@repo-os/repoos 0.5.62 → 0.5.63

package/dist/.build-info.json

@@ -1,5 +1,5 @@
 {
-  "hash": "0264ffb217828c3c1e53be5b58abbe310ff9b749bb8bd2c916d4d22e6dd164ac",
-  "version": "0.5.62",
+  "hash": "78aa3a42b046cff40b116d148fb0658d06e650ee59dc63efa098b4a2ef4a44f4",
+  "version": "0.5.63",
   "devUi": false
 }

package/dist/.build-stamp.json

@@ -1,3 +1,3 @@
 {
-  "generatedAt": "2026-10-02T12:12:44.891Z"
+  "generatedAt": "2026-10-04T01:58:52.804Z"
 }

package/dist/commands/init.js

@@ -432,8 +432,6 @@ const ENV_EXAMPLE = `# Copy to .env and fill in what you need — .env is gitign
 # REPOOS_OPENROUTER_API_KEY=...
 # REPOOS_OPENCODE_GO_API_KEY=...
 # REPOOS_DEEPINFRA_API_KEY=...
-# REPOOS_GITHUB_COPILOT_TOKEN=...         # classic PAT — billing endpoints reject fine-grained tokens
-# REPOOS_GITHUB_COPILOT_SCOPE=            # empty = personal plan; org:<name> / enterprise:<name> for centrally billed
 # REPOOS_WHISPER_KEY=...                  # or GROQ_API_KEY / OPENAI_API_KEY directly
 
 # --- Infrastructure ---

package/dist/commands/tasks.js

@@ -15,7 +15,7 @@ import { c, statusColor, priorityColor } from "../cli/colors.js";
 import { patchTaskFile } from "../server/write.js";
 import { writeHandoffRequest } from "../server/handoff-request.js";
 import { isAncestor } from "../core/git.js";
-import { parseShotPlan } from "../core/shot-plan.js";
+import { declaredShotsSectionContent, parseShotPlan } from "../core/shot-plan.js";
 import { normalizeSectionHeading, replaceSection } from "../core/task.js";
 /**
  * RepoOS facade rooted at the LIVE BOARD's checkout (the main checkout), even
@@ -318,6 +318,7 @@ const UPDATE_FLAGS = {
     branch: "branch",
     "assigned-to": "assignedTo",
     "needs-input": "needsInput",
+    "needs-merge": "needsMerge",
     questions: "questions",
     section: "section",
 };
@@ -342,7 +343,7 @@ function shotsSectionContent(raw) {
     if (parsed.errors.length || parsed.shots.length === 0) {
         throw new Error(`Invalid --shots JSON: ${parsed.errors.join("; ") || "expected at least one shot"}`);
     }
-    return `\`\`\`json\n${JSON.stringify(parsed.shots, null, 2)}\n\`\`\``;
+    return declaredShotsSectionContent(parsed.shots);
 }
 /**
  * `repoos update <id> [--title ...] [--area ...] [--story ...] [--priority ...]
@@ -361,7 +362,7 @@ function shotsSectionContent(raw) {
  */
 export function cmdUpdate(args) {
     const [id, ...rest] = args;
-    const usage = '  Usage: repoos update <id> [--title "..."] [--area a,b] [--story "Delivery slice"] [--depends-on 0542,0538] [--priority p] [--type t] [--body "..."|-] [--branch b] [--assigned-to ai|human] [--needs-input true|false] [--questions "Question one\\nQuestion two"] [--clear-questions] [--shots "<JSON list>"|- | --section "<heading>" --section-body ...] [--force]';
+    const usage = '  Usage: repoos update <id> [--title "..."] [--area a,b] [--story "Delivery slice"] [--depends-on 0542,0538] [--priority p] [--type t] [--body "..."|-] [--branch b] [--assigned-to ai|human] [--needs-input true|false] [--needs-merge true|false] [--questions "Question one\\nQuestion two"] [--clear-questions] [--shots "<JSON list>"|- | --section "<heading>" --section-body ...] [--force]';
     if (!id) {
         console.error(c.red(usage));
         process.exitCode = 1;
@@ -435,13 +436,16 @@ export function cmdUpdate(args) {
             process.exitCode = 1;
             return;
         }
-        if (field === "needsInput") {
+        if (field === "needsInput" || field === "needsMerge") {
             if (raw !== "true" && raw !== "false") {
-                console.error(c.red(`  --needs-input must be true or false`));
+                console.error(c.red(`  --${field === "needsInput" ? "needs-input" : "needs-merge"} must be true or false`));
                 process.exitCode = 1;
                 return;
             }
-            patch.needsInput = raw === "true";
+            if (field === "needsInput")
+                patch.needsInput = raw === "true";
+            else
+                patch.needsMerge = raw === "true";
         }
         else if (field === "questions") {
             patch.questions = parseQuestions(raw);

