copilot-operator 0.1.15 → 0.1.17

package/dist/src/api/operator.controller.js

@@ -126,6 +126,10 @@ let OperatorController = class OperatorController {
     sessions() {
         return this.ops.listSessions();
     }
+    /** The sessions list in the operator's order: every session id, top to bottom. */
+    reorderSessions(body) {
+        return this.ops.reorderSessions(body?.ids).catch(fail);
+    }
     createSession(body) {
         return this.ops.createSession(body?.name ?? '', body?.projectDir).catch(fail);
     }
@@ -500,6 +504,10 @@ let OperatorController = class OperatorController {
     vcsStatus(id) {
         return this.ops.vcsStatus(id).catch(fail);
     }
+    /** The operator's approval of the starting snapshot: one choice per file of the list they saw. */
+    vcsSnapshot(id, body) {
+        return this.ops.vcsSnapshot(id, body?.choices ?? {}).catch(fail);
+    }
     // --- the model picker ---------------------------------------------------------------------
     /** The cached list. Returns null when the picker has never been read on this machine. */
     models() {
@@ -509,6 +517,10 @@ let OperatorController = class OperatorController {
      * Re-reads the picker from the live chat. Slow on purpose: it opens the browser with the
      * bot profile, so it cannot run while a session is running.
      */
+    /** "Sign in" from Settings: opens the bot's Edge and waits for the operator to sign in. See `OperatorService.login`. */
+    login(body) {
+        return this.ops.login(body?.account).catch(fail);
+    }
     refreshModels() {
         return this.ops.refreshModels().catch(fail);
     }
@@ -628,6 +640,13 @@ __decorate([
     __metadata("design:paramtypes", []),
     __metadata("design:returntype", Promise)
 ], OperatorController.prototype, "sessions", null);
+__decorate([
+    Put('sessions-order'),
+    __param(0, Body()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], OperatorController.prototype, "reorderSessions", null);
 __decorate([
     Post('sessions'),
     __param(0, Body()),
@@ -1023,12 +1042,27 @@ __decorate([
     __metadata("design:paramtypes", [String]),
     __metadata("design:returntype", Promise)
 ], OperatorController.prototype, "vcsStatus", null);
+__decorate([
+    Post('sessions/:id/vcs/snapshot'),
+    __param(0, Param('id')),
+    __param(1, Body()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", Promise)
+], OperatorController.prototype, "vcsSnapshot", null);
 __decorate([
     Get('models'),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", []),
     __metadata("design:returntype", Promise)
 ], OperatorController.prototype, "models", null);
+__decorate([
+    Post('login'),
+    __param(0, Body()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], OperatorController.prototype, "login", null);
 __decorate([
     Post('models/refresh'),
     __metadata("design:type", Function),

