d.guidance } : {}),
+                                },
+                            });
+                        }
+                    }
+                };
                 let nonSystemCount = 0;
-                // Turns recorded before any build message (anchor 0) render at the top.
+                // Turns/markers recorded before any build message (anchor 0) render at
+                // the top.
                 flushNolan(0);
+                flushAutopilot(0);
+                flushAppMarkers(0);
                 for (const msg of messages) {
                     if (msg.role === "system")
                         continue;
@@ -1566,30 +2123,54 @@ async function createSession(deps, opts) {
                         }
                         continue;
                     }
-                    // User or assistant message — existing text/hook/command/compacted
-                    // extraction, plus sub-agent group detection for assistant tool_calls.
-                    const text = typeof msg.content === "string"
-                        ? msg.content
-                        : msg.content
-                            .map((c) => c.type === "text" && "text" in c && typeof c.text === "string" ? c.text : "")
-                            .join("");
-                    const images = typeof msg.content === "string"
-                        ? []
-                        : msg.content.flatMap((c) => c.type === "image" ? [`data:${c.mediaType};base64,${c.data}`] : []);
-                    const hook = msg.role === "user" ? detectHookKind(text) : null;
-                    const compacted = msg.role === "user" && !hook && text.startsWith("[Previous conversation summary]");
-                    const command = msg.role === "user" && !hook && !compacted
-                        ? detectPromptCommand(text, commandCandidates)
-                        : null;
-                    if (text.trim() || images.length > 0) {
-                        history.push({
-                            role: msg.role,
-                            text: command ?? text,
-                            images,
-                            hook,
-                            command: command !== null,
-                            compacted,
-                        });
+                    // User or assistant message — text/hook/command/compacted extraction,
+                    // plus sub-agent group detection for assistant tool_calls.
+                    if (msg.role === "user") {
+                        // Rebuild the live bubble: strip the steering wrapper, drop
+                        // attachment/file notes the model saw but the bubble never showed.
+                        const restored = restoreUserRow(msg.content);
+                        const text = restored.text;
+                        const hook = detectHookKind(text);
+                        const compacted = !hook && text.startsWith("[Previous conversation summary]");
+                        const command = !hook && !compacted ? detectPromptCommand(text, commandCandidates) : null;
+                        if (text.trim() || restored.images.length > 0) {
+                            const hint = userHintByCount.get(nonSystemCount);
+                            history.push({
+                                role: "user",
+                                text: command ?? text,
+                                images: restored.images,
+                                hook,
+                                command: command !== null,
+                                compacted,
+                                // Markers accumulate across continuation files (each rewrite
+                                // re-persists prior ones) but only the LATEST summary row
+                                // survives compaction — so consume from the newest end.
+                                ...(compacted && compactionCounts.length > 0
+                                    ? { compactionCounts: compactionCounts.pop() }
+                                    : {}),
+                                ...(hint?.nolanSent === true ? { nolanSent: true } : {}),
+                                ...(Array.isArray(hint?.enhancements) ? { enhancements: hint.enhancements } : {}),
+                            });
+                            // Live showed the video-capability warning right after the bubble.
+                            if (restored.videoWarning) {
+                                history.push({ role: "assistant", text: "", infoKind: "video_warning" });
+                            }
+                        }
+                    }
+                    else {
+                        // Assistant: one wire row per persisted text block — live streaming
+                        // splits bubbles at server_tool_call boundaries, and the persisted
+                        // content keeps those blocks separate.
+                        for (const blockText of restoreAssistantTexts(msg.content)) {
+                            history.push({
+                                role: "assistant",
+                                text: blockText,
+                                images: [],
+                                hook: null,
+                                command: false,
+                                compacted: false,
+                            });
+                        }
                     }
                     // Assistant tool_call blocks: detect sub-agent delegations.
                     if (msg.role === "assistant" && typeof msg.content !== "string") {
@@ -1610,14 +2191,21 @@ async function createSession(deps, opts) {
                             });
                         }
                     }
-                    // Interleave any Nolan turns recorded right after this message.
+                    // Interleave any Nolan turns / autopilot / app markers recorded right
+                    // after this message.
                     flushNolan(nonSystemCount);
+                    flushAutopilot(nonSystemCount);
+                    flushAppMarkers(nonSystemCount);
                 }
-                // Flush remaining Nolan turns whose anchor is at/after the message count
-                // (e.g. asked before any build message, or anchors beyond the current
-                // count after compaction shrank the history) so none are dropped.
+                // Flush remaining Nolan turns whose anchor is at/after the message count so
+                // none are dropped. Autopilot/app markers beyond the restored message
+                // count were already filtered above; any remaining marker here is valid.
                 for (const count of [...nolanByCount.keys()].sort((a, b) => a - b))
                     flushNolan(count);
+                for (const count of [...autopilotByCount.keys()].sort((a, b) => a - b))
+                    flushAutopilot(count);
+                for (const count of [...appMarkersByCount.keys()].sort((a, b) => a - b))
+                    flushAppMarkers(count);
                 json(res, 200, { history });
             })();
             return;
@@ -1650,10 +2238,12 @@ async function createSession(deps, opts) {
             void readBody(req).then(async (raw) => {
                 let text;
                 let attachments;
+                let meta;
                 try {
                     const body = JSON.parse(raw);
                     text = body.text ?? "";
                     attachments = Array.isArray(body.attachments) ? body.attachments : [];
+                    meta = typeof body.meta === "object" && body.meta !== null ? body.meta : undefined;
                 }
                 catch {
                     json(res, 400, { error: "invalid JSON body" });
@@ -1677,9 +2267,25 @@ async function createSession(deps, opts) {
                     return;
                 }
                 json(res, 202, { accepted: true });
+                // Webview display hint for this prompt's user bubble (nolanSent shimmer
+                // label / enhancer highlight segments). Anchored +1 so it attaches to
+                // the user message the prompt below is about to push. Queued prompts
+                // skip this (their position in the run is unpredictable).
