copilot-operator 0.1.18 → 0.1.19

package/dist/src/vcs/inputs.js

@@ -170,9 +170,11 @@ async function commitOnto(top, parent, files, message, branch) {
         const commit = await git(top, ['-c', 'user.name=copilot-operator', '-c', `user.email=${RUNNER_EMAIL}`, 'commit-tree', tree.stdout, '-p', parent, '-m', message]);
         if (!commit.ok || !commit.stdout)
             return { problem: commit.stderr || 'git commit-tree failed' };
-        const made = await git(top, ['branch', branch, commit.stdout]);
-        if (!made.ok)
-            return { problem: made.stderr || `the branch ${branch} could not be made` };
+        if (branch) {
+            const made = await git(top, ['branch', branch, commit.stdout]);
+            if (!made.ok)
+                return { problem: made.stderr || `the branch ${branch} could not be made` };
+        }
         return { commit: commit.stdout };
     }
     finally {
@@ -180,41 +182,27 @@ async function commitOnto(top, parent, files, message, branch) {
     }
 }
 /**
- * Makes sure the commit a session starts from has the operator's input files, and records their
- * sums on the start. Returns the start to use — the same one, or one whose commit has the inputs
- * committed on top — or why the session cannot start.
- *
- * Called once the start is known and the working tree holds nothing uncommitted of the inputs (new
- * or changed ones went into the snapshot before this). Where the inputs are taken from: the
- * repository's HEAD for every pattern it has files for, else the latest session in this same
- * repository whose start recorded files for that pattern.
+ * Where each input pattern's files are committed: the repository's HEAD first, then `start` (a
+ * snapshot approved on the page has them, wherever HEAD has moved since), then the latest earlier
+ * session in this repository that recorded them. A pattern found nowhere is `missing`.
  */
-export async function settleInputs(session, dir, start, allSessions) {
-    const settings = inputSettings(session.vcs);
-    if (!settings)
-        return { start };
-    const topR = await git(dir, ['rev-parse', '--show-toplevel']);
-    if (!topR.ok || !topR.stdout)
-        return { problem: `${dir} is not a git repository.` };
-    const top = resolve(topR.stdout);
+async function inputSources(session, dir, top, patterns, start, allSessions) {
     const head = (await git(top, ['rev-parse', '--verify', '--quiet', 'HEAD'])).stdout;
-    // Where each pattern's files are: HEAD first, then the latest earlier capture in this repository.
     const wanted = [];
     const sources = new Set();
     const missing = [];
-    const atHead = head ? await inputsAt(top, head, settings.patterns) : [];
+    const atHead = head ? await inputsAt(top, head, patterns) : [];
     const earlier = (await allSessions())
         .filter((s) => s.id !== session.id && s.vcsStart?.inputs && norm(s.vcs?.repoDir || s.projectDir || '') === norm(dir))
         // The newest first: a later capture is the operator's later word on the inputs.
         .sort((a, b) => (b.createdAt ?? '').localeCompare(a.createdAt ?? ''))
         .map((s) => s.vcsStart);
-    for (const pattern of settings.patterns) {
+    for (const pattern of patterns) {
         let found = atHead.filter((f) => inScope(f.path, [pattern]));
         let from = head;
-        // The start itself next: a snapshot approved on the page has them, wherever HEAD has moved since.
-        if (found.length === 0) {
-            found = (await inputsAt(top, start.commit, [pattern])).filter((f) => inScope(f.path, [pattern]));
-            from = start.commit;
+        if (found.length === 0 && start) {
+            found = (await inputsAt(top, start, [pattern])).filter((f) => inScope(f.path, [pattern]));
+            from = start;
         }
         for (const s of earlier) {
             if (found.length > 0)
@@ -230,6 +218,42 @@ export async function settleInputs(session, dir, start, allSessions) {
             if (!wanted.some((w) => w.path === f.path))
                 wanted.push(f);
     }
+    return { wanted, sources, missing };
+}
+/**
+ * The input patterns that match no file anywhere — not in the working tree, not committed, not
+ * captured by an earlier session. Asked before a snapshot is approved: found only afterwards, the
+ * snapshot was already taken when the session was refused for it.
