@prestyj/cli 5.6.0 → 5.8.0

package/dist/app-sidecar.js

@@ -18,10 +18,11 @@ import os from "node:os";
 import path from "node:path";
 import { randomUUID } from "node:crypto";
 import { parseArgs } from "node:util";
-import { formatError } from "@prestyj/ai";
+import { environmentSecrets, formatError, redactValue } from "@prestyj/ai";
 import { runJsonMode } from "./modes/json-mode.js";
 import { runSubagentWorkerMode } from "./modes/subagent-worker-mode.js";
 import { AgentSession } from "./core/agent-session.js";
+import { RunLifecycle } from "./core/run-lifecycle.js";
 import { CHAT_AGENT_IDS, chatAgentSessionsDir, createChatAgent, parseChatAgentId, sessionsDirForChatAgent, switchChatAgent, } from "./chat-agents/index.js";
 import { buildJiwaTools, JiwaStore } from "./chat-agents/jiwa.js";
 import { buildMemoryTools, MemoryStore } from "./chat-agents/memory.js";
@@ -33,6 +34,7 @@ import { driveAutopilotCycle, frameAutopilotInjection } from "./core/autopilot-c
 import { validateNolanModelPref, effectiveNolanModel, } from "./core/nolan-model.js";
 import { normalizeAutopilotMarkersForHistory, normalizeAppMarkersForHistory, normalizeNolanTurnsForHistory, restoreUserRow, restoreAssistantTexts, autopilotMarkerCopySeed, } from "./core/session-history.js";
 import { AuthStorage } from "./core/auth-storage.js";
+import { cleanupToolOutputs } from "./tools/overflow.js";
 import { fetchSubscriptionUsage, MOONSHOT_OAUTH_KEY, SubscriptionUsageError, XIAOMI_CREDITS_KEY, } from "@prestyj/core";
 import { loginAnthropic } from "./core/oauth/anthropic.js";
 import { loginOpenAI } from "./core/oauth/openai.js";
@@ -43,7 +45,8 @@ import { ensureAppDirs, loadSavedSettings } from "./config.js";
 import { SettingsManager } from "./core/settings-manager.js";
 import { getModel, getMaxThinkingLevel, getContextWindow, MODELS } from "./core/model-registry.js";
 import { resolveStartOrFallback } from "./core/resolve-start.js";
-import { getGitBranch, isGitRepo } from "./utils/git.js";
+import { getGitBranch, getGitDirtyFileCount, isGitRepo } from "./utils/git.js";
+import { extractPlanSteps } from "./utils/plan-steps.js";
 import { getNextThinkingLevel, getSupportedThinkingLevels, isThinkingLevelSupported, } from "./core/thinking-level.js";
 import { PROMPT_COMMANDS } from "./core/prompt-commands.js";
 import { loadCustomCommands } from "./core/custom-commands.js";
@@ -62,16 +65,20 @@ import { awardPrompt, awardCommits } from "./core/progress/engine.js";
 import { detectNewCommits, repoKey } from "./core/progress/git-xp.js";
 import { rebuildFromSessions } from "./core/progress/rebuild.js";
 const ALL_PROVIDERS = [
+    // US
     "anthropic",
-    "xiaomi",
     "openai",
     "gemini",
-    "glm",
+    "xai",
+    // China
     "moonshot",
+    "glm",
     "minimax",
+    "xiaomi",
     "deepseek",
-    "openrouter",
+    // Japan, then provider-agnostic gateway last
     "sakana",
+    "openrouter",
 ];
 function appSettingsFile() {
     return path.join(os.homedir(), ".ezcoder", "ezcoder-app.json");
@@ -504,6 +511,9 @@ async function main() {
     // before anything spawns (bash tool, background tasks, LSP, git helpers all
     // inherit it). Best-effort — never blocks startup beyond its internal cap.
     await enrichProcessPath();
+    // Sweep recoverable full tool outputs (~/.ezcoder/tool-output/) older than 48h.
+    // Fire-and-forget: cleanup must never delay or break startup.
+    void cleanupToolOutputs().catch(() => { });
     const auth = new AuthStorage(paths.authFile);
     await auth.load();
     // Every window's session lives here as an in-process object, keyed by the id
@@ -534,6 +544,11 @@ async function main() {
     });
     const usageCache = new Map();
     const usageRequests = new Map();
+    // 429 backoff: when the provider rate-limits the usage endpoint, hold the
+    // error result until this timestamp instead of re-polling (and re-logging a
+    // WARN) every 60s — the old cadence hammered a limited endpoint for hours.
