@worca/app 1.1.1 → 1.2.0-rc.1

package/src/core/ask/spawn.mjs

@@ -60,7 +60,9 @@ export const ASK_DENY_RULES = Object.freeze([
 export const ASK_SPAWN_ENV = Object.freeze({ CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: '1' });
 
 /**
- * The per-thread Read allow rule of the chat's worktrees (P4 §6). Explicit
+ * The per-thread Read allow rules: the chat's worktrees (P4 §6) and its stored
+ * attachment bodies (#398 — read_attachment hands the model an `att/` path for
+ * an image or PDF, and the model views it with its own Read tool). Explicit
  * intent more than enforcement: under the engine's measured `unmatched ⇒ allow`
  * (gate E1, claude 2.1.241 — a path in neither list is read, verified OUTSIDE
  * the process cwd; and Grep ignored both `Read(<path>)` and `Grep(<path>)`
@@ -72,13 +74,14 @@ export const ASK_SPAWN_ENV = Object.freeze({ CLAUDE_CODE_DISABLE_BACKGROUND_TASK
  */
 export function askWorktreeAllowRules(threadId) {
   if (typeof threadId !== 'string' || !/^ask_[0-9a-f]{8}$/.test(threadId)) return [];
-  return [`Read(//**/.worca-cc/ask/${threadId}/wt/**)`];
+  return [`Read(//**/.worca-cc/ask/${threadId}/wt/**)`, `Read(//**/.worca-cc/ask/${threadId}/att/**)`];
 }
 
 export const SANDBOX_NOTE =
   "You are a sub-agent of Worca's assistant and run in the same sandbox: the only tools available are Task, Read, Grep, Glob and " +
   'the worca MCP tools (mcp__worca__*). You cannot run commands, edit files or use the network — do not try. ' +
-  "The only view into a repository is this chat's read-only detached worktrees: list_worktrees/open_worktree give the path; Read, Grep and Glob work under that path (never elsewhere on disk), and the worca `git` tool serves history and diffs. " +
+  "The only view into a repository is this chat's read-only detached worktrees: list_worktrees/open_worktree give the path; Read, Grep and Glob work under that path, and the worca `git` tool serves history and diffs. " +
+  'The one other place Read may go is the file path read_attachment returns for an image or PDF attachment of this chat; never read anywhere else on disk. ' +
   'Answer from tool results only; never invent run data; return a short report.';
 
 /** System-prompt-only mock markers (the runner parses the ask role from the SYSTEM prompt, Task 16). */

package/src/core/ask/store.mjs

@@ -3,13 +3,16 @@
 // SYNCHRONOUS (node:sqlite) and goes through getDb()/prepare()/tx() — never
 // node:sqlite directly. tx() is NOT re-entrant (db.mjs:897): the server must never
 // call a writer from inside its own tx(). Attachment bodies live on disk under
-// <worcaHome>/ask/<threadId>/att/<attachmentId>.txt — the path is built from the
-// ROW ID only, never from the user-supplied name.
+// <worcaHome>/ask/<threadId>/att/<attachmentId><ext> — the path is built from the
+// ROW ID plus the row's kind/mime (attachment-kind.mjs), never from the
+// user-supplied name. Text kinds stay `.txt`/utf8; binary kinds (#398) keep the
+// extension of their SNIFFED mime and raw bytes.
 import { randomBytes } from 'node:crypto';
-import { mkdirSync, writeFileSync, readFileSync, rmSync } from 'node:fs';
+import { mkdirSync, writeFileSync, readFileSync, rmSync, existsSync } from 'node:fs';
 import { basename, join } from 'node:path';
 import { getDb, prepare, tx } from '../db.mjs';
 import { worcaHome } from '../projects.mjs';
+import { extensionForAttachment } from './attachment-kind.mjs';
 
 export const ASK_ID_RE = /^[a-z]+_[0-9a-f]{8}$/;
 const ROLES = new Set(['user', 'assistant', 'system']);
@@ -53,7 +56,11 @@ function rowToMessage(r) {
   };
 }
 function rowToAttachment(r) {
-  return { id: r.id, threadId: r.thread_id, messageId: r.message_id ?? null, name: r.name, bytes: r.bytes, createdAt: r.created_at };
+  return {
+    id: r.id, threadId: r.thread_id, messageId: r.message_id ?? null, name: r.name, bytes: r.bytes,
+    kind: r.kind ?? 'text', mime: r.mime ?? null, // pre-v27 rows carry neither column value: they are text
+    createdAt: r.created_at,
+  };
 }
 function rowToRunLink(r) {
   return {
@@ -92,6 +99,33 @@ export function listThreads({ limit = 50 } = {}) {
   return rows.map((r) => ({ ...rowToThread(r), runLinks: r.run_links, worktrees: r.worktrees }));
 }
 
