ci(deps): bump actions/first-interaction from 1 to 3

Bumps [actions/first-interaction](https://github.com/actions/first-interaction) from 1 to 3. - [Release notes](https://github.com/actions/first-interaction/releases) - [Commits](https://github.com/actions/first-interaction/compare/v1...v3) --- updated-dependencies: - dependency-name: actions/first-interaction dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Improved prompt for Opus 4.6
2026-02-26 18:26:24 +00:00 · 2026-02-21 21:34:08 +01:00 · 2026-02-20 12:47:00 +01:00 · 2026-02-20 12:00:10 +01:00 · 2026-02-20 12:00:02 +01:00 · 2026-02-20 11:59:55 +01:00
262 changed files with 35782 additions and 4231 deletions
@@ -3,6 +3,7 @@ name: Discord Release Notification
 on:
  release:
    types: [published]
+  workflow_dispatch:

 jobs:
  discord-notification:
@@ -620,7 +620,7 @@ jobs:
          draft: false
          prerelease: ${{ contains(github.ref, 'beta') || contains(github.ref, 'alpha') }}
        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.PAT_TOKEN || secrets.GITHUB_TOKEN }}

  # Update README with new version after successful release
  update-readme:
@@ -13,7 +13,7 @@ jobs:
      issues: write
      pull-requests: write
    steps:
-      - uses: actions/first-interaction@v1
+      - uses: actions/first-interaction@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          issue-message: |
@@ -127,6 +127,13 @@ fi
 if git diff --cached --name-only | grep -q "^apps/backend/.*\.py$"; then
  echo "Python changes detected, running backend checks..."

+  # Detect if we're in a worktree
+  IS_WORKTREE=false
+  if [ -f ".git" ]; then
+    # .git is a file (not directory) in worktrees
+    IS_WORKTREE=true
+  fi
+
  # Determine ruff command (venv or global)
  RUFF=""
  if [ -f "apps/backend/.venv/bin/ruff" ]; then
@@ -158,7 +165,16 @@ if git diff --cached --name-only | grep -q "^apps/backend/.*\.py$"; then
      echo "$STAGED_PY_FILES" | xargs git add
    fi
  else
-    echo "Warning: ruff not found, skipping Python linting. Install with: uv pip install ruff"
+    if [ "$IS_WORKTREE" = true ]; then
+      echo ""
+      echo "⚠️  WARNING: ruff not available in this worktree."
+      echo "   Python linting checks will be skipped."
+      echo "   This is expected for auto-claude worktrees."
+      echo "   Full validation will occur when PR is created/merged."
+      echo ""
+    else
+      echo "Warning: ruff not found, skipping Python linting. Install with: uv pip install ruff"
+    fi
  fi

  # Run pytest (skip slow/integration tests and Windows-incompatible tests for pre-commit speed)
@@ -192,17 +208,28 @@ if git diff --cached --name-only | grep -q "^apps/backend/.*\.py$"; then
    elif [ -d "apps/backend/.venv" ]; then
      echo "Warning: venv exists but Python not found in it, using system Python"
      PYTHONPATH=apps/backend python -m pytest tests/ -v --tb=short -x -m "not slow and not integration" -k "not windows_path" $IGNORE_TESTS
+    elif [ "$IS_WORKTREE" = true ]; then
+      echo ""
+      echo "⚠️  WARNING: Python venv not available in this worktree."
+      echo "   Python tests will be skipped."
+      echo "   This is expected for auto-claude worktrees."
+      echo "   Full validation will occur when PR is created/merged."
+      echo ""
+      exit 77  # GNU convention for 'test skipped' (avoids pytest exit-code collision)
    else
      echo "Warning: No .venv found in apps/backend, using system Python"
      PYTHONPATH=apps/backend python -m pytest tests/ -v --tb=short -x -m "not slow and not integration" -k "not windows_path" $IGNORE_TESTS
    fi
  )
-  if [ $? -ne 0 ]; then
+  PYTHON_EXIT=$?
+  if [ $PYTHON_EXIT -eq 77 ]; then
+    echo "Backend checks passed! (Python tests skipped — worktree)"
+  elif [ $PYTHON_EXIT -ne 0 ]; then
    echo "Python tests failed. Please fix failing tests before committing."
    exit 1
+  else
+    echo "Backend checks passed!"
  fi
-
-  echo "Backend checks passed!"
 fi

 # =============================================================================
@@ -97,9 +97,8 @@ repos:
      - id: ruff-format
        files: ^apps/backend/