package/dist/commands/ui-harness.d.ts

@@ -6,10 +6,20 @@ export interface PreviewServer {
 export interface SmokeConsoleMessage {
     type(): string;
     text(): string;
+    /** Where the console message originated — used to key resource errors to
+     * the URL that failed, so known-benign 404s can be tolerated per-URL. */
+    location(): {
+        url: string;
+    };
+}
+export interface SmokeResponse {
+    status(): number;
+    url(): string;
 }
 export interface SmokePage {
     on(event: "console", handler: (msg: SmokeConsoleMessage) => void): void;
     on(event: "pageerror", handler: (err: Error) => void): void;
+    on(event: "response", handler: (res: SmokeResponse) => void): void;
     route(url: string, handler: (route: {
         fetch(): Promise<{
             json(): Promise<unknown>;
@@ -41,6 +51,22 @@ export interface SmokePage {
         timeout?: number;
     }): Promise<unknown>;
     waitForTimeout(ms: number): Promise<void>;
+    /**
+     * Real pointer click: unlike `el.click()` in evaluate, the browser runs the
+     * focus-on-click default action, which is the whole point of the #0638
+     * smoke flow (a teleported input must hold focus after a real click).
+     */
+    click(selector: string, options?: {
+        timeout?: number;
+    }): Promise<void>;
+    /** Programmatic focus — still dispatches focusin/focusout normally. */
+    focus(selector: string, options?: {
+        timeout?: number;
+    }): Promise<void>;
+    keyboard: {
+        type(text: string): Promise<void>;
+        press(key: string): Promise<void>;
+    };
     route(url: string, handler: (route: {
         fetch(): Promise<{
             json(): Promise<unknown>;

