copilot-operator 0.1.12 → 0.1.15

package/dist/src/api/operator.service.js

@@ -17,16 +17,14 @@ import { readFile, readdir } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { installLayout } from '../config/layout.js';
-import { SessionStore, DEFAULT_VCS, DEFAULT_REVIEW, applyTaskPatch } from '../session/store.js';
+import { SessionStore, DEFAULT_VCS, DEFAULT_REVIEW, applyDefaultProject, applyTaskPatch } from '../session/store.js';
 import { EventBus } from '../session/events.js';
 import { isContinuable, newId } from '../session/model.js';
 import { runSession, openBrowser, queuedToRun } from '../orchestrator/taskRunner.js';
 import { buildExport } from '../session/exportRecord.js';
 import { buildDebugExport } from '../session/debugExport.js';
-import { buildPlanExport, buildDomainExport, buildBotExport, buildBundleExport, exportFileName, exportMachine, taskAtAttempt, withTask, writeAttemptRecord } from '../session/exports.js';
+import { buildPlanExport, buildDomainExport, buildBotExport, buildBundleExport, exportFileName, exportMachine, runScope, taskAtAttempt, taskInRun, withTask, writeAttemptRecord } from '../session/exports.js';
 import { suggestRunName } from '../session/runName.js';
-import { mirrorAllProjects, removeProjectMirrors, contextRoot } from '../context/desktopMirror.js';
-import { describeMirror } from '../context/projectMirror.js';
 import { buildStory } from '../session/story.js';
 import { checkPlan } from '../plan/schema.js';
 import { planBrief } from '../plan/brief.js';
@@ -37,10 +35,9 @@ function sameFolder(a, b) {
 }
 import { importPlan, plannedSessionSignature, taskSignature } from '../plan/importPlan.js';
 import { readInterruption } from '../session/interruption.js';
-import { commitInterrupted, repoDirOf, vcsPreflight, restorePreview, restoreToBase, sessionBranches } from '../vcs/taskVcs.js';
-import { changedFilesBetween, fileAt, gitAvailable, repoUnusableReason } from '../vcs/git.js';
+import { branchAt, commitInterrupted, repoDirOf, vcsPreflight, restorePoint, restorePreview, restoreToBase, sessionBranches, sessionBranchName } from '../vcs/taskVcs.js';
+import { branchExists, changedFilesBetween, fileAt, freeBranchName, gitAvailable, localBranches, plannedBranchName, repoUnusableReason } from '../vcs/git.js';
 import { makeAuthorizer } from '../exec/authorizer.js';
-import { listSelectableDirs, collectFiles, findSelectionConflicts, describeConflicts, DEFAULT_IGNORE_DIRS } from '../context/projectMirror.js';
 import { pickFolder } from './folderPicker.js';
 import { findEdgeUsingProfile } from '../transport/profileLock.js';
 import { assessIsolation, readIsolationSignals, unattendedIsolationRefusal } from '../exec/isolation.js';
@@ -49,21 +46,128 @@ import { createTransport } from '../transport/chatTransport.js';
 import { composeHandoff } from '../session/handoff.js';
 import { planSync } from '../vcs/syncCommand.js';
 import { computeMetrics } from '../session/metrics.js';
-import { resolveDesktopDir, desktopIsSynced } from '../context/contextFiles.js';
+import { resolveDesktopDir, desktopIsSynced } from '../context/desktopDir.js';
 import { saveAndReveal } from './saveToDesktop.js';
-import { Settings } from './settings.js';
+import { settingsOf } from './settings.js';
+/**
+ * Why the browser cannot be had now, said in terms of what was pressed. The sentences a start, a
+ * batch and the model picker gave before there was one rule for all three are kept where they still
+ * apply, so the page reads as it did.
+ */
+function browserRefusal(held, ask) {
+    const modelsWhileRunning = 'A session is running and it is using the browser profile. Stop it first, then read the models.';
+    if (held.kind === 'batch') {
+        if (ask.kind === 'models')
+            return modelsWhileRunning;
+        return ask.kind === 'batch' ? 'a batch is already running' : 'a batch of sessions is running';
+    }
+    if (held.kind === 'models') {
+        return ask.kind === 'models'
+            ? 'The model list is already being read.'
+            : 'the model list is being read from the chat, which has the browser; start this once it has finished';
+    }
+    // A session running on its own.
+    if (ask.kind === 'models')
+        return modelsWhileRunning;
+    if (ask.kind === 'run') {
+        return ask.sessionId === held.sessionId
+            ? 'already running'
+            : 'another session is running, and the browser takes one run at a time; start this one once it has finished';
+    }
+    return ask.sessionIds.includes(held.sessionId)
+        ? 'one of the selected sessions is already running on its own'
+        : 'a session is running on its own, and the browser takes one run at a time; start the batch once it has finished';
+}
 /** A folder as compared: absolute, forward slashes, no trailing slash, and case folded as Windows does. */
 function normaliseDir(dir) {
     if (!dir.trim())
         return '';
     return resolve(dir.trim()).replace(/\\/g, '/').replace(/\/+$/, '').toLowerCase();
 }
+/** The repository a planned session will work in, read the way `repoDirOf` reads an imported one. */
+function plannedRepoDir(session) {
+    return session.vcs?.repoDir?.trim() || session.projectDir?.trim() || session.mirror?.rootDir?.trim() || '';
+}
+/**
+ * The branches a planned session will make by name when it runs, as `prepareForTask` names them.
+ *
+ * None with version control off, and none when it carries on an existing branch, which makes
+ * nothing. In per-session mode the one `branchName`; in per-task mode the branch each task names,
+ * since `branchName` is ignored there. A branch named for the session's id is not known before the
+ * import, and is not one a plan can ask to carry on.
+ */
+function branchesMadeBy(session) {
+    const vcs = session.vcs;
+    if (!vcs || vcs.enabled === false || vcs.startFrom === 'existing-branch' || vcs.existingBranch?.trim())
+        return [];
+    const prefix = vcs.branchPrefix?.trim() || 'cop/';
+    if (vcs.branchMode === 'per-session')
+        return vcs.branchName?.trim() ? [plannedBranchName(vcs.branchName, prefix)] : [];
+    return session.tasks.flatMap((t) => (t.vcs?.branch?.trim() ? [plannedBranchName(t.vcs.branch, prefix)] : []));
+}
+/**
+ * The one restore each repository gets when a run starts again from a task: the rule, in one place,
+ * for the preview and for the restore itself, which used to keep a copy each and drifted apart.
+ *
+ * One per repository, keyed on the folder as compared rather than on the path as written or on the
+ * session: three sessions working in one repository must not take it back three times to three
+ * different commits. The earliest affected task that ran is the one that decides, because that is
+ * the state the whole re-run starts from.
+ *
+ * A repository whose affected tasks never ran has nothing to go back to: the run never touched it.
+ * Taking "no base commit recorded" as a refusal blocked "run again from here" for every plan whose
+ * later sessions had not started yet — which is the usual shape of a run that stopped in the middle.
+ *
+ * A session that carries on an existing branch cannot be taken back: its run checks that branch out
+ * again before the first task, so a restore branch would be left the moment it was made, and going
+ * back on the branch itself would take a reset, which this tool never does. That holds for every
+ * session of the repository the run reached, not only the one that decides where it goes back to:
+ * a later one carrying on a branch would run its tasks again on top of what they did the first
+ * time, which is not "the code goes back first" either. So the repository's restore carries the
+ * problem of the first such session, and the preview and the restart refuse before anything moves.
+ */
+function restoreTargets(tasks) {
+    const byRepo = new Map();
+    for (const { session, task } of tasks) {
+        if (!session.vcs?.enabled || !task.startedAt)
+            continue;
+        const dir = repoDirOf(session);
+        const key = normaliseDir(dir);
+        if (!key)
+            continue;
+        const target = byRepo.get(key) ?? { dir, session, task };
+        byRepo.set(key, target);
+        const existing = session.vcs.startFrom === 'existing-branch' ? (session.vcs.existingBranch ?? '').trim() : '';
+        if (existing && !target.problem) {
+            target.problem =
+                `"${session.name}" carries on the existing branch ${existing}, and its run checks that branch out again, so the code ` +
+                    `would not stay back; going back on ${existing} itself would take a reset, which this tool never does. ` +
+                    `Queue its tasks again with "Run again" on each, which carries on ${existing} as it is, or move that branch yourself first.`;
+        }
+    }
+    return [...byRepo.values()];
+}
+/** Whether two folders, as `normaliseDir` gives them, are one folder or one is inside the other. */
+function overlaps(a, b) {
+    return a === b || a.startsWith(`${b}/`) || b.startsWith(`${a}/`);
+}
+/**
+ * The reason a restart stopped, with what it had already done by then.
+ *
+ * A repository taken back and tasks queued again stay so when a later step refuses — nothing here
+ * undoes them — and the reason is the one thing the page shows. Said only in the result, they were
+ * left for the operator to find in git and in the queue.
