copilot-operator 0.1.16 → 0.1.18

package/dist/src/api/operator.controller.js

@@ -126,6 +126,10 @@ let OperatorController = class OperatorController {
     sessions() {
         return this.ops.listSessions();
     }
+    /** The sessions list in the operator's order: every session id, top to bottom. */
+    reorderSessions(body) {
+        return this.ops.reorderSessions(body?.ids).catch(fail);
+    }
     createSession(body) {
         return this.ops.createSession(body?.name ?? '', body?.projectDir).catch(fail);
     }
@@ -500,6 +504,10 @@ let OperatorController = class OperatorController {
     vcsStatus(id) {
         return this.ops.vcsStatus(id).catch(fail);
     }
+    /** The operator's approval of the starting snapshot: one choice per file of the list they saw. */
+    vcsSnapshot(id, body) {
+        return this.ops.vcsSnapshot(id, body?.choices ?? {}).catch(fail);
+    }
     // --- the model picker ---------------------------------------------------------------------
     /** The cached list. Returns null when the picker has never been read on this machine. */
     models() {
@@ -632,6 +640,13 @@ __decorate([
     __metadata("design:paramtypes", []),
     __metadata("design:returntype", Promise)
 ], OperatorController.prototype, "sessions", null);
+__decorate([
+    Put('sessions-order'),
+    __param(0, Body()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], OperatorController.prototype, "reorderSessions", null);
 __decorate([
     Post('sessions'),
     __param(0, Body()),
@@ -1027,6 +1042,14 @@ __decorate([
     __metadata("design:paramtypes", [String]),
     __metadata("design:returntype", Promise)
 ], OperatorController.prototype, "vcsStatus", null);
+__decorate([
+    Post('sessions/:id/vcs/snapshot'),
+    __param(0, Param('id')),
+    __param(1, Body()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", Promise)
+], OperatorController.prototype, "vcsSnapshot", null);
 __decorate([
     Get('models'),
     __metadata("design:type", Function),

