codeden 0.4.4 → 0.5.0

package/dist/{main-CKLHi4sz.js → main-BQwSt6Az.js}

@@ -1,5 +1,5 @@
 import { n as __require, r as __toESM, t as __commonJSMin } from "./rolldown-runtime-DegdyBIC.js";
-import { $ as BrowserNavigateRequest, $n as InboxItemKind, $t as isNewerVersion, A as SessionFileQuery, An as TriagePolicy, Ar as unknown, At as RespondRequest, B as NetworkStatus, Bn as TerminalClientMessage, Bt as HealthResponse, C as isElectronRuntime, Cn as isFactoryMode, Cr as number, Ct as CreateProjectRequest, D as CODEDEN_VERSION, Dn as AutomationGuards, Dr as record, Dt as ListSessionsQuery, E as wrapper_default, En as AutomationAction, Er as preprocess, Et as ListInboxQuery, F as ListConflictsQuery, Fn as GitCommitRequest, Ft as StartSessionRequest, G as SetNetworkPasswordResponse, Gn as ConflictDecision, Gt as LOCAL_STT_SAMPLE_RATE, H as RemoteAccessFile, Hn as RunnerCommandResults, Ht as READ_ALOUD_FULL_MAX_CHARS, I as ListNoticesQuery, In as GitPushRequest, It as SteerRequest, J as ImageTestRequest, Jn as Project, Jt as TtsRequest, K as SignInRequest, Kn as StartedBy, Kt as LocalSttModelParams, L as ResolveConflictRequest, Ln as RestoreFilesRequest, Lt as ThreadItemsQuery, M as RunnerToServerMessage, Mn as SessionStatus, Mr as toJSONSchema, Mt as SendMessageRequest, N as ServerLock, Nn as DiffScope, Nr as safeParse$1, Nt as SessionStartMeta, O as UsageQuery, On as AutomationRun, Or as string, Ot as ReorderProjectsRequest, P as ArchiveSessionRequest, Pn as EditQueuedMessageRequest, Pr as prettifyError, Pt as SetSecretRequest, Q as BrowserHistoryRequest, Qn as InboxItem, Qt as compareVersions, R as RoleMessageRequest, Rn as SessionResult, Rt as UiClientMessage, S as acquireInstallLock, Sn as SetAutonomyModeRequest, Sr as looseObject, St as UpdateAutomationRequest, T as import_websocket_server, Tn as Automation, Tr as optional, Tt as FileWriteRequest, U as SetNetworkAccessRequest, Un as SessionOptions, Ut as Settings, V as PASSWORD_RULE_TEXT, Vn as TerminalQuery, Vt as agentEventToNewEvent, W as SetNetworkPasswordRequest, Wn as ProjectConfigFile, Wt as speechExcerpt, X as BrowserClientMessage, Xn as DEFAULT_VISION_PATH, Xt as UpdateInstallRequest, Y as summarizeActivity, Yn as sortProjects, Yt as AppPointer, Z as BrowserDevServerRequest, Zn as FactoryLimits, Zt as UpdateStatus, _ as importClaudeSdkFrom, _n as FactoryTuning, _r as custom, _t as StarterSetRequest, a as Hono, an as GithubLabelRequest, ar as AgentConfigWriteRequest, at as AutomationImportSource, b as runNpm, bn as PutVisionRequest, br as intersection, bt as UpcomingRunsQuery, c as createAdaptorServer, cn as MergePrRequest, cr as McpServerUpsertRequest, ct as ImportAutomationsRequest, d as createImageEngineRegistry, dn as parseGithubPrId, dr as ReasoningEffort, dt as AutomationProjectRequest, en as ConflictRecord, er as messageFrom, et as BrowserNewTabRequest, f as IMAGE_ASPECT_RATIOS, fn as DiscoveryArea, fr as datetime, ft as CreateAutomationRequest, g as CLAUDE_SDK_VERSION, gn as FactoryTriageRequest, gr as boolean, gt as SetAutomationEnabledRequest, h as claudeSdkSource, hn as FactoryDecisionRequest, hr as array, ht as RunAutomationRequest, i as killTree$1, in as GithubIssue, ir as AgentConfigLocator, it as AUTOMATION_IMPORT_LIMITS, j as RunnerLock, jn as Session, jr as ZodError, jt as SecretKey, k as UsageSettings, kn as AutomationTrigger, kr as union$1, kt as ResolveInboxRequest, l as upgradeWebSocket, ln as TriageIssueRequest, lr as AutonomyLevel, lt as AutomationFileFrontmatter, m as ImageGenerationError, mn as FactoryCandidate, mr as _null, mt as ListAutomationsQuery, n as readLock, nn as CreateGithubIssueRequest, nr as AgentConfigDiffRequest, nt as BrowserViewportRequest, o as tryDecodeURIComponent, on as GithubListQuery, or as McpServerDiffRequest, ot as DuplicateAutomationRequest, p as resolveImageOutput, pn as FactoryAllowLargeChangeRequest, pr as _enum, pt as ListAutomationRunsQuery, q as passwordProblem, qn as WorkKey, qt as SttQuery, r as isAlive, rn as GithubCommentRequest, rr as AgentConfigListQuery, rt as BrowserWsQuery, s as bufferToFormData, sn as GithubPr, sr as McpServerTarget, st as ExportAutomationsQuery, tn as NOTICE_BATCH_CODE, tr as AgentConfigDeleteQuery, tt as BrowserOpenRequest, u as ImageEngineRegistry, un as githubPrId, ur as ProviderId, ut as AutomationGuardsPatch, v as installClaudeSdk, vn as KillSwitchRequest, vr as discriminatedUnion, vt as TriageDecisionRequest, w as ownNodeEnv, wn as Artifact, wr as object, wt as FileReadQuery, x as resolveNpm, xn as ReviewVerdict, xr as literal, xt as UpdateAutomationProjectSettingsRequest, y as isClaudeSdkInstalled, yn as LEGACY_SIZE_LIMITS, yr as int, yt as TriageReport, z as UpdateSessionRequest, zn as SpeechSummaryRequest, zt as UpdateProjectRequest } from "./runner-DjavcMnG.js";
+import { $ as SetNetworkPasswordResponse, $n as SessionOptions, $t as speechExcerpt, A as findExecutable, An as PutVisionRequest, Ar as intersection, At as UpdateAutomationProjectSettingsRequest, B as RunnerToServerMessage, Bn as TriagePolicy, Br as unknown, Bt as SecretKey, C as importClaudeSdkFrom, Cn as FactoryAllowLargeChangeRequest, Cr as _enum, Ct as ListAutomationsQuery, D as resolveNpm, Dn as FactoryTuning, Dr as custom, Dt as TriageDecisionRequest, E as runNpm, En as FactoryTriageRequest, Er as boolean, Et as StarterSetRequest, F as CODEDEN_VERSION, Fn as Automation, Fr as optional, Ft as ListInboxQuery, G as ResolveConflictRequest, Gn as GitCommitRequest, Gt as SteerRequest, H as ArchiveSessionRequest, Hn as SessionStatus, Hr as toJSONSchema, Ht as SessionStartMeta, I as UsageQuery, In as AutomationAction, Ir as preprocess, It as ListSessionsQuery, J as NetworkStatus, Jn as SessionResult, Jt as UpdateProjectRequest, K as RoleMessageRequest, Kn as GitPushRequest, Kt as ThreadItemsQuery, L as UsageSettings, Ln as AutomationGuards, Lr as record, Lt as ReorderProjectsRequest, M as ownNodeEnv, Mn as SetAutonomyModeRequest, Mr as looseObject, Mt as CreateProjectRequest, N as import_websocket_server, Nn as isFactoryMode, Nr as number, Nt as FileReadQuery, O as acquireInstallLock, On as KillSwitchRequest, Or as discriminatedUnion, Ot as TriageReport, P as wrapper_default, Pn as Artifact, Pr as object, Pt as FileWriteRequest, Q as SetNetworkPasswordRequest, Qn as RunnerCommandResults, Qt as Settings, R as SessionFileQuery, Rn as AutomationRun, Rr as string, Rt as ResolveInboxRequest, S as CLAUDE_SDK_VERSION, Sn as DiscoveryArea, Sr as datetime, St as ListAutomationRunsQuery, T as isClaudeSdkInstalled, Tn as FactoryDecisionRequest, Tr as array, Tt as SetAutomationEnabledRequest, U as ListConflictsQuery, Un as DiffScope, Ur as safeParse$1, Ut as SetSecretRequest, V as ServerLock, Vn as Session, Vr as ZodError, Vt as SendMessageRequest, W as ListNoticesQuery, Wn as EditQueuedMessageRequest, Wr as prettifyError, Wt as StartSessionRequest, X as RemoteAccessFile, Xn as TerminalClientMessage, Xt as agentEventToNewEvent, Y as PASSWORD_RULE_TEXT, Yn as SpeechSummaryRequest, Yt as HealthResponse, Z as SetNetworkAccessRequest, Zn as TerminalQuery, Zt as READ_ALOUD_FULL_MAX_CHARS, _ as ImageGenerationError, _n as GithubPr, _r as McpServerTarget, _t as ImportAutomationsRequest, a as Hono, an as UpdateInstallRequest, ar as sortProjects, at as BrowserClientMessage, b as mainRepoRoot, bn as githubPrId, br as ProviderId, bt as AutomationProjectRequest, c as createAdaptorServer, cn as isNewerVersion, cr as InboxItem, ct as BrowserNavigateRequest, d as defaultShell, dn as NoticeBatchData, dr as AgentConfigDeleteQuery, dt as BrowserViewportRequest, en as LOCAL_STT_SAMPLE_RATE, er as ProjectConfigFile, et as SignInRequest, f as shellCommandLine, fn as CreateGithubIssueRequest, fr as AgentConfigDiffRequest, ft as BrowserWsQuery, g as resolveImageOutput, gn as GithubListQuery, gr as McpServerDiffRequest, gt as ExportAutomationsQuery, h as IMAGE_ASPECT_RATIOS, hn as GithubLabelRequest, hr as AgentConfigWriteRequest, ht as DuplicateAutomationRequest, i as killTree$1, in as AppPointer, ir as Project, it as summarizeActivity, j as isElectronRuntime, jn as ReviewVerdict, jr as literal, jt as UpdateAutomationRequest, k as brokenInstallMessage, kn as LEGACY_SIZE_LIMITS, kr as int, kt as UpcomingRunsQuery, l as upgradeWebSocket, ln as ConflictRecord, lr as InboxItemKind, lt as BrowserNewTabRequest, m as createImageEngineRegistry, mn as GithubIssue, mr as AgentConfigLocator, mt as AutomationImportSource, n as readLock, nn as SttQuery, nr as StartedBy, nt as ImageTestRequest, o as tryDecodeURIComponent, on as UpdateStatus, or as DEFAULT_VISION_PATH, ot as BrowserDevServerRequest, p as ImageEngineRegistry, pn as GithubCommentRequest, pr as AgentConfigListQuery, pt as AUTOMATION_IMPORT_LIMITS, q as UpdateSessionRequest, qn as RestoreFilesRequest, qt as UiClientMessage, r as isAlive, rn as TtsRequest, rr as WorkKey, rt as BrowserHostClientMessage, s as bufferToFormData, sn as compareVersions, sr as FactoryLimits, st as BrowserHistoryRequest, tn as LocalSttModelParams, tr as ConflictDecision, tt as passwordProblem, u as refreshProcessPath, un as NOTICE_BATCH_CODE, ur as messageFrom, ut as BrowserOpenRequest, v as claudeMemoryDir, vn as MergePrRequest, vr as McpServerUpsertRequest, vt as AutomationFileFrontmatter, w as installClaudeSdk, wn as FactoryCandidate, wr as _null, wt as RunAutomationRequest, x as claudeSdkSource, xn as parseGithubPrId, xr as ReasoningEffort, xt as CreateAutomationRequest, y as findGitRoot, yn as TriageIssueRequest, yr as AutonomyLevel, yt as AutomationGuardsPatch, z as RunnerLock, zn as AutomationTrigger, zr as union$1, zt as RespondRequest } from "./runner-WAbCC8k2.js";
 import { createRequire } from "node:module";
 import fs, { accessSync, appendFileSync, closeSync, constants, copyFileSync, cpSync, createReadStream, existsSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, watch, writeFileSync } from "node:fs";
 import { homedir, networkInterfaces, tmpdir } from "node:os";
@@ -7856,7 +7856,9 @@ const notices = sqliteTable("notices", {
 	sessionId: text("session_id"),
 	notice: json("notice").notNull(),
 	createdAt: text("created_at").notNull(),
-	deliveredAt: text("delivered_at")
+	deliveredAt: text("delivered_at"),
+	/** Not delivered before this time (a scheduled wake-up); null: at once. */
+	notBefore: text("not_before")
 }, (t) => [index("notices_target").on(t.target, t.projectId, t.deliveredAt), index("notices_created").on(t.createdAt)]);
 /** Conflict details; the status lives on the `conflict` inbox item with the same id. */
 const conflicts = sqliteTable("conflicts", {
@@ -8194,7 +8196,8 @@ function requestResolution(item) {
 	};
 	return {
 		status: item.status,
-		...item.answers ? { answers: item.answers } : {}
+		...item.answers ? { answers: item.answers } : {},
+		...item.decidedBy ? { decidedBy: item.decidedBy } : {}
 	};
 }
 /** Close an open inbox item; `completed`/`declined` resolve it, anything else dismisses it. */
@@ -9539,7 +9542,8 @@ function applyOrchestrationProjection(tx, e) {
 				sessionId: notice.sessionId,
 				notice,
 				createdAt: notice.createdAt,
-				deliveredAt: notice.deliveredAt
+				deliveredAt: notice.deliveredAt,
+				notBefore: notice.notBefore ?? null
 			};
 			tx.insert(notices).values(row).onConflictDoUpdate({
 				target: notices.id,
@@ -9562,6 +9566,21 @@ function applyOrchestrationProjection(tx, e) {
 			}
 			return;
 		}
+		case "notice.returned": {
+			if (e.payload.noticeIds.length === 0) return;
+			const rows = tx.select().from(notices).where(inArray(notices.id, e.payload.noticeIds)).all();
+			for (const row of rows) {
+				if (!row.deliveredAt) continue;
+				tx.update(notices).set({
+					deliveredAt: null,
+					notice: {
+						...row.notice,
+						deliveredAt: null
+					}
+				}).where(eq(notices.id, row.id)).run();
+			}
+			return;
+		}
 		case "conflict.created": {
 			const { conflict } = e.payload;
 			tx.insert(conflicts).values({
@@ -9669,6 +9688,17 @@ function applyUsageReport(tx, report) {
 		}
 	}
 }
+// ../server/src/events/reducer/retry.ts
+/**
+* Whether a failed root turn is left for automatic retry to decide (`AutoRetry`): an agent
+* session's turn that failed for a passing reason (`transient`, or a `usage_limit`). The
+* reducer leaves such a session idle with no inbox item; the auto-retry service then either
+* schedules the retry or fails the session the usual way. Orchestrator and PM sessions, and
+* every other failure, fail at once. Pure.
+*/
+function awaitsRetryDecision(session, error) {
+	return session.role === "agent" && (error.kind === "transient" || error.kind === "usage_limit");
+}
 // ../server/src/events/reducer/usage.ts
 /** Fields that add up across turns. */
 const ADDITIVE$1 = [
@@ -9824,6 +9854,11 @@ function onTurnEnded(d, sessionId, event, ts) {
 	if (event.type === "turn.completed") setStatus(d, sessionId, "idle", ts);
 	else if (event.type === "turn.interrupted") setStatus(d, sessionId, event.reason === "runner_restart" ? "interrupted" : "idle", ts);
 	else {
+		const current = d.getSession(sessionId)?.session;
+		if (current && awaitsRetryDecision(current, event.error)) {
+			setStatus(d, sessionId, "idle", ts);
+			return;
+		}
 		setStatus(d, sessionId, "failed", ts);
 		const session = d.getSession(sessionId)?.session;
 		if (session) {
@@ -10088,6 +10123,7 @@ function applyProjection(tx, e) {
 			return [];
 		case "notice.created":
 		case "notice.delivered":
+		case "notice.returned":
 		case "conflict.created":
 			applyOrchestrationProjection(tx, e);
 			return [];
@@ -21265,7 +21301,7 @@ function createMcpHandler(deps) {
 const FREE_FAILURES = 3;
 /** First wait once the free failures are used up; it doubles with each failure. */
 const BASE_DELAY_MS = 1e3;
-const MAX_DELAY_MS = 3e4;
+const MAX_DELAY_MS$1 = 3e4;
 /** This many failures inside the window lock the address out. */
 const LOCKOUT_FAILURES = 10;
 const WINDOW_MS = 9e5;
@@ -21285,7 +21321,7 @@ var SignInLimiter = class SignInLimiter {
 	/** Wait required before the `failures`-th failure may be followed by another attempt. */
 	static delayAfter(failures) {
 		if (failures < FREE_FAILURES) return 0;
-		return Math.min(MAX_DELAY_MS, BASE_DELAY_MS * 2 ** (failures - FREE_FAILURES));
+		return Math.min(MAX_DELAY_MS$1, BASE_DELAY_MS * 2 ** (failures - FREE_FAILURES));
 	}
 	/** May `address` try a password now? */
 	check(address) {
@@ -21593,6 +21629,26 @@ function redetectProviders(runner, log) {
 		log?.(`runner: provider re-detect failed: ${error instanceof Error ? error.message : error}`);
 	});
 }
+/** Model discovery starts a provider CLI (up to 30 s); detection runs first. */
+const REFRESH_MODELS_TIMEOUT_MS = 9e4;
+/**
+* "Refresh models": re-detect one provider and wait until it has listed its models again.
+* Resolves with every provider's list after the refresh (the runner also broadcasts it, so
+* other clients update as well).
+*/
+async function refreshProviderModels(runner, providerId) {
+	if (!runner.isConnected()) throw new ServiceError(503, "runner_unavailable", "The runner is not connected");
+	if (!runner.providers().some((p) => p.id === providerId)) throw new ServiceError(404, "unknown_provider", `No provider "${providerId}" is loaded`);
+	try {
+		return { providers: (await runner.request({
+			name: "provider.detect",
+			providerId,
+			waitForModels: true
+		}, REFRESH_MODELS_TIMEOUT_MS)).providers ?? runner.providers() };
+	} catch (error) {
+		throw toServiceError$1(error);
+	}
+}
 /** `RunnerPort` over the server's (possibly absent) `RunnerClient`. */
 function runnerPort(get) {
 	return {
@@ -21619,6 +21675,175 @@ function runnerPort(get) {
 		}
 	};
 }
+// ../server/src/services/browser/agent-activity.ts
+/** How long the "Agent is acting" signal lingers after the last agent browser command. */
+const AGENT_ACTIVITY_DECAY_MS = 2500;
+/**
+* Tracks when agents drive a session's browser (§12.2): a session is "acting" while an agent
+* `browser.*` command runs and for `decayMs` after the last one ends, so a burst of tool calls
+* reads as one stretch of activity. Listeners hear only transitions.
+*/
+var AgentActivity = class {
+	decayMs;
+	sessions = /* @__PURE__ */ new Map();
+	listeners = /* @__PURE__ */ new Set();
+	constructor(decayMs = AGENT_ACTIVITY_DECAY_MS) {
+		this.decayMs = decayMs;
+	}
+	onChange(listener) {
+		this.listeners.add(listener);
+		return () => this.listeners.delete(listener);
+	}
+	isActing(sessionId) {
+		return this.sessions.get(sessionId)?.acting ?? false;
+	}
+	/** Run an agent command, marking the session acting around it. */
+	async track(sessionId, run) {
+		this.begin(sessionId);
+		try {
+			return await run();
+		} finally {
+			this.end(sessionId);
+		}
+	}
+	begin(sessionId) {
+		const s = this.sessions.get(sessionId) ?? {
+			inFlight: 0,
+			acting: false
+		};
+		this.sessions.set(sessionId, s);
+		s.inFlight += 1;
+		clearTimeout(s.timer);
+		s.timer = void 0;
+		this.set(sessionId, s, true);
+	}
+	end(sessionId) {
+		const s = this.sessions.get(sessionId);
+		if (!s) return;
+		s.inFlight = Math.max(0, s.inFlight - 1);
+		if (s.inFlight > 0) return;
+		clearTimeout(s.timer);
+		s.timer = setTimeout(() => {
+			s.timer = void 0;
+			this.set(sessionId, s, false);
+			this.sessions.delete(sessionId);
+		}, this.decayMs);
+		s.timer.unref?.();
+	}
+	set(sessionId, s, acting) {
+		if (s.acting === acting) return;
+		s.acting = acting;
+		for (const l of this.listeners) l(sessionId, acting);
+	}
+};
+// ../server/src/services/browser/browser-host.ts
+const ATTACH_TIMEOUT_MS = 1e4;
+/**
+* The desktop app's offer of native browser views (§17 Phase 2), over `/ws/browser-host`
+* (loopback only, install token). One app runs per home, so the latest app to connect is the
+* host. The server asks it to `attach` a session and gets that session's relay back; when the
+* app quits it hands its open sessions to the runner through here.
+*/
+var BrowserHostLink = class {
+	deps;
+	host = null;
+	waiting = /* @__PURE__ */ new Map();
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/** A desktop app is connected and can host native views. */
+	get available() {
+		return this.host !== null && this.host.ws.readyState === 1;
+	}
+	/** Ask the app for a session's native browser; rejects when no app answers in time. */
+	attach(sessionId, timeoutMs = ATTACH_TIMEOUT_MS) {
+		const ws = this.host?.ws;
+		if (ws?.readyState !== 1) return Promise.reject(/* @__PURE__ */ new Error("No desktop app is connected"));
+		const id = randomUUID();
+		return new Promise((resolve, reject) => {
+			const timer = setTimeout(() => {
+				this.waiting.delete(id);
+				reject(/* @__PURE__ */ new Error("The desktop app did not answer"));
+			}, timeoutMs);
+			timer.unref?.();
+			this.waiting.set(id, {
+				resolve,
+				reject,
+				timer
+			});
+			send$2(ws, {
+				type: "attach",
+				id,
+				sessionId
+			});
+		});
+	}
+	handlers() {
+		let ws;
+		return {
+			onOpen: (_event, socket) => {
+				ws = socket;
+			},
+			onMessage: (event) => {
+				if (!ws) return;
+				let msg;
+				try {
+					msg = BrowserHostClientMessage.parse(JSON.parse(String(event.data)));
+				} catch {
+					return;
+				}
+				this.handle(ws, msg);
+			},
+			onClose: () => {
+				if (ws && this.host?.ws === ws) {
+					this.host = null;
+					this.deps.log?.("browser host: the desktop app disconnected");
+					for (const [id, w] of this.waiting) {
+						clearTimeout(w.timer);
+						w.reject(/* @__PURE__ */ new Error("The desktop app disconnected"));
+						this.waiting.delete(id);
+					}
+				}
+			}
+		};
+	}
+	async handle(ws, msg) {
+		switch (msg.type) {
+			case "hello":
+				if (this.host && this.host.ws !== ws) this.host.ws.close(1e3, "replaced");
+				this.host = {
+					ws,
+					version: msg.version
+				};
+				this.deps.log?.(`browser host: desktop app ${msg.version} offers native views`);
+				return;
+			case "attached":
+			case "failed": {
+				const w = this.waiting.get(msg.id);
+				if (!w) return;
+				this.waiting.delete(msg.id);
+				clearTimeout(w.timer);
+				if (msg.type === "attached") w.resolve(msg.relay);
+				else w.reject(new Error(msg.message));
+				return;
+			}
+			case "handoff": {
+				const failed = await this.deps.handoff(msg.sessions).catch((error) => {
+					this.deps.log?.(`browser host: hand-off failed: ${String(error)}`);
+					return msg.sessions.map((s) => s.sessionId);
+				});
+				send$2(ws, {
+					type: "handoff.done",
+					id: msg.id,
+					failed
+				});
+			}
+		}
+	}
+};
+function send$2(ws, msg) {
+	if (ws.readyState === 1) ws.send(JSON.stringify(msg));
+}
 // ../server/src/services/browser/browser-service.ts
 /** Navigation and agent actions can wait on slow pages; leave headroom over the runner's 30s. */
 const BROWSER_TIMEOUT_MS = 6e4;
@@ -21630,11 +21855,49 @@ function isBrowserNotOpen(error) {
 * The session browser (§12.2) for the panel routes, the `/ws/browser` channel and the agent
 * tools. Every call names the session it acts for, so nobody can reach another session's
 * context; the runner enforces the same isolation.
+*
+* Engines: a session's browser opens on native views in the desktop app when the app is
+* connected, the setting is on and the desktop window or an agent opens it; otherwise on the
+* runner's Chromium. An open browser keeps its engine until it closes, or until the app quits
+* and hands it to the runner.
 */
 var BrowserService = class {
 	deps;
+	/** When agents drive each session's browser, for the panel's "Agent is acting" chip. */
+	agentActivity = new AgentActivity();
+	/** The desktop app, when one offers native views. */
+	host;
 	constructor(deps) {
 		this.deps = deps;
+		this.host = new BrowserHostLink({
+			handoff: (s) => this.handoff(s),
+			log: deps.log
+		});
+	}
+	/** A `browser.*` command an agent tool sends: like `command`, and marks the agent acting. */
+	agentCommand(command, timeoutMs = BROWSER_TIMEOUT_MS) {
+		const { sessionId } = command;
+		return this.agentActivity.track(sessionId, () => this.command(command, timeoutMs));
+	}
+	/** `navigate` on behalf of an agent tool (marks the agent acting). */
+	agentNavigate(sessionId, url, tabId) {
+		return this.agentActivity.track(sessionId, () => this.navigate(sessionId, url, tabId, { native: true }));
+	}
+	/** Open a dev server for an agent: a new tab, or the first tab of a browser it opens. */
+	agentOpenDevServer(sessionId, port, path) {
+		return this.agentActivity.track(sessionId, async () => {
+			if ((await this.tabs(sessionId)).open) return this.command({
+				name: "browser.devServer",
+				sessionId,
+				port,
+				path
+			});
+			const url = `http://localhost:${port}${path ?? "/"}`;
+			const { tabs } = await this.open(sessionId, url, { native: true });
+			const tab = tabs.find((t) => t.active) ?? tabs[0];
+			if (!tab) throw new ServiceError(500, "browser_error", "The browser opened without a tab");
+			return { tab };
+		});
 	}
 	/** Send a `browser.*` command for an existing session, mapping runner failures. */
 	async command(command, timeoutMs = BROWSER_TIMEOUT_MS) {
@@ -21646,27 +21909,31 @@ var BrowserService = class {
 			throw toServiceError$1(error);
 		}
 	}
-	async open(sessionId, url) {
+	async open(sessionId, url, opts = {}) {
+		const relay = opts.native ? await this.nativeRelay(sessionId) : void 0;
 		const result = await this.command({
 			name: "browser.open",
 			sessionId,
-			url
+			url,
+			relay
 		});
 		return {
 			cdpUrl: result.cdpUrl,
-			tabs: result.tabs ?? []
+			tabs: result.tabs ?? [],
+			engine: result.engine ?? "runner"
 		};
 	}
 	/** The session's tabs; `open: false` when it has no browser yet (never throws for that). */
 	async tabs(sessionId) {
 		try {
-			const { tabs } = await this.command({
+			const { tabs, engine } = await this.command({
 				name: "browser.tabs.list",
 				sessionId
 			});
 			return {
 				open: true,
-				tabs
+				tabs,
+				engine: engine ?? "runner"
 			};
 		} catch (error) {
 			if (isBrowserNotOpen(error)) return {
@@ -21677,8 +21944,8 @@ var BrowserService = class {
 		}
 	}
 	/** Open the browser if needed, then navigate the active tab. */
-	async navigate(sessionId, url, tabId) {
-		if (!(await this.tabs(sessionId)).open) await this.open(sessionId);
+	async navigate(sessionId, url, tabId, opts = {}) {
+		if (!(await this.tabs(sessionId)).open) await this.open(sessionId, void 0, opts);
 		return this.command({
 			name: "browser.navigate",
 			sessionId,
@@ -21698,7 +21965,92 @@ var BrowserService = class {
 			throw toServiceError$1(error);
 		}
 	}
+	/**
+	* The desktop app's relay for a session that has no browser yet, when native views are on
+	* offer; undefined means the runner's Chromium (an open browser keeps its engine).
+	*/
+	async nativeRelay(sessionId) {
+		if (!this.host.available) return void 0;
+		if (this.deps.settings && !this.deps.settings().desktop.nativeBrowser) return void 0;
+		if ((await this.tabs(sessionId)).open) return void 0;
+		try {
+			return await this.host.attach(sessionId);
+		} catch (error) {
+			this.deps.log?.(`browser: native views unavailable, using the runner: ${errorMessage$1(error)}`);
+			return;
+		}
+	}
+	/** The desktop app quits: its open sessions move to the runner's Chromium. */
+	async handoff(sessions) {
+		const failed = [];
+		await Promise.all(sessions.map(async ({ sessionId, tabs, cookies }) => {
+			try {
+				if (!this.deps.repo.find(sessionId)) throw new Error("no such session");
+				await this.deps.runner.request({
+					name: "browser.handoff",
+					sessionId,
+					tabs,
+					cookies
+				}, BROWSER_TIMEOUT_MS);
+			} catch (error) {
+				this.deps.log?.(`browser: hand-off of ${sessionId}: ${errorMessage$1(error)}`);
+				failed.push(sessionId);
+			}
+		}));
+		return failed;
+	}
 };
+// ../server/src/realtime/browser-viewport.ts
+/**
+* Decides which viewer's panel size a session's page follows (§12.2), so a phone opening the
+* panel doesn't resize the page under a desktop viewer:
+*
+* - The first viewer to report a size owns the viewport.
+* - A viewer that claims (it was focused, clicked, or picked a size) becomes the owner.
+* - The page follows the owner's reports; other viewers' reports are only remembered.
+* - When the owner leaves, the remaining viewer that claimed most recently takes over
+*   (viewers that never claimed rank by when they first reported).
+*/
+var ViewportArbiter = class {
+	reports = /* @__PURE__ */ new Map();
+	owner;
+	clock = 0;
+	get ownerId() {
+		return this.owner;
+	}
+	/** The size the page should have, or undefined when no viewer reported one. */
+	get size() {
+		return this.owner ? this.reports.get(this.owner)?.size : void 0;
+	}
+	get viewers() {
+		return this.reports.size;
+	}
+	/** Record a viewer's size. Returns true when the owner's size (what the page follows) changed. */
+	report(viewerId, size, claim = false) {
+		const before = this.size;
+		const previous = this.reports.get(viewerId);
+		const rank = claim || !previous ? ++this.clock : previous.rank;
+		this.reports.set(viewerId, {
+			size: { ...size },
+			rank
+		});
+		if (claim || this.owner === void 0) this.owner = viewerId;
+		return !sameSize(before, this.size);
+	}
+	/** Forget a viewer. Returns true when the owner's size changed (ownership passed on). */
+	remove(viewerId) {
+		const before = this.size;
+		if (!this.reports.delete(viewerId)) return false;
+		if (this.owner !== viewerId) return false;
+		let next;
+		for (const entry of this.reports) if (!next || entry[1].rank > next[1].rank) next = entry;
+		this.owner = next?.[0];
+		return next !== void 0 && !sameSize(before, this.size);
+	}
+};
+function sameSize(a, b) {
+	return a?.width === b?.width && a?.height === b?.height && a?.deviceScaleFactor === b?.deviceScaleFactor;
+}
 // ../server/src/realtime/browser.ts
 /** Skip frames for a socket that has this much unsent data (slow client). */
 const MAX_BUFFERED_BYTES = 4194304;
@@ -21711,19 +22063,34 @@ const MAX_BUFFERED_BYTES = 4194304;
 var BrowserBridge = class {
 	deps;
 	viewers = /* @__PURE__ */ new Map();
+	/** Per session: whose panel size the page follows. */
+	arbiters = /* @__PURE__ */ new Map();
+	/** Per session: the viewport the runner last applied (cleared when the browser closes). */
+	applied = /* @__PURE__ */ new Map();
+	applying = /* @__PURE__ */ new Map();
+	/** Per session: what backs its open browser. */
+	engines = /* @__PURE__ */ new Map();
 	constructor(deps) {
 		this.deps = deps;
+		deps.browser.agentActivity?.onChange((sessionId, acting) => {
+			for (const v of this.viewers.get(sessionId) ?? []) send$1(v.ws, {
+				type: "agent",
+				acting
+			});
+		});
 	}
 	handlers(query) {
 		let viewer;
 		return {
 			onOpen: (_event, ws) => {
-				const { sessionId, open: _open, ...settings } = query;
+				const { sessionId, open: _open, native: nativeQuery, ...settings } = query;
+				const native = nativeQuery === "1";
 				viewer = {
 					id: `ui-${randomUUID()}`,
 					ws,
 					sessionId,
-					wantsWatch: true,
+					wantsWatch: !native,
+					native,
 					watching: false,
 					open: false,
 					settings,
@@ -21753,6 +22120,14 @@ var BrowserBridge = class {
 				viewer.closed = true;
 				this.remove(viewer);
 				if (viewer.watching) this.setWatching(viewer, false).catch(() => void 0);
+				const arbiter = this.arbiters.get(viewer.sessionId);
+				if (arbiter) {
+					const owner = arbiter.ownerId;
+					const resized = arbiter.remove(viewer.id);
+					if (arbiter.viewers === 0) this.arbiters.delete(viewer.sessionId);
+					else if (resized) this.applyViewport(viewer.sessionId);
+					else if (owner !== arbiter.ownerId) this.announceViewport(viewer.sessionId);
+				}
 			}
 		};
 	}
@@ -21769,18 +22144,27 @@ var BrowserBridge = class {
 			}