+ */
+function afterMoves(reason, restored, requeued) {
+    const done = [...restored.map((r) => `taken back ${r}`), ...(requeued > 0 ? [`${requeued} task(s) queued again`] : [])];
+    return done.length > 0 ? `${reason} Already done, and left as it is: ${done.join('; ')}.` : reason;
+}
 let OperatorService = class OperatorService {
     /** Where this install keeps its prompts and its records. See `config/layout.ts`. */
     layout = installLayout();
     projectRoot = this.layout.projectRoot;
     dataDir = this.layout.dataDir;
-    settings = new Settings(this.projectRoot, this.dataDir, this.layout.mode === 'package' ? { runsDir: this.layout.runsDir, level1File: join(this.layout.promptsDir, 'level1.md') } : {});
+    settings = settingsOf(this.layout);
     store = new SessionStore(this.dataDir, join(this.layout.promptsDir, 'level1.md'));
     bus = new EventBus();
     running = new Map();
@@ -71,8 +175,21 @@ let OperatorService = class OperatorService {
     /** The batch in progress, or the last one that finished. At most one ever exists. */
     batch = null;
     ready = null;
-    /** One model read at a time: it launches a browser and holds the profile lock. */
-    readingModels = false;
+    /**
+     * What has the browser now: one session's run, a batch, or a read of the model list.
+     *
+     * The Edge profile takes one writer, and every way into a chat window goes through here: a
+     * start, a batch, and reading the models. Each used to look only at its own kind — a start
+     * refused only while a batch ran, a batch only a second batch — so while one session ran on its
+     * own, starting another or a batch of others opened a second window on the same profile, which
+     * fails minutes later with a message about a closed browser. The profile lock is no help inside
+     * one process: it waves through a lock this process already holds.
+     *
+     * Taken at the entrance before its first wait, so two presses that arrive together cannot both
+     * find it free, and given back when the window it was taken for has closed or the entrance has
+     * refused. See `claimBrowser`.
+     */
+    browser = null;
     /**
      * One-time startup work, run lazily on the first request that needs the store.
      *
@@ -207,30 +324,32 @@ let OperatorService = class OperatorService {
         const pending = [...this.waiting.values()].filter((w) => w.approval.sessionId === id).map((w) => w.approval);
         return { ...s, running: this.running.has(id), pending, runMode: this.running.get(id)?.mode };
     }
-    async createSession(name, mirror) {
+    async createSession(name, folder) {
         await this.init();
-        if (mirror)
-            assertMirrorIsCoherent(mirror);
-        const session = await this.store.createSession(name, mirror);
+        // Read before the session is made: a settings file that cannot be read refuses the request,
+        // and a refusal must leave nothing behind, or each retry adds a session with no project.
+        const cfg = await this.settings.load();
+        const session = await this.store.createSession(name, folder ?? '');
         /*
          * The models are not written onto a new session. A session with no model of its own uses the
          * one chosen in Settings at the time it runs (see `effectiveModels` in taskRunner.ts), so
          * choosing a model there reaches every such session, the ones created before it included.
          * It used to be copied here, which meant a model chosen after an import reached nothing.
          */
-        const cfg = await this.settings.load();
         const projectDir = (cfg.project?.rootDir ?? '').trim();
-        if (!projectDir)
-            return session;
         return await this.store.updateSession(session.id, (s) => {
-            if (projectDir) {
-                // Both fields, because they answer different questions about the same folder: where the
-                // files are and where the branches go. Neither is switched on by being filled in.
-                if (!s.mirror.rootDir.trim())
-                    s.mirror.rootDir = projectDir;
-                if (s.vcs && !s.vcs.repoDir.trim())
-                    s.vcs.repoDir = projectDir;
-            }
+            /*
+             * A folder given here is the session's repository too, in the shape a session made on the
+             * Project page's folder has: both fields, one folder. Left empty, every reader that follows
+             * `repoDirOf` found the folder, but the review read `vcs.repoDir` itself, and was told there
+             * was no repository and no changed files for work committed in that folder. The review asks
+             * `trackedRepoOf` now, so a session saved with `repoDir` empty is read right as well; this
+             * keeps the record saying what the session works in.
+             */
+            if (s.projectDir.trim() && s.vcs && !s.vcs.repoDir.trim())
+                s.vcs.repoDir = s.projectDir;
+            // The same rule an import applies, for a session given no folder; see `applyDefaultProject`.
+            applyDefaultProject(s, projectDir);
         });
     }
     async updateSession(id, patch) {
@@ -259,11 +378,8 @@ let OperatorService = class OperatorService {
                 const merged = { ...DEFAULT_REVIEW, ...s.review, ...patch.review };
                 s.review = { enabled: merged.enabled !== false, model: (merged.model ?? '').trim() };
             }
-            if (patch.mirror) {
-                const merged = { ...s.mirror, ...patch.mirror };
-                assertMirrorIsCoherent(merged);
-                s.mirror = merged;
-            }
+            if (patch.projectDir !== undefined)
+                s.projectDir = patch.projectDir.trim();
             if (patch.vcs) {
                 const merged = { ...DEFAULT_VCS, ...s.vcs, ...patch.vcs };
                 // A prefix is what makes the bot's branches recognisable in `git branch`, so an empty
@@ -271,12 +387,20 @@ let OperatorService = class OperatorService {
                 merged.branchPrefix = merged.branchPrefix.trim() || DEFAULT_VCS.branchPrefix;
                 merged.repoDir = merged.repoDir.trim();
                 if (merged.enabled) {
-                    const reason = repoUnusableReason(merged.repoDir || s.mirror.rootDir || '');
+                    const reason = repoUnusableReason(merged.repoDir || s.projectDir || '');
                     if (reason)
                         throw new Error(reason);
                 }
                 if (merged.baseBranch !== undefined)
                     merged.baseBranch = merged.baseBranch.trim();
+                if (merged.existingBranch !== undefined)
+                    merged.existingBranch = merged.existingBranch.trim();
+                // Only the program marks a name as one of its own branches, and a name changed is not that one.
+                const stillOwn = !!s.vcs?.branchNameExact && (merged.branchName ?? '').trim() === (s.vcs.branchName ?? '').trim();
+                if (stillOwn)
+                    merged.branchNameExact = true;
+                else
+                    delete merged.branchNameExact;
                 /*
                  * Where the session starts is fixed at its first run. A new choice clears that record, so
                  * the next task to run is cut from what was chosen now; the tasks that already ran keep
@@ -284,6 +408,8 @@ let OperatorService = class OperatorService {
                  */
                 const startChanged = (merged.startFrom ?? 'head') !== (s.vcs?.startFrom ?? 'head') ||
                     (merged.baseBranch || 'main') !== (s.vcs?.baseBranch || 'main') ||
+                    (merged.existingBranch ?? '') !== (s.vcs?.existingBranch ?? '') ||
+                    (merged.updateFromRemote !== false) !== (s.vcs?.updateFromRemote !== false) ||
                     merged.repoDir.toLowerCase() !== (s.vcs?.repoDir ?? '').trim().toLowerCase();
                 if (startChanged) {
                     s.vcsBaseCommit = undefined;
@@ -607,15 +733,17 @@ let OperatorService = class OperatorService {
                 .sort((a, b) => (a.runGroup?.id === runId ? (a.runGroup.order ?? 0) : 0) - (b.runGroup?.id === runId ? (b.runGroup.order ?? 0) : 0));
             if (sessions.length === 0)
                 throw new Error(`No session took part in run ${runId}.`);
-            const group = sessions.map((s) => s.runGroup).find((g) => g?.id === runId);
+            /*
+             * The run's name and start, from a session's own record of the run — or, once a later run has
+             * replaced that record, from a task that ran in it, which carries both. Without the second,
+             * the earlier run's file was called "run-" with nothing after it, the kind of name nobody
+             * finds again.
+             */
+            const group = sessions.map((s) => s.runGroup).find((g) => g?.id === runId) ??
+                sessions.flatMap((s) => s.tasks.map((t) => taskInRun(t, runId)?.runGroup)).find((g) => g?.id === runId);
             const name = group?.name?.trim() || `run-${(group?.startedAt ?? '').slice(0, 16).replace(/[:T]/g, '-')}`;
-            scope = {
-                sessions,
-                // A task belongs to the run if this attempt ran in it, or if it was queued for it and
-                // never reached — that second kind is what the run's own record on the session is for.
-                taskFilter: (s, t) => t.runGroup?.id === runId || (s.runGroup?.id === runId && s.runGroup.taskIds.includes(t.id)),
-                label: name,
-            };
+            // Each task as it ended in this run, not as it is now; see `runScope`.
+            scope = runScope(sessions, runId, name);
         }
         else if (where.sessionId) {
             const session = await this.store.getSession(where.sessionId);
@@ -700,34 +828,56 @@ let OperatorService = class OperatorService {
     isRunning(sessionId) {
         return this.running.has(sessionId);
     }
+    /**
+     * Takes the browser for `ask`, or says why it cannot have it. Synchronous on purpose (see
+     * `browser`). What it hands back is what `releaseBrowser` is given, so a release that comes late
+     * cannot free a browser somebody else has taken since.
+     */
+    claimBrowser(ask) {
+        if (this.browser)
+            return { refused: browserRefusal(this.browser, ask) };
+        const holder = ask.kind === 'run' ? { kind: 'run', sessionId: ask.sessionId } : { kind: ask.kind };
+        this.browser = holder;
+        return { holder };
+    }
+    releaseBrowser(holder) {
+        if (this.browser === holder)
+            this.browser = null;
+    }
     /**
      * Starts the session's queued tasks in the background. Returns immediately; progress
-     * arrives on the event stream. One run per session at a time.