package/dist/src/api/operator.service.js

@@ -19,7 +19,7 @@ import { join, resolve } from 'node:path';
 import { installLayout } from '../config/layout.js';
 import { SessionStore, DEFAULT_VCS, DEFAULT_REVIEW, applyDefaultProject, applyTaskPatch } from '../session/store.js';
 import { EventBus } from '../session/events.js';
-import { isContinuable, newId } from '../session/model.js';
+import { freshRetriesOfLatestRun, isContinuable, newId } from '../session/model.js';
 import { runSession, openBrowser, queuedToRun } from '../orchestrator/taskRunner.js';
 import { buildExport } from '../session/exportRecord.js';
 import { buildDebugExport } from '../session/debugExport.js';
@@ -45,6 +45,8 @@ import { unattendedPrecondition } from '../exec/policy.js';
 import { createTransport } from '../transport/chatTransport.js';
 import { composeHandoff } from '../session/handoff.js';
 import { planSync } from '../vcs/syncCommand.js';
+import { dirtyPolicy, takeSnapshot } from '../vcs/snapshot.js';
+import { normalisePatterns } from '../vcs/inputs.js';
 import { computeMetrics } from '../session/metrics.js';
 import { resolveDesktopDir, desktopIsSynced } from '../context/desktopDir.js';
 import { saveAndReveal } from './saveToDesktop.js';
@@ -320,6 +322,14 @@ let OperatorService = class OperatorService {
         await this.store.deletePersona(name);
     }
     // --- sessions and tasks ---------------------------------------------------------------
+    /** The operator's order for the sessions list, top to bottom. See `SessionStore.reorderSessions`. */
+    async reorderSessions(ids) {
+        await this.init();
+        if (!Array.isArray(ids) || ids.some((x) => typeof x !== 'string'))
+            throw new Error('ids must be a list of session ids.');
+        await this.store.reorderSessions(ids);
+        return await this.listSessions();
+    }
     async listSessions() {
         await this.init();
         const all = await this.store.listSessions();
@@ -404,6 +414,32 @@ let OperatorService = class OperatorService {
                     merged.baseBranch = merged.baseBranch.trim();
                 if (merged.existingBranch !== undefined)
                     merged.existingBranch = merged.existingBranch.trim();
+                // Only the two known fields, and absent when it says what absent says: reject, asking first.
+                const dirty = dirtyPolicy(merged);
+                if (dirty.policy === 'reject')
+                    delete merged.dirtyWorktree;
+                else
+                    merged.dirtyWorktree = { policy: dirty.policy, ...(dirty.requireApproval ? {} : { requireApproval: false }) };
+                // Input files and artifacts: patterns as the matching reads them, absent when there are none.
+                const inputPaths = normalisePatterns(merged.userInputs?.paths ?? []);
+                if (inputPaths.length === 0)
+                    delete merged.userInputs;
+                else {
+                    merged.userInputs = {
+                        paths: inputPaths,
+                        ...(merged.userInputs?.readOnly === false ? { readOnly: false } : {}),
+                        ...(merged.userInputs?.requireApproval === false ? { requireApproval: false } : {}),
+                    };
+                }
+                const artifactPaths = normalisePatterns(merged.artifacts?.paths ?? []);
+                if (artifactPaths.length === 0)
+                    delete merged.artifacts;
+                else
+                    merged.artifacts = { paths: artifactPaths };
+                // New inputs are settled again at the next task: the recorded ones are no longer the whole list.
+                if (JSON.stringify(merged.userInputs ?? null) !== JSON.stringify(s.vcs?.userInputs ?? null) && s.vcsStart?.inputs) {
+                    s.vcsStart = { ...s.vcsStart, inputs: undefined };
+                }
                 // Only the program marks a name as one of its own branches, and a name changed is not that one.
                 const stillOwn = !!s.vcs?.branchNameExact && (merged.branchName ?? '').trim() === (s.vcs.branchName ?? '').trim();
                 if (stillOwn)
@@ -1822,11 +1858,27 @@ let OperatorService = class OperatorService {
             return { ok: false, repoDir: '', problem: "git is not installed, or not on this machine's PATH.", git: null };
         // `branch` is where HEAD is; `work` is where the session's work is. After a per-task run
         // those differ, and the second is the one the operator is asking about.
-        const preflight = await vcsPreflight(session);
+        const preflight = await vcsPreflight(session, () => this.store.listSessions());
         // The local branches, so "carry on an existing branch" can offer them rather than be typed blind.
         const branches = preflight.repoDir ? await localBranches(preflight.repoDir) : [];
         return { ...preflight, git, work: sessionBranches(session), branches };
     }
+    /**
+     * The operator's approval of the starting snapshot: their uncommitted changes become the commit the
+     * session starts from, each file taken or left out as they chose on the list. See `vcs/snapshot.ts`.
+     * Refused while anything could be working in the repository, as a restore is: it changes branches.
+     */
+    async vcsSnapshot(sessionId, choices) {
+        await this.init();
+        const session = await this.store.getSession(sessionId);
+        if (!session)
+            throw new Error('No such session.');
+        const refused = await this.restoreRefusal(session);
+        if (refused)
+            return { ok: false, problem: refused };
+        const taken = await takeSnapshot(session, { approved: true, choices: choices && typeof choices === 'object' ? choices : {} }, this.bus, async (mutate) => void (await this.store.updateSession(sessionId, mutate)), () => this.store.listSessions());
+        return taken.ok ? { ok: true, branch: taken.start.branch, commit: taken.start.commit } : { ok: false, problem: taken.problem };
+    }
     /**
      * What going back to before a task would do, and then doing it.
      *
@@ -2570,7 +2622,7 @@ let OperatorService = class OperatorService {
                     commit: t.vcs?.commit,
                     vcsProblem: t.vcs?.problem,
                     sessionInactive: s.active === false || undefined,
-                    autoRetries: t.autoRetries || undefined,
+                    autoRetries: freshRetriesOfLatestRun(t) || undefined,
                     attempt: t.attempt,
                     changedFiles: t.vcs?.commit && t.vcs.baseCommit ? (t.vcs.files?.length ?? 0) : undefined,
                     interrupted: t.status === 'aborted' && !!t.interruption ? true : undefined,

package/dist/src/orchestrator/derivedChecks.js

@@ -23,7 +23,25 @@ export function derivedCheckName(findingId, name) {
     return `review ${findingId}: ${name}`;
 }
 export function isDerivedCheck(check) {
-    return /^review r\d+f\d+: /.test(check.name);
+    return /^review (?:a\d+)?r\d+f\d+: /.test(check.name);
+}
+/**
+ * Kept checks written before a finding's id carried its attempt, given the id it carries now.
+ *
+ * Those records hold `r1f1` for attempt 1's first finding and again for attempt 2's, under one check
+ * name, and a dispute, a deferral or a drop aimed at one acted on both. Renamed from the attempt each
+ * was made on (see `findingId`), check name included, so the gate and the implementer see the same
+ * name a dispute can then use. A check of the first attempt, and one already renamed, is left as it is.
+ */
+export function withAttemptIds(reviewChecks) {
+    return reviewChecks.map((rc) => {
+        if ((rc.attempt ?? 1) <= 1 || !/^r\d+f\d+$/.test(rc.findingId))
+            return rc;
+        const id = `a${rc.attempt}${rc.findingId}`;
+        const before = derivedCheckName(rc.findingId, '');
+        const name = rc.check.name.startsWith(before) ? derivedCheckName(id, rc.check.name.slice(before.length)) : rc.check.name;
+        return { ...rc, findingId: id, check: { ...rc.check, name } };
+    });
 }
 /**
  * Runs each finding's check on the current state. Kept if it fails now, refused if it passes.