-  # Python tests (apps/backend/) - skip slow/integration tests for pre-commit speed
+  # Python tests (apps/backend/) - run full test suite from project root
  # Tests to skip: graphiti (external deps), merge_file_tracker/service_orchestrator/worktree/workspace (Windows path/git issues)
-  # NOTE: Skip this hook in worktrees (where .git is a file, not a directory)
  - repo: local
    hooks:
      - id: pytest
@@ -108,31 +107,24 @@ repos:
        args:
          - -c
          - |
-            # Skip in worktrees - .git is a file pointing to main repo, not a directory
-            # This prevents path resolution issues with ../../tests/ in worktree context
-            if [ -f ".git" ]; then
-              echo "Skipping pytest in worktree (path resolution would fail)"
-              exit 0
-            fi
-            cd apps/backend
-            if [ -f ".venv/bin/pytest" ]; then
-              PYTEST_CMD=".venv/bin/pytest"
-            elif [ -f ".venv/Scripts/pytest.exe" ]; then
-              PYTEST_CMD=".venv/Scripts/pytest.exe"
+            # Run pytest directly from project root
+            if [ -f "apps/backend/.venv/bin/pytest" ]; then
+              PYTEST_CMD="apps/backend/.venv/bin/pytest"
+            elif [ -f "apps/backend/.venv/Scripts/pytest.exe" ]; then
+              PYTEST_CMD="apps/backend/.venv/Scripts/pytest.exe"
            else
              PYTEST_CMD="python -m pytest"
            fi
-            PYTHONPATH=. $PYTEST_CMD \
-              ../../tests/ \
+            $PYTEST_CMD tests/ \
              -v \
              --tb=short \
              -x \
              -m "not slow and not integration" \
-              --ignore=../../tests/test_graphiti.py \
-              --ignore=../../tests/test_merge_file_tracker.py \
-              --ignore=../../tests/test_service_orchestrator.py \
-              --ignore=../../tests/test_worktree.py \
-              --ignore=../../tests/test_workspace.py
+              --ignore=tests/test_graphiti.py \
+              --ignore=tests/test_merge_file_tracker.py \
+              --ignore=tests/test_service_orchestrator.py \
+              --ignore=tests/test_worktree.py \
+              --ignore=tests/test_workspace.py
        language: system
        files: ^(apps/backend/.*\.py$|tests/.*\.py$)
        pass_filenames: false
@@ -1,3 +1,234 @@
+## 2.7.6 - Stability & Feature Enhancements
+
+### ✨ New Features
+
+- **Multi-profile account management** — Unified profile swapping with automatic token refresh and rate limit recovery for both OAuth and API-compatible providers
+
+- **Enhanced terminal experience** — Customizable terminal fonts with OS-specific defaults, Claude Code CLI settings injection, and improved worktree integration
+
+- **Advanced roadmap management** — Expand/collapse functionality for phase features and real-time sync with task lifecycle
+
+- **Queue System v2** — Smart task prioritization with auto-promotion and intelligent rate limit recovery
+
+- **GitHub integration enhancements** — AI-powered PR template generation, user-friendly API error handling, and improved review visibility
+
+- **UI/UX improvements** — Spell check support for text inputs, collapsible sidebar toggle, task screenshot capture, expandable task descriptions, and bulk worktree operations
+
+- **Evidence-based PR validation** — Advanced review system with trigger-driven exploration and enhanced recovery mechanisms
+
+### 🛠️ Improvements
+
+- **Performance optimizations** — Async parallel worktree listing prevents UI freezes and improves responsiveness
+
+- **Robustness enhancements** — Atomic file writes, better error detection in AI responses, and improved OOM/orphaned agent management for overnight builds
+
+- **Terminal stability** — Fixed GPU context exhaustion from large pastes, SIGABRT crashes on macOS shutdown, and session restoration on app restart
+
+- **Build & packaging** — XState bundling for packaged apps, aligned Linux package builds, and improved auto-updater for beta releases and DMG installations
+
+- **Diagnostic improvements** — Sentry instrumentation for Python subprocesses and better error tracking across the system
+
+### 🐛 Bug Fixes
+
+- **Terminal & PTY** — Fixed paste size limits, race conditions, rendering issues, text alignment, worktree crashes, and terminal content resizing on expansion
+
+- **PR review system** — Resolved error visibility in bundled apps, improved structured output validation with three-tier recovery, preserved findings during crashes, and fixed UTC timestamp detection for comment tracking
+
+- **Planning & task execution** — Fixed handling of empty/greenfield projects, atomic writes to prevent 0-byte file corruption, planning phase crashes, and implementation plan file watching
+
+- **Authentication & profiles** — Resolved OAuth token revocation loops, API profile mode support without OAuth requirement, subscription type preservation during token refresh, and Linux credential file detection
+
+- **Windows/cross-platform** — Complete System32 executable path fixes for where.exe and taskkill.exe, Windows credential normalization, and proper shell detection for Windows terminals
+
+- **Agent management** — Fixed infinite retry loops for tool concurrency errors, auth error detection, and title generator production path resolution
+
+- **UI/UX fixes** — Resolved Insights scroll-to-blank-space issues, infinite re-render loops in terminal font settings, kanban board scaling collisions, ideation stuck states, and panel constraint errors during terminal exit
+
+- **Worktree & Git** — Improved branch pattern validation, removed auto-commit on deletion, support for detached HEAD state during PR creation, and better merge conflict resolution with progress tracking
+
+- **Integrations** — Fixed Ollama infinite subprocess spawning, Graphiti import paths, OpenRouter API URL suffix, and GitLab authentication bugs
+
+- **Settings & configuration** — Corrected .auto-claude path discovery timeout, z.AI China preset URL, log order sorting, and onboarding completion state persistence
+
+### 📚 Documentation
+
+- Added Awesome Claude Code badge to README
+
+- Added instructions for resetting PR review state in CLAUDE.md
+
+---
+
+## What's Changed
+
+- fix: handle unknown SDK message types (rate_limit_event) to prevent session crashes by @AndyMik90 in 4a75ea9f9
+- fix: PR review error visibility and gh CLI resolution in bundled apps by @AndyMik90 in 732fc1cd3
+- fix: handle empty/greenfield projects in spec creation (#1426) (#1841) by @Andy in 819f98d9f
+- fix: clear terminalEventSeen on task restart to prevent stuck-after-planning (#1828) (#1840) by @Andy in 28a620079
+- fix: watch worktree path for implementation_plan.json changes (#1805) (#1842) by @Andy in fb3a3fbda
+- fix: resolve Claude CLI not found on Windows - PATH, prompt size, cwd (#1661) (#1843) by @Andy in 76d1d3b03
+- fix: handle planning phase crash and resume recovery (#1562) (#1844) by @Andy in 3cb05781f
+- fix: show dismissed PR review findings in UI instead of silently dropping them (#1852) by @Andy in d98ff7d19
+- fix: preserve file/line info in PR review extraction recovery (#1857) by @Andy in 635b53eea
+- docs: add Awesome Claude Code badge to README (#1838) by @Andy in 2e4b5ac65
+- test: achieve 100% test coverage for backend CLI commands (#1772) by @StillKnotKnown in 385f04414
+- fix: cap terminal paste size to 1MB to prevent GPU context exhaustion by @AndyMik90 in 7b0f3a2c0
+- fix: prevent OOM, orphaned agents, and unbounded growth during overnight builds (#1813) by @Andy in 4091d1d4b
+- docs: add instructions for resetting PR review state in CLAUDE.md by @AndyMik90 in ecb615802
+- auto-claude: 217-investigate-symlink-issues-in-work-tree-creation-f (#1808) by @Andy in ae13ce14c
+- auto-claude: 218-enable-claude-code-features-in-worktree-terminals (#1809) by @Andy in e3b219288
+- auto-claude: 219-investigate-and-fix-authentication-subscription-sy (#1810) by @Andy in 6204d5fc2
+- feat(roadmap): add expand/collapse functionality for phase features (#1796) by @Burak in f735f0b49
+- auto-claude: 216-display-ongoing-pr-review-logs-in-progress (#1807) by @Andy in a4870fa0c
+- fix(pr-review): reduce structured output failures and preserve findings in recovery (#1806) by @Andy in f1b8cd3a7
+- fix(sentry): enable Sentry for Python subprocesses and add diagnostic instrumentation (#1804) by @Andy in 4d4234378
+- fix(pr-review): add three-tier recovery for structured output validation failure (#1797) by @Andy in d1fbccde3
+- test: improve backend agent test coverage to 94% (#1779) by @StillKnotKnown in ed93df698
+- fix(github): use UTC timestamps for reviewed_at to fix comment detection (#1795) by @Andy in 8872d33e3
+- feat: add user-friendly GitHub API error handling (#1790) by @StillKnotKnown in 8ece0009e
+- fix(roadmap): sync roadmap features with task lifecycle (#1791) by @Andy in 115576e85
+- fix(github): resolve PR review hanging in bundled app (#1793) by @Andy in 3791b37bb
+- feat(profiles): implement unified profile swapping across OAuth and API accounts (#1794) by @StillKnotKnown in 282387356
+- test: improve backend memory system test coverage to 100% (#1780) by @StillKnotKnown in 4f1b7b2a9
+- fix(ideation): guard against non-string properties in IdeaCard badges by @AndyMik90 in 5e78d748e
+- fix(updater): convert HTML release notes to markdown before rendering by @AndyMik90 in aa5fc7f95
+- fix(pr-review): simplify structured output schema to reduce validation failures (#1787) by @Andy in cd8914700
+- fix(qa): enforce visual verification for UI changes and inject startup commands (#1784) by @Andy in f149a7fbd
+- fix(plan-files): use atomic writes to prevent 0-byte corruption (#1785) by @Andy in c2245b812
+- fix(terminal): make worktree dropdown scrollable and show all items by @AndyMik90 in 950da45e4
+- auto-claude: subtask-1-1 - Add adaptive thinking badge to thinking level label (#1782) by @Andy in 25acf2826
+- auto-claude: subtask-1-1 - Add overflow-hidden and break-words to subtask cards by @AndyMik90 in 39aa08872
+- refactor(app-updater): disable automatic downloads and allow intentional downgrades by @AndyMik90 in 8de8039db
+- fix(auth): detect auth errors in AI response text and prevent retry loops (#1776) by @Andy in f4788e4af
+- test: achieve 100% coverage for backend core workspace module (#1774) by @StillKnotKnown in 3f95765cf
+- fix(title-generator): add production path resolution for backend source (#1778) by @Andy in 923880f5b
+- fix(fast-mode): use setting_sources instead of env var for CLI fast mode (#1771) by @Andy in 390ba6a58
+- fix(windows): complete System32 executable path fixes for where.exe and taskkill.exe (#1715) by @VDT-91 in aa7f56e5d
+- fix(worktree): remove auto-commit on deletion and add uncommitted changes warning by @AndyMik90 in cec8e65ee
+- Smart PR Status Polling System (#1766) by @Andy in 48d5f7a32
+- feat: simplify thinking system and remove opus-1m model variant (#1760) by @Andy in bb7e18937
+- auto-claude: 203-fix-pr-review-ui-update-issue (#1732) by @Andy in 7589f8e4f
+- auto-claude: subtask-2-1 - Create isAPIProfileAuthenticated() function to val (#1745) by @Andy in 57e38a692
+- auto-claude: 202-fix-kanban-board-scaling-collisions (#1731) by @Andy in d09ebb850
+- auto-claude: 204-fix-pr-review-ui-not-updating-without-manual-navig (#1734) by @Andy in 087091cef
+- auto-claude: 203-fix-ui-not-updating-during-pr-review-operations (#1733) by @Andy in f085c08bd
+- auto-claude: 205-fix-insights-chat-only-shows-last-task-suggestion- (#1735) by @Andy in f121f9cdd
+- auto-claude: 197-roadmap-generation-stuck-at-50-file-locking-race-c (#1746) by @Andy in f41f15e59
+- auto-claude: 193-fix-update-context7-mcp-tool-name-from-get-library (#1744) by @Andy in bdff9141a
+- auto-claude: 192-changelog-generation-multiple-critical-bugs-tasks- (#1725) by @Andy in 8c9a504df
+- auto-claude: 194-bug-rate-limit-during-task-execution-causes-subtas (#1726) by @Andy in 8a7443d24
+- auto-claude: 201-bug-pr-review-logs-and-analysis (#1730) by @Andy in e0d53adb4
+- auto-claude: 196-fix-worktrees-dialog-auto-close-race-condition-and (#1727) by @Andy in 323b0d3be
+- auto-claude: 199-bug-logs-disappear-after-restart (#1728) by @Andy in d639f6ef8
+- auto-claude: 198-critical-oauth-token-revocation-causes-infinite-40 (#1747) by @Andy in 4438c0b10
+- Fix Panel Constraints Error During Terminal Exit (#1757) by @Andy in 32bf353da
+- auto-claude: 190-bug-context-page-crash-multiple-root-causes-when-v (#1724) by @Andy in 2db36982f
+- feat: add search/filter to WorktreeSelector dropdown (#1754) by @Andy in 09f059ca3
+- fix(terminal): push worktree branch to remote with tracking on creation (#1753) by @Andy in b5de0d9ff
+- auto-claude: 189-subtask-execution-stuck-in-infinite-retry-loop-whe (#1723) by @Andy in 445da186c
+- auto-claude: 188-terminal-claude-sessions-require-manual-click-to-r (#1743) by @Andy in f8499e965
+- auto-claude: 200-bug-changelog-and-release-generation (#1729) by @Andy in 826583b82
+- fix(terminal): use each terminal's cwd for invoke Claude all button (#1756) by @Andy in ac4fe4f42
+- feat(terminal): read Claude Code CLI settings and inject env vars into PTY sessions (#1750) by @Andy in 152e54093
+- fix: correct .auto-claude path mismatch causing discovery phase timeout (#1748) by @VDT-91 in 2c2a8a754
+- fix: remove incorrect /v1 suffix from OpenRouter API URL (#1749) by @StillKnotKnown in 7e799ee57
+- fix: prevent terminal worktree crash with race condition fixes (#1586) (#1658) by @VDT-91 in 216b58bcf
+- fix: correct log order sorting and add configurable log order setting (#1720) by @Burak in 2e2b82365
+- fix(ollama): stop infinite subprocess spawning from useEffect re-render loop (#1716) by @Quentin Veys in acb131b72
+- fix(graphiti): migrate graphiti_memory imports to canonical paths (#1714) by @Quentin Veys in df528f065
+- fix: improve auto-updater for beta releases and DMG installs (#1681) by @Andy in ff91a1af0
+- feat: unified operation registry for intelligent auth/rate limit recovery (#1698) by @Andy in 6d0222fa9
+- fix: Prevent stale worktree data from overriding correct task status (#1710) by @Burak in fe08c644c
+- feat: add subscriptionType and rateLimitTier to ClaudeProfile (#1688) by @Andy in a5e3cc9a2
+- auto-claude: subtask-1-1 - Add useTaskStore import and update task state after successful PR creation (#1683) by @Andy in 4587162e4
+- auto-claude: 182-implement-pagination-and-filtering-for-github-pr-l (#1654) by @Andy in b4e6b2fe4
+- auto-claude: 181-add-expand-button-for-long-task-descriptions (#1653) by @Andy in d9cd300fe
+- fix(terminal): resolve text alignment issues on expand/minimize (#1650) by @VDT-91 in f5a7e26d9
+- fix(windows): use full path to where.exe for reliable executable lookup (#1659) by @VDT-91 in 5f63daa3c
+- fix: resolve ideation stuck at 3/6 types bug (#1660) by @VDT-91 in e6e8da17c
+- Clarify Local and Origin Branch Distinction (#1652) by @Andy in 9317148b6
+- auto-claude: 186-set-default-dark-mode-on-startup (#1656) by @Andy in 473020621
+- auto-claude: subtask-1-1 - Add min-h-0 to enable scrolling in Roadmap tabs (#1655) by @Andy in ae703be9f
+- fix: XState status lifecycle & cross-project contamination fixes (#1647) by @kaigler in 5293fb399
+- refactor(frontend): complete XState task state machine migration (#1338) (#1575) by @kaigler in e2f9abadb
+- Merge conflict resolution progress bar and log viewer (#1620) by @Andy in d16be3077
+- fix: align Linux package builds (AppImage/deb/Flatpak) with target-specific extraResources (#1623) by @StillKnotKnown in bad1a9b2c
+- Fix/gitlab bugs (#1519 and #1521) (#1544) by @bu5hm4nn in cd423c65c
+- feat(kanban): add bulk task delete and worktree cleanup improvements (#1588) by @kaigler in 02ed91c91
+- fix: add worktree isolation warning to prevent agent escape (#1528) by @kaigler in fe5cc582b
+- feat(ui): add spell check support for text inputs (#1304) by @kaigler in 8f02a5129
+- fix(windows): complete Windows credential fixes with path normalization (#1585) by @kaigler in 1e1997167
+- AI-Powered GitHub PR Template Generation (#1618) by @Andy in 900dd4360
+- Fix pty.node SIGABRT crash on macOS shutdown (#1619) by @Andy in f355e09d7
+- fix(merge): use git merge for diverged branches with progress tracking (#1605) by @Andy in bde2ca4b2
+- Surface Billing/Credit Exhaustion Errors to UI (Issue #1580) (#1617) by @Andy in 7bf12e856
+- auto-claude: subtask-1-1 - Change $teamId type from ID! to String! in the team query (#1627) by @Andy in 54d0cd2f4
+- fix(auth): support API profile mode without OAuth requirement (#1616) by @StillKnotKnown in f8cc63af4
+- fix: agent retry loop for tool concurrency errors (#1546) [v3] (#1606) by @Michael Ludlow in 0aea4fb5e
+- fix(queue): enforce max parallel tasks and auto-refresh UI (#1594) by @Andy in 4070a4c29
+- Persist Kanban column collapse state per project via main process (#1579) by @Andy in a1114664e
+- feat(pr-review): evidence-based validation and trigger-driven exploration (#1593) by @Andy in bfc232825
+- fix(ui): smart auto-scroll for Insights streaming responses (#1591) by @kaigler in eee97e7ea
+- fix(changelog): validate Claude CLI exists before generation (#1305) by @kaigler in c1f24c07f
+- auto-claude: subtask-1-1 - Add min-w-0 class to subtask title row flex container (#1578) by @Andy in 286591c02
+- auto-claude: subtask-1-1 - Remove Popover wrapper and related functionality from ClaudeCodeStatusBadge (#1566) by @Andy in 8d18cc81a
+- fix(claude-profile): preserve subscriptionType and rateLimitTier during token refresh (#1556) by @Andy in 52e426a48
+- auto-claude: subtask-1-1 - Update cancelReview callback to handle both success and failure cases (#1551) by @Andy in d8f00fe5a
+- fix(backend): prioritize git remote detection over env var for repo (#1555) by @Andy in 9b07ed464
+- fix(backend): handle detached HEAD state when pushing branch for PR creation (#1560) by @Andy in 2b72694d0
+- fix: add explicit UTF-8 encoding across all Electron main process I/O (#1554) by @Andy in 4243530e9
+- fix(backend): pass OAuth token to Python subprocess for authentication by @AndyMik90 in 6f1002dd7
+- perf(frontend): async parallel worktree listing to prevent UI freezes (#1553) by @Andy in 399a7e736
+- auto-claude: subtask-1-1 - Remove amber lock indicator line from kanban resize handle (#1557) by @Andy in 83a64b88e
+- fix(frontend): resolve TerminalFontSettings infinite re-render loop (#1536) by @StillKnotKnown in 1c6266025
+- fix(frontend): respect hasCompletedOnboarding from ~/.claude.json (#1537) by @StillKnotKnown in 1860c2c43
+- fix: prevent planner from generating invalid verification types (#1388) (#1529) by @kaigler in 94d941333
+- fix(frontend): resolve Insights scroll-to-blank-space issue on macOS (ACS-382) (#1535) by @StillKnotKnown in 496b2b96a
+- feat: add customizable terminal fonts with OS-specific defaults (#1412) by @StillKnotKnown in f289107b8
+- Add dev mode screenshot capture warning (#1516) by @Andy in 16eeb301a
+- fix: add worktree isolation warnings to prevent agent escape (ACS-394) (#1495) by @StillKnotKnown in 1e453653b
+- fix: resolve flaky subprocess-spawn test on Windows CI (ACS-392) (#1494) by @StillKnotKnown in f6b264d56
+- feat(task-logger): strip ANSI escape codes from logs and extend coverage (#1411) by @StillKnotKnown in 988ec0c25
+- fix(frontend): use spawn() instead of exec() for Windows terminal launching (#1498) by @StillKnotKnown in 26c9083d3
+- fix(api-profiles): correct z.AI China preset URL and rename provider presets (#1500) by @StillKnotKnown in 05cf0a516
+- fix: validate branch pattern before worktree cleanup to prevent deleting wrong branch (#1493) by @StillKnotKnown in 8576754a1
+- Real-Time Updates for Insights Chat (#1511) by @Andy in d940b6ade
+- Fix Terminal UI Rendering Issues (#1514) by @Andy in 8d8306b8e
+- Fix terminal content resizing on expansion (#1512) by @Andy in 9f6c0026b
+- Restore Terminal Session History on App Restart (#1515) by @Andy in 63e2847fc
+- Move Reference Images Above Task Title & Fix Image Display Issues (#1513) by @Andy in b269ac305
+- auto-claude: 143-fix-github-integration-ui-refresh-issues (#1467) by @Andy in aa2cb4fa6
+- feat: Multi-profile account swapping with token refresh and queue routing (#1496) by @Andy in 1e72c8d77
+- Simplified Testing Strategy for Regression Prevention (#1379) by @Andy in ae4e48e8b
+- auto-claude: 152-persist-tasks-during-roadmap-regeneration (#1463) by @Andy in 9bd3d7e3b
+- Debug Kanban Memory & Add Sentry Monitoring (#1380) by @Andy in bc5f550ee
+- auto-claude: 147-remove-outdated-compatibility-shims (#1465) by @Andy in 53111dbb9
+- auto-claude: 162-fix-worktree-error-on-repeated-task-starts (#1453) by @Andy in b955badf7
+- auto-claude: 155-fix-pr-list-diff-display-metrics (#1458) by @Andy in 31f116db5
+- auto-claude: 151-fix-pr-review-agent-token-refresh-on-account-swap (#1456) by @Andy in d081af042
+- auto-claude: 148-add-progress-persistence-and-status-indicators (#1464) by @Andy in 4937d5745
+- auto-claude: 154-fix-task-modal-conflict-check-status-refresh (#1462) by @Andy in 0299009df
+- auto-claude: 153-widen-kanban-columns-and-add-collapse-feature (#1457) by @Andy in d65973075
+- auto-claude: subtask-1-1 - Add filter after map operation to remove empty str (#1466) by @Andy in 783f0fe0e
+- fix: add formatReleaseNotes helper for markdown changelog rendering (#1468) by @Andy in 43a97e1b3
+- feat(sidebar): add collapsible sidebar toggle (#1501) by @Michael Ludlow in d17c17887
+- fix(auth): check .credentials.json for Linux profile authentication (#1492) by @StillKnotKnown in 8d2f66291
+- auto-claude: subtask-1-1 - Replace ReleaseNotesRenderer with ReactMarkdown (#1454) by @Andy in 1185a558c
+- auto-claude: 156-fix-electron-app-version-detection-bug (#1459) by @Andy in 9a3b48c25
+- auto-claude: subtask-1-1 - Add --no-track flag to git worktree add command (#1455) by @Andy in 0c2990815
+- auto-claude: subtask-1-1 - Change task.specId to taskId in 3 startSpecCreation calls (#1461) by @Andy in 91edc0e14
+- fix(onboarding): align MemoryStep layout with Settings MemoryBackendSection (#1445) by @Michael Ludlow in e9de26d59
+- auto-claude: subtask-1-1 - Add metadata?.requireReviewBeforeCoding check (#1460) by @Andy in 426d56571
+- fix: use API profile environment variables for task title generation (#1471) by @JoshuaRileyDev in c5a0f042d
+- fix(auth): Long-lived OAuth authentication with multi-profile usage display (#1443) by @Andy in 12e788417
+- feat: Add screenshot capture to task creation modal (#1429) by @JoshuaRileyDev in 1a2a1b1fc
+- fix: prevent queue settings modal from disappearing when tasks change (#1430) by @JoshuaRileyDev in 33acc1430
+- feat: Queue System v2 with Auto-Promotion and Smart Task Management (#1203) by @JoshuaRileyDev in 3b87e24d7
+- feat: Add API profile providers usage endpoints support (#1279) by @StillKnotKnown in cfe7dedd0
+
+## Thanks to all contributors
+
+@AndyMik90, @Andy, @Burak, @StillKnotKnown, @VDT-91, @kaigler, @Michael Ludlow, @JoshuaRileyDev, @Quentin Veys, @bu5hm4nn
+
 ## 2.7.5 - Security & Platform Improvements