+     * arrives on the event stream. One run at a time, of this session or any other.
      */
     async start(sessionId, mode = 'confirm', name) {
         // One conversation at a time is not a policy, it is the browser profile: a second run
-        // does not get a second browser, it gets an error about a closed one. A batch already
-        // holds that turn, so a single session asking for it now is refused where the reason can
-        // still be read, rather than three minutes later in a stack trace.
-        if (this.batch?.running)
-            return { started: false, reason: 'a batch of sessions is running' };
-        // A run nobody named is named after what it is a run of, rather than left to show up in the
-        // register as "Unnamed run" beside five others of the same description.
-        const chosenName = name?.trim() || (await this.suggestRunName([sessionId]));
-        const runGroup = { id: newId('r-'), startedAt: new Date().toISOString(), sessions: 1, name: chosenName };
-        // A run of one is still a run, and it records the same thing a batch does, so that going
-        // back and starting again from a task works the same whether one session was started or six.
-        await this.store.updateSession(sessionId, (s) => {
-            s.runGroup = {
-                ...runGroup,
-                order: 0,
-                taskIds: s.tasks.filter((t) => t.status === 'queued').map((t) => t.id),
-                mode,
-                onFailure: s.onFailure === 'continue' ? 'continue' : 'stop',
-            };
-        });
-        const begun = await this.beginRun(sessionId, mode, undefined, runGroup);
-        return { started: begun.started, reason: begun.reason };
+        // does not get a second browser, it gets an error about a closed one. Whatever has the
+        // browser now — a batch, another session, a read of the models — the start is refused where
+        // the reason can still be read, rather than three minutes later in a stack trace.
+        const claim = this.claimBrowser({ kind: 'run', sessionId });
+        if ('refused' in claim)
+            return { started: false, reason: claim.refused };
+        try {
+            // A run nobody named is named after what it is a run of, rather than left to show up in the
+            // register as "Unnamed run" beside five others of the same description.
+            const chosenName = name?.trim() || (await this.suggestRunName([sessionId]));
+            const runGroup = { id: newId('r-'), startedAt: new Date().toISOString(), sessions: 1, name: chosenName };
+            // A run of one is still a run, and it records the same thing a batch does, so that going
+            // back and starting again from a task works the same whether one session was started or six.
+            // Recorded by `beginRun` once the start is accepted, not here: see `recordOnSession`.
+            const begun = await this.beginRun(sessionId, mode, undefined, runGroup, undefined, { recordOnSession: true });
+            if (!begun.started) {
+                this.releaseBrowser(claim.holder);
+                return { started: false, reason: begun.reason };
+            }
+            // The window closes before the run's promise settles (see `runSession`), so the browser is
+            // free again exactly when it is.
+            void begun.done.finally(() => this.releaseBrowser(claim.holder));
+            return { started: true };
+        }
+        catch (e) {
+            this.releaseBrowser(claim.holder);
+            throw e;
+        }
     }
     /**
      * The same thing `start` does, but it also hands back a promise that settles when the run
@@ -744,12 +894,8 @@ let OperatorService = class OperatorService {
     /** The press of a start button this belongs to, stamped onto every task it reaches. */
     runGroup, 
     /** Only these queued tasks, when the operator chose some; the rest stay queued. */
-    onlyTasks) {
+    onlyTasks, how = {}) {
         await this.init();
-        // Every project's Desktop copy brought up to date before the chat opens, when the operator
-        // asked for that. Before the run rather than before each task: a task's own mirror already
-        // refreshes its project, and the other projects do not change while the bot works.
-        await this.refreshDesktopMirrors();
         const idle = { ran: 0, failed: 0, leftQueued: 0, failedTitles: [] };
         if (this.running.has(sessionId))
             return { started: false, reason: 'already running', done: Promise.resolve(idle) };
@@ -782,6 +928,12 @@ let OperatorService = class OperatorService {
         const precondition = unattendedPrecondition(policy);
         if (precondition)
             return { started: false, reason: precondition, done: Promise.resolve(idle) };
+        if (how.recordOnSession && runGroup) {
+            // The tasks this run takes, as worked out above, so the record and the run cannot disagree.
+            await this.store.updateSession(sessionId, (s) => {
+                s.runGroup = { ...runGroup, order: 0, taskIds: queuedIds, mode, onFailure: s.onFailure === 'continue' ? 'continue' : 'stop' };
+            });
+        }
         const controller = new AbortController();
         /*
          * The same authorizer in both modes. It used to be `unattendedAuthorizer` here for an unattended
@@ -809,14 +961,13 @@ let OperatorService = class OperatorService {
             bus: this.bus,
             authorizer,
             signal: controller.signal,
-            // Read between tasks, so the one in flight finishes properly first. The batch owns the
-            // flag, because a pause is about the whole run and not about this session.
-            shouldPause: () => !!this.batch?.pausing,
+            // Read between tasks, so the one in flight finishes properly first. The batch that owns
+            // this run answers it, because a pause is about the whole run and not about this session.
+            shouldPause: how.shouldPause,
             // The mode as it is now, not as it was: "run the rest without asking" changes it mid-run,
             // and the policy.json of a later task must say so.
             currentMode: () => this.running.get(sessionId)?.mode ?? mode,
             // The Desktop copies follow the work while it happens, not only before the run.
-            onWorkChanged: () => this.requestDesktopRefresh(),
             // The session decides whether its tasks are one chain or a set of independent checks.
             continueOnFailure: session.onFailure === 'continue',
             transport,
@@ -931,20 +1082,64 @@ let OperatorService = class OperatorService {
      * tasks nobody chose stay queued exactly as they were. Absent means every queued task.
      */
     taskIds) {
-        await this.init();
-        const onlyTasks = taskIds && taskIds.length > 0 ? new Set(taskIds.map((t) => t.trim()).filter(Boolean)) : undefined;
-        if (this.batch?.running)
-            return { started: false, reason: 'a batch is already running' };
         const wanted = [...new Set(sessionIds.map((s) => s.trim()).filter(Boolean))];
-        if (wanted.length === 0)
-            return { started: false, reason: 'no sessions were selected' };
+        // Before anything is waited for (see `browser`): a second batch, a session running on its own
+        // — one of these or any other — and a read of the models all have the browser already.
+        const claim = this.claimBrowser({ kind: 'batch', sessionIds: wanted });
+        if ('refused' in claim)
+            return { started: false, reason: claim.refused };
+        return await this.startBatchHolding(claim.holder, wanted, mode, onFailure, model, reviewModel, name, taskIds);
+    }
+    /**
+     * `startBatch` for a caller that has claimed the browser already, and the claim with it: handed on
+     * to the batch once it is under way (`runBatch` gives it back), and given back here on every
+     * refusal. "Run again from here" claims it before it moves anything and starts through this, so
+     * one claim covers the restore, the requeue and the run.
+     */
+    async startBatchHolding(holder, wanted, mode, onFailure, model, reviewModel, name, taskIds) {
+        const onlyTasks = taskIds && taskIds.length > 0 ? new Set(taskIds.map((t) => t.trim()).filter(Boolean)) : undefined;
+        let handedOn = false;
+        try {
+            await this.init();
+            if (wanted.length === 0)
+                return { started: false, reason: 'no sessions were selected' };
+            const begun = await this.prepareBatch(wanted, onlyTasks, mode, onFailure, model, reviewModel, name);
+            if (!begun.batch)
+                return { started: false, reason: begun.reason };
+            this.batch = begun.batch;
+            handedOn = true;
+            void this.runBatch(begun.batch, holder);
+            return { started: true, batch: this.batchState() };
+        }
+        finally {
+            if (!handedOn)
+                this.releaseBrowser(holder);
+        }
+    }
+    /**
+     * Why a batch in this mode may not begin on this machine now, or null when it may: the entrance
+     * rule (`unattendedPrecondition`) asked of the settings as they are at this moment. One place, for
+     * the batch and for "Run again from here", which has to ask it before it moves anything.
+     */
+    async unattendedRefusal(mode) {
+        const cfg = await this.settings.load();
+        return unattendedPrecondition({
+            mode,
+            allowedPrograms: cfg.execution.allowedPrograms,
+            isolation: cfg.execution.isolation,
+            lockedToConfirm: cfg.policyLock?.maxMode === 'confirm',
+        });
+    }
+    /**
+     * Everything `startBatch` decides before the batch exists: which sessions it has work in, whether
+     * an unattended run may begin, and the models the run panel chose. A refusal comes back as the
+     * reason; nothing is started here.
+     */
+    async prepareBatch(wanted, onlyTasks, mode, onFailure, model, reviewModel, name) {
         // Worked out here rather than asked of the operator again: every way into this — the run
         // panel, continuing after a failure, "Run again from here" — either has a field they may
         // have left empty or has no field at all.
         const chosenName = name?.trim() || (await this.suggestRunName(wanted));
-        if (wanted.some((id) => this.running.has(id))) {
-            return { started: false, reason: 'one of the selected sessions is already running on its own' };
-        }
         const sessions = [];
         for (const id of wanted) {
             const s = await this.store.getSession(id);
@@ -958,7 +1153,7 @@ let OperatorService = class OperatorService {
                 : { sessionId: id, name: s.name, state: 'waiting', ran: 0, failed: 0 });
         }
         if (!sessions.some((s) => s.state === 'waiting')) {
-            return { started: false, reason: 'none of the selected sessions has a queued task' };
+            return { reason: 'none of the selected sessions has a queued task' };
         }
         /*
          * The same entrance rule `start` has, asked here too and for the same reason: before a browser
@@ -968,17 +1163,9 @@ let OperatorService = class OperatorService {
          * session was quietly skipped with the reason held in a batch state nobody was looking at. Asked
          * here, the refusal is the answer to the press, shown under the button that caused it.