package/dist/src/orchestrator/review.js

@@ -329,7 +329,7 @@ ${machineNote}` : contract);
                         problem: `every finding of round ${round} rested on something the task never asked for, twice; the review is inconclusive`,
                     };
                 }
-                const named = grounded.map((f, i) => ({ ...f, id: findingId(round, i) }));
+                const named = grounded.map((f, i) => ({ ...f, id: findingId(round, i, task.attempt ?? 1) }));
                 /*
                  * A read-only task's findings never become gate conditions.
                  *
@@ -605,7 +605,7 @@ export function findingsMessage(outcome, round, maxRounds, repeated = [], leftov
         `Fix these, then verify as usual and close the task again. This is review round ${round} of ${maxRounds};`,
         'after that the task is closed as blocked with whatever is still outstanding.',
         '',
-        'If you believe a finding is wrong, say so in `disputed`: its id (the `[r1f2]` in front of it), why it',
+        'If you believe a finding is wrong, say so in `disputed`: its id as written (the `[r1f2]` in front of it), why it',
         'is wrong, and the evidence that shows it — the command you ran and what came back. A dispute goes to',
         'the next reviewer as a claim to test; a sentence in your summary goes nowhere. Do not change the',
         'thing the reviewer looked at in order to make the objection go away.',

package/dist/src/orchestrator/taskRunner.js

@@ -21,7 +21,7 @@ import { buildCoveringMessage, assertSendable } from '../protocol/reporter.js';
 import { runStep } from '../exec/runner.js';
 import { availableShells, detectShells, effectiveShell, preferredShell, refusalForChat, resolveShell, shellNote } from '../exec/shells.js';
 import { runChecks, failureMessage, failureRedactions, failureReport, environmentProblemIn, COMMIT_CLEAN_CHECK, CONTENT_CLEAN_CHECK, RUNNER_CHECK_KINDS } from '../exec/checks.js';
-import { activeChecks, suspendDisputed, settleAfterReview, onlyDerivedFailing, isDerivedCheck } from './derivedChecks.js';
+import { activeChecks, suspendDisputed, settleAfterReview, onlyDerivedFailing, isDerivedCheck, withAttemptIds } from './derivedChecks.js';
 import { workingDirFor, isWorkingDirProblem, workingDirNote } from '../exec/workDir.js';
 import { redactSecrets } from '../exec/redaction.js';
 import { snapshotProcesses, reapLeftovers, describeLeftovers, ProcessTracker } from '../exec/processes.js';
@@ -46,6 +46,8 @@ import { ProgressWatch } from './progress.js';
 import { contractConflicts, readsTreeClean } from './contract.js';
 import { treeFingerprint } from '../vcs/git.js';
 import { prepareForTask, commitTaskResult, repoDirOf, trackedRepoOf } from '../vcs/taskVcs.js';
+import { protectInputs, inputsMessage } from '../vcs/inputs.js';
+import { artifactPatterns, keepArtifacts } from '../vcs/artifacts.js';
 import { exportMachine, writeAttemptRecord } from '../session/exports.js';
 /** Why a task that was reported as done is being closed as failed. */
 function checksFailedReason(outcomes) {
@@ -538,9 +540,10 @@ export async function runTask(transport, session, task, deps) {
     let runAfterCommit = null;
     /**
      * Checks earlier reviews gave with their findings — carried over from every attempt before
-     * this one, and grown by this one. See `derivedChecks.ts` for the three rules.
+     * this one, and grown by this one. See `derivedChecks.ts` for the three rules. Ones written before
+     * a finding's id carried its attempt are renamed here, before anything finds one by id or name.
      */
-    let reviewChecks = task.reviewChecks ?? [];
+    let reviewChecks = withAttemptIds(task.reviewChecks ?? []);
     /** Derived checks that still failed when the rounds ran out; the reviewer is told. */
     let derivedStillFailing = [];
     /**
@@ -577,10 +580,57 @@ export async function runTask(transport, session, task, deps) {
         await record(`LEFT RUNNING BY ${by.toUpperCase()}`, describeLeftovers([...result.killed, ...result.failed]));
         return all.map((l) => ({ name: l.name, ports: l.ports }));
     };
+    /** The session's read-only input files and the commit they are put back from, once the task is on its own branch. */
+    let inputsGuard = null;
+    /** Puts back whatever a round did to the input files, and tells the chat and the record. */
+    const guardInputs = async (iteration) => {
+        if (!inputsGuard)
+            return null;
+        const guard = inputsGuard;
+        const check = await protectInputs(repoDirOf(session), guard.base, guard.inputs).catch((e) => ({
+            changed: ['(the input files)'],
+            restored: [],
+            failed: [{ path: '(the input files)', why: e.message }],
+        }));
+        if (check.changed.length > 0) {
+            sink.event('inputs-restored', { iteration, restored: check.restored, failed: check.failed }, `the operator's input files are read-only; put back: ${check.restored.join(', ') || '(none)'}` +
+                (check.failed.length > 0 ? `; could not be put back: ${check.failed.map((f) => f.path).join(', ')}` : ''), 'warn');
+            runnerNotes.push(inputsMessage(check));
+            await setTask((t) => {
+                t.inputsRestored = [...new Set([...(t.inputsRestored ?? []), ...check.restored])];
+            });
+        }
+        return check;
+    };
     const finish = async (status, reason, summary, finalReply) => {
         await record(`TASK ${status.toUpperCase()}`, [summary ?? '', reason ? `Reason: ${reason}` : ''].filter(Boolean).join('\n\n') || '(no details)');
         // The net under the plan's own checks: whatever the task left running is stopped and named.
         await reap(processesBefore, 'the task');
+        /*
+         * The operator's input files, once more before the commit: put back what the last round changed,
+         * so it is not committed as the task's work. One that cannot be put back fails a done task. See
+         * `vcs/inputs.ts`.
+         */
+        if (inputsGuard) {
