@robota-sdk/agent-command 3.0.0-beta.82 → 3.0.0-beta.84

package/src/provider/provider-command-setup.ts

@@ -87,11 +87,12 @@ export function runProviderAddSetup(
   ui: IUserInteraction,
   flow: IProviderSetupFlowState,
   options: IProviderCommandModuleOptions,
+  isSetupRequired: boolean,
 ): Promise<ICommandResult> {
   return runProviderSetupAsk(
     ui,
     flow,
-    (input) => completeProviderSetup(input, options),
+    (input) => completeProviderSetup(input, options, isSetupRequired),
     'Provider setup cancelled.',
   );
 }
@@ -99,12 +100,24 @@ export function runProviderAddSetup(
 function completeProviderSetup(
   input: IProviderSetupInput,
   options: IProviderCommandModuleOptions,
+  isSetupRequired: boolean,
 ): ICommandResult {
   const target = options.settings.readTargetSettings();
   const patch = buildProviderSetupPatch(input, {
     providerDefinitions: options.providerDefinitions,
   });
   options.settings.writeTargetSettings(mergeProviderPatch(target, patch));
+  // #3282 §3: the session's own live setup-mode state (never settings — an ordinary env-default
+  // session also has no persisted `currentProvider`, and restarts like any other session). Only a
+  // session that itself started with a placeholder provider hot-swaps the real one in; every other
+  // `/provider add`, even a session's first EVER persisted profile, restarts as before.
+  if (isSetupRequired) {
+    return {
+      message: `Provider ${input.profile} configured.`,
+      success: true,
+      hostActions: [{ type: 'provider-hot-swap', profileName: input.profile }],
+    };
+  }
   return {
     message: `Provider ${input.profile} configured. Restarting...`,
     success: true,

package/src/rewind/__tests__/rewind-command-module.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, it, vi } from 'vitest';
+import { afterEach, describe, expect, it, vi } from 'vitest';
 import type {
   IEditCheckpointInspection,
   IEditCheckpointRestoreResult,
@@ -252,4 +252,35 @@ describe('executeRewindCommand', () => {
     expect(result?.success).toBe(false);
     expect(result?.message).toBe('Unknown edit checkpoint');
   });
+
+  describe('in a session built without a checkpoint store', () => {
+    afterEach(() => {
+      vi.restoreAllMocks();
+    });
+
+    it('tells a restricted workspace to trust it, for every subcommand', async () => {
+      vi.spyOn(process, 'platform', 'get').mockReturnValue('linux');
+      const session = createInteractiveSession();
+
+      for (const args of ['', 'list', 'inspect turn-0001', 'restore turn-0001', 'branches']) {
+        const result = await session.executeCommand('rewind', args);
+        expect(result?.success).toBe(false);
+        expect(result?.message).toBe(
+          'Edit checkpoints need a trusted workspace: run robota trust --yes, then restart robota.',
+        );
+      }
+    });
+
+    it('says why on a host that cannot prove a project write is safe, without naming trust', async () => {
+      vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin');
+      const session = createInteractiveSession();
+
+      const result = await session.executeCommand('rewind', 'list');
+
+      expect(result?.success).toBe(false);
+      // #3289 §3: plain words naming the feature ("Rewind"), not the internal write-containment reason.
+      expect(result?.message).toBe("Rewind isn't available on this computer yet.");
+      expect(result?.message).not.toContain('trust');
+    });
+  });
 });

package/src/rewind/rewind-command.ts

@@ -1,4 +1,5 @@
 import {
+  EditCheckpointsUnavailableError,
   inspectCommandEditCheckpoint,
   listCommandEditCheckpoints,
   restoreCommandEditCheckpoint,
@@ -121,13 +122,33 @@ function formatRollbackResult(result: IEditCheckpointRestoreResult): ICommandRes
   };
 }
 
+/** A restricted workspace is the one case the user fixes with a command; the rest say why. */
+function unavailableMessage(error: EditCheckpointsUnavailableError): string {
+  return error.reason === 'restricted-workspace'
+    ? 'Edit checkpoints need a trusted workspace: run robota trust --yes, then restart robota.'
+    : error.message;
+}
+
 function formatError(error: Error | string): ICommandResult {
   return {
-    message: error instanceof Error ? error.message : String(error),
+    message:
+      error instanceof EditCheckpointsUnavailableError
+        ? unavailableMessage(error)
+        : error instanceof Error
+          ? error.message
+          : String(error),
     success: false,
   };
 }
 
