copilot-operator 0.1.17 → 0.1.19

package/dist/src/api/operator.service.js

@@ -19,7 +19,7 @@ import { join, resolve } from 'node:path';
 import { installLayout } from '../config/layout.js';
 import { SessionStore, DEFAULT_VCS, DEFAULT_REVIEW, applyDefaultProject, applyTaskPatch } from '../session/store.js';
 import { EventBus } from '../session/events.js';
-import { isContinuable, newId } from '../session/model.js';
+import { freshRetriesOfLatestRun, isContinuable, newId } from '../session/model.js';
 import { runSession, openBrowser, queuedToRun } from '../orchestrator/taskRunner.js';
 import { buildExport } from '../session/exportRecord.js';
 import { buildDebugExport } from '../session/debugExport.js';
@@ -46,6 +46,9 @@ import { createTransport } from '../transport/chatTransport.js';
 import { composeHandoff } from '../session/handoff.js';
 import { planSync } from '../vcs/syncCommand.js';
 import { dirtyPolicy, takeSnapshot } from '../vcs/snapshot.js';
+import { normalisePatterns } from '../vcs/inputs.js';
+import { coveredByArtifacts } from '../vcs/artifacts.js';
+import { botVersion } from '../config/version.js';
 import { computeMetrics } from '../session/metrics.js';
 import { resolveDesktopDir, desktopIsSynced } from '../context/desktopDir.js';
 import { saveAndReveal } from './saveToDesktop.js';
@@ -419,6 +422,32 @@ let OperatorService = class OperatorService {
                     delete merged.dirtyWorktree;
                 else
                     merged.dirtyWorktree = { policy: dirty.policy, ...(dirty.requireApproval ? {} : { requireApproval: false }) };
+                // Input files and artifacts: patterns as the matching reads them, absent when there are none.
+                const inputPaths = normalisePatterns(merged.userInputs?.paths ?? []);
+                if (inputPaths.length === 0)
+                    delete merged.userInputs;
+                else {
+                    merged.userInputs = {
+                        paths: inputPaths,
+                        ...(merged.userInputs?.readOnly === false ? { readOnly: false } : {}),
+                        ...(merged.userInputs?.requireApproval === false ? { requireApproval: false } : {}),
+                    };
+                }
+                const artifactPaths = normalisePatterns(merged.artifacts?.paths ?? []);
+                if (artifactPaths.length === 0)
+                    delete merged.artifacts;
+                else
+                    merged.artifacts = { paths: artifactPaths };
+                // Artifacts are kept out of git; one that covers the input files would keep them out too.
+                const hidden = coveredByArtifacts(merged.userInputs?.paths ?? [], artifactPaths);
+                if (hidden.length > 0) {
+                    throw new Error(`An artifacts pattern covers the input files ${hidden.map((h) => `"${h}"`).join(', ')}: artifacts are kept out of git, so the inputs would be too. ` +
+                        'Name only the folders the evidence is written to, not a whole project folder.');
+                }
+                // New inputs are settled again at the next task: the recorded ones are no longer the whole list.
+                if (JSON.stringify(merged.userInputs ?? null) !== JSON.stringify(s.vcs?.userInputs ?? null) && s.vcsStart?.inputs) {
+                    s.vcsStart = { ...s.vcsStart, inputs: undefined };
+                }
                 // Only the program marks a name as one of its own branches, and a name changed is not that one.
                 const stillOwn = !!s.vcs?.branchNameExact && (merged.branchName ?? '').trim() === (s.vcs.branchName ?? '').trim();
                 if (stillOwn)
@@ -2601,7 +2630,7 @@ let OperatorService = class OperatorService {
                     commit: t.vcs?.commit,
                     vcsProblem: t.vcs?.problem,
                     sessionInactive: s.active === false || undefined,
-                    autoRetries: t.autoRetries || undefined,
+                    autoRetries: freshRetriesOfLatestRun(t) || undefined,
                     attempt: t.attempt,
                     changedFiles: t.vcs?.commit && t.vcs.baseCommit ? (t.vcs.files?.length ?? 0) : undefined,
                     interrupted: t.status === 'aborted' && !!t.interruption ? true : undefined,
@@ -2637,6 +2666,8 @@ let OperatorService = class OperatorService {
         const edge = ['C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe', 'C:/Program Files/Microsoft/Edge/Application/msedge.exe'].find((p) => existsSync(p));
         const holders = findEdgeUsingProfile(cfg.resolved.profileDir);
         return {
+            // Which copilot-operator this is: `cop --version` without a terminal.
+            version: botVersion(),
             node: process.versions.node,
             edge: edge ?? null,
             profileDir: cfg.resolved.profileDir,