package/dist/commands/ui-smoke.js

@@ -27,6 +27,43 @@ function makeSmokeFixture() {
     const root = mkdtempSync(join(tmpdir(), "repoos-smoke-"));
     mkdirSync(join(root, "work"), { recursive: true });
     writeFileSync(join(root, "repoos.toml"), 'theme = "dark"\nuiTheme = "classic"\n\n');
+    // A review task with a stored report drives the send-to-engineer dialog
+    // flow below (#0638). No `branch` in the frontmatter — review recovery
+    // skips branchless tasks, so the fixture server never spawns a reviewer
+    // for it, and the seeded report is never treated as interrupted work.
+    const now = new Date().toISOString();
+    writeFileSync(join(root, "work", "9001-smoke-review-fixture.md"), [
+        "---",
+        'id: "9001"',
+        "title: Smoke review fixture",
+        "type: feature",
+        "status: review",
+        "priority: p2",
+        "area: web",
+        `created_at: "${now}"`,
+        `updated_at: "${now}"`,
+        "---",
+        "",
+        "Fixture task for the send-to-engineer note dialog in the UI smoke test.",
+        "",
+    ].join("\n"));
+    mkdirSync(join(root, ".repoos", "reviews"), { recursive: true });
+    writeFileSync(join(root, ".repoos", "reviews", "9001.md"), [
+        "---",
+        'task: "9001"',
+        `at: "${now}"`,
+        "agent: reviewer",
+        "cli: smoke",
+        "model: smoke",
+        "branch: feat/smoke-fixture",
+        "state: ok",
+        "---",
+        "",
+        "## Verdict",
+        "",
+        "good to go",
+        "",
+    ].join("\n"));
     return root;
 }
 /**
@@ -59,9 +96,31 @@ async function runUISmokeTest() {
         const page = await context.newPage();
         const consoleErrs = [];
         const pageErrors = [];
+        // Known-benign API 404s, tracked by URL: the drawer's best-effort usage
+        // fetch (`loadTaskUsage`) 404s for a task with no recorded sessions, and
+        // the browser logs every failed resource as a console error. The app
+        // handles the response (same precedent as the /api/ pageerror filter
+        // below), so one tolerated 404 per such URL keeps the gate honest without
+        // masking real failures.
+        const benign404Urls = new Set();
+        // Resource-failure console errors, keyed to the URL that failed so each
+        // can be matched against `benign404Urls` rather than tolerated by count.
+        const resourceErrs = [];
         page.on("console", (msg) => {
-            if (msg.type() === "error")
-                consoleErrs.push(msg.text());
+            if (msg.type() !== "error")
+                return;
+            const text = msg.text();
+            if (text.startsWith("Failed to load resource")) {
+                resourceErrs.push({ text, url: msg.location().url });
+            }
+            else {
+                consoleErrs.push(text);
+            }
+        });
+        page.on("response", (res) => {
+            if (res.status() === 404 && /\/api\/tasks\/[^/]+\/stats$/.test(res.url())) {
+                benign404Urls.add(res.url());
+            }
         });
         page.on("pageerror", (err) => {
             // WebKit reports failed optional API requests as page errors when the
@@ -192,6 +251,104 @@ async function runUISmokeTest() {
         });
         await page.waitForTimeout(500);
         await assertUtilitySpacing("settings");
+        // ── Teleported text fields take real clicks and focus (#0638) ───────
+        // The area picker's free-text input and the send-to-engineer note both
+        // live in body-teleported layers above a modal drawer. The drawer's Radix
+        // focus trap used to yank focus straight back (no caret, no typing), and
+        // an intermediate fix suppressed document-level focus events, which
+        // starved the global tooltip handler. The layers now pause the trap via
+        // their own radix FocusScope, so drive both flows with REAL pointer
+        // clicks (page.click, not el.click() — only real pointer events trigger
+        // the browser's focus-on-click default action): focus must stick, typing
+        // must land, and a focused control inside the layer must still raise the
+        // global tooltip.
+        const goWork = async () => {
+            await page.evaluate(() => {
+                const navItems = document.querySelectorAll(".nav-item");
+                for (const item of Array.from(navItems)) {
+                    if (item.textContent?.includes("Work"))
+                        item.click();
+                }
+            });
+            await page.waitForTimeout(500);
+        };
+        const assertActive = async (sel, what) => {
+            const ok = await page.evaluate((s) => document.activeElement === document.querySelector(s), sel);
+            if (!ok)
+                throw new Error(`${what} did not take focus on a real click (#0638)`);
+        };
+        // (a) Area picker over the New-task drawer's modal dialog.
+        await goWork();
+        await page.click(".new-btn");
+        await page.waitForTimeout(400);
+        await page.click(".drawer-tabs .tab-btn:nth-child(2)"); // Manual mode form
+        await page.waitForTimeout(200);
+        await page.click("#nt-area"); // opens the teleported picker panel
+        await page.waitForTimeout(300);