+function list(context: ICommandHostCheckpoints): ICommandResult {
+  try {
+    return formatList(listCommandEditCheckpoints(context));
+  } catch (error) {
+    return formatError(error instanceof Error ? error : String(error));
+  }
+}
+
 function inspect(
   context: ICommandHostCheckpoints,
   checkpointId: string | undefined,
@@ -222,7 +243,7 @@ export async function executeRewindCommand(
   const subcommand = args[SUBCOMMAND_INDEX] ?? 'list';
 
   if (subcommand === 'list') {
-    return formatList(listCommandEditCheckpoints(context));
+    return list(context);
   }
 
   if (subcommand === 'inspect') {

package/src/schedule/__tests__/loop-command-functional.test.ts

@@ -10,6 +10,15 @@ afterEach(async () => {
   harness = undefined;
 });
 
+/**
+ * #3288 §1: a bare/interval-only loop now asks before it falls back to the default prompt, even in
+ * this harness's "typed the command" (`source: 'user'`) path — subscribing an `askHandler` gives
+ * `getUserInteraction()` a live port (REMOTE-007 D4a), so these functional tests stay interactive
+ * rather than hitting the new headless refusal. Always answers "Start".
+ */
+const confirmDefaultStart = async (): Promise<{ type: 'answer'; values: readonly string[] }> =>
+  ({ type: 'answer', values: ['start'] });
+
 describe('/loop command in a real interactive session', () => {
   it('re-reads an omitted self-paced prompt before each iteration without changing explicit prompts', async () => {
     let prompt = 'project first';
@@ -18,6 +27,7 @@ describe('/loop command in a real interactive session', () => {
       turns: [{ text: 'first' }, { text: 'second' }],
       commandModules: [createScheduleCommandModule({ defaultPrompt: 'fallback', resolveDefaultPrompt })],
       resolveDefaultLoopPrompt: resolveDefaultPrompt,
+      askHandler: confirmDefaultStart,
       backgroundTasks: true,
       persistence: true,
     });
@@ -51,6 +61,7 @@ describe('/loop command in a real interactive session', () => {
       turns: [{ text: 'first' }, { text: 'second' }],
       commandModules: [createScheduleCommandModule({ defaultPrompt: 'fallback', resolveDefaultPrompt })],
       resolveDefaultLoopPrompt: resolveDefaultPrompt,
+      askHandler: confirmDefaultStart,
       backgroundTasks: true,
       persistence: true,
     });
@@ -109,6 +120,7 @@ describe('/loop command in a real interactive session', () => {
       turns: [{ text: 'done' }],
       commandModules: [createScheduleCommandModule({ defaultPrompt: 'fallback', resolveDefaultPrompt })],
       resolveDefaultLoopPrompt: resolveDefaultPrompt,
+      askHandler: confirmDefaultStart,
       backgroundTasks: true,
       persistence: true,
     });
@@ -297,6 +309,7 @@ describe('/loop command in a real interactive session', () => {
     harness = scriptedSession({
       turns: [{ text: 'unused' }],
       commandModules: [createScheduleCommandModule({ defaultPrompt: maintenancePrompt })],
+      askHandler: confirmDefaultStart,
       backgroundTasks: true,
       persistence: true,
     });

package/src/schedule/__tests__/loop-command.test.ts

@@ -2,15 +2,27 @@ import { describe, expect, it, vi } from 'vitest';
 
 import { executeLoopCommand } from '../loop-command.js';
 
+import type { ILoopInvocationContext } from '../loop-command.js';
 import { createTestAgentJobHost } from '@robota-sdk/agent-framework/testing';
 