+                if (meta && (meta.nolanSent === true || Array.isArray(meta.enhancements))) {
+                    void session
+                        .persistAppMarker("user_hint", {
+                        ...(meta.nolanSent === true ? { nolanSent: true } : {}),
+                        ...(Array.isArray(meta.enhancements) ? { enhancements: meta.enhancements } : {}),
+                    }, 1)
+                        .catch(() => { });
+                }
                 // Fresh user turn: clear any cancel flag left from a prior cycle so this
                 // turn's autopilot review can run.
                 autopilotCancelled = false;
+                // A typed message while a plan modal/review is pending (reject,
+                // feedback, anything) supersedes the pending plan — the bump also
+                // invalidates any in-flight Nolan plan review.
+                clearPendingPlan();
                 // Gate inputs captured around the run: whether this turn is a workflow
                 // slash command (attachment prompts skip slash expansion entirely), and
                 // how many assistant messages the run actually adds. Computed even when
@@ -1687,6 +2293,7 @@ async function createSession(deps, opts) {
                 // gate reads the post-run value.
                 const workflowCommand = attachments.length === 0 && isWorkflowCommandText(text, await loadWorkflowCommandSpecs());
                 const assistantsBefore = countAssistantMessages(session.getMessages());
+                const messagesBefore = session.getMessages().length;
                 await runAgent(text, async () => {
                     if (attachments.length > 0) {
                         // Persist each attachment under .ezcoder/uploads so files are inspectable
@@ -1715,10 +2322,19 @@ async function createSession(deps, opts) {
                     enabled: autopilot,
                     cancelled: autopilotCancelled,
                     planMode: session.getPlanMode(),
+                    // A submitted plan (exit_plan fired) routes into the PLAN review
+                    // branch — the cycle reviews the plan itself instead of skipping.
+                    planPending: pendingPlanPath !== null,
                     workflowCommand,
                     assistantMessagesAdded: countAssistantMessages(session.getMessages()) - assistantsBefore,
+                    // Skip the review API call outright for turns that only started a
+                    // background process (dev server/watcher), ran a read-only lookup, or
+                    // committed/pushed — Nolan's autopilot contract already IGNOREs these,
+                    // so there's no reason to pay for that verdict.
+                    mechanicalOnly: isMechanicalOnlyTurn(extractTurnToolCalls(session.getMessages(), messagesBefore)),
                 });
                 if (decision.start) {
+                    log("INFO", "app-sidecar", "autopilot cycle starting", { kind: decision.kind });
                     await runAutopilotCycle(text);
                 }
                 else if (autopilot) {
@@ -2175,12 +2791,14 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/cancel") {
+            cancelGeneration++;
             abort.abort();
             abort = new AbortController();
             session.setSignal(abort.signal);
             running = false;
             // Stop a run-all sweep so the next pending task isn't auto-started.
             taskRunAll = false;
+            taskRunActive = false;
             // Stop any in-flight autopilot cycle: flag it so the loop bails between
             // steps, and abort a review that's mid-prompt on the nolanAuto session.
             autopilotCancelled = true;
@@ -2205,6 +2823,7 @@ async function createSession(deps, opts) {
                 .newSession()
                 .then(() => {
                 injectedAutopilotPrompts = [];
+                clearPendingPlan();
                 broadcast("session_reset", {});
                 json(res, 200, { ok: true });
             })
@@ -2236,6 +2855,24 @@ async function createSession(deps, opts) {
                     json(res, 409, { error: "cannot accept a plan while the agent is running" });
                     return;
                 }
+                // Manual accept, possibly racing Nolan's autopilot plan review: the user
+                // always wins. Bump the plan generation (invalidates any in-flight
+                // review's verdict), stop the cycle, abort a mid-prompt review on the
+                // nolanAuto session, and clear the spinner — autopilot_ignored renders
+                // nothing, so no stale "approve or reject" bubble ever lands. The
+                // webview's follow-up "implement" /prompt arrives as a fresh turn
+                // (resetting autopilotCancelled), so the implementation still gets its
+                // normal post-run review; if it lands while the cycle is winding down
+                // it queues and runStrandedQueue drains it as a fresh turn.
+                clearPendingPlan();
+                autopilotCancelled = true;
+                nolanAutoAbort.abort();
+                nolanAutoAbort = new AbortController();
+                nolanAutoSession?.setSignal(nolanAutoAbort.signal);
+                if (autopilotReviewing) {
+                    autopilotReviewing = false;
+                    broadcast("autopilot_ignored", {});
+                }
                 try {
                     await session.newSession();
                     injectedAutopilotPrompts = [];