package/dist/src/api/operator.service.js

@@ -45,6 +45,7 @@ import { unattendedPrecondition } from '../exec/policy.js';
 import { createTransport } from '../transport/chatTransport.js';
 import { composeHandoff } from '../session/handoff.js';
 import { planSync } from '../vcs/syncCommand.js';
+import { dirtyPolicy, takeSnapshot } from '../vcs/snapshot.js';
 import { computeMetrics } from '../session/metrics.js';
 import { resolveDesktopDir, desktopIsSynced } from '../context/desktopDir.js';
 import { saveAndReveal } from './saveToDesktop.js';
@@ -56,6 +57,15 @@ import { settingsOf } from './settings.js';
  */
 function browserRefusal(held, ask) {
     const modelsWhileRunning = 'A session is running and it is using the browser profile. Stop it first, then read the models.';
+    const loginWhileBusy = 'The browser profile is in use right now. Sign in once the run, or the reading of the models, has finished.';
+    // The sign-in window holds the profile until the operator has signed in and it closes.
+    if (held.kind === 'login') {
+        return ask.kind === 'login'
+            ? 'The sign-in window is already open. Finish signing in there.'
+            : 'the sign-in window is open and has the browser profile; finish signing in first';
+    }
+    if (ask.kind === 'login')
+        return loginWhileBusy;
     if (held.kind === 'batch') {
         if (ask.kind === 'models')
             return modelsWhileRunning;
@@ -311,6 +321,14 @@ let OperatorService = class OperatorService {
         await this.store.deletePersona(name);
     }
     // --- sessions and tasks ---------------------------------------------------------------
+    /** The operator's order for the sessions list, top to bottom. See `SessionStore.reorderSessions`. */
+    async reorderSessions(ids) {
+        await this.init();
+        if (!Array.isArray(ids) || ids.some((x) => typeof x !== 'string'))
+            throw new Error('ids must be a list of session ids.');
+        await this.store.reorderSessions(ids);
+        return await this.listSessions();
+    }
     async listSessions() {
         await this.init();
         const all = await this.store.listSessions();
@@ -395,6 +413,12 @@ let OperatorService = class OperatorService {
                     merged.baseBranch = merged.baseBranch.trim();
                 if (merged.existingBranch !== undefined)
                     merged.existingBranch = merged.existingBranch.trim();
+                // Only the two known fields, and absent when it says what absent says: reject, asking first.
+                const dirty = dirtyPolicy(merged);
+                if (dirty.policy === 'reject')
+                    delete merged.dirtyWorktree;
+                else
+                    merged.dirtyWorktree = { policy: dirty.policy, ...(dirty.requireApproval ? {} : { requireApproval: false }) };
                 // Only the program marks a name as one of its own branches, and a name changed is not that one.
                 const stillOwn = !!s.vcs?.branchNameExact && (merged.branchName ?? '').trim() === (s.vcs.branchName ?? '').trim();
                 if (stillOwn)
@@ -1813,11 +1837,27 @@ let OperatorService = class OperatorService {
             return { ok: false, repoDir: '', problem: "git is not installed, or not on this machine's PATH.", git: null };
         // `branch` is where HEAD is; `work` is where the session's work is. After a per-task run
         // those differ, and the second is the one the operator is asking about.
-        const preflight = await vcsPreflight(session);
+        const preflight = await vcsPreflight(session, () => this.store.listSessions());
         // The local branches, so "carry on an existing branch" can offer them rather than be typed blind.
         const branches = preflight.repoDir ? await localBranches(preflight.repoDir) : [];
         return { ...preflight, git, work: sessionBranches(session), branches };
     }
+    /**
+     * The operator's approval of the starting snapshot: their uncommitted changes become the commit the
+     * session starts from, each file taken or left out as they chose on the list. See `vcs/snapshot.ts`.
+     * Refused while anything could be working in the repository, as a restore is: it changes branches.
+     */
+    async vcsSnapshot(sessionId, choices) {
+        await this.init();
+        const session = await this.store.getSession(sessionId);
+        if (!session)
+            throw new Error('No such session.');
+        const refused = await this.restoreRefusal(session);
+        if (refused)
+            return { ok: false, problem: refused };
+        const taken = await takeSnapshot(session, { approved: true, choices: choices && typeof choices === 'object' ? choices : {} }, this.bus, async (mutate) => void (await this.store.updateSession(sessionId, mutate)), () => this.store.listSessions());
+        return taken.ok ? { ok: true, branch: taken.start.branch, commit: taken.start.commit } : { ok: false, problem: taken.problem };
+    }
     /**
      * What going back to before a task would do, and then doing it.
      *
@@ -2397,6 +2437,77 @@ let OperatorService = class OperatorService {
      * gets to choose from, which is the only way this keeps working when Microsoft changes the
      * line-up.
      */
+    /**
+     * "Sign in" from Settings: what `cop login` does, from the page.
+     *
+     * Opens Edge with the bot's own profile — the one in Settings, which is the one every run uses —
+     * and waits for the operator to sign in to Microsoft 365 Copilot. With an account, the profile is
+     * signed out first and the chat asked for that account, because Edge on a work machine otherwise
+     * signs the profile in with whatever account Windows knows. The bot never types a credential:
+     * the person signs in, completes any verification, and the window closes once the chat is there.
+     *
+     * The request stays open until then (up to `copilot.signInTimeoutSec`). It takes the browser like
+     * a run does, so it is refused while a run or a reading of the models has it, and they are while
+     * it is open.
+     */
+    async login(account) {
+        const upn = account?.trim() || undefined;
+        if (upn && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(upn)) {
+            throw new Error(`"${upn}" is not an account address. Give the work or school address, for example name@company.com, or leave it empty.`);
+        }
+        const claim = this.claimBrowser({ kind: 'login' });
+        if ('refused' in claim)
+            throw new Error(claim.refused);
+        let transport = null;
+        try {
+            await this.init();
+            const cfg = await this.settings.load();
+            transport = createTransport({
+                profileDir: cfg.resolved.profileDir,
+                transportDir: join(cfg.resolved.runsDir, '_login'),
+                chatUrl: cfg.copilot.url,
+                channel: cfg.copilot.channel,
+                // Always on screen, whatever Settings say: a person has to see the window to sign in.
+                headless: false,
+                replyTimeoutMs: 60_000,
+                signInTimeoutMs: cfg.copilot.signInTimeoutSec * 1000,
+                humanWaitMs: cfg.copilot.signInTimeoutSec * 1000,
+                keepFailurePage: cfg.copilot.keepFailurePage,
+            });
+            await transport.open();
+            if (upn) {
+                await transport.signOut();
+                await transport.gotoChatAs(upn, cfg.copilot.url);
+            }
+            await transport.ensureSignedIn(upn ? undefined : cfg.copilot.url);
+            const accounts = await transport.findAccountsInPage();
+            if (!upn) {
+                return {
+                    ok: true,
+                    accounts,
+                    message: accounts.length > 0 ? `Signed in. The page shows: ${accounts.join(', ')}.` : 'Signed in.',
+                };
+            }
+            const matched = accounts.some((a) => a.toLowerCase() === upn.toLowerCase());
+            if (matched)
+                return { ok: true, accounts, account: upn, matched, message: `Signed in as ${upn}.` };
+            if (accounts.length > 0) {
+                return {
+                    ok: false,
+                    accounts,
+                    account: upn,
+                    matched,
+                    message: `Signed in, but not as ${upn}: the page shows ${accounts.join(', ')}. Sign in again and choose "Use another account".`,
+                };
+            }
+            return { ok: true, accounts, account: upn, message: `Signed in. The account could not be read from the page, so ${upn} is not confirmed.` };
+        }
+        finally {
+            // Always closed: a window left open keeps the profile locked, and the next run would fail on it.
+            await transport?.close().catch(() => undefined);
+            this.releaseBrowser(claim.holder);
+        }
+    }
     async refreshModels() {
         // Asked of the one claim every window goes through (see `browser`), before anything is waited
         // for. It used to count the sessions running, which is none in the moment between two