+/** Total saved chats — the History popover shows this, not the capped page listThreads returns. */
+export function countThreads() {
+  getDb();
+  const row = prepare('SELECT count(*) AS n FROM ask_threads').get();
+  return row ? Number(row.n) : 0;
+}
+
+/** Every thread id, oldest-updated first, NO limit — the bulk delete walks all of them. */
+export function listThreadIds() {
+  getDb();
+  return prepare('SELECT id FROM ask_threads ORDER BY updated_at, id').all().map((r) => r.id);
+}
+
+/** Global ask_worktrees row count (the per-thread count rides listThreads rows). */
+export function countWorktrees() {
+  getDb();
+  const row = prepare('SELECT count(*) AS n FROM ask_worktrees').get();
+  return row ? Number(row.n) : 0;
+}
+
+/** Global ask_attachments row count. */
+export function countAttachments() {
+  getDb();
+  const row = prepare('SELECT count(*) AS n FROM ask_attachments').get();
+  return row ? Number(row.n) : 0;
+}
+
 const THREAD_PATCH_COLS = { title: 'title', model: 'model', effort: 'effort', sessionId: 'session_id', context: 'context' };
 
 /** Patch ⊆ {title, model, effort, sessionId, context}; unknown keys ignored; always bumps updated_at. */
@@ -260,20 +294,36 @@ export function sweepStreamingMessages({ text = 'interrupted by restart' } = {})
 
 // ── attachments ─────────────────────────────────────────────────────────────
 
-export function addAttachment(threadId, messageId, { name, text } = {}) {
+/**
+ * Text kinds pass `{name, text}` (the pre-#398 signature, kind defaults 'text');
+ * binary kinds pass `{name, kind, mime, data}` with a Buffer that has already
+ * been sniffed by the route (attachment-kind.mjs) — the store trusts kind/mime
+ * only to pick the on-disk extension, never to build a path from `name`.
+ * NOTE (#398, issue point 8): binary bodies are raw pixel/PDF bytes — the
+ * redactAskText guard that runs over text attachment content structurally
+ * cannot apply to them; the model reads them via its Read tool as-is.
+ */
+export function addAttachment(threadId, messageId, { name, text, kind = 'text', mime = null, data = null } = {}) {
   getDb();
   if (!prepare('SELECT 1 FROM ask_threads WHERE id = ?').get(threadId)) {
     throw new Error(`addAttachment: unknown thread ${threadId}`);
   }
   const id = newAskId('att');
   const safeName = (basename(String(name ?? '')).slice(0, 255)) || 'attachment.txt';
-  const body = String(text ?? '');
-  const bytes = Buffer.byteLength(body, 'utf8');
   const dir = attachmentsDir(threadId);
   mkdirSync(dir, { recursive: true });
-  writeFileSync(join(dir, `${id}.txt`), body, 'utf8'); // file FIRST: a row without a file would 404 on read
-  prepare('INSERT INTO ask_attachments (id, thread_id, message_id, name, bytes, created_at) VALUES (?, ?, ?, ?, ?, ?)')
-    .run(id, threadId, messageId ?? null, safeName, bytes, now());
+  let bytes;
+  if (kind === 'text') {
+    const body = String(text ?? '');
+    bytes = Buffer.byteLength(body, 'utf8');
+    writeFileSync(join(dir, `${id}.txt`), body, 'utf8'); // file FIRST: a row without a file would 404 on read
+  } else {
+    if (!Buffer.isBuffer(data)) throw new Error('addAttachment: a non-text attachment needs a Buffer body');
+    bytes = data.length;
+    writeFileSync(join(dir, `${id}${extensionForAttachment(kind, mime)}`), data); // no encoding: raw bytes
+  }
+  prepare('INSERT INTO ask_attachments (id, thread_id, message_id, name, bytes, kind, mime, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)')
+    .run(id, threadId, messageId ?? null, safeName, bytes, kind, mime, now());
   return getAttachment(threadId, id);
 }
 
@@ -298,7 +348,7 @@ export function getAttachment(threadId, id) {
  */
 export function readAttachmentText(threadId, id) {
   const a = getAttachment(threadId, id);
-  if (!a || !ASK_ID_RE.test(a.id)) return null;
+  if (!a || !ASK_ID_RE.test(a.id) || a.kind !== 'text') return null; // a binary body is not utf8-readable
   try {
     return { ...a, text: readFileSync(join(attachmentsDir(threadId), `${a.id}.txt`), 'utf8') };
   } catch {
@@ -306,6 +356,34 @@ export function readAttachmentText(threadId, id) {
   }
 }
 