+    const usageRateLimitedUntil = new Map();
+    const USAGE_RATE_LIMIT_BACKOFF_MS = 5 * 60_000;
     async function fetchUsageProvider(provider) {
         const displayName = provider === "anthropic" ? "Anthropic" : "Codex";
         if (!(await auth.hasProviderAuth(provider))) {
@@ -542,14 +557,24 @@ async function main() {
         try {
             let credentials = await auth.resolveCredentials(provider);
             try {
-                return { ...(await fetchSubscriptionUsage(provider, credentials)), connected: true };
+                const snapshot = {
+                    ...(await fetchSubscriptionUsage(provider, credentials)),
+                    connected: true,
+                };
+                usageRateLimitedUntil.delete(provider);
+                return snapshot;
             }
             catch (error) {
                 // A provider can revoke an access token before its stored expiry. Refresh
                 // once on 401, matching inference auth recovery, then retry the usage call.
                 if (error instanceof SubscriptionUsageError && error.status === 401) {
                     credentials = await auth.resolveCredentials(provider, { forceRefresh: true });
-                    return { ...(await fetchSubscriptionUsage(provider, credentials)), connected: true };
+                    const snapshot = {
+                        ...(await fetchSubscriptionUsage(provider, credentials)),
+                        connected: true,
+                    };
+                    usageRateLimitedUntil.delete(provider);
+                    return snapshot;
                 }
                 throw error;
             }
@@ -557,6 +582,9 @@ async function main() {
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
             log("WARN", "app-sidecar", "subscription usage fetch failed", { provider, message });
+            if (error instanceof SubscriptionUsageError && error.status === 429) {
+                usageRateLimitedUntil.set(provider, Date.now() + USAGE_RATE_LIMIT_BACKOFF_MS);
+            }
             const connected = await auth.hasProviderAuth(provider);
             return {
                 provider,
@@ -585,9 +613,12 @@ async function main() {
             const missingReset = result.connected &&
                 result.windows.length > 0 &&
                 result.windows.some((window) => window.resetsAt === undefined);
+            const rateLimitedUntil = usageRateLimitedUntil.get(provider) ?? 0;
             usageCache.set(provider, {
                 result,
-                expiresAt: Date.now() + (missingReset ? 10_000 : 60_000),
+                expiresAt: rateLimitedUntil > Date.now()
+                    ? rateLimitedUntil
+                    : Date.now() + (missingReset ? 10_000 : 60_000),
             });
             return result;
         }
@@ -929,7 +960,8 @@ async function createSession(deps, opts) {
     const clients = new Set();
     let clientSeq = 0;
     function broadcast(type, data) {
-        const frame = `data: ${JSON.stringify({ type, data })}\n\n`;
+        const safePayload = redactValue({ type, data }, { secrets: environmentSecrets(process.env) });
+        const frame = `data: ${JSON.stringify(safePayload)}\n\n`;
         for (const c of clients)
             c.res.write(frame);
     }
@@ -1009,6 +1041,11 @@ async function createSession(deps, opts) {
         signal: abort.signal,
         // Keep MCP startup off the readiness path in both modes.
         backgroundMcpConnect: true,
+        // Keep restore-time auto-compaction off the readiness path too: its summary
+        // LLM call (30s timeout) used to freeze waitForReady — and with it the whole
+        // window (project picker, session list) — whenever a resumed session was
+        // over the context threshold. First prompt compacts instead, with UI events.
+        deferLoadCompaction: true,
     };
     let session;
     if (mode === "chat") {
@@ -1036,7 +1073,9 @@ async function createSession(deps, opts) {
                 // Unattended task runs cannot approve plans; implement directly instead.
                 if (taskRunActive)
                     return false;
+                deactivateApprovedPlan();
                 await session.setPlanMode(true);
+                broadcast("plan_progress", { total: 0, completed: [] });
                 broadcast("plan_enter", { reason: reason ?? "" });
                 void session.persistAppMarker("plan", { reason: reason ?? "" }).catch(() => { });
             },
@@ -1071,11 +1110,17 @@ async function createSession(deps, opts) {
         }
     }
     log("INFO", "app-sidecar", "session ready", { provider, model, mode, chatAgent, cwd });
-    // Footer extras (context window, git branch, background tasks). The git
-    // branch is resolved once at startup and refreshed lazily; the context
+    // Workspace extras (context window, git status, background tasks). Git state
+    // is resolved once at startup and refreshed after every run; the context
     // window follows the active model.
