copilot-operator 0.1.17 → 0.1.18

package/dist/src/api/operator.service.js

@@ -19,7 +19,7 @@ import { join, resolve } from 'node:path';
 import { installLayout } from '../config/layout.js';
 import { SessionStore, DEFAULT_VCS, DEFAULT_REVIEW, applyDefaultProject, applyTaskPatch } from '../session/store.js';
 import { EventBus } from '../session/events.js';
-import { isContinuable, newId } from '../session/model.js';
+import { freshRetriesOfLatestRun, isContinuable, newId } from '../session/model.js';
 import { runSession, openBrowser, queuedToRun } from '../orchestrator/taskRunner.js';
 import { buildExport } from '../session/exportRecord.js';
 import { buildDebugExport } from '../session/debugExport.js';
@@ -46,6 +46,7 @@ import { createTransport } from '../transport/chatTransport.js';
 import { composeHandoff } from '../session/handoff.js';
 import { planSync } from '../vcs/syncCommand.js';
 import { dirtyPolicy, takeSnapshot } from '../vcs/snapshot.js';
+import { normalisePatterns } from '../vcs/inputs.js';
 import { computeMetrics } from '../session/metrics.js';
 import { resolveDesktopDir, desktopIsSynced } from '../context/desktopDir.js';
 import { saveAndReveal } from './saveToDesktop.js';
@@ -419,6 +420,26 @@ let OperatorService = class OperatorService {
                     delete merged.dirtyWorktree;
                 else
                     merged.dirtyWorktree = { policy: dirty.policy, ...(dirty.requireApproval ? {} : { requireApproval: false }) };
+                // Input files and artifacts: patterns as the matching reads them, absent when there are none.
+                const inputPaths = normalisePatterns(merged.userInputs?.paths ?? []);
+                if (inputPaths.length === 0)
+                    delete merged.userInputs;
+                else {
+                    merged.userInputs = {
+                        paths: inputPaths,
+                        ...(merged.userInputs?.readOnly === false ? { readOnly: false } : {}),
+                        ...(merged.userInputs?.requireApproval === false ? { requireApproval: false } : {}),
+                    };
+                }
+                const artifactPaths = normalisePatterns(merged.artifacts?.paths ?? []);
+                if (artifactPaths.length === 0)
+                    delete merged.artifacts;
+                else
+                    merged.artifacts = { paths: artifactPaths };
+                // New inputs are settled again at the next task: the recorded ones are no longer the whole list.
+                if (JSON.stringify(merged.userInputs ?? null) !== JSON.stringify(s.vcs?.userInputs ?? null) && s.vcsStart?.inputs) {
+                    s.vcsStart = { ...s.vcsStart, inputs: undefined };
+                }
                 // Only the program marks a name as one of its own branches, and a name changed is not that one.
                 const stillOwn = !!s.vcs?.branchNameExact && (merged.branchName ?? '').trim() === (s.vcs.branchName ?? '').trim();
                 if (stillOwn)
@@ -2601,7 +2622,7 @@ let OperatorService = class OperatorService {
                     commit: t.vcs?.commit,
                     vcsProblem: t.vcs?.problem,
                     sessionInactive: s.active === false || undefined,
-                    autoRetries: t.autoRetries || undefined,
+                    autoRetries: freshRetriesOfLatestRun(t) || undefined,
                     attempt: t.attempt,
                     changedFiles: t.vcs?.commit && t.vcs.baseCommit ? (t.vcs.files?.length ?? 0) : undefined,
                     interrupted: t.status === 'aborted' && !!t.interruption ? true : undefined,

package/dist/src/orchestrator/derivedChecks.js

@@ -23,7 +23,25 @@ export function derivedCheckName(findingId, name) {
     return `review ${findingId}: ${name}`;
 }
 export function isDerivedCheck(check) {
-    return /^review r\d+f\d+: /.test(check.name);
+    return /^review (?:a\d+)?r\d+f\d+: /.test(check.name);
+}
+/**
+ * Kept checks written before a finding's id carried its attempt, given the id it carries now.
+ *
+ * Those records hold `r1f1` for attempt 1's first finding and again for attempt 2's, under one check
+ * name, and a dispute, a deferral or a drop aimed at one acted on both. Renamed from the attempt each
+ * was made on (see `findingId`), check name included, so the gate and the implementer see the same
+ * name a dispute can then use. A check of the first attempt, and one already renamed, is left as it is.
+ */
+export function withAttemptIds(reviewChecks) {
+    return reviewChecks.map((rc) => {
+        if ((rc.attempt ?? 1) <= 1 || !/^r\d+f\d+$/.test(rc.findingId))
+            return rc;
+        const id = `a${rc.attempt}${rc.findingId}`;
+        const before = derivedCheckName(rc.findingId, '');
+        const name = rc.check.name.startsWith(before) ? derivedCheckName(id, rc.check.name.slice(before.length)) : rc.check.name;
+        return { ...rc, findingId: id, check: { ...rc.check, name } };
+    });
 }
 /**
  * Runs each finding's check on the current state. Kept if it fails now, refused if it passes.

