copilot-operator 0.1.12 → 0.1.15

package/dist/src/plan/brief.js

@@ -92,20 +92,29 @@ ${lines.join('\n')}
  * Whether a run with nobody watching can start on this machine — and when it cannot, what to press.
  *
  * Kerrigan's phase 2 script offers the unattended button first, because on a machine that allows it
- * that is the ordinary way to run. On one that does not — no isolation claimed, or no allowlist —
- * the runner refuses it at the entrance, and a persona that recommends it has sent the operator to
- * a button that says no. She cannot see the machine; the app can, so it tells her, and only when it
- * matters. The labels are the ones on the screens, so check:guide holds them.
+ * that is the ordinary way to run. On one that does not — a policy lock, no isolation claimed, or no
+ * allowlist — the runner refuses it at the entrance, and a persona that recommends it has sent the
+ * operator to a button that says no. She cannot see the machine; the app can, so it tells her, and
+ * only when it matters. The labels are the ones on the screens, so check:guide holds them.
  */
 function machineSection(unattendedBlocked, lang) {
     if (!unattendedBlocked)
         return '';
-    const whyBg = unattendedBlocked === 'isolation'
-        ? '**„Къде върви ботът“** в `/defaults` още казва, че ботът върви в акаунта на оператора, без изолация'
-        : 'списъкът с позволени програми е празен, а без него нищо не ограничава стъпка, която никой не гледа';
-    const whyEn = unattendedBlocked === 'isolation'
-        ? '**"Where the bot runs"** on `/defaults` still says the bot runs in the operator\'s own account, with no isolation'
-        : 'the list of allowed programs is empty, and without it nothing limits a step that nobody is watching';
+    /*
+     * Each reason named as it is, because each sends the operator somewhere different. A lock blamed
+     * on the allowlist sent them to fill in a list that was already full, and the run was refused all
+     * the same: the lock is the machine's, set beside the install, and no page changes it.
+     */
+    const whyBg = {
+        lock: 'файлът `policy.lock.json` до инсталацията на тази машина забранява пускания без надзор, и никоя настройка на страниците не го променя',
+        isolation: '**„Къде върви ботът“** в `/defaults` още казва, че ботът върви в акаунта на оператора, без изолация',
+        allowlist: 'списъкът с позволени програми е празен, а без него нищо не ограничава стъпка, която никой не гледа',
+    }[unattendedBlocked];
+    const whyEn = {
+        lock: "this machine's `policy.lock.json`, beside the install, forbids runs with nobody watching, and no setting on any page changes it",
+        isolation: '**"Where the bot runs"** on `/defaults` still says the bot runs in the operator\'s own account, with no isolation',
+        allowlist: 'the list of allowed programs is empty, and without it nothing limits a step that nobody is watching',
+    }[unattendedBlocked];
     return lang === 'bg'
         ? `
 ## На тази машина пускане без надзор се отказва
@@ -248,14 +257,6 @@ export function planExample() {
                     baseBranch: 'main',
                 },
                 review: { enabled: true, model: '' },
-                mirror: {
-                    enabled: true,
-                    rootDir: root,
-                    includeDirs: ['src/invoices'],
-                    excludeDirs: [],
-                    respectGitignore: true,
-                    includeEnvFiles: false,
-                },
                 tasks: firstTasks,
             },
             {
@@ -308,6 +309,12 @@ const FIELD_ROWS_EN = [
         'no',
         'Overrides the setting above for this one session: give the same name to the sessions that should share a chat, and leave it "" for a session that should have its own.',
     ],
+    [
+        'projectDir',
+        'session',
+        'no',
+        'The project folder of a session with version control off: its commands run there. Leave it out for the default project. With version control on, `vcs.repoDir` is required and the commands run in it.',
