cyrus-edge-worker 0.2.49 → 0.2.50

package/dist/EdgeWorker.js

@@ -1,13 +1,14 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { execSync } from "node:child_process";
 import { EventEmitter } from "node:events";
+import { existsSync, readFileSync } from "node:fs";
 import { mkdir, readdir, readFile, writeFile } from "node:fs/promises";
 import { basename, join } from "node:path";
 import { LinearClient } from "@linear/sdk";
-import { ClaudeRunner } from "cyrus-claude-runner";
+import { buildBaseSessionEnv, ClaudeRunner, HttpSessionStore, normalizeMcpHttpTransport, } from "cyrus-claude-runner";
 import { CodexRunner } from "cyrus-codex-runner";
 import { ConfigUpdater } from "cyrus-config-updater";
-import { CLIIssueTrackerService, CLIRPCServer, createLogger, DEFAULT_PROXY_URL, isAgentSessionCreatedWebhook, isAgentSessionPromptedWebhook, isContentUpdateMessage, isIssueAssignedWebhook, isIssueCommentMentionWebhook, isIssueDeletedWebhook, isIssueNewCommentWebhook, isIssueStateChangeMessage, isIssueStateChangeWebhook, isIssueTitleOrDescriptionUpdateWebhook, isIssueUnassignedWebhook, isSessionStartMessage, isStopSignalMessage, isUnassignMessage, isUserPromptMessage, PersistenceManager, requireLinearWorkspaceId, resolvePath, WebhookIpValidator, } from "cyrus-core";
+import { CLIIssueTrackerService, CLIRPCServer, createLogger, DEFAULT_PROXY_URL, isAgentSessionCreatedWebhook, isAgentSessionPromptedWebhook, isContentUpdateMessage, isIssueAssignedWebhook, isIssueCommentMentionWebhook, isIssueDeletedWebhook, isIssueNewCommentWebhook, isIssueStateChangeMessage, isIssueStateChangeWebhook, isIssueStateIdUpdateWebhook, isIssueTitleOrDescriptionUpdateWebhook, isIssueUnassignedWebhook, isSessionStartMessage, isStopSignalMessage, isUnassignMessage, isUserPromptMessage, PersistenceManager, requireLinearWorkspaceId, resolvePath, WebhookIpValidator, } from "cyrus-core";
 import { CursorRunner } from "cyrus-cursor-runner";
 import { GeminiRunner } from "cyrus-gemini-runner";
 import { extractCommentAuthor, extractCommentBody, extractCommentId, extractCommentUrl, extractPRBaseBranchRef, extractPRBranchRef, extractPRNumber, extractPRTitle, extractRepoFullName, extractRepoName, extractRepoOwner, extractSessionKey, GitHubAppTokenProvider, GitHubCommentService, GitHubEventTransport, isCommentOnPullRequest, isIssueCommentPayload, isPullRequestReviewCommentPayload, isPullRequestReviewPayload, stripMention, } from "cyrus-github-event-transport";
@@ -50,6 +51,8 @@ export class EdgeWorker extends EventEmitter {
     agentSessionManager; // Single instance managing all agent sessions across repositories
     activitySinks = new Map(); // Maps Linear workspace ID to activity sink (one per workspace, mirrors issueTrackers)
     sessionRepositories = new Map(); // Maps session ID to repository ID
+    lastStopTimeBySession = new Map(); // Maps session ID to timestamp of last stop signal (for double-stop detection)
+    warmInstances = new Map(); // Pre-warmed Claude sessions keyed by agentSessionId
     issueTrackers = new Map(); // one issue tracker per Linear workspace (keyed by linearWorkspaceId)
     linearEventTransport = null; // Single event transport for webhook delivery
     gitHubEventTransport = null; // GitHub event transport for forwarded GitHub webhooks
@@ -98,18 +101,61 @@ export class EdgeWorker extends EventEmitter {
     sdkSandboxSettings = null;
     /** CA cert path for MITM TLS termination (passed per-session env, not process.env) */
     egressCaCertPath = null;
+    /**
+     * Remote SessionStore that mirrors Claude SDK transcripts to the Cyrus
+     * hosted control plane. Enabled when all three of `CYRUS_APP_URL`,
+     * `CYRUS_API_KEY`, and `CYRUS_TEAM_ID` are set — used by any Claude
+     * runner spawned from this worker so transcripts survive ephemeral
+     * worktrees and are resumable from any host.
+     */
+    claudeSessionStore = null;
     /**
      * Tracks recently processed issue-update webhook keys to prevent
      * duplicate deliveries from Linear's at-least-once delivery.