-    let gitBranch = await getGitBranch(cwd).catch(() => null);
-    let gitIsRepo = await isGitRepo(cwd).catch(() => false);
+    const [initialGitBranch, initialGitIsRepo, initialDirtyFileCount] = await Promise.all([
+        getGitBranch(cwd).catch(() => null),
+        isGitRepo(cwd).catch(() => false),
+        getGitDirtyFileCount(cwd).catch(() => 0),
+    ]);
+    let gitBranch = initialGitBranch;
+    let gitIsRepo = initialGitIsRepo;
+    let gitDirtyFileCount = initialDirtyFileCount;
     function currentContextWindow() {
         const st = session.getState();
         return getContextWindow(st.model, { provider: st.provider, accountId: st.accountId });
@@ -1087,6 +1132,7 @@ async function createSession(deps, opts) {
             contextWindow: currentContextWindow(),
             gitBranch,
             isGitRepo: gitIsRepo,
+            gitDirtyFileCount,
             tasks: session.listBackgroundProcesses(),
         };
     }
@@ -1096,8 +1142,93 @@ async function createSession(deps, opts) {
     // failures (e.g. repeated invalid-argument errors) instead of leaving the
     // fatal-abort path with no forensic trail.
     const toolCallNames = new Map();
+    // Approved-plan progress belongs beside the plan file, not in the webview.
+    // The implementation can rewrite/expand that file mid-run, so a step count
+    // frozen at approval time becomes dishonest (the exact stale-total bug the
+    // CLI already fixed). Re-read the live file after tools/markers, retain the
+    // last valid step section during transient edits, and send one authoritative
+    // snapshot to the app.
+    let approvedPlanPath = null;
+    let approvedPlanTotal = 0;
+    let approvedPlanMarkers = new Set();
+    let approvedPlanGeneration = 0;
+    let planMarkerTail = "";
+    let planProgressSync = Promise.resolve(false);
+    function planProgressPayload() {
+        const completed = [...approvedPlanMarkers]
+            .filter((step) => step >= 1 && step <= approvedPlanTotal)
+            .sort((a, b) => a - b);
+        return { total: approvedPlanTotal, completed };
+    }
+    async function syncApprovedPlanProgress(generation) {
+        const planPath = approvedPlanPath;
+        if (planPath === null || generation !== approvedPlanGeneration)
+            return false;
+        const content = await fs.readFile(planPath, "utf-8").catch(() => null);
+        if (approvedPlanPath !== planPath || generation !== approvedPlanGeneration)
+            return false;
+        if (content !== null) {
+            const freshTotal = extractPlanSteps(content).length;
+            // During an in-place rewrite the step section can briefly disappear.
+            // Keep the last real total instead of flashing 0 or declaring completion.
+            if (freshTotal > 0 || approvedPlanTotal === 0)
+                approvedPlanTotal = freshTotal;
+        }
+        broadcast("plan_progress", planProgressPayload());
+        return (approvedPlanTotal > 0 &&
+            Array.from({ length: approvedPlanTotal }, (_, index) => index + 1).every((step) => approvedPlanMarkers.has(step)));
+    }
+    function queueApprovedPlanProgressSync() {
+        const generation = approvedPlanGeneration;
+        planProgressSync = planProgressSync
+            .catch(() => false)
+            .then(() => syncApprovedPlanProgress(generation))
+            .catch((error) => {
+            log("WARN", "app-sidecar", "plan progress refresh failed", {
+                message: error instanceof Error ? error.message : String(error),
+            });
+            return false;
+        });
+        return planProgressSync;
+    }
+    async function activateApprovedPlan(planPath) {
+        deactivateApprovedPlan();
+        await session.setApprovedPlan(planPath);
+        if (!planPath)
+            return 0;
+        approvedPlanPath = planPath;
+        await queueApprovedPlanProgressSync();
+        return approvedPlanTotal;
+    }
+    function deactivateApprovedPlan() {
+        approvedPlanGeneration++;
+        approvedPlanPath = null;
+        approvedPlanTotal = 0;
+        approvedPlanMarkers = new Set();
+        planMarkerTail = "";
+        planProgressSync = Promise.resolve(false);
+    }
+    function recordApprovedPlanMarkers(text) {
+        if (approvedPlanPath === null || !text)
+            return;
+        const candidate = planMarkerTail + text;
+        let changed = false;
+        for (const match of candidate.matchAll(/\[DONE:(\d+)\]/gi)) {
+            const step = Number.parseInt(match[1], 10);
+            if (step >= 1 && !approvedPlanMarkers.has(step)) {
+                approvedPlanMarkers.add(step);
+                changed = true;
+            }
+        }
+        planMarkerTail = candidate.slice(-32);
+        if (changed)
+            void queueApprovedPlanProgressSync();
+    }
     // Forward every relevant bus event to the webview.
