@tamsensedev/runner 0.2.1 → 0.3.0

package/README.md

@@ -38,10 +38,12 @@ Options:
 - `--name <name>` how this computer is called in TAMsense (login)
 - `--server <url>` TAMsense address, default https://my.tamsense.com (login)
 - `--parallel <n>` how many tasks to work on at once (start)
+- `--no-browser` do not install the headless browser for interface checks (start)
 
 ## What it does on your computer
 
 - Clones the task's repositories into `~/.tamsense/repos` and works in `~/.tamsense/work`.
+- Installs a headless browser for interface checks into `~/.tamsense` when `start` finds none, about 150 MB, without asking. If that fails, it says why and tasks still run without it.
 - Gets a short-lived GitHub token from TAMsense for those repositories only, and pushes the task branch. Pull requests are opened by TAMsense.
-- Records the browser Claude drives during a task (a replay of each page, and a video when asked) into `~/.tamsense/recordings`, attaches it to the task and deletes the local copy when the step ends. Requests from the tested site to the TAMsense tracker are blocked during these runs, so they never reach your analytics.
+- Records the browser Claude drives during a task (a replay of each page, and a video when asked) into `~/.tamsense/recordings`, attaches it to the task and deletes the local copy when the step ends. Requests from the tested site to the TAMsense tracker are blocked during these runs, so they never reach your analytics, and so are requests that change data (anything but GET, HEAD and OPTIONS) to addresses outside your computer.
 - Never stops processes it did not start.

package/dist/cli.js

@@ -81,7 +81,7 @@ var HELP_TEXT = `Connects this computer to TAMsense so it can work on your tasks
 Usage:
   ${LOGIN_COMMAND}    connect this computer
   ${START_COMMAND}    take your tasks and work on them until you press Ctrl+C
-  ${BROWSER_COMMAND}  install the headless browser for interface checks, or show it
+  ${BROWSER_COMMAND}  install the headless browser for interface checks now, or show it
   ${BROWSER_COMMAND} remove   delete that browser
   npx @tamsensedev/runner@latest status   show the connection
   npx @tamsensedev/runner@latest logout   disconnect this computer
@@ -91,7 +91,8 @@ Login options:
   --server <url>   TAMsense address (default: ${DEFAULT_SERVER})
 
 Start options:
-  --parallel <n>   how many tasks to work on at once, 1 to ${MAX_PARALLEL} (default: ${DEFAULT_PARALLEL}, or TAMSENSE_PARALLEL)`;
+  --parallel <n>   how many tasks to work on at once, 1 to ${MAX_PARALLEL} (default: ${DEFAULT_PARALLEL}, or TAMSENSE_PARALLEL)
+  --no-browser     do not install the headless browser for interface checks (start installs it when it is missing)`;
 function parallelFor(flag, env) {
   const [source, value] = flag !== void 0 ? ["--parallel", flag] : ["TAMSENSE_PARALLEL", env?.trim() || void 0];
   if (value === void 0) {
@@ -109,10 +110,11 @@ function parseCommand(argv, env = {}) {
     allowPositionals: true,
     strict: true,
     options: {
-      server: { type: "string" },
-      name: { type: "string" },
-      parallel: { type: "string" },
-      help: { type: "boolean" }
+      "server": { type: "string" },
+      "name": { type: "string" },
+      "parallel": { type: "string" },
+      "no-browser": { type: "boolean" },
+      "help": { type: "boolean" }
     }
   });
   const [name, detail] = positionals;
@@ -129,7 +131,7 @@ function parseCommand(argv, env = {}) {
     return { name: "login", server: values.server ?? null, deviceName: values.name ?? null };
   }
   if (name === "start") {
-    return { name: "start", parallel: parallelFor(values.parallel, env.TAMSENSE_PARALLEL) };
+    return { name: "start", parallel: parallelFor(values.parallel, env.TAMSENSE_PARALLEL), browser: !values["no-browser"] };
   }
   if (name === "status" || name === "logout") {
     return { name };
@@ -145,8 +147,7 @@ var OUTPUT_TAIL_LINES = 40;
 var ERROR_TAIL_LINES = 3;
 var ANSI_PATTERN = /\u001B\[[\d;]*m/g;
 var OFFLINE_PATTERN = /ENOTFOUND|EAI_AGAIN|ETIMEDOUT|ECONNREFUSED|ECONNRESET|ENETUNREACH|getaddrinfo/i;
-var BROWSER_QUESTION = "Interface checks need a headless browser (about 150 MB, installed once into ~/.tamsense). Install it now? [Y/n] ";
-var BROWSER_HINT = `Interface checks can use a headless browser. To install it (about 150 MB), run ${BROWSER_COMMAND}`;
+var INSTALLING_TEXT = "Interface checks need a headless browser. Installing it once into ~/.tamsense, about 150 MB. To start without it, add --no-browser.";
 var OFFLINE_TEXT = `No connection to download it. Check your internet connection and run ${BROWSER_COMMAND} again.`;
 function browserFolders(home) {
   const prefix = join(home, ".tamsense", "playwright");
@@ -248,24 +249,13 @@ async function removeBrowser(home) {
   await rm(folders.browsers, { recursive: true, force: true });
   return present2;
 }
-async function offerBrowser(tools) {