+            const check = await guardInputs();
+            if (check && check.failed.length > 0 && status === 'done') {
+                status = 'failed';
+                reason = `the operator's input file(s) ${check.failed.map((f) => f.path).join(', ')} were changed and could not be put back as they were: ${check.failed.map((f) => f.why).join('; ')}.`;
+            }
+        }
+        /*
+         * The session's artifacts, whatever the outcome: copied into this attempt's record, so the
+         * evidence of each attempt is kept even after a later one overwrites it. See `vcs/artifacts.ts`.
+         */
+        const patterns = artifactPatterns(session.vcs);
+        const projectRoot = repoDirOf(session) || session.projectDir?.trim() || '';
+        if (patterns.length > 0 && projectRoot) {
+            const kept = await keepArtifacts(projectRoot, patterns, join(artifactsDir, 'project')).catch((e) => ({ kept: [], skipped: [`(all: ${e.message})`] }));
+            sink.event('artifacts-kept', { kept: kept.kept.length, skipped: kept.skipped }, `artifacts kept with the run: ${kept.kept.length} file(s)${kept.skipped.length > 0 ? `; not kept: ${kept.skipped.slice(0, 5).join('; ')}` : ''}`, kept.skipped.length > 0 ? 'warn' : 'info');
+            await setTask((t) => {
+                t.artifactsKept = kept.kept.length > 0 ? kept.kept : undefined;
+            });
+        }
         /*
          * A read-only task that changed files has failed, whatever it reported.
          *
@@ -737,6 +787,9 @@ export async function runTask(transport, session, task, deps) {
         t.runId = runId;
         t.runGroup = deps.runGroup;
         t.startedAt = new Date().toISOString();
+        // The kept checks under the ids this run uses (`withAttemptIds`), so the record names them as the gate does.
+        if (reviewChecks.length > 0)
+            t.reviewChecks = reviewChecks;
     });
     sink.event('task-started', { runId, title: task.title }, `task "${task.title}" starting (run ${runId})`);
     await writeFile(taskLogPath, `TASK: ${task.title}\nSESSION: ${session.name} (${session.id})\nRUN: ${runId}\nSTARTED: ${new Date().toISOString()}\n`, 'utf8');
@@ -856,6 +909,11 @@ export async function runTask(transport, session, task, deps) {
          * findings described a tree that was not the one it had been asked to audit.
          */
         const scopeEnforced = (scope.length > 0 || !!task.readOnly) && onOwnBranch;
+        // The operator's input files, read-only on a branch of the task's own; see `vcs/inputs.ts`.
+        const startNow = (await store.getSession(session.id))?.vcsStart;
+        if (onOwnBranch && startNow?.inputs?.readOnly && startNow.inputs.files.length > 0) {
+            inputsGuard = { base: prepared.vcs.baseCommit, inputs: startNow.inputs };
+        }
         /** The working tree's fingerprint, when the task is on a branch of its own; null otherwise. */
         const treeNow = async () => prepared.vcs.branch && !prepared.vcs.problem && prepared.vcs.baseCommit ? await treeFingerprint(repoDirOf(session)).catch(() => null) : null;
         /*
@@ -1409,7 +1467,7 @@ export async function runTask(transport, session, task, deps) {
             // `repeated` still identifies them.
             const named = outcome.findings.map((f, i) => ({
                 ...f,
-                id: f.id ?? findingId(reviewRounds, i),
+                id: f.id ?? findingId(reviewRounds, i, attempt),
                 ...(repeated.includes(f) ? { repeated: true } : {}),
             }));
             outcome = { ...outcome, findings: named };
@@ -1936,6 +1994,7 @@ export async function runTask(transport, session, task, deps) {
                     });
                 }
             }
+            await guardInputs(iterations);
             // --- report back ---------------------------------------------------------------
             const report = await writeReport(results, {
                 runId,
@@ -2160,9 +2219,23 @@ export async function runSession(sessionId, deps) {
                 break;
             }
             session = (await store.getSession(sessionId));
-            const task = session.tasks.find((t) => t.id === queuedTask.id);
+            let task = session.tasks.find((t) => t.id === queuedTask.id);
             if (!task || task.status !== 'queued')
                 continue;
+            /*
+             * A task taken from the queue was started by the operator, never by the retry loop below, which
+             * runs its own. A fresh-retry mark on it is left from a retry that was queued and never ran —
+             * the new chat failed to open, the program was closed — and counted as this run's, it added the
+             * old run's retry to this one's (`freshRetriesOfLatestRun`).
+             */
+            if (task.freshRetry) {
+                session = await store.updateSession(sessionId, (s) => {
+                    const t = s.tasks.find((x) => x.id === queuedTask.id);
+                    if (t)
+                        t.freshRetry = undefined;
+                });
+                task = session.tasks.find((t) => t.id === queuedTask.id);
+            }
             let outcome = await runTask(chat, session, task, deps);
             ran += 1;
             /*
@@ -2194,11 +2267,11 @@ export async function runSession(sessionId, deps) {
                 session = await store.updateSession(sessionId, (s) => {
                     s.chat = undefined;
                     s.contractSent = false;
+                    // Marked, not counted: how many retries this run made is read back from the marks
+                    // (`freshRetriesOfLatestRun`), so a later run cannot add to an earlier one's count.
                     const again = s.tasks.find((x) => x.id === task.id);
-                    if (again) {
-                        again.autoRetries = (again.autoRetries ?? 0) + 1;
+                    if (again)
                         again.freshRetry = true;
-                    }
                 });
                 await chat.newChat();
                 /*