package/dist/src/orchestrator/review.js

@@ -329,7 +329,7 @@ ${machineNote}` : contract);
                         problem: `every finding of round ${round} rested on something the task never asked for, twice; the review is inconclusive`,
                     };
                 }
-                const named = grounded.map((f, i) => ({ ...f, id: findingId(round, i) }));
+                const named = grounded.map((f, i) => ({ ...f, id: findingId(round, i, task.attempt ?? 1) }));
                 /*
                  * A read-only task's findings never become gate conditions.
                  *
@@ -605,7 +605,7 @@ export function findingsMessage(outcome, round, maxRounds, repeated = [], leftov
         `Fix these, then verify as usual and close the task again. This is review round ${round} of ${maxRounds};`,
         'after that the task is closed as blocked with whatever is still outstanding.',
         '',
-        'If you believe a finding is wrong, say so in `disputed`: its id (the `[r1f2]` in front of it), why it',
+        'If you believe a finding is wrong, say so in `disputed`: its id as written (the `[r1f2]` in front of it), why it',
         'is wrong, and the evidence that shows it — the command you ran and what came back. A dispute goes to',
         'the next reviewer as a claim to test; a sentence in your summary goes nowhere. Do not change the',
         'thing the reviewer looked at in order to make the objection go away.',

package/dist/src/orchestrator/taskRunner.js

@@ -21,7 +21,7 @@ import { buildCoveringMessage, assertSendable } from '../protocol/reporter.js';
 import { runStep } from '../exec/runner.js';
 import { availableShells, detectShells, effectiveShell, preferredShell, refusalForChat, resolveShell, shellNote } from '../exec/shells.js';
 import { runChecks, failureMessage, failureRedactions, failureReport, environmentProblemIn, COMMIT_CLEAN_CHECK, CONTENT_CLEAN_CHECK, RUNNER_CHECK_KINDS } from '../exec/checks.js';
-import { activeChecks, suspendDisputed, settleAfterReview, onlyDerivedFailing, isDerivedCheck } from './derivedChecks.js';
+import { activeChecks, suspendDisputed, settleAfterReview, onlyDerivedFailing, isDerivedCheck, withAttemptIds } from './derivedChecks.js';
 import { workingDirFor, isWorkingDirProblem, workingDirNote } from '../exec/workDir.js';
 import { redactSecrets } from '../exec/redaction.js';
 import { snapshotProcesses, reapLeftovers, describeLeftovers, ProcessTracker } from '../exec/processes.js';
@@ -46,6 +46,8 @@ import { ProgressWatch } from './progress.js';
 import { contractConflicts, readsTreeClean } from './contract.js';
 import { treeFingerprint } from '../vcs/git.js';
 import { prepareForTask, commitTaskResult, repoDirOf, trackedRepoOf } from '../vcs/taskVcs.js';
+import { protectInputs, inputsMessage } from '../vcs/inputs.js';
+import { artifactPatterns, keepArtifacts } from '../vcs/artifacts.js';
 import { exportMachine, writeAttemptRecord } from '../session/exports.js';
 /** Why a task that was reported as done is being closed as failed. */
 function checksFailedReason(outcomes) {
@@ -538,9 +540,10 @@ export async function runTask(transport, session, task, deps) {
     let runAfterCommit = null;
     /**
      * Checks earlier reviews gave with their findings — carried over from every attempt before
-     * this one, and grown by this one. See `derivedChecks.ts` for the three rules.
+     * this one, and grown by this one. See `derivedChecks.ts` for the three rules. Ones written before
+     * a finding's id carried its attempt are renamed here, before anything finds one by id or name.
      */
-    let reviewChecks = task.reviewChecks ?? [];
+    let reviewChecks = withAttemptIds(task.reviewChecks ?? []);
     /** Derived checks that still failed when the rounds ran out; the reviewer is told. */
     let derivedStillFailing = [];
     /**
@@ -577,10 +580,57 @@ export async function runTask(transport, session, task, deps) {
         await record(`LEFT RUNNING BY ${by.toUpperCase()}`, describeLeftovers([...result.killed, ...result.failed]));
         return all.map((l) => ({ name: l.name, ports: l.ports }));
     };
+    /** The session's read-only input files and the commit they are put back from, once the task is on its own branch. */
+    let inputsGuard = null;
+    /** Puts back whatever a round did to the input files, and tells the chat and the record. */
+    const guardInputs = async (iteration) => {
+        if (!inputsGuard)
+            return null;
+        const guard = inputsGuard;
+        const check = await protectInputs(repoDirOf(session), guard.base, guard.inputs).catch((e) => ({
+            changed: ['(the input files)'],
+            restored: [],
+            failed: [{ path: '(the input files)', why: e.message }],
+        }));
+        if (check.changed.length > 0) {
+            sink.event('inputs-restored', { iteration, restored: check.restored, failed: check.failed }, `the operator's input files are read-only; put back: ${check.restored.join(', ') || '(none)'}` +
+                (check.failed.length > 0 ? `; could not be put back: ${check.failed.map((f) => f.path).join(', ')}` : ''), 'warn');
+            runnerNotes.push(inputsMessage(check));
+            await setTask((t) => {
+                t.inputsRestored = [...new Set([...(t.inputsRestored ?? []), ...check.restored])];
+            });
+        }
+        return check;
+    };
     const finish = async (status, reason, summary, finalReply) => {
         await record(`TASK ${status.toUpperCase()}`, [summary ?? '', reason ? `Reason: ${reason}` : ''].filter(Boolean).join('\n\n') || '(no details)');
         // The net under the plan's own checks: whatever the task left running is stopped and named.
         await reap(processesBefore, 'the task');
+        /*
+         * The operator's input files, once more before the commit: put back what the last round changed,
+         * so it is not committed as the task's work. One that cannot be put back fails a done task. See
+         * `vcs/inputs.ts`.
+         */
+        if (inputsGuard) {