package/dist/src/plan/brief.js

@@ -454,6 +454,16 @@ Before a session's first branch the runner fetches and fast-forwards the branch
 merges. \`"updateFromRemote": false\` turns that off — only when the user asks to work offline or from
 local commits on purpose.
 
+**dirtyWorktree** — what happens when the repository has uncommitted changes (the user's own, such as
+input files a task needs) before a session's first task. Ask only when the user mentions such files:
+\`{ "policy": "snapshot" }\` makes them one commit, "Capture operator baseline before run", on a branch of
+its own, and the session starts from it; the user approves the exact list on the session's page first.
+\`"tracked-only-snapshot"\` takes tracked changes only. Secrets (\`.env\`), tool output and files outside
+the project are never taken, and an ignored file only when a task's \`scope\` names it. The snapshot is
+taken where the changes are, so use it with \`startFrom\` \`"branch"\` only when the repository is already on
+that branch, and never with \`"existing-branch"\`. Leaving it out keeps \`"reject"\`: version control stays out
+of a tree with uncommitted changes.
+
 Put the same \`startFrom\` on every session that works in one repository unless the user wants it
 mixed. Leaving it out keeps the old behaviour — whatever branch the repository is on — which is
 the one to avoid.
@@ -512,6 +522,16 @@ const VCS_DETAIL_BG = `
 reset или merge. \`"updateFromRemote": false\` го изключва — само ако потребителят поиска да работи
 офлайн или нарочно от локални commit-и.
 