      * Key format: `${createdAt}:${issueId}`
      */
     processedIssueUpdateKeys = new Set();
+    /**
+     * Sessions parked due to blocked-by dependencies.
+     * Key: Linear issue ID (the blocked issue)
+     * Value: All data needed to replay initializeAgentRunner when unblocked
+     */
+    parkedSessions = new Map();
     constructor(config) {
         super();
         this.config = config;
         this.cyrusHome = config.cyrusHome;
         this.logger = createLogger({ component: "EdgeWorker" });
         this.persistenceManager = new PersistenceManager(join(this.cyrusHome, "state"));
+        // Mirror Claude SDK session transcripts to the hosted control plane
+        // when CYRUS_APP_URL (destination), CYRUS_API_KEY (proof of team
+        // ownership), and CYRUS_TEAM_ID (which team the transcripts belong to)
+        // are all configured. If any is missing the store stays null and the
+        // SDK falls back to local JSONL only. Operators can also opt out
+        // explicitly by setting CYRUS_DISABLE_REMOTE_SESSION_STORE=1, which
+        // keeps transcripts local even when the three vars above are present.
+        const sessionStoreBaseUrl = process.env.CYRUS_APP_URL;
+        const sessionStoreApiKey = process.env.CYRUS_API_KEY;
+        const sessionStoreTeamId = process.env.CYRUS_TEAM_ID;
+        const sessionStoreDisabled = this.isRemoteSessionStoreDisabled();
+        if (!sessionStoreDisabled &&
+            sessionStoreBaseUrl &&
+            sessionStoreApiKey &&
+            sessionStoreTeamId) {
+            this.claudeSessionStore = new HttpSessionStore({
+                baseUrl: sessionStoreBaseUrl,
+                apiKey: sessionStoreApiKey,
+                teamId: sessionStoreTeamId,
+                logger: this.logger,
+            });
+            this.logger.info(`[SessionStore] Mirroring Claude sessions to ${sessionStoreBaseUrl} for team ${sessionStoreTeamId}`);
+        }
+        else if (sessionStoreDisabled &&
+            sessionStoreBaseUrl &&
+            sessionStoreApiKey &&
+            sessionStoreTeamId) {
+            this.logger.info("[SessionStore] Remote session store disabled via CYRUS_DISABLE_REMOTE_SESSION_STORE; transcripts will stay local.");
+        }
         // Initialize GitHub comment service for posting replies to GitHub PRs
         this.gitHubCommentService = new GitHubCommentService();
         // Initialize GitLab comment service for posting replies to GitLab MRs
@@ -270,6 +316,14 @@ export class EdgeWorker extends EventEmitter {
         await this.skillsPluginResolver.ensureUserPluginScaffolded();
         // Load persisted state for each repository
         await this.loadPersistedState();
+        // Pre-warm the 30 most recent Claude sessions in the background
+        // so their first query after restart has near-zero cold-start latency.
+        // Disabled by default; opt in with CYRUS_ENABLE_WARM_SESSIONS=1.
+        if (this.isWarmSessionsEnabled()) {
+            this.warmupRecentSessions(30).catch((err) => {
+                this.logger.warn("Session warmup failed (non-fatal):", err);
+            });
+        }
         // Start config file watcher via ConfigManager
         this.configManager.on("configChanged", async (changes) => {
             this.updateLinearWorkspaceTokens(changes.newConfig);
@@ -327,7 +381,19 @@ export class EdgeWorker extends EventEmitter {
     async initializeComponents() {
         // 1. Platform-specific initialization
         if (this.config.platform === "cli") {
-            // CLI mode: find any available CLIIssueTrackerService
+            // CLI mode: ensure a CLIIssueTrackerService exists for each repo workspace.
+            // Repos from config.repositories don't go through linearWorkspaces init,
+            // so we create trackers here if missing.