package/dist/src/cli.js

@@ -24,32 +24,14 @@ import { PolicyLockUnusableError } from './config/lockedPolicy.js';
 import { EventBus } from './session/events.js';
 import { terminalAuthorizer, unattendedAuthorizer } from './exec/authorizer.js';
 import { unattendedPrecondition } from './exec/policy.js';
-import { botRootDir, isOwnCheckout } from './exec/workDir.js';
+import { isOwnCheckout } from './exec/workDir.js';
 import { desktopIsSynced, resolveDesktopDir } from './context/desktopDir.js';
 import { Url } from './transport/locators.js';
+import { botVersion } from './config/version.js';
 import { findEdgeUsingProfile } from './transport/profileLock.js';
 import { assessIsolation, readIsolationSignals } from './exec/isolation.js';
-/**
- * The version of the copilot-operator that is running, from its own package.json.
- *
- * It was a literal, '0.1.0', and stayed that through thirteen releases, so a bug report's
- * `cop --version` named a version that never had the bug. Read where the code is — `src/` under
- * tsx, `dist/src/` in a clone, `node_modules/copilot-operator/dist/src/` once installed — so it
- * cannot drift from what npm installed. botRootDir() falls back to the working directory when it
- * finds no package.json of ours, and that one is the user's project's: its version is not ours to
- * print, so the name is checked and anything else says "unknown".
- */
-function ownVersion() {
-    try {
-        const pkg = JSON.parse(readFileSync(join(botRootDir(), 'package.json'), 'utf8'));
-        if (pkg.name === 'copilot-operator' && typeof pkg.version === 'string' && pkg.version)
-            return pkg.version;
-    }
-    catch {
-        // No readable package.json: say so rather than guess.
-    }
-    return 'unknown';
-}
+/** The running version; see `config/version.ts`. */
+const ownVersion = botVersion;
 const program = new Command();
 program
     .name('cop')
@@ -213,7 +195,7 @@ program
         replyTimeoutMs: 60_000,
         signInTimeoutMs: 15 * 60_000,
         humanWaitMs: 15 * 60_000,
-        onEvent: (e, d) => process.stdout.write(`  ${e}${d && Object.keys(d).length ? ' ' + JSON.stringify(d) : ''}
+        onEvent: (e, d) => process.stdout.write(`  ${e}${d && Object.keys(d).length ? ' ' + JSON.stringify(d) : ''}
 `),
     });
     await transport.open();
@@ -506,14 +488,14 @@ program
     console.log('');
     console.log(`task "${done?.title}": ${done?.status} after ${done?.iterations ?? 0} iteration(s)`);
     if (done?.summary)
-        console.log(`
-Summary:
+        console.log(`
+Summary:
 ${done.summary}`);
     if (done?.reason)
-        console.log(`
+        console.log(`
 Reason: ${done.reason}`);
     if (final?.chat)
-        console.log(`
+        console.log(`
 chat: ${final.chat.name} — ${final.chat.url}`);
     if (done?.runId)
         console.log(`log: ${join(cfg.resolved.runsDir, done.runId, 'task-log.txt')}`);
@@ -533,8 +515,8 @@ program
         return;
     }
     const c = withChat.chat;
-    console.log(`${c.name}
-${c.url}
+    console.log(`${c.name}
+${c.url}
 session ${withChat.id}, ${withChat.tasks.length} task(s), created ${c.createdAt}`);
 });
 program.parseAsync(process.argv).catch((e) => {

package/dist/src/config/version.js

@@ -0,0 +1,30 @@
+/**
+ * The version of the copilot-operator that is running, from its own package.json.
+ *
+ * It was a literal, '0.1.0', and stayed that through thirteen releases, so a bug report's
+ * `cop --version` named a version that never had the bug. Read where the code is — `src/` under
+ * tsx, `dist/src/` in a clone, `node_modules/copilot-operator/dist/src/` once installed — so it
+ * cannot drift from what npm installed. botRootDir() falls back to the working directory when it
+ * finds no package.json of ours, and that one is the user's project's: its version is not ours to
+ * print, so the name is checked and anything else says "unknown".
+ *
+ * Written into every export and attempt record too: a report sent as a screenshot from another
+ * machine could not say which version made it, and the operator had to be asked.
+ */
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { botRootDir } from '../exec/workDir.js';
+let cached;
+export function botVersion() {
+    if (cached)
+        return cached;
+    try {
+        const pkg = JSON.parse(readFileSync(join(botRootDir(), 'package.json'), 'utf8'));
+        if (pkg.name === 'copilot-operator' && typeof pkg.version === 'string' && pkg.version)
+            return (cached = pkg.version);
+    }
+    catch {
+        // No readable package.json: say so rather than guess.
+    }
+    return 'unknown';
+}