+/**
+ * Absolute on-disk path of an attachment's body — the pointer the read_attachment
+ * tool hands the model for binary kinds (its Read tool renders images and PDFs
+ * natively; the ask/ subtree is deliberately outside spawn.mjs ASK_DENY_RULES).
+ * Same guards as readAttachmentText: row must exist, id must be store-minted —
+ * and the body must actually be on disk. A row that outlived its file (DB-only
+ * restore, an external sweep of ask/<thread>/att) is the same `null` as a
+ * missing row: the model must never be handed a path whose Read fails ENOENT.
+ */
+export function attachmentPath(threadId, id) {
+  const a = getAttachment(threadId, id);
+  if (!a || !ASK_ID_RE.test(a.id)) return null;
+  const path = join(attachmentsDir(threadId), `${a.id}${extensionForAttachment(a.kind, a.mime)}`);
+  return existsSync(path) ? path : null;
+}
+
+/** Raw thread-scoped read for the download route: any kind, body as a Buffer. */
+export function readAttachmentRaw(threadId, id) {
+  const a = getAttachment(threadId, id);
+  const path = attachmentPath(threadId, id);
+  if (!a || !path) return null;
+  try {
+    return { ...a, buffer: readFileSync(path) };
+  } catch {
+    return null;
+  }
+}
+
 export function threadAttachmentBytes(threadId) {
   getDb();
   return prepare('SELECT COALESCE(SUM(bytes), 0) AS n FROM ask_attachments WHERE thread_id = ?').get(threadId).n;

package/src/core/ask/tool-deps.mjs

@@ -11,7 +11,7 @@ import { DIFF_PATCH_FILE } from '../results.mjs';
 import { GUARDRAIL_PRESETS } from '../guardrails.mjs';
 import { buildCatalog } from './catalog.mjs';
 import { validateProposal } from './proposal.mjs';
-import { readAttachmentText } from './store.mjs';
+import { readAttachmentText, getAttachment, attachmentPath, getThread } from './store.mjs';
 import { redactAskText } from './redact.mjs';
 import { ASK_LIMITS } from './limits.mjs';
 
@@ -49,10 +49,34 @@ export function defaultToolDeps({ threadId }) {
     readDiffPatch,
     hasDiffPatch,
     readAttachment: (id) => {
-      const a = threadId ? readAttachmentText(threadId, id) : null;
-      return a ? { name: a.name, text: a.text } : null;
+      const row = threadId ? getAttachment(threadId, id) : null;
+      if (!row) return null;
+      if (row.kind === 'text') {
+        const a = readAttachmentText(threadId, id);
+        return a ? { name: a.name, kind: 'text', text: a.text } : null;
+      }
+      // Binary kinds (#398): metadata plus the on-disk path — the model views the
+      // body with its own Read tool; sliceBytes over raw bytes would be garbage.
+      // attachmentPath is null when the body is gone (DB-only restore, an external
+      // sweep of ask/<t>/att): the same not-found the text branch reports, never a
+      // path whose Read then fails with a raw ENOENT the model may retry.
+      const path = attachmentPath(threadId, id);
+      return path ? { name: row.name, kind: row.kind, mime: row.mime, bytes: row.bytes, path } : null;
     },
     validateProposal,
+    // #397: the user-pinned scope of the owning thread — {projectKey}|{workspaceId}|
+    // null — read fresh from the thread row per call, so a selector change lands on
+    // the very next tool call. A missing thread or an unreadable DB means "nothing
+    // pinned", never an error.
+    pinnedScope: () => {
+      if (!threadId) return null;
+      let c = null;
+      try { c = getThread(threadId)?.context ?? null; } catch { return null; }
+      if (!c || c.pinned !== true) return null;
+      if (typeof c.projectKey === 'string' && c.projectKey) return { projectKey: c.projectKey };
+      if (typeof c.workspaceId === 'string' && c.workspaceId) return { workspaceId: c.workspaceId };
+      return null;
+    },
     // The SECURE preset is the floor, not the run's own set: guardrailsId defaults
     // to 'permissive' (empty protectedPaths), so resolving per row would show the
     // model every credential file on most runs. This only ever omits more.

package/src/core/ask/tools.mjs

@@ -298,6 +298,14 @@ const SCHEMA = {
 export function createAskTools(deps) {
   const L = deps.limits;
 