+            for (const [repoId, repo] of this.repositories) {
+                const wsId = repo.linearWorkspaceId;
+                if (wsId && !this.issueTrackers.has(wsId)) {
+                    const service = new CLIIssueTrackerService();
+                    service.seedDefaultData();
+                    this.issueTrackers.set(wsId, service);
+                    const activitySink = new LinearActivitySink(service, wsId);
+                    this.activitySinks.set(repoId, activitySink);
+                }
+            }
             const firstCliTracker = Array.from(this.issueTrackers.values()).find((tracker) => tracker instanceof CLIIssueTrackerService);
             if (firstCliTracker) {
                 this.cliRPCServer = new CLIRPCServer({
@@ -388,7 +454,7 @@ export class EdgeWorker extends EventEmitter {
             this.linearEventTransport.on("error", (error) => {
                 this.handleError(error);
             });
-            // Register the /webhook endpoint
+            // Register the /linear-webhook endpoint (with /webhook retained as a deprecated alias)
             this.linearEventTransport.register();
             this.logger.info(`✅ Linear event transport registered (${verificationMode} mode)`);
             this.logger.info(`   Webhook endpoint: ${this.sharedApplicationServer.getWebhookUrl()}`);
@@ -468,6 +534,13 @@ export class EdgeWorker extends EventEmitter {
         });
         // Listen for legacy GitHub webhook events (deprecated, kept for backward compatibility)
         this.gitHubEventTransport.on("event", (event) => {
+            // Route push events to the base branch notification handler
+            if (event.eventType === "push") {
+                this.handleGitHubPushWebhook(event.payload).catch((error) => {
+                    this.logger.error("Failed to handle GitHub push webhook", error instanceof Error ? error : new Error(String(error)));
+                });
+                return;
+            }
             this.handleGitHubWebhook(event).catch((error) => {
                 this.logger.error("Failed to handle GitHub webhook", error instanceof Error ? error : new Error(String(error)));
             });
@@ -834,6 +907,68 @@ export class EdgeWorker extends EventEmitter {
             this.activeWebhookCount--;
         }
     }
+    /**
+     * Handle GitHub push webhook events.
+     * When a base branch receives new commits, find active sessions tracking that
+     * branch and stream a rebase notification to the running agent.
+     */
+    async handleGitHubPushWebhook(payload) {
+        // Only handle branch pushes (refs/heads/*), not tags
+        if (!payload.ref.startsWith("refs/heads/")) {
+            return;
+        }
+        // Ignore branch deletions
+        if (payload.deleted) {
+            return;
+        }
+        const branchName = payload.ref.replace("refs/heads/", "");
+        const repoFullName = payload.repository.full_name;
+        // Find the matching repository config
+        const repository = this.findRepositoryByGitHubUrl(repoFullName);
+        if (!repository) {
+            this.logger.debug(`No repository configured for GitHub push from ${repoFullName}`);
+            return;
+        }
+        // Find active sessions tracking this branch as their base branch
+        const sessions = this.agentSessionManager.getSessionsByBaseBranch(branchName, repository.id);
+        if (sessions.length === 0) {
+            this.logger.debug(`No active sessions tracking base branch ${branchName} for ${repository.name}`);
+            return;
+        }
+        // Build a notification prompt with commit summary
+        const commitCount = payload.commits.length;
+        const commitSummary = payload.commits
+            .slice(0, 5)
+            .map((c) => `- ${c.message.split("\n")[0]}`)
+            .join("\n");
+        const moreCommits = commitCount > 5 ? `\n- ... and ${commitCount - 5} more` : "";
+        const notification = `<base_branch_update>
+<branch>${branchName}</branch>
+<repository>${repoFullName}</repository>
+<commit_count>${commitCount}</commit_count>
+<compare_url>${payload.compare}</compare_url>
+<commits>
+${commitSummary}${moreCommits}
+</commits>
+<guidance>
+Your base branch \`${branchName}\` has received ${commitCount} new commit(s). Consider rebasing your working branch onto the updated base to avoid merge conflicts. You can do this with: \`git fetch origin && git rebase origin/${branchName}\`
+</guidance>
+</base_branch_update>`;
+        this.logger.info(`Base branch ${branchName} updated (${commitCount} commits) — notifying ${sessions.length} active session(s)`);
+        // Stream notification to the first running session that supports streaming
+        const sortedSessions = [...sessions].sort((a, b) => (b.updatedAt ?? 0) - (a.updatedAt ?? 0));
+        for (const session of sortedSessions) {
+            const existingRunner = session.agentRunner;
+            const isRunning = existingRunner?.isRunning() || false;
+            if (isRunning &&
+                existingRunner?.supportsStreamingInput &&
+                existingRunner.addStreamMessage) {
+                existingRunner.addStreamMessage(notification);
+                this.logger.debug(`[base-branch-update] Streamed notification to session ${session.id} for branch ${branchName}`);
+                break;
+            }
+        }
+    }
     /**
      * Find a repository configuration that matches a GitHub repository URL.
      * Matches against the githubUrl field in repository config.