package/dist/src/orchestrator/derivedChecks.js

@@ -23,7 +23,25 @@ export function derivedCheckName(findingId, name) {
     return `review ${findingId}: ${name}`;
 }
 export function isDerivedCheck(check) {
-    return /^review r\d+f\d+: /.test(check.name);
+    return /^review (?:a\d+)?r\d+f\d+: /.test(check.name);
+}
+/**
+ * Kept checks written before a finding's id carried its attempt, given the id it carries now.
+ *
+ * Those records hold `r1f1` for attempt 1's first finding and again for attempt 2's, under one check
+ * name, and a dispute, a deferral or a drop aimed at one acted on both. Renamed from the attempt each
+ * was made on (see `findingId`), check name included, so the gate and the implementer see the same
+ * name a dispute can then use. A check of the first attempt, and one already renamed, is left as it is.
+ */
+export function withAttemptIds(reviewChecks) {
+    return reviewChecks.map((rc) => {
+        if ((rc.attempt ?? 1) <= 1 || !/^r\d+f\d+$/.test(rc.findingId))
+            return rc;
+        const id = `a${rc.attempt}${rc.findingId}`;
+        const before = derivedCheckName(rc.findingId, '');
+        const name = rc.check.name.startsWith(before) ? derivedCheckName(id, rc.check.name.slice(before.length)) : rc.check.name;
+        return { ...rc, findingId: id, check: { ...rc.check, name } };
+    });
 }
 /**
  * Runs each finding's check on the current state. Kept if it fails now, refused if it passes.

package/dist/src/orchestrator/review.js

@@ -329,7 +329,7 @@ ${machineNote}` : contract);
                         problem: `every finding of round ${round} rested on something the task never asked for, twice; the review is inconclusive`,
                     };
                 }
-                const named = grounded.map((f, i) => ({ ...f, id: findingId(round, i) }));
+                const named = grounded.map((f, i) => ({ ...f, id: findingId(round, i, task.attempt ?? 1) }));
                 /*
                  * A read-only task's findings never become gate conditions.
                  *
@@ -605,7 +605,7 @@ export function findingsMessage(outcome, round, maxRounds, repeated = [], leftov
         `Fix these, then verify as usual and close the task again. This is review round ${round} of ${maxRounds};`,
         'after that the task is closed as blocked with whatever is still outstanding.',
         '',
-        'If you believe a finding is wrong, say so in `disputed`: its id (the `[r1f2]` in front of it), why it',
+        'If you believe a finding is wrong, say so in `disputed`: its id as written (the `[r1f2]` in front of it), why it',
         'is wrong, and the evidence that shows it — the command you ran and what came back. A dispute goes to',
         'the next reviewer as a claim to test; a sentence in your summary goes nowhere. Do not change the',
         'thing the reviewer looked at in order to make the objection go away.',