 			return;
 		}
-		if (stream.kind === "browser.tabs") for (const v of this.viewers.get(stream.sessionId) ?? []) {
-			if (stream.tabs.length === 0) {
-				if (v.open) this.detach(v);
-				continue;
+		if (stream.kind === "browser.tabs") {
+			const engineChanged = stream.engine !== void 0 && this.engines.get(stream.sessionId) !== stream.engine;
+			if (stream.engine) this.engines.set(stream.sessionId, stream.engine);
+			if (stream.tabs.length === 0 || engineChanged) this.applied.delete(stream.sessionId);
+			for (const v of this.viewers.get(stream.sessionId) ?? []) {
+				if (stream.tabs.length === 0) {
+					if (v.open) this.detach(v);
+					continue;
+				}
+				if (!v.open) {
+					v.open = true;
+					this.watchIfWanted(v, stream.tabs).catch((error) => this.fail(v, error));
+				} else {
+					send$1(v.ws, {
+						type: "tabs",
+						tabs: stream.tabs,
+						engine: this.engines.get(v.sessionId)
+					});
+					if (engineChanged && stream.engine === "runner") this.applyViewport(v.sessionId);
+				}
 			}
-			if (!v.open) {
-				v.open = true;
-				this.watchIfWanted(v, stream.tabs).catch((error) => this.fail(v, error));
-			} else send$1(v.ws, {
-				type: "tabs",
-				tabs: stream.tabs
-			});
 		}
 	}
 	/** Number of viewers per session (diagnostics and tests). */
@@ -21789,11 +22173,13 @@ var BrowserBridge = class {
 	}
 	async start(v, openNow) {
 		if (openNow) {
-			const opened = await this.deps.browser.open(v.sessionId);
+			const opened = await this.deps.browser.open(v.sessionId, void 0, { native: v.native });
+			this.noteEngine(v.sessionId, opened.engine);
 			v.open = true;
 			return this.watchIfWanted(v, opened.tabs);
 		}
-		const { open, tabs } = await this.deps.browser.tabs(v.sessionId);
+		const { open, tabs, engine } = await this.deps.browser.tabs(v.sessionId);
+		this.noteEngine(v.sessionId, engine);
 		v.open = v.open || open;
 		if (!v.open) return this.sendState(v, []);
 		return this.watchIfWanted(v, tabs);
@@ -21821,17 +22207,89 @@ var BrowserBridge = class {
 				if (v.watching) await this.setWatching(v, false);
 				return this.sendState(v, (await browser.tabs(v.sessionId)).tabs);
 			case "open": {
-				const opened = await browser.open(v.sessionId, msg.url);
+				const opened = await browser.open(v.sessionId, msg.url, { native: v.native });
+				this.noteEngine(v.sessionId, opened.engine);
 				v.open = true;
 				return this.watchIfWanted(v, opened.tabs);
 			}
+			case "viewport": {
+				const { type: _t, claim, ...size } = msg;
+				let arbiter = this.arbiters.get(v.sessionId);
+				if (!arbiter) {
+					arbiter = new ViewportArbiter();
+					this.arbiters.set(v.sessionId, arbiter);
+				}
+				const owner = arbiter.ownerId;
+				if (arbiter.report(v.id, size, claim)) this.applyViewport(v.sessionId);
+				else if (owner !== arbiter.ownerId) this.announceViewport(v.sessionId);
+				return;
+			}
 		}
 	}
 	async watchIfWanted(v, tabs) {
 		if (v.wantsWatch && !v.watching) await this.setWatching(v, true);
 		this.sendState(v, tabs);
+		if (v.open) {
+			if (this.applied.has(v.sessionId)) this.announceViewport(v.sessionId, v);
+			else this.applyViewport(v.sessionId);
+		}
+		if (this.deps.browser.agentActivity?.isActing(v.sessionId)) send$1(v.ws, {
+			type: "agent",
+			acting: true
+		});
+	}
+	/**
+	* Bring the runner's viewport in line with the owning viewer's panel. Serialized per session
+	* and always applies the latest size, so a burst of resizes ends at the final one.
+	*/
+	applyViewport(sessionId) {
+		const run = async () => {
+			const size = this.arbiters.get(sessionId)?.size;
+			if (!size) return;
+			const key = `${size.width}x${size.height}@${size.deviceScaleFactor}`;
+			const known = this.applied.get(sessionId);
+			if (known?.key === key && !known.fixed) return this.announceViewport(sessionId);
+			try {
+				const result = await this.deps.browser.command({
+					name: "browser.viewport",
+					sessionId,
+					width: Math.min(size.width, 7680),
+					height: Math.min(size.height, 4320),
+					deviceScaleFactor: size.deviceScaleFactor
+				});
+				this.applied.set(sessionId, {
+					key,
+					width: result.width ?? size.width,
+					height: result.height ?? size.height,
+					deviceScaleFactor: result.deviceScaleFactor ?? size.deviceScaleFactor,
+					fixed: result.fixed === true
+				});
+				this.announceViewport(sessionId);
+			} catch (error) {
+				if (!isBrowserNotOpen(error)) this.deps.log?.(`browser viewport: ${errorMessage$1(error)}`);
+			}
+		};
+		const next = (this.applying.get(sessionId) ?? Promise.resolve()).then(run, run);
+		this.applying.set(sessionId, next);
+		next.finally(() => {
+			if (this.applying.get(sessionId) === next) this.applying.delete(sessionId);
+		});
+	}
+	/** Tell viewers (or one) the applied viewport and whether it follows their panel. */
+	announceViewport(sessionId, only) {
+		const applied = this.applied.get(sessionId);
+		if (!applied) return;
+		const owner = this.arbiters.get(sessionId)?.ownerId;
+		const { key: _k, fixed, ...viewport } = applied;
+		for (const v of only ? [only] : this.viewers.get(sessionId) ?? []) if (v.open) send$1(v.ws, {
+			type: "viewport",
+			...viewport,
+			mine: !fixed && v.id === owner
+		});
 	}
 	async setWatching(v, watching) {
+		const before = v.watching;
+		v.watching = watching && !v.closed;
 		try {
 			await this.deps.browser.command({
 				name: "browser.screencast",
@@ -21840,8 +22298,8 @@ var BrowserBridge = class {
 				watching: watching && !v.closed,
 				...v.settings
 			});
-			v.watching = watching && !v.closed;
 		} catch (error) {
+			v.watching = before;
 			if (!isBrowserNotOpen(error)) throw error;
 			v.open = false;
 			v.watching = false;
@@ -21859,14 +22317,19 @@ var BrowserBridge = class {
 		this.sendState(v, []);
 	}
 	sendState(v, tabs) {
+		const engine = v.open ? this.engines.get(v.sessionId) : void 0;
 		send$1(v.ws, {
 			type: "state",
 			viewerId: v.id,
 			open: v.open,
 			watching: v.watching,
-			tabs
+			tabs,
+			engine
 		});
 	}
+	noteEngine(sessionId, engine) {
+		if (engine) this.engines.set(sessionId, engine);
+	}
 	fail(v, error) {
 		const code = error instanceof ServiceError ? error.code : "browser_error";
 		send$1(v.ws, {
@@ -21892,6 +22355,35 @@ function buffered(ws) {
 function send$1(ws, msg) {
 	if (ws.readyState === 1) ws.send(JSON.stringify(msg));
 }
+// ../server/src/realtime/browser-routes.ts
+/** Paths only the machine itself may use, even with network access on (§15.1). */
+const BROWSER_LOOPBACK_ONLY_PATHS = ["/ws/browser-host"];
+/**
+* The browser sockets (§12.2, §17 Phase 2):
+* - `/ws/browser`: one viewer of one session's browser (frames, tabs, input, viewport);
+* - `/ws/browser-host`: the desktop app offering native views (loopback only).
+* Returns the bridge, which also takes the runner's browser stream data.
+*/
+function mountBrowserSockets(app, services, log) {
+	const bridge = new BrowserBridge({
+		browser: services.browser,
+		log
+	});
+	app.get("/ws/browser", async (c, next) => {
+		const query = BrowserWsQuery.safeParse(c.req.query());
+		if (!query.success) return c.json({ error: {
+			code: "bad_request",
+			message: "Invalid browser query"
+		} }, 400);
+		if (!services.sessionRepo.find(query.data.sessionId)) return c.json({ error: {
+			code: "session_not_found",
+			message: "No such session"
+		} }, 404);
+		return upgradeWebSocket(() => bridge.handlers(query.data))(c, next);
+	});
+	app.get("/ws/browser-host", upgradeWebSocket(() => services.browser.host.handlers()));
+	return bridge;
+}
 // ../server/src/services/sessions/preview.ts
 /** Tool output kept in transcript pages and live updates; the rest is fetched on demand (§6). */
 const OUTPUT_PREVIEW_CHARS = 16e3;
@@ -31819,7 +32311,10 @@ function projectAutomationRoutes(s) {
 */
 function sessionBrowserRoutes(s) {
 	const b = s.browser;
-	return new Hono().post("/:id/browser/open", jsonBody(BrowserOpenRequest), async (c) => c.json(await b.open(c.req.param("id"), c.req.valid("json").url))).post("/:id/browser/close", async (c) => {
+	return new Hono().post("/:id/browser/open", jsonBody(BrowserOpenRequest), async (c) => {
+		const { url, native } = c.req.valid("json");
+		return c.json(await b.open(c.req.param("id"), url, { native }));
+	}).post("/:id/browser/close", async (c) => {
 		await b.command({
 			name: "browser.close",
 			sessionId: c.req.param("id")
@@ -32712,6 +33207,13 @@ function setupRoutes(s) {
 		return c.json({ setupCompleted });
 	});
 }
+/** `/api/providers`: the runner's providers. Their model lists arrive with the runner status. */
+function providerRoutes(s) {
+	return new Hono().post("/:id/refresh-models", async (c) => {
+		const body = await refreshProviderModels(s.runner, c.req.param("id"));
+		return c.json(body);
+	});
+}
 /** `/api/fs` (folder picker) and `/api/files` (config editors). */
 function fileRoutes(s) {
 	return new Hono().get("/fs/list", queryOf(object({
@@ -33166,7 +33668,7 @@ function createApi(ctx) {
 			uptimeSec: (Date.now() - ctx.startedAt) / 1e3
 		};
 		return c.json(body);
-	}).get("/snapshot", (c) => c.json(buildSnapshot(ctx))).get("/activity", (c) => c.json(buildActivity(s))).get("/sessions/:id/snapshot", (c) => c.json(buildSessionSnapshot(s, c.req.param("id")))).route("/projects", projectRoutes(s)).route("/projects", projectGithubRoutes(s)).route("/projects", projectFactoryRoutes(s)).route("/factory", factoryRoutes(s)).route("/prs", prRoutes(s)).route("/github", githubRoutes(s)).route("/sessions", sessionGithubRoutes(s)).route("/sessions", sessionRoutes(s)).route("/sessions", workbenchRoutes(s)).route("/sessions", sessionBrowserRoutes(s)).route("/browser", browserRoutes(s)).route("/images", imageRoutes(s)).route("/agent-config", agentConfigRoutes(s)).route("/voice", voiceRoutes(s)).route("/", speechRoutes(s)).route("/sessions", sessionAgentConfigRoutes(s)).route("/sessions", sessionFileRoutes(s)).route("/utility", utilityRoutes(s)).route("/inbox", inboxRoutes(s)).route("/orchestration", orchestrationRoutes(s)).route("/conflicts", conflictRoutes(s)).route("/automations", automationRoutes(s)).route("/projects", projectAutomationRoutes(s)).route("/usage", usageRoutes(s)).route("/setup", setupRoutes(s)).route("/updates", updateRoutes(s)).route("/artifacts", artifactRoutes(s)).route("/secrets", secretRoutes(s)).route("/network", networkRoutes(ctx.network)).route("/auth", authRoutes(ctx.network)).route("/", fileRoutes(s)).get("/settings", (c) => c.json(s.settings.get())).patch("/settings", async (c) => {
+	}).get("/snapshot", (c) => c.json(buildSnapshot(ctx))).get("/activity", (c) => c.json(buildActivity(s))).get("/sessions/:id/snapshot", (c) => c.json(buildSessionSnapshot(s, c.req.param("id")))).route("/projects", projectRoutes(s)).route("/projects", projectGithubRoutes(s)).route("/projects", projectFactoryRoutes(s)).route("/factory", factoryRoutes(s)).route("/prs", prRoutes(s)).route("/github", githubRoutes(s)).route("/sessions", sessionGithubRoutes(s)).route("/sessions", sessionRoutes(s)).route("/sessions", workbenchRoutes(s)).route("/sessions", sessionBrowserRoutes(s)).route("/browser", browserRoutes(s)).route("/images", imageRoutes(s)).route("/agent-config", agentConfigRoutes(s)).route("/voice", voiceRoutes(s)).route("/", speechRoutes(s)).route("/sessions", sessionAgentConfigRoutes(s)).route("/sessions", sessionFileRoutes(s)).route("/utility", utilityRoutes(s)).route("/inbox", inboxRoutes(s)).route("/orchestration", orchestrationRoutes(s)).route("/conflicts", conflictRoutes(s)).route("/automations", automationRoutes(s)).route("/projects", projectAutomationRoutes(s)).route("/usage", usageRoutes(s)).route("/setup", setupRoutes(s)).route("/providers", providerRoutes(s)).route("/updates", updateRoutes(s)).route("/artifacts", artifactRoutes(s)).route("/secrets", secretRoutes(s)).route("/network", networkRoutes(ctx.network)).route("/auth", authRoutes(ctx.network)).route("/", fileRoutes(s)).get("/settings", (c) => c.json(s.settings.get())).patch("/settings", async (c) => {
 		const patch = await c.req.json().catch(() => void 0);
 		if (!patch || typeof patch !== "object" || Array.isArray(patch)) throw badRequest("Expected a JSON object");
 		let settings;
@@ -34201,6 +34703,15 @@ const UNATTENDED_ANSWER = [
 	"If the user is talking to you directly in this conversation, ask them in your reply instead."
 ].join("\n");
 /**
+* The denial an unattended factory session gets instead of waiting for an approval. Nothing is
+* ever approved on the user's behalf: the agent finds a way that needs no approval, or flags it.
+*/
+const UNATTENDED_APPROVAL = [
+	"Not approved: this project runs as a dark factory, so nobody is watching to approve it. Don't wait for it or try the same thing again.",
+	"- Find a way that stays inside your worktree and the factory's limits. To publish your work, commit it and call `create_pull_request`: it pushes your own branch (with a lease after a rebase).",
+	"- If the work can't be done without this, call `factory_record_decision` with `needsHuman: true`, saying what you needed and why, and carry on with whatever doesn't depend on it."
+].join("\n");
+/**
 * True when nobody is expected to answer this session's questions: its project is a dark factory
 * and the session is the PM or one of the factory's own agent sessions. Sessions the user
 * started themselves still ask as usual.
@@ -34329,7 +34840,7 @@ function postSharedArtifact(services, sessionId, artifact, caption) {
 */
 const askUser = defineTool({
 	name: "ask_user",
-	description: "Ask the user a question when you cannot proceed without their decision. Offer options when there are clear choices. The call waits a few minutes for an answer. If it returns 'pending', do not wait or ask again: finish whatever does not depend on the answer, then end your turn; the answer will arrive as your next message.",
+	description: "Ask the user for a decision only they can make: destructive or irreversible steps, spending money or creating accounts or credentials, outward-facing actions nobody asked for (publishing, releases, deploys, messages to other people), protected areas, or a request with two readings that lead to very different work. For anything else, pick a sensible default, say what you assumed, and carry on. Put your recommended option first. The call waits a few minutes for an answer. If it returns 'pending', do not wait or ask again: finish whatever does not depend on the answer, then end your turn; the answer will arrive as your next message.",
 	roles: ["agent", "pm"],
 	scope: "session",
 	alwaysLoad: true,
@@ -34352,7 +34863,7 @@ const askUser = defineTool({
 			multiSelect: input.multiSelect ?? false,
 			allowFreeText: true
 		}, signal);
-		if (outcome.status === "answered") return `The user answered:\n${outcome.text}`;
+		if (outcome.status === "answered") return `${outcome.by === "pm" ? "Your project manager" : "The user"} answered:\n${outcome.text}`;
 		if (outcome.status === "dismissed") return "The user dismissed the question without answering.";
 		return "pending: the question is waiting in the user's inbox. Do not wait for it. Finish what you can without the answer, then end your turn; the answer will arrive as your next message.";
 	}
@@ -34378,7 +34889,7 @@ const browserNavigate = defineTool({
 		tabId
 	}),
 	handler: async (input, { services, sessionId }) => {
-		const result = await services.browser.navigate(sessionId, input.url, input.tabId);
+		const result = await services.browser.agentNavigate(sessionId, input.url, input.tabId);
 		const { tabs } = await services.browser.tabs(sessionId);
 		const status = result.status ? ` (HTTP ${result.status})` : "";
 		return `Navigated to ${result.url ?? input.url}${status}.\nTabs:\n${tabLine(tabs)}`;
@@ -34391,7 +34902,7 @@ const browserSnapshot = defineTool({
 	scope: "session",
 	input: object({ tabId }),
 	handler: async (input, { services, sessionId }) => {
-		const snap = await services.browser.command({
+		const snap = await services.browser.agentCommand({
 			name: "browser.snapshot",
 			sessionId,
 			tabId: input.tabId
@@ -34416,7 +34927,7 @@ const browserClick = defineTool({
 		tabId
 	}),
 	handler: async (input, { services, sessionId }) => {
-		await services.browser.command({
+		await services.browser.agentCommand({
 			name: "browser.click",
 			sessionId,
 			...input
@@ -34436,7 +34947,7 @@ const browserType = defineTool({
 		tabId
 	}),
 	handler: async (input, { services, sessionId }) => {
-		await services.browser.command({
+		await services.browser.agentCommand({
 			name: "browser.type",
 			sessionId,
 			...input
@@ -34454,7 +34965,7 @@ const browserPress = defineTool({
 		tabId
 	}),
 	handler: async (input, { services, sessionId }) => {
-		await services.browser.command({
+		await services.browser.agentCommand({
 			name: "browser.press",
 			sessionId,
 			...input
@@ -34519,7 +35030,7 @@ const browserWait = defineTool({
 		v.networkIdle || void 0
 	].filter(Boolean).length === 1, { message: "Pass exactly one of selector, text or networkIdle" }),
 	handler: async (input, { services, sessionId }) => {
-		const { matched } = await services.browser.command({
+		const { matched } = await services.browser.agentCommand({
 			name: "browser.wait",
 			sessionId,
 			...input
@@ -34537,7 +35048,7 @@ const browserEvaluate = defineTool({
 		tabId
 	}),
 	handler: async (input, { services, sessionId }) => {
-		const result = await services.browser.command({
+		const result = await services.browser.agentCommand({
 			name: "browser.evaluate",
 			sessionId,
 			...input
@@ -34562,12 +35073,7 @@ const browserOpenDevServer = defineTool({
 			if (servers.length > 1) return `Several dev servers are running; call again with a port:\n${servers.map((s) => `- ${s.url}${s.pid ? ` (pid ${s.pid})` : ""}`).join("\n")}`;
 			port = servers[0]?.port;
 		}
-		const { tab } = await services.browser.command({
-			name: "browser.devServer",
-			sessionId,
-			port,
-			path: input.path
-		});
+		const { tab } = await services.browser.agentOpenDevServer(sessionId, port, input.path);
 		return `Opened ${tab.url} in tab ${tab.tabId}. Use browser_snapshot to read it.`;
 	}
 });
@@ -34598,7 +35104,7 @@ const browserScreenshot = defineTool({
 		mkdirSync(incoming, { recursive: true });
 		const tmp = join(incoming, `${randomUUID()}.png`);
 		try {
-			const shot = await services.browser.command({
+			const shot = await services.browser.agentCommand({
 				name: "browser.screenshot",
 				sessionId,
 				path: tmp,
@@ -35011,7 +35517,8 @@ function buildProjectStatus(input) {
 		project: {
 			id: input.project.id,
 			name: input.project.name,
-			kind: input.project.kind
+			kind: input.project.kind,
+			mode: input.project.autonomyMode
 		},
 		running: input.work.filter((w) => w.status !== "queued"),
 		queued: input.work.filter((w) => w.status === "queued"),
@@ -35049,6 +35556,22 @@ function age(from, now) {
 	if (sec < 86400) return `${Math.round(sec / 3600)}h`;
 	return `${Math.round(sec / 86400)}d`;
 }
+/**
+* Shorten `text` to at most `max` characters, keeping its start and its end: agents put the
+* question or the next step they need in their last paragraph, so cutting only the end would
+* hide it. Keeps the whole last paragraph when it fits in about half of `max`.
+*/
+function clipKeepingEnd(text, max = 500) {
+	const trimmed = text.trim();
+	if (trimmed.length <= max) return trimmed;
+	const gap = " [...] ";
+	const room = max - 7;
+	const paragraphs = trimmed.split(/\n\s*\n/);
+	const last = paragraphs.length > 1 ? (paragraphs.at(-1) ?? "").trim() : "";
+	const tailMax = Math.floor(room / 2);
+	const tail = last && last.length <= tailMax ? last : trimmed.slice(-tailMax).trimStart();
+	return `${trimmed.slice(0, room - tail.length).trimEnd()}${gap}${tail}`;
+}
 const short = (id) => id.slice(0, 8);
 const quote = (text, max = 100) => `"${text.length > max ? `${text.slice(0, max - 3)}...` : text}"`;
 function workLine(w, now) {
@@ -35099,7 +35622,7 @@ function block(open, close, lines) {
 /** The PM's digest for its project. */
 function renderProjectDigest(s, now = Date.now()) {
 	const at = new Date(now).toISOString();
-	return block(`<codeden_status project=${quote(neutralizeTags(s.project.name))} at="${at}">`, "</codeden_status>", projectLines(s, now));
+	return block(`<codeden_status project=${quote(neutralizeTags(s.project.name))} mode="${s.project.mode}" at="${at}">`, "</codeden_status>", projectLines(s, now));
 }
 /** The orchestrator's digest: every project rolled up. */
 function renderOverviewDigest(o, now = Date.now()) {
@@ -35131,8 +35654,8 @@ function renderNotices(list, projectName) {
 }
 function noticeDetail(n) {
 	switch (n.type) {
-		case "session.finished": return ` · ${n.data.workKey} · session ${short(n.data.sessionId)}${n.data.summary ? ` · ${quote(n.data.summary, 200)}` : ""}`;
-		case "session.needs_input": return ` · ${n.data.kind}: ${quote(n.data.question, 200)} (waiting in the user's inbox)`;
+		case "session.finished": return ` · ${n.data.workKey} · session ${short(n.data.sessionId)}${n.data.summary ? ` · "${clipKeepingEnd(n.data.summary)}"` : ""}`;
+		case "session.needs_input": return ` · ${n.data.kind}: ${quote(n.data.question, 200)} (${n.data.kind !== "question" ? "waiting for the user's approval" : n.data.startedBy.kind === "user" ? `inbox item ${n.data.inboxItemId}: the user started this session and answers its questions` : `inbox item ${n.data.inboxItemId}: answer it with answer_question when the brief, the notes or the vision settle it`})`;
 		case "session.failed": return ` · ${n.data.workKey} · ${quote(n.data.error, 200)}`;
 		case "pr.opened": return ` · ${n.data.pr.url}`;
 		case "pr.checks_failed": return ` · ${n.data.pr.url} · failed: ${n.data.failedChecks.join(", ") || "unknown"}`;
@@ -35143,6 +35666,8 @@ function noticeDetail(n) {
 		case "automation.skipped": return ` · ${n.data.workKey} · reason: ${n.data.reason}`;
 		case "conflict": return ` · ${n.data.workKey} requested by ${n.data.requestedBy.kind}, matches ${n.data.existing.map((w) => w.workKey).join(", ")} (conflict ${short(n.data.conflictId)} waits in the user's inbox)`;
 		case "pm.message": return ` · ${quote(n.data.text, 2e3)}`;
+		case "orchestrator.message": return ` · ${quote(n.data.text, Number.POSITIVE_INFINITY)}`;
+		case "reminder": return ` · ${quote(n.data.note, 2e3)} (scheduled for ${n.notBefore ?? n.createdAt})`;
 		case "factory.update": return ` · ${n.data.event}\n${quote(n.data.text, 4e3)}`;
 	}
 }
@@ -35168,12 +35693,23 @@ function githubProject(services, projectId) {
 	if (project.kind !== "github") throw new ToolError(`${project.name} is a local project without a GitHub remote: no issues or PRs.`);
 	return project;
 }
-/** An agent session of the caller's project, or a tool error. */
+/**
+* An agent session of the caller's project, or a tool error. Takes the full id or a unique
+* prefix of at least six characters, as digests and updates show ids.
+*/
 function agentSessionOf(services, sessionId, projectId) {
-	const found = services.sessionRepo.find(sessionId)?.session;
+	const id = services.sessionRepo.find(sessionId) ? sessionId : byPrefix(services, sessionId, projectId);
+	const found = id ? services.sessionRepo.find(id)?.session : void 0;
 	if (found?.role !== "agent" || found.projectId !== projectId) throw new ToolError(`No agent session ${sessionId} in this project. Call list_sessions for the ids.`);
 	return found;
 }
+/** The one agent session of a project whose id starts with `prefix`, if exactly one does. */
+function byPrefix(services, prefix, projectId) {
+	if (!/^[0-9a-f-]{6,}$/i.test(prefix)) return void 0;
+	const rows = services.db.select({ id: sessions.id }).from(sessions).where(and(eq(sessions.projectId, projectId), eq(sessions.role, "agent"), like(sessions.id, `${prefix.toLowerCase()}%`))).limit(5).all();
+	if (rows.length > 1) throw new ToolError(`More than one session starts with ${prefix}: ${rows.map((r) => r.id).join(", ")}. Use the full id.`);
+	return rows[0]?.id;
+}
 /** A session as tools report it: enough to identify and judge the work. */
 function compactSession(s) {
 	return {
@@ -35268,12 +35804,32 @@ const messagePm = defineTool({
 		projectId: string().min(1),
 		text: string().min(1).max(2e4)
 	}),
-	handler: async ({ projectId, text }, { services }) => {
+	handler: async ({ projectId, text }, { services, caller, sessionId }) => {
 		const project = projectFor(services, projectId);
-		const res = await services.orchestration.messagePm(projectId, text);
+		const res = await services.orchestration.messagePm(projectId, text, {
+			caller,
+			sessionId
+		});
+		if (res.status === "held") return `${heldNote(project.name, res.until)} Its reply arrives as a later message.`;
 		return `Message ${res.status} to the PM of ${project.name} (session ${res.sessionId}). Its reply arrives as a later message.`;
 	}
 });
+/**
+* What the orchestrator is told about a message the loop guard held back (§8.2): it is
+* queued and delivered automatically, so there is nothing to wait for or retry.
+*/
+function heldNote(projectName, until, now = Date.now()) {
+	return [
+		`Queued: CodeDen delivers this to the PM of ${projectName} automatically ${until - now <= 6e4 ? "within a minute" : `at about ${clock(until)} (local time)`}, or sooner if the PM wakes up for something else.`,
+		"Nothing else to do: do not send it again or plan a retry.",
+		"(CodeDen paces automatic back-and-forth between you and a PM while the user has not stepped in.)"
+	].join(" ");
+}
+/** `HH:MM` in the server's (the user's) local time. */
+const clock = (at) => {
+	const d = new Date(at);
+	return `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}`;
+};
 /** `ask_pm` (§8.3): ask a PM and wait for its answer. */
 const askPm = defineTool({
 	name: "ask_pm",
@@ -35286,13 +35842,17 @@ const askPm = defineTool({
 		question: string().min(1).max(2e4),
 		timeoutSec: int().min(10).max(540).optional()
 	}),
-	handler: async ({ projectId, question, timeoutSec }, { services, sessionId, signal }) => {
+	handler: async ({ projectId, question, timeoutSec }, { services, caller, sessionId, signal }) => {
 		const project = projectFor(services, projectId);
 		const outcome = await services.orchestration.askPm(projectId, question, {
-			fromSessionId: sessionId,
+			origin: {
+				caller,
+				sessionId
+			},
 			timeoutMs: timeoutSec ? timeoutSec * 1e3 : void 0,
 			signal
 		});
+		if (outcome.status === "held") return `pending: ${heldNote(project.name, outcome.until)} Do not ask again; the PM's answer arrives as a message.`;
 		if (outcome.status === "answered") return `The PM of ${project.name} answered:\n${outcome.text}`;
 		return `pending: the PM of ${project.name} is still working on it. Do not ask again; its answer will arrive as a message.`;
 	}
@@ -35479,7 +36039,7 @@ const listAutomations = defineTool({
 /** `run_automation` (§8.3, §8.4): run now, with the conflict check. */
 const runAutomation = defineTool({
 	name: "run_automation",
-	description: "Run one of this project's automations now (even if it is disabled or paused). If matching work is already running or queued, nothing starts and the result is 'conflict' with the existing work: call again with conflict = {resolution: 'wait'}, {resolution: 'skip'}, {resolution: 'join', sessionId} or {resolution: 'force', reason}.",
+	description: "Run one of this project's automations now (even if it is disabled or paused). If matching work is already running or queued, nothing starts and the result is 'conflict' with the existing work: choose the resolution yourself and call again with conflict = {resolution: 'wait'}, {resolution: 'skip'}, {resolution: 'join', sessionId} or {resolution: 'force', reason}.",
 	roles: ["pm"],
 	scope: "project",
 	input: object({
@@ -35539,7 +36099,7 @@ const getIssue = defineTool({
 /** `triage_issue` (§8.3, §10 issue triage): labels, comment, accept or decline. */
 const triageIssue$1 = defineTool({
 	name: "triage_issue",
-	description: "Record a triage decision on an issue: ready, needs_info, unsafe, out_of_scope or duplicate, with labels to add or remove and an optional comment (close: true for out of scope or duplicates). Follow the project's policy; ask the user when unsure.",
+	description: "Record a triage decision on an issue: ready, needs_info, unsafe, out_of_scope or duplicate, with labels to add or remove and an optional comment (close: true for out of scope or duplicates). Follow the project's policy. When you can't decide, choose needs_info (ask the author the specific questions in the comment) or unsafe (it needs a human decision); don't wait on the user.",
 	roles: ["pm"],
 	scope: "project",
 	isAvailable: inGithubProject,
@@ -35659,6 +36219,319 @@ const messageOrchestrator = defineTool({
 		return "Sent: the orchestrator will be woken with it shortly.";
 	}
 });
+// ../server/src/services/orchestration/notices.ts
+const clip$4 = (text, max = 300) => text.length > max ? `${text.slice(0, max - 3)}...` : text;
+/**
+* Work started by the PM, the orchestrator or an automation wakes the PM; sessions the user
+* started (and is watching) only produce notices that show up in the PM's next digest.
+*/
+function wakesPm(session) {
+	return session.startedBy.kind !== "user" || session.parentSessionId !== null;
+}
+/** Work a PM started for a request the orchestrator passed on (`startedBy.reportTo`). */
+function reportsToOrchestrator(session) {
+	return session.startedBy.reportTo === "orchestrator";
+}
+/** A session notice, copied for the orchestrator so the result reaches whoever asked (§8.2). */
+function forOrchestrator(notice, id) {
+	return {
+		wake: true,
+		notice: {
+			...notice,
+			id,
+			target: "orchestrator"
+		}
+	};
+}