-    session.eventBus.on("text_delta", (d) => broadcast("text_delta", d));
+    session.eventBus.on("text_delta", (d) => {
+        broadcast("text_delta", d);
+        recordApprovedPlanMarkers(d.text);
+    });
     session.eventBus.on("thinking_delta", (d) => broadcast("thinking_delta", d));
     session.eventBus.on("tool_call_start", (d) => {
         toolCallNames.set(d.toolCallId, d.name);
@@ -1120,6 +1251,11 @@ async function createSession(deps, opts) {
         if (name === "tasks") {
             broadcast("tasks_list", { tasks: loadTasksSync(cwd) });
         }
+        // Any tool can mutate the approved plan (including bash), so refresh after
+        // every completed call while tracking is active. The file is tiny and this
+        // keeps the displayed total aligned before the next completion marker.
+        if (approvedPlanPath !== null)
+            void queueApprovedPlanProgressSync();
     });
     // Native server tools (e.g. Anthropic web_search) do NOT end the turn — text
     // streams before and after them in the SAME turn. The webview must reset its
@@ -1137,15 +1273,23 @@ async function createSession(deps, opts) {
     session.eventBus.on("compaction_start", (d) => broadcast("compaction_start", d));
     session.eventBus.on("compaction_end", (d) => broadcast("compaction_end", d));
     let running = false;
-    let titleGenerated = false;
+    const runLifecycle = new RunLifecycle((runState) => {
+        running = runState !== "idle";
+        if (runState === "cancelling")
+            broadcast("run_cancelling", { runState });
+    });
+    const cancelledRunEndGenerations = new Set();
+    let pendingCancelDrain = null;
     // Bumped by /cancel — a run whose cancel generation changed mid-flight was
     // canceled and earns no XP.
     let cancelGeneration = 0;
     // Autopilot (auto-review) toggle for THIS window's project. Loaded from
     // ezcoder-app.json on boot; flipped via POST /autopilot. When on, POST /prompt runs
     // runAutopilotCycle after the user's turn settles — Nolan auto-reviews the work
-    // and drives the review→prompt→review loop.
+    // and drives the review→prompt→review loop. Nolan is the sole verification
+    // owner in this mode, so suppress the build session's redundant Ideal hook.
     let autopilot = mode === "code" && (await loadAutopilot(cwd));
+    session.setIdealReviewSuppressed(autopilot);
     // True while an autopilot review is in flight (used to defer nolanAuto model
     // switches, like nolanRunning does for chat Nolan, and to drive the spinner).
     let autopilotReviewing = false;
@@ -1159,6 +1303,7 @@ async function createSession(deps, opts) {
     let autopilotCancelled = false;
     // Hard cap on review→prompt→review rounds per user turn (loop safety).
     const MAX_AUTOPILOT_ROUNDS = 3;
+    const CANCEL_TIMEOUT_MS = 5_000;
     // Prompt bodies Autopilot Nolan injected into the BUILD session this
     // conversation. Passed into every Nolan digest so injected prompts render as
     // "Nolan autopilot (injected)" instead of `**User:**` — otherwise multi-round
@@ -1341,6 +1486,9 @@ async function createSession(deps, opts) {
             // (often >5 min) regardless of the user's global speedProfile pick.
             forceLongCacheRetention: true,
         });
+        // Nolan is already the independent autopilot reviewer; recursively running
+        // his own Ideal self-review adds latency and can corrupt the verdict shape.
+        ken.setIdealReviewSuppressed(true);
         await ken.initialize();
         // Deliberately no bus bridge: the review is silent. Errors surface via the
         // runAutopilotReview try/catch as autopilot_error frames.
@@ -1351,53 +1499,108 @@ async function createSession(deps, opts) {
         });
         return ken;
     }
-    // Resumed session: if it already has a conversation, generate its title now so
-    // the title bar shows it immediately on load (not just after the next prompt).
-    {
-        const hasHistory = session
-            .getMessages()
-            .some((m) => m.role === "user" || m.role === "assistant");
-        if (hasHistory) {
-            titleGenerated = true;
-            void session.generateTitle().then((title) => {
-                if (title)
-                    broadcast("session_title", { title });
-            });
-        }
+    function abortOwnedWork() {
+        cancelGeneration++;
+        abort.abort();
+        // Stop a run-all sweep and every async child through AgentSession's signal.