+            const check = await guardInputs();
+            if (check && check.failed.length > 0 && status === 'done') {
+                status = 'failed';
+                reason = `the operator's input file(s) ${check.failed.map((f) => f.path).join(', ')} were changed and could not be put back as they were: ${check.failed.map((f) => f.why).join('; ')}.`;
+            }
+        }
+        /*
+         * The session's artifacts, whatever the outcome: copied into this attempt's record, so the
+         * evidence of each attempt is kept even after a later one overwrites it. See `vcs/artifacts.ts`.
+         */
+        const patterns = artifactPatterns(session.vcs);
+        const projectRoot = repoDirOf(session) || session.projectDir?.trim() || '';
+        if (patterns.length > 0 && projectRoot) {
+            const kept = await keepArtifacts(projectRoot, patterns, join(artifactsDir, 'project')).catch((e) => ({ kept: [], skipped: [`(all: ${e.message})`] }));
+            sink.event('artifacts-kept', { kept: kept.kept.length, skipped: kept.skipped }, `artifacts kept with the run: ${kept.kept.length} file(s)${kept.skipped.length > 0 ? `; not kept: ${kept.skipped.slice(0, 5).join('; ')}` : ''}`, kept.skipped.length > 0 ? 'warn' : 'info');
+            await setTask((t) => {
+                t.artifactsKept = kept.kept.length > 0 ? kept.kept : undefined;
+            });
+        }
         /*
          * A read-only task that changed files has failed, whatever it reported.
          *
@@ -737,6 +787,9 @@ export async function runTask(transport, session, task, deps) {
         t.runId = runId;
         t.runGroup = deps.runGroup;
         t.startedAt = new Date().toISOString();
+        // The kept checks under the ids this run uses (`withAttemptIds`), so the record names them as the gate does.
+        if (reviewChecks.length > 0)
+            t.reviewChecks = reviewChecks;
     });
     sink.event('task-started', { runId, title: task.title }, `task "${task.title}" starting (run ${runId})`);
     await writeFile(taskLogPath, `TASK: ${task.title}\nSESSION: ${session.name} (${session.id})\nRUN: ${runId}\nSTARTED: ${new Date().toISOString()}\n`, 'utf8');
@@ -856,6 +909,11 @@ export async function runTask(transport, session, task, deps) {
          * findings described a tree that was not the one it had been asked to audit.
          */
         const scopeEnforced = (scope.length > 0 || !!task.readOnly) && onOwnBranch;
+        // The operator's input files, read-only on a branch of the task's own; see `vcs/inputs.ts`.
+        const startNow = (await store.getSession(session.id))?.vcsStart;
+        if (onOwnBranch && startNow?.inputs?.readOnly && startNow.inputs.files.length > 0) {
+            inputsGuard = { base: prepared.vcs.baseCommit, inputs: startNow.inputs };
+        }
         /** The working tree's fingerprint, when the task is on a branch of its own; null otherwise. */
         const treeNow = async () => prepared.vcs.branch && !prepared.vcs.problem && prepared.vcs.baseCommit ? await treeFingerprint(repoDirOf(session)).catch(() => null) : null;
         /*
@@ -1409,7 +1467,7 @@ export async function runTask(transport, session, task, deps) {
             // `repeated` still identifies them.
             const named = outcome.findings.map((f, i) => ({
                 ...f,
-                id: f.id ?? findingId(reviewRounds, i),
+                id: f.id ?? findingId(reviewRounds, i, attempt),
                 ...(repeated.includes(f) ? { repeated: true } : {}),
             }));
             outcome = { ...outcome, findings: named };
@@ -1936,6 +1994,7 @@ export async function runTask(transport, session, task, deps) {
                     });
                 }
             }
+            await guardInputs(iterations);
             // --- report back ---------------------------------------------------------------
             const report = await writeReport(results, {
                 runId,
@@ -2160,9 +2219,23 @@ export async function runSession(sessionId, deps) {
                 break;
             }
             session = (await store.getSession(sessionId));
-            const task = session.tasks.find((t) => t.id === queuedTask.id);
+            let task = session.tasks.find((t) => t.id === queuedTask.id);
             if (!task || task.status !== 'queued')
                 continue;
+            /*
+             * A task taken from the queue was started by the operator, never by the retry loop below, which
+             * runs its own. A fresh-retry mark on it is left from a retry that was queued and never ran —
+             * the new chat failed to open, the program was closed — and counted as this run's, it added the
+             * old run's retry to this one's (`freshRetriesOfLatestRun`).
+             */
+            if (task.freshRetry) {
+                session = await store.updateSession(sessionId, (s) => {
+                    const t = s.tasks.find((x) => x.id === queuedTask.id);
+                    if (t)
+                        t.freshRetry = undefined;
+                });
+                task = session.tasks.find((t) => t.id === queuedTask.id);
+            }
             let outcome = await runTask(chat, session, task, deps);
             ran += 1;
             /*
@@ -2194,11 +2267,11 @@ export async function runSession(sessionId, deps) {
                 session = await store.updateSession(sessionId, (s) => {
                     s.chat = undefined;
                     s.contractSent = false;
+                    // Marked, not counted: how many retries this run made is read back from the marks
+                    // (`freshRetriesOfLatestRun`), so a later run cannot add to an earlier one's count.
                     const again = s.tasks.find((x) => x.id === task.id);
-                    if (again) {
-                        again.autoRetries = (again.autoRetries ?? 0) + 1;
+                    if (again)
                         again.freshRetry = true;
-                    }
                 });
                 await chat.newChat();
                 /*