+    ],
     [
         'review',
         'session',
@@ -317,7 +324,6 @@ const FIELD_ROWS_EN = [
     ['review', 'task', 'no', 'Set to `false` to skip the review for one task. Absent means the session decides.'],
     ['readOnly', 'task', 'no', '`true` for a task that must not change files — an audit, a smoke test, a report. The runner fails it if the tree changed, and still commits the change on its branch so nothing is lost.'],
     ['scope', 'task', 'no', 'The paths the task may change: files, folders (`tests/e2e/`) or `*`/`**` patterns. With version control on, the runner puts back any change outside them. Give it when the task is about one suite or module.'],
-    ['mirror', 'session', 'no, but ask', 'Whether project files are copied and attached to the first message as context, and which: root, directories in and out, gitignore, env files. Off when left out.'],
     ['tasks', 'session', 'yes', 'At least one, in the order they must run.'],
     ['title', 'task', 'yes', '3 to 120 characters. Short, latin, hyphenated.'],
     ['prompt', 'task', 'yes', 'The task itself, at least 30 characters. This is what Copilot reads.'],
@@ -373,6 +379,12 @@ const FIELD_ROWS_BG = [
         'не',
         'Отменя настройката горе само за тази сесия: дай едно и също име на сесиите, които да споделят чат, и остави "" на онази, която да е сама.',
     ],
+    [
+        'projectDir',
+        'сесия',
+        'не',
+        'Папката на проекта на сесия с изключен контрол на версиите: командите ѝ се изпълняват там. Пропусни го за проекта по подразбиране. С включен контрол на версиите `vcs.repoDir` е задължително и командите се изпълняват в него.',
+    ],
     [
         'review',
         'сесия',
@@ -382,7 +394,6 @@ const FIELD_ROWS_BG = [
     ['review', 'задача', 'не', 'Сложи `false`, за да се пропусне рецензията само за тази задача. Липсата значи каквото казва сесията.'],
     ['readOnly', 'задача', 'не', '`true` за задача, която не бива да променя файлове — одит, smoke тест, доклад. Runner-ът я проваля, ако дървото е променено, и пак комитва промяната на клона ѝ, за да не се губи нищо.'],
     ['scope', 'задача', 'не', 'Пътищата, които задачата може да променя: файлове, папки (`tests/e2e/`) или шаблони с `*`/`**`. При включен контрол на версиите runner-ът връща всяка промяна извън тях. Давай го, когато задачата е за един suite или модул.'],
-    ['mirror', 'сесия', 'не, но питай', 'Дали файлове от проекта се копират и прикачат към първото съобщение като контекст, и кои: корен, директории вътре и вън, gitignore, env файлове. Изключено, когато липсва.'],
     ['tasks', 'сесия', 'да', 'Поне една, в реда, в който трябва да се изпълнят.'],
     ['title', 'задача', 'да', 'От 3 до 120 знака. Кратко, латиница, с тирета.'],
     ['prompt', 'задача', 'да', 'Самата задача, поне 30 знака. Това чете Copilot.'],
@@ -432,6 +443,16 @@ is clean: the runner commits after the checks, and its own commit is what leaves
 - \`"previous-session"\` — the session carries on from the end of the branch of the session that
   ran before it **in the same repository**, so the sessions form a chain. The first session of
   such a chain starts from \`baseBranch\`. Sessions in other repositories do not count.
+- \`"existing-branch"\` with \`existingBranch\` — no new branch at all: every task of the session
+  works on that existing local branch, exactly as named (\`"existingBranch": "recovery/apz-migration"\`),
+  one after another, building on what is already on it. For new work that continues a branch the
+  user already has. The branch must exist when the plan is imported; \`branchMode\`, \`branchName\`
+  and the prefix do not apply.
+
+Before a session's first branch the runner fetches and fast-forwards the branch it starts from
+(\`baseBranch\`, or \`existingBranch\`), so the work begins from the server's code; it never resets or
+merges. \`"updateFromRemote": false\` turns that off — only when the user asks to work offline or from
+local commits on purpose.
 