+/**
+ * #3288 §1: every default-prompt form (bare or interval-only) is gated on confirmation — an
+ * interactive invocation with an ask port that answers Start, for a test whose OWN point is
+ * something else (default-prompt resolution, cadence, etc.), not the confirmation gate itself.
+ */
+function interactiveStart(): ILoopInvocationContext {
+  return { ui: { ask: vi.fn().mockResolvedValue({ type: 'answer', values: ['start'] }) }, source: 'user' };
+}
+
 describe('fixed in-session loop', () => {
   it('uses the host maintenance prompt for interval-only forms', async () => {
     const spawnScheduledWake = vi.fn().mockResolvedValue({ id: 'loop_default' });
     const host = createTestAgentJobHost({ spawnScheduledWake });
     const options = { defaultPrompt: 'Tend only the current task and its PR.' };
 
-    expect((await executeLoopCommand(host, vi.fn(), '5m', options)).success).toBe(true);
+    expect(
+      (await executeLoopCommand(host, vi.fn(), '5m', options, interactiveStart())).success,
+    ).toBe(true);
     expect(spawnScheduledWake).toHaveBeenLastCalledWith(
       expect.objectContaining({
         cronExpression: expect.any(String),
@@ -27,7 +39,10 @@ describe('fixed in-session loop', () => {
     const host = createTestAgentJobHost({ spawnScheduledWake, createSelfPacedLoop });
     const options = { defaultPrompt: 'Tend the current task.' };
 
-    expect((await executeLoopCommand(host, vi.fn(), '', options)).success).toBe(true);
+    expect(
+      (await executeLoopCommand(host, vi.fn(), '', options, interactiveStart())).success,
+    ).toBe(true);
+    // An explicit prompt is never gated — no invocation (headless) needed to succeed.
     expect((await executeLoopCommand(host, vi.fn(), 'check the build')).success).toBe(true);
     expect(createSelfPacedLoop.mock.calls.map(([prompt]) => prompt)).toEqual([
       options.defaultPrompt,
@@ -45,9 +60,13 @@ describe('fixed in-session loop', () => {
     const resolveDefaultPrompt = vi.fn().mockReturnValue('current file prompt');
     const options = { defaultPrompt: 'built-in prompt', resolveDefaultPrompt };
 