package/dist/src/plan/brief.js

@@ -464,6 +464,19 @@ taken where the changes are, so use it with \`startFrom\` \`"branch"\` only when
 that branch, and never with \`"existing-branch"\`. Leaving it out keeps \`"reject"\`: version control stays out
 of a tree with uncommitted changes.
 
+**userInputs** — files the user provides for the work (schemas, test data):
+\`{ "paths": ["rules-engine/test-data/schemas/*.yaml"] }\`. They go into the commit every session starts from —
+new or ignored ones in the starting snapshot, approved by the user; a later session whose start lacks them
+gets them committed on top of it — and they are read-only while the tasks run (\`"readOnly": false\` only if
+the user wants the work to change them). Ask the user which files are inputs; never name a whole folder of
+work, and never \`.env\`. **artifacts** — evidence the work writes (reports, ZIP archives, test results):
+\`{ "paths": ["rules-engine/test-results/**"] }\`. Never committed, kept with the run; tell tasks to write
+evidence there instead of changing \`.gitignore\`.
+
+A session with \`"startFrom": "previous-session"\` continues the whole work of the one before it only when
+that one is \`"branchMode": "per-session"\`: per task, its work is on several branches and the next session
+refuses to start from part of it.
+
 Put the same \`startFrom\` on every session that works in one repository unless the user wants it
 mixed. Leaving it out keeps the old behaviour — whatever branch the repository is on — which is
 the one to avoid.
@@ -532,6 +545,19 @@ run“, на отделен клон, и сесията тръгва от нег
 този клон, и никога с \`"existing-branch"\`. Ако го пропуснеш, остава \`"reject"\`: контролът на версиите
 не влиза в дърво с некомитнати промени.
 
+**userInputs** — файлове, които потребителят дава за работата (схеми, тестови данни):
+\`{ "paths": ["rules-engine/test-data/schemas/*.yaml"] }\`. Влизат в комита, от който тръгва всяка сесия —
+новите или ignored в началната снимка, с одобрение от потребителя; следваща сесия, чието начало ги няма, ги
+получава комитнати върху него — и са само за четене, докато задачите работят (\`"readOnly": false\` само ако
+потребителят иска работата да ги променя). Питай кои файлове са вход; никога цяла папка с работа и никога
+\`.env\`. **artifacts** — доказателства, които работата пише (отчети, ZIP архиви, резултати от тестове):
+\`{ "paths": ["rules-engine/test-results/**"] }\`. Никога не се комитват, пазят се към пускането; кажи на
+задачите да пишат доказателствата там, вместо да променят \`.gitignore\`.
+
+Сесия с \`"startFrom": "previous-session"\` продължава цялата работа на предната само ако тя е
+\`"branchMode": "per-session"\`: при per-task работата ѝ е на няколко клона и следващата сесия отказва да
+тръгне от част от нея.
+
 Сложи един и същ \`startFrom\` на всички сесии в едно хранилище, освен ако потребителят не иска
 различни. Ако го пропуснеш, остава старото поведение — от който клон е хранилището в момента —
 което е за избягване.