 Put the same \`startFrom\` on every session that works in one repository unless the user wants it
 mixed. Leaving it out keeps the old behaviour — whatever branch the repository is on — which is
@@ -455,7 +476,9 @@ commit is written: imperative, short, about the change rather than about the tas
 \`"vcs": { "enabled": false, "repoDir": "", "branchMode": "per-task", "commitOnFinish": false, "branchPrefix": "cop/" }\`.
 Then give its tasks no \`vcs\` at all — no branch, no commit message — because there is nothing
 to name. Read-only work, audits and reports are the usual reason. Say in \`notes\` why you turned
-it off, so the operator can disagree with you.
+it off, so the operator can disagree with you. Its commands run in the default project; when its
+work is in another one, give that project's path as the session's \`projectDir\`, since the empty
+\`repoDir\` cannot say it.
 
 **Do not leave \`vcs\` out of a session.** The system refuses the whole document and hands the
 user a line saying so, and you will have to ask the question then anyway — after wasting their
@@ -479,6 +502,15 @@ const VCS_DETAIL_BG = `
 - \`"previous-session"\` — сесията продължава от края на клона на сесията, пусната преди нея **в
   същото хранилище**, така че сесиите образуват верига. Първата сесия от веригата тръгва от
   \`baseBranch\`. Сесии в други хранилища не се броят.
+- \`"existing-branch"\` с \`existingBranch\` — без нов клон: всяка задача от сесията работи на този
+  съществуващ локален клон, точно с това име (\`"existingBranch": "recovery/apz-migration"\`), една след
+  друга, върху това, което вече е там. За нова работа, която продължава клон, който потребителят вече
+  има. Клонът трябва да съществува при импорта; \`branchMode\`, \`branchName\` и представката не се прилагат.
+
+Преди първия клон на сесията runner-ът прави fetch и fast-forward на клона, от който тя тръгва
+(\`baseBranch\` или \`existingBranch\`), така че работата започва от кода на сървъра; никога не прави
+reset или merge. \`"updateFromRemote": false\` го изключва — само ако потребителят поиска да работи
+офлайн или нарочно от локални commit-и.
 
 Сложи един и същ \`startFrom\` на всички сесии в едно хранилище, освен ако потребителят не иска
 различни. Ако го пропуснеш, остава старото поведение — от който клон е хранилището в момента —
@@ -502,7 +534,9 @@ const VCS_DETAIL_BG = `
 \`"vcs": { "enabled": false, "repoDir": "", "branchMode": "per-task", "commitOnFinish": false, "branchPrefix": "cop/" }\`.
 На нейните задачи не давай \`vcs\` изобщо — нито клон, нито текст на комит — защото няма какво да
 се именува. Обичайната причина е работа само за четене, одит или отчет. Напиши в \`notes\` защо си
-го изключил, за да може операторът да не се съгласи с теб.
+го изключил, за да може операторът да не се съгласи с теб. Командите ѝ се изпълняват в проекта по
+подразбиране; когато работата ѝ е в друг, дай пътя на този проект като \`projectDir\` на сесията,
+защото празното \`repoDir\` не може да го каже.
 
 **Не пропускай \`vcs\` в сесия.** Системата отказва целия документ и връща на потребителя ред,
 който го казва, а ти пак ще трябва да зададеш въпроса — след като си му загубил времето. Задай
@@ -606,16 +640,6 @@ const CHECKS_BG = `
 трите минават без свършена работа.
 Всеки критерий от заданието е покрит поне от една проверка, която пада, докато работата не е свършена.
 `.trim();
-const MIRROR_EN = `
-**mirror**: \`enabled\`, \`rootDir\` (absolute), \`includeDirs\` and \`excludeDirs\` (paths relative to
-the root, forward slashes), \`respectGitignore\` (leave it true), \`includeEnvFiles\` (leave it false
-unless the user insists — it copies secrets into a chat).
-`.trim();
-const MIRROR_BG = `
-**mirror**: \`enabled\`, \`rootDir\` (абсолютен), \`includeDirs\` и \`excludeDirs\` (пътища спрямо корена,
-с наклонени черти напред), \`respectGitignore\` (остави го true), \`includeEnvFiles\` (остави го false,
-освен ако потребителят не настоява — копира тайни в чат).
-`.trim();
 const VCS_RULE_EN = '- **Version control is yours to ask about, and there is no default.** With it on, the runner makes a branch\n' +
     '  before each task and a commit after it, using the names you give, and it never pushes; Copilot must not touch\n' +
     '  git itself. With it off, files are changed where they lie and there is no way back. Ask the user which it is,\n' +
@@ -1504,10 +1528,6 @@ asking for both — the first is what makes the next plan quicker to write than
      judges it. Ask whether it stays on and on which model; a model different from the working
      one catches more. \`model\` for the work itself only if the user names one from the chat's
      own picker.
-   - \`mirror\` (optional, off by default): whether project files are copied and attached to the
-     first message as context — from which root, which directories in and out, whether
-     \`.gitignore\` is respected (yes), whether \`.env\` files go in (no: they are secrets). Ask;
-     never assume.
 3. **The tasks.** For each: \`title\` (required), \`prompt\` (required — what Copilot reads:
    precise, with paths, ports and commands), \`expected\` (the bar, one sentence), \`checks\`
    (the same bar written so the runner can decide it; write one wherever a command or a file can
@@ -1592,8 +1612,6 @@ ${table(['Field', 'Where', 'Required', 'What it is'], rows)}
 