-  if (tools.declined) {
-    return null;
-  }
-  if (!tools.interactive) {
-    tools.print(BROWSER_HINT);
-    return null;
-  }
-  if (!await tools.ask(BROWSER_QUESTION)) {
-    await tools.rememberDecline();
-    tools.print(`Not installed. To install it later, run ${BROWSER_COMMAND}`);
-    return null;
-  }
+async function ensureBrowser(tools) {
+  tools.print(INSTALLING_TEXT);
   try {
     return await tools.install();
   } catch (error) {
     tools.print(`Could not install the browser: ${error instanceof Error ? error.message : String(error)}`);
-    tools.print("Tasks still run without it.");
+    tools.print(`Tasks still run without it. To try again, run ${BROWSER_COMMAND}`);
     return null;
   }
 }
@@ -354,6 +344,56 @@ import { fileURLToPath } from "url";
 import { createSdkMcpServer, query as query2, tool as tool2 } from "@anthropic-ai/claude-agent-sdk";
 import { z as z2 } from "zod";
 
+// src/askPerson.ts
+var MAX_ASK_TRIES = 5;
+var MAX_ASK_OPTIONS = 4;
+function personLine(person) {
+  const roles = person.roles.length > 0 ? `, ${person.roles.join(", ")}` : "";
+  return `${person.id}: ${person.name} (${person.relation}, ${person.access} access${roles})`;
+}
+function findPerson(people, to) {
+  const key = String(to).trim().toLowerCase();
+  return people.find((person) => String(person.id) === key || person.name.toLowerCase() === key) ?? null;
+}
+function cleanTry(item) {
+  return { did: item.did.trim(), error: item.error?.trim() || null, result: item.result.trim() };
+}
+function checkAsk(people, request) {
+  const question = request.question.trim();
+  const why = request.why.trim();
+  const assumption = request.assumption?.trim() ?? "";
+  if (!question) {
+    return { error: "Write the question: one plain sentence the person can answer without reading the code." };
+  }
+  const person = findPerson(people, request.to);
+  if (!person) {
+    return { error: `"${request.to}" is not a person on this task. Ask one of them by id:
+${people.map(personLine).join("\n")}` };
+  }
+  if (!why) {
+    return { error: `Say in one line why ${person.name} is the right person to ask.` };
+  }
+  if (!request.blocking && !assumption) {
+    return { error: "A question you do not wait for needs the assumption you continue with until the answer comes." };
+  }
+  const tried = (request.tried ?? []).map(cleanTry).filter((item) => item.did);
+  const options = (request.options ?? []).map((option) => ({ label: option.label.trim(), detail: option.detail.trim() })).filter((option) => option.label);
+  if (tried.length > MAX_ASK_TRIES || options.length > MAX_ASK_OPTIONS) {
+    return { error: `Keep it short: at most ${MAX_ASK_TRIES} things you tried and at most ${MAX_ASK_OPTIONS} suggested answers.` };
+  }
+  return {
+    person,
+    body: { to: person.id, why, question, context: request.context?.trim() ?? "", tried, options, blocking: request.blocking, assumption: request.blocking ? null : assumption }
+  };
+}
+function askedText(name, body) {
+  if (body.blocking) {
+    return `Sent to ${name}. This run now waits for the answer and frees the computer. Write one short line saying what you wait for, then end your turn without doing more work. When ${name} answers, this conversation continues here with the answer.`;
+  }
+  return `Sent to ${name}. Keep working on your assumption: ${body.assumption}. The answer comes as a message from ${name} while you work, or with the next run if this one has ended. If it differs, change what you did.`;
+}
+var ALREADY_WAITING_TEXT = "You already asked a question this run waits for. End your turn now: the conversation continues when the answer comes.";
+
 // src/claudeResult.ts
 var MAX_ACTIVITY_LENGTH = 120;
 var FILE_TOOLS = /* @__PURE__ */ new Set(["Read", "Edit", "Write", "MultiEdit", "NotebookEdit"]);
@@ -431,7 +471,7 @@ function toolDraft(block, parent) {
     return { ...base, kind: "agent", text: clip(what ? `${who}: ${what}` : who, MAX_SUMMARY_LENGTH) };
   }
   if (tool3 === "submit_verdict") {
-    const verdict = fields.passed === true ? "Passed" : "Did not pass";
+    const verdict = fields.couldNotRun === true ? "Could not run" : fields.passed === true ? "Passed" : "Did not pass";
     return { ...base, kind: "tool", text: clip(`${verdict}. ${textField(fields, "report") ?? ""}`, MAX_SUMMARY_LENGTH) };
   }
   if (tool3 === "hand_off") {
@@ -818,7 +858,10 @@ var VIDEO_TOOL_NAME = "attach_video";
 var HANDOFF_TOOL_NAME = "hand_off";
 var SUBMIT_QUESTIONS_TOOL_NAME = "submit_questions";
 var SUBMIT_SPEC_TOOL_NAME = "submit_spec";
-var UNATTENDED_RULE = `You are working on a TAMsense task on the user's own computer. People on the task may send you messages during this run, each starting with "Message from <name>:". Follow them: they take priority over the original task where the two disagree. Nobody answers questions or approves actions during the run, so never stop to wait for a reply: decide yourself, keep working, and explain your decisions in your report.`;