          */
-        {
-            const cfg = await this.settings.load();
-            const blocked = unattendedPrecondition({
-                mode,
-                allowedPrograms: cfg.execution.allowedPrograms,
-                isolation: cfg.execution.isolation,
-                lockedToConfirm: cfg.policyLock?.maxMode === 'confirm',
-            });
-            if (blocked)
-                return { started: false, reason: blocked };
-        }
+        const blocked = await this.unattendedRefusal(mode);
+        if (blocked)
+            return { reason: blocked };
         // One model for the whole run, chosen here rather than opened on every session first. It
         // is written onto the sessions instead of being held for the run, so what the session says
         // it will use and what it used are the same thing afterwards — including for anyone who
@@ -1010,20 +1197,20 @@ let OperatorService = class OperatorService {
                 });
             }
         }
-        this.batch = {
-            id: newId('b-'),
-            startedAt: new Date().toISOString(),
-            name: chosenName,
-            ...(onlyTasks ? { onlyTasks: [...onlyTasks] } : {}),
-            mode,
-            onFailure,
-            stopping: false,
-            pausing: false,
-            running: true,
-            sessions,
+        return {
+            batch: {
+                id: newId('b-'),
+                startedAt: new Date().toISOString(),
+                name: chosenName,
+                ...(onlyTasks ? { onlyTasks: [...onlyTasks] } : {}),
+                mode,
+                onFailure,
+                stopping: false,
+                pausing: false,
+                running: true,
+                sessions,
+            },
         };
-        void this.runBatch();
-        return { started: true, batch: this.batchState() };
     }
     /** Stops the session that is running now and leaves the rest of the batch unstarted. */
     /**
@@ -1077,6 +1264,24 @@ let OperatorService = class OperatorService {
             await this.stop(current.sessionId);
         return { stopping: true };
     }
+    /**
+     * Runs a batch that has just been started, and ends what only the batch may end: its hold and
+     * its claim on the browser. Both are let go here, once, however the loop came out — finished,
+     * stopped, failed, or never able to open its window.
+     */
+    async runBatch(batch, holder) {
+        try {
+            await this.batchLoop(batch);
+        }
+        finally {
+            // A pause holds this batch's queue and nothing after it. Left on, it read as "pausing" on a
+            // batch that had ended, and it was what every later run read, so each stopped before its
+            // first task (see `shouldPause` in `beginRun`).
+            batch.pausing = false;
+            // The batch's window is closed by now, in the loop's own ending.
+            this.releaseBrowser(holder);
+        }
+    }
     /**
      * The batch loop. Nothing here runs in parallel, on purpose: see `beginRun`.
      *
@@ -1084,10 +1289,7 @@ let OperatorService = class OperatorService {
      * failure is `done`; one with a failed task is `failed`; one the operator stopped, or one
      * whose chain stopped early with no failure of its own, is `stopped`.
      */
-    async runBatch() {
-        const batch = this.batch;
-        if (!batch)
-            return;
+    async batchLoop(batch) {
         /*
          * One browser for the whole batch.
          *
@@ -1192,7 +1394,11 @@ let OperatorService = class OperatorService {
                     message: `starting as part of a batch of ${batch.sessions.length} session(s), in ${batch.mode} mode`,
                     data: { batchId: batch.id },
                 });
-                const begun = await this.beginRun(entry.sessionId, batch.mode, browser, runGroup, batch.onlyTasks ? new Set(batch.onlyTasks) : undefined);
+                // In the batch's mode as it is now: "run the rest without asking" in an earlier session
+                // switched the batch with it (see `setRunMode`). The hold is this batch's own.
+                const begun = await this.beginRun(entry.sessionId, batch.mode, browser, runGroup, batch.onlyTasks ? new Set(batch.onlyTasks) : undefined, {
+                    shouldPause: () => batch.pausing,
+                });
                 if (!begun.started) {
                     entry.state = 'skipped';
                     entry.reason = begun.reason;
@@ -1297,11 +1503,18 @@ let OperatorService = class OperatorService {
          */
         const cfg = await this.settings.load();
         const unattendedRule = { mode: 'unattended', allowedPrograms: cfg.execution.allowedPrograms, isolation: cfg.execution.isolation, lockedToConfirm: cfg.policyLock?.maxMode === 'confirm' };
+        /*
+         * Which of its refusals it is, asked in the order the rule asks them: the lock, then isolation,
+         * then the allowlist. Anything that was not isolation used to be told as an empty allowlist, so
+         * under a policy lock the brief sent the operator to fill in a list that was already full.
+         */
         const unattendedBlocked = !unattendedPrecondition(unattendedRule)
             ? undefined
-            : unattendedIsolationRefusal('unattended', cfg.execution.isolation)
-                ? 'isolation'
-                : 'allowlist';
+            : unattendedRule.lockedToConfirm
+                ? 'lock'
+                : unattendedIsolationRefusal('unattended', cfg.execution.isolation)
+                    ? 'isolation'
+                    : 'allowlist';
         return {
             text: planBrief({
                 lang,
@@ -1349,7 +1562,7 @@ let OperatorService = class OperatorService {
         check.plan.sessions.forEach((session, i) => {
             if (session.vcs?.enabled === false)
                 return;
-            const dir = session.vcs?.repoDir?.trim() || session.mirror?.rootDir?.trim() || '';
+            const dir = plannedRepoDir(session);
             const reason = repoUnusableReason(dir);
             if (reason)
                 repoIssues.push({ path: `sessions[${i}].vcs.repoDir`, message: reason });
@@ -1361,6 +1574,37 @@ let OperatorService = class OperatorService {
                 });
             }
         });
+        if (repoIssues.length > 0)
+            return { ok: false, issues: repoIssues, warnings: check.warnings, duplicates: [] };
+        /*
+         * A branch to carry on must be there to carry on — unless a session before it in this same plan
+         * is the one that makes it, in this same repository. Refused now, with the branches that are
+         * there, rather than at the first run with a task refused.
+         *
+         * The repository is part of the question. A branch is a branch of one repository, and the name
+         * alone let a branch an earlier session makes somewhere else count here: the plan was accepted,
+         * and the session failed at its first task with "no such local branch" — the failure this check
+         * exists to bring forward.
+         */
+        for (const [i, session] of check.plan.sessions.entries()) {
+            const wanted = session.vcs?.enabled === false ? '' : (session.vcs?.existingBranch ?? '').trim();
+            if (!wanted)
+                continue;
+            const dir = plannedRepoDir(session);
+            const here = normaliseDir(dir);
+            const madeEarlier = check.plan.sessions
+                .slice(0, i)
+                .some((e) => normaliseDir(plannedRepoDir(e)) === here && branchesMadeBy(e).includes(wanted));
+            if (madeEarlier || (await branchExists(dir, wanted)))
+                continue;
+            const have = await localBranches(dir);
+            repoIssues.push({
+                path: `sessions[${i}].vcs.existingBranch`,
+                message: `${dir} has no local branch "${wanted}" to carry on. ` +
+                    (have.length > 0 ? `Its branches: ${have.slice(0, 20).join(', ')}.` : 'It has no branches yet.') +
+                    ' Give the exact name, or use startFrom "branch" to start a new one.',
+            });
+        }
         if (repoIssues.length > 0)
             return { ok: false, issues: repoIssues, warnings: check.warnings, duplicates: [] };
         return { ...check, duplicates: await this.findDuplicates(check.plan) };
@@ -1407,7 +1651,9 @@ let OperatorService = class OperatorService {
          */
         const persona = (await this.getContext('persona', 'en')).content;
         // No default models passed: a session the plan gives no model follows Settings at run time.
-        const result = await importPlan(this.store, check.plan, '', '', persona);
+        // The default project is passed, so a session the plan gives no folder works where one made
+        // on the Sessions page would, and not in execution.cwd.
+        const result = await importPlan(this.store, check.plan, '', '', persona, (cfg.project?.rootDir ?? '').trim());
         return {
             ok: true,
             result: { ...result, warnings: [...check.warnings, ...result.warnings] },
@@ -1478,14 +1724,26 @@ let OperatorService = class OperatorService {
          * one would read.
          */
         run.policy.mode = mode;
+        /*
+         * A batch is one run. The dialog behind "run the rest without asking" says "until this run
+         * ends", and the run the operator started is the batch: the switch used to reach only the
+         * session on screen, and the next session started in the batch's old mode and asked again. So
+         * the sessions the batch has not reached yet start in the mode it is switched to — and back,
+         * when the asking is switched on again. Each still meets the unattended precondition as it
+         * starts (see `beginRun`), under the settings of that moment, and the run recorded on it
+         * (`Session.runGroup`) keeps the mode it was started in.