-    expect((await executeLoopCommand(host, vi.fn(), '', options)).success).toBe(true);
+    expect(
+      (await executeLoopCommand(host, vi.fn(), '', options, interactiveStart())).success,
+    ).toBe(true);
     expect(createSelfPacedLoop).toHaveBeenCalledWith('current file prompt', { useDefaultPrompt: true });
-    expect((await executeLoopCommand(host, vi.fn(), '5m', options)).success).toBe(true);
+    expect(
+      (await executeLoopCommand(host, vi.fn(), '5m', options, interactiveStart())).success,
+    ).toBe(true);
     expect(spawnScheduledWake).toHaveBeenCalledWith(expect.objectContaining({
       agentInstruction: 'current file prompt', sessionLoopDefaultPrompt: true,
     }));
@@ -358,3 +377,218 @@ describe('fixed in-session loop', () => {
     },
   );
 });
+
+/**
+ * #3288 §1: every form that falls back to the host's default maintenance prompt — bare `/loop` or
+ * an interval-only `/loop <N><s|m|h|d>` (self-paced or fixed cadence) — keeps working on its own for
+ * up to 7 days: a standing commitment the operator never typed, gated the same way regardless of
+ * which form reached it. An explicit prompt is the operator's own instruction and is never gated.
+ * A model-invoked call is always refused outright; an interactive one (an ask port attached) asks;
+ * a headless one (no ask port — print mode, a scheduled run) is refused too, the same reason as the
+ * model: nobody is there to say yes to a loop that can run for a week.
+ */
+describe('/loop asks before starting on its own (#3288 §1)', () => {
+  function askResolving(value: 'start' | 'cancel'): ReturnType<typeof vi.fn> {
+    return vi.fn().mockResolvedValue({ type: 'answer', values: [value] });
+  }
+
+  it('asks before creating a bare self-paced loop, and creates it on Start', async () => {
+    const createSelfPacedLoop = vi.fn().mockResolvedValue({
+      loopId: 'loop_default',
+      expiresAt: '2030-01-01T00:00:00.000Z',
+    });
+    const host = createTestAgentJobHost({ createSelfPacedLoop });
+    const ask = askResolving('start');
+    const options = { defaultPrompt: 'Tend the current task.\nCheck CI when it finishes.' };
+
+    const result = await executeLoopCommand(host, vi.fn(), '', options, { ui: { ask }, source: 'user' });
+
+    expect(ask).toHaveBeenCalledTimes(1);
+    const request = ask.mock.calls[0]![0] as { title: string; options: Array<{ value: string }> };
+    expect(request.title).toContain('Start a loop that keeps working on its own for up to 7 days');
+    expect(request.title).toContain('Tend the current task.');
+    expect(request.title).not.toContain('Check CI when it finishes.');
+    expect(request.options.map((option) => option.value)).toEqual(['start', 'cancel']);
+    expect(createSelfPacedLoop).toHaveBeenCalledWith('Tend the current task.\nCheck CI when it finishes.', {
+      useDefaultPrompt: true,
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('does not create the loop when the user cancels', async () => {
+    const createSelfPacedLoop = vi.fn();
+    const host = createTestAgentJobHost({ createSelfPacedLoop });
+    const ask = askResolving('cancel');
+    const options = { defaultPrompt: 'Tend the current task.' };
+
+    const result = await executeLoopCommand(host, vi.fn(), '', options, { ui: { ask }, source: 'user' });
+
+    expect(createSelfPacedLoop).not.toHaveBeenCalled();
+    expect(result).toMatchObject({ success: true, message: 'Loop not started.' });
+  });
+
+  it('treats a dismissed (cancelled) ask the same as Cancel', async () => {
+    const createSelfPacedLoop = vi.fn();
+    const host = createTestAgentJobHost({ createSelfPacedLoop });
+    const ask = vi.fn().mockResolvedValue({ type: 'cancelled' });
+    const options = { defaultPrompt: 'Tend the current task.' };
+
+    const result = await executeLoopCommand(host, vi.fn(), '', options, { ui: { ask }, source: 'user' });
+
+    expect(createSelfPacedLoop).not.toHaveBeenCalled();
+    expect(result.success).toBe(true);
+    expect(result.message).toBe('Loop not started.');
+  });
+
+  it('lists other active loops in the confirmation', async () => {
+    const createSelfPacedLoop = vi.fn().mockResolvedValue({
+      loopId: 'loop_new',
+      expiresAt: '2030-01-01T00:00:00.000Z',
+    });
+    const host = createTestAgentJobHost({
+      createSelfPacedLoop,
+      listSelfPacedLoops: () => [
+        {
+          loopId: 'loop_existing',
+          instruction: 'watch CI',
+          phase: 'waiting',
+          createdAt: '2026-09-24T00:00:00.000Z',
+          expiresAt: '2026-10-01T00:00:00.000Z',
+          revision: 1,
+          generation: 1,
+          fallbackUsed: false,
+        },
+      ],
+    });
+    const ask = askResolving('start');
+
+    await executeLoopCommand(host, vi.fn(), '', { defaultPrompt: 'Tend.' }, { ui: { ask }, source: 'user' });
+
+    const request = ask.mock.calls[0]![0] as { description?: string };
+    expect(request.description).toContain('loop_existing');
+  });
+
+  it('refuses a model-invoked bare loop outright, without asking', async () => {
+    const createSelfPacedLoop = vi.fn();
+    const host = createTestAgentJobHost({ createSelfPacedLoop });
+    const ask = vi.fn();
+    const options = { defaultPrompt: 'Tend the current task.' };