+var ASK_PERSON_TOOL_NAME = "ask_person";
+var MESSAGES_RULE = `You are working on a TAMsense task on the user's own computer. People on the task may send you messages during this run, each starting with "Message from <name>:". Follow them: they take priority over the original task where the two disagree.`;
+var UNATTENDED_RULE = `${MESSAGES_RULE} Nobody answers questions or approves actions during the run, so never stop to wait for a reply: decide yourself, keep working, and explain your decisions in your report.`;
+var ASKING_RULE = `${MESSAGES_RULE} Decide yourself when you reasonably can, keep working, and explain your decisions in your report. When you are stuck, or the decision belongs to a person (intent, design, access, how the team runs something locally), ask one of the people on the task with the ${ASK_PERSON_TOOL_NAME} tool instead of guessing, and say what you tried. Never ask what the code or the project knowledge already answers. Nobody watches your messages, so ask only with the tool.`;
 var MACHINE_RULE = "This is the person's own computer, and their other programs may be running on it. Stop only the processes you started yourself, by their process id, and stop them before you finish. Never kill processes by name or pattern (taskkill /IM, pkill, killall, Stop-Process -Name) and never touch programs you did not start.";
 var CODE_RULES = [
   "Make the changes the task asks for, and keep them focused on it.",
@@ -836,8 +879,22 @@ var CHECK_RULES = [
 ];
 var SCREENSHOT_RULE = `If you render screens (screenshots of the interface), attach the ones that show the result with the ${SCREENSHOT_TOOL_NAME} tool. People see them on the task without opening the code.`;
 var NAMING_RULE = 'Name everything you attach (screenshots, replays, videos) by what it shows and why it was made: a short title such as "Design option 1", "Feature testing" or "Feature testing, attempt 2", and a one-line purpose such as "Comparing two layouts for the empty orders state". Number design variants, name test runs by their goal and attempt, and never use generic names like "screenshot1".';
-var RECORDING_RULE = `Every browser you open with Playwright from Node is recorded for the task as a replay people can watch, and requests from the tested site to the TAMsense tracker are blocked, so your runs never reach analytics. In every browser script, load the recorder from the TAMSENSE_RECORDER environment variable (require(process.env.TAMSENSE_RECORDER), or createRequire(import.meta.url)(process.env.TAMSENSE_RECORDER) in an .mjs script), open each context with await recorder.newRecordedContext(browser, { title, purpose, context: { viewport } }), call await recorder.mark(page, 'what just happened') at every meaningful step, and end with await recorder.closeRecorded(context). Add video: true when the page has a canvas, a map, a video player or iframes from another site (a replay cannot show them), or when someone asks for a video. Recordings are attached to the task when the run ends; ${REPLAY_TOOL_NAME} and ${VIDEO_TOOL_NAME} attach one earlier with a better title.`;
-var BROWSER_RULE = "A headless browser is installed for interface checks. If the project has no Playwright of its own, load playwright-core from the folder in the TAMSENSE_PLAYWRIGHT environment variable, with PLAYWRIGHT_BROWSERS_PATH set to the folder in TAMSENSE_PLAYWRIGHT_BROWSERS. Never install browsers or packages yourself.";
+var RECORDING_RULE = `Every browser you open with Playwright from Node is recorded for the task as a replay people can watch, requests from the tested site to the TAMsense tracker are blocked, so your runs never reach analytics, and requests other than GET, HEAD and OPTIONS to addresses outside this computer are aborted. In every browser script, load the recorder from the TAMSENSE_RECORDER environment variable (require(process.env.TAMSENSE_RECORDER), or createRequire(import.meta.url)(process.env.TAMSENSE_RECORDER) in an .mjs script), open each context with await recorder.newRecordedContext(browser, { title, purpose, context: { viewport } }), call await recorder.mark(page, 'what just happened') at every meaningful step, and end with await recorder.closeRecorded(context). Add video: true when the page has a canvas, a map, a video player or iframes from another site (a replay cannot show them), or when someone asks for a video. Recordings are attached to the task when the run ends; ${REPLAY_TOOL_NAME} and ${VIDEO_TOOL_NAME} attach one earlier with a better title.`;
+var BROWSER_RULE = "A headless browser is installed for interface checks. If the project has no Playwright of its own, load playwright-core from the folder in the TAMSENSE_PLAYWRIGHT environment variable, with PLAYWRIGHT_BROWSERS_PATH set to the folder in TAMSENSE_PLAYWRIGHT_BROWSERS.";