+ */
+export async function missingInputPatterns(session, dir, top, allSessions) {
+    const settings = inputSettings(session.vcs);
+    if (!settings)
+        return [];
+    const inTree = await inputFilesInTree(top, settings.patterns);
+    const notInTree = settings.patterns.filter((p) => !inTree.some((f) => inScope(f.path, [p])));
+    if (notInTree.length === 0)
+        return [];
+    return (await inputSources(session, dir, top, notInTree, session.vcsStart?.commit, allSessions)).missing;
+}
+/**
+ * Makes sure the commit a session starts from has the operator's input files, and records their
+ * sums on the start. Returns the start to use — the same one, or one whose commit has the inputs
+ * committed on top — or why the session cannot start.
+ *
+ * Called once the start is known and the working tree holds nothing uncommitted of the inputs (new
+ * or changed ones went into the snapshot before this). Where the inputs are taken from: the
+ * repository's HEAD for every pattern it has files for, else the latest session in this same
+ * repository whose start recorded files for that pattern.
+ */
+export async function settleInputs(session, dir, start, allSessions) {
+    const settings = inputSettings(session.vcs);
+    if (!settings)
+        return { start };
+    const topR = await git(dir, ['rev-parse', '--show-toplevel']);
+    if (!topR.ok || !topR.stdout)
+        return { problem: `${dir} is not a git repository.` };
+    const top = resolve(topR.stdout);
+    const { wanted, sources, missing } = await inputSources(session, dir, top, settings.patterns, start.commit, allSessions);
     if (missing.length > 0) {
         return {
             problem: `the input file pattern(s) ${missing.map((m) => `"${m}"`).join(', ')} match no file: not in the working tree, not in the repository's HEAD, ` +
@@ -266,12 +290,105 @@ export async function settleInputs(session, dir, start, allSessions) {
     const files = await inputSumsAt(top, commit, settings.patterns);
     return { start: { ...start, commit, inputs: { patterns: settings.patterns, files, readOnly: settings.readOnly, ...(carried ? { carried } : {}) } } };
 }
+/**
+ * The input files in the working tree that the session's record does not have as they are: new
+ * since it was taken, changed since, or never recorded and not committed. Committed and unchanged
+ * ones are not changes.
+ */
+export async function inputChanges(top, patterns, recorded) {
+    const known = new Map((recorded ?? []).map((f) => [f.path, f.blob]));
+    const out = [];
+    for (const f of await inputFilesInTree(top, patterns)) {
+        const now = await blobOfFile(top, f.path);
+        if (!now || known.get(f.path) === now)
+            continue;
+        if (!known.has(f.path) && f.kind === 'tracked' && (await git(top, ['rev-parse', '--verify', '--quiet', `HEAD:${f.path}`])).stdout === now)
+            continue;
+        out.push(f);
+    }
+    return out;
+}
+/**
+ * Commits input files that changed after the session started, on its line of work, and moves the
+ * working tree onto that commit without losing a byte: per session, on top of the session's branch;
+ * per task, on top of the commit every task branch is cut from, on a branch of its own that becomes
+ * that commit. The files' bytes go in as git would store them (`hash-object -w --path`), the commit
+ * is made with a temporary index, and the files are then staged as they are, so the switch onto the
+ * commit keeps them. Asked for by the operator's approval, or without it when `requireApproval` is
+ * false. Found in a run on 0.1.18: inputs edited or added once the session had started were "a dirty
+ * tree to commit or stash", version control went off, and the task ran without it.
+ */
+export async function recaptureInputs(session, dir, paths, target) {
+    const topR = await git(dir, ['rev-parse', '--show-toplevel']);
+    if (!topR.ok || !topR.stdout)
+        return { problem: `${dir} is not a git repository.` };
+    const top = resolve(topR.stdout);
+    const files = [];
+    for (const path of paths) {
+        const blob = await git(top, ['hash-object', '-w', `--path=${path}`, '--', join(top, path)]);
+        if (!blob.ok || !blob.stdout)
+            return { problem: `${path} could not be read into git: ${blob.stderr}` };
+        const mode = (await git(top, ['ls-tree', target.parent, '--', path])).stdout.split(' ')[0] || '100644';
+        files.push({ path, mode, blob: blob.stdout });
+    }
+    const message = [
+        'Capture user-provided inputs',
+        '',
+        `The operator's input files for session "${session.name}" as they are now, changed or added after the session started.`,
+        'They are inputs: the work reads them and does not change them.',
+        '',
+        ...paths.slice(0, 200).map((p) => `- ${p}`),
+        '',
+        'Committed by copilot-operator. Not pushed.',
+        '',
+    ].join('\n');
+    const made = await commitOnto(top, target.parent, files, message, target.newBranch);
+    if ('problem' in made)
+        return { problem: `the input files could not be committed: ${made.problem}` };
+    const branch = target.ffBranch ?? target.newBranch;
+    if (target.ffBranch) {
+        // Forward only, from the tip it was read at: nothing on the branch is lost or rewritten.