 ### ✨ New Features
@@ -30,27 +30,64 @@ Auto Claude is a desktop application (+ CLI) where users describe a goal and AI

 ## Critical Rules

-**Claude Agent SDK only** — All AI interactions use `claude-agent-sdk`. NEVER use `anthropic.Anthropic()` directly. Always use `create_client()` from `core.client`.
+**Claude Agent SDK only** — All AI interactions use `claude-agent-sdk` because it handles security hooks, tool permissions, and MCP server integration. Use `create_client()` from `core.client`, not `anthropic.Anthropic()` directly.

-**i18n required** — All frontend user-facing text MUST use `react-i18next` translation keys. Never hardcode strings in JSX/TSX. Add keys to both `en/*.json` and `fr/*.json`.
+**i18n required** — All frontend user-facing text uses `react-i18next` translation keys. Hardcoded strings in JSX/TSX break localization for non-English users. Add keys to both `en/*.json` and `fr/*.json`.

-**Platform abstraction** — Never use `process.platform` directly. Import from `apps/frontend/src/main/platform/` or `apps/backend/core/platform/`. CI tests all three platforms.
+**Platform abstraction** — Use the platform modules in `apps/frontend/src/main/platform/` or `apps/backend/core/platform/` instead of `process.platform` directly. CI tests all three platforms, and raw platform checks cause failures.

-**No time estimates** — Never provide duration predictions. Use priority-based ordering instead.
+**No time estimates** — Provide priority-based ordering instead of duration predictions.

-**PR target** — Always target the `develop` branch for PRs to AndyMik90/Auto-Claude, NOT `main`.
+**PR target** — Always target the `develop` branch for PRs, not `main`. Main is reserved for releases.