+**dirtyWorktree** — какво става, когато хранилището има некомитнати промени (на потребителя, например
+входни файлове, които задача използва) преди първата задача на сесията. Питай само ако потребителят
+спомене такива файлове: \`{ "policy": "snapshot" }\` ги прави един commit, „Capture operator baseline before
+run“, на отделен клон, и сесията тръгва от него; потребителят първо одобрява точния списък на страницата на
+сесията. \`"tracked-only-snapshot"\` взема само tracked промени. Тайни (\`.env\`), изход от инструменти и
+файлове извън проекта никога не се вземат, а ignored файл — само когато \`scope\` на задача го посочва.
+Снимката се прави там, където са промените, затова с \`startFrom\` \`"branch"\` само ако хранилището вече е на
+този клон, и никога с \`"existing-branch"\`. Ако го пропуснеш, остава \`"reject"\`: контролът на версиите
+не влиза в дърво с некомитнати промени.
+
 Сложи един и същ \`startFrom\` на всички сесии в едно хранилище, освен ако потребителят не иска
 различни. Ако го пропуснеш, остава старото поведение — от който клон е хранилището в момента —
 което е за избягване.
@@ -1438,6 +1458,13 @@ bot actually does, because it changes what a good task looks like:
   reads it and decides the next step. This repeats until Copilot writes a final summary.
 - Nothing is interactive. A command that waits for a keypress, opens an editor or needs a
   browser login will hang the task.
+- **How the working chat learns the project: by running commands.** No file of the project is
+  copied, attached or uploaded to it. In each task it reads what it needs itself, with terminal
+  commands in the project folder — it lists the folders, opens the files, looks at the git log —
+  and the output comes back to it. So never ask the user how the chat will get the project's files,
+  how it will see the code or whether to attach anything; that is settled. If the organisation
+  document still says how the chat reaches a project (attached files, a Desktop copy), ignore it:
+  that way no longer exists. Write prompts that name the paths to read, not files to attach.
 - **Only the project folders.** The runner refuses any command, check or file path that reaches
   outside the session's folder and the projects listed below — reading as well as writing — and
   anything that manages the machine: the registry, services, the network, users, installs that
@@ -1655,6 +1682,13 @@ function buildBg(projects, ctx = {}) {
   чете и решава следващата стъпка. Това се повтаря, докато Copilot не напише финално резюме.
 - Нищо не е интерактивно. Команда, която чака клавиш, отваря редактор или иска вход през
   браузър, ще увисне.
+- **Как работният чат опознава проекта: с команди.** Никой файл от проекта не се копира, прикачва
+  или качва в него. Във всяка задача той сам чете каквото му трябва, с терминални команди в папката
+  на проекта — изброява папките, отваря файловете, гледа git историята — и изходът се връща при него.
+  Затова никога не питай потребителя как чатът ще получи файловете на проекта, как ще види кода или
+  дали да прикачи нещо; това е решено. Ако документът за организацията още казва как чатът стига до
+  проект (прикачени файлове, копие на Desktop-а), не го слушай: такъв начин вече няма. Пиши prompt-ове,
+  които назовават пътищата за четене, а не файлове за прикачване.
 - **Само папките на проектите.** Runner-ът отказва всяка команда, проверка или път към файл, който
   излиза извън папката на сесията и проектите, изброени по-долу — и за четене, и за запис — и всичко,
   което управлява машината: регистъра, услугите, мрежата, потребителите, инсталации извън проекта.

package/dist/src/plan/importPlan.js

@@ -172,7 +172,12 @@ defaultProjectDir = '') {
                 'the chat reads the project by running commands. "mirror" was ignored.');
         }
         const created = await store.createSession(planned.name, planned.projectDir || planned.mirror?.rootDir || '');
-        const vcs = { ...DEFAULT_VCS, ...(planned.vcs ?? {}) };
+        const { dirtyWorktree: plannedDirty, ...plannedVcs } = planned.vcs ?? {};
+        const vcs = { ...DEFAULT_VCS, ...plannedVcs };
+        // Stored in the one spelling the session has: see `DirtyWorktree`.
+        const policy = plannedDirty?.policy === 'snapshot' && plannedDirty.includeUntracked === false ? 'tracked-only-snapshot' : plannedDirty?.policy;
+        if (policy && policy !== 'reject')
+            vcs.dirtyWorktree = { policy, ...(plannedDirty?.requireApproval === false ? { requireApproval: false } : {}) };
         vcs.branchPrefix = vcs.branchPrefix.trim() || DEFAULT_VCS.branchPrefix;
         vcs.repoDir = vcs.repoDir.trim();
         // A branch to carry on, given alone, is that choice: see `VersionControl.startFrom`.
@@ -211,5 +216,7 @@ defaultProjectDir = '') {
         }
         sessions.push({ id: created.id, name: created.name, tasks: titles.length, titles });
     }
+    // The plan's sessions on top of the list, in the order the plan gives them, not newest first.
+    await store.placeOnTop(sessions.map((s) => s.id));
     return { sessions, taskCount: sessions.reduce((n, s) => n + s.tasks, 0), warnings };
 }