+        const moved = await git(top, ['update-ref', `refs/heads/${target.ffBranch}`, made.commit, target.parent]);
+        if (!moved.ok)
+            return { problem: `${target.ffBranch} could not be moved onto the inputs' commit: ${moved.stderr}` };
+    }
+    const staged = await git(top, ['--literal-pathspecs', 'add', '-f', '--', ...paths]);
+    if (!staged.ok)
+        return { problem: `the input files could not be staged: ${staged.stderr}` };
+    const on = (await git(top, ['rev-parse', '--abbrev-ref', 'HEAD'])).stdout;
+    if (on !== branch) {
+        const moved = await git(top, ['checkout', '-q', branch]);
+        if (!moved.ok)
+            return { problem: `the repository could not be put on ${branch}: ${moved.stderr}` };
+    }
+    return { commit: made.commit, branch };
+}
+/** The input files as one commit has them, for the guard of a task cut from it. */
+export async function inputsAtCommit(dir, commit, inputs) {
+    const topR = await git(dir, ['rev-parse', '--show-toplevel']);
+    if (!topR.ok || !topR.stdout)
+        return inputs;
+    return { ...inputs, files: await inputSumsAt(resolve(topR.stdout), commit, inputs.patterns) };
+}
+/** The files under the input patterns that git does not track, when a task starts: not the task's to remove. */
+export async function untrackedInputs(dir, patterns) {
+    const topR = await git(dir, ['rev-parse', '--show-toplevel']);
+    if (!topR.ok || !topR.stdout)
+        return new Set();
+    return new Set((await inputFilesInTree(resolve(topR.stdout), patterns)).filter((f) => f.kind !== 'tracked').map((f) => f.path));
+}
 /**
  * Puts the input files back as the task's starting commit has them: a changed or removed one from
  * that commit, a new one matching an input pattern removed. Only on the task's own branch, whose
  * starting commit has the inputs (see `settleInputs`).
  */
-export async function protectInputs(dir, base, inputs) {
+export async function protectInputs(dir, base, inputs, 
+/**
+ * Untracked files under the patterns that were there when the task started: the operator's, not
+ * the task's, and never removed. Found in a run on 0.1.18: an input the operator added, ignored by
+ * .gitignore and so in no commit, was "put back" by deleting it.
+ */
+keep = new Set()) {
     const out = { changed: [], restored: [], failed: [] };
     const topR = await git(dir, ['rev-parse', '--show-toplevel']);
     if (!topR.ok || !topR.stdout)
@@ -290,7 +407,7 @@ export async function protectInputs(dir, base, inputs) {
     }
     // A file the task added under an input pattern: inputs are the operator's, so it goes.