package/dist/src/plan/importPlan.js

@@ -1,4 +1,5 @@
 import { DEFAULT_VCS, applyDefaultProject } from '../session/store.js';
+import { normalisePatterns } from '../vcs/inputs.js';
 import { availableShells, detectShells } from '../exec/shells.js';
 /** The heading under which a task's acceptance bar reaches Copilot. English, like level 1. */
 const EXPECTED_HEADER = '### Expected result';
@@ -165,6 +166,23 @@ defaultProjectDir = '') {
     const sharedGroup = plan.conversation === 'shared'
         ? (plan.plan.trim() || `plan-${new Date().toISOString().slice(0, 16).replace(/[:T-]/g, '')}`).slice(0, 60)
         : '';
+    /*
+     * A session that continues the one before it in the same repository, when that one ran per task
+     * with several tasks: its work is on several branches, and the continuation is refused at its start
+     * (see `sessionStart`). Said now, when the plan can still be changed.
+     */
+    const lastIn = new Map();
+    for (const planned of plan.sessions) {
+        const repo = (planned.vcs?.repoDir || planned.projectDir || '').trim().replace(/[\\/]+$/, '').toLowerCase();
+        if (!planned.vcs?.enabled || !repo)
+            continue;
+        const before = lastIn.get(repo);
+        if (planned.vcs.startFrom === 'previous-session' && before?.perTask && before.tasks > 1) {
+            warnings.push(`Session "${planned.name}" continues "${before.name}", which runs a branch per task: its ${before.tasks} tasks' work will be on ${before.tasks} branches, ` +
+                `and "${planned.name}" will refuse to start from part of it. Give "${before.name}" "branchMode": "per-session" if the next session builds on all of it.`);
+        }
+        lastIn.set(repo, { name: planned.name, perTask: (planned.vcs.branchMode ?? 'per-task') === 'per-task', tasks: planned.tasks.length });
+    }
     for (const planned of plan.sessions) {
         // Attaching project files to the chat was removed; an old plan's root is still its project folder.
         if (planned.mirror?.enabled) {
@@ -172,8 +190,17 @@ defaultProjectDir = '') {
                 'the chat reads the project by running commands. "mirror" was ignored.');
         }
         const created = await store.createSession(planned.name, planned.projectDir || planned.mirror?.rootDir || '');
-        const { dirtyWorktree: plannedDirty, ...plannedVcs } = planned.vcs ?? {};
+        const { dirtyWorktree: plannedDirty, userInputs: plannedInputs, artifacts: plannedArtifacts, ...plannedVcs } = planned.vcs ?? {};
         const vcs = { ...DEFAULT_VCS, ...plannedVcs };
+        // Input files and artifacts in the one spelling the session has: see `UserInputs`.
+        const inputPaths = plannedInputs?.enabled === false ? [] : normalisePatterns(plannedInputs?.paths ?? []);
+        if (inputPaths.length > 0) {
+            const readOnly = plannedInputs?.readOnly ?? plannedInputs?.readOnlyAfterCapture;
+            vcs.userInputs = { paths: inputPaths, ...(readOnly === false ? { readOnly: false } : {}), ...(plannedInputs?.requireApproval === false ? { requireApproval: false } : {}) };
+        }
+        const artifactPaths = normalisePatterns(plannedArtifacts?.paths ?? []);
+        if (artifactPaths.length > 0)
+            vcs.artifacts = { paths: artifactPaths };
         // Stored in the one spelling the session has: see `DirtyWorktree`.
         const policy = plannedDirty?.policy === 'snapshot' && plannedDirty.includeUntracked === false ? 'tracked-only-snapshot' : plannedDirty?.policy;
         if (policy && policy !== 'reject')