+/** The id of an opened PR's notice: the same whether it came from the session or GitHub sync. */
+function prOpenedNoticeId(projectId, number) {
+	return `pr.opened:${projectId}:${number}`;
+}
+function workRef(s) {
+	return {
+		sessionId: s.id,
+		workKey: s.workKey,
+		purpose: s.purpose,
+		startedBy: s.startedBy
+	};
+}
+/**
+* Typed notices for a batch of committed events (§8.2 step 4). Pure apart from the lookups.
+* Only agent sessions inside a project produce notices; ids are derived from the source so
+* replays and repeats never create duplicates.
+*/
+function deriveNotices(events, lookup) {
+	const out = [];
+	const agentSession = (id) => {
+		const s = id ? lookup.session(id) : void 0;
+		return s && s.role === "agent" && s.projectId ? s : void 0;
+	};
+	for (const e of events) if (e.type === "agent.turn.completed") {
+		const event = e.payload;
+		const s = agentSession(e.sessionId);
+		if (!s || s.rootThreadId !== event.threadId) continue;
+		const final = lookup.finalMessage(s.id, event.turnId);
+		const finished = {
+			id: `session.finished:${s.id}:${event.turnId}`,
+			type: "session.finished",
+			projectId: s.projectId,
+			target: "pm",
+			sessionId: s.id,
+			title: `Finished: ${s.title ?? s.purpose}`,
+			data: {
+				...workRef(s),
+				summary: s.result?.summary ?? (final ? clipKeepingEnd(final) : null),
+				outcome: s.result?.outcome ?? null
+			}
+		};
+		out.push({
+			wake: wakesPm(s),
+			notice: finished
+		});
+		if (reportsToOrchestrator(s) && s.result) out.push(forOrchestrator(finished, `session.finished:orchestrator:${s.id}:${s.result.at}`));
+	} else if (e.type === "inbox.created") {
+		const { item } = e.payload;
+		const s = agentSession(item.sessionId);
+		if (!s) continue;
+		if (item.kind === "question" || item.kind === "approval") out.push({
+			wake: wakesPm(s),
+			notice: {
+				id: `session.needs_input:${item.id}`,
+				type: "session.needs_input",
+				projectId: s.projectId,
+				target: "pm",
+				sessionId: s.id,
+				title: `Needs input: ${s.title ?? s.purpose}`,
+				data: {
+					...workRef(s),
+					inboxItemId: item.id,
+					kind: item.kind,
+					question: item.title
+				}
+			}
+		});
+		else if (item.kind === "run_failed") {
+			const failed = {
+				id: `session.failed:${item.id}`,
+				type: "session.failed",
+				projectId: s.projectId,
+				target: "pm",
+				sessionId: s.id,
+				title: `Failed: ${s.title ?? s.purpose}`,
+				data: {
+					...workRef(s),
+					error: clip$4(item.body ?? item.title)
+				}
+			};
+			out.push({
+				wake: wakesPm(s),
+				notice: failed
+			});
+			if (reportsToOrchestrator(s)) out.push(forOrchestrator(failed, `session.failed:orchestrator:${item.id}`));
+		}
+	} else if (e.type === "session.updated") {
+		const { session } = e.payload;
+		if (session.role !== "agent" || !session.projectId || !session.pr) continue;
+		out.push({
+			wake: wakesPm(session),
+			notice: {
+				id: prOpenedNoticeId(session.projectId, session.pr.number),
+				type: "pr.opened",
+				projectId: session.projectId,
+				target: "pm",
+				sessionId: session.id,
+				title: `PR #${session.pr.number} opened: ${session.pr.title ?? session.purpose}`,
+				data: {
+					sessionId: session.id,
+					pr: session.pr
+				}
+			}
+		});
+	} else if (e.type === "automation_run.updated") {
+		const { run } = e.payload;
+		if (run.status !== "skipped" || !run.projectId) continue;
+		out.push({
+			wake: true,
+			notice: {
+				id: `automation.skipped:${run.id}`,
+				type: "automation.skipped",
+				projectId: run.projectId,
+				target: "pm",
+				sessionId: run.sessionId,
+				title: `Automation skipped: ${run.purpose}`,
+				data: {
+					automationRunId: run.id,
+					automationId: run.automationId,
+					workKey: run.workKey,
+					purpose: run.purpose,
+					reason: run.skipReason ?? "skipped"
+				}
+			}
+		});
+	}
+	return out;
+}
+/** Stored notices (§8.2): created through `notice.created`, delivered through `notice.delivered`. */
+var NoticeStore = class {
+	db;
+	store;
+	constructor(db, store) {
+		this.db = db;
+		this.store = store;
+	}
+	/** Store a notice unless one with the same id exists. Returns the stored notice, if new. */
+	create(draft) {
+		if (this.db.select({ id: notices.id }).from(notices).where(eq(notices.id, draft.id)).get()) return;
+		const notice = {
+			...draft,
+			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+			deliveredAt: null
+		};
+		this.store.append([{
+			type: "notice.created",
+			sessionId: null,
+			payload: { notice }
+		}]);
+		return notice;
+	}
+	list(query = {}) {
+		const conditions = [];
+		if (query.projectId) conditions.push(eq(notices.projectId, query.projectId));
+		if (query.target) conditions.push(eq(notices.target, query.target));
+		return this.db.select().from(notices).where(and(...conditions)).orderBy(desc(notices.createdAt)).limit(query.limit ?? 100).all().map((r) => r.notice);
+	}
+	/**
+	* Undelivered notices for a target, oldest first. `projectId` null = the orchestrator. A
+	* scheduled wake-up counts once it is due.
+	*/
+	undelivered(target, projectId) {
+		return this.db.select().from(notices).where(and(eq(notices.target, target), isNull(notices.deliveredAt), projectId === null ? void 0 : eq(notices.projectId, projectId), or$1(isNull(notices.notBefore), lte(notices.notBefore, (/* @__PURE__ */ new Date()).toISOString())))).orderBy(notices.createdAt).limit(50).all().map((r) => r.notice);
+	}
+	/** A target's scheduled wake-ups still to deliver (due or not), soonest first. */
+	scheduled(target, projectId) {
+		return this.db.select().from(notices).where(and(eq(notices.type, "reminder"), eq(notices.target, target), isNull(notices.deliveredAt), projectId === null ? isNull(notices.projectId) : eq(notices.projectId, projectId))).orderBy(asc(notices.notBefore)).all().map((r) => r.notice);
+	}
+	/** Undelivered notices held back until a time: the due ones, or the soonest still ahead. */
+	heldBack(due) {
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		return this.db.select().from(notices).where(and(isNull(notices.deliveredAt), due ? lte(notices.notBefore, now) : gt$1(notices.notBefore, now))).orderBy(asc(notices.notBefore)).limit(due ? 200 : 1).all().map((r) => r.notice);
+	}
+	/** Notices of the given types for a project since `since`, newest first. */
+	recent(projectId, types, since, limit = 5) {
+		return this.db.select().from(notices).where(and(eq(notices.projectId, projectId), inArray(notices.type, types), gte(notices.createdAt, since))).orderBy(desc(notices.createdAt)).limit(limit).all().map((r) => r.notice);
+	}
+	markDelivered(ids) {
+		if (ids.length === 0) return;
+		this.store.append([{
+			type: "notice.delivered",
+			sessionId: null,
+			payload: {
+				noticeIds: ids,
+				at: (/* @__PURE__ */ new Date()).toISOString()
+			}
+		}]);
+	}
+	/** Back to undelivered: the turn that carried them failed, so the next wake carries them. */
+	markReturned(ids) {
+		if (ids.length === 0) return;
+		this.store.append([{
+			type: "notice.returned",
+			sessionId: null,
+			payload: {
+				noticeIds: ids,
+				at: (/* @__PURE__ */ new Date()).toISOString()
+			}
+		}]);
+	}
+};
+// ../server/src/mcp/tools/shared/session-items.ts
+/** A session's question item (`ask_user` or the provider's own) by its request id. */
+function questionItem(db, sessionId, requestId) {
+	const rows = db.select().from(items).where(and(eq(items.sessionId, sessionId), eq(items.kind, "user_question"))).all();
+	for (const row of rows) if (row.data.kind === "user_question" && row.data.requestId === requestId) return row.data;
+}
+/** The latest non-empty assistant message on a session's root thread. */
+function lastAssistantMessage(db, session) {
+	if (!session.rootThreadId) return null;
+	const rows = db.select().from(items).where(and(eq(items.sessionId, session.id), eq(items.threadId, session.rootThreadId), eq(items.kind, "assistant_message"))).orderBy(desc(items.position)).limit(5).all();
+	for (const row of rows) if (row.data.kind === "assistant_message" && row.data.text.trim()) return row.data.text.trim();
+	return null;
+}
+// ../server/src/mcp/tools/pm/questions.ts
+/**
+* `answer_question` (§8.2 step 5): the PM answers a question one of its project's agent
+* sessions asked, so the agent carries on without waiting for the user. Only questions from
+* work the PM, the orchestrator or an automation started; approvals and the questions of
+* sessions the user started stay with the user.
+*/
+const answerQuestion = defineTool({
+	name: "answer_question",
+	description: "Answer a question one of this project's agent sessions asked (an open inbox item of kind 'question', named in a 'needs input' update), when its brief, your notes, the vision or a sensible default settles it. The agent gets the answer at once (or as its next message) and the inbox item closes as answered by you. Approvals, and questions from sessions the user started, stay with the user.",
+	roles: ["pm"],
+	scope: "project",
+	alwaysLoad: true,
+	input: object({
+		inboxItemId: string().min(1),
+		answer: string().min(1).max(1e4).describe("Your answer: an option's label or free text, with a short reason")
+	}),
+	handler: async ({ inboxItemId, answer }, { services, projectId }) => {
+		const item = services.inbox.find(inboxItemId);
+		if (!item) throw new ToolError(`No inbox item ${inboxItemId}`);
+		if (item.status !== "open") throw new ToolError(`That question was already ${item.status}`);
+		if (item.kind !== "question") throw new ToolError(item.kind === "approval" ? "Approvals stay with the user; you can only answer questions." : `Only questions can be answered here (this item is a ${item.kind}).`);
+		if (!item.sessionId || !item.requestId) throw new ToolError("This question belongs to no agent session");
+		const session = agentSessionOf(services, item.sessionId, projectId);
+		if (!wakesPm(session)) throw new ToolError("The user started that session and answers its questions themselves.");
+		const ids = questionItem(services.db, session.id, item.requestId)?.questions.map((q) => q.id) ?? ["q1"];
+		const answers = Object.fromEntries(ids.map((id) => [id, [answer]]));
+		await services.sessions.respond(session.id, {
+			requestId: item.requestId,
+			response: {
+				kind: "answer",
+				answers
+			}
+		}, "pm");
+		return `Answered. ${session.title ?? session.purpose} (session ${session.id}) has your answer.`;
+	}
+});
+// ../server/src/mcp/tools/pm/session-detail.ts
+/** Longest last message returned; longer ones keep their end, where questions usually are. */
+const MESSAGE_LIMIT = 8e3;
+/**
+* `get_session` (§8.4): one agent session in detail, so the PM can act on what it said or asked
+* without the user relaying it: its last message in full, what it waits on (with inbox ids, for
+* `answer_question`) and its result.
+*/
+const getSession = defineTool({
+	name: "get_session",
+	description: "One of this project's agent sessions in detail: status, progress and result, its last message in full, and the questions and approvals it is waiting on with their inbox ids (answer questions with answer_question). Takes the full session id or a unique prefix of at least 6 characters, as updates and the status digest show them.",
+	roles: ["pm"],
+	scope: "project",
+	alwaysLoad: true,
+	input: object({ sessionId: string().min(1) }),
+	handler: async ({ sessionId }, { services, projectId }) => {
+		const session = agentSessionOf(services, sessionId, projectId);
+		const last = lastAssistantMessage(services.db, session);
+		const waitingOn = services.inbox.list({ sessionId: session.id }).filter((i) => i.kind === "question" || i.kind === "approval").map((i) => {
+			const asked = i.requestId ? questionItem(services.db, session.id, i.requestId) : void 0;
+			return {
+				inboxItemId: i.id,
+				kind: i.kind,
+				title: i.title,
+				body: i.body,
+				...asked ? { questions: asked.questions.map((q) => ({
+					question: q.question,
+					options: q.options.map((o) => o.label)
+				})) } : {}
+			};
+		});
+		return {
+			session: compactSession(session),
+			lastMessage: last && last.length > MESSAGE_LIMIT ? `…${last.slice(-8e3)}` : last ?? null,
+			waitingOn
+		};
+	}
+});
 // ../server/src/mcp/tools/pm/sessions.ts
 const ENDED$3 = /* @__PURE__ */ new Set([
 	"completed",
@@ -35695,12 +36568,12 @@ const listSessions = defineTool({
 /** `start_session` (§8.2, §8.4): start an agent session, with the conflict check built in. */
 const startSession = defineTool({
 	name: "start_session",
-	description: "Start an agent session in its own worktree to do one piece of work. Always pass a workKey (issue:<n>, pr:<n>, automation:<name> or request:<slug>) and a one-line purpose; add scope (paths or area) when known. If matching work is already running or queued, nothing starts and the result is 'conflict' with the existing work: then call again with conflict = {resolution: 'wait'} (queue behind it), {resolution: 'skip'}, {resolution: 'join', sessionId} (send the prompt to the existing session) or {resolution: 'force', reason}.",
+	description: "Start an agent session in its own worktree to do one piece of work. Always pass a workKey (issue:<n>, pr:<n>, automation:<name> or request:<slug>) and a one-line purpose; add scope (paths or area) when known. If matching work is already running or queued, nothing starts and the result is 'conflict' with the existing work: choose the resolution yourself and call again with conflict = {resolution: 'wait'} (queue behind it), {resolution: 'skip'} (it is the same work), {resolution: 'join', sessionId} (send the prompt to the existing session) or {resolution: 'force', reason}.",
 	roles: ["pm"],
 	scope: "project",
 	alwaysLoad: true,
 	input: object({
-		prompt: string().min(1).max(5e4).describe("The brief for the agent: goal, context, acceptance criteria"),
+		prompt: string().min(1).max(5e4).describe("The brief for the agent: goal, context, acceptance criteria, and the decisions you already made (defaults, scope, whether to open a pull request), so the agent doesn't have to ask"),
 		purpose: string().trim().min(1).max(300),
 		workKey: WorkKey.optional(),
 		scope: object({
@@ -35712,7 +36585,8 @@ const startSession = defineTool({
 		provider: ProviderId.optional(),
 		model: string().min(1).optional(),
 		effort: ReasoningEffort.optional(),
-		conflict: ConflictDecision.optional()
+		conflict: ConflictDecision.optional(),
+		reportTo: _enum(["orchestrator"]).optional().describe("'orchestrator' when the orchestrator passed this work on: its finish or failure also reaches the orchestrator, so it can tell the user")
 	}),
 	handler: async (input, { services, projectId, sessionId }) => {
 		const project = projectFor(services, projectId);
@@ -35733,7 +36607,8 @@ const startSession = defineTool({
 			issue,
 			startedBy: {
 				kind: "pm",
-				id: sessionId ?? void 0
+				id: sessionId ?? void 0,
+				reportTo: input.reportTo
 			},
 			parentSessionId: sessionId ?? void 0,
 			input: { text: input.prompt },
@@ -35761,7 +36636,7 @@ const startSession = defineTool({
 			};
 			case "conflict": return {
 				status: "conflict",
-				message: "Matching work is already running or queued; nothing was started. Report it, or call start_session again with a conflict resolution (wait, skip, join with sessionId, force with reason).",
+				message: "Matching work is already running or queued; nothing was started. Choose a resolution yourself and call start_session again with it: wait (queue behind it), skip (it is the same work), join with sessionId (it adds to that work) or force with a reason. Then say in one line what you chose.",
 				existing: result.existing.map(compactWork)
 			};
 		}
@@ -35780,8 +36655,8 @@ const messageSession = defineTool({
 		whenBusy: _enum(["queue", "steer"]).optional()
 	}),
 	handler: async ({ sessionId, text, whenBusy }, { services, projectId }) => {
-		agentSessionOf(services, sessionId, projectId);
-		return `Message ${(await services.sessions.send(sessionId, {
+		const session = agentSessionOf(services, sessionId, projectId);
+		return `Message ${(await services.sessions.send(session.id, {
 			input: messageFrom("pm", text),
 			whenBusy: whenBusy ?? "queue"
 		}, "pm")).status}.`;
@@ -35800,10 +36675,10 @@ const stopSession = defineTool({
 	}),
 	handler: async ({ sessionId }, { services, projectId }) => {
 		const session = agentSessionOf(services, sessionId, projectId);
-		if (ENDED$3.has(session.status)) throw new ToolError(`Session ${sessionId} already ${session.status}`);
+		if (ENDED$3.has(session.status)) throw new ToolError(`Session ${session.id} already ${session.status}`);
 		return {
-			status: (await services.sessions.stop(sessionId)).status,
-			sessionId
+			status: (await services.sessions.stop(session.id)).status,
+			sessionId: session.id
 		};
 	}
 });
@@ -35823,9 +36698,11 @@ const pmTools = [
 		handler: async (_input, { services, projectId }) => renderProjectDigest(services.orchestration.projectStatus(projectId))
 	}),
 	listSessions,
+	getSession,
 	startSession,
 	messageSession,
 	stopSession,
+	answerQuestion,
 	defineTool({
 		name: "list_scheduled_runs",
 		description: "Upcoming scheduled automation runs of this project, soonest first.",
@@ -36139,31 +37016,96 @@ const shareToChat = defineTool({
 function extensionFor(mediaType) {
 	return Object.entries(MEDIA_TYPES$1).find(([, type]) => type === mediaType)?.[0] ?? ".bin";
 }
+// ../server/src/mcp/tools/suggest-followups.ts
+/** `suggest_followups` (§7.5): next prompts shown as chips when the turn completes. */
+const suggestFollowups = defineTool({
+	name: "suggest_followups",
+	description: "Suggest 2 to 4 short next prompts the user might send after this turn, written as the user would type them (for example 'Add tests for the empty-input case'). Call it as the last action of every turn. Calling it again in the same turn replaces the earlier suggestions.",
+	roles: ["agent"],
+	scope: "session",
+	alwaysLoad: true,
+	input: object({ suggestions: array(string().min(1).max(300)).min(2).max(4).describe("2-4 follow-up prompts, most useful first") }),
+	handler: async ({ suggestions }, { services, sessionId }) => {
+		const turn = currentTurn(services, sessionId);
+		putTurnItem(services, sessionId, turn, {
+			id: `followups-${turn.turnId}`,
+			kind: "followups",
+			status: "completed",
+			source: "agent",
+			suggestions: suggestions.map((prompt) => ({ prompt }))
+		});
+		return "Follow-ups saved; they are shown to the user when the turn ends.";
+	}
+});
+// ../server/src/mcp/tools/wakeups.ts
+/** The orchestrator, or the PM of the caller's project. */
+function ownerOf(ctx) {
+	if (ctx.role === "orchestrator") return {
+		target: "orchestrator",
+		projectId: null,
+		sessionId: ctx.sessionId
+	};
+	if (!ctx.projectId) throw new ToolError("Only the orchestrator or a project's PM has wake-ups");
+	return {
+		target: "pm",
+		projectId: ctx.projectId,
+		sessionId: ctx.sessionId
+	};
+}
+/** The wake-up tools of the orchestrator and PMs. */
+const wakeupTools = [
+	defineTool({
+		name: "schedule_wakeup",
+		description: "Schedule a wake-up for yourself: at that time CodeDen wakes you with your note (and the usual status digest), so you can follow up later (check on running work, retry something, report back) without waiting for the user. Give inMinutes (1 to 10080) or an ISO 8601 time in at, no more than 7 days ahead. At most 20 pending at once.",
+		roles: ["orchestrator", "pm"],
+		scope: "session",
+		alwaysLoad: true,
+		input: object({
+			inMinutes: int().min(1).max(10080).optional(),
+			at: datetime({ offset: true }).optional().describe("When, e.g. 2026-11-11T09:00:00Z"),
+			note: string().trim().min(1).max(2e3).describe("What to do when you wake up, for your future self")
+		}).refine((v) => v.inMinutes === void 0 !== (v.at === void 0), { message: "Give exactly one of inMinutes or at" }),
+		handler: async ({ inMinutes, at, note }, ctx) => {
+			const when = at ? new Date(at) : new Date(Date.now() + (inMinutes ?? 0) * 6e4);
+			const reminder = ctx.services.orchestration.reminders.schedule(ownerOf(ctx), when, note);
+			return `Wake-up ${reminder.id} scheduled for ${reminder.notBefore}. You will be woken with your note then; nothing more to do now.`;
+		}
+	}),
+	defineTool({
+		name: "list_wakeups",
+		description: "Your pending wake-ups (from schedule_wakeup), soonest first.",
+		roles: ["orchestrator", "pm"],
+		scope: "session",
+		input: object({}),
+		handler: async (_input, ctx) => {
+			const owner = ownerOf(ctx);
+			return { wakeups: ctx.services.orchestration.reminders.pending(owner.target, owner.projectId).flatMap((n) => n.type === "reminder" ? [{
+				id: n.id,
+				at: n.notBefore,
+				note: n.data.note
+			}] : []) };
+		}
+	}),
+	defineTool({
+		name: "cancel_wakeup",
+		description: "Cancel one of your pending wake-ups by its id (from list_wakeups).",
+		roles: ["orchestrator", "pm"],
+		scope: "session",
+		input: object({ id: string().min(1) }),
+		handler: async ({ id }, ctx) => {
+			const owner = ownerOf(ctx);
+			if (!ctx.services.orchestration.reminders.cancel(owner.target, owner.projectId, id)) throw new ToolError(`You have no pending wake-up ${id}. Call list_wakeups for the ids.`);
+			return `Wake-up ${id} cancelled.`;
+		}
+	})
+];
 // ../server/src/mcp/tools/index.ts
 /** Every CodeDen tool, in the order agents see them. Add new tools here (one file each). */
 const allTools = [
 	reportProgress,
 	askUser,
 	shareToChat,
-	defineTool({
-		name: "suggest_followups",
-		description: "Suggest 2 to 4 short next prompts the user might send after this turn, written as the user would type them (for example 'Add tests for the empty-input case'). Call it as the last action of every turn. Calling it again in the same turn replaces the earlier suggestions.",
-		roles: ["agent"],
-		scope: "session",
-		alwaysLoad: true,
-		input: object({ suggestions: array(string().min(1).max(300)).min(2).max(4).describe("2-4 follow-up prompts, most useful first") }),
-		handler: async ({ suggestions }, { services, sessionId }) => {
-			const turn = currentTurn(services, sessionId);
-			putTurnItem(services, sessionId, turn, {
-				id: `followups-${turn.turnId}`,
-				kind: "followups",
-				status: "completed",
-				source: "agent",
-				suggestions: suggestions.map((prompt) => ({ prompt }))
-			});
-			return "Follow-ups saved; they are shown to the user when the turn ends.";
-		}
-	}),
+	suggestFollowups,
 	finish,
 	browserNavigate,
 	browserSnapshot,
@@ -36178,65 +37120,18 @@ const allTools = [
 	generateImage,
 	...orchestratorTools,
 	...pmTools,
+	...wakeupTools,
 	...githubTools,
 	...factoryTools
 ];
 // ../server/src/services/agent-config/paths.ts
 /**
-* Claude Code's folder name for a project under `~/.claude/projects/`: every character that
-* is not an ASCII letter or digit becomes `-` (`C:\Projects\codeden` -> `C--Projects-codeden`,
-* `C:\Users\me\.cfg` -> `C--Users-me--cfg`). Verified against real folder names on Windows.
-*/
-function claudeProjectSlug(projectPath) {
-	return projectPath.replace(/[^a-zA-Z0-9]/g, "-");
-}
-/**
 * The project's Claude auto-memory folder (§12.4): `autoMemoryDirectory` from the user's
 * `~/.claude/settings.json` when set, else `~/.claude/projects/<slug>/memory`. The slug comes
-* from the git repository root, so every worktree of a repo shares one folder. Very long
-* slugs are shortened by Claude Code; an existing folder with the same prefix is used then.
+* from the git repository root, so every worktree of a repo shares one folder.
 */
 function claudeAutoMemoryDir(home, repoRoot) {
-	const custom = readJson(join(home, ".claude", "settings.json"))?.autoMemoryDirectory;
-	if (typeof custom === "string" && custom.trim()) {
-		const value = custom.trim();
-		return value.startsWith("~/") || value.startsWith("~\\") ? join(home, value.slice(2)) : resolve(value);
-	}
-	const projects = join(home, ".claude", "projects");
-	const slug = claudeProjectSlug(repoRoot);
-	const direct = join(projects, slug);
-	if (slug.length > 200 && !existsSync(direct) && existsSync(projects)) {
-		const prefix = slug.slice(0, 200).toLowerCase();
-		const match = readdirSync(projects).find((name) => name.toLowerCase().startsWith(prefix));
-		if (match) return join(projects, match, "memory");
-	}
-	return join(direct, "memory");
-}
-/** Nearest ancestor (or `dir` itself) containing `.git` (a folder, or a file in worktrees). */
-function findGitRoot(dir) {
-	let current = resolve(dir);
-	for (;;) {
-		if (existsSync(join(current, ".git"))) return current;
-		const parent = dirname(current);
-		if (parent === current) return null;
-		current = parent;
-	}
-}
-/** The main checkout of a worktree (`.git` file -> `gitdir: <main>/.git/worktrees/x`). */
-function mainRepoRoot(gitRoot) {
-	const marker = join(gitRoot, ".git");
-	try {
-		if (!statSync(marker).isFile()) return gitRoot;
-		const line = readFileSync(marker, "utf8").trim();
-		const gitdir = /^gitdir:\s*(.+)$/m.exec(line)?.[1];
-		if (!gitdir) return gitRoot;
-		const absolute = resolve(gitRoot, gitdir);
-		const at = absolute.split(sep).lastIndexOf("worktrees");
-		if (at < 1) return gitRoot;
-		return dirname(absolute.split(sep).slice(0, at).join(sep));
-	} catch {
-		return gitRoot;
-	}
+	return claudeMemoryDir(join(home, ".claude"), repoRoot, home);
 }
 /** `dir` and its ancestors, nearest first, up to the filesystem root. */
 function ancestors(dir) {
@@ -45130,7 +46025,7 @@ const NOTICE_EVENTS = {
 	"session.failed": "session.failed",
 	"session.needs_input": "session.needs_input"
 };
-const PR_EVENTS = /* @__PURE__ */ new Set([
+const PR_EVENTS$1 = /* @__PURE__ */ new Set([
 	"pr.opened",
 	"pr.merged",
 	"pr.checks_failed"
@@ -45189,7 +46084,7 @@ function triggerEvents(events, session) {
 			author: pr.author,
 			sessionId: pr.sessionId
 		});
-	} else if (PR_EVENTS.has(e.type)) {
+	} else if (PR_EVENTS$1.has(e.type)) {
 		const { pr } = e.payload;
 		out.push({
 			event: e.type,
@@ -45885,6 +46780,43 @@ var CronScheduler = class {
 		this.timer.unref();
 	}
 };
+// ../server/src/services/automations/triage-prompts.ts
+/**
+* The texts of issue triage (§10): the request a triage run sends to the PM, and the brief of
+* the agent session that resolves a ready issue. Pure, so tests can check the wording.
+*/
+/** The PM's instructions for one triage run. `canStart`: ready issues start a session. */
+function triageRequestText(opts) {
+	const { automation, run, issue, policy } = opts;
+	const labels = Object.entries(policy.labels).map(([decision, names]) => `  - ${decision}: ${names.length ? names.join(", ") : "(none)"}`).join("\n");
+	return [
+		`Issue triage (automation "${automation.name}", run ${run.id}).`,
+		`New issue #${issue.number}: ${issue.title ?? ""}`,
+		issue.url,
+		"",
+		"1. Read it with get_issue (and list_issues to look for duplicates). Compare it with the project notes, the vision and the work already running.",
+		"2. Classify it as exactly one of: ready (clear, in scope, safe to implement), needs_info (unclear or missing reproduction), unsafe (touches protected areas or needs a human decision), out_of_scope, duplicate.",
+		`3. Apply it with triage_issue using these labels:\n${labels}`,
+		policy.comment ? "   Include a short, friendly comment explaining the decision (for needs_info, ask the specific questions)." : "   Do not comment on the issue.",
+		policy.closeRejected ? "   Close duplicates and out-of-scope issues (close: true)." : "   Do not close the issue.",
+		"4. Then call report_triage with the issue number, the decision and a two-sentence summary.",
+		opts.canStart ? "   For ready issues CodeDen starts an agent session automatically; do not call start_session yourself." : "   For ready issues CodeDen asks the user whether to take it on; do not call start_session yourself.",
+		"Decide the classification yourself and don't call ask_user: nobody answers during a triage run, and a run that waits never reports. When you can't tell, choose needs_info or unsafe and say why in the summary.",
+		automation.action.type === "triage" && automation.action.instructions ? `\nProject guidance:\n${automation.action.instructions}` : ""
+	].filter((l) => l !== "").join("\n");
+}
+/** The brief of the agent session that resolves a triaged issue. */
+function issueSessionPrompt(issue, summary) {
+	const title = issue.title ?? `Issue #${issue.number}`;
+	return [
+		`Resolve GitHub issue #${issue.number}: ${title}`,
+		issue.url,
+		summary ? `\nTriage summary: ${summary}` : "",
+		"",
+		`Read the full issue and its comments first (\`gh issue view ${issue.number} --comments\`). Implement the change in your worktree following the project's conventions, add or update tests that prove it, and run the test suite.`,
+		`Then open a pull request with create_pull_request whose body includes "Fixes #${issue.number}", attach evidence (test output, and screenshots for UI changes) with attach_evidence, and call finish. If a detail is unclear, make the reasonable call within the issue's scope and state the assumption in the pull request description. Ask with ask_user only if the change needs a protected area or a destructive or outward-facing step.`
+	].filter((l) => l !== "").join("\n");
+}
 // ../server/src/services/automations/triage.ts
 /** Inbox id of the "Should I take this on?" decision for an issue. */
 function triageItemId(projectId, issueNumber) {
@@ -45910,22 +46842,13 @@ var TriageService = class {
 	async request(project, automation, run, issue) {
 		if (project.kind !== "github") throw badRequest("Triage needs a GitHub project", "not_github");
 		const policy = policyOf(automation);
-		const labels = Object.entries(policy.labels).map(([decision, names]) => `  - ${decision}: ${names.length ? names.join(", ") : "(none)"}`).join("\n");