+         */
+        const batch = this.batch?.running && this.batch.sessions.some((e) => e.sessionId === sessionId && e.state === 'running') ? this.batch : null;
+        if (batch)
+            batch.mode = mode;
         this.bus.publish({
             sessionId,
             type: 'run-mode-changed',
             level: mode === 'unattended' ? 'warn' : 'info',
             message: mode === 'unattended'
-                ? 'the rest of this run will execute without asking; denied patterns are still refused'
-                : 'every further step will be shown for approval again',
-            data: { mode },
+                ? `the rest of this run${batch ? ', the sessions of the batch after this one included,' : ''} will execute without asking; denied patterns are still refused`
+                : `every further step${batch ? ', in this session and the ones of the batch after it,' : ''} will be shown for approval again`,
+            data: { mode, ...(batch ? { batchId: batch.id } : {}) },
         });
         if (mode === 'unattended') {
             for (const [id, w] of this.waiting) {
@@ -1505,6 +1763,12 @@ let OperatorService = class OperatorService {
     }
     webAuthorizer(policy, signal) {
         return makeAuthorizer(policy, (step, ctx, held) => new Promise((resolvePromise) => {
+            // A stopped run answers before anything else, the mode included: "run the rest without
+            // asking" is permission to run the steps of a run that is going, not of one that was stopped.
+            if (signal.aborted) {
+                resolvePromise({ action: 'abort', reason: 'stopped by the operator', by: 'operator' });
+                return;
+            }
             // The operator may have pressed "run the rest without asking" on an earlier step.
             // This is checked per step rather than captured once, which is what makes the switch
             // take effect from the very next step instead of the next run. A held step is the
@@ -1522,17 +1786,13 @@ let OperatorService = class OperatorService {
                 createdAt: new Date().toISOString(),
                 ...(held ? { network: held.network } : {}),
             };
-            if (signal.aborted) {
-                resolvePromise({ action: 'abort', reason: 'stopped by the operator', by: 'operator' });
-                return;
-            }
             this.waiting.set(approval.id, { approval, resolve: resolvePromise });
             this.bus.publish({ sessionId: approval.sessionId, taskId: approval.taskId, type: 'approval-requested', level: 'warn',
                 message: held
                     ? `held for the operator — ${held.network}: ${approval.description}`
                     : `waiting for approval: ${approval.description}`,
                 data: { ...approval } });
-        }));
+        }), signal);
     }
     // --- events ---------------------------------------------------------------------------
     recentEvents(sessionId) {
@@ -1553,7 +1813,10 @@ let OperatorService = class OperatorService {
             return { ok: false, repoDir: '', problem: "git is not installed, or not on this machine's PATH.", git: null };
         // `branch` is where HEAD is; `work` is where the session's work is. After a per-task run
         // those differ, and the second is the one the operator is asking about.
-        return { ...(await vcsPreflight(session)), git, work: sessionBranches(session) };
+        const preflight = await vcsPreflight(session);
+        // The local branches, so "carry on an existing branch" can offer them rather than be typed blind.
+        const branches = preflight.repoDir ? await localBranches(preflight.repoDir) : [];
+        return { ...preflight, git, work: sessionBranches(session), branches };
     }
     /**
      * What going back to before a task would do, and then doing it.
@@ -1569,24 +1832,68 @@ let OperatorService = class OperatorService {
         const task = session.tasks.find((t) => t.id === taskId);
         if (!task)
             throw new Error('No such task.');
-        return await restorePreview(session, task);
+        const preview = await restorePreview(session, task);
+        // Said in the preview too, so the dialog refuses before the operator agrees to anything,
+        // rather than showing what would happen and refusing when they say yes.
+        const refused = await this.restoreRefusal(session);
+        return refused ? { ...preview, ok: false, problem: refused } : preview;
     }
     async restore(sessionId, taskId) {
         await this.init();
-        if (this.running.has(sessionId)) {
-            return { ok: false, problem: 'This session is running. Stop it before moving the repository to another branch.' };
-        }
-        if (this.batch?.running) {
-            return { ok: false, problem: 'A batch is running. Stop it before moving the repository to another branch.' };
-        }
         const session = await this.store.getSession(sessionId);
         if (!session)
             throw new Error('No such session.');
         const task = session.tasks.find((t) => t.id === taskId);
         if (!task)
             throw new Error('No such task.');
+        const refused = await this.restoreRefusal(session);
+        if (refused)
+            return { ok: false, problem: refused };
         return await restoreToBase(session, task, this.bus);
     }
+    /**
+     * Why the repository of this session cannot be moved to another branch now, or null when it can.
+     *
+     * Anything that may be working in that folder at this moment: the session itself, a batch (which
+     * may reach a session in it next), and any other session running there on its own. Only the first
+     * two used to be asked, so a restore checked out a branch under another session in the middle of
+     * its task — and that session then found its repository moved, and left its work uncommitted.
+     * Version control being off for the other session does not make it safe: its commands still run
+     * in that folder.
+     */
+    async restoreRefusal(session) {
+        if (this.running.has(session.id))
+            return 'This session is running. Stop it before moving the repository to another branch.';
+        if (this.batch?.running)
+            return 'A batch is running. Stop it before moving the repository to another branch.';
+        const other = await this.runningIn(repoDirOf(session));
+        return other
+            ? `Session "${other.name}" is running in this repository. Stop it before moving the repository to another branch.`
+            : null;
+    }
+    /**
+     * A session running right now whose commands run in this folder, inside it, or in a folder around it.
+     *
+     * By where its commands run, the rule `workingDirFor` decides it by: the repository, else the
+     * project folder, else `execution.cwd`. Compared as folders, not as equal paths: an audit with
+     * version control off whose project is the repository's `web` folder works in the tree a checkout
+     * rewrites, and so does a session whose folder holds the repository. Only the same path used to
+     * count, and a restore changed files under such a session in the middle of its task.
+     */
+    async runningIn(dir) {
+        const here = normaliseDir(dir);
+        if (!here)
+            return undefined;
+        for (const id of this.running.keys()) {
+            const s = await this.store.getSession(id);
+            if (!s)
+                continue;
+            const there = normaliseDir(repoDirOf(s) || (await this.settings.load()).resolved.cwd);
+            if (there && overlaps(here, there))
+                return s;
+        }
+        return undefined;
+    }
     /**
      * Everything one run was asked to do, from a given task onward, in the order it would run.
      *
@@ -1673,37 +1980,27 @@ let OperatorService = class OperatorService {
             })),
             sessions: sessions.map((s) => ({ id: s.id, name: s.name, tasks: tasks.filter((x) => x.session.id === s.id).length })),
             restores: [],
-            mode: group?.mode ?? 'unattended',
+            /*
+             * Nothing on record says a run with no record of its own ever went unattended, and taken for
+             * one, it was refused on every machine that refuses unattended runs, the default among them:
+             * the dialog has no other mode to offer, so its button could never do anything for such a task.
+             */
+            mode: group?.mode ?? 'confirm',
             onFailure: group?.onFailure ?? session.onFailure ?? 'stop',
         };
-        /*
-         * One restore per repository, keyed on the folder rather than on the session.
-         *
-         * Three sessions working in one repository must not take it back three times to three
-         * different commits; the earliest affected task is the one that decides, because that is
-         * the state the whole re-run starts from.
-         */
-        const byRepo = new Map();
-        for (const entry of tasks) {
-            const dir = (entry.session.vcs?.enabled ? entry.session.vcs.repoDir : '')?.trim();
-            if (!dir)
-                continue;
-            // A repository whose affected tasks never ran has nothing to go back to: the run never
-            // touched it. Taking "no base commit recorded" as a refusal blocked "run again from
-            // here" for every plan whose later sessions had not started yet — which is the usual
-            // shape of a run that stopped in the middle.
-            if (!entry.task.startedAt)
-                continue;
-            if (!byRepo.has(dir))
-                byRepo.set(dir, entry);
-        }
-        for (const [dir, entry] of byRepo) {
-            const preview = await restorePreview(entry.session, entry.task);
+        // Asked of the machine as it is now, as `restartFrom` will ask it; see `unattendedRefused`.
+        if (plan.mode === 'unattended')
+            plan.unattendedRefused = (await this.unattendedRefusal('unattended')) ?? undefined;
+        for (const target of restoreTargets(tasks)) {
+            const preview = await restorePreview(target.session, target.task);
+            // What would stop the restore itself, asked here as well, so the dialog says it before the
+            // operator agrees rather than after.
+            const refused = target.problem ?? (await this.restoreRefusal(target.session));
             plan.restores.push({
-                repoDir: preview.repoDir || dir,
-                ok: preview.ok,
-                problem: preview.problem,
-                forTask: entry.task.title,
+                repoDir: preview.repoDir || target.dir,
+                ok: preview.ok && !refused,
+                problem: refused ?? preview.problem,
+                forTask: target.task.title,
                 baseCommit: preview.baseCommit,
                 branchName: preview.branchName,
                 leftBehind: preview.leftBehind,
@@ -1735,27 +2032,95 @@ let OperatorService = class OperatorService {
         if (plan.sessions.some((s) => this.running.has(s.id))) {
             return { ...idle, reason: 'One of these sessions is running on its own. Stop it first.' };
         }
+        /*
+         * Claimed before anything is moved, and held until the run it ends in has the browser: that run
+         * needs it, and another session running on its own, or a read of the models, may have it. Found
+         * out only at the start, the repositories were already taken back and the tasks queued, with
+         * nothing to run them; and only looked at here, the browser could still be taken by a start that
+         * came in while the repositories were being taken back, to the same end. Given back on every way
+         * out that does not start the run.