+var DEPENDENCIES_RULE = "The checkout may have no dependencies installed. To run the app or its tests, install the project's own dependencies from its lockfile with its package manager (pnpm install --frozen-lockfile, npm ci, yarn install --immutable and similar). Never add packages, change a lockfile or download browsers.";
+function localAppRule(taskId, isCheck, canAsk) {
+  const project = `tamsense-task-${taskId}`;
+  const cannotRun = isCheck ? `call ${VERDICT_TOOL_NAME} with passed false and couldNotRun true, write the exact reason and what a person should do in the report, and do not hand off: the task waits on this step for a person.` : "say so in your report with the exact reason and what a person should do.";
+  return [
+    "When you need the running app, start a local copy from this task folder only.",
+    "Find how the project runs locally yourself: the README, compose files named local or dev, .env.example and local env files, package scripts.",
+    canAsk ? `If you still cannot tell how the team prepares it, for example how the local database gets its tables, ask with ${ASK_PERSON_TOOL_NAME} instead of guessing.` : null,
+    "Use only settings meant for a local run that are in this checkout. Never read or copy .env files from elsewhere on this computer, including the person's own checkout, and never use staging, shared dev or production addresses.",
+    "Before starting, check every address in the settings you use: databases, caches, queues and APIs must point at localhost or at containers you started, and keys of outside services stay empty.",
+    `Start containers as a separate compose project named ${project} on free host ports (an override file in a temp folder), never stop or change containers you did not start, and remove yours with their volumes at the end (docker compose -p ${project} down -v).`,
+    `If Docker is not running, there is no local setup, or the settings point outside this computer, do not start anything: ${cannotRun}`
+  ].filter(Boolean).join(" ");
+}
 var STAGE_GOALS = {
   code: "Implement",
   review: "Review the code for",
@@ -888,6 +945,16 @@ function teamMessagesText(messages) {
   return messages.length > 0 ? `Messages from the team before this run:
 ${messages.map((message) => `${message.authorName}: ${message.text}`).join("\n")}` : null;
 }
+function peopleText(people) {
+  if (people.length === 0) {
+    return null;
+  }
+  return [
+    `People on this task you can ask with ${ASK_PERSON_TOOL_NAME} (id: name, relation, access):`,
+    bulletList(people.map(personLine)),
+    "Ask the assignee first; a question on a topic goes to the person whose role fits it. Set blocking only when you cannot go on without the answer: the run then pauses and the computer is freed for other tasks. Otherwise give the assumption you continue with."
+  ].join("\n");
+}
 function handoffText(targets, isCheck) {
   if (targets.length === 0) {
     return null;
@@ -971,6 +1038,8 @@ function buildTaskPrompt(job, workspace, options = {}) {
     return buildSpecPrompt(job, job.specWork, workspace);
   }
   const isCheck = kind !== "code";
+  const people = job.people ?? [];
+  const canAsk = people.length > 0;
   const prompt = [
     `${STAGE_GOALS[kind]} TAMsense task #${job.taskId}: ${job.title}`,
     job.description,
@@ -981,9 +1050,10 @@ ${job.review}`,
     teamMessagesText(job.messages)
   ].filter(Boolean).join("\n\n");
   const evidence = [SCREENSHOT_RULE, ...options.recorder ? [RECORDING_RULE] : [], NAMING_RULE];
-  const rules = isCheck ? [...CHECK_RULES, ...evidence] : [...CODE_RULES, ...job.review ? [REWORK_RULE] : [], ...evidence, CODE_REPORT_RULE];
+  const localApp = localAppRule(job.taskId, isCheck, canAsk);
+  const rules = isCheck ? [...CHECK_RULES, DEPENDENCIES_RULE, localApp, ...evidence] : [...CODE_RULES, ...job.review ? [REWORK_RULE] : [], DEPENDENCIES_RULE, localApp, ...evidence, CODE_REPORT_RULE];
   const instructions = [
-    UNATTENDED_RULE,
+    canAsk ? ASKING_RULE : UNATTENDED_RULE,
     MACHINE_RULE,
     stepLine(job.stage),
     job.stage.instructions,
@@ -992,6 +1062,7 @@ ${job.review}`,
 ${bulletList(repositoryLines(job, workspace))}`,
     `How to work:
 ${bulletList(rules)}`,
+    peopleText(people),
     handoffText(job.allowedHandoffs, isCheck),
     options.browser && BROWSER_RULE
   ].filter(Boolean).join("\n\n");
@@ -1284,10 +1355,11 @@ function verdictTool(onVerdict) {
     "Hand in the result of this check. Call it exactly once, at the very end.",
     {
       passed: z2.boolean().describe("true only if nothing must be fixed"),
-      report: z2.string().describe("what you checked and, if it failed, exactly what to fix with file and line")
+      report: z2.string().describe("what you checked and, if it failed, exactly what to fix with file and line"),
+      couldNotRun: z2.boolean().optional().describe("true when the check could not run at all because of this computer: Docker not running, no local setup, or settings that point outside this computer; passed must be false and the report gives the exact reason and what a person should do")