+  // #397: the user-pinned scope of this conversation — {projectKey}|{workspaceId}|
+  // null — re-read per call so a mid-conversation selector change is honoured.
+  // Optional dep: an absent or failing reader means "nothing pinned", never an error.
+  const pinnedScope = () => {
+    try { return typeof deps.pinnedScope === 'function' ? (deps.pinnedScope() || null) : null; }
+    catch { return null; }
+  };
+
   const defs = [
     { name: 'list_projects',
       description: 'List the registered projects (key, name, path) and workspaces (id, name, member project keys). Use the key / id in the other tools.',
@@ -310,7 +318,7 @@ export function createAskTools(deps) {
       inputSchema: SCHEMA.obj({ projectKey: SCHEMA.s('project key from list_projects'), workspaceId: SCHEMA.s('workspace id from list_projects'),
         status: SCHEMA.s('run status to match'), limit: SCHEMA.i('max results (1-100)', 1, L.listRunsMaxLimit), query: SCHEMA.s('case-insensitive title substring') }) },
     { name: 'get_run',
-      description: 'Read one run: its metadata and the user\'s original prompt. Give projectKey or workspaceId when known; without them the id is searched everywhere.',
+      description: 'Read one run: its metadata and the user\'s original prompt. Give projectKey or workspaceId when known; without them the user-pinned scope (when the chat has one) is tried first, then the id is searched everywhere.',
       inputSchema: SCHEMA.obj({ id: SCHEMA.s('run id (8 hex)'), projectKey: SCHEMA.s('scope to a project'), workspaceId: SCHEMA.s('scope to a workspace') }, ['id']) },
     { name: 'get_run_diff',
       description: 'Read the unified diff of a run, paged by byte offset (use nextOffset until truncated is false). Optional path = one file only. files[] lists every file with added/removed counts; credential files are omitted.',
@@ -318,7 +326,7 @@ export function createAskTools(deps) {
         path: SCHEMA.s('only this file path'), offset: SCHEMA.i('byte offset to start at', 0, Number.MAX_SAFE_INTEGER),
         maxBytes: SCHEMA.i('bytes per page (default 60000, max 200000)', 1, L.diffMaxBytes) }, ['id']) },
     { name: 'propose_run',
-      description: 'Propose a pipeline run for the user to confirm — it never starts anything. Exactly one of projectKey / workspaceId. guardrailsId defaults to "normal"; "permissive" is not allowed. Returns {ok:true, card} or {ok:false, errors}.',
+      description: 'Propose a pipeline run for the user to confirm — it never starts anything. Exactly one of projectKey / workspaceId; omitting both targets the scope the user pinned for this chat, when there is one. guardrailsId defaults to "normal"; "permissive" is not allowed. Returns {ok:true, card} or {ok:false, errors}.',
       inputSchema: SCHEMA.obj({ projectKey: SCHEMA.s('target project key'), workspaceId: SCHEMA.s('target workspace id'), workflowId: SCHEMA.s('workflow id (default wf_default)'),
         brief: SCHEMA.s('the full task description for the run (≤ 8000 chars)'), title: SCHEMA.s('short run title'), guardrailsId: SCHEMA.s('guardrail set id (default normal)'),
         sourceBranch: SCHEMA.s('branch to start from (default: current)'), featureBranch: SCHEMA.s('feature branch name'),
@@ -326,7 +334,7 @@ export function createAskTools(deps) {
         commentIds: { type: 'array', items: { type: 'string' },
           description: 'diff comment ids (dc_…) this run is meant to address. They are stamped with the run id once the user confirms the card AND the run actually starts; nothing is resolved.' } }, ['brief']) },
     { name: 'read_attachment',
-      description: 'Read an attachment of this conversation by id, paged by byte offset (default 32000 bytes per page).',
+      description: 'Read an attachment of this conversation by id. Text attachments return their content, paged by byte offset (default 32000 bytes per page). Image and PDF attachments return metadata plus a file path — pass that path to your Read tool to view the content.',
       inputSchema: SCHEMA.obj({ id: SCHEMA.s('attachment id'), offset: SCHEMA.i('byte offset', 0, Number.MAX_SAFE_INTEGER), maxBytes: SCHEMA.i('bytes per page', 1, L.attachmentReadMaxBytes) }, ['id']) },
     { name: 'list_diff_comments',
       description: 'List the internal review comments anchored to a run\'s diff lines, ordered by file then line then when they were written. status filters them (all | unresolved | resolved, default all); path narrows to one file. Every comment carries line_text — the snapshot of the line it was anchored to, taken when it was written, so it stays readable even though the source branch has moved on. When the patch is still readable, a few surrounding hunk lines come with each comment. Comments on credential files are never listed.',
@@ -373,11 +381,19 @@ export function createAskTools(deps) {
     const projectKey = str(input.projectKey);
     const workspaceId = str(input.workspaceId);
     if (projectKey && workspaceId) throw new AskToolError(`${tool}: give projectKey OR workspaceId, not both`);
-    const row = projectKey
-      ? deps.lookupPipelineRow(projectKey, id)
-      : workspaceId
-        ? deps.lookupPipelineRow(`workspaces/${workspaceId}`, id)
-        : deps.findPipelineRowById(id);
+    let row;
+    if (projectKey) row = deps.lookupPipelineRow(projectKey, id);
+    else if (workspaceId) row = deps.lookupPipelineRow(`workspaces/${workspaceId}`, id);
+    else {
+      // #397: an unscoped id tries the user-pinned scope first (disambiguation
+      // when the same short id exists in two stores), then everywhere — never
+      // fewer results than an unpinned chat.
+      const pin = pinnedScope();
+      row = (pin && pin.projectKey ? deps.lookupPipelineRow(pin.projectKey, id)
+        : pin && pin.workspaceId ? deps.lookupPipelineRow(`workspaces/${pin.workspaceId}`, id)
+          : null)
+        || deps.findPipelineRowById(id);
+    }
     if (!row) throw new AskToolError(`${tool}: run not found`);
     return row;
   }
@@ -617,7 +633,15 @@ export function createAskTools(deps) {
       return { available: true, files, ...sliceBytes(filtered(str(input.path)), offset, maxBytes) };
     },
     async propose_run(input) {
-      const r = await deps.validateProposal(input);
+      // #397: a proposal naming NO target defaults to the user-pinned scope. The
+      // parent turn applies the same default before its authoritative
+      // re-validation, so the card the user sees matches what the model got.
+      let inp = input;
+      if (!str(input.projectKey) && !str(input.workspaceId)) {
+        const pin = pinnedScope();
+        if (pin) inp = { ...input, ...pin };
+      }
+      const r = await deps.validateProposal(inp);
       // commentIds are a ONE-WAY hand-off: a comment cited here is stamped
       // "sent to #<runId>" the moment the user starts the run, and nothing ever
       // un-stamps it. Refuse ids from a different project/workspace than this
@@ -729,10 +753,17 @@ export function createAskTools(deps) {
       if (!id) throw new AskToolError('read_attachment: id is required');
       const a = deps.readAttachment(id);
       if (!a) throw new AskToolError('read_attachment: attachment not found');
+      if (a.kind && a.kind !== 'text') {
+        // #398: never a sliceBytes view of binary garbage — and deps.redact is a
+        // TEXT guard, so the body deliberately does not pass through it (the
+        // model reads the raw file; nothing here can scrub pixels).
+        return { name: a.name, kind: a.kind, mime: a.mime, totalBytes: a.bytes, path: a.path,
+          note: 'binary attachment: pass `path` to your Read tool to view the content' };
+      }
       const offset = clampInt(input.offset, 0, Number.MAX_SAFE_INTEGER, 0);
       const maxBytes = clampInt(input.maxBytes, 1, L.attachmentReadMaxBytes, L.attachmentReadDefaultBytes);
       const { text, truncated, totalBytes, nextOffset } = sliceBytes(deps.redact(a.text), offset, maxBytes);
-      return { name: a.name, text, truncated, totalBytes, nextOffset };
+      return { name: a.name, kind: 'text', text, truncated, totalBytes, nextOffset };
     },
     async open_worktree(input) {
       try {