package/dist/src/plan/brief.js

@@ -454,6 +454,29 @@ Before a session's first branch the runner fetches and fast-forwards the branch
 merges. \`"updateFromRemote": false\` turns that off — only when the user asks to work offline or from
 local commits on purpose.
 
+**dirtyWorktree** — what happens when the repository has uncommitted changes (the user's own, such as
+input files a task needs) before a session's first task. Ask only when the user mentions such files:
+\`{ "policy": "snapshot" }\` makes them one commit, "Capture operator baseline before run", on a branch of
+its own, and the session starts from it; the user approves the exact list on the session's page first.
+\`"tracked-only-snapshot"\` takes tracked changes only. Secrets (\`.env\`), tool output and files outside
+the project are never taken, and an ignored file only when a task's \`scope\` names it. The snapshot is
+taken where the changes are, so use it with \`startFrom\` \`"branch"\` only when the repository is already on
+that branch, and never with \`"existing-branch"\`. Leaving it out keeps \`"reject"\`: version control stays out
+of a tree with uncommitted changes.
+
+**userInputs** — files the user provides for the work (schemas, test data):
+\`{ "paths": ["rules-engine/test-data/schemas/*.yaml"] }\`. They go into the commit every session starts from —
+new or ignored ones in the starting snapshot, approved by the user; a later session whose start lacks them
+gets them committed on top of it — and they are read-only while the tasks run (\`"readOnly": false\` only if
+the user wants the work to change them). Ask the user which files are inputs; never name a whole folder of
+work, and never \`.env\`. **artifacts** — evidence the work writes (reports, ZIP archives, test results):
+\`{ "paths": ["rules-engine/test-results/**"] }\`. Never committed, kept with the run; tell tasks to write
+evidence there instead of changing \`.gitignore\`.
+
+A session with \`"startFrom": "previous-session"\` continues the whole work of the one before it only when
+that one is \`"branchMode": "per-session"\`: per task, its work is on several branches and the next session
+refuses to start from part of it.
+
 Put the same \`startFrom\` on every session that works in one repository unless the user wants it
 mixed. Leaving it out keeps the old behaviour — whatever branch the repository is on — which is
 the one to avoid.
@@ -512,6 +535,29 @@ const VCS_DETAIL_BG = `
 reset или merge. \`"updateFromRemote": false\` го изключва — само ако потребителят поиска да работи
 офлайн или нарочно от локални commit-и.
 