     for (const { path, kind } of await inputFilesInTree(top, inputs.patterns)) {
-        if (known.has(path) || kind === 'tracked')
+        if (known.has(path) || kind === 'tracked' || keep.has(path))
             continue;
         out.changed.push(path);
         const abs = resolve(join(top, path));

package/dist/src/vcs/snapshot.js

@@ -27,8 +27,8 @@ import { tmpdir } from 'node:os';
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { looksGenerated } from './commitHygiene.js';
 import { branchNameFrom, freeBranchName, git, gitBytes, isValidBranchName, RUNNER_EMAIL } from './git.js';
-import { repoDirOf, sessionStart } from './taskVcs.js';
-import { inputFilesInTree, inputSettings } from './inputs.js';
+import { repoDirOf, sessionBranchName, sessionStart } from './taskVcs.js';
+import { inputChanges, inputFilesInTree, inputSettings, inputSumsAt, missingInputPatterns, recaptureInputs } from './inputs.js';
 import { artifactPatterns } from './artifacts.js';
 import { inScope } from './scope.js';
 /** The session's dirty-tree policy, absent fields filled in: reject, and asking first. */
@@ -134,11 +134,15 @@ export async function planSnapshot(session, allSessions = async () => []) {
     const inputs = inputSettings(session.vcs);
     const repoDir = repoDirOf(session);
     const plan = { needed: false, ok: false, policy, requireApproval, repoDir, branch: null, head: null, entries: [] };
-    if (!session.vcs?.enabled || (policy === 'reject' && !inputs) || session.vcsBaseCommit)
+    if (!session.vcs?.enabled || (policy === 'reject' && !inputs))
+        return plan;
+    if (session.vcsBaseCommit && (!inputs || session.vcs.startFrom === 'existing-branch'))
         return plan;
     const top = repoDir ? await topOf(repoDir) : null;
     if (!top)
         return { ...plan, problem: `${repoDir || 'The repository folder'} is not a git repository.` };
+    if (session.vcsBaseCommit)
+        return await planRecapture(session, top, plan);
     const status = await statusEntries(top);
     if (!status)
         return { ...plan, problem: 'git status could not be read.' };
@@ -208,7 +212,14 @@ export async function planSnapshot(session, allSessions = async () => []) {
         }
     }
     const blocked = plan.entries.filter((e) => e.allowed.length === 0);
-    if (!plan.head)
+    // A pattern that matches nothing anywhere is said now, before anything is committed for approval.
+    const missing = inputs ? await missingInputPatterns(session, repoDir, top, allSessions) : [];
+    if (missing.length > 0) {
+        plan.problem =
+            `the input file pattern(s) ${missing.map((m) => `"${m}"`).join(', ')} match no file in the project, and nothing earlier captured them. ` +
+                'Correct "Input files" (a "*" stays inside one folder; "**" crosses folders), or put the files in the project.';
+    }
+    else if (!plan.head)
         plan.problem = 'the repository has no commit yet, so there is nothing for a snapshot to sit on. Make the first commit yourself.';
     else if (blocked.length > 0)
         plan.problem = `${blocked.length} change(s) can be neither taken nor left out: ${blocked.map((e) => `${e.path} (${e.reason})`).join('; ')}.`;
@@ -224,6 +235,62 @@ export async function planSnapshot(session, allSessions = async () => []) {
     plan.ok = !plan.problem;
     return plan;
 }
+/**
+ * After the session's start: the input files changed or added since it was recorded, to be taken
+ * onto its line of work (see `recaptureInputs`). Anything else uncommitted is in the way, as it is
+ * before a task, and refuses.
+ */
+async function planRecapture(session, top, plan) {
+    const inputs = inputSettings(session.vcs);
+    if (!inputs || !session.vcsBaseCommit)
+        return plan;
+    const branchR = await git(top, ['rev-parse', '--abbrev-ref', 'HEAD']);
+    const headR = await git(top, ['rev-parse', '--verify', '--quiet', 'HEAD']);
+    plan.branch = branchR.ok && branchR.stdout !== 'HEAD' ? branchR.stdout : null;
+    plan.head = headR.ok && headR.stdout ? headR.stdout : null;
+    const changes = await inputChanges(top, inputs.patterns, session.vcsStart?.inputs?.files);
+    if (changes.length === 0)
+        return plan;
+    plan.needed = true;
+    plan.requireApproval = inputs.requireApproval;
+    const project = session.projectDir?.trim() ? relative(top, resolve(session.projectDir.trim())).replace(/\\/g, '/') : '';
+    const inProject = (p) => !project || project.startsWith('..') || isAbsolute(project) || p.toLowerCase() === project.toLowerCase() || p.toLowerCase().startsWith(`${project.toLowerCase()}/`);
+    for (const c of changes) {
+        const blocked = looksGenerated(c.path)?.reason === 'a secrets file' ? 'a secrets file is never taken as an input' : !inProject(c.path) ? `outside the project folder ${project}` : undefined;
+        plan.entries.push({
+            path: c.path,
+            kind: c.kind,
+            input: true,
+            size: (await stat(join(top, c.path)).catch(() => null))?.size,
+            allowed: blocked ? [] : ['include'],
+            choice: blocked ? null : 'include',
+            reason: blocked ?? 'an input file changed or added after the session started: committed on its line of work, then read-only',
+        });
+    }
+    const changed = new Set(changes.map((c) => c.path));
+    const others = ((await statusEntries(top)) ?? []).filter((s) => !changed.has(s.path)).map((s) => s.path);
+    const blocked = plan.entries.filter((e) => e.allowed.length === 0);
+    if (others.length > 0) {
+        plan.problem = `besides the input files there are other uncommitted changes (${someOf(others)}). Commit or stash them yourself first.`;
+    }
+    else if (blocked.length > 0) {
+        plan.problem = `${blocked.length} file(s) cannot be taken as inputs: ${blocked.map((e) => `${e.path} (${e.reason})`).join('; ')}.`;
+    }
+    // Where they go: on the session's one branch when it has it, else on the commit tasks are cut from.