@@ -1869,6 +2004,14 @@ ${taskSection}`;
     async handleWebhook(webhook, repos) {
         // Track active webhook processing for status endpoint
         this.activeWebhookCount++;
+        const webhookAction = webhook.action;
+        const webhookType = webhook.type;
+        this.logger.event("webhook_received", {
+            source: "linear",
+            action: webhookAction,
+            type: webhookType,
+            repoCount: repos.length,
+        });
         // Log verbose webhook info if enabled
         if (process.env.CYRUS_WEBHOOK_DEBUG === "true") {
             this.logger.debug(`Full webhook payload:`, JSON.stringify(webhook, null, 2));
@@ -1909,6 +2052,10 @@ ${taskSection}`;
                 // Handle issue title/description/attachments updates - feed changes into active session
                 await this.handleIssueContentUpdate(webhook);
             }
+            else if (isIssueStateIdUpdateWebhook(webhook)) {
+                // Handle issue state changes — wake up parked sessions when blocking issues complete
+                await this.handleIssueStateChange(webhook);
+            }
             else {
                 if (process.env.CYRUS_WEBHOOK_DEBUG === "true") {
                     this.logger.debug(`Unhandled webhook type: ${webhook.action}`);
@@ -2268,6 +2415,173 @@ ${taskSection}`;
      * and includes guidance for the agent to evaluate whether these changes affect
      * its current implementation or action plan.
      */
+    /**
+     * Check if an issue has unresolved blocked-by dependencies.
+     * Fetches the issue from Linear and checks its inverse relations for blocking issues
+     * that haven't been completed or canceled.
+     */
+    async checkBlockedByDependencies(agentSession, linearWorkspaceId) {
+        const issue = agentSession.issue;
+        if (!issue) {
+            return { blocked: false, blockingIssueIds: [], blockingIdentifiers: [] };
+        }
+        try {
+            const fullIssue = await this.fetchFullIssueDetails(issue.id, linearWorkspaceId);
+            if (!fullIssue) {
+                return {
+                    blocked: false,
+                    blockingIssueIds: [],
+                    blockingIdentifiers: [],
+                };
+            }
+            const blockingIssues = await this.promptBuilder.fetchBlockingIssues(fullIssue);
+            if (blockingIssues.length === 0) {
+                return {
+                    blocked: false,
+                    blockingIssueIds: [],
+                    blockingIdentifiers: [],
+                };
+            }
+            // Filter to only unresolved blockers (not completed or canceled)
+            const unresolvedBlockers = [];
+            for (const blocker of blockingIssues) {
+                try {
+                    const state = await blocker.state;
+                    if (state &&
+                        state.type !== "completed" &&
+                        state.type !== "canceled") {
+                        unresolvedBlockers.push({
+                            id: blocker.id,
+                            identifier: blocker.identifier,
+                        });
+                    }
+                }
+                catch {
+                    // If we can't resolve the state, assume it's unresolved
+                    unresolvedBlockers.push({
+                        id: blocker.id,
+                        identifier: blocker.identifier,
+                    });
+                }
+            }
+            if (unresolvedBlockers.length === 0) {
+                return {
+                    blocked: false,
+                    blockingIssueIds: [],
+                    blockingIdentifiers: [],
+                };
+            }
+            return {
+                blocked: true,
+                blockingIssueIds: unresolvedBlockers.map((b) => b.id),
+                blockingIdentifiers: unresolvedBlockers.map((b) => b.identifier),
+            };
+        }
+        catch (error) {
+            this.logger.error(`Failed to check blocked-by dependencies for ${issue.identifier}:`, error);
+            // On error, don't block — proceed with normal flow
+            return { blocked: false, blockingIssueIds: [], blockingIdentifiers: [] };
+        }
+    }
+    /**
+     * Handle issue state change webhooks.
+     * When a blocking issue is completed, wake up any parked sessions that were waiting on it.