+**dirtyWorktree** — какво става, когато хранилището има некомитнати промени (на потребителя, например
+входни файлове, които задача използва) преди първата задача на сесията. Питай само ако потребителят
+спомене такива файлове: \`{ "policy": "snapshot" }\` ги прави един commit, „Capture operator baseline before
+run“, на отделен клон, и сесията тръгва от него; потребителят първо одобрява точния списък на страницата на
+сесията. \`"tracked-only-snapshot"\` взема само tracked промени. Тайни (\`.env\`), изход от инструменти и
+файлове извън проекта никога не се вземат, а ignored файл — само когато \`scope\` на задача го посочва.
+Снимката се прави там, където са промените, затова с \`startFrom\` \`"branch"\` само ако хранилището вече е на
+този клон, и никога с \`"existing-branch"\`. Ако го пропуснеш, остава \`"reject"\`: контролът на версиите
+не влиза в дърво с некомитнати промени.
+
+**userInputs** — файлове, които потребителят дава за работата (схеми, тестови данни):
+\`{ "paths": ["rules-engine/test-data/schemas/*.yaml"] }\`. Влизат в комита, от който тръгва всяка сесия —
+новите или ignored в началната снимка, с одобрение от потребителя; следваща сесия, чието начало ги няма, ги
+получава комитнати върху него — и са само за четене, докато задачите работят (\`"readOnly": false\` само ако
+потребителят иска работата да ги променя). Питай кои файлове са вход; никога цяла папка с работа и никога
+\`.env\`. **artifacts** — доказателства, които работата пише (отчети, ZIP архиви, резултати от тестове):
+\`{ "paths": ["rules-engine/test-results/**"] }\`. Никога не се комитват, пазят се към пускането; кажи на
+задачите да пишат доказателствата там, вместо да променят \`.gitignore\`.
+
+Сесия с \`"startFrom": "previous-session"\` продължава цялата работа на предната само ако тя е
+\`"branchMode": "per-session"\`: при per-task работата ѝ е на няколко клона и следващата сесия отказва да
+тръгне от част от нея.
+
 Сложи един и същ \`startFrom\` на всички сесии в едно хранилище, освен ако потребителят не иска
 различни. Ако го пропуснеш, остава старото поведение — от който клон е хранилището в момента —
 което е за избягване.
@@ -1438,6 +1484,13 @@ bot actually does, because it changes what a good task looks like:
   reads it and decides the next step. This repeats until Copilot writes a final summary.
 - Nothing is interactive. A command that waits for a keypress, opens an editor or needs a
   browser login will hang the task.
+- **How the working chat learns the project: by running commands.** No file of the project is
+  copied, attached or uploaded to it. In each task it reads what it needs itself, with terminal
+  commands in the project folder — it lists the folders, opens the files, looks at the git log —
+  and the output comes back to it. So never ask the user how the chat will get the project's files,
+  how it will see the code or whether to attach anything; that is settled. If the organisation
+  document still says how the chat reaches a project (attached files, a Desktop copy), ignore it:
+  that way no longer exists. Write prompts that name the paths to read, not files to attach.
 - **Only the project folders.** The runner refuses any command, check or file path that reaches
   outside the session's folder and the projects listed below — reading as well as writing — and
   anything that manages the machine: the registry, services, the network, users, installs that
@@ -1655,6 +1708,13 @@ function buildBg(projects, ctx = {}) {
   чете и решава следващата стъпка. Това се повтаря, докато Copilot не напише финално резюме.
 - Нищо не е интерактивно. Команда, която чака клавиш, отваря редактор или иска вход през
   браузър, ще увисне.
+- **Как работният чат опознава проекта: с команди.** Никой файл от проекта не се копира, прикачва
+  или качва в него. Във всяка задача той сам чете каквото му трябва, с терминални команди в папката
+  на проекта — изброява папките, отваря файловете, гледа git историята — и изходът се връща при него.
+  Затова никога не питай потребителя как чатът ще получи файловете на проекта, как ще види кода или
+  дали да прикачи нещо; това е решено. Ако документът за организацията още казва как чатът стига до
+  проект (прикачени файлове, копие на Desktop-а), не го слушай: такъв начин вече няма. Пиши prompt-ове,
+  които назовават пътищата за четене, а не файлове за прикачване.
 - **Само папките на проектите.** Runner-ът отказва всяка команда, проверка или път към файл, който
   излиза извън папката на сесията и проектите, изброени по-долу — и за четене, и за запис — и всичко,
   което управлява машината: регистъра, услугите, мрежата, потребителите, инсталации извън проекта.