     },
     async (args) => {
-      onVerdict({ passed: args.passed, report: args.report });
+      onVerdict(args.couldNotRun ? { passed: false, report: args.report, couldNotRun: true } : { passed: args.passed, report: args.report });
       return { content: [{ type: "text", text: "Verdict received. You can stop now." }] };
     }
   );
@@ -1311,6 +1383,48 @@ function handoffTool(targets, onHandoff) {
     }
   );
 }
+function askPersonTool(asking, waiting) {
+  return tool2(
+    ASK_PERSON_TOOL_NAME,
+    "Ask a person on this TAMsense task when you are stuck or the decision belongs to a person: intent, design, access, or how the team runs something locally. Never ask what the code or the project knowledge already answers. With blocking true the run pauses and frees the computer until the answer comes; with blocking false you keep working on your assumption.",
+    {
+      to: z2.union([z2.number(), z2.string()]).describe("id of the person from the people list in your instructions: the assignee first; a topic question goes to the person whose role fits"),
+      why: z2.string().describe('one line on why this person: "assignee, and the run is on her computer", "Designer, owns empty states"'),
+      question: z2.string().describe("one plain question the person can answer without reading the code"),
+      context: z2.string().optional().describe("one line on what you saw that led to the question"),
+      tried: z2.array(z2.object({
+        did: z2.string().describe("the command or step"),
+        error: z2.string().optional().describe("the exact error line, if there was one"),
+        result: z2.string().describe("what it showed, one line")
+      })).max(MAX_ASK_TRIES).optional().describe("what you already tried, the most telling first"),
+      options: z2.array(z2.object({
+        label: z2.string().describe("a short answer the person can pick"),
+        detail: z2.string().describe("one line on what happens if it is picked")
+      })).max(MAX_ASK_OPTIONS).optional().describe("2 to 4 answers you suggest, the one you would pick first"),
+      blocking: z2.boolean().describe("true when you cannot go on without the answer"),
+      assumption: z2.string().optional().describe("when blocking is false: what you continue with until the answer comes")
+    },
+    async (args) => {
+      if (waiting.waitingFor !== null) {
+        return { content: [{ type: "text", text: ALREADY_WAITING_TEXT }], isError: true };
+      }
+      const choice = checkAsk(asking.people, args);
+      if ("error" in choice) {
+        return { content: [{ type: "text", text: choice.error }], isError: true };
+      }
+      let reply2;
+      try {
+        reply2 = await asking.send(choice.body);
+      } catch (error) {
+        return { content: [{ type: "text", text: `Could not send the question: ${error instanceof Error ? error.message : String(error)}. Decide yourself and say so in your report.` }], isError: true };
+      }
+      if (choice.body.blocking) {
+        waiting.waitingFor = reply2.id;
+      }
+      return { content: [{ type: "text", text: askedText(reply2.name, choice.body) }] };
+    }
+  );
+}
 function specWorkTools(specWork, submitted) {
   if (!specWork) {
     return [];
@@ -1330,6 +1444,7 @@ function tamsenseServer(request, submitted) {
       submitted.verdict = verdict;
     })] : [],
     ...specWorkTools(request.specWork, submitted),
+    ...request.asking ? [askPersonTool(request.asking, submitted)] : [],
     ...request.handoffs.length > 0 ? [handoffTool(request.handoffs, (handoff) => {
       submitted.handoff = handoff;
     })] : []
@@ -1421,7 +1536,7 @@ function claudeRunner(startQuery) {
       request.input.close();
       abortController.abort();
     }, { once: true });
-    const submitted = { verdict: null, handoff: null, questions: null, spec: null, helperStarted: false };
+    const submitted = { verdict: null, handoff: null, questions: null, spec: null, helperStarted: false, waitingFor: null };
     const limit = usageLimitWatch();
     const context = { startQuery, abortController, submitted, limit };
     try {
@@ -1431,7 +1546,7 @@ function claudeRunner(startQuery) {
       }
       const pausedUntil = limit.pausedUntil(result.outcome.completed);
       const outcome = pausedUntil ? { ...result.outcome, completed: false, report: USAGE_LIMIT_REPORT } : result.outcome;
-      return { ...outcome, verdict: submitted.verdict, handoff: submitted.handoff, questions: submitted.questions, spec: submitted.spec, sessionId: result.sessionId, pausedUntil };
+      return { ...outcome, verdict: submitted.verdict, handoff: submitted.handoff, questions: submitted.questions, spec: submitted.spec, sessionId: result.sessionId, pausedUntil, waitingFor: submitted.waitingFor };
     } finally {