+    const sessionBranch = sessionBranchName(session);
+    const tip = session.vcs?.branchMode === 'per-session' ? (await git(top, ['rev-parse', '--verify', '--quiet', `refs/heads/${sessionBranch}^{commit}`])).stdout : '';
+    if (tip) {
+        plan.recapture = { parent: tip, ffBranch: sessionBranch };
+        plan.baselineBranch = sessionBranch;
+    }
+    else {
+        const newBranch = await freeBranchName(top, `${branchNameFrom(['input'], session.vcs?.branchPrefix || 'cop/')}/${session.id}`);
+        plan.recapture = { parent: session.vcsBaseCommit, newBranch };
+        plan.baselineBranch = newBranch;
+    }
+    plan.ok = !plan.problem;
+    return plan;
+}
 /** A path as a pattern for `.git/info/exclude` that matches that one file and nothing else. */
 function excludePattern(path) {
     return `/${path.replace(/[\\*?[]/g, (c) => `\\${c}`).replace(/ $/, '\\ ')}`;
@@ -284,8 +351,52 @@ export async function takeSnapshot(session, opts, bus, saveSession, allSessions
     if (dirtyPolicy(session.vcs).policy === 'reject' && !inputSettings(session.vcs)) {
         return { ok: false, problem: 'this session does not take uncommitted changes as a snapshot. Choose that under Version control → "Uncommitted changes" first.' };
     }
-    if (session.vcsBaseCommit)
-        return { ok: false, problem: 'this session has already started; a snapshot is taken only before its first task.' };
+    if (session.vcsBaseCommit) {
+        // Started already: only input files changed or added since can be taken, onto its line of work.
+        const plan = await planSnapshot(session, allSessions);
+        if (!plan.needed || !plan.recapture) {
+            return { ok: false, problem: 'this session has already started, and no input file has changed since: a snapshot is taken only before its first task.' };
+        }
+        if (!plan.ok)
+            return { ok: false, problem: plan.problem ?? 'the input files cannot be taken.' };
+        const paths = plan.entries.map((e) => e.path);
+        if (opts.approved) {
+            const shown = Object.keys(opts.choices ?? {}).sort();
+            if (JSON.stringify(shown) !== JSON.stringify([...paths].sort()) || paths.some((p) => opts.choices?.[p] !== 'include')) {
+                return { ok: false, problem: 'the input files changed since the list was shown. Look at the list again; nothing was done.' };
+            }
+        }
+        const made = await recaptureInputs(session, plan.repoDir, paths, plan.recapture);
+        if ('problem' in made)
+            return { ok: false, problem: made.problem };
+        const settings = inputSettings(session.vcs);
+        const top = (await topOf(plan.repoDir));
+        const before = session.vcsStart;
+        const start = {
+            ...before,
+            inputs: {
+                patterns: settings?.patterns ?? [],
+                files: await inputSumsAt(top, made.commit, settings?.patterns ?? []),
+                readOnly: settings?.readOnly ?? true,
+                ...(before.inputs?.carried ? { carried: before.inputs.carried } : {}),
+                recaptured: [...(before.inputs?.recaptured ?? []), { commit: made.commit, branch: made.branch, paths: paths.slice(0, 200), approved: opts.approved }],
+            },
+        };
+        await saveSession((s) => {
+            s.vcsStart = start;
+            // A commit tasks are cut from moves to the inputs' commit; a session branch moved forward itself.