package/dist/src/plan/importPlan.js

@@ -1,4 +1,5 @@
 import { DEFAULT_VCS, applyDefaultProject } from '../session/store.js';
+import { normalisePatterns } from '../vcs/inputs.js';
 import { availableShells, detectShells } from '../exec/shells.js';
 /** The heading under which a task's acceptance bar reaches Copilot. English, like level 1. */
 const EXPECTED_HEADER = '### Expected result';
@@ -165,6 +166,23 @@ defaultProjectDir = '') {
     const sharedGroup = plan.conversation === 'shared'
         ? (plan.plan.trim() || `plan-${new Date().toISOString().slice(0, 16).replace(/[:T-]/g, '')}`).slice(0, 60)
         : '';
+    /*
+     * A session that continues the one before it in the same repository, when that one ran per task
+     * with several tasks: its work is on several branches, and the continuation is refused at its start
+     * (see `sessionStart`). Said now, when the plan can still be changed.
+     */
+    const lastIn = new Map();
+    for (const planned of plan.sessions) {
+        const repo = (planned.vcs?.repoDir || planned.projectDir || '').trim().replace(/[\\/]+$/, '').toLowerCase();
+        if (!planned.vcs?.enabled || !repo)
+            continue;
+        const before = lastIn.get(repo);
+        if (planned.vcs.startFrom === 'previous-session' && before?.perTask && before.tasks > 1) {
+            warnings.push(`Session "${planned.name}" continues "${before.name}", which runs a branch per task: its ${before.tasks} tasks' work will be on ${before.tasks} branches, ` +
+                `and "${planned.name}" will refuse to start from part of it. Give "${before.name}" "branchMode": "per-session" if the next session builds on all of it.`);
+        }
+        lastIn.set(repo, { name: planned.name, perTask: (planned.vcs.branchMode ?? 'per-task') === 'per-task', tasks: planned.tasks.length });
+    }
     for (const planned of plan.sessions) {
         // Attaching project files to the chat was removed; an old plan's root is still its project folder.
         if (planned.mirror?.enabled) {
@@ -172,7 +190,21 @@ defaultProjectDir = '') {
                 'the chat reads the project by running commands. "mirror" was ignored.');
         }
         const created = await store.createSession(planned.name, planned.projectDir || planned.mirror?.rootDir || '');
-        const vcs = { ...DEFAULT_VCS, ...(planned.vcs ?? {}) };
+        const { dirtyWorktree: plannedDirty, userInputs: plannedInputs, artifacts: plannedArtifacts, ...plannedVcs } = planned.vcs ?? {};
+        const vcs = { ...DEFAULT_VCS, ...plannedVcs };
+        // Input files and artifacts in the one spelling the session has: see `UserInputs`.
+        const inputPaths = plannedInputs?.enabled === false ? [] : normalisePatterns(plannedInputs?.paths ?? []);
+        if (inputPaths.length > 0) {
+            const readOnly = plannedInputs?.readOnly ?? plannedInputs?.readOnlyAfterCapture;
+            vcs.userInputs = { paths: inputPaths, ...(readOnly === false ? { readOnly: false } : {}), ...(plannedInputs?.requireApproval === false ? { requireApproval: false } : {}) };
+        }
+        const artifactPaths = normalisePatterns(plannedArtifacts?.paths ?? []);
+        if (artifactPaths.length > 0)
+            vcs.artifacts = { paths: artifactPaths };
+        // Stored in the one spelling the session has: see `DirtyWorktree`.
+        const policy = plannedDirty?.policy === 'snapshot' && plannedDirty.includeUntracked === false ? 'tracked-only-snapshot' : plannedDirty?.policy;
+        if (policy && policy !== 'reject')
+            vcs.dirtyWorktree = { policy, ...(plannedDirty?.requireApproval === false ? { requireApproval: false } : {}) };
         vcs.branchPrefix = vcs.branchPrefix.trim() || DEFAULT_VCS.branchPrefix;
         vcs.repoDir = vcs.repoDir.trim();
         // A branch to carry on, given alone, is that choice: see `VersionControl.startFrom`.
@@ -211,5 +243,7 @@ defaultProjectDir = '') {
         }
         sessions.push({ id: created.id, name: created.name, tasks: titles.length, titles });
     }
+    // The plan's sessions on top of the list, in the order the plan gives them, not newest first.
+    await store.placeOnTop(sessions.map((s) => s.id));
     return { sessions, taskCount: sessions.reduce((n, s) => n + s.tasks, 0), warnings };
 }