+        taskRunAll = false;
+        autopilotCancelled = true;
+        nolanAutoAbort.abort();
+    }
+    function installFreshRunControllers() {
+        abort = new AbortController();
+        session.setSignal(abort.signal);
+        nolanAutoAbort = new AbortController();
+        nolanAutoSession?.setSignal(nolanAutoAbort.signal);
     }
-    // Core run lifecycle shared by /prompt and the task runner: flips `running`,
-    // brackets the run with run_start/run_end, refreshes the footer extras, and
-    // generates the session title once. `label` is the text shown live with the
-    // run_start frame.
+    function finishOwnedGeneration(generation, emitCancelledFallback) {
+        const cancelled = runLifecycle.isCancellationRequested(generation);
+        const settlement = runLifecycle.settle(generation);
+        if (!settlement.settled)
+            return cancelled;
+        // A replacement signal is safe only after the provider-backed owner settled.
+        installFreshRunControllers();
+        if (cancelled && emitCancelledFallback && !cancelledRunEndGenerations.has(generation)) {
+            cancelledRunEndGenerations.add(generation);
+            broadcast("run_end", { cancelled: true, runState: runLifecycle.state });
+        }
+        return cancelled;
+    }
+    // Core provider-run bracket. Standalone runs own a lifecycle generation;
+    // injected autopilot runs share the cycle's outer generation.
     async function runAgent(label, run) {
-        running = true;
+        const ownsGeneration = !runLifecycle.running;
+        const generation = ownsGeneration
+            ? runLifecycle.begin(abortOwnedWork).generation
+            : runLifecycle.generation;
+        if (ownsGeneration)
+            pendingCancelDrain = null;
         // Progress (Ranks): completed, non-canceled runs with ≥1 assistant turn earn
         // XP — prompt + any commits authored during the run window.
         const runStartedAt = Date.now();
         const cancelGenAtStart = cancelGeneration;
         const assistantsBeforeRun = countAssistantMessages(session.getMessages());
         let runSucceeded = false;
-        broadcast("run_start", { text: label });
+        broadcast("run_start", { text: label, runState: runLifecycle.state });
         try {
-            await run();
+            if (!runLifecycle.isCancellationRequested(generation))
+                await run();
             runSucceeded = true;
         }
         catch (err) {
-            broadcastError("error", "run failed", err);
+            if (!runLifecycle.isCancellationRequested(generation)) {
+                broadcastError("error", "run failed", err);
+            }
         }
         finally {
-            running = false;
+            const cancelled = runLifecycle.isCancellationRequested(generation);
             if (runSucceeded &&
+                !cancelled &&
                 cancelGeneration === cancelGenAtStart &&
                 countAssistantMessages(session.getMessages()) > assistantsBeforeRun) {
                 // Fire-and-forget — XP must never delay or break run teardown.
                 void progress.awardRun(cwd, runStartedAt, opts.id);
             }
-            // A run may have switched branches (git checkout) or spawned/finished
-            // background tasks — refresh the footer extras once it settles.
-            gitBranch = await getGitBranch(cwd).catch(() => gitBranch);
-            gitIsRepo = await isGitRepo(cwd).catch(() => gitIsRepo);
-            broadcast("run_end", {});
+            // A run may have switched branches, changed files, or spawned/finished
+            // background tasks. Refresh the workspace extras once it settles.
+            [gitBranch, gitIsRepo, gitDirtyFileCount] = await Promise.all([
+                getGitBranch(cwd).catch(() => gitBranch),
+                isGitRepo(cwd).catch(() => gitIsRepo),
+                getGitDirtyFileCount(cwd).catch(() => gitDirtyFileCount),
+            ]);
+            // Serialize behind any marker/tool-triggered refresh so the terminal
+            // progress snapshot uses the live plan file. Once every canonical step
+            // is complete, remove the approved plan from future system prompts and
+            // clear the widget before run_end paints the idle activity bar.
+            if (runSucceeded &&
+                !cancelled &&
+                approvedPlanPath !== null &&
+                (await queueApprovedPlanProgressSync())) {
+                try {
+                    await session.setApprovedPlan(undefined);
+                    deactivateApprovedPlan();
+                    broadcast("plan_progress", { total: 0, completed: [] });
+                }
+                catch (error) {
+                    // Keep tracking when prompt cleanup fails; hiding the widget here
+                    // would claim completion while the approved-plan contract remained.
+                    log("WARN", "app-sidecar", "completed plan cleanup failed", {
+                        message: error instanceof Error ? error.message : String(error),
+                    });
+                }
+            }
+            if (ownsGeneration)
+                finishOwnedGeneration(generation, false);
+            // A cancelled injected run is still owned by the surrounding autopilot
+            // cycle; its outer finalizer emits the one terminal cancelled run_end.