+
+    const result = await executeLoopCommand(host, vi.fn(), '', options, { ui: { ask }, source: 'model' });
+
+    expect(ask).not.toHaveBeenCalled();
+    expect(createSelfPacedLoop).not.toHaveBeenCalled();
+    expect(result.success).toBe(false);
+    expect(result.message).toContain('/loop');
+  });
+
+  it('refuses a model-invoked bare loop even with no interactive renderer attached', async () => {
+    const createSelfPacedLoop = vi.fn();
+    const host = createTestAgentJobHost({ createSelfPacedLoop });
+    const options = { defaultPrompt: 'Tend the current task.' };
+
+    const result = await executeLoopCommand(host, vi.fn(), '', options, { ui: undefined, source: 'model' });
+
+    expect(createSelfPacedLoop).not.toHaveBeenCalled();
+    expect(result.success).toBe(false);
+  });
+
+  it('refuses a bare loop headless (no ask port attached) — never proceeds unconfirmed', async () => {
+    const createSelfPacedLoop = vi.fn();
+    const host = createTestAgentJobHost({ createSelfPacedLoop });
+    const options = { defaultPrompt: 'Tend the current task.' };
+
+    const result = await executeLoopCommand(host, vi.fn(), '', options, { ui: undefined, source: 'user' });
+
+    expect(createSelfPacedLoop).not.toHaveBeenCalled();
+    expect(result.success).toBe(false);
+    expect(result.message).toContain('needs someone to confirm it');
+    expect(result.message).toContain('/loop <prompt>');
+  });
+
+  it('refuses an interval-only default-prompt loop headless too, the same as bare', async () => {
+    const spawnScheduledWake = vi.fn();
+    const host = createTestAgentJobHost({ spawnScheduledWake });
+    const options = { defaultPrompt: 'Tend the current task.' };
+
+    const result = await executeLoopCommand(host, vi.fn(), '1h', options, { ui: undefined, source: 'user' });
+
+    expect(spawnScheduledWake).not.toHaveBeenCalled();
+    expect(result.success).toBe(false);
+    expect(result.message).toContain('needs someone to confirm it');
+  });
+
+  it('refuses a model-invoked interval-only default-prompt loop outright, without asking', async () => {
+    const spawnScheduledWake = vi.fn();
+    const host = createTestAgentJobHost({ spawnScheduledWake });
+    const ask = vi.fn();
+    const options = { defaultPrompt: 'Tend the current task.' };
+
+    const result = await executeLoopCommand(host, vi.fn(), '1h', options, { ui: { ask }, source: 'model' });
+
+    expect(ask).not.toHaveBeenCalled();
+    expect(spawnScheduledWake).not.toHaveBeenCalled();
+    expect(result.success).toBe(false);
+  });
+
+  it('asks for an interactive interval-only default-prompt loop, and creates it on Start', async () => {
+    const spawnScheduledWake = vi.fn().mockResolvedValue({ id: 'loop_task_interval' });
+    const host = createTestAgentJobHost({ spawnScheduledWake });
+    const ask = askResolving('start');
+    const options = { defaultPrompt: 'Tend the current task.' };
+
+    const result = await executeLoopCommand(host, vi.fn(), '1h', options, { ui: { ask }, source: 'user' });
+
+    expect(ask).toHaveBeenCalledTimes(1);
+    const request = ask.mock.calls[0]![0] as { title: string };
+    expect(request.title).toContain('Start a loop that keeps working on its own for up to 7 days');
+    expect(spawnScheduledWake).toHaveBeenCalledWith(
+      expect.objectContaining({ agentInstruction: options.defaultPrompt }),
+    );
+    expect(result.success).toBe(true);
+  });
+
+  it('never asks for an interval WITH an explicit prompt, even headless', async () => {
+    const spawnScheduledWake = vi.fn().mockResolvedValue({ id: 'loop_task_explicit_interval' });
+    const host = createTestAgentJobHost({ spawnScheduledWake });
+
+    // No invocation at all (defaults to headless, source 'user') — an explicit prompt is unaffected.
+    const result = await executeLoopCommand(host, vi.fn(), '1h check the build', {
+      defaultPrompt: 'Tend the current task.',
+    });
+
+    expect(spawnScheduledWake).toHaveBeenCalledWith(
+      expect.objectContaining({ agentInstruction: 'check the build' }),
+    );
+    expect(result.success).toBe(true);
+  });
+
+  it('never asks for an explicit prompt, even with a person attached', async () => {
+    const createSelfPacedLoop = vi.fn().mockResolvedValue({
+      loopId: 'loop_explicit',
+      expiresAt: '2030-01-01T00:00:00.000Z',
+    });
+    const host = createTestAgentJobHost({ createSelfPacedLoop });
+    const ask = vi.fn();
+
+    const result = await executeLoopCommand(host, vi.fn(), 'check the build', {}, { ui: { ask }, source: 'user' });
+
+    expect(ask).not.toHaveBeenCalled();
+    expect(createSelfPacedLoop).toHaveBeenCalledWith('check the build');
+    expect(result.success).toBe(true);
+  });
+
+  it('never asks for a fixed-cadence loop with an explicit prompt', async () => {
+    const spawnScheduledWake = vi.fn().mockResolvedValue({ id: 'loop_task_fixed' });
+    const host = createTestAgentJobHost({ spawnScheduledWake });
+    const ask = vi.fn();
+
+    const result = await executeLoopCommand(host, vi.fn(), '5m check the build', {}, {
+      ui: { ask },
+      source: 'user',
+    });
+
+    expect(ask).not.toHaveBeenCalled();
+    expect(result.success).toBe(true);
+  });
+});