+         */
+        const ids = plan.sessions.map((s) => s.id);
+        if (opts.start === false)
+            return await this.restartMoves(sessionId, taskId, plan, opts);
+        /*
+         * The run's entrance rule, asked before anything moves, for the same reason as the browser
+         * below. Asked only when the batch began, a machine that no longer lets this run go unattended
+         * (a policy lock added since, isolation no longer accepted) took the repositories back and
+         * queued the tasks, and only then refused the run they were moved for. The plan says so first
+         * (`unattendedRefused`), so the dialog asks for the run step by step instead.
+         */
+        const blocked = await this.unattendedRefusal(opts.mode ?? plan.mode);
+        if (blocked)
+            return { ...idle, reason: blocked };
+        const claim = this.claimBrowser({ kind: 'batch', sessionIds: ids });
+        if ('refused' in claim)
+            return { ...idle, reason: claim.refused };
+        let handedOn = false;
+        try {
+            const moved = await this.restartMoves(sessionId, taskId, plan, opts);
+            if (moved.reason !== undefined)
+                return moved;
+            // Named after the task it goes back to, which is the one thing this run is about and the
+            // only thing a heading could usefully say. There is no field to type into on a task card,
+            // so leaving it to the operator meant leaving it blank every time.
+            const runName = await this.suggestRunName(ids, plan.from.title);
+            // From here the claim is the batch's to give back, whichever way its start goes.
+            handedOn = true;
+            /*
+             * Exactly the tasks the preview listed, which are the tasks the run was asked to do from this
+             * one on. Started with none named, the batch took every queued task of these sessions, so a
+             * task the run never chose — queued beside it, or added since — was sent to the chat as well.
+             */
+            const taskIds = plan.tasks.map((x) => x.taskId);
+            const started = await this.startBatchHolding(claim.holder, ids, opts.mode ?? plan.mode, opts.onFailure ?? plan.onFailure, undefined, undefined, runName, taskIds);
+            // A start refused now leaves the moves in place, and says so with its reason.
+            const reason = started.started || started.reason === undefined ? started.reason : afterMoves(started.reason, moved.restored, moved.requeued);
+            return { started: started.started, reason, requeued: moved.requeued, restored: moved.restored, batch: started.batch };
+        }
+        finally {
+            if (!handedOn)
+                this.releaseBrowser(claim.holder);
+        }
+    }
+    /**
+     * What `restartFrom` moves before its run starts: the repositories taken back, then the tasks
+     * queued again. A refusal, and "prepared, not started", come back with their reason; with none,
+     * everything is in place for the run.
+     */
+    async restartMoves(sessionId, taskId, plan, opts) {
+        const idle = { started: false, requeued: 0, restored: [] };
         const restored = [];
         if (opts.restore !== false) {
             for (const entry of plan.restores) {
                 if (!entry.ok)
                     return { ...idle, reason: `${entry.repoDir}: ${entry.problem ?? 'the restore could not be prepared.'}` };
             }
-            // Re-read each repository's own pivot and do it for real. The preview above is what the
-            // operator agreed to; this is the same call, one step further.
+            /*
+             * Re-read each repository's own pivot and do it for real. The preview above is what the
+             * operator agreed to; this is the same choice (`restoreTargets`), one step further. It was
+             * worked out a second time here, by a copy of the rule that had not been given the preview's
+             * "never started" skip, so a run whose later repository was never reached failed on it after
+             * the first repository had already been moved — and queued nothing.
+             *
+             * A refusal part-way still says what was already moved, in the result and in its reason (the
+             * one thing the page shows): a repository taken back is the operator's to know about, whatever
+             * happened after it.
+             */
             const session = (await this.store.getSession(sessionId));
             const task = session.tasks.find((t) => t.id === taskId);
             const { tasks } = await this.affectedByRestart(session, task);
-            const seenRepo = new Set();
-            for (const entry of tasks) {
-                const dir = (entry.session.vcs?.enabled ? entry.session.vcs.repoDir : '')?.trim();
-                if (!dir || seenRepo.has(dir))
-                    continue;
-                seenRepo.add(dir);
-                const done = await restoreToBase(entry.session, entry.task, this.bus);
-                if (!done.ok)
-                    return { ...idle, reason: `${dir}: ${done.problem ?? 'the restore failed.'}` };
-                restored.push(`${dir} -> ${done.branch ?? ''}`);
+            for (const target of restoreTargets(tasks)) {
+                // Asked again at the moment of moving: a session may have started in this folder since.
+                const refused = target.problem ?? (await this.restoreRefusal(target.session));
+                if (refused)
+                    return { ...idle, restored, reason: afterMoves(`${target.dir}: ${refused}`, restored, 0) };
+                const done = await restoreToBase(target.session, target.task, this.bus);
+                if (!done.ok || !done.branch) {
+                    return { ...idle, restored, reason: afterMoves(`${target.dir}: ${done.problem ?? 'the restore failed.'}`, restored, 0) };
+                }
+                restored.push(`${target.dir} -> ${done.branch}`);
+                await this.rerunFromRestore(target, done.branch, tasks);
             }
         }
         let requeued = 0;
@@ -1768,8 +2133,8 @@ let OperatorService = class OperatorService {
             }
             catch (e) {
                 // One task refusing to be queued again must not leave the rest half-reset with no
-                // explanation, so it stops here and says which one and why.
-                return { ...idle, restored, reason: `"${t.title}" could not be queued again: ${e.message}` };
+                // explanation, so it stops here and says which one and why — and what was done before it.
+                return { ...idle, restored, requeued, reason: afterMoves(`"${t.title}" could not be queued again: ${e.message}`, restored, requeued) };
             }
         }
         this.bus.publish({
@@ -1783,12 +2148,102 @@ let OperatorService = class OperatorService {
         });
         if (opts.start === false)
             return { started: false, reason: 'prepared, not started', requeued, restored };
-        const started = await this.startBatch(plan.sessions.map((x) => x.id), opts.mode ?? plan.mode, opts.onFailure ?? plan.onFailure, undefined, undefined, 
-        // Named after the task it goes back to, which is the one thing this run is about and the
-        // only thing a heading could usefully say. There is no field to type into on a task card,
-        // so leaving it to the operator meant leaving it blank every time.
-        await this.suggestRunName(plan.sessions.map((x) => x.id), plan.from.title));
-        return { started: started.started, reason: started.reason, requeued, restored, batch: started.batch };
+        return { started: false, requeued, restored };
+    }
+    /**
+     * Makes a restore hold for the run that follows it.
+     *
+     * The restore puts the repository on a new branch at the pivot task's starting commit, and the
+     * re-run then puts each session on its own branch. In per-task mode that is right: a re-run cuts
+     * a fresh branch from where the task first started, which is the restore commit. In per-session
+     * mode it undid the restore: the session's one branch was checked out again, with the failed
+     * attempt's commit still on it, so the attempt that was to start from the code as it was began on
+     * the work it was meant to replace, and committed it a second time. So the pivot's session now
+     * works on the restore branch — the code as it was before that task, with the tasks before it —
+     * and its old branch keeps the attempt that failed, as the confirmation says.
+     *
+     * A per-session session after it in the same repository that this run reached has the same
+     * problem whatever it started from: its one branch carries what its tasks did in this run, and
+     * checked out again it would start them over on their own first attempt. So it gets a branch of
+     * its own, and the old one keeps what it did. Where that branch starts depends on where the
+     * session began. From a named branch: where its first task in this run began, as a restore of
+     * that task would go back to, and the session's start stays as recorded. From where the
+     * repository was, or from the session before it: that start was work this run is now redoing, so
+     * it is forgotten, to be worked out again when the session is reached (for a `previous-session`
+     * chain, from the work done again), and the branch is cut from that. A session the run never
+     * reached holds nothing of this run and is left alone.
+     *
+     * A later per-task session is left as it is. From a named branch that is right: each re-run is
+     * cut from where its task first started, that branch's commit. Chained on this run's work it is
+     * not, and is not solved here: its tasks first started on the work being redone, so their re-runs
+     * are cut from it again. Telling that apart from an operator's new "Start from", whose re-runs go
+     * back to where each task first started on purpose (see `updateSession`), needs the restart
+     * written on the session, and the session's record has no field for it.
+     */
+    async rerunFromRestore(target, branch, tasks) {
+        if (target.session.vcs?.branchMode === 'per-session') {
+            const left = sessionBranchName(target.session);
+            // The restore branch exists by this name, so the name is kept as it is (see `branchNameExact`).