-		const canStart = policy.autoStart && project.autonomyMode !== "manual";
-		const text = [
-			`Issue triage (automation "${automation.name}", run ${run.id}).`,
-			`New issue #${issue.number}: ${issue.title ?? ""}`,
-			issue.url,
-			"",
-			"1. Read it with get_issue (and list_issues to look for duplicates). Compare it with the project notes, the vision and the work already running.",
-			"2. Classify it as exactly one of: ready (clear, in scope, safe to implement), needs_info (unclear or missing reproduction), unsafe (touches protected areas or needs a human decision), out_of_scope, duplicate.",
-			`3. Apply it with triage_issue using these labels:\n${labels}`,
-			policy.comment ? "   Include a short, friendly comment explaining the decision (for needs_info, ask the specific questions)." : "   Do not comment on the issue.",
-			policy.closeRejected ? "   Close duplicates and out-of-scope issues (close: true)." : "   Do not close the issue.",
-			"4. Then call report_triage with the issue number, the decision and a two-sentence summary.",
-			canStart ? "   For ready issues CodeDen starts an agent session automatically; do not call start_session yourself." : "   For ready issues CodeDen asks the user whether to take it on; do not call start_session yourself.",
-			automation.action.type === "triage" && automation.action.instructions ? `\nProject guidance:\n${automation.action.instructions}` : ""
-		].filter((l) => l !== "").join("\n");
+		const text = triageRequestText({
+			automation,
+			run,
+			issue,
+			policy,
+			canStart: policy.autoStart && project.autonomyMode !== "manual"
+		});
 		return (await this.deps.orchestration().sendToRole("pm", project.id, {
 			text,
 			attachments: []
@@ -46025,14 +46948,7 @@ var TriageService = class {
 	}
 	async startForIssue(project, issue, summary, policy, startedBy, decision) {
 		const title = issue.title ?? `Issue #${issue.number}`;
-		const prompt = [
-			`Resolve GitHub issue #${issue.number}: ${title}`,
-			issue.url,
-			summary ? `\nTriage summary: ${summary}` : "",
-			"",
-			`Read the full issue and its comments first (\`gh issue view ${issue.number} --comments\`). Implement the change in your worktree following the project's conventions, add or update tests that prove it, and run the test suite.`,
-			`Then open a pull request with create_pull_request whose body includes "Fixes #${issue.number}", attach evidence (test output, and screenshots for UI changes) with attach_evidence, and call finish. If the issue turns out to be unclear or unsafe, ask with ask_user instead of guessing.`
-		].filter((l) => l !== "").join("\n");
+		const prompt = issueSessionPrompt(issue, summary);
 		return this.deps.sessions.start(StartSessionRequest.parse({
 			projectId: project.id,
 			role: "agent",
@@ -46501,7 +47417,8 @@ const runTool = (command, args, opts = {}) => {
 			env: mergeEnv(env, {
 				NO_COLOR: "1",
 				FORCE_COLOR: "0",
-				GIT_TERMINAL_PROMPT: "0"
+				GIT_TERMINAL_PROMPT: "0",
+				GCM_INTERACTIVE: "never"
 			}),
 			windowsHide: true,
 			windowsVerbatimArguments: isShim,
@@ -52470,6 +53387,21 @@ var PrFollowUp = class {
 		for (const number of issues) await commentOnIssue({ client: this.deps.client }, repo, number, `Resolved by #${pr.number}, merged${pr.mergedAt ? ` at ${pr.mergedAt}` : ""}.\n\n<sub>CodeDen session ${label}</sub>`);
 	}
 };
+// ../server/src/services/sessions/own-branch.ts
+/**
+* The branch a session owns: its own worktree's branch, never its base branch or a usual
+* default branch. The agent may force-push it with a lease (§11.2).
+*/
+function ownBranch(session) {
+	const { branch, worktreePath, baseBranch } = session;
+	if (!branch || !worktreePath || branch === baseBranch) return void 0;
+	return [
+		"main",
+		"master",
+		"develop",
+		"trunk"
+	].includes(branch) ? void 0 : branch;
+}
 // ../server/src/services/github/graphql.ts
 /** Batched GraphQL reads of pull requests: state, checks, reviews, mergeability, commits. */
 const PR_FIELDS = `
@@ -52646,6 +53578,31 @@ function pullRequestBody(text, issue, session) {
 	parts.push(`---\n<sub>Opened by CodeDen session ${label}</sub>\n${SESSION_MARKER}${session.id} -->`);
 	return parts.filter(Boolean).join("\n\n");
 }
+/** git's answer when a push would rewrite the remote branch's history. */
+const NOT_FAST_FORWARD = /\((non-fast-forward|fetch first)\)|updates were rejected/i;
+/**
+* Push the session's branch. When the session owns it (its own worktree's branch) and the push
+* is rejected as not a fast-forward, as after a rebase, push again with a lease: that rewrites
+* only the session's own work, and refuses if someone else pushed there since.
+*/
+async function pushBranch(deps, session, cwd, branch) {
+	const push = {
+		name: "git.push",
+		cwd,
+		branch,
+		setUpstream: true
+	};
+	try {
+		await deps.runner.request(push, 3e5);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		if (ownBranch(session) !== branch || !NOT_FAST_FORWARD.test(message)) throw error;
+		await deps.runner.request({
+			...push,
+			forceWithLease: true
+		}, 3e5);
+	}
+}
 /**
 * Push the session's branch through the runner and open (or update) its pull request (§8.2,
 * §9). The PR is projected right away (`pr.opened` / `pr.updated`) and linked to the session.
@@ -52670,12 +53627,7 @@ async function createPullRequest(deps, session, repo, input) {
 				message: input.commitMessage
 			}, 3e5)).commit;
 		}
-		await deps.runner.request({
-			name: "git.push",
-			cwd,
-			branch,
-			setUpstream: true
-		}, 3e5);
+		await pushBranch(deps, session, cwd, branch);
 	} catch (error) {
 		throw toServiceError$1(error);
 	}
@@ -53891,28 +54843,37 @@ var GithubServicePort = class {
 // ../server/src/services/orchestration/asks.ts
 /** The marker that ties a PM turn to an `ask_pm` call. */
 const askMarker = (askId) => `(ask ${askId})`;
+const MARKER = /\(ask ([0-9a-f]{8})\)/g;
+/** Asks answered recently (kept so a turn's answer is never sent twice). */
+const SETTLED_LIMIT = 500;
 const MAX_AGE_MS = 216e5;
 /**
 * `ask_pm` replies (§8.3). The question goes to the PM as a message carrying a marker; the
 * PM's turn that handles it is found by the marker in its user message, and the final
 * assistant message of that turn is the answer (or a `message_orchestrator` call with
 * `replyTo`, whichever comes first). If the call times out, the answer still reaches the
-* orchestrator later, as a message.
+* orchestrator later, as a message. So does the answer to an ask nothing tracks any more (a
+* restart, an ask older than six hours): the marker in the turn's input is enough.
 */
 var PmAsks = class {
 	deps;
 	waiters = /* @__PURE__ */ new Map();
+	settled = /* @__PURE__ */ new Set();
 	constructor(deps) {
 		this.deps = deps;
 	}
-	register(askId, target) {
+	/**
+	* Track an ask. A `detached` ask has no call waiting for it (the loop guard held the
+	* question back): its answer reaches the orchestrator as a message.
+	*/
+	register(askId, target, opts = {}) {
 		this.prune();
 		this.waiters.set(askId, {
 			askId,
 			...target,
 			turnId: void 0,
 			resolve: void 0,
-			late: false,
+			late: opts.detached ?? false,
 			createdAt: Date.now()
 		});
 	}
@@ -53949,9 +54910,10 @@ var PmAsks = class {
 	}
 	/** Follow committed events: find the answering turn, then its final message. */
 	onEvents(events) {
-		if (this.waiters.size === 0) return;
 		for (const e of events) {
 			if (!e.sessionId) continue;
+			if (e.type === "agent.turn.completed") this.answerUntracked(e.sessionId, e.payload.turnId);
+			if (this.waiters.size === 0) continue;
 			if (e.type === "agent.item.started" || e.type === "agent.item.completed") {
 				const event = e.payload;
 				const item = event.item;
@@ -53973,16 +54935,50 @@ var PmAsks = class {
 	}
 	finish(waiter, text) {
 		this.waiters.delete(waiter.askId);
+		this.settle(waiter.askId);
 		if (waiter.resolve) waiter.resolve(text);
 		else if (waiter.late) {
-			const reply = {
-				projectId: waiter.projectId,
-				pmSessionId: waiter.pmSessionId,
+			const { askId, projectId, pmSessionId } = waiter;
+			setImmediate(() => this.deps.onLateReply({
+				askId,
+				projectId,
+				pmSessionId,
 				text
-			};
-			setImmediate(() => this.deps.onLateReply(reply));
+			}));
 		}
 	}
+	/**
+	* A PM's turn completed: answer the asks in its input that no waiter tracks (registered
+	* before a restart, or pruned). Tracked ones are answered by their waiter instead.
+	*/
+	answerUntracked(sessionId, turnId) {
+		const session = this.deps.session(sessionId);
+		if (session?.role !== "pm" || !session.projectId) return;
+		const projectId = session.projectId;
+		const askIds = /* @__PURE__ */ new Set();
+		for (const row of this.deps.db.select().from(items).where(and(eq(items.sessionId, sessionId), eq(items.turnId, turnId), eq(items.kind, "user_message"))).all()) {
+			if (row.data.kind !== "user_message") continue;
+			for (const m of row.data.input.text.matchAll(MARKER)) if (m[1]) askIds.add(m[1]);
+		}
+		const untracked = [...askIds].filter((id) => !this.waiters.has(id) && !this.settled.has(id));
+		if (untracked.length === 0) return;
+		const text = this.finalMessage(sessionId, turnId) ?? "(The PM finished without a reply.)";
+		for (const askId of untracked) {
+			this.settle(askId);
+			setImmediate(() => this.deps.onLateReply({
+				askId,
+				projectId,
+				pmSessionId: sessionId,
+				text
+			}));
+		}
+	}
+	settle(askId) {
+		this.settled.add(askId);
+		if (this.settled.size <= SETTLED_LIMIT) return;
+		const oldest = this.settled.values().next().value;
+		if (oldest !== void 0) this.settled.delete(oldest);
+	}
 	finalMessage(sessionId, turnId) {
 		return finalAssistantMessage(this.deps.db, sessionId, turnId);
 	}
@@ -53997,6 +54993,52 @@ function finalAssistantMessage(db, sessionId, turnId) {
 	for (const row of rows) if (row.data.kind === "assistant_message" && row.data.text.trim()) return row.data.text.trim();
 	return null;
 }
+// ../server/src/services/orchestration/cards.ts
+/**
+* Notices a wake (or any message) delivered to a role session, shown as one batch of cards at
+* the start of the turn that carries them (§8.2: notices stay structured data up to the UI).
+*/
+var NoticeCards = class {
+	store;
+	pending = /* @__PURE__ */ new Map();
+	constructor(store) {
+		this.store = store;
+	}
+	/** Notices delivered with the next turn of `sessionId`. */
+	add(sessionId, notices) {
+		this.pending.set(sessionId, [...this.pending.get(sessionId) ?? [], ...notices]);
+	}
+	/** Forget notices a turn was going to carry: its send failed, they wait for the next one. */
+	remove(sessionId, ids) {
+		const left = (this.pending.get(sessionId) ?? []).filter((n) => !ids.includes(n.id));
+		if (left.length > 0) this.pending.set(sessionId, left);
+		else this.pending.delete(sessionId);
+	}
+	/** Append the waiting cards to each role session whose turn just started. */
+	attach(events) {
+		for (const e of events) {
+			if (e.type !== "agent.turn.started" || !e.sessionId) continue;
+			const cards = this.pending.get(e.sessionId);
+			if (!cards) continue;
+			this.pending.delete(e.sessionId);
+			const event = e.payload;
+			this.store.append([agentEventToNewEvent(e.sessionId, {
+				type: "item.completed",
+				threadId: event.threadId,
+				turnId: event.turnId,
+				item: {
+					id: `notices-${event.turnId}`,
+					kind: "notice",
+					status: "completed",
+					level: "info",
+					code: NOTICE_BATCH_CODE,
+					message: `${cards.length} update${cards.length === 1 ? "" : "s"} since the last turn`,
+					data: JSON.parse(JSON.stringify({ notices: cards }))
+				}
+			})]);
+		}
+	}
+};
 // ../server/src/services/orchestration/conflicts.ts
 /**
 * Persisted conflicts (§8.4): a start request that matched running work becomes an inbox
@@ -54115,184 +55157,116 @@ var ConflictService = class {
 		});
 	}
 };
-// ../server/src/services/orchestration/notices.ts
-const clip$2 = (text, max = 300) => text.length > max ? `${text.slice(0, max - 3)}...` : text;
-/**
-* Work started by the PM, the orchestrator or an automation wakes the PM; sessions the user
-* started (and is watching) only produce notices that show up in the PM's next digest.
-*/
-function wakesPm(session) {
-	return session.startedBy.kind !== "user" || session.parentSessionId !== null;
-}
-/** The id of an opened PR's notice: the same whether it came from the session or GitHub sync. */
-function prOpenedNoticeId(projectId, number) {
-	return `pr.opened:${projectId}:${number}`;
-}
-function workRef(s) {
-	return {
-		sessionId: s.id,
-		workKey: s.workKey,
-		purpose: s.purpose,
-		startedBy: s.startedBy
-	};
+// ../server/src/services/orchestration/delivery.ts
+/** Whether a stored notice should wake its target (older notices didn't record it). */
+function wakesTarget(n) {
+	if (n.wake !== void 0) return n.wake;
+	return !(n.type === "pm.message" && n.data.informational);
 }
+const keyOf$2 = (session) => session.role === "pm" ? `pm:${session.projectId}` : "orchestrator";
 /**
-* Typed notices for a batch of committed events (§8.2 step 4). Pure apart from the lookups.
-* Only agent sessions inside a project produce notices; ids are derived from the source so
-* replays and repeats never create duplicates.
-*/
-function deriveNotices(events, lookup) {
-	const out = [];
-	const agentSession = (id) => {
-		const s = id ? lookup.session(id) : void 0;
-		return s && s.role === "agent" && s.projectId ? s : void 0;
-	};
-	for (const e of events) if (e.type === "agent.turn.completed") {
-		const event = e.payload;
-		const s = agentSession(e.sessionId);
-		if (!s || s.rootThreadId !== event.threadId) continue;
-		const final = lookup.finalMessage(s.id, event.turnId);
-		out.push({
-			wake: wakesPm(s),
-			notice: {
-				id: `session.finished:${s.id}:${event.turnId}`,
-				type: "session.finished",
-				projectId: s.projectId,
-				target: "pm",
-				sessionId: s.id,
-				title: `Finished: ${s.title ?? s.purpose}`,
-				data: {
-					...workRef(s),
-					summary: s.result?.summary ?? (final ? clip$2(final) : null),
-					outcome: s.result?.outcome ?? null
-				}
-			}
-		});
-	} else if (e.type === "inbox.created") {
-		const { item } = e.payload;
-		const s = agentSession(item.sessionId);
-		if (!s) continue;
-		if (item.kind === "question" || item.kind === "approval") out.push({
-			wake: wakesPm(s),
-			notice: {
-				id: `session.needs_input:${item.id}`,
-				type: "session.needs_input",
-				projectId: s.projectId,
-				target: "pm",
-				sessionId: s.id,
-				title: `Needs input: ${s.title ?? s.purpose}`,
-				data: {
-					...workRef(s),
-					inboxItemId: item.id,
-					kind: item.kind,
-					question: item.title
-				}
-			}
-		});
-		else if (item.kind === "run_failed") out.push({
-			wake: wakesPm(s),
-			notice: {
-				id: `session.failed:${item.id}`,
-				type: "session.failed",
-				projectId: s.projectId,
-				target: "pm",
-				sessionId: s.id,
-				title: `Failed: ${s.title ?? s.purpose}`,
-				data: {
-					...workRef(s),
-					error: clip$2(item.body ?? item.title)
-				}
-			}
-		});
-	} else if (e.type === "session.updated") {
-		const { session } = e.payload;
-		if (session.role !== "agent" || !session.projectId || !session.pr) continue;
-		out.push({
-			wake: wakesPm(session),
-			notice: {
-				id: prOpenedNoticeId(session.projectId, session.pr.number),
-				type: "pr.opened",
-				projectId: session.projectId,
-				target: "pm",
-				sessionId: session.id,
-				title: `PR #${session.pr.number} opened: ${session.pr.title ?? session.purpose}`,
-				data: {
-					sessionId: session.id,
-					pr: session.pr
-				}
-			}
-		});
-	} else if (e.type === "automation_run.updated") {
-		const { run } = e.payload;
-		if (run.status !== "skipped" || !run.projectId) continue;
-		out.push({
-			wake: true,
-			notice: {
-				id: `automation.skipped:${run.id}`,
-				type: "automation.skipped",
-				projectId: run.projectId,
-				target: "pm",
-				sessionId: run.sessionId,
-				title: `Automation skipped: ${run.purpose}`,
-				data: {
-					automationRunId: run.id,
-					automationId: run.automationId,
-					workKey: run.workKey,
-					purpose: run.purpose,
-					reason: run.skipReason ?? "skipped"
-				}
-			}
-		});
+* Getting notices to the orchestrator and the PMs (§8.2) reliably:
+*
+* - a turn's notices count as delivered only once the runner took the turn; until then they
+*   are claimed, so a message sent meanwhile doesn't carry them twice;
+* - on start, targets with wake-worthy notices still undelivered (a restart cut the wake off)
+*   are woken again;
+* - when a role session's turn that carried notices fails (an overloaded model, say), the
+*   notices go back to undelivered and the session is woken again a few times, backing off.
+*/
+var NoticeDelivery = class {
+	deps;
+	claimed = /* @__PURE__ */ new Set();
+	failures = /* @__PURE__ */ new Map();
+	timers = /* @__PURE__ */ new Set();
+	constructor(deps) {
+		this.deps = deps;
 	}
-	return out;
-}
-/** Stored notices (§8.2): created through `notice.created`, delivered through `notice.delivered`. */
-var NoticeStore = class {
-	db;
-	store;
-	constructor(db, store) {
-		this.db = db;
-		this.store = store;
+	/** Prepend the status digest and the undelivered notices to a role session's input (§8.4). */
+	decorate(session, input) {
+		if (session.role === "agent") return { input };
+		try {
+			const parts = [this.deps.digestFor(session)];
+			const pending = this.deps.notices.undelivered(session.role === "pm" ? "pm" : "orchestrator", session.role === "pm" ? session.projectId : null).filter((n) => !this.claimed.has(n.id));
+			parts.push(...pending.length > 0 ? [renderNotices(pending, this.deps.projectName)] : []);
+			parts.push(input.text);
+			const ids = pending.map((n) => n.id);
+			for (const id of ids) this.claimed.add(id);
+			if (pending.length > 0) this.deps.cards.add(session.id, pending);
+			const release = () => {
+				for (const id of ids) this.claimed.delete(id);
+			};
+			return {
+				input: {
+					...input,
+					text: parts.join("\n\n")
+				},
+				delivered: () => {
+					release();
+					this.deps.notices.markDelivered(ids);
+				},
+				failed: () => {
+					release();
+					this.deps.cards.remove(session.id, ids);
+				}
+			};
+		} catch (error) {
+			this.deps.log?.(`orchestration digest: ${errorMessage$1(error)}`);
+			return { input };
+		}
 	}
-	/** Store a notice unless one with the same id exists. Returns the stored notice, if new. */
-	create(draft) {
-		if (this.db.select({ id: notices.id }).from(notices).where(eq(notices.id, draft.id)).get()) return;
-		const notice = {
-			...draft,
-			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-			deliveredAt: null
-		};
-		this.store.append([{
-			type: "notice.created",
-			sessionId: null,
-			payload: { notice }
-		}]);
-		return notice;
+	/** Wake every target whose wake-worthy notices are still undelivered (server start). */
+	rearm() {
+		if (this.deps.notices.undelivered("orchestrator", null).some(wakesTarget)) this.deps.wakes.request("orchestrator");
+		for (const id of this.deps.projectIds()) if (this.deps.notices.undelivered("pm", id).some(wakesTarget)) this.deps.wakes.request(`pm:${id}`);
 	}
-	list(query = {}) {
-		const conditions = [];
-		if (query.projectId) conditions.push(eq(notices.projectId, query.projectId));
-		if (query.target) conditions.push(eq(notices.target, query.target));
-		return this.db.select().from(notices).where(and(...conditions)).orderBy(desc(notices.createdAt)).limit(query.limit ?? 100).all().map((r) => r.notice);
+	/** Follow role sessions' root turns: a failed one returns its notices and retries. */
+	onEvents(events) {
+		for (const e of events) {
+			if (e.type !== "agent.turn.completed" && e.type !== "agent.turn.failed") continue;
+			const session = e.sessionId ? this.deps.session(e.sessionId) : void 0;
+			if (!session || session.role === "agent") continue;
+			const event = e.payload;
+			if (session.rootThreadId && session.rootThreadId !== event.threadId) continue;
+			if (e.type === "agent.turn.completed") {
+				this.failures.delete(session.id);
+				continue;
+			}
+			this.turnFailed(session, event.turnId);
+		}
 	}
-	/** Undelivered notices for a target, oldest first. `projectId` null = the orchestrator. */
-	undelivered(target, projectId) {
-		return this.db.select().from(notices).where(and(eq(notices.target, target), isNull(notices.deliveredAt), projectId === null ? void 0 : eq(notices.projectId, projectId))).orderBy(notices.createdAt).limit(50).all().map((r) => r.notice);
+	dispose() {
+		for (const timer of this.timers) clearTimeout(timer);
+		this.timers.clear();
 	}
-	/** Notices of the given types for a project since `since`, newest first. */
-	recent(projectId, types, since, limit = 5) {
-		return this.db.select().from(notices).where(and(eq(notices.projectId, projectId), inArray(notices.type, types), gte(notices.createdAt, since))).orderBy(desc(notices.createdAt)).limit(limit).all().map((r) => r.notice);
+	turnFailed(session, turnId) {
+		const carried = this.carried(session.id, turnId);
+		if (carried.length === 0) return;
+		this.deps.notices.markReturned(carried);
+		const attempt = (this.failures.get(session.id) ?? 0) + 1;
+		this.failures.set(session.id, attempt);
+		const delay = (this.deps.retryDelaysMs ?? [
+			3e4,
+			12e4,
+			6e5
+		])[attempt - 1];
+		if (delay === void 0) {
+			this.deps.log?.(`orchestration: ${keyOf$2(session)} keeps failing; its updates wait for its next message`);
+			return;
+		}
+		const timer = setTimeout(() => {
+			this.timers.delete(timer);
+			this.deps.wakes.request(keyOf$2(session));
+		}, delay);
+		timer.unref?.();
+		this.timers.add(timer);
 	}
-	markDelivered(ids) {
-		if (ids.length === 0) return;
-		this.store.append([{
-			type: "notice.delivered",
-			sessionId: null,
-			payload: {
-				noticeIds: ids,
-				at: (/* @__PURE__ */ new Date()).toISOString()
-			}
-		}]);
+	/** Ids of the notices a turn carried (its batch of cards). */
+	carried(sessionId, turnId) {
+		const row = this.deps.db.select().from(items).where(and(eq(items.sessionId, sessionId), eq(items.turnId, turnId), eq(items.id, `notices-${turnId}`))).get();
+		if (row?.data.kind !== "notice") return [];
+		const batch = NoticeBatchData.safeParse(row.data.data);
+		return batch.success ? batch.data.notices.map((n) => n.id) : [];
 	}
 };
 // ../server/src/services/orchestration/github-notices.ts
@@ -54305,7 +55279,7 @@ const GITHUB_NOTICE_EVENTS = /* @__PURE__ */ new Set([
 	"issue.opened",
 	"review.submitted"
 ]);
-const clip$1 = (text, max = 300) => text.length > max ? `${text.slice(0, max - 3)}...` : text;
+const clip$3 = (text, max = 300) => text.length > max ? `${text.slice(0, max - 3)}...` : text;
 function prRef(pr) {
 	return {
 		number: pr.number,
@@ -54441,7 +55415,7 @@ function deriveGithubNotices(events, session) {
 							pr: prRef(pr),
 							reviewer: review.author,
 							state: review.state,
-							body: clip$1(review.body)
+							body: clip$3(review.body)
 						}
 					}
 				});
@@ -54449,6 +55423,243 @@ function deriveGithubNotices(events, session) {
 	}
 	return out;
 }
+// ../server/src/services/orchestration/wake-scheduler.ts
+/**
+* Batches notices into debounced wakes per target (`pm:<projectId>`, `orchestrator`) with a
+* loop guard (§8.2): notices arriving close together become one "updates since your last
+* turn" wake, and no target is woken more than `maxWakes` times per window. Held-back wakes
+* fire as soon as the window allows, or right after `reset` when a person steps in; nothing
+* is dropped. The orchestration service runs one for notice wakes and one for the
+* orchestrator's messages to PMs (`LoopGuard`), so each conversation is counted on its own.
+*/
+var WakeScheduler = class {
+	fire;
+	pending = /* @__PURE__ */ new Map();
+	history = /* @__PURE__ */ new Map();
+	opts;
+	constructor(fire, opts = {}) {
+		this.fire = fire;
+		this.opts = {
+			debounceMs: opts.debounceMs ?? 5e3,
+			maxWaitMs: opts.maxWaitMs ?? 3e4,
+			maxWakes: opts.maxWakes ?? 6,
+			windowMs: opts.windowMs ?? 6e5,
+			maxRetryMs: opts.maxRetryMs ?? 12e4,
+			maxBusyRetries: opts.maxBusyRetries ?? 20,
+			onGaveUp: opts.onGaveUp,
+			now: opts.now ?? Date.now,
+			setTimer: opts.setTimer ?? ((fn, ms) => setTimeout(fn, ms)),
+			clearTimer: opts.clearTimer ?? ((h) => clearTimeout(h)),
+			onSuppressed: opts.onSuppressed
+		};
+	}
+	/** A wake-worthy notice arrived for `key`: (re)start its debounce. */
+	request(key) {
+		const now = this.opts.now();
+		const entry = this.pending.get(key);
+		if (entry) {
+			if (entry.firing) {
+				entry.again = true;
+				return;
+			}
+			if (entry.suppressed) return;
+			entry.retries = 0;
+			this.opts.clearTimer(entry.timer);
+			const at = Math.min(now + this.opts.debounceMs, entry.firstAt + this.opts.maxWaitMs);
+			entry.timer = this.arm(key, at - now);
+			return;
+		}
+		this.pending.set(key, {
+			firstAt: now,
+			timer: this.arm(key, this.opts.debounceMs),
+			suppressed: false,
+			retries: 0,
+			firing: false,
+			again: false
+		});
+	}
+	/** Whether `key` may be woken now (loop guard). */
+	allowed(key) {
+		return this.recent(key).length < this.opts.maxWakes;
+	}
+	/** When the loop guard lets `key` be woken again (now, while it is under the limit). */
+	freeAt(key) {
+		const recent = this.recent(key);
+		const over = recent.length - this.opts.maxWakes;
+		return over < 0 ? this.opts.now() : (recent[over] ?? this.opts.now()) + this.opts.windowMs;
+	}
+	/** Count a wake that happened outside the scheduler (a direct message). */
+	recordWake(key) {
+		this.history.set(key, [...this.recent(key), this.opts.now()]);
+	}
+	/**
+	* A person stepped in: forget `key`'s counted wakes, so whatever follows is not part of a
+	* loop, and let a wake the guard was holding back go out after the usual quiet period.
+	*/
+	reset(key) {
+		this.history.delete(key);
+		const entry = this.pending.get(key);
+		if (!entry?.suppressed || entry.firing) return;
+		entry.suppressed = false;
+		this.opts.clearTimer(entry.timer);
+		entry.timer = this.arm(key, this.opts.debounceMs);
+	}
+	/** Whether a wake is waiting for `key`. */
+	isPending(key) {
+		return this.pending.has(key);
+	}
+	dispose() {
+		for (const entry of this.pending.values()) this.opts.clearTimer(entry.timer);
+		this.pending.clear();
+	}
+	recent(key) {
+		const since = this.opts.now() - this.opts.windowMs;
+		const kept = (this.history.get(key) ?? []).filter((t) => t > since);
+		this.history.set(key, kept);
+		return kept;
+	}
+	arm(key, ms) {
+		return this.opts.setTimer(() => void this.run(key), Math.max(0, ms));
+	}
+	async run(key) {
+		const entry = this.pending.get(key);
+		if (!entry || entry.firing) return;
+		if (!this.allowed(key)) {
+			const until = this.freeAt(key);
+			if (!entry.suppressed) this.opts.onSuppressed?.(key, until);
+			entry.suppressed = true;
+			entry.timer = this.arm(key, until - this.opts.now() + 1);
+			return;
+		}
+		let result;
+		entry.firing = true;
+		entry.again = false;
+		try {
+			result = await this.fire(key);
+		} catch {
+			result = "busy";
+		} finally {
+			entry.firing = false;
+		}
+		if (this.pending.get(key) !== entry) return;
+		if (entry.again) {
+			entry.again = false;
+			entry.retries = 0;
+			if (result === "sent") this.recordWake(key);
+			if (result !== "busy") {
+				entry.firstAt = this.opts.now();
+				entry.timer = this.arm(key, this.opts.debounceMs);
+				return;
+			}
+		}
+		if (result === "busy") {
+			entry.suppressed = false;
+			entry.retries++;
+			if (entry.retries > this.opts.maxBusyRetries) {
+				this.pending.delete(key);
+				this.opts.onGaveUp?.(key);
+				return;
+			}
+			const backoff = this.opts.debounceMs * 2 ** (entry.retries - 1);
+			entry.timer = this.arm(key, Math.min(backoff, this.opts.maxRetryMs));
+			return;
+		}
+		this.pending.delete(key);
+		if (result === "sent") this.recordWake(key);
+	}
+};
+// ../server/src/services/orchestration/loop-guard.ts
+const pmKey = (projectId) => `pm:${projectId ?? ""}`;
+/**
+* Loop protection between role sessions (§8.2). A loop is agents messaging each other with no
+* person in between: the orchestrator and a PM, or a PM and its sessions. So the guard:
+*
+* - counts each conversation on its own: the orchestrator's messages to a PM here, notice
+*   wakes (a PM's sessions reporting, PM messages to the orchestrator) in the `wakes`
+*   scheduler. A PM busy with its sessions' reports never blocks the orchestrator, or the
+*   other way round;
+* - never holds back what the user asked for: a message sent through the UI, or by the
+*   orchestrator in a turn the user started, always goes straight through, and like any
+*   message the user writes to a role session it clears that session's counts;
+* - holds back, never refuses, the rest: past the limit an orchestrator message is stored as
+*   an `orchestrator.message` notice and reaches the PM with its next wake, at the latest when
+*   the window allows another message. Nobody has to wait and retry.
+*/
+var LoopGuard = class {
+	deps;
+	/** The orchestrator's messages to each PM (`pm:<projectId>`) from turns it started itself. */
+	relays;
+	/** Who sent the input that started each role session's latest turn. */
+	turnFrom = /* @__PURE__ */ new Map();
+	constructor(deps) {
+		this.deps = deps;
+		this.relays = new WakeScheduler((key) => this.deliverHeld(key.slice(3)), {
+			...deps.options,
+			onSuppressed: (key, until) => deps.log?.(`orchestration: loop guard holds the orchestrator's messages to ${key} until ${new Date(until).toISOString()}`),
+			onGaveUp: (key) => deps.log?.(`orchestration: ${key} stayed busy; held messages wait for its next wake`)