       request.input.close();
     }
@@ -1455,9 +1570,9 @@ function parseConfig(value) {
   if (!isRecord2(value)) {
     return null;
   }
-  const { server, token, deviceId, deviceName, browserDeclined } = value;
+  const { server, token, deviceId, deviceName } = value;
   const isValid = typeof server === "string" && typeof token === "string" && typeof deviceId === "number" && typeof deviceName === "string";
-  return isValid ? { server, token, deviceId, deviceName, ...browserDeclined === true ? { browserDeclined } : {} } : null;
+  return isValid ? { server, token, deviceId, deviceName } : null;
 }
 function isMissingFile(error) {
   return error instanceof Error && "code" in error && error.code === "ENOENT";
@@ -1545,6 +1660,7 @@ var META_SUFFIX = ".json";
 var MAX_TITLE_LENGTH = 60;
 var MAX_PURPOSE_LENGTH = 160;
 var DEFAULT_TRACKER_ORIGINS = ["https://my.tamsense.com"];
+var READ_METHODS = ["GET", "HEAD", "OPTIONS"];
 var BINDING = "__tamsenseRecord";
 var STATE_KEY = /* @__PURE__ */ Symbol.for("tamsense.recorder");
 var FLUSH_MS = 100;
@@ -1573,6 +1689,13 @@ function isTrackerIngest(url, tamsenseOrigins) {
   }
   return url.searchParams.has("key") || tamsenseOrigins.includes(url.origin);
 }
+function isLocalHost(hostname2) {
+  const host = hostname2.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");
+  return host === "localhost" || host.endsWith(".localhost") || host === "::1" || host === "0.0.0.0" || /^127(?:\.\d{1,3}){3}$/.test(host);
+}
+function isExternalWrite(method, url) {
+  return !READ_METHODS.includes(method.toUpperCase()) && !isLocalHost(url.hostname);
+}
 function trackerOrigins(env = process2.env) {
   const origins = new Set(DEFAULT_TRACKER_ORIGINS);
   try {
@@ -1659,7 +1782,7 @@ var Session = class {
     const id = `${Date.now().toString(36)}-${Math.random().toString(16).slice(2, 8)}`;
     this.file = join3(dir, `${id}${REPLAY_SUFFIX}`);
     this.metaFile = join3(dir, `${id}${META_SUFFIX}`);
-    this.meta = { version: 1, id, ...recording.caption, startedAt: Date.now(), endedAt: null, url, marks: [], video: null, gaps: [], blockedTrackerRequests: 0, truncated: false, automatic: recording.automatic };
+    this.meta = { version: 1, id, ...recording.caption, startedAt: Date.now(), endedAt: null, url, marks: [], video: null, gaps: [], blockedTrackerRequests: 0, blockedExternalWrites: 0, truncated: false, automatic: recording.automatic };
     writeFileSync(this.file, "");
     this.save();
   }
@@ -1703,10 +1826,20 @@ var Session = class {
     }
   }
   summary() {
-    const { title, purpose, video, marks, gaps, blockedTrackerRequests } = this.meta;
-    return { title, purpose, replay: this.file, video, marks: marks.length, gaps, blockedTrackerRequests };
+    const { title, purpose, video, marks, gaps, blockedTrackerRequests, blockedExternalWrites } = this.meta;
+    return { title, purpose, replay: this.file, video, marks: marks.length, gaps, blockedTrackerRequests, blockedExternalWrites };
   }
 };
+function countBlocked(route, counter) {
+  try {
+    const session = state().pages.get(route.request().frame().page());
+    if (session) {
+      session.meta[counter] += 1;
+      session.save();
+    }
+  } catch {
+  }
+}
 async function startSession(recording, page, injectNow) {
   const current = state();
   if (current.pages.has(page)) {
@@ -1748,15 +1881,19 @@ async function recordContext(context, caption, automatic = false) {
   const recording = { caption: checked, automatic, sessions: [] };
   current.contexts.set(context, recording);
   const origins = trackerOrigins();
-  await context.route((url) => isTrackerIngest(url, origins), async (route) => {
-    try {
-      const session = current.pages.get(route.request().frame().page());
-      if (session) {
-        session.meta.blockedTrackerRequests += 1;
-        session.save();
-      }
-    } catch {
+  await context.route((url) => !isLocalHost(url.hostname), async (route) => {
+    const request = route.request();
+    if (!isExternalWrite(request.method(), new URL(request.url()))) {
+      await route.continue().catch(() => {
+      });
+      return;
     }
+    countBlocked(route, "blockedExternalWrites");
+    await route.abort("blockedbyclient").catch(() => {
+    });
+  });
+  await context.route((url) => isTrackerIngest(url, origins), async (route) => {
+    countBlocked(route, "blockedTrackerRequests");
     await route.fulfill({ status: 200, contentType: "application/json", body: '{"ok":true}' });
   });
   await context.exposeBinding(BINDING, ({ page }, payload) => current.pages.get(page)?.receive(payload));
@@ -1850,7 +1987,6 @@ function describeDevice(identity) {
 import { spawn as spawn2 } from "child_process";
 import { hostname } from "os";
 import { delimiter as delimiter2 } from "path";
-import { createInterface as createInterface2 } from "readline/promises";
 import { setTimeout as wait } from "timers/promises";