package/dist/src/orchestrator/taskRunner.js

@@ -21,7 +21,7 @@ import { buildCoveringMessage, assertSendable } from '../protocol/reporter.js';
 import { runStep } from '../exec/runner.js';
 import { availableShells, detectShells, effectiveShell, preferredShell, refusalForChat, resolveShell, shellNote } from '../exec/shells.js';
 import { runChecks, failureMessage, failureRedactions, failureReport, environmentProblemIn, COMMIT_CLEAN_CHECK, CONTENT_CLEAN_CHECK, RUNNER_CHECK_KINDS } from '../exec/checks.js';
-import { activeChecks, suspendDisputed, settleAfterReview, onlyDerivedFailing, isDerivedCheck } from './derivedChecks.js';
+import { activeChecks, suspendDisputed, settleAfterReview, onlyDerivedFailing, isDerivedCheck, withAttemptIds } from './derivedChecks.js';
 import { workingDirFor, isWorkingDirProblem, workingDirNote } from '../exec/workDir.js';
 import { redactSecrets } from '../exec/redaction.js';
 import { snapshotProcesses, reapLeftovers, describeLeftovers, ProcessTracker } from '../exec/processes.js';
@@ -45,7 +45,9 @@ import { composeHandoff } from '../session/handoff.js';
 import { ProgressWatch } from './progress.js';
 import { contractConflicts, readsTreeClean } from './contract.js';
 import { treeFingerprint } from '../vcs/git.js';
-import { prepareForTask, commitTaskResult, repoDirOf, trackedRepoOf } from '../vcs/taskVcs.js';
+import { prepareForTask, commitTaskResult, commitShortfall, repoDirOf, trackedRepoOf } from '../vcs/taskVcs.js';
+import { protectInputs, inputsMessage, inputsAtCommit, untrackedInputs } from '../vcs/inputs.js';
+import { artifactPatterns, artifactState, keepArtifacts } from '../vcs/artifacts.js';
 import { exportMachine, writeAttemptRecord } from '../session/exports.js';
 /** Why a task that was reported as done is being closed as failed. */
 function checksFailedReason(outcomes) {
@@ -538,9 +540,10 @@ export async function runTask(transport, session, task, deps) {
     let runAfterCommit = null;
     /**
      * Checks earlier reviews gave with their findings — carried over from every attempt before
-     * this one, and grown by this one. See `derivedChecks.ts` for the three rules.
+     * this one, and grown by this one. See `derivedChecks.ts` for the three rules. Ones written before
+     * a finding's id carried its attempt are renamed here, before anything finds one by id or name.
      */
-    let reviewChecks = task.reviewChecks ?? [];
+    let reviewChecks = withAttemptIds(task.reviewChecks ?? []);
     /** Derived checks that still failed when the rounds ran out; the reviewer is told. */
     let derivedStillFailing = [];
     /**
@@ -577,10 +580,68 @@ export async function runTask(transport, session, task, deps) {
         await record(`LEFT RUNNING BY ${by.toUpperCase()}`, describeLeftovers([...result.killed, ...result.failed]));
         return all.map((l) => ({ name: l.name, ports: l.ports }));
     };
+    /** The session's read-only input files and the commit they are put back from, once the task is on its own branch. */
+    let inputsGuard = null;
+    /** The artifact files as they were when the task started; what is kept afterwards is what changed. */
+    let artifactsBefore;
+    /** Puts back whatever a round did to the input files, and tells the chat and the record. */
+    const guardInputs = async (iteration) => {
+        if (!inputsGuard)
+            return null;
+        const guard = inputsGuard;
+        const check = await protectInputs(repoDirOf(session), guard.base, guard.inputs, guard.keep).catch((e) => ({
+            changed: ['(the input files)'],
+            restored: [],
+            failed: [{ path: '(the input files)', why: e.message }],
+        }));
+        if (check.changed.length > 0) {
+            sink.event('inputs-restored', { iteration, restored: check.restored, failed: check.failed }, `the operator's input files are read-only; put back: ${check.restored.join(', ') || '(none)'}` +
+                (check.failed.length > 0 ? `; could not be put back: ${check.failed.map((f) => f.path).join(', ')}` : ''), 'warn');
+            runnerNotes.push(inputsMessage(check));
+            await setTask((t) => {
+                t.inputsRestored = [...new Set([...(t.inputsRestored ?? []), ...check.restored])];
+            });
+        }
+        return check;
+    };
     const finish = async (status, reason, summary, finalReply) => {
         await record(`TASK ${status.toUpperCase()}`, [summary ?? '', reason ? `Reason: ${reason}` : ''].filter(Boolean).join('\n\n') || '(no details)');
         // The net under the plan's own checks: whatever the task left running is stopped and named.
         await reap(processesBefore, 'the task');
+        /*
+         * The operator's input files, once more before the commit: put back what the last round changed,
+         * so it is not committed as the task's work. One that cannot be put back fails a done task. See
+         * `vcs/inputs.ts`.
+         */
+        if (inputsGuard) {
+            const check = await guardInputs();
+            if (check && check.failed.length > 0 && status === 'done') {
+                status = 'failed';
+                reason = `the operator's input file(s) ${check.failed.map((f) => f.path).join(', ')} were changed and could not be put back as they were: ${check.failed.map((f) => f.why).join('; ')}.`;