package/dist/src/plan/schema.js

@@ -13,6 +13,7 @@
  * sending the user back to the chat; it is reported as a warning instead.
  */
 import { z } from 'zod';
+import { namesEverything } from '../vcs/inputs.js';
 export const PLAN_VERSION = 1;
 /**
  * Version control, exactly as a session stores it, and required on every session.
@@ -77,6 +78,35 @@ const VcsInput = z
             .optional(),
     })
         .optional(),
+    /**
+     * The operator's input files. See `UserInputs`. Accepts the spelling a chat model may write:
+     * `capture` can only be "baseline-commit", `allowUntracked`/`allowIgnored` only true (an input
+     * may be either), `readOnlyAfterCapture` is `readOnly`.
+     */
+    userInputs: z
+        .object({
+        enabled: z.boolean().optional(),
+        paths: z.array(z.string().trim()).default([]),
+        capture: z.literal('baseline-commit', { error: 'userInputs.capture can only be "baseline-commit": input files go into the commit the session starts from. Leave the field out.' }).optional(),
+        allowUntracked: z.literal(true, { error: 'userInputs.allowUntracked can only be true: an input file may be untracked. Leave the field out.' }).optional(),
+        allowIgnored: z.literal(true, { error: 'userInputs.allowIgnored can only be true: an input file may be ignored by git. Leave the field out.' }).optional(),
+        readOnly: z.boolean().optional(),
+        readOnlyAfterCapture: z.boolean().optional(),
+        requireApproval: z.boolean().optional(),
+    })
+        .optional(),
+    /**
+     * Evidence kept with the run and never committed. See `VersionControl.artifacts`. `commit` can
+     * only be false and `attachToRun`/`allowIgnored` only true: that is what an artifact is.
+     */
+    artifacts: z
+        .object({
+        paths: z.array(z.string().trim()).default([]),
+        allowIgnored: z.literal(true, { error: 'artifacts.allowIgnored can only be true. Leave the field out.' }).optional(),
+        attachToRun: z.literal(true, { error: 'artifacts.attachToRun can only be true: artifacts are always kept with the run. Leave the field out.' }).optional(),
+        commit: z.literal(false, { error: 'artifacts.commit can only be false: an artifact is never committed. Files that should be committed are the work, not artifacts.' }).optional(),
+    })
+        .optional(),
 }, {
     error: 'Every session needs a "vcs" object saying whether the runner does version control for it and, when it does, which git repository to work in. Ask the user both questions and write the answers here.',
 })
@@ -102,6 +132,14 @@ const VcsInput = z
             message: '"tracked-only-snapshot" takes tracked changes only, and includeUntracked true asks for new files too. Keep one: policy "snapshot", or leave includeUntracked out.',
         });
     }
+    for (const [i, p] of (vcs.userInputs?.paths ?? []).entries()) {
+        if (namesEverything(p)) {
+            ctx.addIssue({ code: 'custom', path: ['userInputs', 'paths', i], message: `"${p}" names the whole repository; an input pattern names the operator's files, such as "rules-engine/test-data/schemas/*.yaml".` });
+        }
+    }
+    if (vcs.userInputs && vcs.userInputs.enabled !== false && (vcs.userInputs.paths ?? []).length > 0 && !vcs.enabled) {
+        ctx.addIssue({ code: 'custom', path: ['userInputs'], message: 'userInputs needs version control on: the input files go into the commit the session starts from. Turn vcs.enabled on, or leave userInputs out.' });
+    }
     if (vcs.enabled && !vcs.repoDir.trim()) {
         ctx.addIssue({
             code: 'custom',