+     */
+    async handleIssueStateChange(webhook) {
+        const issueData = webhook.data;
+        const completedIssueId = issueData.id;
+        const issueIdentifier = issueData.identifier;
+        // Only care about transitions TO completed or canceled states
+        // The IssueWebhookPayload has a stateId field — resolve the state
+        // via the issue tracker to check if it's a completion state
+        const stateId = issueData.stateId;
+        if (!stateId) {
+            return;
+        }
+        // Find workspace for this webhook to resolve state type
+        const linearWorkspaceId = webhook.organizationId;
+        const issueTracker = this.issueTrackers.get(linearWorkspaceId);
+        if (!issueTracker) {
+            return;
+        }
+        // Fetch the issue to check its current state type
+        let stateType;
+        try {
+            const fullIssue = await issueTracker.fetchIssue(completedIssueId);
+            const state = await fullIssue.state;
+            stateType = state?.type;
+        }
+        catch {
+            // Can't resolve state — skip
+            return;
+        }
+        if (stateType !== "completed" && stateType !== "canceled") {
+            return;
+        }
+        this.logger.debug(`Issue ${issueIdentifier} moved to ${stateType} — checking for parked sessions to wake`);
+        // Find parked sessions that were blocked by this issue
+        const sessionsToWake = [];
+        for (const [blockedIssueId, parked] of this.parkedSessions.entries()) {
+            if (parked.blockingIssueIds.includes(completedIssueId)) {
+                // Remove this blocker from the list
+                parked.blockingIssueIds = parked.blockingIssueIds.filter((id) => id !== completedIssueId);
+                // If no more blockers, wake the session
+                if (parked.blockingIssueIds.length === 0) {
+                    sessionsToWake.push(blockedIssueId);
+                }
+                else {
+                    this.logger.debug(`Parked session for issue ${blockedIssueId} still has ${parked.blockingIssueIds.length} remaining blocker(s)`);
+                }
+            }
+        }
+        // Wake up unblocked sessions
+        for (const blockedIssueId of sessionsToWake) {
+            const parked = this.parkedSessions.get(blockedIssueId);
+            if (!parked)
+                continue;
+            this.parkedSessions.delete(blockedIssueId);
+            this.logger.info(`Waking parked session for issue ${parked.agentSession.issue?.identifier} — all blockers resolved`);
+            // Post activity about waking up
+            await this.activityPoster.postThoughtActivity(parked.agentSession.id, parked.linearWorkspaceId, `All blocking dependencies are now resolved — starting work.`);
+            // Replay the normal initializeAgentRunner flow
+            try {
+                await this.initializeAgentRunner(parked.agentSession, parked.repositories, parked.linearWorkspaceId, parked.guidance, parked.commentBody, parked.baseBranchOverrides, parked.routingMethod);
+            }
+            catch (error) {
+                this.logger.error(`Failed to wake parked session for issue ${blockedIssueId}:`, error);
+            }
+        }
+    }
+    /**
+     * Handle a user re-prompt on a parked (blocked-by) session.
+     * Re-checks blocking status: if clear, wakes the session; if still blocked, re-posts status.
+     */
+    async handleParkedSessionReprompt(_webhook, issueId) {
+        const parked = this.parkedSessions.get(issueId);
+        if (!parked)
+            return;
+        const blockResult = await this.checkBlockedByDependencies(parked.agentSession, parked.linearWorkspaceId);
+        if (blockResult.blocked) {
+            // Still blocked — update the parked entry and re-post status
+            parked.blockingIssueIds = blockResult.blockingIssueIds;
+            const blockerList = blockResult.blockingIdentifiers
+                .map((id) => `**${id}**`)
+                .join(", ");
+            await this.activityPoster.postThoughtActivity(parked.agentSession.id, parked.linearWorkspaceId, `Still blocked by ${blockerList}. Will start automatically when resolved.`);
+            this.logger.info(`Re-prompt on parked session for ${parked.agentSession.issue?.identifier}: still blocked by ${blockResult.blockingIdentifiers.join(", ")}`);
+            return;
+        }
+        // Blockers resolved — wake the session
+        this.parkedSessions.delete(issueId);
+        this.logger.info(`Re-prompt cleared blockers for ${parked.agentSession.issue?.identifier} — waking session`);
+        await this.activityPoster.postThoughtActivity(parked.agentSession.id, parked.linearWorkspaceId, `Blocking dependencies are now resolved — starting work.`);
+        try {
+            await this.initializeAgentRunner(parked.agentSession, parked.repositories, parked.linearWorkspaceId, parked.guidance, parked.commentBody, parked.baseBranchOverrides, parked.routingMethod);
+        }
+        catch (error) {
+            this.logger.error(`Failed to wake parked session for issue ${issueId} on re-prompt:`, error);
+        }
+    }
     buildIssueUpdatePrompt(issueIdentifier, issueData, updatedFrom) {
         return this.promptBuilder.buildIssueUpdatePrompt(issueIdentifier, issueData, updatedFrom);
     }
@@ -2292,8 +2606,7 @@ ${taskSection}`;
     getLinearTokenForWorkspace(linearWorkspaceId) {
         const workspaceConfig = this.config.linearWorkspaces?.[linearWorkspaceId];
         if (!workspaceConfig) {
-            throw new Error(`No Linear workspace config found for workspace ${linearWorkspaceId}. ` +