+            if (!(cancelled && !ownsGeneration)) {
+                if (cancelled)
+                    cancelledRunEndGenerations.add(generation);
+                broadcast("run_end", {
+                    ...(cancelled ? { cancelled: true } : {}),
+                    runState: runLifecycle.state,
+                });
+            }
             // Autopilot's review loop is driven explicitly from POST /prompt (see
             // runAutopilotCycle), NOT from this shared finally — that keeps the
             // injected EZ Coder runs this cycle triggers from recursively re-entering
@@ -1406,19 +1609,8 @@ async function createSession(deps, opts) {
             // completed ones so they drop out of the Tasks modal automatically (users
             // never have to delete finished tasks by hand).
             broadcast("tasks_list", { tasks: pruneDoneTasksSync(cwd) });
-            // Queue drains into the run as steering, so it's empty by run_end —
-            // sync the webview indicator.
             broadcast("queued", { count: session.getQueuedCount() });
             broadcast("extras", footerExtras());
-            // Generate a session title once, after the first run, for the title bar
-            // (best-effort, async — don't block the response).
-            if (!titleGenerated) {
-                titleGenerated = true;
-                void session.generateTitle().then((title) => {
-                    if (title)
-                        broadcast("session_title", { title });
-                });
-            }
         }
     }
     // ── Autopilot orchestration ─────────────────────────────────
@@ -1444,7 +1636,8 @@ async function createSession(deps, opts) {
             return parseAutopilotVerdict(lastAssistantText(ken.getMessages()));
         }
         catch (err) {
-            broadcastError("autopilot_error", "autopilot review failed", err);
+            if (!autopilotCancelled)
+                broadcastError("autopilot_error", "autopilot review failed", err);
             return null;
         }
         finally {
@@ -1519,7 +1712,10 @@ async function createSession(deps, opts) {
     async function runAutopilotCycle(originalRequest) {
         if (!autopilot || autopilotCancelled)
             return;
+        const generation = runLifecycle.begin(abortOwnedWork).generation;
+        pendingCancelDrain = null;
         autopilotActive = true;
+        session.setIdealReviewSuppressed(true);
         // Generation captured by the last plan review; acceptPlan re-checks it so
         // a user Accept/Reject landing mid-review always wins.
         let planGenAtReview = -1;
@@ -1546,22 +1742,22 @@ async function createSession(deps, opts) {
                     if (pendingPlanPath === null || planGeneration !== planGenAtReview)
                         return false;
                     const planPath = pendingPlanPath;
+                    let planTotal;
                     try {
-                        await session.newSession();
+                        await session.newSession(true);
                         injectedAutopilotPrompts = [];
-                        titleGenerated = false;
-                        await session.setApprovedPlan(planPath);
+                        planTotal = await activateApprovedPlan(planPath);
                     }
                     catch (err) {
                         broadcastError("autopilot_error", "autopilot plan accept failed", err);
                         return false;
                     }
                     clearPendingPlan();
-                    // Ordering is load-bearing: the webview reads its still-open plan
-                    // modal state (step count) on autopilot_plan_accepted, and
-                    // session_reset clears it — accepted must land first.
+                    // Keep the approval marker ahead of the reset, then seed the reset
+                    // with the sidecar's canonical count from the actual plan file.
                     broadcast("autopilot_plan_accepted", {});
-                    broadcast("session_reset", {});
+                    broadcast("session_reset", { planTotal });
+                    broadcast("plan_progress", planProgressPayload());
                     // Persisted into the NEW session so a resume shows the marker.
                     void session.persistAutopilotMarker("plan_approved");
                     return true;
@@ -1633,6 +1829,9 @@ async function createSession(deps, opts) {
         }
         finally {
             autopilotActive = false;
+            session.setIdealReviewSuppressed(autopilot);
+            finishOwnedGeneration(generation, true);
+            queueMicrotask(() => void runStrandedQueue());
         }
     }
     // ── Stranded-queue drain ───────────────────────────────
@@ -1730,9 +1929,9 @@ async function createSession(deps, opts) {
     async function runTaskByIdInner(task) {
         // Fresh session per task so one task's context never bleeds into the next.
         await session.newSession();
+        deactivateApprovedPlan();
         injectedAutopilotPrompts = [];
         clearPendingPlan();
-        titleGenerated = false;
         broadcast("session_reset", {});
         markTaskInProgress(cwd, task.id);
         broadcast("tasks_list", { tasks: loadTasksSync(cwd) });
@@ -1816,6 +2015,30 @@ async function createSession(deps, opts) {
         tasksPoll.unref?.();
     };
     scheduleTasksPoll(1500);
+    // Files can change outside the agent (editor saves, terminal commits), so keep
+    // the dirty count current while idle. Branch/repo state already refreshes after
+    // agent runs; polling only the count avoids spawning three git processes per tick.