package/dist/src/plan/schema.js

@@ -13,6 +13,7 @@
  * sending the user back to the chat; it is reported as a warning instead.
  */
 import { z } from 'zod';
+import { namesEverything } from '../vcs/inputs.js';
 export const PLAN_VERSION = 1;
 /**
  * Version control, exactly as a session stores it, and required on every session.
@@ -60,6 +61,52 @@ const VcsInput = z
      * Absent means true. See `VersionControl.updateFromRemote`.
      */
     updateFromRemote: z.boolean().optional(),
+    /**
+     * What the session's first run does with uncommitted changes. See `DirtyWorktree`. Accepts the
+     * longer spelling a chat model may write — `includeUntracked: false` is `tracked-only-snapshot`,
+     * and `includeIgnoredOnlyWhenScoped` can only be true, since that is the rule, not a choice.
+     */
+    dirtyWorktree: z
+        .object({
+        policy: z.enum(['reject', 'snapshot', 'tracked-only-snapshot'], {
+            error: 'dirtyWorktree.policy must be "reject" (uncommitted changes keep version control out, as until now), "snapshot" (they become the commit the session starts from) or "tracked-only-snapshot" (the same, tracked changes only). "discard" is not offered: the runner never throws work away.',
+        }),
+        requireApproval: z.boolean().optional(),
+        includeUntracked: z.boolean().optional(),
+        includeIgnoredOnlyWhenScoped: z
+            .literal(true, { error: 'dirtyWorktree.includeIgnoredOnlyWhenScoped can only be true: an ignored file goes into a snapshot only when a task\'s scope names it. Leave the field out.' })
+            .optional(),
+    })
+        .optional(),
+    /**
+     * The operator's input files. See `UserInputs`. Accepts the spelling a chat model may write:
+     * `capture` can only be "baseline-commit", `allowUntracked`/`allowIgnored` only true (an input
+     * may be either), `readOnlyAfterCapture` is `readOnly`.
+     */
+    userInputs: z
+        .object({
+        enabled: z.boolean().optional(),
+        paths: z.array(z.string().trim()).default([]),
+        capture: z.literal('baseline-commit', { error: 'userInputs.capture can only be "baseline-commit": input files go into the commit the session starts from. Leave the field out.' }).optional(),
+        allowUntracked: z.literal(true, { error: 'userInputs.allowUntracked can only be true: an input file may be untracked. Leave the field out.' }).optional(),
+        allowIgnored: z.literal(true, { error: 'userInputs.allowIgnored can only be true: an input file may be ignored by git. Leave the field out.' }).optional(),
+        readOnly: z.boolean().optional(),
+        readOnlyAfterCapture: z.boolean().optional(),
+        requireApproval: z.boolean().optional(),
+    })
+        .optional(),
+    /**
+     * Evidence kept with the run and never committed. See `VersionControl.artifacts`. `commit` can
+     * only be false and `attachToRun`/`allowIgnored` only true: that is what an artifact is.
+     */
+    artifacts: z
+        .object({
+        paths: z.array(z.string().trim()).default([]),
+        allowIgnored: z.literal(true, { error: 'artifacts.allowIgnored can only be true. Leave the field out.' }).optional(),
+        attachToRun: z.literal(true, { error: 'artifacts.attachToRun can only be true: artifacts are always kept with the run. Leave the field out.' }).optional(),
+        commit: z.literal(false, { error: 'artifacts.commit can only be false: an artifact is never committed. Files that should be committed are the work, not artifacts.' }).optional(),
+    })
+        .optional(),
 }, {
     error: 'Every session needs a "vcs" object saying whether the runner does version control for it and, when it does, which git repository to work in. Ask the user both questions and write the answers here.',
 })
@@ -78,6 +125,21 @@ const VcsInput = z
             message: `"existingBranch" carries on a branch that exists, and startFrom "${vcs.startFrom}" cuts a new one. Keep one: startFrom "existing-branch" with existingBranch, or leave existingBranch out.`,
         });
     }
+    if (vcs.dirtyWorktree?.policy === 'tracked-only-snapshot' && vcs.dirtyWorktree.includeUntracked === true) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['dirtyWorktree', 'includeUntracked'],
+            message: '"tracked-only-snapshot" takes tracked changes only, and includeUntracked true asks for new files too. Keep one: policy "snapshot", or leave includeUntracked out.',
+        });
+    }
+    for (const [i, p] of (vcs.userInputs?.paths ?? []).entries()) {
+        if (namesEverything(p)) {
+            ctx.addIssue({ code: 'custom', path: ['userInputs', 'paths', i], message: `"${p}" names the whole repository; an input pattern names the operator's files, such as "rules-engine/test-data/schemas/*.yaml".` });
+        }
+    }
+    if (vcs.userInputs && vcs.userInputs.enabled !== false && (vcs.userInputs.paths ?? []).length > 0 && !vcs.enabled) {
+        ctx.addIssue({ code: 'custom', path: ['userInputs'], message: 'userInputs needs version control on: the input files go into the commit the session starts from. Turn vcs.enabled on, or leave userInputs out.' });
+    }
     if (vcs.enabled && !vcs.repoDir.trim()) {
         ctx.addIssue({
             code: 'custom',