+            if (plan.recapture?.newBranch)
+                s.vcsBaseCommit = made.commit;
+        });
+        bus.publish({
+            sessionId: session.id,
+            type: 'vcs-inputs-recaptured',
+            level: 'info',
+            message: `${paths.length} input file(s) changed or added since the session started are now the commit ${made.commit.slice(0, 8)} on ${made.branch}; the next task starts from it`,
+            data: { commit: made.commit, branch: made.branch, paths: paths.slice(0, 50) },
+        });
+        return { ok: true, start };
+    }
     const plan = await planSnapshot(session, allSessions);
     if (!plan.needed)
         return { ok: false, problem: 'there is nothing uncommitted to take.' };

package/dist/src/vcs/taskVcs.js

@@ -31,6 +31,23 @@ export function trackedRepoOf(session) {
 export async function prepareForTask(session, task, bus, saveSession, 
 /** Every session on record, for `startFrom: previous-session` to find the one before this. */
 allSessions = async () => []) {
+    const prepared = await prepare(session, task, bus, saveSession, allSessions);
+    /*
+     * Version control that is on but cannot do its part refuses the task, whatever the cause — a dirty
+     * tree, a starting branch that is not there, a branch git would not make. It used to be "on but
+     * inactive": the task ran, nothing was committed, and the task still ended done with its work
+     * loose in the tree. A task that cannot be committed is not run.
+     */
+    // Not when the operator chose no commits (`commitOnFinish` false): earlier tasks' files are then
+    // meant to stay in the tree, and refusing would stop every task after the first.
+    if (session.vcs?.enabled && session.vcs.commitOnFinish !== false && !prepared.refuse && !prepared.vcs.branch && prepared.vcs.problem) {
+        const why = `version control is on and cannot work for this task: ${prepared.vcs.problem.replace(/\.?\s*$/, '.')} Nothing was run.`;
+        bus.publish({ sessionId: session.id, taskId: task.id, type: 'vcs-refused', level: 'error', message: why });
+        return { ...prepared, refuse: why };
+    }
+    return prepared;
+}
+async function prepare(session, task, bus, saveSession, allSessions) {
     const settings = session.vcs;
     if (!settings?.enabled)
         return { vcs: {}, note: '' };
@@ -93,15 +110,40 @@ allSessions = async () => []) {
             state = await repoState(dir);
         }
     }
+    /*
+     * Started already, and input files changed or were added since: taken onto the session's line of
+     * work (see `recaptureInputs`), with the operator's approval unless they said otherwise. They used
+     * to be "a dirty tree to commit or stash": version control went off and the task ran without it.
+     */
+    if (base && inputs) {
+        const plan = await planSnapshot(session, allSessions);
+        if (plan.needed && plan.recapture) {
+            if (!plan.ok)
+                return refuse(`the input files changed since the session started cannot be taken: ${plan.problem} Nothing was run.`);
+            if (plan.requireApproval) {
+                return refuse(`input files changed or were added since the session started (${someOf(plan.entries.map((e) => e.path))}). Approve them on the session's page, ` +
+                    'Version control → "Uncommitted changes", and they are committed on its line of work before the next task. Nothing was run.');
+            }
+            const taken = await takeSnapshot(session, { approved: false }, bus, saveSession, allSessions);
+            if (!taken.ok)
+                return refuse(`the changed input files were not taken: ${taken.problem} Nothing was run.`);
+            start = taken.start;
+            if (plan.recapture.newBranch)
+                base = taken.start.inputs?.recaptured?.at(-1)?.commit ?? base;
+            state = await repoState(dir);
+        }
+    }
     // A dirty tree is the operator's own work in progress. Committing it under the bot's name
     // or moving it to another branch would both be decisions that are not ours to make — unless
     // the operator made it, with a snapshot policy, above.
     if (state.dirty) {
         const problem = `the repository has uncommitted changes (${state.changed.slice(0, 5).join(', ')}` +
             `${state.changed.length > 5 ? `, and ${state.changed.length - 5} more` : ''}). ` +
-            'Commit or stash them, so the task starts from a known state.';
+            (base
+                ? 'Commit or stash them, so the task starts from a known state.'