 ${VCS_DETAIL_EN}
 
-${MIRROR_EN}
-
 ${CHECKS_EN}
 
 ### A filled-in example
@@ -1727,10 +1745,6 @@ ${systemGuideSection('bg')}
      работата и я оценява. Питай дали остава включен и на кой модел; модел, различен от
      работния, хваща повече. \`model\` за самата работа — само ако потребителят назове такъв
      от менюто на чата.
-   - \`mirror\` (незадължително, изключено по подразбиране): дали файлове от проекта се копират
-     и прикачат към първото съобщение като контекст — от кой корен, кои директории вътре и вън,
-     дали се спазва \`.gitignore\` (да), дали влизат \`.env\` файлове (не: те са тайни). Питай;
-     никога не предполагай.
 3. **Задачите.** За всяка: \`title\` (задължително), \`prompt\` (задължително — това чете
    Copilot: точно, с пътища, портове и команди), \`expected\` (летвата, едно изречение),
    \`checks\` (същата летва, написана така, че runner-ът да я решава сам; пиши по една навсякъде,
@@ -1816,8 +1830,6 @@ ${table(['Поле', 'Къде', 'Задължително', 'Какво е'], r
 
 ${VCS_DETAIL_BG}
 
-${MIRROR_BG}
-
 ${CHECKS_BG}
 
 ### Попълнен пример

package/dist/src/plan/importPlan.js

@@ -1,4 +1,4 @@
-import { DEFAULT_MIRROR, DEFAULT_VCS } from '../session/store.js';
+import { DEFAULT_VCS, applyDefaultProject } from '../session/store.js';
 import { availableShells, detectShells } from '../exec/shells.js';
 /** The heading under which a task's acceptance bar reaches Copilot. English, like level 1. */
 const EXPECTED_HEADER = '### Expected result';
@@ -145,7 +145,13 @@ function unavailableShellWarnings(plan) {
  */
 export async function importPlan(store, plan, defaultModel = '', defaultReviewModel = '', 
 /** The operator's persona at the moment of import, written into every task's level 2. */
-persona = '') {
+persona = '', 
+/**
+ * The default project on the Project page, for a session that names no folder of its own. The
+ * service passes it, so an imported session works where one made by hand would; see
+ * `applyDefaultProject`. Empty leaves such a session without a folder.
+ */
+defaultProjectDir = '') {
     const sessions = [];
     const warnings = [...unavailableShellWarnings(plan)];
     /*
@@ -160,15 +166,18 @@ persona = '') {
         ? (plan.plan.trim() || `plan-${new Date().toISOString().slice(0, 16).replace(/[:T-]/g, '')}`).slice(0, 60)
         : '';
     for (const planned of plan.sessions) {
-        const mirror = { ...DEFAULT_MIRROR, ...(planned.mirror ?? {}) };
-        if (mirror.enabled && !mirror.rootDir.trim()) {
-            mirror.enabled = false;
-            warnings.push(`Session "${planned.name}" asked for project files without a root folder, so file attachment was left off.`);
+        // Attaching project files to the chat was removed; an old plan's root is still its project folder.
+        if (planned.mirror?.enabled) {
+            warnings.push(`Session "${planned.name}" asks for project files to be attached to the chat. That no longer exists: ` +
+                'the chat reads the project by running commands. "mirror" was ignored.');
         }
-        const created = await store.createSession(planned.name, mirror);
+        const created = await store.createSession(planned.name, planned.projectDir || planned.mirror?.rootDir || '');
         const vcs = { ...DEFAULT_VCS, ...(planned.vcs ?? {}) };
         vcs.branchPrefix = vcs.branchPrefix.trim() || DEFAULT_VCS.branchPrefix;
         vcs.repoDir = vcs.repoDir.trim();
+        // A branch to carry on, given alone, is that choice: see `VersionControl.startFrom`.
+        if (vcs.existingBranch?.trim())
+            vcs.startFrom = 'existing-branch';
         const group = planned.conversationGroup.trim() || sharedGroup;
         await store.updateSession(created.id, (s) => {
             s.onFailure = planned.onFailure;
@@ -180,6 +189,8 @@ persona = '') {
             s.model = (planned.model || defaultModel).trim() || undefined;
             s.planName = plan.plan.trim() || undefined;
             s.vcs = vcs;
+            // After the plan's own folders are in place, so only a session that named none is pointed at it.
+            applyDefaultProject(s, defaultProjectDir);
         });
         const titles = [];
         for (const task of planned.tasks) {