package/src/schedule/__tests__/schedule-redos.test.ts

@@ -7,10 +7,12 @@
  * The pre-fix regexes used `\s+(.+)$`; because `.` also matches a space, the split point between
  * `\s+` and `(.+)` was ambiguous and a non-matching argument was rejected in O(n^2). Measured
  * pre-fix on the inputs below: ~17s (`/schedule cron`) and ~15s (`/monitor`); post-fix, <1ms.
+ * `/loop`'s leading interval had the same `\s+([\s\S]+)$` shape and is held to the same bound.
  */
 
 import { describe, expect, it, vi } from 'vitest';
 
+import { executeLoopCommand } from '../loop-command.js';
 import { executeMonitorCommand } from '../schedule-command.js';
 import { parseScheduleSpec } from '../schedule-spec-parser.js';
 
@@ -78,4 +80,35 @@ describe('schedule argument parsing is not polynomial-ReDoS-able', () => {
       }),
     );
   });
+
+  it('parses a pumped leading-interval `/loop` in linear time', async () => {
+    // The shape CodeQL named for `\s+([\s\S]+)$`: an interval, then a long run of whitespace.
+    const spawnScheduledWake = vi.fn();
+    const host = createTestAgentJobHost({ spawnScheduledWake });
+    const hostile = `0s\t${'\t\t'.repeat(PUMP_LENGTH)}x`;
+
+    const started = performance.now();
+    const result = await executeLoopCommand(host, vi.fn(), hostile);
+    const took = performance.now() - started;
+
+    expect(result.success).toBe(false);
+    expect(spawnScheduledWake).not.toHaveBeenCalled();
+    expect(took).toBeLessThan(BUDGET_MS);
+  });
+
+  it.each([
+    ['5m check the build', 'check the build'],
+    ['5m \t\n  check   the build  ', 'check   the build'],
+    ['5M\ncheck', 'check'],
+  ])('still reads a leading-interval `/loop` identically: %j', async (args, instruction) => {
+    const spawnScheduledWake = vi.fn().mockResolvedValue({ id: 'loop_1' });
+    const host = createTestAgentJobHost({ spawnScheduledWake });
+
+    const result = await executeLoopCommand(host, vi.fn(), args);
+
+    expect(result.success).toBe(true);
+    expect(spawnScheduledWake).toHaveBeenCalledWith(
+      expect.objectContaining({ agentInstruction: instruction }),
+    );
+  });
 });

package/src/schedule/loop-command.ts

@@ -2,10 +2,14 @@
 
 import { randomUUID } from 'node:crypto';
 
+import { selectAction } from '@robota-sdk/agent-core';
+import { isLoopStopVerb } from '@robota-sdk/agent-framework';
+
 import { jitterFixedLoop } from './loop-jitter.js';
 
+import type { IUserInteraction } from '@robota-sdk/agent-core';
 import type { IAgentJobHostContext } from '@robota-sdk/agent-framework';
-import type { ICommandResult } from '@robota-sdk/agent-interface-command';
+import type { ICommandResult, TCommandInvocationSource } from '@robota-sdk/agent-interface-command';
 import type { IBackgroundTaskState } from '@robota-sdk/agent-interface-execution';
 
 const LOOP_LABEL = 'Loop: ';
@@ -14,6 +18,7 @@ const HOURS_PER_DAY = 24;
 const MAX_LABEL_LENGTH = 48;
 const MAX_ACTIVE_LOOPS = 3;
 const LOOP_LIFETIME_MS = 7 * 24 * 60 * 60_000;
+const LOOP_LIFETIME_DAYS = LOOP_LIFETIME_MS / (HOURS_PER_DAY * 60 * SECONDS_PER_MINUTE * 1_000);
 const MAX_DEFAULT_PROMPT_LENGTH = 4_096;
 const pendingCreates = new WeakMap<object, number>();
 const TRAILING_UNITS = new Set([
@@ -31,6 +36,20 @@ export interface ILoopCommandOptions {
   disabled?: boolean;
 }
 