+        const areaInput = 'input[aria-label="Add a custom area"]';
+        await page.click(areaInput);
+        await assertActive(areaInput, "area picker free-text input");
+        await page.keyboard.type("smoke-area");
+        const typedArea = await page.evaluate((s) => document.querySelector(s)?.value ?? "", areaInput);
+        if (typedArea !== "smoke-area") {
+            throw new Error(`area picker input did not accept typing: "${typedArea}"`);
+        }
+        await page.keyboard.press("Enter");
+        await page.waitForTimeout(200);
+        // Enter committed the custom area, so the picker now offers to register
+        // it — a title-carrying control INSIDE the layer. Focusing it must raise
+        // the global tooltip (round-2 regression: suppressed focus events starved
+        // exactly this handler).
+        const offerBtn = 'div[data-overlay-layer="floating"] button[title]';
+        const hasOffer = await page.evaluate((s) => document.querySelector(s) !== null, offerBtn);
+        if (!hasOffer) {
+            throw new Error("custom area was not committed to the picker selection");
+        }
+        await page.focus(offerBtn);
+        await page.waitForTimeout(120);
+        const tooltipShown = await page.evaluate(() => {
+            const tip = document.querySelector(".app-tooltip");
+            return (tip instanceof HTMLElement &&
+                tip.classList.contains("show") &&
+                (tip.textContent ?? "").includes("repoos.toml"));
+        });
+        if (!tooltipShown) {
+            throw new Error("global tooltip did not appear for a focused control inside the area picker");
+        }
+        await page.keyboard.press("Escape"); // close the picker panel
+        await page.keyboard.press("Escape"); // close the new-task drawer
+        await page.waitForTimeout(300);
+        // (b) Send-to-engineer note over a review task's drawer. The fixture
+        // seeds task 9001 (status review) with a stored report so the button is
+        // enabled; the flow stops before confirming, so nothing is spawned.
+        await goWork();
+        await page.click('[data-task-id="9001"]');
+        await page.waitForTimeout(600); // drawer opens on the Review tab
+        await page.waitForFunction(() => {
+            const btn = Array.from(document.querySelectorAll("button")).find((b) => (b.textContent ?? "").includes("Send engineer"));
+            return Boolean(btn && !btn.hasAttribute("disabled"));
+        }, { timeout: 5_000 });
+        await page.evaluate(() => {
+            const btn = Array.from(document.querySelectorAll("button")).find((b) => (b.textContent ?? "").includes("Send engineer"));
+            btn.click();
+        });
+        await page.waitForTimeout(300);
+        const noteArea = "textarea.ste-note";
+        await page.click(noteArea);
+        await assertActive(noteArea, "send-to-engineer note textarea");
+        await page.keyboard.type("smoke note text");
+        const noteValue = await page.evaluate(() => document.querySelector("textarea.ste-note")?.value ?? "");
+        if (noteValue !== "smoke note text") {
+            throw new Error(`send-to-engineer note did not accept typing: "${noteValue}"`);
+        }
+        const withNote = await page.evaluate(() => (document.querySelector(".ste-actions button:nth-child(2)")?.textContent ?? "").includes("with note"));
+        if (!withNote) {
+            throw new Error("confirm button did not reflect the typed note");
+        }
+        await page.keyboard.press("Escape"); // close the note dialog (never confirmed)
+        await page.waitForTimeout(200);
+        await page.keyboard.press("Escape"); // close the drawer
+        await page.waitForTimeout(300);
         // ── UI recovery banner regression (#0420) ───────────────────────────
         // Intercept /api/health to return a build hash that differs from the
         // client's, which triggers checkUiBuild → showStaleUi on the next
@@ -229,11 +386,20 @@ async function runUISmokeTest() {
             }
         }
         // Check for zero console errors
-        if (consoleErrs.length > 0) {
-            let msg = "Console errors (" + consoleErrs.length + "): " + consoleErrs.join("; ");
-            if (pageErrors.length > 0)
-                msg += " | Page errors: " + pageErrors.join("; ");
-            throw new Error(msg);
+        {
+            // Tolerate failed-resource errors only for the known-benign stats 404
+            // URLs (the drawer's best-effort usage fetch on a task with no
+            // sessions); every other failed resource is a real failure.
+            const unexpected = resourceErrs
+                .filter((e) => !benign404Urls.has(e.url))
+                .map((e) => e.text + (e.url ? " (" + e.url + ")" : ""));
+            const fatal = [...consoleErrs, ...unexpected];
+            if (fatal.length > 0) {
+                let msg = "Console errors (" + fatal.length + "): " + fatal.join("; ");
+                if (pageErrors.length > 0)
+                    msg += " | Page errors: " + pageErrors.join("; ");
+                throw new Error(msg);
+            }
         }
         if (pageErrors.length > 0) {
             throw new Error("Page errors (" + pageErrors.length + "): " + pageErrors.join("; "));