+    let gitPoll;
+    let gitPollStopped = false;
+    const scheduleGitPoll = (delay) => {
+        if (gitPollStopped)
+            return;
+        gitPoll = setTimeout(() => {
+            void getGitDirtyFileCount(cwd)
+                .catch(() => gitDirtyFileCount)
+                .then((nextDirtyFileCount) => {
+                if (gitPollStopped)
+                    return;
+                if (nextDirtyFileCount !== gitDirtyFileCount) {
+                    gitDirtyFileCount = nextDirtyFileCount;
+                    broadcast("extras", footerExtras());
+                }
+                scheduleGitPoll(5000);
+            });
+        }, delay);
+        gitPoll.unref?.();
+    };
+    scheduleGitPoll(5000);
     function readBody(req) {
         return new Promise((resolve, reject) => {
             const chunks = [];
@@ -1825,7 +2048,7 @@ async function createSession(deps, opts) {
         });
     }
     function json(res, status, body) {
-        const payload = JSON.stringify(body);
+        const payload = JSON.stringify(redactValue(body, { secrets: environmentSecrets(process.env) }));
         res.writeHead(status, {
             "content-type": "application/json",
             "access-control-allow-origin": "*",
@@ -1841,6 +2064,7 @@ async function createSession(deps, opts) {
                 mode,
                 chatAgent,
                 running,
+                runState: runLifecycle.state,
                 ready: true,
                 thinkingLevel: session.getThinkingLevel() ?? null,
                 supportedThinkingLevels: getSupportedThinkingLevels(st.provider, st.model),
@@ -1913,6 +2137,7 @@ async function createSession(deps, opts) {
                     mode,
                     chatAgent,
                     running,
+                    runState: runLifecycle.state,
                     thinkingLevel: session.getThinkingLevel() ?? null,
                     supportedThinkingLevels: getSupportedThinkingLevels(st.provider, st.model),
                     supportsVideo: getModel(st.model)?.supportsVideo ?? false,
@@ -2087,6 +2312,20 @@ async function createSession(deps, opts) {
             void (async () => {
                 const commandCandidates = [...PROMPT_COMMANDS, ...(await loadCustomCommands(cwd))];
                 const messages = session.getMessages();
+                // An Ideal hook is injected immediately after the assistant's candidate
+                // no-tool response. That response is review scratch, not a user-visible
+                // final answer. Live SSE drops it when the hook event arrives; mark the
+                // same assistant message here so resumed history stays identical.
+                const hiddenIdealDrafts = new Set();
+                for (let i = 0; i < messages.length - 1; i++) {
+                    const draft = messages[i];
+                    const hookPrompt = messages[i + 1];
+                    if (draft?.role !== "assistant" || hookPrompt?.role !== "user")
+                        continue;
+                    const restored = restoreUserRow(hookPrompt.content);
+                    if (detectHookKind(restored.text) === "ideal")
+                        hiddenIdealDrafts.add(draft);
+                }
                 // Pre-index tool results by toolCallId so we can pair tool calls with
                 // their results (for sub-agent status + image extraction).
                 const toolResultMap = new Map();
@@ -2304,10 +2543,11 @@ async function createSession(deps, opts) {
                             }
                         }
                     }
-                    else {
+                    else if (!hiddenIdealDrafts.has(msg)) {
                         // Assistant: one wire row per persisted text block — live streaming
                         // splits bubbles at server_tool_call boundaries, and the persisted
-                        // content keeps those blocks separate.
+                        // content keeps those blocks separate. Ideal-review candidate drafts
+                        // are intentionally omitted to match the live pre-final hook flow.
                         for (const blockText of restoreAssistantTexts(msg.content)) {
                             history.push({
                                 role: "assistant",
@@ -2409,6 +2649,13 @@ async function createSession(deps, opts) {
                     json(res, 400, { error: "empty prompt" });
                     return;
                 }
+                if (runLifecycle.running && runLifecycle.isCancellationRequested(runLifecycle.generation)) {
+                    json(res, 409, {
+                        error: runLifecycle.state === "cancelling" ? "run_cancelling" : "cancel_failed",
+                        runState: runLifecycle.state,
+                    });
+                    return;
+                }
                 if (running || autopilotActive) {
                     // Queue prompts as mid-run steering (mirrors the CLI). Also queue while
                     // an autopilot cycle is active but between injected runs (build idle,
@@ -2580,6 +2827,9 @@ async function createSession(deps, opts) {
                     return;
                 }
                 autopilot = enabled;
+                // A toggle-off during an active cycle takes effect after Nolan finishes;
+                // until then, injected build runs must not re-enable Ideal self-review.