+		});
+	}
+	/** A role session's turn starts with input from `from`; the user's input clears its counts. */
+	turnStarted(session, from) {
+		if (session.role === "agent") return;
+		this.turnFrom.set(session.id, from);
+		if (from !== "user") return;
+		this.clear(session.role === "pm" ? pmKey(session.projectId) : "orchestrator");
+	}
+	/** Whether a message carries the user's own request (the UI, or a turn the user started). */
+	humanLed(origin) {
+		if (origin.caller === "ui") return true;
+		return origin.sessionId !== null && this.turnFrom.get(origin.sessionId) === "user";
+	}
+	/**
+	* Whether an orchestrator message may go to the PM of `projectId` now. The user's requests
+	* always may (and clear the PM's counts); others count against the limit, and wait behind
+	* messages already held so none overtakes another. When this is false, `hold` the message.
+	*/
+	mayDeliver(projectId, origin) {
+		const key = pmKey(projectId);
+		if (this.humanLed(origin)) {
+			this.clear(key);
+			return true;
+		}
+		if (!this.relays.allowed(key) || this.relays.isPending(key)) return false;
+		this.relays.recordWake(key);
+		return true;
+	}
+	/**
+	* Keep an orchestrator message for the PM of `projectId` and deliver it with the PM's next
+	* wake. Returns when the guard lets it go (any earlier wake of the PM takes it along, and a
+	* PM in the middle of a turn gets it once the turn ends).
+	*/
+	hold(projectId, fromSessionId, text) {
+		this.deps.notices.create({
+			id: `orchestrator.message:${randomUUID()}`,
+			type: "orchestrator.message",
+			projectId,
+			target: "pm",
+			sessionId: fromSessionId,
+			title: "Message from the orchestrator",
+			data: {
+				fromSessionId,
+				text
+			}
+		});
+		const key = pmKey(projectId);
+		this.relays.request(key);
+		return this.relays.freeAt(key);
+	}
+	dispose() {
+		this.relays.dispose();
+	}
+	/** Wake the PM for its held messages; another wake may have delivered them already. */
+	async deliverHeld(projectId) {
+		return this.deps.notices.undelivered("pm", projectId).some((n) => n.type === "orchestrator.message") ? this.deps.wakePm(projectId) : "empty";
+	}
+	clear(key) {
+		this.deps.wakes.reset(key);
+		this.relays.reset(key);
+	}
+};
 // ../server/src/services/orchestration/ports.ts
 const unavailable = (what, code) => new ServiceError(503, code, `${what} is not available in this CodeDen build yet.`);
 /** GitHub stub: every call fails with `github_unavailable`. */
@@ -54484,6 +55695,94 @@ var UnavailableAutomationPort = class {
 		throw unavailable("Automation scheduling", "automations_unavailable");
 	}
 };
+// ../server/src/services/orchestration/reminders.ts
+const MAX_DELAY_MS = 6048e5;
+/** Longest timer wait, so clock changes and sleep are noticed. */
+const MAX_TIMER_MS$1 = 6e4;
+const keyOf$1 = (n) => n.target === "orchestrator" ? "orchestrator" : `pm:${n.projectId ?? ""}`;
+/**
+* Wake-ups the orchestrator and PMs schedule for themselves (`schedule_wakeup`, §8.2), so they
+* can follow up later (check on a running audit, retry tomorrow) without the user prompting
+* them. Each is a `reminder` notice held back until `notBefore`: stored in the event log, so
+* it survives restarts, and delivered like any other notice, with a wake once it is due.
+*/
+var Reminders = class {
+	deps;
+	timer;
+	requested = /* @__PURE__ */ new Set();
+	stopped = true;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	start() {
+		this.stopped = false;
+		this.tick();
+	}
+	dispose() {
+		this.stopped = true;
+		if (this.timer) clearTimeout(this.timer);
+		this.timer = void 0;
+	}
+	/** Schedule a wake-up for `owner` at `at` with `note`. */
+	schedule(owner, at, note) {
+		const delay = at.getTime() - Date.now();
+		const min = this.deps.minDelayMs ?? 6e4;
+		if (!Number.isFinite(delay) || delay < min) throw badRequest(`A wake-up must be at least ${Math.ceil(min / 6e4)} minute(s) ahead`, "wakeup_too_soon");
+		if (delay > MAX_DELAY_MS) throw badRequest("A wake-up can be at most 7 days ahead", "wakeup_too_late");
+		if (this.pending(owner.target, owner.projectId).length >= 20) throw conflict(`You already have 20 wake-ups scheduled; cancel one first`, "too_many_wakeups");
+		const notice = this.deps.notices.create({
+			id: `reminder:${randomUUID()}`,
+			type: "reminder",
+			projectId: owner.projectId,
+			target: owner.target,
+			sessionId: null,
+			title: "Wake-up you scheduled",
+			wake: true,
+			notBefore: at.toISOString(),
+			data: {
+				note,
+				requestedBy: owner.sessionId
+			}
+		});
+		if (!notice) throw conflict("That wake-up already exists", "wakeup_exists");
+		this.tick();
+		return notice;
+	}
+	/** An owner's wake-ups still to come (or due and not yet delivered), soonest first. */
+	pending(target, projectId) {
+		return this.deps.notices.scheduled(target, projectId);
+	}
+	/** Cancel one of an owner's pending wake-ups; false when it has none with that id. */
+	cancel(target, projectId, id) {
+		if (!this.pending(target, projectId).some((n) => n.id === id)) return false;
+		this.deps.notices.markDelivered([id]);
+		return true;
+	}
+	/** Wake the owners of wake-ups that just came due, then wait for the next one. */
+	tick() {
+		if (this.stopped) return;
+		try {
+			for (const n of this.deps.notices.heldBack(true)) {
+				if (this.requested.has(n.id)) continue;
+				this.requested.add(n.id);
+				this.deps.wakes.request(keyOf$1(n));
+			}
+		} catch (error) {
+			this.deps.log?.(`orchestration wake-ups: ${error instanceof Error ? error.message : error}`);
+		}
+		this.arm();
+	}
+	arm() {
+		if (this.timer) clearTimeout(this.timer);
+		this.timer = void 0;
+		if (this.stopped) return;
+		const next = this.deps.notices.heldBack(false)[0]?.notBefore;
+		if (!next) return;
+		const wait = Math.min(Math.max(Date.parse(next) - Date.now(), 0), MAX_TIMER_MS$1);
+		this.timer = setTimeout(() => this.tick(), wait + 5);
+		this.timer.unref?.();
+	}
+};
 // ../server/src/services/orchestration/role-sessions.ts
 /**
 * The long-lived role sessions (§8.1): one orchestrator (cwd `<home>/orchestrator/`) and one
@@ -54550,132 +55849,6 @@ var RoleSessions = class {
 		return session;
 	}
 };
-// ../server/src/services/orchestration/wake-scheduler.ts
-/**
-* Batches notices into debounced wakes per target (`pm:<projectId>`, `orchestrator`) with a
-* loop guard (§8.2): notices arriving close together become one "updates since your last
-* turn" wake, and no target is woken more than `maxWakes` times per window. Held-back wakes
-* fire as soon as the window allows; nothing is dropped.
-*/
-var WakeScheduler = class {
-	fire;
-	pending = /* @__PURE__ */ new Map();
-	history = /* @__PURE__ */ new Map();
-	opts;
-	constructor(fire, opts = {}) {
-		this.fire = fire;
-		this.opts = {
-			debounceMs: opts.debounceMs ?? 5e3,
-			maxWaitMs: opts.maxWaitMs ?? 3e4,
-			maxWakes: opts.maxWakes ?? 6,
-			windowMs: opts.windowMs ?? 6e5,
-			maxRetryMs: opts.maxRetryMs ?? 12e4,
-			maxBusyRetries: opts.maxBusyRetries ?? 20,
-			onGaveUp: opts.onGaveUp,
-			now: opts.now ?? Date.now,
-			setTimer: opts.setTimer ?? ((fn, ms) => setTimeout(fn, ms)),
-			clearTimer: opts.clearTimer ?? ((h) => clearTimeout(h)),
-			onSuppressed: opts.onSuppressed
-		};
-	}
-	/** A wake-worthy notice arrived for `key`: (re)start its debounce. */
-	request(key) {
-		const now = this.opts.now();
-		const entry = this.pending.get(key);
-		if (entry) {
-			if (entry.firing) {
-				entry.again = true;
-				return;
-			}
-			if (entry.suppressed) return;
-			entry.retries = 0;
-			this.opts.clearTimer(entry.timer);
-			const at = Math.min(now + this.opts.debounceMs, entry.firstAt + this.opts.maxWaitMs);
-			entry.timer = this.arm(key, at - now);
-			return;
-		}
-		this.pending.set(key, {
-			firstAt: now,
-			timer: this.arm(key, this.opts.debounceMs),
-			suppressed: false,
-			retries: 0,
-			firing: false,
-			again: false
-		});
-	}
-	/** Whether `key` may be woken now (loop guard). */
-	allowed(key) {
-		return this.recent(key).length < this.opts.maxWakes;
-	}
-	/** Count a wake that happened outside the scheduler (a direct message). */
-	recordWake(key) {
-		this.history.set(key, [...this.recent(key), this.opts.now()]);
-	}
-	/** Whether a wake is waiting for `key`. */
-	isPending(key) {
-		return this.pending.has(key);
-	}
-	dispose() {
-		for (const entry of this.pending.values()) this.opts.clearTimer(entry.timer);
-		this.pending.clear();
-	}
-	recent(key) {
-		const since = this.opts.now() - this.opts.windowMs;
-		const kept = (this.history.get(key) ?? []).filter((t) => t > since);
-		this.history.set(key, kept);
-		return kept;
-	}
-	arm(key, ms) {
-		return this.opts.setTimer(() => void this.run(key), Math.max(0, ms));
-	}
-	async run(key) {
-		const entry = this.pending.get(key);
-		if (!entry || entry.firing) return;
-		const recent = this.recent(key);
-		if (recent.length >= this.opts.maxWakes) {
-			const until = (recent[0] ?? this.opts.now()) + this.opts.windowMs;
-			if (!entry.suppressed) this.opts.onSuppressed?.(key, until);
-			entry.suppressed = true;
-			entry.timer = this.arm(key, until - this.opts.now() + 1);
-			return;
-		}
-		let result;
-		entry.firing = true;
-		entry.again = false;
-		try {
-			result = await this.fire(key);
-		} catch {
-			result = "busy";
-		} finally {
-			entry.firing = false;
-		}
-		if (this.pending.get(key) !== entry) return;
-		if (entry.again) {
-			entry.again = false;
-			entry.retries = 0;
-			if (result === "sent") this.recordWake(key);
-			if (result !== "busy") {
-				entry.firstAt = this.opts.now();
-				entry.timer = this.arm(key, this.opts.debounceMs);
-				return;
-			}
-		}
-		if (result === "busy") {
-			entry.suppressed = false;
-			entry.retries++;
-			if (entry.retries > this.opts.maxBusyRetries) {
-				this.pending.delete(key);
-				this.opts.onGaveUp?.(key);
-				return;
-			}
-			const backoff = this.opts.debounceMs * 2 ** (entry.retries - 1);
-			entry.timer = this.arm(key, Math.min(backoff, this.opts.maxRetryMs));
-			return;
-		}
-		this.pending.delete(key);
-		if (result === "sent") this.recordWake(key);
-	}
-};
 // ../server/src/services/orchestration/orchestration-service.ts
 const NOT_READY = /* @__PURE__ */ new Set([
 	"created",
@@ -54700,13 +55873,16 @@ var OrchestrationService = class {
 	github;
 	automation;
 	wakes;
-	/** Notices to show as cards in the next turn of a role session. */
-	pendingCards = /* @__PURE__ */ new Map();
+	loops;
+	reminders;
+	cards;
+	delivery;
 	unsubscribe;
 	constructor(deps) {
 		this.deps = deps;
 		this.roles = new RoleSessions(deps);
 		this.notices = new NoticeStore(deps.db, deps.store);
+		this.cards = new NoticeCards(deps.store);
 		this.notes = new ProjectNotes(deps.projects);
 		this.github = deps.github ?? new UnavailableGithubPort();
 		this.automation = deps.automation ?? new UnavailableAutomationPort();
@@ -54716,21 +55892,55 @@ var OrchestrationService = class {
 		});
 		this.asks = new PmAsks({
 			db: deps.db,
-			onLateReply: (reply) => this.postToOrchestrator(reply.projectId, reply.pmSessionId, `Answer to your earlier ask_pm question:\n${reply.text}`, false)
+			session: (id) => deps.repo.find(id)?.session,
+			onLateReply: (reply) => this.postToOrchestrator(reply.projectId, reply.pmSessionId, `Answer to your earlier ask_pm question:\n${reply.text}`, false, `pm.message:ask:${reply.askId}`)
 		});
 		this.wakes = new WakeScheduler((key) => this.fire(key), {
 			...deps.options?.wake,
 			onSuppressed: (key, until) => deps.log?.(`orchestration: loop guard holds wakes for ${key} until ${new Date(until).toISOString()}`),
 			onGaveUp: (key) => deps.log?.(`orchestration: ${key} stayed busy; its notices wait for its next message or notice`)
 		});
+		this.loops = new LoopGuard({
+			wakes: this.wakes,
+			notices: this.notices,
+			wakePm: (projectId) => this.fire(wakeKey("pm", projectId)),
+			options: deps.options?.wake,
+			log: deps.log
+		});
+		this.delivery = new NoticeDelivery({
+			db: deps.db,
+			notices: this.notices,
+			cards: this.cards,
+			wakes: this.wakes,
+			digestFor: (session) => this.digestFor(session),
+			projectName: (id) => this.projectName(id),
+			session: (id) => deps.repo.find(id)?.session,
+			projectIds: () => deps.projects.list().flatMap((p) => p.archivedAt ? [] : [p.id]),
+			retryDelaysMs: deps.options?.failedTurnRetryMs,
+			log: deps.log
+		});
+		const minDelayMs = deps.options?.wakeupMinDelayMs;
+		this.reminders = new Reminders({
+			notices: this.notices,
+			wakes: this.wakes,
+			minDelayMs
+		});
 	}
 	start() {
 		this.unsubscribe = this.deps.store.subscribe((events) => this.onEvents(events));
-		this.deps.sessions.setInputDecorator((session, input) => this.decorate(session, input));
+		this.deps.sessions.setInputDecorator((session, input, from) => {
+			this.loops.turnStarted(session, from);
+			return this.delivery.decorate(session, input);
+		});
+		this.delivery.rearm();
+		this.reminders.start();
 	}
 	stop() {
 		this.unsubscribe?.();
 		this.wakes.dispose();
+		this.loops.dispose();
+		this.delivery.dispose();
+		this.reminders.dispose();
 	}
 	projectStatus(projectId) {
 		const project = this.deps.projects.get(projectId);
@@ -54766,31 +55976,6 @@ var OrchestrationService = class {
 		});
 	}
 	/**
-	* Prepend the status digest and any undelivered notices to a role session's input (§8.4).
-	* Runs at send time, so queued messages get a fresh digest too.
-	*/
-	decorate(session, input) {
-		if (session.role === "agent") return input;
-		try {
-			const parts = [this.digestFor(session)];
-			const target = session.role === "pm" ? "pm" : "orchestrator";
-			const pending = this.notices.undelivered(target, session.role === "pm" ? session.projectId : null);
-			if (pending.length > 0) {
-				parts.push(renderNotices(pending, (id) => this.projectName(id)));
-				this.notices.markDelivered(pending.map((n) => n.id));
-				this.pendingCards.set(session.id, [...this.pendingCards.get(session.id) ?? [], ...pending]);
-			}
-			parts.push(input.text);
-			return {
-				...input,
-				text: parts.join("\n\n")
-			};
-		} catch (error) {
-			this.deps.log?.(`orchestration digest: ${errorMessage$1(error)}`);
-			return input;
-		}
-	}
-	/**
 	* Send a message to the orchestrator or a project's PM, creating the session if needed.
 	* `from` labels the message in the queue tray when it has to wait for a running turn.
 	*/
@@ -54805,28 +55990,45 @@ var OrchestrationService = class {
 			status: res.status
 		};
 	}
-	/** `message_pm`: hand a PM a task without waiting. */
-	async messagePm(projectId, text) {
-		this.guard(`pm:${projectId}`);
+	/**
+	* `message_pm`: hand a PM a task without waiting. Past the loop guard's limit (§8.2) the
+	* message is held and delivered automatically; the user's own requests are never held.
+	*/
+	async messagePm(projectId, text, origin) {
+		await this.roles.ensure("pm", projectId);
+		if (!this.loops.mayDeliver(projectId, origin)) return {
+			status: "held",
+			until: this.loops.hold(projectId, origin.sessionId, text)
+		};
 		return this.sendToRole("pm", projectId, messageFrom("orchestrator", text), "queue", "orchestrator");
 	}
-	/** `ask_pm`: ask a PM and wait (up to `timeoutMs`) for the answer. */
+	/**
+	* `ask_pm`: ask a PM and wait (up to `timeoutMs`) for the answer. A question the loop guard
+	* holds back (§8.2) is answered later, as a message to the orchestrator.
+	*/
 	async askPm(projectId, question, opts) {
-		this.guard(`pm:${projectId}`);
 		const pm = await this.roles.ensure("pm", projectId);
 		const askId = randomUUID().slice(0, 8);
-		this.asks.register(askId, {
+		const target = {
 			pmSessionId: pm.id,
 			projectId,
-			fromSessionId: opts.fromSessionId
-		});
-		const answer = this.asks.wait(askId, opts.timeoutMs ?? this.deps.options?.askTimeoutMs ?? 18e4, opts.signal);
+			fromSessionId: opts.origin.sessionId
+		};
 		const text = [
 			`Question from the orchestrator ${askMarker(askId)}:`,
 			question,
 			"",
 			"Answer in your final message of this turn: it is returned to the orchestrator directly."
 		].join("\n");
+		if (!this.loops.mayDeliver(projectId, opts.origin)) {
+			this.asks.register(askId, target, { detached: true });
+			return {
+				status: "held",
+				until: this.loops.hold(projectId, opts.origin.sessionId, text)
+			};
+		}
+		this.asks.register(askId, target);
+		const answer = this.asks.wait(askId, opts.timeoutMs ?? this.deps.options?.askTimeoutMs ?? 18e4, opts.signal);
 		await this.deps.sessions.send(pm.id, {
 			input: {
 				text,
@@ -54847,14 +56049,17 @@ var OrchestrationService = class {
 	}
 	/** Record a notice (other services: GitHub checks, automations); wakes its target when asked. */
 	notify(draft, wake = true) {
-		const created = this.notices.create(draft);
+		const created = this.notices.create({
+			...draft,
+			wake
+		});
 		if (created && wake) this.wakes.request(wakeKey(created.target, created.projectId));
 		return created;
 	}
-	postToOrchestrator(projectId, fromSessionId, text, informational) {
+	postToOrchestrator(projectId, fromSessionId, text, informational, id = `pm.message:${randomUUID()}`) {
 		const name = projectId ? this.projectName(projectId) : "a project";
 		this.notify({
-			id: `pm.message:${randomUUID()}`,
+			id,
 			type: "pm.message",
 			projectId,
 			target: "orchestrator",
@@ -54885,16 +56090,13 @@ var OrchestrationService = class {
 			}
 		});
 	}
-	guard(key) {
-		if (!this.wakes.allowed(key)) throw new ServiceError(409, "loop_guard", "Too many messages to this session recently (loop guard). Wait a few minutes or ask the user.");
-		this.wakes.recordWake(key);
-	}
 	onEvents(events) {
 		this.asks.onEvents(events);
-		if (!events.some((e) => e.type === "agent.turn.completed" || e.type === "agent.turn.started" || e.type === "inbox.created" || e.type === "session.updated" || e.type === "automation_run.updated" || GITHUB_NOTICE_EVENTS.has(e.type))) return;
+		if (!events.some((e) => e.type === "agent.turn.completed" || e.type === "agent.turn.failed" || e.type === "agent.turn.started" || e.type === "inbox.created" || e.type === "session.updated" || e.type === "automation_run.updated" || GITHUB_NOTICE_EVENTS.has(e.type))) return;
 		setImmediate(() => {
 			try {
-				this.attachCards(events);
+				this.cards.attach(events);
+				this.delivery.onEvents(events);
 				const session = (id) => this.deps.repo.find(id)?.session;
 				const derived = [...deriveNotices(events, {
 					session,
@@ -54906,30 +56108,6 @@ var OrchestrationService = class {
 			}
 		});
 	}
-	/** Show the notices a wake delivered as cards at the start of the role session's turn. */
-	attachCards(events) {
-		for (const e of events) {
-			if (e.type !== "agent.turn.started" || !e.sessionId) continue;
-			const cards = this.pendingCards.get(e.sessionId);
-			if (!cards) continue;
-			this.pendingCards.delete(e.sessionId);
-			const event = e.payload;
-			this.deps.store.append([agentEventToNewEvent(e.sessionId, {
-				type: "item.completed",
-				threadId: event.threadId,
-				turnId: event.turnId,
-				item: {
-					id: `notices-${event.turnId}`,
-					kind: "notice",
-					status: "completed",
-					level: "info",
-					code: NOTICE_BATCH_CODE,
-					message: `${cards.length} update${cards.length === 1 ? "" : "s"} since the last turn`,
-					data: JSON.parse(JSON.stringify({ notices: cards }))
-				}
-			})]);
-		}
-	}
 	/** Deliver pending notices to their target with one wake (called by the scheduler). */
 	async fire(key) {
 		const role = key === "orchestrator" ? "orchestrator" : "pm";
@@ -55454,19 +56632,260 @@ var ProjectRedetector = class {
 		this.refresh(projectId).catch((error) => this.deps.log?.(`projects: checking ${projectId}: ${errorMessage$1(error)}`));
 	}
 };
+// ../server/src/services/sessions/auto-retry.ts
+/** Waits before the 1st, 2nd and 3rd automatic retry after a transient failure. */
+const RETRY_DELAYS_MS = [
+	2e4,
+	9e4,
+	3e5
+];
+/** Longest single timer (setTimeout's limit); longer waits re-arm. */
+const MAX_TIMER_MS = 2 ** 31 - 1;
+/**
+* Decide, from a session and its root turns (newest first), whether its last turn is retried
+* and when. Only an idle agent session whose last root turn failed for a passing reason
+* qualifies (`awaitsRetryDecision`); `attempt` counts the consecutive such failures. A transient
+* failure waits `delaysMs[attempt - 1]` after the turn ended, a usage limit until `retryAt`
+* plus the margin. Past the last delay, without a reset time, or switched off: give up. Pure.
+*/
+function planRetry(session, rootTurns, opts) {
+	const turn = rootTurns[0];
+	if (!turn?.error || turn.status !== "failed" || session.status !== "idle") return { action: "none" };
+	const error = turn.error;
+	if (!awaitsRetryDecision(session, error)) return { action: "none" };
+	let attempt = 0;
+	for (const t of rootTurns) {
+		if (t.status !== "failed" || !t.error || !awaitsRetryDecision(session, t.error)) break;
+		attempt += 1;
+	}
+	const giveUp = (exhausted) => ({
+		action: "give_up",
+		turn,
+		error,
+		attempt,
+		exhausted
+	});
+	if (!opts.enabled) return giveUp(false);
+	if (attempt > opts.delaysMs.length) return giveUp(true);
+	const endedAt = Date.parse(turn.completedAt ?? turn.startedAt);
+	if (error.kind === "usage_limit") {
+		const resetsAt = error.retryAt ? Date.parse(error.retryAt) : NaN;
+		if (!Number.isFinite(resetsAt)) return giveUp(false);
+		return {
+			action: "retry",
+			turn,
+			error,
+			attempt,
+			at: resetsAt + opts.usageMarginMs
+		};
+	}
+	const delay = opts.delaysMs[attempt - 1] ?? 0;
+	return {
+		action: "retry",
+		turn,
+		error,
+		attempt,
+		at: endedAt + delay
+	};
+}
+/** "in 20s", "in 3 min", "in about 2 h 15 min". */
+function inAbout(ms) {
+	const s = Math.max(1, Math.round(ms / 1e3));
+	if (s < 60) return `in ${s}s`;
+	const m = Math.round(s / 60);
+	if (m < 60) return `in ${m} min`;
+	return `in about ${Math.floor(m / 60)} h${m % 60 ? ` ${m % 60} min` : ""}`;
+}
+/** The `codeden` message that continues the session. */
+function continueMessage(error) {
+	return `Previous turn stopped (${error.kind === "usage_limit" ? "usage limit reached" : error.message.length > 160 ? `${error.message.slice(0, 157)}...` : error.message}); continue where you left off.`;
+}
+/**
+* Automatic retries for agent sessions (§7.3 `ErrorInfo.kind`). A root turn that failed for a
+* passing reason leaves the session idle with no inbox item (the reducer, `awaitsRetryDecision`);
+* this service then continues it with a `codeden` message after a backoff (transient: 20 s,
+* 90 s, 5 min, at most three in a row) or a minute after a usage limit resets, and says so in
+* the transcript. A user message or Stop cancels a pending retry. When the retries run out, or
+* `sessions.autoRetry` is off, the session fails as it always did: `failed` with a `run_failed`
+* inbox item (and the PM notices that come from it). Pending retries are derived from the turns
+* and sessions tables, so a server restart picks them up again. Orchestrator and PM sessions
+* are never retried here.
+*/
+var AutoRetry = class {
+	deps;
+	timers = /* @__PURE__ */ new Map();
+	unsubscribe;
+	stopped = false;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	start() {
+		this.stopped = false;
+		this.unsubscribe = this.deps.store.subscribe((events) => this.onEvents(events));
+		setImmediate(() => {
+			if (this.stopped) return;
+			for (const session of this.deps.repo.list({
+				role: "agent",
+				status: ["idle"]
+			})) this.evaluate(session.id);
+		});
+	}
+	stop() {
+		this.stopped = true;
+		this.unsubscribe?.();
+		for (const { timer } of this.timers.values()) clearTimeout(timer);
+		this.timers.clear();
+	}
+	/** Sessions with a retry waiting (tests). */
+	pending() {
+		return [...this.timers.keys()];
+	}
+	onEvents(events) {
+		for (const e of events) {
+			if (!e.sessionId) continue;
+			const sessionId = e.sessionId;
+			if (e.type === "agent.turn.failed") queueMicrotask(() => this.evaluate(sessionId));
+			else if (e.type === "agent.turn.started" && this.timers.has(sessionId)) this.cancel(sessionId, "A new message was sent, so the automatic retry was cancelled.");
+			else if (e.type === "session.updated" && this.timers.has(sessionId)) {
+				const { session } = e.payload;
+				if (session.status !== "idle" || session.archivedAt) this.cancel(sessionId, "The automatic retry was cancelled.");
+			}
+		}
+	}
+	/** Decide about a session's last root turn now: schedule, give up, or nothing. */
+	evaluate(sessionId) {
+		try {
+			const decision = this.decide(sessionId);
+			if (decision.action === "retry") this.schedule(sessionId, decision);
+			else if (decision.action === "give_up") this.giveUp(sessionId, decision);
+		} catch (error) {
+			this.deps.log?.(`auto-retry for ${sessionId}: ${errorMessage$1(error)}`);
+		}
+	}
+	decide(sessionId) {
+		const session = this.deps.repo.find(sessionId)?.session;
+		if (!session?.rootThreadId) return { action: "none" };
+		return planRetry(session, this.deps.db.select().from(turns).where(and(eq(turns.sessionId, sessionId), eq(turns.threadId, session.rootThreadId))).orderBy(desc(turns.startedAt)).limit(10).all().map(rowToTurnRecord), {
+			enabled: this.deps.settings().sessions.autoRetry,
+			delaysMs: this.deps.delaysMs ?? RETRY_DELAYS_MS,
+			usageMarginMs: this.deps.usageMarginMs ?? 6e4
+		});
+	}
+	schedule(sessionId, plan) {
+		const existing = this.timers.get(sessionId);
+		if (existing) clearTimeout(existing.timer);
+		const wait = Math.max(0, plan.at - this.now());
+		const max = (this.deps.delaysMs ?? RETRY_DELAYS_MS).length;
+		this.notice(sessionId, plan.turn, {
+			message: plan.error.kind === "usage_limit" ? `Usage limit reached. CodeDen continues the session ${inAbout(wait)}, a minute after it resets.` : `Retrying automatically ${inAbout(wait)} (attempt ${plan.attempt} of ${max}).`,
+			data: {
+				attempt: plan.attempt,
+				maxAttempts: max,
+				retryAt: new Date(plan.at).toISOString()
+			}
+		});
+		const timer = setTimeout(() => void this.fire(sessionId, plan.turn.id), Math.min(wait, MAX_TIMER_MS));
+		timer.unref?.();
+		this.timers.set(sessionId, {
+			turnId: plan.turn.id,
+			timer
+		});
+	}
+	async fire(sessionId, turnId) {
+		this.timers.delete(sessionId);
+		if (this.stopped) return;
+		let decision;
+		try {
+			decision = this.decide(sessionId);
+		} catch (error) {
+			this.deps.log?.(`auto-retry for ${sessionId}: ${errorMessage$1(error)}`);
+			return;
+		}
+		if (decision.action === "give_up") return this.giveUp(sessionId, decision);
+		if (decision.action !== "retry" || decision.turn.id !== turnId) return;
+		if (decision.at > this.now()) return this.schedule(sessionId, decision);
+		this.deps.log?.(`auto-retry: continuing session ${sessionId} (attempt ${decision.attempt})`);
+		try {
+			const text = continueMessage(decision.error);
+			await this.deps.send(sessionId, {
+				text,
+				attachments: [],
+				from: "codeden"
+			});
+		} catch (error) {
+			this.deps.log?.(`auto-retry for ${sessionId}: ${errorMessage$1(error)}`);
+			this.giveUp(sessionId, {
+				...decision,
+				action: "give_up",
+				exhausted: false
+			});
+		}
+	}
+	/** Fail the session the usual way, with the `run_failed` item the reducer would have raised. */
+	giveUp(sessionId, decision) {
+		const pending = this.timers.get(sessionId);
+		if (pending) clearTimeout(pending.timer);
+		this.timers.delete(sessionId);
+		if (decision.exhausted) this.notice(sessionId, decision.turn, {
+			message: `Stopped retrying after ${decision.attempt - 1} automatic ${decision.attempt === 2 ? "retry" : "retries"}.`,
+			data: { attempt: decision.attempt }
+		});
+		const session = this.deps.repo.update(sessionId, (s) => s.status === "idle" ? {
+			...s,
+			status: "failed"
+		} : s);
+		if (session.status !== "failed") return;
+		this.deps.inbox.raiseRunFailed(session, `${decision.turn.id}:failed`, decision.error.message);
+	}
+	cancel(sessionId, message) {
+		const pending = this.timers.get(sessionId);
+		if (!pending) return;
+		clearTimeout(pending.timer);
+		this.timers.delete(sessionId);
+		const turn = this.deps.db.select().from(turns).where(and(eq(turns.sessionId, sessionId), eq(turns.id, pending.turnId))).get();
+		if (turn) this.notice(sessionId, rowToTurnRecord(turn), {
+			message,
+			data: { cancelled: true }
+		});
+	}
+	/** The retry's notice in the failed turn, replaced as the retry's state changes. */
+	notice(sessionId, turn, body) {
+		this.deps.store.append([agentEventToNewEvent(sessionId, {
+			type: "item.completed",
+			threadId: turn.threadId,
+			turnId: turn.id,
+			item: {
+				id: `auto-retry-${turn.id}`,
+				kind: "notice",
+				status: "completed",
+				level: "info",
+				code: "auto_retry",
+				message: body.message,
+				data: body.data
+			}
+		})]);
+	}
+	now() {
+		return this.deps.now?.() ?? Date.now();
+	}
+};
 // ../server/src/services/orchestration/prompts.ts
 /**
 * System prompt sections for the orchestrator and the project managers (§8.1). Kept short:
 * the live state arrives with every wake in the status digest, so the prompts only describe
-* responsibilities, tools, escalation and conflict behaviour.
+* responsibilities, tools, when to involve the user, and conflict behaviour. Both roles decide
+* routine questions with sensible defaults and keep the user for the decisions that are theirs.
 */
+/** The decisions that go to the user; everything else the PM or the orchestrator decides. */
+const USER_DECISIONS$1 = "destructive or irreversible actions; spending money or new accounts or credentials; outward-facing actions (releases, publishing, deploys, messages to people outside the project); protected areas; conflicting priorities";
 const SHARED = `## How CodeDen keeps you informed
 