package/dist/core/close-out-failure.d.ts

@@ -32,6 +32,13 @@ export interface CloseOutFailure {
     detail?: string;
     /** Guidance paragraph; replaces the default conflict hint when set. */
     hint?: string;
+    /**
+     * Fixed one-sentence tl;dr (cause + next action) for failure kinds the
+     * Debugger doesn't diagnose — the cause is already known, so no model run is
+     * needed. Unset for `conflict`/`validating`, whose tl;dr comes from the
+     * Debugger. The card shows the Debugger's sentence in preference when present.
+     */
+    summary?: string;
 }
 /**
  * Turn a failed close-out's recorded `phase` + `reason` into what the error

package/dist/core/close-out-failure.js

@@ -122,6 +122,7 @@ export function describeCloseOutFailure(phase, reason) {
                     "the branch and worktree are untouched. Retry Move to done when the machine is less " +
                     "loaded, or raise the budget in Settings → Close-out timeout (`closeOut.timeoutMs` in " +
                     "repoos.toml).",
+                summary: "Move to done timed out before anything merged and your branch is untouched — retry when the machine is quieter, or raise the Close-out timeout in Settings.",
             };
         }
         case "validating": {
@@ -155,6 +156,9 @@ export function describeCloseOutFailure(phase, reason) {
                 hint: inWorktree
                     ? "The task's worktree has uncommitted changes the merge would not carry, and close-out deletes the worktree with them. Commit them on the task branch, then retry."
                     : "Main's working tree has uncommitted changes that the merge would overwrite. Commit or stash them on main, then retry.",
+                summary: inWorktree
+                    ? "The task worktree has uncommitted changes — commit them on the task branch, then retry Move to done."
+                    : "Main has uncommitted changes the merge would overwrite — commit or stash them on main, then retry Move to done.",
             };
         }
         case "syncing":
@@ -166,6 +170,7 @@ export function describeCloseOutFailure(phase, reason) {
                 step: "sync",
                 detail: clean || undefined,
                 hint: "The branch could not be brought up to date with main. Fix the issue in the feature branch's worktree, then retry.",
+                summary: "RepoOS couldn't bring this branch up to date with main — fix the issue in the task worktree, then retry Move to done.",
             };
         case "publishing":
             return {
@@ -174,6 +179,7 @@ export function describeCloseOutFailure(phase, reason) {
                 step: "publish",
                 detail: clean || undefined,
                 hint: "The merge to main failed at publish time. Retry the close-out.",
+                summary: "The merge to main failed at the final publish step — retry Move to done.",
             };
         default:
             return {
@@ -182,6 +188,7 @@ export function describeCloseOutFailure(phase, reason) {
                 step: "merge",
                 detail: clean || undefined,
                 hint: "Retry the close-out. If it keeps failing, check the feature branch's worktree for issues.",
+                summary: "Move to done failed unexpectedly — retry it, and if it keeps failing, check the task worktree for issues.",
             };
     }
 }

package/dist/core/config.d.ts

@@ -186,6 +186,22 @@ export interface PreviewOverlay {
  * `auth.enabled`, leaving every other `[auth]` key at its base value.
  */
 export declare function parsePreviewOverlays(parsed: Record<string, unknown>): PreviewOverlay;
+/**
+ * Validate a repo-relative directory setting (`storiesDir` today; the shape any
+ * future sibling must satisfy). Returns the cleaned value, or `null` when
+ * unusable — the caller falls back to the default with a warning instead of
+ * pointing RepoOS outside the repo:
+ *
+ *   - empty, absolute (`/x`, `C:\x`), home-relative (`~/x`), or a backslash
+ *     path (a literal filename on POSIX, never a separator)
+ *   - any `..` segment (escaping the repo root)
+ *   - empty or `.` segments beyond the redundant `./` prefix and trailing `/`,
+ *     which are stripped so `./stories/` parses as `stories`
+ *
+ * Warning, not a load failure: a typo in `repoos.toml` must never stop the
+ * server from booting; it just gets the default directory back (#0637).
+ */
+export declare function normalizeRelativeDir(raw: unknown, key: string): string | null;
 /**
  * The preview-only override keys a repo's `repoos.toml` declares that the
  * runtime will actually apply (supported base keys only), sorted. Fail-soft: a