+            await this.store.updateSession(target.session.id, (s) => {
+                if (s.vcs) {
+                    s.vcs.branchName = branch;
+                    s.vcs.branchNameExact = true;
+                }
+            });
+            this.bus.publish({
+                sessionId: target.session.id,
+                taskId: target.task.id,
+                type: 'vcs-session-branch',
+                level: 'info',
+                message: `the session carries on from ${branch}, the code as it was before "${target.task.title}"; ${left} keeps the work that came after`,
+                data: { branch, left },
+            });
+        }
+        const here = normaliseDir(target.dir);
+        const inOrder = [...new Map(tasks.map(({ session }) => [session.id, session])).values()];
+        const later = inOrder.slice(inOrder.findIndex((s) => s.id === target.session.id) + 1);
+        for (const s of later) {
+            // One that carries on an existing branch never gets here: `restoreTargets` refuses the restart.
+            if (!s.vcs?.enabled || s.vcs.branchMode !== 'per-session' || s.vcs.startFrom === 'existing-branch')
+                continue;
+            // No base recorded: version control never got as far as making its branch.
+            if (!s.vcsBaseCommit || normaliseDir(repoDirOf(s)) !== here)
+                continue;
+            const first = tasks.find((x) => x.session.id === s.id && x.task.startedAt)?.task;
+            if (!first)
+                continue;
+            const left = sessionBranchName(s);
+            const fresh = await freeBranchName(target.dir, left);
+            // No record of the start is read as chained, the reading that cannot bring undone work back.
+            const chained = s.vcsStart?.kind !== 'branch';
+            const at = chained ? undefined : restorePoint(s, first);
+            if (at) {
+                const made = await branchAt(target.dir, fresh, at);
+                // Not made: left to the run, which cuts it from the session's start when it is reached.
+                if (!made.ok) {
+                    this.bus.publish({ sessionId: s.id, type: 'vcs-problem', level: 'warn', message: `${fresh} could not be made at ${at.slice(0, 8)}: ${made.problem}` });
+                }
+            }
+            await this.store.updateSession(s.id, (x) => {
+                if (chained) {
+                    x.vcsBaseCommit = undefined;
+                    x.vcsStart = undefined;
+                }
+                if (x.vcs) {
+                    x.vcs.branchName = fresh;
+                    x.vcs.branchNameExact = true;
+                }
+            });
+            this.bus.publish({
+                sessionId: s.id,
+                type: 'vcs-session-branch',
+                level: 'info',
+                message: chained
+                    ? `the session began from work this run is doing again, so it starts again when it is reached, on a new branch ${fresh}; ${left} keeps what it did before`
+                    : `the session starts its tasks again on a new branch ${fresh}, from where "${first.title}" began; ${left} keeps what it did before`,
+                data: { branch: fresh, left },
+            });
+        }
     }
     /** Why a folder cannot be used for version control, or null when it can. */
     repoProblem(dir) {
@@ -1806,7 +2261,7 @@ let OperatorService = class OperatorService {
         await this.init();
         const wanted = normaliseDir(dir);
         const cfg = await this.settings.load();
-        const known = new Set([cfg.project?.rootDir ?? '', ...(cfg.project?.others ?? []).map((o) => o.rootDir), ...(await this.store.listSessions()).flatMap((s) => [s.vcs?.repoDir ?? '', s.mirror?.rootDir ?? ''])]
+        const known = new Set([cfg.project?.rootDir ?? '', ...(cfg.project?.others ?? []).map((o) => o.rootDir), ...(await this.store.listSessions()).flatMap((s) => [s.vcs?.repoDir ?? '', s.projectDir ?? ''])]
             .filter((d) => d.trim())
             .map(normaliseDir));
         if (!wanted || !known.has(wanted)) {
@@ -1827,7 +2282,7 @@ let OperatorService = class OperatorService {
         const problem = repoUnusableReason(rootDir);
         const others = (cfg.project?.others ?? []).map((o) => {
             const p = repoUnusableReason(o.rootDir);
-            return { name: o.name, rootDir: o.rootDir, repoOk: p === null, ...(p ? { repoProblem: p } : {}), mirror: o.mirror, desktop: o.desktop !== false };
+            return { name: o.name, rootDir: o.rootDir, repoOk: p === null, ...(p ? { repoProblem: p } : {}) };
         });
         return {
             rootDir,
@@ -1835,65 +2290,8 @@ let OperatorService = class OperatorService {
             repoOk: rootDir !== '' && problem === null,
             ...(problem ? { repoProblem: problem } : {}),
             others,
-            mirrorToDesktop: cfg.project?.mirrorToDesktop ?? false,
-            desktop: cfg.project?.desktop !== false,
-            mirror: cfg.project?.mirror,
-            contextRoot: contextRoot(cfg),
         };
     }
-    desktopRefresh = null;
-    desktopRefreshAgain = false;
-    /**
-     * Asks for the Desktop copies to be brought up to date, while a run works.
-     *
-     * They used to be refreshed once, before a run, so a task that changed files left the Desktop —
-     * and OneDrive, and the chat that reads from it — on the code as it was before the task. The
-     * runner now calls this after every round of steps and after every task. One refresh runs at a
-     * time: a request that arrives while one is running is remembered and served by one more pass
-     * after it, so a burst of rounds costs two passes, not one per round, and the last pass always
-     * sees the latest files. A failure is reported and never stops the run.
-     */
-    requestDesktopRefresh() {
-        if (this.desktopRefresh) {
-            this.desktopRefreshAgain = true;
-            return;
-        }
-        this.desktopRefresh = (async () => {
-            do {
-                this.desktopRefreshAgain = false;
-                await this.refreshDesktopMirrors();
-            } while (this.desktopRefreshAgain);
-        })().finally(() => {
-            this.desktopRefresh = null;
-        });
-    }
-    /** Resolves once no Desktop refresh is running or waiting. For the checks, and for a clean stop. */
-    async desktopRefreshSettled() {
-        while (this.desktopRefresh)
-            await this.desktopRefresh;
-    }
-    /**
-     * Refreshes every project's Desktop folder, when the switch is on. Called before a run
-     * starts, so what OneDrive holds when the chat opens is the code as it is now, for every
-     * project on the Settings page and not only the one the session is about.
-     */
-    async refreshDesktopMirrors() {
-        const cfg = await this.settings.load();
-        if (!cfg.project?.mirrorToDesktop)
-            return;
-        try {
-            const outcomes = await mirrorAllProjects(cfg);
-            this.bus.publish({
-                sessionId: '*',
-                type: 'desktop-mirror',
-                level: outcomes.some((o) => o.problem) ? 'warn' : 'info',
-                message: outcomes.map((o) => `${o.name}: ${o.result ? describeMirror(o.result) : `not refreshed — ${o.problem}`}`).join('; ') || 'no projects to mirror',
-            });
-        }
-        catch (e) {
-            this.bus.publish({ sessionId: '*', type: 'desktop-mirror-failed', level: 'warn', message: e.message });
-        }
-    }
     /**
      * Stores the project folder and the other folders the operator works in. A field left out
      * of the patch is kept; an empty `rootDir` clears the default, which is a real choice: it
@@ -1906,54 +2304,37 @@ let OperatorService = class OperatorService {
      * — each of those would be a setting that looks filled in and points nowhere.
      */
     async setProject(patch) {
-        const raw = await this.settings.raw();
-        const current = (raw.project ?? {});
-        const rootDir = patch.rootDir !== undefined ? patch.rootDir.trim() : (current.rootDir ?? '').trim();
-        const name = patch.name !== undefined ? patch.name.trim() : (current.name ?? '').trim();
-        if (rootDir && !existsSync(rootDir))
-            throw new Error(`The folder ${rootDir} does not exist on this machine.`);
-        const others = (patch.others ?? current.others ?? []).map((o) => ({
-            name: (o.name ?? '').trim(),
-            rootDir: (o.rootDir ?? '').trim(),
-            ...(o.mirror ? { mirror: o.mirror } : {}),
-            // Stored only when it is off: absent means the project goes to the Desktop with the rest.
-            ...(o.desktop === false ? { desktop: false } : {}),
-        }));
-        const seen = new Set();
-        for (const o of others) {
-            if (!o.name)
-                throw new Error(`Every other project needs a name; the one at ${o.rootDir || '(no folder)'} has none.`);
-            if (!o.rootDir)
-                throw new Error(`The project "${o.name}" needs a folder.`);
-            if (!existsSync(o.rootDir))
-                throw new Error(`The folder ${o.rootDir} for "${o.name}" does not exist on this machine.`);
-            if (sameFolder(o.rootDir, rootDir))
-                throw new Error(`${o.rootDir} is already the default project; it does not need listing again.`);
-            const key = o.name.toLowerCase();
-            if (seen.has(key))
-                throw new Error(`Two projects are named "${o.name}". Names are how the folders are told apart, so each needs its own.`);
-            seen.add(key);
-        }
-        const mirrorToDesktop = patch.mirrorToDesktop ?? current.mirrorToDesktop ?? false;
-        const mirror = patch.mirror ?? current.mirror;
-        const desktop = patch.desktop ?? current.desktop ?? true;
-        const { desktop: _old, ...rest } = current;
-        const cfg = await this.settings.save({
-            ...raw,
-            project: { ...rest, rootDir, name, others, mirrorToDesktop, ...(mirror ? { mirror } : {}), ...(desktop === false ? { desktop: false } : {}) },
+        // Worked out from the file in its turn (see `Settings.update`), so a model chosen at the same
+        // moment is kept, and a refusal below leaves the file as it was.