package/dist/src/plan/systemGuide.js

@@ -1224,6 +1224,46 @@ export const SYSTEM_GUIDE = [
                         doesEn: 'Under the list of uncommitted files, each set to "Include in the starting snapshot" or "Leave out of the run": commits the included ones on the snapshot branch; left-out files go to the repository\'s .git/info/exclude. Until it is pressed a run of the session is refused and nothing changes.',
                         doesBg: 'Под списъка с некомитнати файлове, всеки с „Включи в началната снимка“ или „Остави извън изпълнението“: комитва включените на клона на снимката; оставените извън отиват в .git/info/exclude на хранилището. Докато не е натиснат, пускане на сесията се отказва и нищо не се променя.',
                     },
+                    {
+                        key: 'vcs.inputs',
+                        kind: 'note',
+                        en: 'Input files',
+                        bg: 'Входни файлове',
+                        doesEn: 'The heading over the operator\'s input files and whether they are read-only.',
+                        doesBg: 'Заглавието над входните файлове на оператора и дали са само за четене.',
+                    },
+                    {
+                        key: 'vcs.inputsField',
+                        kind: 'field',
+                        en: 'Your input files, one pattern per line (repository-relative)',
+                        bg: 'Твоите входни файлове, по един шаблон на ред (спрямо хранилището)',
+                        doesEn: 'Files the operator provides — schemas, test data. They go into the commit every session of the run starts from (new or ignored ones in the starting snapshot, listed for approval); a later session whose start lacks them has them committed on top of it; their SHA-256 sums are recorded. In a plan: "userInputs": { "paths": [...] }.',
+                        doesBg: 'Файлове, които операторът дава — схеми, тестови данни. Влизат в комита, от който тръгва всяка сесия на пускането (новите или ignored — в началната снимка, със списък за одобрение); следваща сесия, чието начало ги няма, ги получава комитнати върху него; SHA-256 сумите им се записват. В план: "userInputs": { "paths": [...] }.',
+                    },
+                    {
+                        key: 'vcs.inputsReadOnly',
+                        kind: 'checkbox',
+                        en: 'Read-only while the tasks run',
+                        bg: 'Само за четене, докато задачите работят',
+                        doesEn: 'On by default. A changed, deleted or added input file is put back after every round and the chat told; one that cannot be put back fails the task.',
+                        doesBg: 'Включено по подразбиране. Променен, изтрит или добавен входен файл се връща след всеки рунд и чатът научава; такъв, който не може да се върне, проваля задачата.',
+                    },
+                    {
+                        key: 'vcs.artifacts',
+                        kind: 'note',
+                        en: 'Artifacts',
+                        bg: 'Artifacts',
+                        doesEn: 'The heading over the evidence files the work writes.',
+                        doesBg: 'Заглавието над файловете с доказателства, които работата пише.',
+                    },
+                    {
+                        key: 'vcs.artifactsField',
+                        kind: 'field',
+                        en: 'Evidence the work writes, one pattern per line (repository-relative)',
+                        bg: 'Доказателства, които работата пише, по един шаблон на ред (спрямо хранилището)',
+                        doesEn: 'Reports, ZIP archives, test results: never committed (kept out through .git/info/exclude, .gitignore untouched) and copied into each attempt\'s record with their sums. In a plan: "artifacts": { "paths": [...] }.',
+                        doesBg: 'Отчети, ZIP архиви, резултати от тестове: никога не се комитват (стоят извън git чрез .git/info/exclude, .gitignore не се пипа) и се копират към записа на всеки опит със сумите си. В план: "artifacts": { "paths": [...] }.',
+                    },
                     {
                         key: 'vcs.ready',
                         kind: 'note',

package/dist/src/protocol/replySchema.js

@@ -83,7 +83,7 @@ export const DeviationSchema = z.object({
  * claim to test, and to the record. The finding is named by the id the runner gave it.
  */
 export const DisputeSchema = z.object({
-    /** The finding's id as it was given: `r1f2`. */
+    /** The finding's id as it was given: `r1f2`, or `a2r1f2` on a later attempt. */
     finding: z.string().trim().min(1),
     /** Why it is wrong. */
     why: z.string().trim().min(1),

package/dist/src/protocol/reviewSchema.js

@@ -166,13 +166,18 @@ export function isGrounded(basis, sources) {
     return sources.some((s) => groundingKey(s).includes(key));
 }
 /**
- * The name a finding is referred to by, once the runner has it: round and position.
+ * The name a finding is referred to by, once the runner has it: round and position, and from the
+ * task's second attempt on the attempt as well — `r1f2`, then `a2r1f2`.
  *
- * Given by the runner rather than the reviewer so that it is unique across rounds and cannot
- * be forgotten. It is what the implementer names in `disputed`, and what the record shows.
+ * Given by the runner rather than the reviewer so that it is unique and cannot be forgotten. It is
+ * what the implementer names in `disputed`, what a check given with the finding is named after, and
+ * what the record shows. Unique across the task's attempts, not only its rounds, because those checks
+ * are kept for every later attempt (`Task.reviewChecks`) and the rounds count from 1 on each: with
+ * round and position alone, attempt 2's first finding was `r1f1` beside attempt 1's kept `r1f1`, and
+ * a dispute of the one suspended the check of the other. The first attempt keeps the short form.
  */
-export function findingId(round, index) {
-    return `r${round}f${index + 1}`;
+export function findingId(round, index, attempt = 1) {
+    return `${attempt > 1 ? `a${attempt}` : ''}r${round}f${index + 1}`;
 }
 /** True when nothing the reviewer found is something the implementer could fix. */
 export function allAboutTheTask(findings) {