 - Every message you receive starts with a \`<codeden_status>\` block: a fresh digest of running and queued work (work key, purpose, status, progress, age), the next scheduled automation runs, open inbox items and recent finishes and failures. Trust it; you do not need a tool call to learn the current state.
 - After it may come a \`<codeden_updates>\` block, "Updates since your last turn": typed notices (session finished, needs input, failed, PR opened, checks failed, automation skipped, conflict, PM messages). React to the ones that need action and ignore routine ones.
 - Everything after the last of these blocks is what the sender actually wrote.
 - You have no write access to project code. You act only through CodeDen tools on the \`codeden\` MCP server; reading files and read-only git commands are fine.
-- Never start work that duplicates running or queued work. Check the digest first; starting tools return \`conflict\` with the existing work instead of starting. Then choose one resolution and say why: \`wait\` (queue behind it), \`skip\`, \`join\` (send your request to the existing session as a follow-up) or \`force\` (only with a concrete reason, which is recorded).`;
+- Never start work that duplicates running or queued work. Check the digest first; starting tools return \`conflict\` with the existing work instead of starting. Then choose one resolution yourself and say why: \`wait\` (queue behind it), \`skip\`, \`join\` (send your request to the existing session as a follow-up) or \`force\` (only with a concrete reason, which is recorded).
+- To follow up later, schedule it with \`schedule_wakeup\`; never promise a follow-up you haven't scheduled.`;
 const ORCHESTRATOR_PROMPT = `# You are the CodeDen orchestrator
 