+/**
+ * #3288 §1: who invoked `/loop`, and how to ask them. `ui` is the injected "ask the user" port
+ * (absent for a headless/automation host — see `ICommandHostUserInteraction`); `source` is the
+ * command's own invocation source. Defaults to `{ ui: undefined, source: 'user' }` when the caller
+ * omits it, matching every pre-existing (headless) call site: proceed unconfirmed, the same as
+ * before this gate existed.
+ */
+export interface ILoopInvocationContext {
+  readonly ui: IUserInteraction | undefined;
+  readonly source: TCommandInvocationSource;
+}
+
+const DEFAULT_INVOCATION: ILoopInvocationContext = { ui: undefined, source: 'user' };
+
 const UNIT_MS: Record<string, number> = {
   s: 1_000,
   m: 60_000,
@@ -115,7 +134,9 @@ function parseCreate(
     const requestedMs = parseDuration(intervalOnly[1]!, intervalOnly[2]!.toLowerCase());
     return requestedMs === undefined ? undefined : { instruction: boundedDefault, requestedMs };
   }
-  const leading = /^(\d+)(s|m|h|d)\s+([\s\S]+)$/i.exec(args);
+  // One required space, then the rest verbatim (trimmed below): `\s+` before `[\s\S]+` split the
+  // same spaces two ways, which CodeQL reads as polynomial backtracking.
+  const leading = /^(\d+)(s|m|h|d)\s([\s\S]+)$/i.exec(args);
   if (leading) {
     const instruction = leading[3]!.trim();
     const requestedMs = parseDuration(leading[1]!, leading[2]!.toLowerCase());
@@ -162,20 +183,80 @@ function loopIdOf(task: IBackgroundTaskState): string {
   return typeof id === 'string' && id.length > 0 ? id : task.id;
 }
 
+function describeActiveLoops(
+  host: Pick<IAgentJobHostContext, 'listSchedules' | 'listSelfPacedLoops'>,
+): string {
+  const loops = activeLoops(host);
+  const selfPaced = activeSelfPacedLoops(host);
+  if (loops.length + selfPaced.length === 0) return 'No other active loops.';
+  return [
+    ...loops.map((task) => `- ${loopIdOf(task)} [${task.status}] ${task.label}`),
+    ...selfPaced.map((loop) => `- ${loop.loopId} [${loop.phase}] Loop: ${loop.instruction}`),
+  ].join('\n');
+}
+
+/** The plain refusal for a default-prompt loop with no one to ask — never a silent, unconfirmed start. */
+const HEADLESS_REFUSAL =
+  'A loop with the default maintenance prompt needs someone to confirm it. Start it from an ' +
+  'interactive session, or give the loop its own prompt: /loop <prompt>';
+
+/**
+ * #3288 §1: every form that falls back to the host's default maintenance prompt — bare `/loop` or an
+ * interval-only `/loop <N><s|m|h|d>` — keeps working on its own for up to 7 days: a standing
+ * commitment the operator never typed, gated the same way regardless of which form reached it.
+ * Returns the refusal/decline result to return in place of creating the loop, or `undefined` to
+ * proceed. A `source: 'model'` call is refused outright and never asks — the model must give its own
+ * prompt, or name `/loop` to the user (AGENTS.md: trust and permission-widening actions stay
+ * user-only, and a refusal names the command to suggest). A headless/automation host (no ask port —
+ * print mode, a scheduled run) is refused too, the same reason: a loop that can run for a week must
+ * not start without a person saying yes, and there is no one here to ask.
+ */
+async function confirmDefaultLoopStart(
+  host: Pick<IAgentJobHostContext, 'listSchedules' | 'listSelfPacedLoops'>,
+  invocation: ILoopInvocationContext,
+  instruction: string,
+): Promise<ICommandResult | undefined> {
+  if (invocation.source === 'model') {
+    return {
+      success: false,
+      message:
+        'Starting a loop with its built-in prompt needs a person to confirm it — ' +
+        'ask the user to run /loop, or give your own prompt with /loop <prompt>.',
+    };
+  }
+  const { ui } = invocation;
+  if (!ui) return { success: false, message: HEADLESS_REFUSAL };
+  const firstLine = instruction.split('\n')[0]!.trim() || instruction;
+  const response = await ui.ask(
+    selectAction(
+      'loop-start-default',
+      `Start a loop that keeps working on its own for up to ${LOOP_LIFETIME_DAYS} days? It will: ${firstLine}`,
+      [
+        { value: 'start', label: 'Start' },
+        { value: 'cancel', label: 'Cancel' },
+      ],
+      { description: describeActiveLoops(host) },
+    ),
+  );
+  if (response.type === 'answer' && response.values.includes('start')) return undefined;
+  return { success: true, message: 'Loop not started.' };
+}
+
 export async function executeLoopCommand(
   host: Pick<IAgentJobHostContext, 'spawnScheduledWake' | 'listSchedules' | 'createSelfPacedLoop' | 'listSelfPacedLoops' | 'stopSelfPacedLoop'>,
   cancelBackgroundTask: (taskId: string, reason: string) => Promise<void>,
   args: string,
   options: ILoopCommandOptions = {},
+  invocation: ILoopInvocationContext = DEFAULT_INVOCATION,
 ): Promise<ICommandResult> {
   const trimmed = args.trim();
   if (trimmed === 'list') return listLoops(host, options);
-  if (/^stop(?:\s|$)/.test(trimmed)) return stopLoop(host, cancelBackgroundTask, trimmed);
+  if (isLoopStopVerb(trimmed)) return stopLoop(host, cancelBackgroundTask, trimmed);
 