package/src/core/ask/turn.mjs

@@ -16,7 +16,7 @@ import { join, dirname, resolve as pathResolve } from 'node:path';
 import { mkdir, writeFile, unlink } from 'node:fs/promises';
 
 import { runClaude } from '../claude-runner.mjs';
-import { resolveModelEnv, resolveModelCost } from '../config.mjs';
+import { resolveModelEnv, resolveModelCost, estimateCost, liveCostRates as defaultLiveCostRates } from '../config.mjs';
 import { worcaHome } from '../projects.mjs';
 import { generateTitle } from '../title.mjs';
 import { createTurnReducer } from './events.mjs';
@@ -40,6 +40,7 @@ class AskTurn extends EventEmitter {
     model, effort, resumeSessionId = null,
     firstTurn = false, firstText = '', deterministicTitle = null,
     mock = null, attachmentNames = {},
+    pinnedScope = null,
     deps = {},
   } = {}) {
     super();
@@ -57,6 +58,8 @@ class AskTurn extends EventEmitter {
     this.deterministicTitle = deterministicTitle ?? null;
     this.mock = mock || null;
     this.attachmentNames = attachmentNames || {};
+    // #397: {projectKey}|{workspaceId}|null — the user-pinned scope at POST time.
+    this.pinnedScope = pinnedScope && typeof pinnedScope === 'object' ? pinnedScope : null;
     this.deps = {
       runClaudeImpl: deps.runClaudeImpl ?? runClaude,
       store: {
@@ -84,6 +87,11 @@ class AskTurn extends EventEmitter {
       onFrame: deps.onFrame ?? (() => {}),
       onOutOfTurn: deps.onOutOfTurn ?? (() => {}),
       onCommentMutation: deps.onCommentMutation ?? (() => {}),
+      onWorktreeMutation: deps.onWorktreeMutation ?? (() => {}),
+      // DISPLAY-ONLY rates for the footer's live "≈" estimate (config.mjs
+      // liveCostRates: override → list price → null). Injectable so tests pin
+      // the frame arithmetic without the catalog.
+      liveCostRates: deps.liveCostRates ?? defaultLiveCostRates,
     };
     this.abort = new AbortController();
     this.status = 'created';
@@ -93,6 +101,7 @@ class AskTurn extends EventEmitter {
     this.sessionId = this.resumeSessionId;
     this.scratchDir = null;
     this.titlePromise = Promise.resolve();
+    this._titleKicked = false;
     this._completed = false;
   }
 