+            }
+            // Said on the record either way: the inputs as the task leaves them, against their recorded sums.
+            if (check && check.failed.length === 0) {
+                sink.event('inputs-verified', { files: inputsGuard.inputs.files.length }, `${inputsGuard.inputs.files.length} input file(s) are as the session's start recorded them: same sums`);
+            }
+        }
+        /*
+         * The session's artifacts, whatever the outcome: copied into this attempt's record, so the
+         * evidence of each attempt is kept even after a later one overwrites it. See `vcs/artifacts.ts`.
+         */
+        const patterns = artifactPatterns(session.vcs);
+        const projectRoot = repoDirOf(session) || session.projectDir?.trim() || '';
+        if ((patterns.length > 0 || (task.outputs?.length ?? 0) > 0) && projectRoot) {
+            // Only what this task made or changed, inside its scope, or declared as its outputs.
+            const kept = await keepArtifacts(projectRoot, patterns, join(artifactsDir, 'project'), { before: artifactsBefore, scope: task.scope, outputs: task.outputs })
+                .catch((e) => ({ kept: [], skipped: [`(all: ${e.message})`], unchanged: 0, outsideScope: [] }));
+            sink.event('artifacts-kept', { kept: kept.kept.length, skipped: kept.skipped, unchanged: kept.unchanged, outsideScope: kept.outsideScope.slice(0, 20) }, `artifacts kept with the run: ${kept.kept.length} file(s) this task made or changed` +
+                `${kept.unchanged > 0 ? `; ${kept.unchanged} already there and untouched, not kept` : ''}` +
+                `${kept.outsideScope.length > 0 ? `; ${kept.outsideScope.length} outside the task's scope, not kept` : ''}` +
+                `${kept.skipped.length > 0 ? `; not kept: ${kept.skipped.slice(0, 5).join('; ')}` : ''}`, kept.skipped.length > 0 ? 'warn' : 'info');
+            await setTask((t) => {
+                t.artifactsKept = kept.kept.length > 0 ? kept.kept : undefined;
+            });
+        }
         /*
          * A read-only task that changed files has failed, whatever it reported.
          *
@@ -604,10 +665,26 @@ export async function runTask(transport, session, task, deps) {
         // The task is re-read first, because the branch was recorded on it after this closure
         // was created.
         const fresh = (await store.getSession(session.id))?.tasks.find((x) => x.id === task.id);
+        let vcsError;
         const vcsAfter = await commitTaskResult(session, { ...task, vcs: fresh?.vcs }, { status, summary, reason, deviations }, bus).catch((e) => {
+            vcsError = e.message;
             sink.event('vcs-error', { error: String(e) }, `version control failed after the task: ${e.message}`, 'warn');
             return undefined;
         });
+        /*
+         * With version control on, a task is done only when its work is committed. The commit used to
+         * fail — on the branch it was moved off, on a git error, on uncommitted files left behind — and
+         * the task still ended done, its work loose in the tree and the next task refusing to start over
+         * it. Now it ends failed with why; the work stays in the working tree, nothing is lost.
+         */
+        if (status === 'done') {
+            const uncommitted = await commitShortfall(session, fresh?.vcs ?? task.vcs, vcsAfter, vcsError);
+            if (uncommitted) {
+                status = 'failed';
+                reason = uncommitted;
+                sink.event('commit-failed', { problem: vcsAfter?.problem ?? vcsError, uncommitted: vcsAfter?.afterCommit?.changed?.slice(0, 20) }, uncommitted, 'error');
+            }
+        }
         /*
          * The checks about a clean tree, now that the runner has committed. A done task whose tree is
          * still not clean after the commit has failed; any other ending keeps its own reason, and the
@@ -737,6 +814,9 @@ export async function runTask(transport, session, task, deps) {
         t.runId = runId;
         t.runGroup = deps.runGroup;
         t.startedAt = new Date().toISOString();
+        // The kept checks under the ids this run uses (`withAttemptIds`), so the record names them as the gate does.
+        if (reviewChecks.length > 0)
+            t.reviewChecks = reviewChecks;
     });
     sink.event('task-started', { runId, title: task.title }, `task "${task.title}" starting (run ${runId})`);
     await writeFile(taskLogPath, `TASK: ${task.title}\nSESSION: ${session.name} (${session.id})\nRUN: ${runId}\nSTARTED: ${new Date().toISOString()}\n`, 'utf8');
@@ -856,6 +936,26 @@ export async function runTask(transport, session, task, deps) {
          * findings described a tree that was not the one it had been asked to audit.
          */
         const scopeEnforced = (scope.length > 0 || !!task.readOnly) && onOwnBranch;
+        // The operator's input files, read-only on a branch of the task's own; see `vcs/inputs.ts`.
+        const startNow = (await store.getSession(session.id))?.vcsStart;
+        if (onOwnBranch && startNow?.inputs?.readOnly && startNow.inputs.files.length > 0) {
+            /*
+             * Held to the inputs as this task's own starting commit has them, not the session's record: a