 var PLATFORM_LABELS = {
   win32: "Windows",
@@ -1886,22 +2022,6 @@ function withNodeOnPath(env, nodeDir, separator = delimiter2) {
   }
   return { ...env, [key]: [...entries, nodeDir].join(separator) };
 }
-async function askYesNo(question) {
-  const prompt = createInterface2({ input: process.stdin, output: process.stdout });
-  try {
-    for (; ; ) {
-      const answer = (await prompt.question(question)).trim().toLowerCase();
-      if (answer === "" || answer === "y" || answer === "yes") {
-        return true;
-      }
-      if (answer === "n" || answer === "no") {
-        return false;
-      }
-    }
-  } finally {
-    prompt.close();
-  }
-}
 async function sleep(ms, signal) {
   await wait(ms, void 0, { signal }).catch(() => {
   });
@@ -2051,7 +2171,7 @@ import { randomUUID } from "crypto";
 import { createReadStream } from "fs";
 import { readdir, readFile as readFile3, stat, writeFile as writeFile3 } from "fs/promises";
 import { basename as basename2, dirname as dirname4, extname, isAbsolute, join as join5 } from "path";
-import { createInterface as createInterface3 } from "readline";
+import { createInterface as createInterface2 } from "readline";
 import { Readable } from "stream";
 import { promisify } from "util";
 import { gzip } from "zlib";
@@ -2172,7 +2292,7 @@ async function pendingRecordings(dir) {
 async function uploadReplay(upload, file, caption) {
   const id = randomUUID();
   const scan = { startTs: Number.POSITIVE_INFINITY, snapshot: false, marks: [] };
-  const lines = createInterface3({ input: createReadStream(file, "utf8"), crlfDelay: Infinity });
+  const lines = createInterface2({ input: createReadStream(file, "utf8"), crlfDelay: Infinity });
   for await (const chunk of replayChunks(lines, scan)) {
     await upload.api.upload("POST", recordingUploadPath(upload.runId, id, "chunks"), new Uint8Array(await gzipAsync(chunk)), "application/gzip");
   }
@@ -2376,6 +2496,16 @@ async function baseRef(cache, job, repository) {
   const pushed = await runGit(["rev-parse", "--verify", "--quiet", `refs/remotes/origin/${job.branch}`], { cwd: cache });
   return pushed.code === 0 ? `origin/${job.branch}` : `origin/${repository.defaultBranch}`;
 }
+async function keptBase(cache, path, job, repository) {
+  if (!job.keepWorkspace || !existsSync3(join6(path, ".git"))) {
+    return null;
+  }
+  const branch = await runGit(["rev-parse", "--abbrev-ref", "HEAD"], { cwd: path });
+  if (branch.code !== 0 || branch.stdout !== job.branch) {
+    return null;
+  }
+  return git(["rev-parse", await baseRef(cache, job, repository)], { cwd: cache });
+}
 async function prepareWorkspace(job, token, tools) {
   const root = tamsenseFolder(tools.home, "work", `task-${job.taskId}`);
   const folders = folderNames(job.repositories);
@@ -2386,6 +2516,10 @@ async function prepareWorkspace(job, token, tools) {
     const path = join6(root, folder);
     const baseSha = await cacheLock.run(repository.fullName, async () => {
       await refreshCache(cache, repository, token, tools);
+      const kept = await keptBase(cache, path, job, repository);
+      if (kept) {
+        return kept;
+      }
       await removeWorktree(cache, path);
       await git(["worktree", "add", "--force", "-B", job.branch, path, await baseRef(cache, job, repository)], { cwd: cache });
       return git(["rev-parse", "HEAD"], { cwd: path });
@@ -2562,6 +2696,13 @@ function specWorkTools2(job, api) {
   }
   return { stage: kind, review: (body) => api.request("POST", runPath(job.runId, "review"), body) };
 }
+function askingTools(job, api) {
+  const people = job.people ?? [];
+  if (people.length === 0 || job.stage.kind === "interview" || job.stage.kind === "spec") {
+    return null;
+  }
+  return { people, send: (body) => api.request("POST", runPath(job.runId, "questions"), body) };
+}
 async function executeJob(job, tools, signal, input, record) {
   const isCheck = job.stage.kind === "review" || job.stage.kind === "test";
   tools.print("Preparing the code\u2026");
@@ -2582,6 +2723,7 @@ async function executeJob(job, tools, signal, input, record) {
     signal,
     wantsVerdict: isCheck,
     specWork: specWorkTools2(job, tools.api),
+    asking: askingTools(job, tools.api),
     handoffs: job.allowedHandoffs,
     resumeSessionId: job.resumeSessionId,
     model: job.model,
@@ -2592,7 +2734,8 @@ async function executeJob(job, tools, signal, input, record) {
   });
   await session.sent();
   signal.throwIfAborted();
-  const shouldPublish = job.stage.kind === "code" && outcome.completed;
+  const waitingFor = outcome.waitingFor ?? null;
+  const shouldPublish = job.stage.kind === "code" && outcome.completed && waitingFor === null;
   const pushed = shouldPublish ? await publishWorkspace(workspace, job, await gitToken(tools.api, job), identity) : [];
   return {
     outcome: outcome.completed ? "succeeded" : "failed",