@@ -125,10 +134,23 @@ class AskTurn extends EventEmitter {
   async _onProposal(input) {
     const d = this.deps;
     const cardId = d.newAskId('card');
+    const raw = input && typeof input === 'object' ? input : {};
+    // #397: a proposal that names NO target falls back to the user-pinned scope.
+    // Mirrors the MCP child's own defaulting, so this authoritative re-validation
+    // builds the same card the model was shown.
+    const pin = this.pinnedScope;
+    const hasTarget = (typeof raw.projectKey === 'string' && raw.projectKey.trim())
+      || (typeof raw.workspaceId === 'string' && raw.workspaceId.trim());
+    const inp = pin && !hasTarget ? { ...raw, ...pin } : raw;
     try {
-      const r = await d.validateProposal(input && typeof input === 'object' ? input : {}, { cardId });
+      const r = await d.validateProposal(inp, { cardId });
       if (r && r.ok) {
-        this.reducer.addBlock({ kind: 'card', id: cardId, state: 'proposed', card: r.card });
+        // #397 guardrail: a proposal targeting a DIFFERENT project/workspace than
+        // the pinned one is accepted but flagged — the card renders the mismatch
+        // instead of silently absorbing it.
+        const scopeMismatch = !!pin && ((pin.projectKey && r.card.projectKey !== pin.projectKey)
+          || (pin.workspaceId && r.card.workspaceId !== pin.workspaceId));
+        this.reducer.addBlock({ kind: 'card', id: cardId, state: 'proposed', card: r.card, ...(scopeMismatch ? { scopeMismatch: true } : {}) });
         // commentIds are propose_run INPUT only: they never enter the card block (its
         // key set is pinned in test/ask-proposal.test.mjs) nor CARD_PATCH_KEYS. Parked
         // against the card id until the user starts the run; unknown ids are dropped,
@@ -148,6 +170,10 @@ class AskTurn extends EventEmitter {
 
   _makeReducer() {
     const d = this.deps;
+    // One settings read per attempt, never per frame. null → the frames carry
+    // estimatedCostUsd:null and the footer keeps today's behaviour.
+    let liveRates = null;
+    try { liveRates = d.liveCostRates(this.model) ?? null; } catch { liveRates = null; }
     this.reducer = createTurnReducer({
       onFrame: (f) => this._frame(f),
       now: d.now,
@@ -165,6 +191,13 @@ class AskTurn extends EventEmitter {
       // The MCP child cannot broadcast; the parent turns its comment writes into
       // the same poke the REST routes emit.
       onCommentMutation: (e) => { try { this.deps.onCommentMutation(e); } catch { /* a broken sink never breaks the turn */ } },
+      // Same shape for worktrees: open/remove/navigate in the child → the server
+      // broadcasts the thread's worktree envelope (ui/server.mjs emitAskWorktrees).
+      onWorktreeMutation: (e) => { try { this.deps.onWorktreeMutation(e); } catch { /* a broken sink never breaks the turn */ } },
+      // DISPLAY ONLY — never a sink input: prices the running usage sum (main +
+      // sub-agent tokens) at the TURN model's rates; the "≈" in the footer owns
+      // that approximation. _complete() reads summary.costUsd, not this.
+      estimateLiveCost: liveRates ? (usage) => estimateCost(usage, liveRates) : null,
     });
     return this.reducer;
   }
@@ -275,6 +308,11 @@ class AskTurn extends EventEmitter {
       const scratchDir = join(d.worcaHome(), 'tmp', 'ask');
       this.scratchDir = scratchDir;
       await d.fs.mkdir(scratchDir, { recursive: true });
+      // D13 title runs CONCURRENTLY with the turn from here — the haiku call
+      // cwd's into scratchDir, so not a line earlier. Idempotent: the call after
+      // _attempts below is the backstop for a mkdir/write failure, so "fires
+      // after ANY terminal status of the first turn" stays true.
+      this._kickoffTitle();
       const homeBase = process.env.WORCA_HOME?.trim()
         ? pathResolve(process.env.WORCA_HOME)
         : dirname(d.worcaHome());
@@ -387,12 +425,14 @@ class AskTurn extends EventEmitter {
   }
 