+                : 'Commit or stash them, or choose "Take them as a starting snapshot" under Version control → "Uncommitted changes" (input files: "Input files").');
         bus.publish({ sessionId: session.id, taskId: task.id, type: 'vcs-dirty', level: 'warn',
-            message: `version control is on but inactive: ${problem}` });
+            message: `version control cannot start: ${problem}` });
         return { vcs: { problem }, note: '' };
     }
     if (!base) {
@@ -274,20 +316,63 @@ export async function sessionStart(session, dir, head, allSessions) {
     };
     if (how === 'branch')
         return await fromBranch();
+    /*
+     * The session before this one: the one that ran last in this repository, however it ended — not the
+     * last one that happened to commit, which skipped a predecessor that had failed or committed
+     * nothing and continued from older work as if it were the latest. A session set aside does not count.
+     */
     const here = normalise(dir);
-    let best = null;
+    let pred = null;
     for (const other of await allSessions()) {
-        if (other.id === session.id || !other.vcs?.enabled || normalise(repoDirOf(other)) !== here)
+        if (other.id === session.id || !other.vcs?.enabled || other.active === false || normalise(repoDirOf(other)) !== here)
             continue;
-        const last = lastWorkOf(other);
-        if (last && (!best || last.at > best.at))
-            best = { session: other, ...last };
+        const at = lastActivityOf(other);
+        if (at && (!pred || at > pred.at))
+            pred = { session: other, at };
+    }
+    if (!pred)
+        return await fromBranch(`no earlier session has run in this repository, so it starts from "${baseBranch}"`);
+    const before = pred.session;
+    /*
+     * Checked before anything is carried on: the previous session finished, and what it produced is
+     * there — a final commit on a branch that still exists, or a result that is artifacts only (or no
+     * change at all), which ends where it started. Anything else is refused with what is wrong; it used
+     * to fall back to the base branch with a note, and the chain went on without the work it needed.
+     */
+    const unfinished = before.tasks.filter((t) => t.status !== 'done');
+    if (unfinished.length > 0) {
+        return {
+            problem: `this session continues the previous session in this repository, "${before.name}", which has not finished: ` +
+                `${unfinished.slice(0, 6).map((t) => `"${t.title}" is ${t.status}`).join(', ')}${unfinished.length > 6 ? `, and ${unfinished.length - 6} more` : ''}. ` +
+                'Finish it first (Continue or Run again), or choose another "Start from".',
+        };
+    }
+    const work = lastWorkOf(before);
+    if (!work) {
+        const startedAt = before.vcsBaseCommit;
+        if (!startedAt || !(await git(dir, ['cat-file', '-e', `${startedAt}^{commit}`])).ok) {
+            return { problem: `the previous session "${before.name}" committed nothing, and the commit it started from is not in the repository, so there is nothing to carry on from.` };
+        }
+        const artifactsOnly = before.tasks.some((t) => (t.artifactsKept?.length ?? 0) > 0);
+        return {
+            start: {
+                kind: 'previous-session',
+                commit: startedAt,
+                ...(before.vcsStart?.branch ? { branch: before.vcsStart.branch } : {}),
+                fromSession: { id: before.id, name: before.name },
+                note: artifactsOnly
+                    ? `"${before.name}" committed nothing — its result is artifacts only — so this session starts where it started (${startedAt.slice(0, 8)})`
+                    : `"${before.name}" changed nothing, so this session starts where it started (${startedAt.slice(0, 8)})`,
+            },
+        };
     }
-    if (!best)
-        return await fromBranch(`no earlier session has committed work in this repository, so it starts from "${baseBranch}"`);
+    const best = { session: before, ...work };
     const tip = await branchTip(dir, best.branch);
     if (!tip) {
-        return await fromBranch(`the branch of the previous session "${best.session.name}" (${best.branch}) is no longer in the repository, so it starts from "${baseBranch}"`);
+        return {
+            problem: `the branch of the previous session "${best.session.name}" (${best.branch}) is no longer in the repository, so its final commit cannot be carried on. ` +
+                'Restore the branch, or choose another "Start from".',
+        };
     }
     /*
      * The whole of that session's done work, or nothing. In per-task mode every task has a branch of
@@ -333,6 +418,17 @@ function lastWorkOf(session) {
     }
     return best;
 }
+/** When a session last did anything: the latest start or end of any of its tasks' attempts. */
+function lastActivityOf(session) {
+    let at = null;
+    for (const t of session.tasks) {
+        for (const v of [t.finishedAt, t.startedAt, ...(t.attempts ?? []).flatMap((a) => [a.finishedAt, a.startedAt])]) {
+            if (v && (!at || v > at))
+                at = v;
+        }
+    }
+    return at;
+}
 async function branchTip(dir, branch) {
     if (!(await isValidBranchName(dir, branch)))
         return null;
@@ -617,6 +713,30 @@ export async function commitTaskResult(session, task, outcome, bus) {
         ...(foreign.length > 0 ? { foreignCommits: foreign } : {}),
     });
 }
+/**
+ * Why a task's work is not committed although version control is on and commits it, or undefined
+ * when it is (or there was nothing to commit). Read after `commitTaskResult`; a task that would end
+ * done ends failed with this instead. See `finish` in the runner.