@@ -2605,7 +2748,8 @@ async function executeJob(job, tools, signal, input, record) {
     sessionId: outcome.sessionId ?? null,
     pausedUntil: outcome.pausedUntil ?? null,
     questions: outcome.questions ?? null,
-    spec: outcome.spec ?? null
+    spec: outcome.spec ?? null,
+    waitingFor
   };
 }
 function clockOf(iso) {
@@ -2616,6 +2760,12 @@ function resultLine(finish2) {
   if (finish2.pausedUntil) {
     return `Paused: ${USAGE_LIMIT_REPORT}, resumes at ${clockOf(finish2.pausedUntil)}`;
   }
+  if (finish2.waitingFor !== null) {
+    return "Waiting for an answer on TAMsense. This computer is free for other tasks; the run continues here after the answer.";
+  }
+  if (finish2.verdict?.couldNotRun) {
+    return `Check could not run: ${finish2.verdict.report}`;
+  }
   if (finish2.verdict) {
     return finish2.verdict.passed ? "Check passed." : `Check did not pass: ${finish2.verdict.report}`;
   }
@@ -2667,7 +2817,7 @@ async function runJob(job, tools, stop) {
   try {
     finish2 = await executeJob(job, tools, run2.signal, input, record);
   } catch (error) {
-    finish2 = { outcome: "failed", report: failureReport(error, run2.signal), pushed: [], model: null, usage: null, verdict: null, handoff: null, sessionId: null, pausedUntil: null, questions: null, spec: null };
+    finish2 = { outcome: "failed", report: failureReport(error, run2.signal), pushed: [], model: null, usage: null, verdict: null, handoff: null, sessionId: null, pausedUntil: null, questions: null, spec: null, waitingFor: null };
   } finally {
     clearInterval(polling);
     clearInterval(feeding);
@@ -2791,8 +2941,7 @@ async function runLogin(server, deviceName) {
     { api, openBrowser, print, sleep, now: Date.now },
     { name, platform: platformLabel() }
   );
-  const browserDeclined = saved?.browserDeclined ? { browserDeclined: true } : {};
-  await writeConfig({ server: api.server, token: result.token, deviceId: result.device.id, deviceName: result.device.name, ...browserDeclined });
+  await writeConfig({ server: api.server, token: result.token, deviceId: result.device.id, deviceName: result.device.name });
   print(`Connected: ${result.device.name}. To take your tasks, run ${START_COMMAND}`);
 }
 function stopOnInterrupt() {
@@ -2807,15 +2956,12 @@ function stopOnInterrupt() {
 function installTools(home) {
   return { home, nodePath: process5.execPath, env: process5.env, print, run: runProcess, exists: existsSync4 };
 }
-async function browserForStart(home, saved) {
-  return await installedBrowser(home) ?? await offerBrowser({
-    interactive: Boolean(process5.stdin.isTTY && process5.stdout.isTTY),
-    declined: saved.browserDeclined === true,
-    print,
-    ask: askYesNo,
-    install: () => installBrowser(installTools(home)),
-    rememberDecline: async () => writeConfig({ ...saved, browserDeclined: true })
-  });
+async function browserForStart(home, install) {
+  const installed = await installedBrowser(home);
+  if (installed || !install) {
+    return installed;
+  }
+  return ensureBrowser({ print, install: () => installBrowser(installTools(home)) });
 }
 async function startedNewVersion() {
   const update = await updateToRun(process5.env, currentVersion(), () => latestVersion());
@@ -2831,7 +2977,7 @@ async function startedNewVersion() {
     return false;
   }
 }
-async function runStart(parallel) {
+async function runStart(parallel, installsBrowser) {
   if (await startedNewVersion()) {
     return;
   }
@@ -2848,17 +2994,13 @@ async function runStart(parallel) {
   }
   print(`${identity.device.name} is connected to ${saved.server} as ${describeDevice(identity)}.`);
   const home = homedir3();
-  const browser = await browserForStart(home, saved);
+  const browser = await browserForStart(home, installsBrowser);
   await work({ api, runAgent: runClaude, capabilities: probeCapabilities, print, sleep, home, remoteUrl: githubRemoteUrl, browser, recorder: bundledRecorder() }, stopOnInterrupt(), parallel);
 }
 async function runBrowser(remove) {
   const home = homedir3();
   if (remove) {
-    print(await removeBrowser(home) ? "Removed the headless browser." : "No headless browser is installed.");
-    const saved = await readConfig();
-    if (saved) {
-      await writeConfig({ ...saved, browserDeclined: true });
-    }
+    print(await removeBrowser(home) ? "Removed the headless browser. The next start installs it again, unless you add --no-browser." : "No headless browser is installed.");
     return;
   }
   const installed = await installedBrowser(home);
@@ -2893,7 +3035,7 @@ async function run(command) {
   if (command.name === "login") {
     await runLogin(command.server, command.deviceName);
   } else if (command.name === "start") {
-    await runStart(command.parallel);
+    await runStart(command.parallel, command.browser);
   } else if (command.name === "browser") {
     await runBrowser(command.remove);
   } else if (command.name === "status") {