package/dist/core/config.js

@@ -115,6 +115,7 @@ export const DEFAULT_CONFIG = {
     docsDir: "docs",
     skillsDir: "skills",
     inputsDir: "inputs",
+    storiesDir: "stories",
     taskExtensions: [".md"],
     defaultStatus: "inbox",
     defaultAssignee: "unassigned",
@@ -161,6 +162,7 @@ export const DEFAULT_CONFIG = {
         idleShutdownMinutes: 8,
         maxServerLifetimeMinutes: 120,
         fallbackToLocal: false,
+        retryOtherHosts: false,
         maxConcurrent: 1,
     },
     // Close-out (Move to done) pipeline budget (#0573): a 6-minute wall clock
@@ -787,6 +789,48 @@ export function parsePreviewOverlays(parsed) {
 function isOverridableConfigPath(path) {
     return SUPPORTED_TOML_KEYS.includes(path);
 }
+/**
+ * Validate a repo-relative directory setting (`storiesDir` today; the shape any
+ * future sibling must satisfy). Returns the cleaned value, or `null` when
+ * unusable — the caller falls back to the default with a warning instead of
+ * pointing RepoOS outside the repo:
+ *
+ *   - empty, absolute (`/x`, `C:\x`), home-relative (`~/x`), or a backslash
+ *     path (a literal filename on POSIX, never a separator)
+ *   - any `..` segment (escaping the repo root)
+ *   - empty or `.` segments beyond the redundant `./` prefix and trailing `/`,
+ *     which are stripped so `./stories/` parses as `stories`
+ *
+ * Warning, not a load failure: a typo in `repoos.toml` must never stop the
+ * server from booting; it just gets the default directory back (#0637).
+ */
+export function normalizeRelativeDir(raw, key) {
+    const invalid = (why) => {
+        console.warn(`[config] ${key} must be a repo-relative directory (${why}) — ignoring "${raw}"`);
+        return null;
+    };
+    if (typeof raw !== "string")
+        return invalid("not a string");
+    let value = raw.trim();
+    if (!value)
+        return invalid("empty");
+    if (/^[/\\]/.test(value) || /^[A-Za-z]:/.test(value) || value.startsWith("~")) {
+        return invalid("must not be absolute or home-relative");
+    }
+    value = value.replace(/\/+$/, "");
+    while (value.startsWith("./"))
+        value = value.slice(2);
+    if (!value)
+        return invalid("empty");
+    for (const segment of value.split("/")) {
+        if (segment === "..")
+            return invalid('must not contain ".."');
+        if (!segment || segment === "." || segment.includes("\\")) {
+            return invalid("must not contain empty or dot segments");
+        }
+    }
+    return value;
+}
 /**
  * The preview-only override keys a repo's `repoos.toml` declares that the
  * runtime will actually apply (supported base keys only), sorted. Fail-soft: a
@@ -846,6 +890,15 @@ export function loadConfig(rootArg, options = {}) {
             cfg.skillsDir = get("skillsDir");
         if (typeof get("inputsDir") === "string")
             cfg.inputsDir = get("inputsDir");
+        // storiesDir (#0637): validated, not trusted — an absolute or escaping
+        // value falls back to the default ("stories") with a warning, so a bad
+        // entry can never point the story registry or the close-out drift check
+        // outside the repo. Present-but-wrong-typed values warn the same way.
+        const storiesDirRaw = get("storiesDir");
+        if (storiesDirRaw !== undefined) {
+            cfg.storiesDir =
+                normalizeRelativeDir(storiesDirRaw, "storiesDir") ?? DEFAULT_CONFIG.storiesDir;
+        }
         if (Array.isArray(get("taskExtensions")))
             cfg.taskExtensions = get("taskExtensions");
         if (typeof get("defaultStatus") === "string")
@@ -1315,6 +1368,25 @@ export function loadConfig(rootArg, options = {}) {
         if (typeof rvReleases === "boolean") {
             cfg.remoteValidation = { ...cfg.remoteValidation, useForReleases: rvReleases };
         }
+        const rvRetry = parsed["remoteValidation.retryOtherHosts"];
+        if (typeof rvRetry === "boolean") {
+            cfg.remoteValidation = { ...cfg.remoteValidation, retryOtherHosts: rvRetry };