   _kickoffTitle() {
-    if (!this.firstTurn) return;
+    if (!this.firstTurn || this._titleKicked) return;
+    this._titleKicked = true;
     const d = this.deps;
-    // Fire-and-forget after ANY terminal status of the first turn (§7.4).
+    // Fire-and-forget: kicked off at the START of the first turn (right after
+    // the scratch dir exists) and backstopped after its terminal status (§7.4).
     // Stored for test determinism, never awaited by run() (orchestrator.mjs:3821).
-    // NO signal: after a user stop this.abort is already aborted and would kill
-    // the call before it spawns. permissionMode 'dontAsk' is the B-1 fix.
+    // NO signal: a user stop aborts this.abort mid-turn and would kill the call
+    // before it spawns. permissionMode 'dontAsk' is the B-1 fix.
     this.titlePromise = Promise.resolve()
       .then(() => d.generateTitle(this.firstText, {
         cwd: this.scratchDir || join(d.worcaHome(), 'tmp', 'ask'),
@@ -400,12 +440,18 @@ class AskTurn extends EventEmitter {
         disableSlashCommands: true, envScrub: true, envAllowlist: [],
         permissionMode: 'dontAsk',
       }))
-      .then((title) => {
-        if (!title || title === this.deterministicTitle) return;
-        // setThreadTitle's onlyIf is the rename guard: a PATCHed or deleted
-        // thread makes the UPDATE match 0 rows and the frame is suppressed.
+      .then((generated) => {
+        // The route stamps NOTHING before the 202 (the header reads "Ask Worca"
+        // until this frame lands), so an empty result — generateTitle swallows
+        // every failure/abort/refusal into '' — falls back to the route's
+        // deterministicTitle (sanitized first 80 chars, or "New chat"). That is
+        // the ONLY moment the prompt text may become the title.
+        const title = generated || this.deterministicTitle;
+        if (!title) return;
+        // `onlyIf: null` (title IS NULL) is the rename guard: a PATCHed or
+        // deleted thread makes the UPDATE match 0 rows and the frame is suppressed.
         let applied = false;
-        try { applied = d.store.setThreadTitle(this.threadId, title, { onlyIf: this.deterministicTitle }); }
+        try { applied = d.store.setThreadTitle(this.threadId, title, { onlyIf: null }); }
         catch { /* deleted thread */ }
         if (applied) {
           try { d.onOutOfTurn({ type: 'ask-title', title }); } catch { /* sink */ }

package/src/core/chat/command-router.mjs

@@ -14,6 +14,7 @@ import { parseCommand } from './parser.mjs';
 import { BOOKEND_EXECUTION_IDS } from '../../shared/graph/constants.mjs';
 import { createAllowlistGuard, parseIdList } from './allowlist.mjs';
 import { runRef, fmtUsd, fmtMs } from './renderers.mjs';
+import { giveUpOption, describePauseReason, pauseConsequences } from '../failure-policy.mjs';
 
 const md = (value) => ({ kind: 'markdown', value });
 const reply = (text, severity = 'info') => ({ title: null, body: [md(text)], severity });
@@ -44,7 +45,7 @@ const HELP_TEXT = [
   '`/status [*ref]` — run detail · `/cost [*ref]` — run cost',
   '`/pause [*ref]` · `/stop [*ref]` · `/resume [*ref]`',
   '`/approve [*ref]` — continue past a gate · `/retry [*ref]` — another cycle',
-  '`/abort [*ref]` — abort a recovery prompt',
+  '`/abort [*ref]` — give up on a recovery prompt (pauses the run; nothing is discarded)',
   '`/answer [*ref] <n|text> [| …]` — answer clarify questions (option number, or text for free-text)',
   '`/projects` · `/use <name>` — scope commands to one project',
   '`/mute 30m|2h|1d` · `/unmute` — silence notifications for this chat',
@@ -174,7 +175,8 @@ export function createCommandRouter({ actions, chatContext, logger = () => {} })
         const r = t.row;
         return reply([runLine({ ...r, runId: r.id }),
           ...(fmtUsd(r.totalCostUsd) ? [`   **Cost:** ${fmtUsd(r.totalCostUsd)}`] : []),
-          ...(r.pauseReason ? [`   **Pause reason:** ${r.pauseReason}`] : []),
+          ...(r.pauseReason ? [`   **Pause reason:** ${describePauseReason(r.pauseReason) || r.pauseReason}`] : []),
+          ...(r.pauseDetail ? [`   **${pauseConsequences(r.pauseReason).severity === 'error' ? 'Error' : 'Cause'}:** ${r.pauseDetail}`] : []),
         ].join('\n'));
       }
       const r = t.run;
@@ -322,14 +324,16 @@ export function createCommandRouter({ actions, chatContext, logger = () => {} })
       if (verb === 'abort') return reply(`Gates have no abort — \`/approve ${ref}\`, \`/retry ${ref}\`, or \`/stop ${ref}\`.`, 'warning');
       payload = { decision: verb === 'approve' ? 'continue' : 'another' };
     } else if (pq.kind === 'recovery') {
-      payload = { decision: verb === 'abort' ? 'abort' : 'retry' };
+      // /abort is the give-up choice; what it does (pause or abort) is the row's
+      // option (failure-policy.mjs) — the option id is the wire decision.
+      payload = { decision: verb === 'abort' ? giveUpOption(pq.recovery?.options).id : 'retry' };
     } else {
       return reply(`\`${ref}\` is waiting on ${pq.kind} — use \`/answer ${ref} <n>\`.`, 'warning');
     }
     await actions.answer(t.run.runId, pq.id, payload);
     const what = pq.kind === 'gate'
       ? (payload.decision === 'continue' ? 'approved — continuing' : 'sent back for another cycle')
-      : (payload.decision === 'retry' ? 'retrying' : 'aborting');
+      : (payload.decision === 'retry' ? 'retrying' : payload.decision === 'abort' ? 'aborting the run' : 'pausing the run');
     return reply(`✅ \`${ref}\` ${what}.`, 'success');
   }
 