+                session.setIdealReviewSuppressed(enabled || autopilotActive);
                 await saveAutopilot(cwd, enabled);
                 log("INFO", "app-sidecar", "autopilot toggled", { enabled: String(enabled) });
                 broadcast("autopilot", { autopilot: enabled });
@@ -2982,27 +3232,50 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/cancel") {
-            cancelGeneration++;
-            abort.abort();
-            abort = new AbortController();
-            session.setSignal(abort.signal);
-            running = false;
-            // Stop a run-all sweep so the next pending task isn't auto-started.
-            taskRunAll = false;
-            taskRunActive = false;
-            // Stop any in-flight autopilot cycle: flag it so the loop bails between
-            // steps, and abort a review that's mid-prompt on the nolanAuto session.
-            autopilotCancelled = true;
-            nolanAutoAbort.abort();
-            nolanAutoAbort = new AbortController();
-            nolanAutoSession?.setSignal(nolanAutoAbort.signal);
-            autopilotReviewing = false;
-            // Drop any queued steering and return it so the webview can restore it to
-            // the composer.
-            const drained = session.drainQueue();
-            broadcast("run_end", { cancelled: true });
-            broadcast("queued", { count: 0 });
-            json(res, 200, { cancelled: true, drained });
+            void (async () => {
+                // Even between task runs, cancellation stops the sweep. Active provider
+                // ownership invokes the full abort hook exactly once through lifecycle.
+                taskRunAll = false;
+                autopilotCancelled = true;
+                if (!runLifecycle.running) {
+                    nolanAutoAbort.abort();
+                    nolanAutoAbort = new AbortController();
+                    nolanAutoSession?.setSignal(nolanAutoAbort.signal);
+                }
+                const generation = runLifecycle.generation;
+                if (!pendingCancelDrain || pendingCancelDrain.generation !== generation) {
+                    pendingCancelDrain = { generation, text: session.drainQueue() };
+                    broadcast("queued", { count: 0 });
+                }
+                const result = await runLifecycle.cancel(CANCEL_TIMEOUT_MS);
+                const drained = pendingCancelDrain.text;
+                if (result.status === "failed") {
+                    broadcast("cancel_failed", {
+                        error: "cancel_failed",
+                        reason: result.reason,
+                        runState: runLifecycle.state,
+                    });
+                    json(res, 504, {
+                        error: "cancel_failed",
+                        reason: result.reason,
+                        runState: runLifecycle.state,
+                        drained,
+                    });
+                    return;
+                }
+                json(res, 200, {
+                    cancelled: result.status === "cancelled",
+                    runState: runLifecycle.state,
+                    drained,
+                });
+            })().catch((error) => {
+                broadcast("cancel_failed", { error: "cancel_failed", runState: runLifecycle.state });
+                json(res, 500, {
+                    error: "cancel_failed",
+                    message: error instanceof Error ? error.message : String(error),
+                    runState: runLifecycle.state,
+                });
+            });
             return;
         }
         if (method === "POST" && url === "/new-session") {
@@ -3016,6 +3289,7 @@ async function createSession(deps, opts) {
                 if (mode === "chat") {
                     await session.persistAppMarker("agent_handoff", { chatAgent });
                 }
+                deactivateApprovedPlan();
                 injectedAutopilotPrompts = [];
                 clearPendingPlan();
                 broadcast("session_reset", {});
@@ -3068,12 +3342,12 @@ async function createSession(deps, opts) {
                     broadcast("autopilot_ignored", {});
                 }
                 try {
-                    await session.newSession();
+                    await session.newSession(true);
                     injectedAutopilotPrompts = [];
-                    titleGenerated = false;
-                    await session.setApprovedPlan(planPath);
-                    broadcast("session_reset", {});
-                    json(res, 200, { ok: true });
+                    const planTotal = await activateApprovedPlan(planPath);
+                    broadcast("session_reset", { planTotal });
+                    broadcast("plan_progress", planProgressPayload());
+                    json(res, 200, { ok: true, planTotal });
                 }
                 catch (err) {
                     json(res, 500, { error: err instanceof Error ? err.message : String(err) });
@@ -3501,6 +3775,9 @@ async function createSession(deps, opts) {
         tasksPollStopped = true;
         if (tasksPoll)
             clearTimeout(tasksPoll);
+        gitPollStopped = true;
+        if (gitPoll)
+            clearTimeout(gitPoll);
         // Stop the Telegram serve loop + dispose its per-chat sessions.
         if (serveController)
             await serveController.stop().catch(() => { });