-## Work Approach
+**No console.log in production code** — `console.log` output is invisible in bundled Electron apps. Use Sentry for error tracking in production; reserve `console.log` for development only.

-**Investigate before speculating** — Always read the actual code before proposing root causes. Spawn agents to grep and read relevant source files before forming any hypothesis. Never guess at causes without evidence from the codebase.
+## Work Approach: Orchestrator-First

-**Spawn agents for complex tasks** — When tackling complex tasks, spawn sub-agents/agent teams immediately rather than trying to handle everything in a single context window. Never attempt to analyze large codebases or multiple features monolithically.
+You are an orchestrator. Your primary role is to understand what needs to be done, break it into workstreams, and delegate execution to agent teams. This keeps your context window focused on coordination and decision-making rather than filling up with implementation details.

-**Minimal fixes only** — Prefer the simplest approach (e.g., prompt-only changes, single guard clause) before suggesting multi-component solutions. If the user asks for X, implement X — don't bundle additional fixes they didn't request.
+<orchestrator_pattern>
+When given a task, follow this pattern:
+
+1. **Investigate first** — Read the actual code before forming any hypothesis. Use targeted searches (Glob, Grep, Read) for simple lookups. For broader exploration, spawn an Explore agent.
+
+2. **Plan the approach** — Identify what needs to change, which files are involved, and whether work can be parallelized. For multi-step tasks, create a task list to track workstreams.
+
+3. **Delegate execution** — Spawn agent teams to do the implementation work. Each agent gets a clear, self-contained assignment with all the context it needs: relevant file paths, the specific change to make, and acceptance criteria. Run independent workstreams in parallel.
+
+4. **Verify and integrate** — Review agent outputs, run tests, and ensure changes work together. Fix integration issues or spawn follow-up agents as needed.
+</orchestrator_pattern>
+
+**When to delegate vs. do directly:**
+- Delegate: multi-file changes, research across the codebase, independent parallel workstreams, tasks that would consume significant context
+- Do directly: single-file edits, simple bug fixes, quick lookups, tasks where you already have the context
+
+**Giving agents good assignments** — Each agent works with a fresh context. Include: the specific goal, relevant file paths, code patterns to follow, and what "done" looks like. Agents perform better with explicit, complete instructions than with vague references to "the current task."
+
+**Minimal changes only** — Prefer the simplest approach (e.g., prompt-only changes, single guard clause) before suggesting multi-component solutions. If the user asks for X, implement X — don't bundle additional fixes they didn't request.
+
+**Default to action** — When the user's intent implies making changes, implement them rather than only suggesting. If something is unclear, read the relevant code to fill in the gaps rather than asking. Only ask when genuine ambiguity remains about what the user wants.
+
+## Context Management
+
+Your context window will be automatically compacted as it approaches its limit, allowing you to continue working indefinitely. Do not stop tasks early due to context concerns — instead, persist progress and keep going.
+
+**For long-running tasks:** Use git commits, task lists, and structured notes to track state. When context compacts, review git log and any progress files to re-orient. Focus on incremental progress — complete one component before moving to the next, and commit working states along the way.
+
+**Parallel tool calls** — When reading multiple files, running independent searches, or executing unrelated commands, make all calls in parallel rather than sequentially. This significantly speeds up investigation and implementation.

 ## Known Gotchas

-**Electron path resolution** — For bug fixes in the Electron app, always check path resolution differences between dev and production builds (`app.isPackaged`, `process.resourcesPath`). Paths that work in dev often break when Electron is bundled for production — verify both contexts.
+**Electron path resolution** — For bug fixes in the Electron app, check path resolution differences between dev and production builds (`app.isPackaged`, `process.resourcesPath`). Paths that work in dev often break when Electron is bundled for production — verify both contexts.
+
+### Resetting PR Review State
+
+To fully clear all PR review data so reviews run fresh, delete/reset these three things in `.auto-claude/github/`:
+
+1. `rm .auto-claude/github/pr/logs_*.json` — review log files
+2. `rm .auto-claude/github/pr/review_*.json` — review result files
+3. Reset `pr/index.json` to `{"reviews": [], "last_updated": null}`
+4. Reset `bot_detection_state.json` to `{"reviewed_commits": {}}` — this is the gatekeeper; without clearing it, the bot detector skips already-seen commits

 ## Project Structure

@@ -267,7 +304,7 @@ Supports Windows, macOS, Linux. CI tests all three.
 | `findExecutable(name)` | Cross-platform executable lookup |
 | `requiresShell(command)` | `.cmd/.bat` shell detection (Win) |

-Never hardcode paths. Use `findExecutable()` and `joinPaths()`. See [ARCHITECTURE.md](shared_docs/ARCHITECTURE.md#cross-platform-development) for extended guide.
+Use `findExecutable()` and `joinPaths()` instead of hardcoded paths. See [ARCHITECTURE.md](shared_docs/ARCHITECTURE.md#cross-platform-development) for extended guide.

 ## E2E Testing (Electron MCP)

@@ -8,6 +8,7 @@
 [![Discord](https://img.shields.io/badge/Discord-Join%20Community-5865F2?style=flat-square&logo=discord&logoColor=white)](https://discord.gg/KCXaPBr4Dj)
 [![YouTube](https://img.shields.io/badge/YouTube-Subscribe-FF0000?style=flat-square&logo=youtube&logoColor=white)](https://www.youtube.com/@AndreMikalsen)
 [![CI](https://img.shields.io/github/actions/workflow/status/AndyMik90/Auto-Claude/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/AndyMik90/Auto-Claude/actions)
+[![Mentioned in Awesome Claude Code](https://awesome.re/mentioned-badge-flat.svg)](https://github.com/hesreallyhim/awesome-claude-code)

 ---

@@ -16,18 +17,18 @@
 ### Stable Release

 <!-- STABLE_VERSION_BADGE -->
-[![Stable](https://img.shields.io/badge/stable-2.7.5-blue?style=flat-square)](https://github.com/AndyMik90/Auto-Claude/releases/tag/v2.7.5)
+[![Stable](https://img.shields.io/badge/stable-2.7.6-blue?style=flat-square)](https://github.com/AndyMik90/Auto-Claude/releases/tag/v2.7.6)
 <!-- STABLE_VERSION_BADGE_END -->

 <!-- STABLE_DOWNLOADS -->
 | Platform | Download |
 |----------|----------|
-| **Windows** | [Auto-Claude-2.7.5-win32-x64.exe](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.5/Auto-Claude-2.7.5-win32-x64.exe) |
-| **macOS (Apple Silicon)** | [Auto-Claude-2.7.5-darwin-arm64.dmg](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.5/Auto-Claude-2.7.5-darwin-arm64.dmg) |
-| **macOS (Intel)** | [Auto-Claude-2.7.5-darwin-x64.dmg](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.5/Auto-Claude-2.7.5-darwin-x64.dmg) |
-| **Linux** | [Auto-Claude-2.7.5-linux-x86_64.AppImage](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.5/Auto-Claude-2.7.5-linux-x86_64.AppImage) |
-| **Linux (Debian)** | [Auto-Claude-2.7.5-linux-amd64.deb](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.5/Auto-Claude-2.7.5-linux-amd64.deb) |
-| **Linux (Flatpak)** | [Auto-Claude-2.7.5-linux-x86_64.flatpak](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.5/Auto-Claude-2.7.5-linux-x86_64.flatpak) |
+| **Windows** | [Auto-Claude-2.7.6-win32-x64.exe](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.6/Auto-Claude-2.7.6-win32-x64.exe) |
+| **macOS (Apple Silicon)** | [Auto-Claude-2.7.6-darwin-arm64.dmg](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.6/Auto-Claude-2.7.6-darwin-arm64.dmg) |
+| **macOS (Intel)** | [Auto-Claude-2.7.6-darwin-x64.dmg](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.6/Auto-Claude-2.7.6-darwin-x64.dmg) |
+| **Linux** | [Auto-Claude-2.7.6-linux-x86_64.AppImage](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.6/Auto-Claude-2.7.6-linux-x86_64.AppImage) |
+| **Linux (Debian)** | [Auto-Claude-2.7.6-linux-amd64.deb](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.6/Auto-Claude-2.7.6-linux-amd64.deb) |
+| **Linux (Flatpak)** | [Auto-Claude-2.7.6-linux-x86_64.flatpak](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.6/Auto-Claude-2.7.6-linux-x86_64.flatpak) |
 <!-- STABLE_DOWNLOADS_END -->

 ### Beta Release
@@ -35,18 +36,18 @@
 > ⚠️ Beta releases may contain bugs and breaking changes. [View all releases](https://github.com/AndyMik90/Auto-Claude/releases)

 <!-- BETA_VERSION_BADGE -->
-[![Beta](https://img.shields.io/badge/beta-2.7.6--beta.3-orange?style=flat-square)](https://github.com/AndyMik90/Auto-Claude/releases/tag/v2.7.6-beta.3)
+[![Beta](https://img.shields.io/badge/beta-2.7.6--beta.6-orange?style=flat-square)](https://github.com/AndyMik90/Auto-Claude/releases/tag/v2.7.6-beta.6)
 <!-- BETA_VERSION_BADGE_END -->