package/dist/src/plan/schema.js

@@ -44,16 +44,40 @@ const VcsInput = z
      * Absent keeps the old behaviour, wherever the repository is. See `VersionControl.startFrom`.
      */
     startFrom: z
-        .enum(['branch', 'previous-session', 'head'], {
-        error: 'startFrom must be "branch" (every session starts from the local branch in baseBranch, "main" unless said otherwise) or "previous-session" (each session carries on from the branch of the session before it in the same repository).',
+        .enum(['branch', 'previous-session', 'head', 'existing-branch'], {
+        error: 'startFrom must be "branch" (every session starts from the local branch in baseBranch, "main" unless said otherwise), "previous-session" (each session carries on from the branch of the session before it in the same repository) or "existing-branch" (the session works on the existing branch named in existingBranch).',
     })
         .optional(),
     /** The local branch `startFrom: "branch"` starts from, and `previous-session`'s fallback. */
     baseBranch: z.string().trim().optional(),
+    /**
+     * The existing local branch the whole session works on, exactly as named: no new branch, no
+     * prefix. Given alone it means `startFrom: "existing-branch"`. See `VersionControl.startFrom`.
+     */
+    existingBranch: z.string().trim().optional(),
+    /**
+     * Fetch and fast-forward the branch the session starts from before its first branch is cut.
+     * Absent means true. See `VersionControl.updateFromRemote`.
+     */
+    updateFromRemote: z.boolean().optional(),
 }, {
     error: 'Every session needs a "vcs" object saying whether the runner does version control for it and, when it does, which git repository to work in. Ask the user both questions and write the answers here.',
 })
     .superRefine((vcs, ctx) => {
+    if (vcs.startFrom === 'existing-branch' && !vcs.existingBranch) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['existingBranch'],
+            message: 'startFrom is "existing-branch", so "existingBranch" must name the local branch to carry on, exactly as it is in git (for example "recovery/apz-migration").',
+        });
+    }
+    if (vcs.existingBranch && vcs.startFrom && vcs.startFrom !== 'existing-branch') {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['existingBranch'],
+            message: `"existingBranch" carries on a branch that exists, and startFrom "${vcs.startFrom}" cuts a new one. Keep one: startFrom "existing-branch" with existingBranch, or leave existingBranch out.`,
+        });
+    }
     if (vcs.enabled && !vcs.repoDir.trim()) {
         ctx.addIssue({
             code: 'custom',
@@ -143,15 +167,12 @@ const TaskVcsInput = z.object({
     branch: z.string().trim().optional(),
     commitMessage: z.string().trim().optional(),
 });
-/** The project files copied into the chat. Absent means none, which is the default. */
-const MirrorInput = z.object({
-    enabled: z.boolean().optional(),
-    rootDir: z.string().optional(),
-    includeDirs: z.array(z.string()).optional(),
-    excludeDirs: z.array(z.string()).optional(),
-    respectGitignore: z.boolean().optional(),
-    includeEnvFiles: z.boolean().optional(),
-});
+/**
+ * What was once the project files copied into the chat, removed on 2026-09-30. Still read, so a plan
+ * written before then imports: its `rootDir` becomes the session's project folder, and the rest is
+ * ignored with a warning. See `importPlan`.
+ */
+const LegacyMirrorInput = z.object({ enabled: z.boolean().optional(), rootDir: z.string().optional() }).passthrough();
 const TaskInput = z.object({
     title: z
         .string()
@@ -247,7 +268,14 @@ const SessionInput = z.object({
     conversationGroup: z.string().trim().default(''),
     vcs: VcsInput,
     review: ReviewInput.optional(),
-    mirror: MirrorInput.optional(),
+    /**
+     * The project folder of a session with version control off: where its commands run. Absent means
+     * the default project on the Project page. With version control on, `vcs.repoDir` is required (see
+     * `checkPlan`) and the commands run there, so this folder decides nothing for such a session.
+     */
+    projectDir: z.string().trim().optional(),
+    /** Read only for old plans; see `LegacyMirrorInput`. */
+    mirror: LegacyMirrorInput.optional(),