+ */
+export async function commitShortfall(session, before, after, error) {
+    if (!session.vcs?.enabled || !session.vcs.commitOnFinish)
+        return undefined;
+    if (error)
+        return `version control failed after the task, so its work was not committed: ${error}. The changes are left in the working tree.`;
+    if (!after?.branch) {
+        // Never on a branch of its own. The start refuses that now; whatever got through, it is said.
+        const state = await repoState(repoDirOf(session));
+        return state.isRepo && state.dirty
+            ? `version control is on but was not active for this task (${after?.problem ?? before?.problem ?? 'no branch was made'}), so its changes were not committed: ${someOf(state.changed)}. They are left in the working tree.`
+            : undefined;
+    }
+    if (after.problem)
+        return `the runner could not commit the task's work: ${after.problem}`;
+    if (after.afterCommit && !after.afterCommit.clean) {
+        return `after the runner's commit the working tree still has uncommitted changes (${someOf(after.afterCommit.changed)}), so not all of the task's work is on ${after.branch}.`;
+    }
+    return undefined;
+}
 /**
  * Commits what a task left behind when the process running it ended before it could.
  *
@@ -810,7 +930,7 @@ export async function vcsPreflight(session, allSessions = async () => []) {
      * file. Input files are looked for even in a clean tree — an ignored input does not make it dirty.
      */
     const inputs = !!inputSettings(settings);
-    if ((dirty || inputs) && !session.vcsBaseCommit && (dirtyPolicy(settings).policy !== 'reject' || inputs) && settings.startFrom !== 'existing-branch') {
+    if ((dirty || inputs) && (!session.vcsBaseCommit || inputs) && (dirtyPolicy(settings).policy !== 'reject' || inputs) && settings.startFrom !== 'existing-branch') {
         const snapshot = await planSnapshot(session, allSessions);
         if (snapshot.needed) {
             const listed = snapshot.entries.map((e) => e.path);
@@ -818,9 +938,13 @@ export async function vcsPreflight(session, allSessions = async () => []) {
                 ok: false,
                 repoDir,
                 branch: state.branch ?? undefined,
-                problem: snapshot.ok
-                    ? `There are uncommitted changes (${someOf(listed, 3)}). They become the session's starting snapshot ${snapshot.requireApproval ? 'once you approve the list below' : 'when its first task starts'}.`
-                    : `There are uncommitted changes, and no starting snapshot can be taken: ${snapshot.problem}`,
+                problem: snapshot.recapture
+                    ? snapshot.ok
+                        ? `Input files changed or were added since the session started (${someOf(listed, 3)}). They are committed on its line of work ${snapshot.requireApproval ? 'once you approve the list below' : 'when its next task starts'}.`
+                        : `Input files changed since the session started, and they cannot be taken: ${snapshot.problem}`
+                    : snapshot.ok
+                        ? `There are uncommitted changes (${someOf(listed, 3)}). They become the session's starting snapshot ${snapshot.requireApproval ? 'once you approve the list below' : 'when its first task starts'}.`
+                        : `There are uncommitted changes, and no starting snapshot can be taken: ${snapshot.problem}`,
                 snapshot,
             };
         }