package/dist/src/plan/schema.js

@@ -60,6 +60,23 @@ const VcsInput = z
      * Absent means true. See `VersionControl.updateFromRemote`.
      */
     updateFromRemote: z.boolean().optional(),
+    /**
+     * What the session's first run does with uncommitted changes. See `DirtyWorktree`. Accepts the
+     * longer spelling a chat model may write — `includeUntracked: false` is `tracked-only-snapshot`,
+     * and `includeIgnoredOnlyWhenScoped` can only be true, since that is the rule, not a choice.
+     */
+    dirtyWorktree: z
+        .object({
+        policy: z.enum(['reject', 'snapshot', 'tracked-only-snapshot'], {
+            error: 'dirtyWorktree.policy must be "reject" (uncommitted changes keep version control out, as until now), "snapshot" (they become the commit the session starts from) or "tracked-only-snapshot" (the same, tracked changes only). "discard" is not offered: the runner never throws work away.',
+        }),
+        requireApproval: z.boolean().optional(),
+        includeUntracked: z.boolean().optional(),
+        includeIgnoredOnlyWhenScoped: z
+            .literal(true, { error: 'dirtyWorktree.includeIgnoredOnlyWhenScoped can only be true: an ignored file goes into a snapshot only when a task\'s scope names it. Leave the field out.' })
+            .optional(),
+    })
+        .optional(),
 }, {
     error: 'Every session needs a "vcs" object saying whether the runner does version control for it and, when it does, which git repository to work in. Ask the user both questions and write the answers here.',
 })
@@ -78,6 +95,13 @@ const VcsInput = z
             message: `"existingBranch" carries on a branch that exists, and startFrom "${vcs.startFrom}" cuts a new one. Keep one: startFrom "existing-branch" with existingBranch, or leave existingBranch out.`,
         });
     }
+    if (vcs.dirtyWorktree?.policy === 'tracked-only-snapshot' && vcs.dirtyWorktree.includeUntracked === true) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['dirtyWorktree', 'includeUntracked'],
+            message: '"tracked-only-snapshot" takes tracked changes only, and includeUntracked true asks for new files too. Keep one: policy "snapshot", or leave includeUntracked out.',
+        });
+    }
     if (vcs.enabled && !vcs.repoDir.trim()) {
         ctx.addIssue({
             code: 'custom',