 <!-- BETA_DOWNLOADS -->
 | Platform | Download |
 |----------|----------|
-| **Windows** | [Auto-Claude-2.7.6-beta.3-win32-x64.exe](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.6-beta.3/Auto-Claude-2.7.6-beta.3-win32-x64.exe) |
-| **macOS (Apple Silicon)** | [Auto-Claude-2.7.6-beta.3-darwin-arm64.dmg](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.6-beta.3/Auto-Claude-2.7.6-beta.3-darwin-arm64.dmg) |
-| **macOS (Intel)** | [Auto-Claude-2.7.6-beta.3-darwin-x64.dmg](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.6-beta.3/Auto-Claude-2.7.6-beta.3-darwin-x64.dmg) |
-| **Linux** | [Auto-Claude-2.7.6-beta.3-linux-x86_64.AppImage](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.6-beta.3/Auto-Claude-2.7.6-beta.3-linux-x86_64.AppImage) |
-| **Linux (Debian)** | [Auto-Claude-2.7.6-beta.3-linux-amd64.deb](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.6-beta.3/Auto-Claude-2.7.6-beta.3-linux-amd64.deb) |
-| **Linux (Flatpak)** | [Auto-Claude-2.7.6-beta.3-linux-x86_64.flatpak](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.6-beta.3/Auto-Claude-2.7.6-beta.3-linux-x86_64.flatpak) |
+| **Windows** | [Auto-Claude-2.7.6-beta.6-win32-x64.exe](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.6-beta.6/Auto-Claude-2.7.6-beta.6-win32-x64.exe) |
+| **macOS (Apple Silicon)** | [Auto-Claude-2.7.6-beta.6-darwin-arm64.dmg](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.6-beta.6/Auto-Claude-2.7.6-beta.6-darwin-arm64.dmg) |
+| **macOS (Intel)** | [Auto-Claude-2.7.6-beta.6-darwin-x64.dmg](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.6-beta.6/Auto-Claude-2.7.6-beta.6-darwin-x64.dmg) |
+| **Linux** | [Auto-Claude-2.7.6-beta.6-linux-x86_64.AppImage](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.6-beta.6/Auto-Claude-2.7.6-beta.6-linux-x86_64.AppImage) |
+| **Linux (Debian)** | [Auto-Claude-2.7.6-beta.6-linux-amd64.deb](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.6-beta.6/Auto-Claude-2.7.6-beta.6-linux-amd64.deb) |
+| **Linux (Flatpak)** | [Auto-Claude-2.7.6-beta.6-linux-x86_64.flatpak](https://github.com/AndyMik90/Auto-Claude/releases/download/v2.7.6-beta.6/Auto-Claude-2.7.6-beta.6-linux-x86_64.flatpak) |
 <!-- BETA_DOWNLOADS_END -->

 > All releases include SHA256 checksums and VirusTotal scan results for security verification.
@@ -67,4 +67,9 @@ tests/

 # Auto Claude data directory
 .auto-claude/
-coverage.json
+
+# Auto Claude generated files
+.auto-claude-security.json
+.auto-claude-status
+.security-key
+logs/security/
@@ -19,5 +19,5 @@ Quick Start:
 See README.md for full documentation.
 """

-__version__ = "2.7.6-beta.3"
+__version__ = "2.7.6"
 __author__ = "Auto Claude Team"
@@ -13,7 +13,9 @@ import re
 from datetime import datetime, timedelta
 from pathlib import Path

+from context.constants import SKIP_DIRS
 from core.client import create_client
+from core.file_utils import write_json_atomic
 from linear_updater import (
    LinearTaskState,
    is_linear_enabled,
@@ -84,6 +86,7 @@ from .memory_manager import debug_memory_system_status, get_graphiti_context
 from .session import post_session_processing, run_agent_session
 from .utils import (
    find_phase_for_subtask,
+    find_subtask_in_plan,
    get_commit_count,
    get_latest_commit,
    load_implementation_plan,
@@ -97,8 +100,383 @@ logger = logging.getLogger(__name__)
 # FILE VALIDATION UTILITIES
 # =============================================================================

+# Directories to exclude from file path search — extends context.constants.SKIP_DIRS
+_EXCLUDE_DIRS = frozenset(SKIP_DIRS | {".auto-claude", ".tox", "out"})

-def validate_subtask_files(subtask: dict, project_dir: Path) -> dict:
+
+def _build_file_index(
+    project_dir: Path, suffixes: set[str]
+) -> dict[str, list[tuple[str, Path]]]:
+    """
+    Build an index of project files grouped by basename, scanning the tree once.
+
+    Also indexes index.{ext} files under their parent directory name as a
+    secondary key (e.g., api/index.ts is indexed under both "index.ts" and
+    "api" as directory-stem).
+
+    Args:
+        project_dir: Root directory of the project
+        suffixes: File extensions to index (e.g., {".ts", ".tsx"})
+
+    Returns:
+        Dict mapping basename -> list of (relative_path_str, Path(relative_path))
+    """
+    index: dict[str, list[tuple[str, Path]]] = {}
+    resolved_str = str(project_dir.resolve())
+
+    for root, dirs, files in os.walk(project_dir.resolve()):
+        dirs[:] = [d for d in dirs if d not in _EXCLUDE_DIRS]
+
+        for filename in files:
+            ext_idx = filename.rfind(".")
+            if ext_idx == -1:
+                continue
+            file_suffix = filename[ext_idx:]
+            if file_suffix not in suffixes:
+                continue
+
+            full_path = os.path.join(root, filename)
+            rel_str = os.path.relpath(full_path, resolved_str).replace(os.sep, "/")
+            rel_path = Path(rel_str)
+
+            # Index by basename
+            index.setdefault(filename, []).append((rel_str, rel_path))
+
+            # Also index index.{ext} files by parent dir name (for stem matching)
+            stem_part = filename[:ext_idx]
+            if stem_part == "index":
+                dir_name = os.path.basename(root)
+                key = f"__dir_stem__:{dir_name}{file_suffix}"
+                index.setdefault(key, []).append((rel_str, rel_path))
+
+    return index
+
+
+def _score_and_select(candidates: list[tuple[str, float]]) -> str | None:
+    """
+    Select the best candidate from a scored list of (path, score) pairs.
+
+    Requires a minimum score of 8.0 and a gap of at least 3.0 from the
+    runner-up to avoid ambiguous matches.
+
+    Args:
+        candidates: List of (relative_path, score) tuples
+
+    Returns:
+        Best path if unambiguous, None otherwise
+    """
+    if not candidates:
+        return None
+
+    candidates.sort(key=lambda x: x[1], reverse=True)
+    best_path, best_score = candidates[0]
+
+    if best_score < 8.0:
+        return None
+
+    if len(candidates) > 1:
+        runner_up_score = candidates[1][1]
+        if best_score - runner_up_score < 3.0:
+            return None
+
+    return best_path
+
+
+def _find_correct_path_indexed(
+    missing_path: str,
+    parent_parts: tuple[str, ...],
+    file_index: dict[str, list[tuple[str, Path]]],
+) -> str | None:
+    """
+    Find the correct path using a pre-built file index (no tree walk needed).
+
+    Args:
+        missing_path: The incorrect file path from the plan
+        parent_parts: Parent directory parts of the missing path
+        file_index: Index built by _build_file_index
+
+    Returns:
+        Corrected relative path, or None if no good match found
+    """
+    missing = Path(missing_path)
+    basename = missing.name
+    stem = missing.stem
+    suffix = missing.suffix
+
+    if not suffix:
+        return None
+
+    candidates: list[tuple[str, float]] = []
+
+    # Strategy 1: Exact basename match
+    for rel_str, rel_path in file_index.get(basename, []):
+        score = 10.0
+        candidate_parts = rel_path.parent.parts
+        for i, part in enumerate(parent_parts):
+            if i < len(candidate_parts) and candidate_parts[i] == part:
+                score += 3.0
+        depth_diff = abs(len(candidate_parts) - len(parent_parts))
+        score -= 0.5 * depth_diff
+        candidates.append((rel_str, score))
+
+    # Strategy 2: index.{ext} in directory matching stem
+    stem_key = f"__dir_stem__:{stem}{suffix}"
+    for rel_str, rel_path in file_index.get(stem_key, []):
+        score = 8.0
+        candidate_parts = rel_path.parent.parts
+        for i, part in enumerate(parent_parts):
+            if i < len(candidate_parts) and candidate_parts[i] == part:
+                score += 3.0
+        depth_diff = abs(len(candidate_parts) - len(parent_parts))
+        score -= 0.5 * depth_diff
+        candidates.append((rel_str, score))
+
+    return _score_and_select(candidates)
+
+
+def _find_correct_path(missing_path: str, project_dir: Path) -> str | None:
+    """
+    Attempt to find the correct path for a missing file using fuzzy matching.
+
+    Strategies:
+    1. Same basename in nearby directory
+    2. index.{ext} pattern (e.g., preload/api.ts -> preload/api/index.ts)
+
+    Uses os.walk with directory pruning to avoid traversing into node_modules,
+    .git, dist, etc. — unlike Path.rglob which traverses everything then filters.
+
+    Args:
+        missing_path: The incorrect file path from the plan
+        project_dir: Root directory of the project
+
+    Returns:
+        Corrected relative path, or None if no good match found
+    """
+    missing = Path(missing_path)
+    basename = missing.name
+    stem = missing.stem
+    suffix = missing.suffix
+    parent_parts = missing.parent.parts
+
+    if not suffix:
+        return None
+
+    candidates: list[tuple[str, float]] = []
+    resolved_project = project_dir.resolve()
+    resolved_str = str(resolved_project)
+
+    # os.walk with pruning: modify dirs in-place to skip excluded directories
+    for root, dirs, files in os.walk(resolved_project):
+        dirs[:] = [d for d in dirs if d not in _EXCLUDE_DIRS]
+
+        for filename in files:
+            if not filename.endswith(suffix):
+                continue
+
+            full_path = os.path.join(root, filename)
+            rel_str = os.path.relpath(full_path, resolved_str).replace(os.sep, "/")
+            rel = Path(rel_str)
+
+            score = 0.0
+
+            # Strategy 1: Exact basename match
+            if filename == basename:
+                score += 10.0
+            # Strategy 2: index.{ext} in directory matching stem
+            elif filename == f"index{suffix}" and os.path.basename(root) == stem:
+                score += 8.0
+            else:
+                continue
+
+            # Bonus: shared parent directory segments
+            candidate_parts = rel.parent.parts
+            for i, part in enumerate(parent_parts):
+                if i < len(candidate_parts) and candidate_parts[i] == part:
+                    score += 3.0
+
+            # Penalty: depth difference
+            depth_diff = abs(len(candidate_parts) - len(parent_parts))
+            score -= 0.5 * depth_diff
+
+            candidates.append((rel_str, score))
+
+    return _score_and_select(candidates)
+
+
+def _auto_correct_subtask_files(
+    subtask: dict,
+    missing_files: list[str],
+    project_dir: Path,
+    spec_dir: Path,
+) -> list[str]:
+    """
+    Attempt to auto-correct missing file paths in a subtask.
+
+    Corrects paths in-memory AND persists changes to implementation_plan.json.
+
+    Args:
+        subtask: Subtask dictionary containing files_to_modify
+        missing_files: List of file paths that don't exist
+        project_dir: Root directory of the project
+        spec_dir: Spec directory containing implementation_plan.json
+
+    Returns:
+        List of file paths that could NOT be corrected
+    """
+    corrections: dict[str, str] = {}
+    still_missing: list[str] = []
+
+    # Build file index once for all missing files (avoids repeated os.walk)
+    suffixes_needed: set[str] = set()
+    for missing_path in missing_files:
+        suffix = Path(missing_path).suffix
+        if suffix:
+            suffixes_needed.add(suffix)
+    file_index = (
+        _build_file_index(project_dir, suffixes_needed) if suffixes_needed else {}
+    )
+
+    for missing_path in missing_files:
+        missing = Path(missing_path)
+        corrected = _find_correct_path_indexed(
+            missing_path, missing.parent.parts, file_index
+        )
+        if corrected:
+            corrections[missing_path] = corrected
+            logger.info(f"Auto-corrected file path: {missing_path} -> {corrected}")
+            print_status(f"Auto-corrected: {missing_path} -> {corrected}", "success")
+        else:
+            still_missing.append(missing_path)
+
+    if not corrections:
+        return still_missing
+
+    # Update subtask in-memory
+    files_to_modify = subtask.get("files_to_modify", [])
+    subtask["files_to_modify"] = [corrections.get(f, f) for f in files_to_modify]
+
+    # Persist corrections to implementation_plan.json
+    plan_file = spec_dir / "implementation_plan.json"
+    if plan_file.exists():
+        try:
+            with open(plan_file, encoding="utf-8") as f:
+                plan = json.load(f)
+
+            subtask_id = subtask.get("id")
+            if subtask_id is not None:
+                plan_subtask = find_subtask_in_plan(plan, subtask_id)
+                if plan_subtask:
+                    plan_files = plan_subtask.get("files_to_modify", [])
+                    plan_subtask["files_to_modify"] = [
+                        corrections.get(f, f) for f in plan_files
+                    ]
+
+            write_json_atomic(plan_file, plan)
+            logger.info(
+                f"Persisted {len(corrections)} path correction(s) to implementation_plan.json"
+            )
+        except (OSError, TypeError, ValueError) as e:
+            logger.warning(f"Failed to persist path corrections: {e}")
+
+    return still_missing
+
+
+def _validate_plan_file_paths(spec_dir: Path, project_dir: Path) -> str | None:
+    """
+    Validate all file paths in the implementation plan after planning.
+
+    Builds a file index once, then checks all paths across all subtasks against it.
+    Attempts auto-correction for missing paths. Returns a retry context string for
+    the planner if uncorrectable paths remain, or None if all paths are valid.
+
+    Args:
+        spec_dir: Spec directory containing implementation_plan.json
+        project_dir: Root directory of the project
+
+    Returns:
+        Retry context string if issues remain, None if all OK
+    """
+    plan_file = spec_dir / "implementation_plan.json"
+    if not plan_file.exists():
+        return None
+
+    try:
+        with open(plan_file, encoding="utf-8") as f:
+            plan = json.load(f)
+    except (OSError, json.JSONDecodeError, UnicodeDecodeError):
+        return None
+
+    resolved_project = project_dir.resolve()
+
+    # First pass: collect all missing files and their suffixes
+    missing_entries: list[
+        tuple[list[str], int, str]
+    ] = []  # (subtask_files_list, index, path)
+    suffixes_needed: set[str] = set()
+
+    for phase in plan.get("phases", []):
+        for subtask in phase.get("subtasks", []):
+            files = subtask.get("files_to_modify", [])
+            for i, file_path in enumerate(files):
+                full_path = (resolved_project / file_path).resolve()
+                if not full_path.is_relative_to(resolved_project):
+                    continue
+                if full_path.exists():
+                    continue
+
+                missing = Path(file_path)
+                if missing.suffix:
+                    suffixes_needed.add(missing.suffix)
+                    missing_entries.append((files, i, file_path))
+
+    if not missing_entries:
+        return None
+
+    # Build index once for all needed suffixes
+    file_index = _build_file_index(project_dir, suffixes_needed)
+
+    all_missing: list[str] = []
+    corrections_made = 0
+
+    for files_list, idx, file_path in missing_entries:
+        missing = Path(file_path)
+        corrected = _find_correct_path_indexed(
+            file_path, missing.parent.parts, file_index
+        )
+        if corrected:
+            files_list[idx] = corrected
+            corrections_made += 1
+            logger.info(f"Post-plan auto-corrected: {file_path} -> {corrected}")
+            print_status(f"Auto-corrected: {file_path} -> {corrected}", "success")
+        else:
+            all_missing.append(file_path)
+
+    # Persist any corrections that were made
+    if corrections_made > 0:
+        try:
+            write_json_atomic(plan_file, plan)
+            logger.info(f"Persisted {corrections_made} post-plan path correction(s)")
+        except (OSError, TypeError, ValueError) as e:
+            logger.warning(f"Failed to persist post-plan corrections: {e}")
+
+    if not all_missing:
+        return None
+
+    return (
+        "## FILE PATH VALIDATION ERRORS\n\n"
+        "The following files referenced in your implementation plan do NOT exist "
+        "and could not be auto-corrected:\n"
+        + "\n".join(f"- `{p}`" for p in all_missing)
+        + "\n\nPlease fix these file paths in the `implementation_plan.json`.\n"
+        "Use the project's actual file structure to find the correct paths.\n"
+        "Common issues: wrong directory nesting, missing index files "
+        "(e.g., `dir/file.ts` should be `dir/file/index.ts`)."
+    )
+
+
+def validate_subtask_files(
+    subtask: dict, project_dir: Path, spec_dir: Path | None = None
+) -> dict:
    """
    Validate all files_to_modify exist before subtask execution.