+             * re-run is cut from where the task first started, before any inputs changed since. And what is
+             * under the patterns untracked now is the operator's, never removed by the guard.
+             */
+            const baseCommit = prepared.vcs.baseCommit;
+            inputsGuard = {
+                base: baseCommit,
+                inputs: await inputsAtCommit(repoDirOf(session), baseCommit, startNow.inputs),
+                keep: await untrackedInputs(repoDirOf(session), startNow.inputs.patterns),
+            };
+        }
+        // Before the first step: what is under the artifact patterns now is not this task's evidence.
+        const artifactRoot = repoDirOf(session) || session.projectDir?.trim() || '';
+        const artifactPatternsNow = [...artifactPatterns(session.vcs), ...(task.outputs ?? [])];
+        if (artifactRoot && artifactPatternsNow.length > 0)
+            artifactsBefore = await artifactState(artifactRoot, artifactPatternsNow).catch(() => undefined);
         /** The working tree's fingerprint, when the task is on a branch of its own; null otherwise. */
         const treeNow = async () => prepared.vcs.branch && !prepared.vcs.problem && prepared.vcs.baseCommit ? await treeFingerprint(repoDirOf(session)).catch(() => null) : null;
         /*
@@ -946,7 +1046,12 @@ export async function runTask(transport, session, task, deps) {
             workDirNote: workingDirNote(work),
             vcsNote: prepared.note,
             readOnlyNote: task.readOnly ? READ_ONLY_NOTE : undefined,
-            scopeNote: scopeNote(scope, scopeEnforced),
+            scopeNote: [
+                scopeNote(scope, scopeEnforced),
+                (task.outputs?.length ?? 0) > 0
+                    ? `## Outputs\n\nThis task is to produce: ${(task.outputs ?? []).map((o) => `\`${o}\``).join(', ')}. What it creates or changes there is kept with the run's record as its evidence.`
+                    : '',
+            ].filter(Boolean).join('\n\n'),
             approachesNote: minApproaches > MIN_TRIED_APPROACHES
                 ? `## Giving up\n\nThis task may end with status "blocked" only after at least ${minApproaches} genuinely different approaches, ` +
                     `each listed in "tried". With fewer, the runner asks you for another approach instead of accepting it.`
@@ -1409,7 +1514,7 @@ export async function runTask(transport, session, task, deps) {
             // `repeated` still identifies them.
             const named = outcome.findings.map((f, i) => ({
                 ...f,
-                id: f.id ?? findingId(reviewRounds, i),
+                id: f.id ?? findingId(reviewRounds, i, attempt),
                 ...(repeated.includes(f) ? { repeated: true } : {}),
             }));
             outcome = { ...outcome, findings: named };
@@ -1936,6 +2041,7 @@ export async function runTask(transport, session, task, deps) {
                     });
                 }
             }
+            await guardInputs(iterations);
             // --- report back ---------------------------------------------------------------
             const report = await writeReport(results, {
                 runId,
@@ -2160,9 +2266,23 @@ export async function runSession(sessionId, deps) {
                 break;
             }
             session = (await store.getSession(sessionId));
-            const task = session.tasks.find((t) => t.id === queuedTask.id);
+            let task = session.tasks.find((t) => t.id === queuedTask.id);
             if (!task || task.status !== 'queued')
                 continue;
+            /*
+             * A task taken from the queue was started by the operator, never by the retry loop below, which
+             * runs its own. A fresh-retry mark on it is left from a retry that was queued and never ran —
+             * the new chat failed to open, the program was closed — and counted as this run's, it added the
+             * old run's retry to this one's (`freshRetriesOfLatestRun`).
+             */
+            if (task.freshRetry) {
+                session = await store.updateSession(sessionId, (s) => {
+                    const t = s.tasks.find((x) => x.id === queuedTask.id);
+                    if (t)
+                        t.freshRetry = undefined;
+                });
+                task = session.tasks.find((t) => t.id === queuedTask.id);
+            }
             let outcome = await runTask(chat, session, task, deps);
             ran += 1;
             /*
@@ -2194,11 +2314,11 @@ export async function runSession(sessionId, deps) {
                 session = await store.updateSession(sessionId, (s) => {
                     s.chat = undefined;
                     s.contractSent = false;
+                    // Marked, not counted: how many retries this run made is read back from the marks
+                    // (`freshRetriesOfLatestRun`), so a later run cannot add to an earlier one's count.
                     const again = s.tasks.find((x) => x.id === task.id);
-                    if (again) {
-                        again.autoRetries = (again.autoRetries ?? 0) + 1;
+                    if (again)
                         again.freshRetry = true;
-                    }
                 });
                 await chat.newChat();
                 /*