package/dist/src/plan/systemGuide.js

@@ -827,6 +827,22 @@ export const SYSTEM_GUIDE = [
                         doesEn: 'Deletes every session ticked in the first column after one question, also during a run; never the one running. Run folders and chats survive.',
                         doesBg: 'Изтрива всички отметнати в първата колона сесии след един въпрос, и по време на пускане; никога работещата. Папките и разговорите остават.',
                     },
+                    {
+                        key: 'home.moveUp',
+                        kind: 'button',
+                        en: 'Move {name} up in the list',
+                        bg: 'Премести {name} нагоре в списъка',
+                        doesEn: 'The ↑ arrow in the Order column: one place up. ↓ is one place down. Dragging a row onto another moves it there. An imported plan comes in on top in its own order.',
+                        doesBg: 'Стрелката ↑ в колона „Ред“: едно място нагоре. ↓ е едно надолу. Плъзгане на ред върху друг го мести там. Импортиран план идва най-отгоре в своя ред.',
+                    },
+                    {
+                        key: 'home.moveDown',
+                        kind: 'button',
+                        en: 'Move {name} down in the list',
+                        bg: 'Премести {name} надолу в списъка',
+                        doesEn: 'The ↓ arrow in the Order column: one place down. A run of several takes the ticked sessions top to bottom.',
+                        doesBg: 'Стрелката ↓ в колона „Ред“: едно място надолу. Пускане на няколко взима отметнатите сесии отгоре надолу.',
+                    },
                     {
                         key: 'home.delete',
                         kind: 'button',
@@ -1192,6 +1208,22 @@ export const SYSTEM_GUIDE = [
                         doesEn: 'One local commit per task whatever the outcome; unticked leaves the changes loose in the working tree.',
                         doesBg: 'По един локален комит на задача, независимо от изхода; без отметка промените остават свободни в работното дърво.',
                     },
+                    {
+                        key: 'vcs.dirty',
+                        kind: 'note',
+                        en: 'Uncommitted changes',
+                        bg: 'Некомитнати промени',
+                        doesEn: 'What the first task does when the repository has uncommitted changes: keep version control out (as until now), or take them — all, or tracked only — as a starting snapshot: one commit on a branch of its own that the session starts from. In a plan: "dirtyWorktree": { "policy": "snapshot" }. Not shown for "Carry on an existing branch".',
+                        doesBg: 'Какво прави първата задача, когато хранилището има некомитнати промени: без контрол на версиите (както досега) или ги взема — всички или само tracked — като начална снимка: един комит на отделен клон, от който сесията тръгва. В план: "dirtyWorktree": { "policy": "snapshot" }. Не се показва при „Продължи съществуващ клон“.',
+                    },
+                    {
+                        key: 'vcs.snapshotTake',
+                        kind: 'button',
+                        en: 'Take the starting snapshot',
+                        bg: 'Направи началната снимка',
+                        doesEn: 'Under the list of uncommitted files, each set to "Include in the starting snapshot" or "Leave out of the run": commits the included ones on the snapshot branch; left-out files go to the repository\'s .git/info/exclude. Until it is pressed a run of the session is refused and nothing changes.',
+                        doesBg: 'Под списъка с некомитнати файлове, всеки с „Включи в началната снимка“ или „Остави извън изпълнението“: комитва включените на клона на снимката; оставените извън отиват в .git/info/exclude на хранилището. Докато не е натиснат, пускане на сесията се отказва и нищо не се променя.',
+                    },
                     {
                         key: 'vcs.ready',
                         kind: 'note',
@@ -2650,6 +2682,37 @@ export const SYSTEM_GUIDE = [
                     },
                 ],
             },
+            {
+                headingKey: 'login.title',
+                en: 'Sign in to Copilot',
+                bg: 'Вход в Copilot',
+                controls: [
+                    {
+                        key: 'login.account',
+                        kind: 'field',
+                        en: 'Account (optional)',
+                        bg: 'Акаунт (по желание)',
+                        doesEn: 'The work or school address to sign in as. Empty: whichever account is chosen in the window. With one, the profile is signed out first and Microsoft is asked for it.',
+                        doesBg: 'Служебният адрес, с който да се влезе. Празно: какъвто акаунт се избере в прозореца. С адрес профилът първо излиза и Microsoft се пита точно за него.',
+                    },
+                    {
+                        key: 'login.button',
+                        kind: 'button',
+                        en: 'Sign in to Copilot',
+                        bg: 'Вход в Copilot',
+                        doesEn: 'What "cop login" does: opens the bot\'s own Edge, waits for the operator to sign in there (the bot never types a password), and closes once the chat appears. Needed once before a run or a reading of the models.',
+                        doesBg: 'Това, което прави „cop login“: отваря собствения Edge на бота, чака операторът да влезе в него (ботът никога не пише парола) и се затваря, щом чатът се появи. Нужно е веднъж преди пускане или четене на моделите.',
+                    },
+                    {
+                        key: 'login.busy',
+                        kind: 'note',
+                        en: 'Waiting for you to sign in…',
+                        bg: 'Чака да влезете…',
+                        doesEn: 'The same button while the sign-in window is open; runs and the reading of the models wait for it.',
+                        doesBg: 'Същият бутон, докато прозорецът за вход е отворен; пусканията и четенето на моделите чакат.',
+                    },
+                ],
+            },
             {
                 headingKey: 'def.modelTitle',
                 en: 'Model for new sessions',