@@ -136,6 +514,15 @@ def validate_subtask_files(subtask: dict, project_dir: Path) -> dict:
        }

    if missing_files:
+        # Attempt auto-correction if spec_dir is provided
+        if spec_dir:
+            still_missing = _auto_correct_subtask_files(
+                subtask, missing_files, project_dir, spec_dir
+            )
+            if not still_missing:
+                return {"success": True, "missing_files": [], "invalid_paths": []}
+            missing_files = still_missing
+
        return {
            "success": False,
            "error": f"Planned files do not exist: {', '.join(missing_files)}",
@@ -685,7 +1072,10 @@ async def run_autonomous_agent(

            # Validate that all files_to_modify exist before attempting execution
            # This prevents infinite retry loops when implementation plan references non-existent files
-            validation_result = validate_subtask_files(next_subtask, project_dir)
+            # Pass spec_dir to enable auto-correction of wrong paths
+            validation_result = validate_subtask_files(
+                next_subtask, project_dir, spec_dir
+            )
            if not validation_result["success"]:
                # File validation failed - record error and skip session
                error_msg = validation_result["error"]
@@ -719,6 +1109,11 @@ async def run_autonomous_agent(
                        subtask_id,
                        f"File validation failed after {attempt_count} attempts: {error_msg}",
                    )
+                    emit_phase(
+                        ExecutionPhase.FAILED,
+                        f"Subtask {subtask_id} stuck: file validation failed",
+                        subtask=subtask_id,
+                    )
                    print_status(
                        f"Subtask {subtask_id} marked as STUCK after {attempt_count} failed validation attempts",
                        "error",
@@ -812,8 +1207,28 @@ async def run_autonomous_agent(
        if is_planning_phase and status != "error":
            valid, errors = _validate_and_fix_implementation_plan()
            if valid:
-                plan_validated = True
-                planning_retry_context = None
+                # Fix 5: Validate file paths in the newly created plan
+                path_issues = _validate_plan_file_paths(spec_dir, project_dir)
+                if (
+                    path_issues
+                    and planning_validation_failures < max_planning_validation_retries
+                ):
+                    planning_validation_failures += 1
+                    planning_retry_context = path_issues
+                    print_status(
+                        "Plan has invalid file paths - retrying planner",
+                        "warning",
+                    )
+                    first_run = True
+                    status = "continue"
+                else:
+                    if path_issues:
+                        logger.warning(
+                            f"Plan has uncorrectable file paths after "
+                            f"{planning_validation_failures} retries - proceeding anyway"
+                        )
+                    plan_validated = True
+                    planning_retry_context = None
            else:
                planning_validation_failures += 1
                if planning_validation_failures >= max_planning_validation_retries:
@@ -871,6 +1286,11 @@ async def run_autonomous_agent(
                recovery_manager.mark_subtask_stuck(
                    subtask_id, f"Failed after {attempt_count} attempts"
                )
+                emit_phase(
+                    ExecutionPhase.FAILED,
+                    f"Subtask {subtask_id} stuck after {attempt_count} attempts",
+                    subtask=subtask_id,
+                )
                print()
                print_status(
                    f"Subtask {subtask_id} marked as STUCK after {attempt_count} attempts",
@@ -1230,4 +1650,24 @@ async def run_autonomous_agent(
    if completed == total:
        status_manager.update(state=BuildState.COMPLETE)
    else:
-        status_manager.update(state=BuildState.PAUSED)
+        # Check if all remaining subtasks are stuck — if so, this is an error, not a pause
+        all_remaining_stuck = False
+        if stuck_subtasks:
+            stuck_ids = {s["subtask_id"] for s in stuck_subtasks}
+            plan = load_implementation_plan(spec_dir)
+            if plan:
+                all_remaining_stuck = True
+                for phase in plan.get("phases", []):
+                    for s in phase.get("subtasks", []):
+                        if s.get("status") != "completed":
+                            if s.get("id") not in stuck_ids:
+                                all_remaining_stuck = False
+                                break
+                    if not all_remaining_stuck:
+                        break
+
+        if all_remaining_stuck and stuck_subtasks:
+            emit_phase(ExecutionPhase.FAILED, "All remaining subtasks are stuck")
+            status_manager.update(state=BuildState.ERROR)
+        else:
+            status_manager.update(state=BuildState.PAUSED)
@@ -14,6 +14,7 @@ from core.error_utils import (
    is_authentication_error,
    is_rate_limit_error,
    is_tool_concurrency_error,
+    safe_receive_messages,
 )
 from core.file_utils import write_json_atomic
 from debug import debug, debug_detailed, debug_error, debug_section, debug_success
@@ -490,7 +491,7 @@ async def run_agent_session(
        # Collect response text and show tool use
        response_text = ""
        debug("session", "Starting to receive response stream...")
-        async for msg in client.receive_response():
+        async for msg in safe_receive_messages(client, caller="session"):
            msg_type = type(msg).__name__
            message_count += 1
            debug_detailed(
@@ -292,6 +292,14 @@ AGENT_CONFIGS = {
        "auto_claude_tools": [],
        "thinking_default": "high",
    },
+    "pr_followup_extraction": {
+        # Lightweight extraction call for recovering data when structured output fails
+        # Pure structured output extraction, no tools needed
+        "tools": [],
+        "mcp_servers": [],
+        "auto_claude_tools": [],
+        "thinking_default": "low",
+    },
    "pr_finding_validator": {
        # Standalone validator for re-checking findings against actual code
        # Called separately from orchestrator to validate findings with fresh context
@@ -31,6 +31,7 @@ class ProjectAnalyzer:
        """Run full project analysis."""
        self._detect_project_type()
        self._find_and_analyze_services()
+        self._aggregate_dependency_locations()
        self._analyze_infrastructure()
        self._detect_conventions()
        self._map_dependencies()
@@ -124,6 +125,63 @@ class ProjectAnalyzer:

        self.index["services"] = services

+    def _aggregate_dependency_locations(self) -> None:
+        """Aggregate dependency location metadata from all services.
+
+        Collects dependency_locations from each service and stores them as
+        paths relative to the project root (e.g., 'apps/backend/.venv'
+        instead of just '.venv').
+        """
+        aggregated: list[dict[str, Any]] = []
+
+        for service_name, service_info in self.index.get("services", {}).items():
+            service_deps = service_info.get("dependency_locations", [])
+            service_path = service_info.get("path", "")
+
+            # Compute service-relative prefix once per service
+            service_rel: Path | None = None
+            if service_path:
+                try:
+                    service_rel = Path(service_path).relative_to(self.project_dir)
+                except ValueError:
+                    # Service path is outside the project root — skip its deps
+                    # to avoid producing absolute paths that bypass containment
+                    continue
+
+            for dep in service_deps:
+                dep_path = dep.get("path")
+                if not dep_path:
+                    continue
+
+                # Build project-relative path from service path + dep path
+                if service_rel is not None:
+                    project_relative = str(service_rel / dep_path)
+                else:
+                    project_relative = dep_path
+
+                entry: dict[str, Any] = {
+                    "type": dep.get("type", "unknown"),
+                    "path": project_relative,
+                    "exists": dep.get("exists", False),
+                    "service": service_name,
+                }
+                if dep.get("requirements_file"):
+                    # Convert to project-relative path like we do for "path"
+                    if service_rel is not None:
+                        entry["requirements_file"] = str(
+                            service_rel / dep["requirements_file"]
+                        )
+                    else:
+                        entry["requirements_file"] = dep["requirements_file"]
+                pkg_mgr = dep.get("package_manager") or service_info.get(
+                    "package_manager"
+                )
+                if pkg_mgr:
+                    entry["package_manager"] = pkg_mgr
+                aggregated.append(entry)
+
+        self.index["dependency_locations"] = aggregated
+
    def _analyze_infrastructure(self) -> None:
        """Analyze infrastructure configuration."""
        infra = {}
@@ -40,6 +40,8 @@ class ServiceAnalyzer(BaseAnalyzer):
        self._find_key_directories()
        self._find_entry_points()
        self._detect_dependencies()
+        self._detect_dependency_locations()
+        self._detect_package_manager()
        self._detect_testing()
        self._find_dockerfile()

@@ -209,6 +211,121 @@ class ServiceAnalyzer(BaseAnalyzer):
                        deps.append(match.group(1))
            self.analysis["dependencies"] = deps[:20]

+    def _detect_dependency_locations(self) -> None:
+        """Detect where dependencies live on disk for this service."""
+        locations: list[dict[str, Any]] = []
+
+        # Node.js: node_modules (only if package.json exists)
+        if self._exists("package.json"):
+            node_modules = self.path / "node_modules"
+            locations.append(
+                {
+                    "type": "node_modules",
+                    "path": "node_modules",
+                    "exists": node_modules.exists() and node_modules.is_dir(),
+                }
+            )
+
+        # Python: .venv or venv
+        for venv_dir in [".venv", "venv"]:
+            venv_path = self.path / venv_dir
+            if venv_path.exists() and venv_path.is_dir():
+                entry: dict[str, Any] = {
+                    "type": "venv",
+                    "path": venv_dir,
+                    "exists": True,
+                }
+                # Find requirements file
+                for req_file in ["requirements.txt", "pyproject.toml", "Pipfile"]:
+                    if self._exists(req_file):
+                        entry["requirements_file"] = req_file
+                        break
+                locations.append(entry)
+                break
+        else:
+            # No venv found, still record requirements file if present
+            for req_file in ["requirements.txt", "pyproject.toml", "Pipfile"]:
+                if self._exists(req_file):
+                    locations.append(
+                        {
+                            "type": "venv",
+                            "path": ".venv",
+                            "exists": False,
+                            "requirements_file": req_file,
+                        }
+                    )
+                    break
+
+        # PHP: vendor
+        vendor_path = self.path / "vendor"
+        if vendor_path.exists() and vendor_path.is_dir():
+            locations.append(
+                {
+                    "type": "vendor_php",
+                    "path": "vendor",
+                    "exists": True,
+                }
+            )
+
+        # Rust: target
+        target_path = self.path / "target"
+        if target_path.exists() and target_path.is_dir():
+            locations.append(
+                {
+                    "type": "cargo_target",
+                    "path": "target",
+                    "exists": True,
+                }
+            )
+
+        # Ruby: vendor/bundle
+        bundle_path = self.path / "vendor" / "bundle"
+        if bundle_path.exists() and bundle_path.is_dir():
+            locations.append(
+                {
+                    "type": "vendor_bundle",
+                    "path": "vendor/bundle",
+                    "exists": True,
+                }
+            )
+
+        self.analysis["dependency_locations"] = locations
+
+    def _detect_package_manager(self) -> None:
+        """Detect the package manager used by this service."""
+        # Node.js package managers
+        if self._exists("package-lock.json"):
+            self.analysis["package_manager"] = "npm"
+        elif self._exists("yarn.lock"):
+            self.analysis["package_manager"] = "yarn"
+        elif self._exists("pnpm-lock.yaml"):
+            self.analysis["package_manager"] = "pnpm"
+        elif self._exists("bun.lockb") or self._exists("bun.lock"):
+            self.analysis["package_manager"] = "bun"
+        # Python package managers
+        elif self._exists("Pipfile"):
+            self.analysis["package_manager"] = "pipenv"
+        elif self._exists("pyproject.toml"):
+            if self._exists("uv.lock"):
+                self.analysis["package_manager"] = "uv"
+            elif self._exists("poetry.lock"):
+                self.analysis["package_manager"] = "poetry"
+            else:
+                self.analysis["package_manager"] = "pip"
+        elif self._exists("requirements.txt"):
+            self.analysis["package_manager"] = "pip"
+        # Other
+        elif self._exists("Cargo.toml"):
+            self.analysis["package_manager"] = "cargo"
+        elif self._exists("go.mod"):
+            self.analysis["package_manager"] = "go_mod"
+        elif self._exists("Gemfile"):
+            self.analysis["package_manager"] = "gem"
+        elif self._exists("composer.json"):
+            self.analysis["package_manager"] = "composer"
+        else:
+            self.analysis["package_manager"] = None
+
    def _detect_testing(self) -> None:
        """Detect testing framework and configuration."""
        if self._exists("package.json"):
@@ -10,6 +10,7 @@ import shutil
 import subprocess
 from pathlib import Path

+from qa.criteria import is_fixes_applied, is_qa_approved, is_qa_rejected
 from ui import highlight, print_status


@@ -151,13 +152,22 @@ def handle_batch_status_command(project_dir: str) -> bool:
            except json.JSONDecodeError:
                pass

-        # Determine status
-        if (spec_dir / "spec.md").exists():
-            status = "spec_created"
-        elif (spec_dir / "implementation_plan.json").exists():
-            status = "building"
-        elif (spec_dir / "qa_report.md").exists():
+        # Determine status (highest priority first)
+        # Use authoritative QA status check, not just file existence
+        if is_qa_approved(spec_dir):
            status = "qa_approved"
+        elif is_qa_rejected(spec_dir):
+            status = "qa_rejected"
+        elif is_fixes_applied(spec_dir):
+            status = "fixes_applied"
+        elif (spec_dir / "implementation_plan.json").exists():
+            # Check if there's a qa_report.md but no approval yet (QA in progress)
+            if (spec_dir / "qa_report.md").exists():
+                status = "qa_in_progress"
+            else:
+                status = "building"
+        elif (spec_dir / "spec.md").exists():
+            status = "spec_created"
        else:
            status = "pending_spec"

@@ -165,7 +175,10 @@ def handle_batch_status_command(project_dir: str) -> bool:
            "pending_spec": "⏳",
            "spec_created": "📋",
            "building": "⚙️",
+            "qa_in_progress": "🔍",
            "qa_approved": "✅",
+            "qa_rejected": "❌",
+            "fixes_applied": "🔧",
            "unknown": "❓",
        }.get(status, "❓")

@@ -192,10 +205,10 @@ def handle_batch_cleanup_command(project_dir: str, dry_run: bool = True) -> bool
        print_status("No specs directory found", "info")
        return True

-    # Find completed specs
+    # Find completed specs (only QA-approved, matching status display logic)
    completed = []
    for spec_dir in specs_dir.iterdir():
-        if spec_dir.is_dir() and (spec_dir / "qa_report.md").exists():
+        if spec_dir.is_dir() and is_qa_approved(spec_dir):
            completed.append(spec_dir.name)

    if not completed:
@@ -449,7 +449,7 @@ def _handle_build_interrupt(
        if choice == "skip":
            print()
            print_status("Resuming build...", "info")
-            status_manager.update(state=BuildState.RUNNING)
+            status_manager.update(state=BuildState.BUILDING)
            asyncio.run(
                run_autonomous_agent(
                    project_dir=working_dir,
@@ -101,8 +101,12 @@ def handle_qa_command(
            print("\n✅ Build already approved by QA.")
        else:
            completed, total = count_subtasks(spec_dir)
-            print(f"\n❌ Build not complete ({completed}/{total} subtasks).")
-            print("Complete all subtasks before running QA validation.")
+            print(
+                f"\n❌ Build not ready for QA ({completed}/{total} subtasks completed)."
+            )
+            print(
+                "All subtasks must reach a terminal state (completed, failed, or stuck) before running QA."
+            )
        return

    if has_human_feedback:
@@ -694,10 +694,25 @@ def get_auth_token(config_dir: str | None = None) -> str | None:
    Returns:
        Token string if found, None otherwise
    """
+    _debug = os.environ.get("DEBUG", "").lower() in ("true", "1")
+
+    if _debug:
+        # Log which auth env vars are set (presence only, never values)
+        set_vars = [v for v in AUTH_TOKEN_ENV_VARS if os.environ.get(v)]
+        logger.info(
+            "[Auth] get_auth_token() called — config_dir param=%s, "
+            "env vars present: %s, CLAUDE_CONFIG_DIR env=%s",
+            repr(config_dir),
+            set_vars or "(none)",
+            "set" if os.environ.get("CLAUDE_CONFIG_DIR") else "unset",
+        )
+
    # First check environment variables (highest priority)
    for var in AUTH_TOKEN_ENV_VARS:
        token = os.environ.get(var)
        if token:
+            if _debug:
+                logger.info("[Auth] Token resolved from env var: %s", var)
            return _try_decrypt_token(token)