package/dist/src/session/exports.js

@@ -21,6 +21,7 @@
 import { existsSync } from 'node:fs';
 import { readFile, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { TASK_FIELD_ON_RERUN } from './store.js';
 import { withoutPersona } from '../plan/importPlan.js';
 const EXPECTED_HEADER = '### Expected result';
 const GOAL_HEADER = '## Goal of this session';
@@ -149,6 +150,8 @@ export function buildPlanExport(scope) {
                     ...(s.vcs?.updateFromRemote === false ? { updateFromRemote: false } : {}),
                     // Only when chosen: absent is reject, as it always was.
                     ...(s.vcs?.dirtyWorktree && s.vcs.dirtyWorktree.policy !== 'reject' ? { dirtyWorktree: { ...s.vcs.dirtyWorktree } } : {}),
+                    ...(s.vcs?.userInputs?.paths.length ? { userInputs: { ...s.vcs.userInputs } } : {}),
+                    ...(s.vcs?.artifacts?.paths.length ? { artifacts: { ...s.vcs.artifacts } } : {}),
                 },
                 review: { enabled: s.review?.enabled !== false, model: s.review?.model ?? '' },
                 ...(s.projectDir ? { projectDir: s.projectDir } : {}),
@@ -231,27 +234,32 @@ export function taskAtAttempt(task, attempt) {
     const a = task.attempts?.[attempt - 1];
     if (!a)
         return null;
+    /*
+     * By the same table `rerunTask` follows: what was archived is read from the attempt, what was
+     * cleared is absent. Field by field, by hand, an earlier attempt read back with the latest one's
+     * handoff, counts, limit and fresh-chat mark.
+     */
+    const asItWas = {};
+    for (const [key, what] of Object.entries(TASK_FIELD_ON_RERUN)) {
+        if (what === 'archived')
+            asItWas[key] = a[key];
+        if (what === 'cleared')
+            asItWas[key] = undefined;
+    }
     return {
         ...task,
+        ...asItWas,
         attempt,
         status: a.status,
-        runId: a.runId,
-        runGroup: a.runGroup,
-        startedAt: a.startedAt,
-        finishedAt: a.finishedAt,
         iterations: a.iterations,
-        summary: a.summary,
-        reason: a.reason,
-        deviations: a.deviations,
-        disputes: a.disputes,
+        // The task's own text and definition as they were when that attempt ran, where it was kept.
         title: a.title,
         prompt: a.prompt,
         level2: a.level2,
         checks: a.checks ?? task.checks,
         vcsPlan: a.vcsPlan ?? task.vcsPlan,
-        checkResults: a.checkResults,
-        review: a.review,
-        vcs: a.vcs,
+        scope: a.scope ?? task.scope,
+        readOnly: a.readOnly ?? task.readOnly,
         attempts: task.attempts?.slice(0, attempt - 1),
         continuing: undefined,
         buildsOn: undefined,
@@ -436,7 +444,25 @@ async function domainTask(session, task, runsDir) {
     const started = task.startedAt ? Date.parse(task.startedAt) : NaN;
     const finished = task.finishedAt ? Date.parse(task.finishedAt) : NaN;
     const out = {
-        session: { id: session.id, name: session.name },
+        /*
+         * Where the session started — the baseline commit, a snapshot of the operator's changes, the
+         * input files with their SHA-256 sums — so a reader can check the work against its inputs.
+         */
+        session: {
+            id: session.id,
+            name: session.name,
+            ...(session.vcsStart
+                ? {
+                    start: {
+                        kind: session.vcsStart.kind,
+                        commit: session.vcsStart.commit,
+                        branch: session.vcsStart.branch,
+                        ...(session.vcsStart.snapshot ? { snapshot: session.vcsStart.snapshot } : {}),
+                        ...(session.vcsStart.inputs ? { inputs: session.vcsStart.inputs } : {}),
+                    },
+                }
+                : {}),
+        },
         task: {
             id: task.id,
             title: task.title,
@@ -444,6 +470,8 @@ async function domainTask(session, task, runsDir) {
             readOnly: task.readOnly ?? false,
             scope: task.scope ?? [],
             scopeReverted: task.scopeReverted ?? [],
+            inputsRestored: task.inputsRestored ?? [],
+            artifactsKept: task.artifactsKept ?? [],
             handoff: task.handoff ?? null,
             stopCode: task.stopCode ?? null,
             prompt: p.prompt,
@@ -526,7 +554,7 @@ async function domainTask(session, task, runsDir) {
                 whatTheChatTried: aRounds,
                 whatWasActuallyDone: { repository: a.vcs, deviations: a.deviations, disputes: a.disputes },
                 whyItFailed: aFailed
-                    ? { status: a.status, reason: a.reason, failingChecks: (a.checkResults ?? []).filter((c) => !c.passed), lastRound: aRounds.at(-1) }
+                    ? { status: a.status, reason: a.reason, failingChecks: (a.checkResults ?? []).filter((c) => !c.passed), lastRound: aRounds.at(-1), leftovers: a.leftovers }
                     : undefined,
             });
         }
@@ -607,6 +635,9 @@ async function botTask(session, task, runsDir) {
                 steps: stepsOf(aEvents).map((s) => ({ iteration: s.iteration, id: s.id, command: s.description, outcome: s.outcome, exitCode: s.exitCode, durationMs: s.durationMs, refused: s.refused })),
                 problems: aEvents.filter((e) => e.level === 'error' || e.level === 'warn').map(trimmed),
                 events: aEvents.map(trimmed),
+                // That attempt's own: what it left running and the machine it ran on.
+                processes: { leftovers: a.leftovers },
+                environment: a.environment,
             };
         })),
     };