package/dist/src/session/exports.js

@@ -147,6 +147,8 @@ export function buildPlanExport(scope) {
                     ...(s.vcs?.existingBranch ? { existingBranch: s.vcs.existingBranch } : {}),
                     // Only when switched off: absent is on.
                     ...(s.vcs?.updateFromRemote === false ? { updateFromRemote: false } : {}),
+                    // Only when chosen: absent is reject, as it always was.
+                    ...(s.vcs?.dirtyWorktree && s.vcs.dirtyWorktree.policy !== 'reject' ? { dirtyWorktree: { ...s.vcs.dirtyWorktree } } : {}),
                 },
                 review: { enabled: s.review?.enabled !== false, model: s.review?.model ?? '' },
                 ...(s.projectDir ? { projectDir: s.projectDir } : {}),

package/dist/src/session/store.js

@@ -29,6 +29,27 @@ const ACTIVE_STATUSES = ['running', 'waiting-approval'];
  * feature works at all would mean most runs go unreviewed.
  */
 export const DEFAULT_REVIEW = { enabled: true, model: '' };
+/**
+ * Where a session sits in the list: its position, or, for one saved before the list could be
+ * arranged, minus the time it was created — which keeps those newest first, as they always were,
+ * and above any arranged session only if they are newer than the list's top was.
+ */
+export function sessionListKey(s) {
+    if (typeof s.position === 'number' && Number.isFinite(s.position))
+        return s.position;
+    const t = Date.parse(s.createdAt);
+    return Number.isNaN(t) ? 0 : -t;
+}
+/** The sessions list's order: by position, then newest first, then by id so it never wobbles. */
+export function bySessionList(a, b) {
+    const byKey = sessionListKey(a) - sessionListKey(b);
+    if (byKey !== 0)
+        return byKey;
+    const byTime = Date.parse(b.createdAt) - Date.parse(a.createdAt);
+    if (byTime !== 0 && !Number.isNaN(byTime))
+        return byTime;
+    return b.id.localeCompare(a.id);
+}
 export const DEFAULT_VCS = {
     enabled: true,
     repoDir: '',
@@ -254,12 +275,50 @@ export class SessionStore {
             if (s)
                 out.push(s);
         }
-        return out.sort((a, b) => {
-            const byTime = Date.parse(b.createdAt) - Date.parse(a.createdAt);
-            if (byTime !== 0 && !Number.isNaN(byTime))
-                return byTime;
-            return b.id.localeCompare(a.id);
-        });
+        return out.sort(bySessionList);
+    }
+    /**
+     * Puts these sessions at the top of the list, in this order.
+     *
+     * An import calls it with the plan's sessions, so they appear as the plan wrote them. Before
+     * this, the list was newest first, and a plan whose sessions were created one after another
+     * read upside down.
+     */
+    async placeOnTop(ids) {
+        const wanted = new Set(ids);
+        const others = (await this.listSessions()).filter((s) => !wanted.has(s.id));
+        const top = others.length > 0 ? Math.min(...others.map(sessionListKey)) : 0;
+        for (const [i, id] of ids.entries()) {
+            await this.updateSession(id, (s) => {
+                s.position = top - ids.length + i;
+            });
+        }
+    }
+    /**
+     * The operator's own order: every session, top to bottom.
+     *
+     * The whole list is given, not one move, so two pages moving rows at once cannot leave positions
+     * that contradict each other: the last order sent is the order there is. A list that names a
+     * session that does not exist, or leaves one out, is refused rather than guessed at.
+     */
+    async reorderSessions(ids) {
+        const all = await this.listSessions();
+        const known = new Set(all.map((s) => s.id));
+        const given = new Set(ids);
+        if (given.size !== ids.length)
+            throw new Error('The order names a session twice.');
+        const unknown = ids.filter((id) => !known.has(id));
+        if (unknown.length > 0)
+            throw new Error(`The order names a session that does not exist: ${unknown.join(', ')}.`);
+        const missing = all.filter((s) => !given.has(s.id)).map((s) => s.name);
+        if (missing.length > 0)
+            throw new Error(`The order leaves out ${missing.length} session(s): ${missing.slice(0, 5).join(', ')}. Reload the list and try again.`);
+        for (const [i, id] of ids.entries()) {
+            await this.updateSession(id, (s) => {
+                s.position = i;
+            });
+        }
+        return await this.listSessions();
     }
     /**
      * The session of this id, or null when there is none.
@@ -282,10 +341,13 @@ export class SessionStore {
         return await this.readSession(path);
     }
     async createSession(name, projectDir = '') {
+        // A new session goes on top of the list, where it is looked for.
+        const existing = await this.listSessions();
         const session = {
             id: newId(),
             name: name.trim() || 'untitled',
             createdAt: new Date().toISOString(),
+            position: existing.length > 0 ? Math.min(...existing.map(sessionListKey)) - 1 : 0,
             status: 'idle',
             contractSent: false,
             // A queue is a chain until the operator says otherwise, which is how it has always