+        }
+        // Default: true when 2+ tailscale hosts are configured, else false. The
+        // guard tests the TOML key, NOT the merged object: DEFAULT_CONFIG already
+        // fills `retryOtherHosts: false`, so a merged-object `=== undefined` check
+        // could never fire and the dynamic default was dead code (#0632 review
+        // round 1). An explicit `false` in repoos.toml must stay false; an absent
+        // key reads as "unset" and gets the conditional default. The host list is
+        // already folded (shorthand `tailscaleHost` + list + [[rows]]) above, so
+        // its length is the resolved pool size.
+        const hostCount = cfg.remoteValidation?.tailscaleHosts?.length ?? 0;
+        if (rvRetry === undefined &&
+            cfg.remoteValidation?.enabled === true &&
+            cfg.remoteValidation?.provider === "tailscale" &&
+            hostCount >= 2) {
+            cfg.remoteValidation = { ...cfg.remoteValidation, retryOtherHosts: true };
+        }
         // [closeOut] section — wall-clock budget for one Move-to-done attempt
         // (#0573). Invalid/negative values are clamped back to the default with a
         // clear warning rather than failing config load: a typo in repoos.toml must
@@ -1348,13 +1420,9 @@ export function loadConfig(rootArg, options = {}) {
     const deepinfraApiKey = process.env.REPOOS_DEEPINFRA_API_KEY;
     if (deepinfraApiKey)
         modelProviders.deepinfraApiKey = deepinfraApiKey;
-    const githubCopilotToken = process.env.REPOOS_GITHUB_COPILOT_TOKEN;
-    if (githubCopilotToken)
-        modelProviders.githubCopilotToken = githubCopilotToken;
     if (modelProviders.openrouterApiKey ||
         modelProviders.opencodeGoApiKey ||
-        modelProviders.deepinfraApiKey ||
-        modelProviders.githubCopilotToken) {
+        modelProviders.deepinfraApiKey) {
         cfg.modelProviders = modelProviders;
     }
     cfg.builtInAgents = loadBuiltInAgentsConfig(root, cfg.cacheDir);
@@ -1502,6 +1570,15 @@ export function getConfigSchema() {
             default: DEFAULT_CONFIG.skillsDir,
             description: "Directory holding skills (relative to repo root)",
         },
+        {
+            key: "storiesDir",
+            label: "Stories directory",
+            type: "string",
+            tier: "guarded",
+            restartRequired: true,
+            default: DEFAULT_CONFIG.storiesDir,
+            description: "Directory holding story definitions (relative to repo root)",
+        },
         {
             key: "taskExtensions",
             label: "Task extensions",
@@ -1744,6 +1821,15 @@ export function getConfigSchema() {
             default: false,
             description: "Cut releases on the same Hetzner runner as close-outs (off by default — a release is watched live, so the provision delay reads as a regression; opt in per repo). Only applies when the runner is enabled.",
         },
+        {
+            key: "remoteValidation.retryOtherHosts",
+            label: "Remote validation: retry on other hosts",
+            type: "boolean",
+            tier: "restart",
+            restartRequired: true,
+            default: false,
+            description: "When a transient failure occurs on one tailscale host, retry the run on another healthy, free host before falling back to local. Default true when 2+ hosts are configured.",
+        },
         {
             key: "dev.inspector.enabled",
             label: "Copy inspector",
@@ -1792,6 +1878,7 @@ export const SUPPORTED_TOML_KEYS = [
     "docsDir",
     "skillsDir",
     "inputsDir",
+    "storiesDir",
     "cacheDir",
     "taskExtensions",
     // Board behavior
@@ -1933,6 +2020,7 @@ export const SUPPORTED_TOML_KEYS = [
     "remoteValidation.maxServerLifetimeMinutes",
     "remoteValidation.maxConcurrent",
     "remoteValidation.fallbackToLocal",
+    "remoteValidation.retryOtherHosts",
     "remoteValidation.useForReleases",
 ];
 function serializeTomlVal(val) {