package/dist/src/plan/brief.js

@@ -324,6 +324,7 @@ const FIELD_ROWS_EN = [
     ['review', 'task', 'no', 'Set to `false` to skip the review for one task. Absent means the session decides.'],
     ['readOnly', 'task', 'no', '`true` for a task that must not change files — an audit, a smoke test, a report. The runner fails it if the tree changed, and still commits the change on its branch so nothing is lost.'],
     ['scope', 'task', 'no', 'The paths the task may change: files, folders (`tests/e2e/`) or `*`/`**` patterns. With version control on, the runner puts back any change outside them. Give it when the task is about one suite or module.'],
+    ['outputs', 'task', 'no', 'Evidence the task is to produce (a report, an archive): patterns. What it creates or changes there is kept with the run\'s record.'],
     ['tasks', 'session', 'yes', 'At least one, in the order they must run.'],
     ['title', 'task', 'yes', '3 to 120 characters. Short, latin, hyphenated.'],
     ['prompt', 'task', 'yes', 'The task itself, at least 30 characters. This is what Copilot reads.'],
@@ -394,6 +395,7 @@ const FIELD_ROWS_BG = [
     ['review', 'задача', 'не', 'Сложи `false`, за да се пропусне рецензията само за тази задача. Липсата значи каквото казва сесията.'],
     ['readOnly', 'задача', 'не', '`true` за задача, която не бива да променя файлове — одит, smoke тест, доклад. Runner-ът я проваля, ако дървото е променено, и пак комитва промяната на клона ѝ, за да не се губи нищо.'],
     ['scope', 'задача', 'не', 'Пътищата, които задачата може да променя: файлове, папки (`tests/e2e/`) или шаблони с `*`/`**`. При включен контрол на версиите runner-ът връща всяка промяна извън тях. Давай го, когато задачата е за един suite или модул.'],
+    ['outputs', 'задача', 'не', 'Доказателства, които задачата трябва да създаде (отчет, архив): шаблони. Каквото създаде или промени там, се пази към записа на пускането.'],
     ['tasks', 'сесия', 'да', 'Поне една, в реда, в който трябва да се изпълнят.'],
     ['title', 'задача', 'да', 'От 3 до 120 знака. Кратко, латиница, с тирета.'],
     ['prompt', 'задача', 'да', 'Самата задача, поне 30 знака. Това чете Copilot.'],
@@ -461,8 +463,24 @@ its own, and the session starts from it; the user approves the exact list on the
 \`"tracked-only-snapshot"\` takes tracked changes only. Secrets (\`.env\`), tool output and files outside
 the project are never taken, and an ignored file only when a task's \`scope\` names it. The snapshot is
 taken where the changes are, so use it with \`startFrom\` \`"branch"\` only when the repository is already on
-that branch, and never with \`"existing-branch"\`. Leaving it out keeps \`"reject"\`: version control stays out
-of a tree with uncommitted changes.
+that branch, and never with \`"existing-branch"\`. Leaving it out keeps \`"reject"\`: a tree with uncommitted
+changes refuses the task, and nothing runs.
+
+**userInputs** — files the user provides for the work (schemas, test data):
+\`{ "paths": ["rules-engine/test-data/schemas/*.yaml"] }\`. They go into the commit every session starts from —
+new or ignored ones in the starting snapshot, approved by the user; a later session whose start lacks them
+gets them committed on top of it — and they are read-only while the tasks run (\`"readOnly": false\` only if
+the user wants the work to change them). Ask the user which files are inputs; never name a whole folder of
+work, and never \`.env\`. **artifacts** — evidence the work writes (reports, ZIP archives, test results):
+\`{ "paths": ["rules-engine/test-results/**"] }\`. Never committed, kept with the run; tell tasks to write
+evidence there instead of changing \`.gitignore\`. Only what a task creates or changes there is kept, and an
+artifacts pattern must never cover the input files or a task's work ("rules-engine/**" would hide both): name
+the evidence folders only.
+
+A session with \`"startFrom": "previous-session"\` continues the whole work of the one before it only when
+that one is \`"branchMode": "per-session"\`: per task, its work is on several branches and the next session
+refuses to start from part of it. It also refuses when the session before has not finished (a task failed or
+blocked): finish it first.
 
 Put the same \`startFrom\` on every session that works in one repository unless the user wants it
 mixed. Leaving it out keeps the old behaviour — whatever branch the repository is on — which is
@@ -529,8 +547,24 @@ run“, на отделен клон, и сесията тръгва от нег
 сесията. \`"tracked-only-snapshot"\` взема само tracked промени. Тайни (\`.env\`), изход от инструменти и
 файлове извън проекта никога не се вземат, а ignored файл — само когато \`scope\` на задача го посочва.
 Снимката се прави там, където са промените, затова с \`startFrom\` \`"branch"\` само ако хранилището вече е на
-този клон, и никога с \`"existing-branch"\`. Ако го пропуснеш, остава \`"reject"\`: контролът на версиите
-не влиза в дърво с некомитнати промени.
+този клон, и никога с \`"existing-branch"\`. Ако го пропуснеш, остава \`"reject"\`: дърво с некомитнати
+промени отказва задачата и нищо не се изпълнява.
+
+**userInputs** — файлове, които потребителят дава за работата (схеми, тестови данни):
+\`{ "paths": ["rules-engine/test-data/schemas/*.yaml"] }\`. Влизат в комита, от който тръгва всяка сесия —
+новите или ignored в началната снимка, с одобрение от потребителя; следваща сесия, чието начало ги няма, ги
+получава комитнати върху него — и са само за четене, докато задачите работят (\`"readOnly": false\` само ако
+потребителят иска работата да ги променя). Питай кои файлове са вход; никога цяла папка с работа и никога
+\`.env\`. **artifacts** — доказателства, които работата пише (отчети, ZIP архиви, резултати от тестове):
+\`{ "paths": ["rules-engine/test-results/**"] }\`. Никога не се комитват, пазят се към пускането; кажи на
+задачите да пишат доказателствата там, вместо да променят \`.gitignore\`. Пази се само каквото задачата създаде
+или промени там, и шаблон за artifacts никога не покрива входните файлове или работата на задача
+("rules-engine/**" би скрил и двете): посочвай само папките с доказателства.
+
+Сесия с \`"startFrom": "previous-session"\` продължава цялата работа на предната само ако тя е
+\`"branchMode": "per-session"\`: при per-task работата ѝ е на няколко клона и следващата сесия отказва да
+тръгне от част от нея. Отказва и когато предната сесия не е завършила (задача е провалена или блокирана):
+първо я завърши.
 