package/dist/src/transport/copilotTransport.js

@@ -11,7 +11,7 @@
  *   3. A message cannot consist of an attachment alone; Send stays disabled without text.
  */
 import { chromium } from 'playwright';
-import { mkdir } from 'node:fs/promises';
+import { mkdir, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { findRecentCrash, describeCrash } from './edgeCrash.js';
 import { landed } from './acceptance.js';
@@ -575,6 +575,7 @@ Current URL: ${url}`);
             return { options: [], current, note: 'The model picker opened nothing that could be read.' };
         }
         const top = await this.readMenuRows();
+        await this.captureMenu('top', top);
         await this.closeMenu();
         const options = top.filter((r) => !r.opensSubmenu).map(({ opensSubmenu, ...o }) => o);
         const groups = top.filter((r) => r.opensSubmenu);
@@ -589,8 +590,44 @@ Current URL: ${url}`);
             }
         }
         this.emit('models-read', { count: options.length, groups: groups.length, current });
+        await this.captureMenu('result', top, { current, options }).catch(() => undefined);
         return { options, current };
     }
+    /**
+     * What the picker showed, kept beside the reading: the menu as HTML, a picture of it, and the rows
+     * that were read from it.
+     *
+     * The picker is Microsoft's markup and it changes without notice; when "Read the list from
+     * Copilot" comes back with the wrong models, the only way to see why is the menu as it was at that
+     * moment. Written to this transport's folder (runs/_models for that button), overwritten by the
+     * next reading, and never a reason for the reading to fail. Nothing personal is in a model menu.
+     */
+    async captureMenu(label, rows, extra) {
+        try {
+            await mkdir(this.opts.transportDir, { recursive: true });
+            const base = join(this.opts.transportDir, `models-${label}`);
+            if (label !== 'result') {
+                const html = await this.p
+                    .evaluate((selectors) => {
+                    const parts = [];
+                    for (const sel of selectors) {
+                        for (const el of Array.from(document.querySelectorAll(sel))) {
+                            if (el.getClientRects().length > 0)
+                                parts.push(`<!-- ${sel} -->\n${el.outerHTML}`);
+                        }
+                    }
+                    return parts.join('\n\n');
+                }, [...Model.popupSelectors])
+                    .catch((e) => `<!-- could not read the menu: ${String(e)} -->`);
+                await writeFile(`${base}.html`, html, 'utf8');
+                await this.p.screenshot({ path: `${base}.png` }).catch(() => undefined);
+            }
+            await writeFile(`${base}.json`, JSON.stringify({ at: new Date().toISOString(), rows, ...(extra ?? {}) }, null, 2), 'utf8');
+        }
+        catch {
+            /* a diagnostic, never the reason a reading fails */
+        }
+    }
     /** Every visible menu row right now, across the menu and whatever submenu is open. */
     async readMenuRows() {
         return await this.p.evaluate(({ roles, selectedAttrs, submenuAttrs }) => {
@@ -652,6 +689,7 @@ Current URL: ${url}`);
             await trigger.click().catch(() => undefined);
             children = await this.waitForNewRows(topNames);
         }
+        await this.captureMenu(`group-${groupName.replace(/[^A-Za-z0-9._-]+/g, '-').slice(0, 40)}`, children);
         await this.closeMenu();
         return children;
     }