-                `Ensure linearWorkspaces.${linearWorkspaceId} is configured.`);
+            return null; // CLI platform or unconfigured workspace
         }
         return workspaceConfig.linearToken;
     }
@@ -2484,6 +2797,29 @@ ${taskSection}`;
         log.info(`Handling agent session created`);
         const { agentSession, guidance } = webhook;
         const commentBody = agentSession.comment?.body;
+        // Check for blocked-by dependencies before starting work
+        const blockResult = await this.checkBlockedByDependencies(agentSession, linearWorkspaceId);
+        if (blockResult.blocked) {
+            // Park the session — don't create worktree or runner
+            const parkedIssueId = agentSession.issue.id;
+            this.parkedSessions.set(parkedIssueId, {
+                agentSession,
+                repositories,
+                linearWorkspaceId,
+                guidance,
+                commentBody,
+                baseBranchOverrides,
+                routingMethod,
+                blockingIssueIds: blockResult.blockingIssueIds,
+            });
+            // Post acknowledgment to the Linear agent session
+            const blockerList = blockResult.blockingIdentifiers
+                .map((id) => `**${id}**`)
+                .join(", ");
+            await this.activityPoster.postThoughtActivity(agentSession.id, linearWorkspaceId, `Blocked by ${blockerList} — will start automatically when ${blockResult.blockingIdentifiers.length === 1 ? "it is" : "they are"} resolved.`);
+            log.info(`Session parked: issue ${agentSession.issue.identifier} is blocked by ${blockResult.blockingIdentifiers.join(", ")}`);
+            return;
+        }
         // Initialize agent runner using shared logic (pass full repositories array)
         await this.initializeAgentRunner(agentSession, repositories, linearWorkspaceId, guidance, commentBody, baseBranchOverrides, routingMethod);
     }
@@ -2656,17 +2992,39 @@ ${taskSection}`;
             await this.agentSessionManager.createResponseActivity(agentSessionId, `Stop signal received for ${issueTitle}. No active session was found (the session may have ended or the system was restarted). No further action is needed.`);
             return;
         }
-        // Stop the existing runner if it's active
+        // Double-stop detection: two stop signals within 10s → full abort
+        const now = Date.now();
+        const lastStop = this.lastStopTimeBySession.get(agentSessionId);
+        const isDoubleStop = lastStop !== undefined && now - lastStop < 10_000;
+        this.lastStopTimeBySession.set(agentSessionId, now);
         const existingRunner = foundSession.agentRunner;
-        this.agentSessionManager.requestSessionStop(agentSessionId);
-        if (existingRunner) {
-            existingRunner.stop();
-            log.info(`Stopped agent session for agent activity session ${agentSessionId}`);
-        }
-        // Post confirmation
         const issueTitle = issue?.title || "this issue";
-        const stopConfirmation = `I've stopped working on ${issueTitle} as requested.\n\n**Stop Signal:** Received from ${webhook.agentSession.creator?.name || "user"}\n**Action Taken:** All ongoing work has been halted`;
-        await this.agentSessionManager.createResponseActivity(agentSessionId, stopConfirmation);
+        const senderName = webhook.agentSession.creator?.name || "user";
+        // Only warm sessions can be safely interrupted without killing the
+        // underlying request. Non-warm sessions get a single-shot full stop —
+        // calling interrupt() on them surfaces a "Request was aborted" error
+        // from the SDK (see CYPACK-1145).
+        const supportsInterrupt = Boolean(existingRunner?.interrupt && existingRunner?.isWarm?.());
+        if (isDoubleStop || !supportsInterrupt) {
+            // Either a second stop within window, or a non-warm runner — full kill
+            this.agentSessionManager.requestSessionStop(agentSessionId);
+            if (existingRunner) {
+                existingRunner.stop();
+                log.info(isDoubleStop
+                    ? `Double-stop: fully aborted session ${agentSessionId}`
+                    : `Stopped session ${agentSessionId} (interrupt not supported)`);
+            }
+            this.lastStopTimeBySession.delete(agentSessionId);
+            await this.agentSessionManager.createResponseActivity(agentSessionId, isDoubleStop
+                ? `I've fully stopped working on ${issueTitle}.\n\n**Stop Signal:** Received from ${senderName} (second stop)\n**Action Taken:** Session terminated`
+                : `I've stopped working on ${issueTitle}.\n\n**Stop Signal:** Received from ${senderName}\n**Action Taken:** Session terminated`);
+        }
+        else {
+            // First stop on a warm session — interrupt current turn, keep session warm
+            await existingRunner.interrupt();
+            log.info(`Interrupted current turn for session ${agentSessionId} (send stop again within 10s to fully terminate)`);
+            await this.agentSessionManager.createResponseActivity(agentSessionId, `Interrupted by ${senderName}\n**Tip:** Type and send "stop" within 10 seconds to fully terminate the session.`);
+        }
     }
     /**
      * Handle repository selection response from prompted webhook
@@ -2883,6 +3241,15 @@ ${taskSection}`;
             await this.handleStopSignal(webhook);
             return;
         }
+        // Branch 1.5: Handle re-prompt for parked (blocked-by) sessions
+        // When a user re-prompts and the session is parked, re-check blocking status.