 Сложи един и същ \`startFrom\` на всички сесии в едно хранилище, освен ако потребителят не иска
 различни. Ако го пропуснеш, остава старото поведение — от който клон е хранилището в момента —

package/dist/src/plan/importPlan.js

@@ -1,4 +1,6 @@
 import { DEFAULT_VCS, applyDefaultProject } from '../session/store.js';
+import { normalisePatterns } from '../vcs/inputs.js';
+import { coveredByArtifacts } from '../vcs/artifacts.js';
 import { availableShells, detectShells } from '../exec/shells.js';
 /** The heading under which a task's acceptance bar reaches Copilot. English, like level 1. */
 const EXPECTED_HEADER = '### Expected result';
@@ -165,6 +167,35 @@ defaultProjectDir = '') {
     const sharedGroup = plan.conversation === 'shared'
         ? (plan.plan.trim() || `plan-${new Date().toISOString().slice(0, 16).replace(/[:T-]/g, '')}`).slice(0, 60)
         : '';
+    /*
+     * A session that continues the one before it in the same repository, when that one ran per task
+     * with several tasks: its work is on several branches, and the continuation is refused at its start
+     * (see `sessionStart`). Said now, when the plan can still be changed.
+     */
+    const lastIn = new Map();
+    for (const planned of plan.sessions) {
+        const repo = (planned.vcs?.repoDir || planned.projectDir || '').trim().replace(/[\\/]+$/, '').toLowerCase();
+        if (!planned.vcs?.enabled || !repo)
+            continue;
+        const before = lastIn.get(repo);
+        if (planned.vcs.startFrom === 'previous-session' && before?.perTask && before.tasks > 1) {
+            warnings.push(`Session "${planned.name}" continues "${before.name}", which runs a branch per task: its ${before.tasks} tasks' work will be on ${before.tasks} branches, ` +
+                `and "${planned.name}" will refuse to start from part of it. Give "${before.name}" "branchMode": "per-session" if the next session builds on all of it.`);
+        }
+        lastIn.set(repo, { name: planned.name, perTask: (planned.vcs.branchMode ?? 'per-task') === 'per-task', tasks: planned.tasks.length });
+    }
+    // A task whose whole scope is under the artifact patterns would have its work kept out of git.
+    for (const planned of plan.sessions) {
+        const arts = planned.vcs?.artifacts?.paths ?? [];
+        if (!planned.vcs?.enabled || arts.length === 0)
+            continue;
+        for (const task of planned.tasks) {
+            if (task.scope.length > 0 && coveredByArtifacts(task.scope, arts).length === task.scope.length) {
+                warnings.push(`Task "${task.title}" in session "${planned.name}" may change only ${task.scope.join(', ')}, and the session's artifacts patterns cover all of it: ` +
+                    'whatever it writes is kept with the run and never committed. If that work is meant to be committed, narrow "artifacts".');
+            }
+        }
+    }
     for (const planned of plan.sessions) {
         // Attaching project files to the chat was removed; an old plan's root is still its project folder.
         if (planned.mirror?.enabled) {
@@ -172,8 +203,17 @@ defaultProjectDir = '') {
                 'the chat reads the project by running commands. "mirror" was ignored.');
         }
         const created = await store.createSession(planned.name, planned.projectDir || planned.mirror?.rootDir || '');
-        const { dirtyWorktree: plannedDirty, ...plannedVcs } = planned.vcs ?? {};
+        const { dirtyWorktree: plannedDirty, userInputs: plannedInputs, artifacts: plannedArtifacts, ...plannedVcs } = planned.vcs ?? {};
         const vcs = { ...DEFAULT_VCS, ...plannedVcs };
+        // Input files and artifacts in the one spelling the session has: see `UserInputs`.
+        const inputPaths = plannedInputs?.enabled === false ? [] : normalisePatterns(plannedInputs?.paths ?? []);
+        if (inputPaths.length > 0) {
+            const readOnly = plannedInputs?.readOnly ?? plannedInputs?.readOnlyAfterCapture;
+            vcs.userInputs = { paths: inputPaths, ...(readOnly === false ? { readOnly: false } : {}), ...(plannedInputs?.requireApproval === false ? { requireApproval: false } : {}) };
+        }
+        const artifactPaths = normalisePatterns(plannedArtifacts?.paths ?? []);
+        if (artifactPaths.length > 0)
+            vcs.artifacts = { paths: artifactPaths };
         // Stored in the one spelling the session has: see `DirtyWorktree`.
         const policy = plannedDirty?.policy === 'snapshot' && plannedDirty.includeUntracked === false ? 'tracked-only-snapshot' : plannedDirty?.policy;
         if (policy && policy !== 'reject')
@@ -211,6 +251,7 @@ defaultProjectDir = '') {
                 reviewEnabled: task.review,
                 readOnly: task.readOnly || undefined,
                 scope: task.scope.length > 0 ? task.scope : undefined,
+                outputs: task.outputs.length > 0 ? task.outputs : undefined,
             });
             titles.push(added.title);
         }