     tasks: z.array(TaskInput).min(1, 'A session with no tasks would import as an empty queue.'),
 });
 export const PlanSchema = z.object({
@@ -326,7 +354,6 @@ const KNOWN_KEYS = {
     vcs: keysOf(VcsInput),
     taskVcs: keysOf(TaskVcsInput),
     review: keysOf(ReviewInput),
-    mirror: keysOf(MirrorInput),
 };
 function unknownKeys(value, kind, where, out) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
@@ -337,31 +364,46 @@ function unknownKeys(value, kind, where, out) {
         }
     }
 }
+/**
+ * A value of the raw document as an object whose fields can be read, or nothing.
+ *
+ * The warning walk runs on the document as it arrived, before the schema has said anything about
+ * it, so every level of it may be null, a number or a list where an object belongs. A cast does
+ * not make it one: `sessions: [null]` read `null.vcs` and threw, where the schema would have
+ * refused it by its path. What is not an object has no fields to warn about, and is left for the
+ * schema to refuse.
+ */
+function fieldsOf(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
+}
 /** Fields a model invented, walked by hand because the schema drops them silently. */
 function collectWarnings(raw) {
     const out = [];
-    if (!raw || typeof raw !== 'object')
+    const plan = fieldsOf(raw);
+    if (!plan)
         return out;
-    unknownKeys(raw, 'plan', 'plan', out);
-    const sessions = raw.sessions;
-    if (!Array.isArray(sessions))
+    unknownKeys(plan, 'plan', 'plan', out);
+    if (!Array.isArray(plan.sessions))
         return out;
-    sessions.forEach((s, i) => {
-        unknownKeys(s, 'session', `sessions[${i}]`, out);
-        const session = s;
+    plan.sessions.forEach((s, i) => {
+        const session = fieldsOf(s);
+        if (!session)
+            return;
+        unknownKeys(session, 'session', `sessions[${i}]`, out);
         unknownKeys(session.vcs, 'vcs', `sessions[${i}].vcs`, out);
         unknownKeys(session.review, 'review', `sessions[${i}].review`, out);
-        unknownKeys(session.mirror, 'mirror', `sessions[${i}].mirror`, out);
-        if (Array.isArray(session.tasks)) {
-            session.tasks.forEach((t, j) => {
-                unknownKeys(t, 'task', `sessions[${i}].tasks[${j}]`, out);
-                unknownKeys(t?.vcs, 'taskVcs', `sessions[${i}].tasks[${j}].vcs`, out);
-                const checks = t?.checks;
-                if (Array.isArray(checks)) {
-                    checks.forEach((c, k) => unknownKeys(c, 'check', `sessions[${i}].tasks[${j}].checks[${k}]`, out));
-                }
-            });
-        }
+        if (!Array.isArray(session.tasks))
+            return;
+        session.tasks.forEach((t, j) => {
+            const task = fieldsOf(t);
+            if (!task)
+                return;
+            unknownKeys(task, 'task', `sessions[${i}].tasks[${j}]`, out);
+            unknownKeys(task.vcs, 'taskVcs', `sessions[${i}].tasks[${j}].vcs`, out);
+            if (Array.isArray(task.checks)) {
+                task.checks.forEach((c, k) => unknownKeys(c, 'check', `sessions[${i}].tasks[${j}].checks[${k}]`, out));
+            }
+        });
     });
     return out;
 }
@@ -404,8 +446,25 @@ export function summarise(plan) {
  *
  * Never throws. Every way this can fail — not JSON at all, the wrong version, a task with no
  * prompt — is an answer the user is meant to see and hand back to the chat model.
+ *
+ * That promise is kept here, around the whole reading, and not only by each walk being careful:
+ * the walks run on whatever a chat produced, and one of them reading a field of null once turned
+ * a malformed plan into a request error carrying a JavaScript message, which neither the page nor
+ * the chat that wrote the plan can do anything with. A walk that throws again is an answer too.
  */
 export function checkPlan(text) {
+    try {
+        return readPlan(text);
+    }
+    catch (e) {
+        return {
+            ok: false,
+            warnings: [],
+            issues: [{ path: '', message: `This plan could not be read: ${e.message}. Check that every session, task and check is a JSON object.` }],
+        };
+    }
+}
+function readPlan(text) {
     const source = extractJson(text ?? '');
     if (!source.trim()) {
         return { ok: false, warnings: [], issues: [{ path: '', message: 'There is nothing here to import.' }] };