 You are the user's front door to every project in CodeDen. You create and configure projects, route requests to each project's project manager (PM), and summarise status across projects. You never do project work yourself and never start agent sessions directly: the PM of the project does that.
@@ -55478,34 +56897,51 @@ You are the user's front door to every project in CodeDen. You create and config
 - \`ask_pm\`: ask a project's PM and wait for its answer. Use it whenever a request concerns a project's work (for example "run a security audit on X"): the PM knows what is already running there and decides how to proceed.
 - \`message_pm\`: hand a PM a task or information without waiting; its reply arrives later as a message.
 - \`list_inbox\`: what is waiting on the user.
+- \`schedule_wakeup\`, \`list_wakeups\`, \`cancel_wakeup\`: follow-ups you want to come back to later.
 
 ## Rules
 
 - Route project work through the PM. For any request to do something in a project (run, start, fix, audit, review, update), call \`ask_pm\` first and pass the request on, even when the digest already shows related work: the PM owns the project's sessions and schedules and decides how to proceed. Never answer a work request from the digest alone.
-- If the PM reports that matching work is already running, tell the user (with its progress and the options) instead of asking for a duplicate.
-- Escalate to the user only for decisions the PMs cannot make: conflicting priorities across projects, protected areas, anything irreversible.
+- If the PM reports that matching work is already running, tell the user in one line what is running and what the PM did about it (joined, queued or skipped).
+- Decide with sensible defaults. Don't pass the PM's open questions on to the user as a menu: when a sensible default exists, tell the PM to go ahead with it (\`message_pm\`) and tell the user the default in one line so they can override it.
+- Involve the user only for decisions the PMs cannot make: ${USER_DECISIONS$1} across projects. Then ask one question with your recommendation; never end a reply with a list of options.
+- When a PM reports on work you passed on, tell the user in one or two lines.
 - PM messages marked informational do not wake you; they appear in your next digest. Do not reply to them unless they need a decision.
 - Be brief with the user: lead with the answer, then the detail that matters.
 
 ${SHARED}`;
 const PM_PROMPT = `# You are a CodeDen project manager (PM)
 
-You manage one project. You triage its GitHub issues, plan work, start and steer agent sessions, follow their progress, review results, and escalate when unsure. Agent sessions do the coding, each in its own worktree; you never edit code yourself.
+You manage one project. You triage its GitHub issues, plan work, start and steer agent sessions, follow their progress and review results. Agent sessions do the coding, each in its own worktree; you never edit code yourself. You make the routine calls yourself and keep work moving; the user only gets the decisions listed under "When to involve the user".
 
 ## Tools
 
 - Awareness: \`get_project_status\`, \`list_sessions\` (filter by status, work key, startedBy), \`list_scheduled_runs\`.
-- Sessions: \`start_session\` (always give a \`workKey\` such as \`issue:142\`, \`automation:security-audit\` or \`request:<slug>\`, a one-line \`purpose\` and a \`scope\` when you know the area), \`message_session\`, \`stop_session\`.
-- Automations: \`skip_next_run\`, \`pause_automation\`, \`resume_automation\`, \`cancel_queued_run\`.
-- GitHub: \`list_issues\`, \`get_issue\`, \`triage_issue\`, \`create_issue\`, \`get_pr_status\`.
+- Sessions: \`start_session\` (always give a \`workKey\` such as \`issue:142\`, \`automation:security-audit\` or \`request:<slug>\`, a one-line \`purpose\`, a \`scope\` when you know the area, and a brief that includes the decisions you already made), \`message_session\`, \`stop_session\`.
+- Automations: \`list_automations\`, \`run_automation\`, \`create_automation\`, \`update_automation\`, \`skip_next_run\`, \`pause_automation\`, \`resume_automation\`, \`cancel_queued_run\`.
+- GitHub: \`list_issues\`, \`get_issue\`, \`triage_issue\`, \`report_triage\`, \`create_issue\`, \`get_pr_status\`.
 - Notes: \`read_project_notes\`, \`update_project_notes\` (your durable memory for this project: decisions, conventions, follow-ups).
-- People: \`ask_user\` for decisions only the user can make; \`message_orchestrator\` to report to the orchestrator.
+- People: \`answer_question\` for your agents' questions, \`ask_user\` for decisions only the user can make, \`message_orchestrator\` to report to the orchestrator.
+- Follow-ups: \`schedule_wakeup\`, \`list_wakeups\`, \`cancel_wakeup\`.
 
-## Rules
+## Decide, don't ask
+
+- When a request leaves details open (provider, model, scope, approach, naming, order of work), choose sensible defaults from the project notes, the vision, the code and its conventions. Write them into the agent's brief and mention them in one line so the user can override them. Never end a turn with a menu of options.
+- Before starting work, check the digest and \`list_sessions\` for the same work key or area. If matching work is already running or queued (including scheduled automation runs), don't start a duplicate: choose the resolution yourself (\`join\` when the request adds detail or scope to the running work, \`wait\` when it has to follow it, \`skip\` when it is the same work, \`force\` only with a concrete reason) and say in one line what you chose.
+- Answer your agents' questions with \`answer_question\` when the brief, the notes or the vision settle them; otherwise leave them for the user.
+- You can't merge pull requests. The \`mode\` in your status digest says who does: in manual and assisted the user reviews and merges them; in autopilot and dark factory the factory loop merges when every check passes. Report a ready pull request once; don't ask whether to merge it.
+
+## When to involve the user
 
-- When the orchestrator asks you something (a message marked "Question from the orchestrator"), answer in your final message of that turn; it is returned to the orchestrator directly.
-- Before starting work, check the digest and \`list_sessions\` for the same work key or area. If matching work is already running or queued (including scheduled automation runs), do not start a duplicate: report it with its progress and the options (wait, skip, join, force).
-- Merge nothing on your own unless the project's policy allows it. Escalate to the user (\`ask_user\`) or the orchestrator when unsure, when a protected area is involved, or when agents keep failing.
+- Only for ${USER_DECISIONS$1}; agents that keep failing at the same thing.
+- Ask one specific question with your default ("I'll go with X unless you say otherwise") and keep doing the work that doesn't depend on the answer.
+- When the user writes to you directly, ask in your reply. Use \`ask_user\` only on an automatic wake-up, when nobody is in the conversation.
+- Never call \`ask_user\` while the orchestrator waits for your answer or during an issue triage run (a triage run that waits on the user never reports). Classify an issue you can't decide as \`needs_info\` (ask its author in the comment) or \`unsafe\`, and say why in \`report_triage\`.
+
+## The orchestrator
+
+- When the orchestrator asks you something (a message marked "Question from the orchestrator"), answer in your final message of that turn; it is returned to the orchestrator directly, and the orchestrator is talking to the user. Answer with what you did or will do and the defaults you chose.
+- Work the orchestrator handed you (a message or a question) is yours to close: when it finishes, fails or needs a decision only the user can make, report it with \`message_orchestrator\` (informational: false), with the session, the PR and the outcome.
 - Use \`message_orchestrator\` with \`informational: true\` for routine updates (progress, a finished run that needs nothing); leave it false only when the orchestrator must act or answer.
 - After an automatic wake-up with nothing to act on, reply in one short line.
 