package/src/core/chat/notifier.mjs

@@ -14,6 +14,7 @@ import { readPluginConfig } from '../plugin-config.mjs';
 import { parseIdList } from './allowlist.mjs';
 import { createRateLimiter } from './rate-limiter.mjs';
 import { renderDone, renderError, renderQuestion } from './renderers.mjs';
+import { pauseConsequences } from '../failure-policy.mjs';
 
 /**
  * @param {{channelHost: object, getPrefs: () => {notify:object, channels:object},
@@ -89,7 +90,11 @@ export function createNotifier({ channelHost, getPrefs, chatContext, logger = ()
         const status = payload?.status || 'done';
         if (status === 'error') return; // the richer 'error' event already went out
         const prefs = getPrefsSafe().notify;
-        if (status === 'paused' ? prefs.paused === false : prefs.done === false) return;
+        // Which preference gates a pause follows its reason (failure-policy.mjs):
+        // an error-pause IS the failure notification (no 'error' event precedes
+        // it), so notify.error gates it, not notify.paused.
+        const gate = status === 'paused' ? prefs[pauseConsequences(payload?.reason).notifyPref] : prefs.done;
+        if (gate === false) return;
         deliver(renderDone(meta(), payload || {}));
       }));
 

package/src/core/chat/renderers.mjs

@@ -9,6 +9,8 @@
 // ordinals and embeds the exact reply commands (/approve, /retry, /answer n…)
 // using the run-id wildcard-suffix convention the command router resolves.
 
+import { pauseConsequences, describePauseReason, giveUpOption } from '../failure-policy.mjs';
+
 const md = (value) => ({ kind: 'markdown', value });
 
 export function fmtMs(ms) {
@@ -41,10 +43,6 @@ function head(icon, meta) {
   return parts;
 }
 
-const PAUSE_REASONS = {
-  cost_pipeline: 'pipeline cost limit reached',
-  cost_total: 'total cost limit reached',
-};
 
 /**
  * done event: status done|stopped|paused (+reason for limit pauses).
@@ -53,11 +51,20 @@ const PAUSE_REASONS = {
 export function renderDone(meta, payload = {}) {
   const status = payload.status || 'done';
   if (status === 'paused') {
-    const reason = payload.reason ? (PAUSE_REASONS[payload.reason] || payload.reason) : null;
-    const parts = head('⏸', meta);
+    // The icon, severity and wording follow the pause's reason (failure-policy.mjs):
+    // an error-pause IS the failure notification (no 'error' event precedes it).
+    const { severity } = pauseConsequences(payload.reason);
+    const isError = severity === 'error';
+    const reason = payload.reason ? (describePauseReason(payload.reason) || payload.reason) : null;
+    const parts = head(isError ? '\u{1F534}' : '⏸', meta);
     parts.push(`   **Status:** paused${reason ? ` — ${reason}` : ''}`);
+    if (payload.detail && payload.reason) {
+      // Already bounded (PAUSE_DETAIL_MAX, middle-clipped so the runner's trailing
+      // cause survives) — a head clip here would throw exactly that tail away.
+      parts.push(`   **${isError ? 'Error' : 'Cause'}:** ${String(payload.detail)}`);
+    }
     parts.push(`   Resume from the worca-cc UI, or reply: /resume ${runRef(meta.runId)}`);
-    return mdMsg(parts.join('\n'), 'warning');
+    return mdMsg(parts.join('\n'), isError ? 'error' : 'warning');
   }
   if (status === 'stopped') {
     const parts = head('⏹', meta);
@@ -109,7 +116,7 @@ export function renderQuestion(meta, payload = {}) {
     }
     parts.push(kind === 'gate'
       ? `   Reply: /approve ${ref} to continue · /retry ${ref} for another cycle`
-      : `   Reply: /approve ${ref} to retry · /abort ${ref} to abort`);
+      : `   Reply: /approve ${ref} to retry · /abort ${ref} to ${giveUpOption(payload.recovery?.options).id === 'abort' ? 'abort the run' : 'pause the run'}`);
     return mdMsg(parts.join('\n'), 'warning');
   }