+        await this.settings.update((raw) => {
+            const current = (raw.project ?? {});
+            const rootDir = patch.rootDir !== undefined ? patch.rootDir.trim() : (current.rootDir ?? '').trim();
+            const name = patch.name !== undefined ? patch.name.trim() : (current.name ?? '').trim();
+            if (rootDir && !existsSync(rootDir))
+                throw new Error(`The folder ${rootDir} does not exist on this machine.`);
+            const others = (patch.others ?? current.others ?? []).map((o) => ({
+                name: (o.name ?? '').trim(),
+                rootDir: (o.rootDir ?? '').trim(),
+            }));
+            const seen = new Set();
+            for (const o of others) {
+                if (!o.name)
+                    throw new Error(`Every other project needs a name; the one at ${o.rootDir || '(no folder)'} has none.`);
+                if (!o.rootDir)
+                    throw new Error(`The project "${o.name}" needs a folder.`);
+                if (!existsSync(o.rootDir))
+                    throw new Error(`The folder ${o.rootDir} for "${o.name}" does not exist on this machine.`);
+                if (sameFolder(o.rootDir, rootDir))
+                    throw new Error(`${o.rootDir} is already the default project; it does not need listing again.`);
+                const key = o.name.toLowerCase();
+                if (seen.has(key))
+                    throw new Error(`Two projects are named "${o.name}". Names are how the folders are told apart, so each needs its own.`);
+                seen.add(key);
+            }
+            // What the removed Desktop copies left in the stored project is dropped with the next save.
+            const { mirror: _m, desktop: _d, mirrorToDesktop: _t, ...rest } = current;
+            return { ...raw, project: { ...rest, rootDir, name, others } };
         });
-        /*
-         * The switch acts at once, both ways. On: every project's folder appears on the Desktop
-         * now, not at the next run, because "I turned it on and nothing happened" is a support
-         * question. Off: the folders go, because a copy of a code base left in OneDrive after the
-         * operator said no is the one outcome the switch must not produce. A changed selection
-         * with the switch on is applied the same way.
-         */
-        const wasOn = current.mirrorToDesktop ?? false;
-        if (mirrorToDesktop)
-            await mirrorAllProjects(cfg);
-        else if (wasOn)
-            await removeProjectMirrors(cfg);
         return await this.project();
     }
     // --- the model catalogue ----------------------------------------------------------------
@@ -1978,9 +2359,7 @@ let OperatorService = class OperatorService {
      */
     async setDefaultReviewModel(name) {
         await this.init();
-        const raw = await this.settings.raw();
-        const copilot = { ...(raw.copilot ?? {}), defaultReviewModel: name.trim() };
-        await this.settings.save({ ...raw, copilot });
+        await this.settings.update((raw) => ({ ...raw, copilot: { ...(raw.copilot ?? {}), defaultReviewModel: name.trim() } }));
         this.bus.publish({
             sessionId: '*',
             type: 'default-review-model-changed',
@@ -1998,9 +2377,7 @@ let OperatorService = class OperatorService {
      */
     async setDefaultModel(name) {
         await this.init();
-        const raw = await this.settings.raw();
-        const copilot = { ...(raw.copilot ?? {}), defaultModel: name.trim() };
-        await this.settings.save({ ...raw, copilot });
+        await this.settings.update((raw) => ({ ...raw, copilot: { ...(raw.copilot ?? {}), defaultModel: name.trim() } }));
         this.bus.publish({
             sessionId: '*',
             type: 'default-model-changed',
@@ -2021,26 +2398,27 @@ let OperatorService = class OperatorService {
      * line-up.
      */
     async refreshModels() {
-        await this.init();
-        if (this.running.size > 0) {
-            throw new Error('A session is running and it is using the browser profile. Stop it first, then read the models.');
-        }
-        if (this.readingModels)
-            throw new Error('The model list is already being read.');
-        this.readingModels = true;
-        const cfg = await this.settings.load();
-        const transport = createTransport({
-            profileDir: cfg.resolved.profileDir,
-            transportDir: join(cfg.resolved.runsDir, '_models'),
-            chatUrl: cfg.copilot.url,
-            channel: cfg.copilot.channel,
-            headless: cfg.copilot.headless,
-            replyTimeoutMs: cfg.copilot.replyTimeoutSec * 1000,
-            signInTimeoutMs: cfg.copilot.signInTimeoutSec * 1000,
-            humanWaitMs: cfg.copilot.humanWaitSec * 1000,
-            keepFailurePage: cfg.copilot.keepFailurePage,
-        });
+        // Asked of the one claim every window goes through (see `browser`), before anything is waited
+        // for. It used to count the sessions running, which is none in the moment between two
+        // sessions of a batch, while the batch's window is still open.
+        const claim = this.claimBrowser({ kind: 'models' });
+        if ('refused' in claim)
+            throw new Error(claim.refused);
+        let transport = null;
         try {
+            await this.init();
+            const cfg = await this.settings.load();
+            transport = createTransport({
+                profileDir: cfg.resolved.profileDir,
+                transportDir: join(cfg.resolved.runsDir, '_models'),
+                chatUrl: cfg.copilot.url,
+                channel: cfg.copilot.channel,
+                headless: cfg.copilot.headless,
+                replyTimeoutMs: cfg.copilot.replyTimeoutSec * 1000,
+                signInTimeoutMs: cfg.copilot.signInTimeoutSec * 1000,
+                humanWaitMs: cfg.copilot.humanWaitSec * 1000,
+                keepFailurePage: cfg.copilot.keepFailurePage,
+            });
             await transport.open();
             await transport.ensureSignedIn();
             const { options, current, note } = await transport.listModels();
@@ -2049,8 +2427,8 @@ let OperatorService = class OperatorService {
             return catalogue;
         }
         finally {
-            await transport.close().catch(() => undefined);
-            this.readingModels = false;
+            await transport?.close().catch(() => undefined);
+            this.releaseBrowser(claim.holder);
         }
     }
     // --- the registry ---------------------------------------------------------------------
@@ -2139,41 +2517,10 @@ let OperatorService = class OperatorService {
         return out;
     }
     // --- environment ----------------------------------------------------------------------
-    async dirs(root, respectGitignore = true) {
-        return await listSelectableDirs(root, { respectGitignore });
-    }
     /** Opens the machine's own folder dialog and reports what was picked. */
     async browseFolder(start) {
         return await pickFolder(start);
     }
-    /**
-     * What the current selection would copy, without writing anything. This is how the two
-     * switches become checkable: turn the env one on and the `.env` files move from the skipped
-     * list into the copied one, whatever `.gitignore` says about them.
-     */
-    async previewMirror(input) {
-        const conflicts = findSelectionConflicts(input.includeDirs ?? [], input.excludeDirs ?? []);
-        if (conflicts.length > 0)
-            throw new Error(describeConflicts(conflicts));
-        const cfg = await this.settings.load();
-        const { files, skipped } = await collectFiles({
-            rootDir: input.rootDir,
-            includeDirs: input.includeDirs?.length ? input.includeDirs : ['.'],
-            excludeDirs: input.excludeDirs ?? [],
-            targetDir: '',
-            respectGitignore: input.respectGitignore ?? true,
-            includeEnvFiles: input.includeEnvFiles ?? false,
-            ignoreDirs: cfg.projectMirror.ignoreDirs,
-            maxFileBytes: cfg.projectMirror.maxFileBytes,
-        });
-        let totalBytes = 0;
-        for (const rel of files) {
-            const s = await import('node:fs/promises').then((fs) => fs.stat(join(input.rootDir, rel)).catch(() => null));
-            if (s)
-                totalBytes += s.size;
-        }
-        return { files, skipped, envFiles: files.filter(isEnvPath), totalBytes, conflicts };
-    }
     async doctor() {
         const cfg = await this.settings.load();
         const edge = ['C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe', 'C:/Program Files/Microsoft/Edge/Application/msedge.exe'].find((p) => existsSync(p));
@@ -2204,7 +2551,6 @@ let OperatorService = class OperatorService {
              */
             isolation: assessIsolation(cfg.execution.isolation, readIsolationSignals()),
             folderDialog: process.platform === 'win32',
-            alwaysIgnoredDirs: DEFAULT_IGNORE_DIRS,
         };
     }
 };
@@ -2227,21 +2573,3 @@ function resolveRunId(task, requested) {
     const owned = [task.runId, ...(task.attempts ?? []).map((a) => a.runId)].filter(Boolean);
     return owned.includes(requested) ? requested : null;
 }
-function isEnvPath(relPath) {
-    const name = relPath.split('/').pop()?.toLowerCase() ?? '';
-    return name === '.env' || name.startsWith('.env.');
-}
-/**
- * Refuses a selection that contradicts itself, at the point it is saved rather than at the
- * point it runs. A contradiction is cheap to fix while the form is open and expensive to
- * discover an hour later, when the first task of a run fails on it.
- */
-function assertMirrorIsCoherent(mirror) {
-    const conflicts = findSelectionConflicts(mirror.includeDirs ?? [], mirror.excludeDirs ?? []);
-    if (conflicts.length > 0) {
-        throw new Error(`The include and exclude lists contradict each other. ${describeConflicts(conflicts)}`);
-    }
-    if (mirror.enabled && mirror.rootDir !== undefined && !mirror.rootDir.trim()) {
-        throw new Error('Attaching project files needs a project root.');
-    }
-}