+        // If blockers are resolved, wake the session immediately.
+        const issueIdForParkedCheck = webhook.agentSession?.issue?.id;
+        if (issueIdForParkedCheck &&
+            this.parkedSessions.has(issueIdForParkedCheck)) {
+            await this.handleParkedSessionReprompt(webhook, issueIdForParkedCheck);
+            return;
+        }
         // Branch 2: Handle repository selection response
         // This is the first Claude runner initialization after user selects a repository.
         // The selection handler extracts the choice from the response (or uses fallback)
@@ -3027,8 +3394,14 @@ ${taskSection}`;
      */
     createRunnerForType(runnerType, config) {
         switch (runnerType) {
-            case "claude":
-                return new ClaudeRunner(config);
+            case "claude": {
+                // Inject the hosted SessionStore at the last moment so it only
+                // attaches to Claude runners (the field is Claude-specific).
+                const claudeConfig = this.claudeSessionStore
+                    ? { ...config, sessionStore: this.claudeSessionStore }
+                    : config;
+                return new ClaudeRunner(claudeConfig, this.isWarmSessionsEnabled());
+            }
             case "gemini":
                 return new GeminiRunner(config);
             case "codex":
@@ -3637,7 +4010,7 @@ ${input.userComment}
             platform: session.issueContext?.trackerId,
             issueIdentifier: session.issueContext?.issueIdentifier,
         });
-        return this.runnerConfigBuilder.buildIssueConfig({
+        const result = this.runnerConfigBuilder.buildIssueConfig({
             session,
             repository,
             sessionId,
@@ -3663,6 +4036,17 @@ ${input.userComment}
             createAskUserQuestionCallback: (sid, wid) => this.createAskUserQuestionCallback(sid, wid),
             requireLinearWorkspaceId,
         });
+        // Attach pre-warmed session if available (only for Claude runner).
+        // Skipped entirely when warm sessions are not enabled.
+        if (result.runnerType === "claude" && this.isWarmSessionsEnabled()) {
+            const warmSession = this.warmInstances.get(sessionId);
+            if (warmSession) {
+                this.warmInstances.delete(sessionId);
+                result.config.warmSession = warmSession;
+                log.debug("Attaching pre-warmed session to runner config");
+            }
+        }
+        return result;
     }
     /**
      * Create an onAskUserQuestion callback for the ClaudeRunner.
@@ -3770,6 +4154,126 @@ ${input.userComment}
             this.logger.error(`Failed to load persisted EdgeWorker state:`, error);
         }
     }
+    /**
+     * Whether the warm-session feature is enabled.
+     *
+     * Warm sessions are an opt-in optimization that pre-spawns Claude Code
+     * subprocesses on startup so the first query after a restart skips the
+     * cold-start cost. Disabled by default; opt in by setting
+     * `CYRUS_ENABLE_WARM_SESSIONS=1` (or `=true`).
+     */
+    isWarmSessionsEnabled() {
+        const raw = process.env.CYRUS_ENABLE_WARM_SESSIONS;
+        if (!raw)
+            return false;
+        const v = raw.toLowerCase().trim();
+        return v === "1" || v === "true";
+    }
+    /**
+     * Whether the remote Claude session store is explicitly disabled.
+     *
+     * The remote store mirrors SDK transcripts to the Cyrus hosted control
+     * plane and is on by default whenever `CYRUS_APP_URL`, `CYRUS_API_KEY`,
+     * and `CYRUS_TEAM_ID` are all set. Operators can opt out — without
+     * unsetting those vars (which other features depend on) — by setting
+     * `CYRUS_DISABLE_REMOTE_SESSION_STORE=1` (or `=true`).