   if (options.disabled) {
     return { success: false, message: 'Session loops are disabled by the host.' };
   }
-  return createLoop(host, trimmed, options);
+  return createLoop(host, trimmed, options, invocation);
 }
 
 function listLoops(
@@ -235,6 +316,7 @@ async function createLoop(
   host: Pick<IAgentJobHostContext, 'spawnScheduledWake' | 'listSchedules' | 'createSelfPacedLoop' | 'listSelfPacedLoops'>,
   args: string,
   options: ILoopCommandOptions,
+  invocation: ILoopInvocationContext = DEFAULT_INVOCATION,
 ): Promise<ICommandResult> {
   const useDefaultPrompt = args === '' || /^\d+(s|m|h|d)$/i.test(args);
   let defaultPrompt = options.defaultPrompt;
@@ -257,6 +339,10 @@ async function createLoop(
     if (!host.createSelfPacedLoop) {
       return { success: false, message: 'Self-paced loops require a persistent interactive session.' };
     }
+    if (useDefaultPrompt) {
+      const declined = await confirmDefaultLoopStart(host, invocation, instruction);
+      if (declined) return declined;
+    }
     const pending = pendingCreates.get(host) ?? 0;
     if (activeLoops(host).length + activeSelfPacedLoops(host).length + pending >= MAX_ACTIVE_LOOPS) {
       return { success: false, message: `At most ${MAX_ACTIVE_LOOPS} active loops are allowed. Stop one before creating another.` };
@@ -277,6 +363,14 @@ async function createLoop(
       else pendingCreates.set(host, remaining);
     }
   }
+  // #3288 §1: an interval-only form (`/loop 5m`) that fell back to the host's default prompt is
+  // gated exactly like the bare form — it is the SAME standing commitment (up to 7 days, unattended),
+  // only on a fixed cadence instead of self-paced. An explicit prompt (`/loop 5m check the build`)
+  // never reaches here with `useDefaultPrompt` true, so it is never gated.
+  if (useDefaultPrompt) {
+    const declined = await confirmDefaultLoopStart(host, invocation, parsed.instruction);
+    if (declined) return declined;
+  }
   const pending = pendingCreates.get(host) ?? 0;
   if (activeLoops(host).length + activeSelfPacedLoops(host).length + pending >= MAX_ACTIVE_LOOPS) {
     return {