package/dist/core/copy-inspector.d.ts

@@ -15,6 +15,19 @@ export declare function resolveCopyInspectorTarget(root: string, file: string, l
     repoRel: string;
     line: number | null;
 } | null;
+/**
+ * Resolve a repo-relative file without the copy-inspector's `src/` restriction,
+ * so callers can open other tracked files (a task markdown under `work/`) in
+ * the configured editor. Same escape guard as {@link resolveCopyInspectorTarget},
+ * but hardened against symlinks: both the repo root and the target are
+ * `realpath`-resolved, and the REAL target must stay inside the REAL root, so a
+ * symlink pointing outside the repo cannot smuggle an external file through.
+ * The returned `repoRel` is the real location (what the editor should open).
+ */
+export declare function resolveRepoFileTarget(root: string, file: string): {
+    absPath: string;
+    repoRel: string;
+} | null;
 /** Split a configured editor command into argv (no shell). Supports " and ' quotes. */
 export declare function tokenizeEditorCommand(command: string): string[];
 /**

package/dist/core/copy-inspector.js

@@ -2,7 +2,7 @@
  * Dev-only click-to-locate UI copy (#0509): path guards and editor-command parsing.
  * Zero runtime dependencies — spawn uses argv arrays built here.
  */
-import { existsSync, readFileSync, statSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 /** True when this repo checkout ships editable RepoOS UI sources. */
 export function hasRepoOsUiSource(root) {
@@ -52,6 +52,41 @@ export function resolveCopyInspectorTarget(root, file, line) {
     const lineNum = typeof line === "number" && Number.isFinite(line) && line >= 1 ? Math.floor(line) : null;
     return { absPath: abs, repoRel: back.replace(/\\/g, "/"), line: lineNum };
 }
+/**
+ * Resolve a repo-relative file without the copy-inspector's `src/` restriction,
+ * so callers can open other tracked files (a task markdown under `work/`) in
+ * the configured editor. Same escape guard as {@link resolveCopyInspectorTarget},
+ * but hardened against symlinks: both the repo root and the target are
+ * `realpath`-resolved, and the REAL target must stay inside the REAL root, so a
+ * symlink pointing outside the repo cannot smuggle an external file through.
+ * The returned `repoRel` is the real location (what the editor should open).
+ */
+export function resolveRepoFileTarget(root, file) {
+    const rel = file.trim().replace(/\\/g, "/");
+    if (!rel || rel.includes("..") || rel.startsWith("/"))
+        return null;
+    const abs = resolve(root, rel);
+    let realRoot;
+    let realAbs;
+    try {
+        realRoot = realpathSync(root);
+        realAbs = realpathSync(abs);
+    }
+    catch {
+        return null;
+    }
+    const back = relative(realRoot, realAbs);
+    if (!back || back.startsWith("..") || isAbsolute(back))
+        return null;
+    try {
+        if (!statSync(realAbs).isFile())
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return { absPath: realAbs, repoRel: back.replace(/\\/g, "/") };
+}
 /** Split a configured editor command into argv (no shell). Supports " and ' quotes. */
 export function tokenizeEditorCommand(command) {
     const out = [];