@@ -55517,21 +56953,104 @@ function rolePrompt(role) {
 // ../server/src/mcp/prompt.ts
 /** Name of CodeDen's MCP server inside agent sessions (tools appear as `codeden` tools). */
 const MCP_SERVER_NAME = "codeden";
-const AGENT_PROMPT = `# Working inside CodeDen
+/**
+* The decisions that are the user's to make. Everything else an agent decides itself, states
+* what it assumed, and carries on.
+*/
+const USER_DECISIONS = "destructive or irreversible steps (deleting data or someone else's work, force-pushing, rewriting shared history), spending money or creating accounts or credentials, outward-facing actions your brief didn't ask for (publishing, releases, deploys, messages or comments to other people), protected areas, or a request with two readings that lead to substantially different work";
+const TOOLS = `## CodeDen tools
 
-You are an agent session in CodeDen, a local harness that shows your work to the user live. Your working directory is your own git worktree and branch. CodeDen tools are on the \`${MCP_SERVER_NAME}\` MCP server:
+CodeDen tools are on the \`${MCP_SERVER_NAME}\` MCP server:
 
 - \`report_progress\`: one line about what you are doing now, at the start of each phase.
-- \`ask_user\`: only when you cannot proceed without a decision. If it returns "pending", finish what you can and end your turn; the answer arrives as your next message.
+- \`ask_user\`: only for a decision that is the user's to make (see above). If it returns "pending", finish what you can and end your turn; the answer arrives as your next message.
 - \`share_to_chat\`: show the user a file or image instead of describing it.
 - Browser (\`browser_navigate\`, \`browser_snapshot\`, \`browser_click\`, \`browser_type\`, \`browser_press\`, \`browser_screenshot\`, \`browser_logs\`, \`browser_wait\`, \`browser_evaluate\`, \`browser_open_dev_server\`): the same browser the user watches. Use it to check UI work: open the dev server, read the page with \`browser_snapshot\`, act on element refs, check \`browser_logs\` for errors. Call \`browser_screenshot\` with \`share: true\` for screenshots that show your result.
 - \`generate_image\` (when listed): create images into your worktree, e.g. \`public/hero.png\`.
 - GitHub projects: \`create_pull_request\` pushes your branch and opens the PR (linked to your issue and this session); \`attach_evidence\` posts screenshots, files and test output on it; \`comment_on_issue\` and \`get_pr_status\` (checks, reviews, mergeability).
 - \`finish\`: record the outcome and a short summary once your assigned task is done.
-- \`suggest_followups\`: 2 to 4 short next prompts the user might send. Call it as the last action of every turn.`;
+- \`suggest_followups\`: 2 to 4 short next prompts the user might send, including optional next steps you would otherwise ask about. Call it as the last action of every turn.`;
+/** Where the agent works: its own worktree, or a folder it shares with the user. */
+function workspaceLine(session) {
+	return session.worktreePath ? "Your working directory is your own git worktree and branch." : "Your working directory is not a worktree of your own: it is the project's checkout or a folder the user chose, and the user may be working in it too.";
+}
+/**
+* The session's permission level (§11.2) in the agent's terms: what is already approved, and
+* that approvals ask the user by themselves, so the agent doesn't ask first.
+*/
+function permissionLine(session) {
+	const where = session.worktreePath ? "your worktree" : "your working directory";
+	switch (session.autonomy) {
+		case "read_only": return "- Your permission level is Read-only: you can read and run the project's checks, but not edit files, commit or push. Report what you found instead of asking to change things.";
+		case "supervised": return "- Your permission level is Supervised: the user approves edits and commands as you make them, so go ahead and make them; don't ask before each one.";
+		case "auto": return `- Your permission level is Auto: edits and commands inside ${where} are pre-approved, so go ahead. Risky actions ask the user for approval automatically, so you don't need to ask first.`;
+		case "full": return `- Your permission level is Full: edits and commands inside ${where} are pre-approved, so go ahead. Anything outside it is refused or goes to the user for approval automatically, so you don't need to ask first.`;
+	}
+}
+/** Committing and pull requests: free in the agent's own worktree, opt-in elsewhere. */
+function gitLines(session, project) {
+	if (!session.worktreePath) return ["- Others may be working in this directory: don't commit, switch branches, stash or discard changes unless you're asked to."];
+	if (session.autonomy === "read_only") return [];
+	const lines = ["- This worktree and its branch are yours: edit files, run the project's checks and commit as you go without asking, unless your brief says otherwise."];
+	if (project?.kind !== "github") return lines;
+	lines.push(session.startedBy.kind === "user" ? "- Open a pull request with `create_pull_request` when the user asks for one; otherwise offer it with `suggest_followups` instead of asking." : "- When the work is done, open the pull request with `create_pull_request` (it links your issue), unless your brief says otherwise.");
+	return lines;
+}
+/** Who started the session, when it wasn't the user: the PM sees the agent's questions first. */
+function starterLine(session) {
+	switch (session.startedBy.kind) {
+		case "user": return null;
+		case "pm": return "- Your project manager started this session and sees your questions first; it answers what it can. Its brief is your first message, its later messages start with \"Message from your project manager:\", and nobody may be watching live.";
+		case "automation": return "- An automation started this session, not the user, and nobody may be watching live. Your project manager sees your questions first; it answers what it can.";
+		case "orchestrator": return "- The orchestrator started this session, not the user. Your project manager sees your questions first; it answers what it can.";
+	}
+}
+/** The agent's section of the system prompt (§8.3): how to work, then CodeDen's tools. */
+function agentPrompt(session, project) {
+	const lines = [
+		"- Keep going until the task is done. When a detail is open (naming, structure, approach, test strategy, a choice between reasonable designs), pick what fits the brief and the project's conventions, note the assumption, and carry on. Don't ask about things you can decide yourself, check in the code, or easily change later.",
+		permissionLine(session),
+		...gitLines(session, project),
+		`- Ask with \`ask_user\` only for a decision that is the user's to make: ${USER_DECISIONS}. First do everything that doesn't depend on the answer, then ask one question with your recommended option first.`,
+		starterLine(session),
+		"- End each turn with what you did and what you assumed, not with a question. Put optional next steps in `suggest_followups` instead of asking \"Want me to ...?\"."
+	].filter((l) => l !== null);
+	return [
+		"# Working inside CodeDen",
+		"",
+		`You are an agent session in CodeDen, a local harness that shows your work to the user live. ${workspaceLine(session)}`,
+		"",
+		"## How to work",
+		"",
+		...lines,
+		"",
+		TOOLS
+	].join("\n");
+}
 /** The CodeDen section appended to a session's system prompt, by role (§7.5, §8.3). */
-function codedenSystemPrompt(role) {
-	return role === "agent" ? AGENT_PROMPT : rolePrompt(role);
+function codedenSystemPrompt(session, project) {
+	return session.role === "agent" ? agentPrompt(session, project) : rolePrompt(session.role);
+}
+// ../server/src/services/sessions/setup-failure.ts
+/**
+* What the agent is told when a worktree setup command failed (§9 setup scripts): the command,
+* its exit code and the end of its output. Null when every command succeeded. Setup stops at
+* the first failure, so there is at most one.
+*/
+function setupFailureNote(setup) {
+	const failed = setup?.find((step) => !step.ok);
+	if (!failed) return null;
+	const exit = failed.exitCode === null ? "timed out" : `exit ${failed.exitCode}`;
+	const head = `Setup command \`${failed.command}\` failed (${exit})`;
+	return failed.outputTail ? `${head}:\n\`\`\`\n${failed.outputTail}\n\`\`\`` : `${head}.`;
+}
+/** The agent's input with a setup failure note in front, so its first turn knows. */
+function withSetupNote(input, note) {
+	if (!input || !note) return input;
+	return {
+		...input,
+		text: `${note}\n\n${input.text}`
+	};
 }
 // ../server/src/services/sessions/launcher.ts
 const PREPARE_TIMEOUT_MS = 6e5;
@@ -55574,9 +57093,12 @@ var SessionLauncher = class {
 				providerId: session.provider,
 				options: this.sessionOptions({
 					...session,
-					cwd: ws.cwd
+					cwd: ws.cwd,
+					worktreePath: ws.worktreePath,
+					branch: ws.branch,
+					baseBranch: ws.baseBranch
 				}),
-				input: opts.input
+				input: withSetupNote(opts.input, ws.setupNote)
 			}, START_TIMEOUT_MS);
 			repo.update(sessionId, (s) => ({
 				...s,
@@ -55594,13 +57116,13 @@ var SessionLauncher = class {
 	*/
 	async resume(session, input) {
 		await this.requireRunner();
-		const current = await this.restoreWorktree(session);
+		const { session: current, setupNote } = await this.restoreWorktree(session);
 		const result = await this.deps.runner.request({
 			name: "session.start",
 			sessionId: current.id,
 			providerId: current.provider,
 			options: this.sessionOptions(current),
-			input
+			input: withSetupNote(input, setupNote)
 		}, START_TIMEOUT_MS);
 		this.deps.repo.update(session.id, (s) => ({
 			...s,
@@ -55613,7 +57135,10 @@ var SessionLauncher = class {
 	* running the project's setup again. A no-op for sessions that still have their worktree.
 	*/
 	async restoreWorktree(session) {
-		if (!session.worktreeRemovedAt || !session.worktreePath || !session.projectId) return session;
+		if (!session.worktreeRemovedAt || !session.worktreePath || !session.projectId) return {
+			session,
+			setupNote: null
+		};
 		const project = this.deps.projects.get(session.projectId);
 		const result = await this.deps.runner.request({
 			name: "workspace.prepare",
@@ -55626,13 +57151,16 @@ var SessionLauncher = class {
 			setupCommands: []
 		}, PREPARE_TIMEOUT_MS);
 		this.deps.log?.(`session ${session.id}: recreated worktree ${result.cwd}`);
-		return this.deps.repo.update(session.id, (s) => ({
-			...s,
-			cwd: result.cwd,
-			worktreePath: result.cwd,
-			branch: result.branch ?? s.branch,
-			worktreeRemovedAt: null
-		}));
+		return {
+			session: this.deps.repo.update(session.id, (s) => ({
+				...s,
+				cwd: result.cwd,
+				worktreePath: result.cwd,
+				branch: result.branch ?? s.branch,
+				worktreeRemovedAt: null
+			})),
+			setupNote: setupFailureNote(result.setup)
+		};
 	}
 	/** Mark a session failed with an inbox item explaining why. */
 	fail(sessionId, key, error) {
@@ -55676,11 +57204,21 @@ var SessionLauncher = class {
 			effort: session.effort ?? void 0,
 			autonomy: session.autonomy,
 			resumeToken: session.resumeToken ?? void 0,
-			systemPrompt: codedenSystemPrompt(session.role),
+			systemPrompt: codedenSystemPrompt(session, this.projectOf(session)),
 			readOnly: session.role !== "agent",
-			mcpServers
+			mcpServers,
+			...ownBranch(session) ? { ownBranch: ownBranch(session) } : {}
 		});
 	}
+	/** The session's project for its system prompt; null without one (or once it is gone). */
+	projectOf(session) {
+		if (!session.projectId) return null;
+		try {
+			return this.deps.projects.get(session.projectId);
+		} catch {
+			return null;
+		}
+	}
 	async requireRunner() {
 		if (!await this.deps.runner.waitForConnection(this.deps.connectTimeoutMs ?? 15e3)) throw new ServiceError(503, "runner_unavailable", "The runner is not connected");
 	}
@@ -55696,6 +57234,7 @@ var SessionLauncher = class {
 		const path = req.mode === "existing" ? req.path : join(this.deps.worktreesDir, project.slug, session.id.slice(0, 8));
 		const branch = req.branch ?? (req.mode === "worktree" ? `codeden/${slugWords(session.title ?? session.purpose, 5, 40)}-${session.id.slice(0, 4)}` : void 0);
 		const baseRef = req.baseRef ?? project.defaultBranch ?? void 0;
+		const fetch = req.fetch ?? (project.kind === "github" && req.mode === "worktree" && !req.baseRef);
 		try {
 			const result = await this.deps.runner.request({
 				name: "workspace.prepare",
@@ -55706,14 +57245,15 @@ var SessionLauncher = class {
 				branch,
 				baseRef,
 				setupCommands: req.setupCommands ?? [],
-				...req.fetch ? { fetch: true } : {}
+				...fetch ? { fetch: true } : {}
 			}, PREPARE_TIMEOUT_MS);
 			return {
 				cwd: result.cwd,
 				worktreePath: req.mode === "worktree" ? result.cwd : null,
 				branch: result.branch,
 				baseBranch: baseRef ?? null,
-				fallback: null
+				fallback: null,
+				setupNote: setupFailureNote(result.setup)
 			};
 		} catch (error) {
 			if (runnerErrorCode(error) !== "not_implemented") throw error;
@@ -55731,7 +57271,8 @@ function plain(cwd) {
 		worktreePath: null,
 		branch: null,
 		baseBranch: null,
-		fallback: null
+		fallback: null,
+		setupNote: null
 	};
 }
 function defaultMeta(workspace) {
@@ -55743,12 +57284,13 @@ function defaultMeta(workspace) {
 	};
 }
 // ../server/src/services/sessions/lifecycle.ts
-/** Session statuses after which its MCP tokens are revoked (§8.3). */
-const ENDED = /* @__PURE__ */ new Set([
-	"stopped",
-	"completed",
-	"failed"
-]);
+/**
+* Session statuses after which its MCP tokens are revoked (§8.3). Not `failed`: a failed turn
+* leaves the provider process running with its token, and the next message reaches that same
+* process; a session whose process is gone is resumed with a freshly minted token, which
+* revokes the old one.
+*/
+const ENDED = /* @__PURE__ */ new Set(["stopped", "completed"]);
 /**
 * Reacts to committed events: starts queued sessions whose blockers finished (§8.4 `wait`),
 * sends queued messages when a session goes idle, and runs utility-model hooks after a root
@@ -55788,7 +57330,7 @@ var SessionLifecycle = class {
 			sessionsChanged = true;
 			const { session } = e.payload;
 			if (ENDED.has(session.status)) this.deps.tokens.revokeSession(session.id);
-			if (session.status === "idle" && this.deps.sessions.hasOutbox(session.id)) setImmediate(() => void this.deps.sessions.flushOutbox(session.id));
+			if ((session.status === "idle" || session.status === "failed") && this.deps.sessions.hasOutbox(session.id)) setImmediate(() => void this.deps.sessions.flushOutbox(session.id));
 		} else if ((e.type === "agent.item.started" || e.type === "agent.item.completed") && e.sessionId) {
 			const { item } = e.payload;
 			if (item.kind === "user_message" && item.input.text.trim()) {
@@ -56000,6 +57542,151 @@ var Outbox = class {
 		return (this.db.select({ payload: events.payload }).from(events).where(and(eq(events.sessionId, sessionId), eq(events.type, "message.dequeued"), sql`json_extract(${events.payload}, '$.messageId') = ${messageId}`)).orderBy(desc(events.seq)).limit(1).get()?.payload)?.reason;
 	}
 };
+/** Sessions that can take a message now or after their turn. */
+const OPEN = /* @__PURE__ */ new Set([
+	"idle",
+	"running",
+	"waiting",
+	"interrupted"
+]);
+const PR_EVENTS = /* @__PURE__ */ new Set([
+	"pr.opened",
+	"pr.updated",
+	"pr.checks_failed",
+	"pr.checks_passed",
+	"review.submitted"
+]);
+const clip$2 = (text, max = 1500) => text.length > max ? `${text.slice(0, max - 3)}...` : text;
+function failingChecks(pr) {
+	return pr.checks.checks.filter((c) => c.conclusion && ![
+		"success",
+		"neutral",
+		"skipped"
+	].includes(c.conclusion));
+}
+/**
+* Whether PR feedback goes to this session: an agent session the user started themselves
+* (the PM follows up on work it, the orchestrator or an automation started), not archived and
+* able to take a message.
+*/
+function receivesPrFeedback(session) {
+	return session.role === "agent" && session.startedBy.kind === "user" && session.parentSessionId === null && !session.archivedAt && OPEN.has(session.status);
+}
+/** The feedback one GitHub event carries for the PR's session, if any. Pure. */
+function prFeedbackFor(event) {
+	if (!PR_EVENTS.has(event.type)) return [];
+	const { pr, review } = event.payload;
+	if (pr.state !== "open" && pr.state !== "draft") return [];
+	const head = pr.headSha ?? "unknown";
+	const short = head.slice(0, 7);
+	const out = [];
+	if (event.type === "pr.checks_failed") {
+		const failed = failingChecks(pr);
+		const list = failed.length ? failed.map((c) => `- ${c.name} (${c.conclusion})${c.url ? `: ${c.url}` : ""}`).join("\n") : "- (GitHub did not say which)";
+		out.push({
+			kind: "checks_failed",
+			key: `checks_failed:${head}`,
+			text: [
+				`CI failed on your pull request #${pr.number} (commit ${short}). Failing checks:`,
+				list,
+				"Read the failure logs (for GitHub Actions: `gh run view <run-id> --log-failed`), fix the cause, and push."
+			].join("\n")
+		});
+	}
+	if (event.type === "review.submitted" && review?.state === "changes_requested") {
+		const who = review.author ? `@${review.author}` : "A reviewer";
+		const body = review.body.trim() ? `\n\n${clip$2(review.body.trim())}` : "";
+		out.push({
+			kind: "changes_requested",
+			key: `changes_requested:${head}`,
+			text: `${who} requested changes on your pull request #${pr.number}.${body}\n\nRead the review and its comments (\`gh pr view ${pr.number} --comments\`), address them, and push.`
+		});
+	}
+	if (pr.mergeable === "conflicting") out.push({
+		kind: "conflicts",
+		key: `conflicts:${head}`,
+		text: `Your pull request #${pr.number} has merge conflicts with \`${pr.baseBranch}\`. Fetch, merge \`origin/${pr.baseBranch}\` into your branch, resolve the conflicts, run the checks, and push.`
+	});
+	return out;
+}
+/**
+* PR feedback for sessions the user started (§9): when the pull request a session owns fails
+* its checks, gets a review requesting changes or runs into merge conflicts, the session is
+* sent a message from CodeDen (queued behind a running turn) so the agent can fix it without
+* the user relaying it. Each problem is sent once per head commit, and at most
+* `PR_FEEDBACK_MAX_ROUNDS` messages go out per PR. Off with `sessions.prFeedback`.
+*/
+var PrFeedbackService = class {
+	deps;
+	unsubscribe;
+	chain = Promise.resolve();
+	constructor(deps) {
+		this.deps = deps;
+	}
+	start() {
+		this.unsubscribe = this.deps.store.subscribe((events) => {
+			this.chain = this.chain.then(() => this.onEvents(events));
+		});
+	}
+	stop() {
+		this.unsubscribe?.();
+	}
+	/** Resolves once the events seen so far are handled (tests). */
+	idle() {
+		return this.chain;
+	}
+	async onEvents(events) {
+		if (!this.deps.settings().sessions.prFeedback) return;
+		for (const event of events) {
+			const feedback = prFeedbackFor(event);
+			if (feedback.length === 0) continue;
+			const { pr } = event.payload;
+			const found = pr.sessionId ? this.deps.repo.find(pr.sessionId) : void 0;
+			if (!found || !receivesPrFeedback(found.session)) continue;
+			for (const item of feedback) await this.deliver(found.session, pr, item);
+		}
+	}
+	async deliver(session, pr, item) {
+		const record = (this.deps.repo.find(session.id)?.startMeta ?? null)?.prFeedback?.[String(pr.number)] ?? {
+			rounds: 0,
+			keys: []
+		};
+		if (record.keys.includes(item.key)) return;
+		if (record.rounds >= 3) {
+			this.deps.log?.(`pr feedback: PR #${pr.number} reached ${record.rounds} rounds; not sent`);
+			return;
+		}
+		const next = {
+			rounds: record.rounds + 1,
+			keys: [...record.keys, item.key].slice(-20)
+		};
+		this.deps.repo.setStartMeta(session.id, (m) => withRecord(m, pr.number, next));
+		try {
+			await this.deps.send(session.id, {
+				text: item.text,
+				attachments: [],
+				from: "codeden"
+			});
+		} catch (error) {
+			this.deps.log?.(`pr feedback for session ${session.id}: ${errorMessage$1(error)}`);
+		}
+	}
+};
+function withRecord(meta, number, record) {
+	const base = meta ?? {
+		workspaceMode: "worktree",
+		workspaceFallback: null,
+		forced: null,
+		queuedBehind: []
+	};
+	return {
+		...base,
+		prFeedback: {
+			...base.prFeedback,
+			[String(number)]: record
+		}
+	};
+}
 // ../server/src/services/sessions/questions.ts
 /**
 * Questions agents ask through CodeDen's `ask_user` tool (§8.3). The question becomes a
@@ -56053,7 +57740,7 @@ var QuestionBroker = class {
 	* Handle a response if `requestId` belongs to an `ask_user` question. Returns false for
 	* provider-native requests (the caller forwards those to the runner).
 	*/
-	async respond(sessionId, requestId, response) {
+	async respond(sessionId, requestId, response, by = "user") {
 		const record = this.find(sessionId, requestId);
 		if (!record) return false;
 		const item = record.item;
@@ -56062,7 +57749,8 @@ var QuestionBroker = class {
 		const done = answers ? {
 			...item,
 			status: "completed",
-			answers
+			answers,
+			decidedBy: by
 		} : {
 			...item,
 			status: "cancelled"
@@ -56071,11 +57759,12 @@ var QuestionBroker = class {
 		const outcome = answers ? {
 			status: "answered",
 			answers,
-			text: formatAnswers(item, answers)
+			text: formatAnswers(item, answers),
+			by
 		} : { status: "dismissed" };
 		const waiter = this.waiters.get(requestId);
 		if (waiter) waiter(outcome);
-		else if (outcome.status === "answered") await this.deps.sendMessage()(sessionId, `Answer to your earlier question:\n${outcome.text}`);
+		else if (outcome.status === "answered") await this.deps.sendMessage()(sessionId, `Answer to your earlier question:\n${outcome.text}`, by);
 		return true;
 	}
 	get waitMs() {
@@ -56200,12 +57889,15 @@ var SessionRecovery = class {
 			return;
 		}
 		for (const id of candidates) {
+			const found = repo.find(id)?.session;
+			if (!found || hosted.has(id) || sessions.launching.has(id)) continue;
+			if (!CUT_OFF.includes(found.status)) continue;
+			repo.closeOrphanedTurns(id);
 			const session = repo.find(id)?.session;
-			if (!session || hosted.has(id) || sessions.launching.has(id)) continue;
-			if (!CUT_OFF.includes(session.status)) continue;
-			await this.resume(session);
+			if (session && CUT_OFF.includes(session.status)) await this.resume(session);
 		}
-		for (const id of sessions.sessionsWithQueuedMessages()) if ((repo.find(id)?.session)?.status === "idle") await sessions.flushOutbox(id).catch(() => void 0);
+		sessions.releaseOutboxes();
+		for (const id of sessions.sessionsWithQueuedMessages()) await sessions.flushOutbox(id).catch(() => void 0);
 	}
 	async resume(session) {
 		const provider = this.deps.runner.providers().find((p) => p.id === session.provider);
@@ -56323,6 +58015,37 @@ var SessionRepo = class {
 			startedAt: r.startedAt
 		}))];
 	}
+	/**
+	* Close what a runner that went away without a word (crash, kill, power loss) left open in a
+	* session it no longer hosts (§4.2). Turns still `running` end as interrupted by a restart,
+	* which cancels their approvals and provider questions and dismisses their inbox items; any
+	* other provider request still open is cancelled too, so none of them can keep the session
+	* `waiting`. CodeDen's deferred `ask_user` questions outlive their turn and stay open.
+	* Returns how many turns and requests it closed.
+	*/
+	closeOrphanedTurns(sessionId) {
+		const running = this.db.select().from(turns).where(and(eq(turns.sessionId, sessionId), eq(turns.status, "running"))).orderBy(asc(turns.startedAt)).all();
+		const ended = new Set(running.map((t) => t.id));
+		const requests = this.db.select().from(items).where(and(eq(items.sessionId, sessionId), inArray(items.kind, ["approval_request", "user_question"]), eq(items.status, "in_progress"))).all().map(rowToItemRecord).filter((r) => !ended.has(r.turnId)).filter((r) => !(r.item.kind === "user_question" && r.item.deferred));
+		const root = this.find(sessionId)?.session.rootThreadId;
+		const isRoot = (t) => Number(t.threadId === root);
+		const events = [...requests.map((r) => agentEventToNewEvent(sessionId, {
+			type: "item.completed",
+			threadId: r.threadId,
+			turnId: r.turnId,
+			item: {
+				...r.item,
+				status: "cancelled"
+			}
+		})), ...running.sort((a, b) => isRoot(a) - isRoot(b)).map((t) => agentEventToNewEvent(sessionId, {
+			type: "turn.interrupted",
+			threadId: t.threadId,
+			turnId: t.id,
+			reason: "runner_restart"
+		}))];
+		if (events.length > 0) this.store.append(events);
+		return events.length;
+	}
 	item(sessionId, itemId) {
 		const row = this.db.select().from(items).where(and(eq(items.sessionId, sessionId), eq(items.id, itemId))).get();
 		return row ? rowToItemRecord(row) : void 0;
@@ -56374,6 +58097,46 @@ function readProjectConfig(projectPath) {
 function projectDefaultProvider(project) {
 	return project.defaultProvider ?? readProjectConfig(project.path)?.defaultProvider ?? null;
 }
+// ../server/src/services/sessions/outbox-holds.ts
+/** Runner failures worth retrying: the runner is away or slow, not refusing the message. */
+function isTransientRunnerError(error) {
+	const code = runnerErrorCode(error);
+	return code === "runner_unavailable" || code === "timeout";
+}
+/**
+* Sessions whose queued-message delivery failed. The message went back in its place and
+* delivery pauses, so a failing send never loops on the status change it causes. It resumes
+* after `retryMs` when the failure was transient, when the runner is ready again
+* (`releaseAll`), or once any message reaches the session (`release`).
+*/
+var OutboxHolds = class {
+	opts;
+	held = /* @__PURE__ */ new Map();
+	constructor(opts) {
+		this.opts = opts;
+	}
+	isHeld(sessionId) {
+		return this.held.has(sessionId);
+	}
+	/** Pause delivery; `retry` resumes it on its own after the retry delay. */
+	hold(sessionId, retry) {
+		this.release(sessionId);
+		const timer = retry ? setTimeout(() => {
+			this.held.delete(sessionId);
+			this.opts.onRetry(sessionId);
+		}, this.opts.retryMs ?? 3e4) : void 0;
+		timer?.unref?.();
+		this.held.set(sessionId, timer);
+	}
+	release(sessionId) {
+		const timer = this.held.get(sessionId);
+		if (timer) clearTimeout(timer);
+		this.held.delete(sessionId);
+	}
+	releaseAll() {
+		for (const id of [...this.held.keys()]) this.release(id);
+	}
+};
 // ../server/src/services/sessions/permissions.ts
 /**
 * Why a session cannot use a permission level on a provider, or null when it can. The
@@ -56492,6 +58255,12 @@ const NOT_STARTED = /* @__PURE__ */ new Set([
 	"queued",
 	"starting"
 ]);
+/** Statuses in which the next queued message is delivered. */
+const FLUSHABLE = /* @__PURE__ */ new Set([
+	"idle",
+	"interrupted",
+	"failed"
+]);
 /**
 * Agent sessions: start (with the §8.4 conflict check), messages, steering, interrupts,
 * approvals and stop. Starts return immediately; the runner work happens in the background
@@ -56503,8 +58272,13 @@ var SessionService = class {
 	launching = /* @__PURE__ */ new Map();
 	/** Rewrites a turn's input at send time (the orchestration status digest, §8.4). */
 	inputDecorator;
+	holds;
 	constructor(deps) {
 		this.deps = deps;
+		this.holds = new OutboxHolds({
+			retryMs: deps.outboxRetryMs,
+			onRetry: (id) => void this.flushOutbox(id).catch(() => void 0)
+		});
 	}
 	setInputDecorator(fn) {
 		this.inputDecorator = fn;
@@ -56637,7 +58411,14 @@ var SessionService = class {
 			}
 			return this.enqueue(id, req.input, from);
 		}
-		await this.sendNow(session, req.input);
+		try {
+			await this.sendNow(session, req.input, from);
+		} catch (error) {
+			if (from === "user" || req.whenBusy === "reject" || !isTransientRunnerError(error)) throw error;
+			this.holds.hold(id, true);
+			return this.enqueue(id, req.input, from);
+		}
+		this.holds.release(id);
 		return { status: "sent" };
 	}
 	async steer(id, raw) {
@@ -56663,9 +58444,10 @@ var SessionService = class {
 			throw toServiceError$1(e);
 		});
 	}
-	async respond(id, req) {
+	/** Answer a question or approval; `by` is who answered a question (the user or the PM). */
+	async respond(id, req, by = "user") {
 		this.deps.repo.get(id);
-		if (await this.deps.questions.respond(id, req.requestId, req.response)) return;
+		if (await this.deps.questions.respond(id, req.requestId, req.response, by)) return;
 		await this.deps.runner.request({
 			name: "session.respond",
 			sessionId: id,
@@ -56676,13 +58458,17 @@ var SessionService = class {
 		});
 		const resolution = req.response.kind === "approval" ? {
 			decision: req.response.decision,
-			decidedBy: "user"
-		} : req.response.kind === "answer" ? { answers: req.response.answers } : { status: "cancelled" };
+			decidedBy: req.response.decidedBy ?? "user"
+		} : req.response.kind === "answer" ? {
+			answers: req.response.answers,
+			decidedBy: by
+		} : { status: "cancelled" };
 		this.deps.inbox.closeForRequest(id, req.requestId, resolution);
 	}
 	async stop(id) {
 		const session = this.deps.repo.get(id);
 		this.deps.outbox.clear(id);
+		this.holds.release(id);
 		if (session.status !== "queued" && session.status !== "created") try {
 			await this.deps.runner.request({
 				name: "session.stop",
@@ -56699,19 +58485,31 @@ var SessionService = class {
 			endedAt: (/* @__PURE__ */ new Date()).toISOString()
 		});
 	}
-	/** Send the next queued message once a session is idle again. */
+	/**
+	* Send the next queued message once no turn is running (idle, or after a failed or
+	* interrupted turn). If delivery fails the message goes back in its place and delivery
+	* pauses (`OutboxHolds`); only an error that is not a runner restart fails the session.
+	*/
 	async flushOutbox(id) {
+		if (this.holds.isHeld(id)) return;
 		const next = this.deps.outbox.peek(id);
 		if (!next) return;
 		const session = this.deps.repo.get(id);
-		if (session.status !== "idle" && session.status !== "interrupted") return;
+		if (!FLUSHABLE.has(session.status)) return;
 		this.deps.outbox.remove(next, "sent");
 		try {
-			await this.sendNow(session, next.input);
+			await this.sendNow(session, next.input, next.from);
 		} catch (error) {
-			this.deps.launcher.fail(id, `send-${Date.now()}`, error);
+			const transient = isTransientRunnerError(error);
+			this.holds.hold(id, transient);
+			this.deps.outbox.restore(next);
+			if (!transient && session.status !== "failed") this.deps.launcher.fail(id, `send-${Date.now()}`, error);
 		}
 	}
+	/** The runner is ready again: retry every paused delivery (§4.2). */
+	releaseOutboxes() {
+		this.holds.releaseAll();
+	}
 	/**
 	* Re-open a session whose turn was cut off by a runner restart and tell the agent to carry
 	* on (§4.2). Resumes through the provider's resume token.
@@ -56721,7 +58519,7 @@ var SessionService = class {
 		await this.sendNow(session, {
 			text,
 			attachments: []
-		});
+		}, "codeden");
 	}
 	sessionsWithQueuedMessages() {
 		return this.deps.outbox.sessionsWithMessages();
@@ -56729,8 +58527,18 @@ var SessionService = class {
 	hasOutbox(id) {
 		return this.deps.outbox.count(id) > 0;
 	}
-	async sendNow(session, raw) {
-		const input = this.forRunner(session, this.inputDecorator?.(session, raw) ?? raw);
+	async sendNow(session, raw, from) {
+		const decorated = this.inputDecorator?.(session, raw, from) ?? { input: raw };
+		try {
+			await this.deliver(session, this.forRunner(session, decorated.input));
+		} catch (error) {
+			decorated.failed?.();
+			throw error;
+		}
+		decorated.delivered?.();
+	}
+	/** Hand a turn's input to the runner, resuming the session when it no longer hosts it. */
+	async deliver(session, input) {
 		await applyPendingConfig(this.deps.repo, this.deps.runner, session);
 		const previous = session.status;
 		this.deps.repo.update(session.id, (s) => ({
@@ -56851,6 +58659,98 @@ function fallbackMeta() {
 		queuedBehind: []
 	};
 }
+/** The denial an unwatched session gets when nobody answered in time. */
+function noAnswerDenial(waitMs) {
+	const minutes = Math.max(1, Math.round(waitMs / 6e4));
+	return [
+		`Not approved: nobody answered within ${minutes} minute${minutes === 1 ? "" : "s"}, and this session runs unattended (started by an automation, a project manager or the factory). Don't wait for it or try the same thing again.`,
+		"- Find a way that stays inside your worktree, or skip this step. To publish your work, commit it and call `create_pull_request`.",
+		"- If the task can't be finished without it, say what you needed and why in your final message, or call `finish` with outcome `blocked`, so the user sees it."
+	].join("\n");
+}
+/**
+* True for sessions the user is unlikely to be watching: started by an automation, a PM or the
+* factory rather than by the user or the orchestrator they talk to.
+*/
+function isUnwatched(session) {
+	return session.automationRunId !== null || session.startedBy.kind === "automation" || session.startedBy.kind === "pm";
+}
+/**
+* Approvals nobody is there to answer (§10.1, §11.2). Nothing here ever approves: it denies, with
+* guidance, so the agent carries on instead of waiting forever (fail closed).
+* - The PM and the factory's sessions in a dark factory are denied at once, as their questions
+*   are answered at once.
+* - Sessions started by an automation, a PM or the factory otherwise wait
+*   {@link UNWATCHED_APPROVAL_WAIT_MS} for the user, then are denied. A scheduled run then
+*   finishes instead of blocking the next ones.
+* Sessions the user started wait for the user, however long.
+*/
+var UnwatchedApprovals = class {
+	deps;
+	unsubscribe;
+	timers = /* @__PURE__ */ new Map();
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/** Watch new approvals, and pick up the ones already open (a restart keeps their age). */
+	start() {
+		this.unsubscribe ??= this.deps.store.subscribe((events) => this.onEvents(events));
+		for (const item of this.deps.inbox.list()) if (item.kind === "approval") this.track(item);
+	}
+	stop() {
+		this.unsubscribe?.();
+		this.unsubscribe = void 0;
+		for (const timer of this.timers.values()) clearTimeout(timer);
+		this.timers.clear();
+	}
+	onEvents(events) {
+		for (const e of events) {
+			if (e.type !== "inbox.created" && e.type !== "inbox.updated") continue;
+			const { item } = e.payload;
+			if (item.kind !== "approval") continue;
+			if (item.status !== "open") {
+				clearTimeout(this.timers.get(item.id));
+				this.timers.delete(item.id);
+			} else if (e.type === "inbox.created") setImmediate(() => this.track(item));
+		}
+	}
+	track(item) {
+		const { sessionId, requestId } = item;
+		if (item.status !== "open" || !sessionId || !requestId || this.timers.has(item.id)) return;
+		const session = this.deps.repo.find(sessionId)?.session;
+		if (!session) return;
+		if (unattendedSession(this.deps, sessionId)) {
+			this.deny(item, UNATTENDED_APPROVAL);
+			return;
+		}
+		if (!isUnwatched(session)) return;
+		const waitMs = this.deps.waitMs ?? 18e5;
+		const age = (this.deps.now?.() ?? Date.now()) - Date.parse(item.createdAt);
+		const timer = setTimeout(() => {
+			this.timers.delete(item.id);
+			this.deny(item, noAnswerDenial(waitMs));
+		}, Math.max(0, waitMs - (Number.isFinite(age) ? age : 0)));
+		timer.unref?.();
+		this.timers.set(item.id, timer);
+	}
+	async deny(item, message) {
+		if (this.deps.inbox.find(item.id)?.status !== "open") return;
+		if (!item.sessionId || !item.requestId) return;
+		try {
+			await this.deps.respond(item.sessionId, {
+				requestId: item.requestId,
+				response: {
+					kind: "approval",
+					decision: "deny",
+					message,
+					decidedBy: "policy"
+				}
+			});
+		} catch (error) {
+			this.deps.log?.(`approvals: deny ${item.id}: ${errorMessage$1(error)}`);
+		}
+	}
+};
 // ../server/src/services/sessions/worktree-cleanup.ts
 const DAY_MS = 864e5;
 const REMOVE_TIMEOUT_MS = 12e4;
@@ -56986,6 +58886,7 @@ var WorktreeCleanup = class {
 			const message = errorMessage$1(error);
 			if (runnerErrorCode(error) === "worktree_dirty" || /modified or untracked/.test(message)) return outcome("kept_changes", "The worktree has uncommitted changes, so it was kept");
 			this.deps.log?.(`worktree cleanup: could not remove ${session.worktreePath}: ${message}`);
+			this.reportFailure(session, message);
 			return outcome("failed", message);
 		}
 		this.deps.repo.update(id, (s) => ({
@@ -56994,6 +58895,7 @@ var WorktreeCleanup = class {
 		}));
 		this.kept.delete(id);
 		this.forced.delete(id);
+		this.clearFailure(id);
 		this.deps.log?.(`worktree cleanup: removed ${session.worktreePath}`);
 		return outcome("removed", discarded ? "Its uncommitted changes were discarded" : null);
 	}
@@ -57045,10 +58947,53 @@ var WorktreeCleanup = class {
 			if (typeof projectId === "string") this.cleanProject(projectId).catch((error) => this.deps.log?.(`worktree cleanup for project ${projectId}: ${errorMessage$1(error)}`));
 		}
 	}
+	/**
+	* Put a failed removal in the inbox (`cleanup_failed`), so it can't go unnoticed while the
+	* sweep keeps retrying. One item per session: updated when the reason changes, reopened
+	* after an earlier one was resolved, and left alone once the user dismissed it.
+	*/
+	reportFailure(session, message) {
+		const inbox = this.deps.inbox;
+		if (!inbox) return;
+		const id = cleanupInboxId(session.id);
+		const existing = inbox.find(id);
+		const body = `${message}\n\nCodeDen tries again every hour; archive the session again to retry now.`;
+		if (existing?.status === "dismissed" || existing?.status === "open" && existing.body === body) return;
+		const now = this.now().toISOString();
+		inbox.put({
+			id,
+			kind: "cleanup_failed",
+			status: "open",
+			priority: "normal",
+			title: `Couldn't remove the worktree: ${session.title ?? session.purpose}`,
+			body,
+			projectId: session.projectId,
+			sessionId: session.id,
+			threadId: session.rootThreadId,
+			itemId: null,
+			requestId: null,
+			issue: session.issue,
+			pr: session.pr,
+			automationRunId: session.automationRunId,
+			createdAt: existing?.status === "open" ? existing.createdAt : now,
+			updatedAt: now,
+			resolvedAt: null,
+			resolution: null
+		});
+	}
+	/** The worktree is gone: resolve its open `cleanup_failed` item. */
+	clearFailure(sessionId) {
+		const item = this.deps.inbox?.find(cleanupInboxId(sessionId));
+		if (item?.status === "open") this.deps.inbox?.close(item, "resolved", { removed: true });
+	}
 	now() {
 		return this.deps.now?.() ?? /* @__PURE__ */ new Date();
 	}
 };
+/** The inbox item reporting that a session's worktree could not be removed. */
+function cleanupInboxId(sessionId) {
+	return `inbox:${sessionId}:worktree-cleanup`;
+}
 // ../server/src/services/setup/claude-sdk.ts
 /**
 * Claude Code support (§14): reports and installs the Claude Agent SDK into `<home>/deps`.
@@ -57256,8 +59201,30 @@ function expiresWithin(iso, days, now = Date.now()) {
 	if (!iso) return false;
 	return Date.parse(iso) - now < days * 24 * 60 * 60 * 1e3;
 }
-// ../server/src/services/setup/checks.ts
-/** Commands that sign a tool in, run in the UI's terminal (§14 step 3). */
+// ../server/src/services/setup/tool-lookup.ts
+/**
+* A look-up through an `Exec` only (`<name> --version`): used when a server is given its own
+* `exec` (tests with fake CLIs) and no `locate`, so no real tool is ever looked for or run.
+*/
+function execLocate(exec) {
+	return async (name) => {
+		const run = await exec(name, ["--version"], { timeoutMs: 1e4 });
+		if (run.notFound || run.code !== 0) return {
+			version: null,
+			broken: []
+		};
+		const version = /\d+\.\d+\.\d+(?:-[\w.]+)?/.exec(run.stdout)?.[0] ?? null;
+		return {
+			command: {
+				kind: "native",
+				path: run.path ?? name
+			},
+			version,
+			broken: []
+		};
+	};
+}
+/** Tools whose sign-in runs in the setup terminal, with the arguments that sign them in. */
 const LOGIN_COMMANDS = {
 	claude: [
 		"claude",
@@ -57274,6 +59241,68 @@ const LOGIN_COMMANDS = {
 		"https"
 	]
 };
+/**
+* The sign-in command typed into the setup terminal (§14 step 3). With a resolved `program`
+* it runs that exact file, quoted for `shell`, so a broken shim or an outdated PATH in the
+* terminal cannot get in the way: `& 'C:\Users\x\.local\bin\claude.exe' auth login`.
+*/
+function loginCommandLine(tool, shell, program) {
+	const [name, ...args] = LOGIN_COMMANDS[tool];
+	return shellCommandLine(shell, program || name, args);
+}
+function loginFix(tool, shell, program) {
+	return {
+		kind: "login",
+		command: loginCommandLine(tool, shell, program)
+	};
+}
+/**
+* Look a tool up and turn "nothing found" and "found, but nothing runs" into honest checks:
+* not installed (with the install fix) or installed but broken (with the paths).
+*/
+async function lookupTool(locate, name, check, notInstalled) {
+	const lookup = await locate(name);
+	const extra = lookup.broken.length > 0 ? { broken: lookup.broken } : {};
+	if (lookup.command) return {
+		found: true,
+		path: lookup.command.path,
+		version: lookup.version,
+		extra
+	};
+	if (lookup.broken.length === 0) return {
+		found: false,
+		result: {
+			...check,
+			state: "missing",
+			...notInstalled
+		}
+	};
+	return {
+		found: false,
+		result: {
+			...check,
+			...extra,
+			state: "missing",
+			message: brokenInstallMessage(check.label, lookup.broken),
+			fix: notInstalled.fix
+		}
+	};
+}
+/** What went wrong running a command, for a check's details (never includes tokens). */
+function runDetail(command, run) {
+	if (run.timedOut) return `\`${command}\` did not finish in time.`;
+	const parts = [`\`${command}\` exited with code ${run.code ?? "none"}.`];
+	const stderr = clip$1(run.stderr);
+	const stdout = clip$1(run.stdout);
+	if (stderr) parts.push(`stderr: ${stderr}`);
+	if (stdout) parts.push(`stdout: ${stdout}`);
+	if (!stderr && !stdout) parts.push("It printed nothing.");
+	return parts.join("\n");
+}
+function clip$1(text) {
+	const t = text.trim();
+	return t.length > 300 ? `${t.slice(0, 297)}...` : t;
+}
 const LABELS = {
 	claude: "Claude Code",
 	codex: "Codex",
@@ -57314,10 +59343,6 @@ function installFix(id, platform) {
 		};
 	}
 }
-const loginFix = (tool) => ({
-	kind: "login",
-	command: LOGIN_COMMANDS[tool].join(" ")
-});
 function base(id) {
 	return {
 		id,
@@ -57332,27 +59357,28 @@ function base(id) {
 		fix: null
 	};
 }
-async function checkClaude({ exec, platform, now }) {
-	const check = base("claude");
-	const version = await exec("claude", ["--version"], { timeoutMs: 1e4 });
-	if (version.notFound || version.code !== 0) return {
-		...check,
-		state: "missing",
+async function checkClaude({ exec, locate, shell, platform, now }) {
+	const tool = await lookupTool(locate, "claude", base("claude"), {
 		message: "Claude Code is not installed",
 		fix: installFix("claude", platform)
-	};
+	});
+	if (!tool.found) return tool.result;
 	const installed = {
-		...check,
+		...base("claude"),
+		...tool.extra,
 		installed: true,
-		version: parseVersion(version.stdout),
-		executablePath: version.path
+		version: tool.version,
+		executablePath: tool.path
 	};
-	const auth = parseClaudeAuth((await exec("claude", ["auth", "status"], { timeoutMs: 1e4 })).stdout);
+	const login = loginFix("claude", shell, tool.path);
+	const status = await exec(tool.path, ["auth", "status"], { timeoutMs: 1e4 });
+	const auth = parseClaudeAuth(status.stdout);
 	if (!auth) return {
 		...installed,
 		state: "warning",
 		message: "Could not read the Claude login state",
-		fix: loginFix("claude")
+		detail: runDetail("claude auth status", status),
+		fix: login
 	};
 	const withAuth = {
 		...installed,
@@ -57362,13 +59388,13 @@ async function checkClaude({ exec, platform, now }) {
 		...withAuth,
 		state: "missing",
 		message: "Not signed in to Claude",
-		fix: loginFix("claude")
+		fix: login
 	};
 	if (expiresWithin(auth.loginExpiresAt, 3, now)) return {
 		...withAuth,
 		state: "warning",
 		message: "Your Claude login expires soon; sign in again",
-		fix: loginFix("claude")
+		fix: login
 	};
 	return {
 		...withAuth,
@@ -57376,29 +59402,29 @@ async function checkClaude({ exec, platform, now }) {
 		message: "Signed in"
 	};
 }
-async function checkCodex({ exec, platform }) {
-	const check = base("codex");
-	const version = await exec("codex", ["--version"], { timeoutMs: 1e4 });
-	if (version.notFound || version.code !== 0) return {
-		...check,
-		state: "missing",
+async function checkCodex({ exec, locate, shell, platform }) {
+	const tool = await lookupTool(locate, "codex", base("codex"), {
 		message: "Codex is not installed",
 		fix: installFix("codex", platform)
-	};
+	});
+	if (!tool.found) return tool.result;
 	const installed = {
-		...check,
+		...base("codex"),
+		...tool.extra,
 		installed: true,
-		version: parseVersion(version.stdout),
-		executablePath: version.path
+		version: tool.version,
+		executablePath: tool.path
 	};
-	const status = await exec("codex", ["login", "status"], { timeoutMs: 1e4 });
-	const login = parseCodexLogin(status.code, `${status.stdout}\n${status.stderr}`);
+	const status = await exec(tool.path, ["login", "status"], { timeoutMs: 1e4 });
+	const login = parseCodexLogin(status.code, `${status.stdout}
+${status.stderr}`);
 	if (!login.loggedIn) return {
 		...installed,
 		loggedIn: false,
 		state: "missing",
 		message: "Not signed in to Codex",
-		fix: loginFix("codex")
+		...status.code !== 0 && !/not logged in/i.test(`${status.stdout}${status.stderr}`) ? { detail: runDetail("codex login status", status) } : {},
+		fix: loginFix("codex", shell, tool.path)
 	};
 	return {
 		...installed,
@@ -57408,37 +59434,36 @@ async function checkCodex({ exec, platform }) {
 		message: "Signed in"
 	};
 }
-async function checkGh({ exec, platform }) {
-	const check = base("gh");
-	const version = await exec("gh", ["--version"], { timeoutMs: 1e4 });
-	if (version.notFound || version.code !== 0) return {
-		...check,
-		state: "missing",
+async function checkGh({ exec, locate, shell, platform }) {
+	const tool = await lookupTool(locate, "gh", base("gh"), {
 		message: "GitHub CLI is not installed (optional)",
 		fix: installFix("gh", platform)
-	};
+	});
+	if (!tool.found) return tool.result;
 	const installed = {
-		...check,
+		...base("gh"),
+		...tool.extra,
 		installed: true,
-		version: parseVersion(version.stdout),
-		executablePath: version.path
+		version: tool.version,
+		executablePath: tool.path
 	};
-	let auth = parseGhAuthJson((await exec("gh", [
+	let auth = parseGhAuthJson((await exec(tool.path, [
 		"auth",
 		"status",
 		"--json",
 		"hosts"
 	], { timeoutMs: 1e4 })).stdout);
 	if (!auth) {
-		const text = await exec("gh", ["auth", "status"], { timeoutMs: 1e4 });
-		auth = parseGhAuthText(text.code, `${text.stdout}\n${text.stderr}`);
+		const text = await exec(tool.path, ["auth", "status"], { timeoutMs: 1e4 });
+		auth = parseGhAuthText(text.code, `${text.stdout}
+${text.stderr}`);
 	}
 	if (!auth.loggedIn) return {
 		...installed,
 		loggedIn: false,
 		state: "missing",
 		message: "Not signed in to GitHub",
-		fix: loginFix("gh")
+		fix: loginFix("gh", shell, tool.path)
 	};
 	return {
 		...installed,
@@ -57576,7 +59601,7 @@ var SetupService = class {
 			...this.cached,
 			setupCompleted: this.deps.settings.get().setup.completed
 		};
-		this.running ??= this.runChecks().finally(() => {
+		this.running ??= this.refreshThenCheck(opts.refresh === true).finally(() => {
 			this.running = void 0;
 		});
 		return this.running;
@@ -57589,18 +59614,35 @@ var SetupService = class {
 		} });
 		return true;
 	}
-	/** The command to run in a terminal to sign `tool` in. */
+	/**
+	* The command to run in a terminal to sign `tool` in: the copy the last check found, by
+	* its full path, so the terminal's own PATH lookup is not involved.
+	*/
 	loginCommand(tool) {
-		const [command, ...args] = LOGIN_COMMANDS[tool];
+		const check = this.cached?.checks.find((c) => c.id === tool);
+		const program = check?.installed ? check.executablePath : null;
+		const args = LOGIN_COMMANDS[tool].slice(1);
 		return {
 			tool,
-			command: [command, ...args].join(" "),
+			command: loginCommandLine(tool, this.shell(), program),
 			args
 		};
 	}
+	async refreshThenCheck(refresh) {
+		if (refresh) try {
+			await (this.deps.refreshPath ?? refreshProcessPath)();
+		} catch {}
+		return this.runChecks();
+	}
+	shell() {
+		return this.deps.shell ?? defaultShell();
+	}
 	async runChecks() {
+		const userHome = this.deps.userHome;
 		const env = {
 			exec: this.deps.exec,
+			locate: this.deps.locate ?? ((name) => findExecutable(name, { home: userHome })),
+			shell: this.shell(),
 			platform: this.deps.platform ?? process.platform,
 			nodeVersion: this.deps.nodeVersion ?? process.version,
 			now: this.now(),
@@ -58300,7 +60342,7 @@ function billingFromSetup(status) {
 // ../server/src/services/usage/prices.ts
 const ANTHROPIC = "https://platform.claude.com/docs/en/about-claude/pricing";
 const OPENAI = "https://developers.openai.com/api/docs/pricing";
-const AS_OF = "2026-11-07";
+const AS_OF = "2026-11-10";
 function table(provider, sourceUrl, rows) {
 	return rows.map(([model, label, input, output, read, write]) => ({
 		provider,
@@ -58321,6 +60363,14 @@ function table(provider, sourceUrl, rows) {
 * override or add models in the usage settings.
 */
 const BUNDLED_PRICES = [...table("claude", ANTHROPIC, [
+	[
+		"claude-fable-5-2",
+		"Fable 5.2",
+		8,
+		40,
+		.2,
+		10
+	],
 	[
 		"claude-fable-5-1",
 		"Fable 5.1",
@@ -58449,6 +60499,14 @@ const BUNDLED_PRICES = [...table("claude", ANTHROPIC, [
 		.1,
 		1.25
 	],
+	[
+		"fable",
+		"Fable (latest)",
+		8,
+		40,
+		.2,
+		10
+	],
 	[
 		"opus",
 		"Opus (latest)",
@@ -60159,14 +62217,15 @@ function createServices(opts) {
 		db: opts.db,
 		store: opts.store,
 		waitMs: opts.askUserWaitMs,
-		sendMessage: () => async (sessionId, text) => {
+		sendMessage: () => async (sessionId, text, by) => {
+			const input = by === "pm" ? messageFrom("pm", text) : {
+				text,
+				attachments: []
+			};
 			await sessions?.send(sessionId, {
-				input: {
-					text,
-					attachments: []
-				},
+				input,
 				whenBusy: "queue"
-			});
+			}, by);
 		}
 	});
 	let sessions;
@@ -60238,6 +62297,9 @@ function createServices(opts) {
 	const setup = new SetupService({
 		exec,
 		settings: opts.settings,
+		locate: opts.locate ?? (opts.exec ? execLocate(opts.exec) : void 0),
+		refreshPath: opts.refreshPath,
+		userHome,
 		onChecked: () => redetectProviders(opts.runner, opts.log)
 	});
 	const claudeSdk = new ClaudeSdkService({
@@ -60306,9 +62368,19 @@ function createServices(opts) {
 		store: opts.store,
 		settings: () => opts.settings.get(),
 		stopSession: (id) => sessions.stop(id),
+		inbox,
 		...opts.worktreeCleanup,
 		log: opts.log
 	});
+	const unwatchedApprovals = new UnwatchedApprovals({
+		store: opts.store,
+		repo: sessionRepo,
+		projects,
+		inbox,
+		respond: (id, req) => sessions.respond(id, req),
+		...opts.unwatchedApprovals,
+		log: opts.log
+	});
 	const services = {
 		db: opts.db,
 		store: opts.store,
@@ -60334,7 +62406,9 @@ function createServices(opts) {
 		artifacts,
 		browser: new BrowserService({
 			runner: opts.runner,
-			repo: sessionRepo
+			repo: sessionRepo,
+			settings: () => opts.settings.get(),
+			log: opts.log
 		}),
 		updates: createUpdates(opts),
 		images: new ImageService({
@@ -60358,6 +62432,30 @@ function createServices(opts) {
 		usage,
 		factory,
 		worktreeCleanup,
+		unwatchedApprovals,
+		prFeedback: new PrFeedbackService({
+			store: opts.store,
+			repo: sessionRepo,
+			settings: () => opts.settings.get(),
+			send: (id, input) => sessions.send(id, {
+				input,
+				whenBusy: "queue"
+			}, "codeden"),
+			log: opts.log
+		}),
+		autoRetry: new AutoRetry({
+			db: opts.db,
+			store: opts.store,
+			repo: sessionRepo,
+			inbox,
+			settings: () => opts.settings.get(),
+			send: (id, input) => sessions.send(id, {
+				input,
+				whenBusy: "queue"
+			}, "codeden"),
+			...opts.autoRetry,
+			log: opts.log
+		}),
 		configFiles: new ConfigFiles({
 			projects,
 			home: userHome,
@@ -60555,6 +62653,8 @@ async function startServer(opts) {
 		runner: runnerPort(() => runner),
 		secrets,
 		exec: opts.exec,
+		locate: opts.locate,
+		refreshPath: opts.refreshPath,
 		utility: opts.utility,
 		userHome: opts.userHome,
 		projectsDir: opts.projectsDir,
@@ -60569,6 +62669,7 @@ async function startServer(opts) {
 		selfUpdate: opts.selfUpdate,
 		updates: opts.updates,
 		worktreeCleanup: opts.worktreeCleanup,
+		autoRetry: opts.autoRetry,
 		log
 	});
 	services.images.refresh();
@@ -60580,6 +62681,9 @@ async function startServer(opts) {
 	services.automations.start();
 	services.factory.start();
 	services.worktreeCleanup.start();
+	services.unwatchedApprovals.start();
+	services.prFeedback.start();
+	services.autoRetry.start();
 	const stopUpdateEvents = services.updates.onChange((status) => hub.broadcastUpdate(status));
 	services.updates.start();
 	let baseOrigins = /* @__PURE__ */ new Set();
@@ -60608,7 +62712,7 @@ async function startServer(opts) {
 		cookieName: tokenCookie,
 		allowedOrigins,
 		publicPaths: /* @__PURE__ */ new Set(["/api/health", "/mcp"]),
-		loopbackOnlyPaths: /* @__PURE__ */ new Set(["/mcp"]),
+		loopbackOnlyPaths: /* @__PURE__ */ new Set(["/mcp", ...BROWSER_LOOPBACK_ONLY_PATHS]),
 		remote: {
 			enabled: () => network.enabled,
 			ownHosts: () => network.ownHosts(),
@@ -60659,22 +62763,7 @@ async function startServer(opts) {
 		} }, 400);
 		return upgradeWebSocket(() => terminals.handlers(query.data))(c, next);
 	});
-	const browserBridge = new BrowserBridge({
-		browser: services.browser,
-		log
-	});
-	app.get("/ws/browser", async (c, next) => {
-		const query = BrowserWsQuery.safeParse(c.req.query());
-		if (!query.success) return c.json({ error: {
-			code: "bad_request",
-			message: "Invalid browser query"
-		} }, 400);
-		if (!services.sessionRepo.find(query.data.sessionId)) return c.json({ error: {
-			code: "session_not_found",
-			message: "No such session"
-		} }, 404);
-		return upgradeWebSocket(() => browserBridge.handlers(query.data))(c, next);
-	});
+	const browserBridge = mountBrowserSockets(app, services, log);
 	mountWeb(app, findWebDir(opts.webDir));
 	if (network.store.enabled && !network.store.passwordSet) log("network access is on but no password is set: listening on 127.0.0.1 only");
 	port = await listener.listen(opts.port, network.desiredHost());
@@ -60723,6 +62812,9 @@ async function startServer(opts) {
 			services.automations.stop();
 			services.factory.stop();
 			services.worktreeCleanup.stop();
+			services.unwatchedApprovals.stop();
+			services.prFeedback.stop();
+			services.autoRetry.stop();
 			services.updates.stop();
 			await services.localStt.stop();
 			stopUpdateEvents();
@@ -61612,4 +63704,4 @@ main().then((code) => process.exit(code), (error) => {
 });
 export {};
 
-//# sourceMappingURL=main-CKLHi4sz.js.map
+//# sourceMappingURL=main-BQwSt6Az.js.map