+     */
+    isRemoteSessionStoreDisabled() {
+        const raw = process.env.CYRUS_DISABLE_REMOTE_SESSION_STORE;
+        if (!raw)
+            return false;
+        const v = raw.toLowerCase().trim();
+        return v === "1" || v === "true";
+    }
+    /**
+     * Pre-warm the N most recently updated Claude sessions so the first query
+     * after a CLI restart has near-zero cold-start latency (~20x faster).
+     *
+     * Uses startup() from @anthropic-ai/claude-agent-sdk with MCP_CONNECTION_NONBLOCKING=true
+     * so the warm instances are ready in ~500ms rather than ~4s.
+     * Warm instances are stored in this.warmInstances keyed by agentSessionId and
+     * consumed by buildAgentRunnerConfig() when the first message arrives.
+     *
+     * Gated by `isWarmSessionsEnabled()` — callers should check before invoking.
+     */
+    async warmupRecentSessions(count = 30) {
+        const allSessions = this.agentSessionManager.getAllSessions();
+        // Only warm Claude sessions that have a persisted session ID and a workspace path
+        const candidates = allSessions
+            .filter((s) => s.claudeSessionId && s.workspace?.path)
+            .sort((a, b) => (b.updatedAt ?? 0) - (a.updatedAt ?? 0))
+            .slice(0, count);
+        if (candidates.length === 0) {
+            this.logger.debug("No Claude sessions to pre-warm");
+            return;
+        }
+        this.logger.info(`Pre-warming ${candidates.length} most recent Claude sessions...`);
+        const { startup } = await import("@anthropic-ai/claude-agent-sdk");
+        await Promise.all(candidates.map(async (session) => {
+            try {
+                const repoId = this.sessionRepositories.get(session.id);
+                const repo = repoId ? this.repositories.get(repoId) : undefined;
+                if (!repo) {
+                    this.logger.debug(`No repo for session ${session.id}, skipping warmup`);
+                    return;
+                }
+                // Build MCP config for this session (same as the live runner would use)
+                const linearWorkspaceId = requireLinearWorkspaceId(repo);
+                const mcpConfig = this.mcpConfigService.buildMcpConfig(repo.id, linearWorkspaceId, session.id);
+                // Merge any file-based MCP configs (reuses shared normalization)
+                const mcpConfigPath = this.mcpConfigService.buildMergedMcpConfigPath(repo);
+                let mcpServers = { ...mcpConfig };
+                if (mcpConfigPath) {
+                    const paths = Array.isArray(mcpConfigPath)
+                        ? mcpConfigPath
+                        : [mcpConfigPath];
+                    for (const filePath of paths) {
+                        try {
+                            if (existsSync(filePath)) {
+                                const fileContent = JSON.parse(readFileSync(filePath, "utf8"));
+                                const servers = fileContent.mcpServers || {};
+                                normalizeMcpHttpTransport(servers);
+                                mcpServers = { ...mcpServers, ...servers };
+                            }
+                        }
+                        catch {
+                            // Ignore unreadable MCP config files
+                        }
+                    }
+                }
+                const repoConfig = repo;
+                const model = session.metadata?.model ||
+                    repoConfig.claudeDefaultModel ||
+                    repoConfig.model ||
+                    "claude-opus-4-6";
+                // Build allowed/disallowed tools — same as what buildAgentRunnerConfig() uses.
+                // Without these, startup() inherits the user's defaultMode ("default"),
+                // which causes macOS permission prompts for file writes.
+                const allowedTools = this.buildAllowedTools(repo);
+                const disallowedTools = this.buildDisallowedTools(repo);
+                const warm = await startup({
+                    options: {
+                        resume: session.claudeSessionId,
+                        model,
+                        cwd: session.workspace.path,
+                        ...(Object.keys(mcpServers).length > 0 && { mcpServers }),
+                        ...(allowedTools.length > 0 && { allowedTools }),
+                        ...(disallowedTools.length > 0 && { disallowedTools }),
+                        settingSources: ["user", "project", "local"],
+                        // CLAUDE_CODE_SUBPROCESS_ENV_SCRUB is intentionally not set here;
+                        // see CYPACK-1108 and ClaudeRunner.start() for context.
+                        env: buildBaseSessionEnv(),
+                    },
+                });
+                this.warmInstances.set(session.id, warm);
+                this.logger.info(`Pre-warmed session ${session.id} (${session.issueContext?.issueIdentifier ?? "unknown"})`);
+            }
+            catch (err) {
+                this.logger.debug(`Failed to pre-warm session ${session.id}:`, err);
+            }
+        }));
+        this.logger.info(`Session pre-warm complete: ${this.warmInstances.size} sessions ready`);
+    }
     /**
      * Save current EdgeWorker state for all repositories
      */