    # Check CLAUDE_CONFIG_DIR environment variable (profile's custom config directory)
@@ -705,12 +720,13 @@ def get_auth_token(config_dir: str | None = None) -> str | None:
    effective_config_dir = config_dir or env_config_dir

    # Debug: Log which config_dir is being used for credential resolution
-    debug = os.environ.get("DEBUG", "").lower() in ("true", "1")
-    if debug and effective_config_dir:
+    if _debug and effective_config_dir:
        service_name = _get_keychain_service_name(effective_config_dir)
        logger.info(
-            f"[Auth] Resolving credentials for profile config_dir: {effective_config_dir} "
-            f"(Keychain service: {service_name})"
+            "[Auth] Resolving credentials for profile config_dir: %s "
+            "(Keychain service: %s)",
+            effective_config_dir,
+            service_name,
        )

    # If a custom config directory is specified, read from there first
@@ -718,24 +734,37 @@ def get_auth_token(config_dir: str | None = None) -> str | None:
        # Try reading from .credentials.json file in the config directory
        token = _get_token_from_config_dir(effective_config_dir)
        if token:
+            if _debug:
+                logger.info(
+                    "[Auth] Token resolved from config dir file: %s",
+                    effective_config_dir,
+                )
            return _try_decrypt_token(token)

        # Also try the system credential store with hash-based service name
        # This is needed because macOS stores credentials in Keychain, not files
        token = get_token_from_keychain(effective_config_dir)
        if token:
+            if _debug:
+                logger.info("[Auth] Token resolved from Keychain (profile-specific)")
            return _try_decrypt_token(token)

        # If config_dir was explicitly provided, DON'T fall back to default keychain
        # - that would return the wrong profile's token
        logger.debug(
-            f"No credentials found for config_dir '{effective_config_dir}' "
-            "in file or keychain"
+            "No credentials found for config_dir '%s' in file or keychain",
+            effective_config_dir,
        )
        return None

    # No config_dir specified - use default system credential store
-    return _try_decrypt_token(get_token_from_keychain())
+    keychain_token = get_token_from_keychain()
+    if _debug:
+        logger.info(
+            "[Auth] Token resolved from default Keychain: %s",
+            "found" if keychain_token else "not found",
+        )
+    return _try_decrypt_token(keychain_token)


 def get_auth_token_source(config_dir: str | None = None) -> str | None:
@@ -970,8 +999,18 @@ def configure_sdk_authentication(config_dir: str | None = None) -> None:
                   - API profile mode: requires ANTHROPIC_AUTH_TOKEN
                   - OAuth mode: requires CLAUDE_CODE_OAUTH_TOKEN (from Keychain or env)
    """
+    _debug = os.environ.get("DEBUG", "").lower() in ("true", "1")
    api_profile_mode = bool(os.environ.get("ANTHROPIC_BASE_URL", "").strip())

+    if _debug:
+        logger.info(
+            "[Auth] configure_sdk_authentication() — mode=%s, config_dir=%s, "
+            "CLAUDE_CONFIG_DIR env=%s",
+            "api_profile" if api_profile_mode else "oauth",
+            repr(config_dir),
+            "set" if os.environ.get("CLAUDE_CONFIG_DIR") else "unset",
+        )
+
    if api_profile_mode:
        # API profile mode: ensure ANTHROPIC_AUTH_TOKEN is present
        if not os.environ.get("ANTHROPIC_AUTH_TOKEN"):
@@ -999,6 +1038,14 @@ def configure_sdk_authentication(config_dir: str | None = None) -> None:
        os.environ["CLAUDE_CODE_OAUTH_TOKEN"] = oauth_token
        logger.info("Using OAuth authentication")

+        if _debug:
+            logger.info(
+                "[Auth] SDK env check — CLAUDE_CONFIG_DIR=%s, "
+                "CLAUDE_CODE_OAUTH_TOKEN=%s",
+                "set" if os.environ.get("CLAUDE_CONFIG_DIR") else "unset",
+                "set" if os.environ.get("CLAUDE_CODE_OAUTH_TOKEN") else "unset",
+            )
+

 def ensure_claude_code_oauth_token() -> None:
    """
@@ -29,6 +29,89 @@ from core.platform import (

 logger = logging.getLogger(__name__)

+# =============================================================================
+# SDK Message Parser Patch
+# =============================================================================
+# The Claude Agent SDK's message_parser raises MessageParseError for unknown
+# message types (e.g., "rate_limit_event"). Since parse_message runs inside an
+# async generator, the exception kills the entire agent session stream.
+# Patch to log a warning and return a SystemMessage instead of crashing.
+# This is needed until the SDK natively handles all CLI message types.
+
+
+def _patch_sdk_message_parser() -> None:
+    """Patch the SDK's parse_message to handle unknown message types gracefully.
+
+    The Claude CLI may emit message types that the installed SDK version doesn't
+    recognize (e.g., rate_limit_event, usage_event). Without this patch, any
+    unrecognized type raises MessageParseError inside the SDK's async generator,
+    which terminates the entire response stream and kills the agent session.
+
+    The patch converts unknown types into SystemMessage objects with a
+    'unknown_<type>' subtype, which all message consumers silently skip.
+    """
+    try:
+        import claude_agent_sdk._internal.message_parser as _parser
+        from claude_agent_sdk._errors import MessageParseError
+        from claude_agent_sdk.types import SystemMessage
+
+        _original_parse = _parser.parse_message
+
+        def _patched_parse(data):
+            try:
+                return _original_parse(data)
+            except MessageParseError as e:
+                msg = str(e)
+                if "Unknown message type" in msg:
+                    msg_type = (
+                        data.get("type", "unknown")
+                        if isinstance(data, dict)
+                        else "unknown"
+                    )
+                    # Rate limit events deserve a visible warning; others just debug-level
+                    if "rate_limit" in msg_type:
+                        retry_after = (
+                            data.get("retry_after")
+                            or data.get("data", {}).get("retry_after")
+                            if isinstance(data, dict)
+                            else None
+                        )
+                        retry_info = (
+                            f" (retry_after={retry_after}s)" if retry_after else ""
+                        )
+                        logger.warning(
+                            f"Rate limit event received from CLI{retry_info} — "
+                            f"the SDK will handle backoff automatically"
+                        )
+                    else:
+                        logger.debug(
+                            f"SDK received unhandled message type '{msg_type}', skipping"
+                        )
+                    return SystemMessage(
+                        subtype=f"unknown_{msg_type}",
+                        data=data if isinstance(data, dict) else {},
+                    )
+                raise
+
+        _parser.parse_message = _patched_parse
+    except Exception as e:
+        logger.warning(f"Failed to patch SDK message parser: {e}")
+
+
+_patch_sdk_message_parser()
+
+# =============================================================================
+# Windows System Prompt Limits
+# =============================================================================
+# Windows CreateProcessW has a 32,768 character limit for the entire command line.
+# When CLAUDE.md is very large and passed as --system-prompt, the command can exceed
+# this limit, causing ERROR_FILE_NOT_FOUND. We cap CLAUDE.md content to stay safe.
+# 20,000 chars leaves ~12KB headroom for CLI overhead (model, tools, MCP config, etc.)
+WINDOWS_MAX_SYSTEM_PROMPT_CHARS = 20000
+WINDOWS_TRUNCATION_MESSAGE = (
+    "\n\n[... CLAUDE.md truncated due to Windows command-line length limit ...]"
+)
+
 # =============================================================================
 # Project Index Cache
 # =============================================================================
@@ -821,8 +904,31 @@ def create_client(
    if should_use_claude_md():
        claude_md_content = load_claude_md(project_dir)
        if claude_md_content:
+            # On Windows, the SDK passes system_prompt as a --system-prompt CLI argument.
+            # Windows CreateProcessW has a 32,768 character limit for the entire command line.
+            # When CLAUDE.md is very large, the command can exceed this limit, causing Windows
+            # to return ERROR_FILE_NOT_FOUND which the SDK misreports as "Claude Code not found".
+            # Cap CLAUDE.md content to keep total command line under the limit. (#1661)
+            was_truncated = False
+            if is_windows():
+                max_claude_md_chars = (
+                    WINDOWS_MAX_SYSTEM_PROMPT_CHARS
+                    - len(base_prompt)
+                    - len(WINDOWS_TRUNCATION_MESSAGE)
+                    - len("\n\n# Project Instructions (from CLAUDE.md)\n\n")
+                )
+                if len(claude_md_content) > max_claude_md_chars > 0:
+                    claude_md_content = (
+                        claude_md_content[:max_claude_md_chars]
+                        + WINDOWS_TRUNCATION_MESSAGE
+                    )
+                    print(
+                        "   - CLAUDE.md: truncated (exceeded Windows command-line limit)"
+                    )
+                    was_truncated = True
            base_prompt = f"{base_prompt}\n\n# Project Instructions (from CLAUDE.md)\n\n{claude_md_content}"
-            print("   - CLAUDE.md: included in system prompt")
+            if not was_truncated:
+                print("   - CLAUDE.md: included in system prompt")
        else:
            print("   - CLAUDE.md: not found in project root")
    else:
@@ -6,7 +6,17 @@ Common error detection and classification functions used across
 agent sessions, QA, and other modules.
 """

+from __future__ import annotations
+
+import logging
 import re
+from collections.abc import AsyncIterator
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from claude_agent_sdk.types import Message
+
+logger = logging.getLogger(__name__)


 def is_tool_concurrency_error(error: Exception) -> bool:
@@ -118,3 +128,61 @@ def is_authentication_error(error: Exception) -> bool:
            "please login again",
        ]
    )
+
+
+async def safe_receive_messages(
+    client,
+    *,
+    caller: str = "agent",
+) -> AsyncIterator[Message]:
+    """Iterate over SDK messages with resilience against unexpected errors.
+
+    The SDK's ``receive_response()`` async generator can terminate early if:
+    1. An unhandled message type slips past the monkey-patch (e.g., SDK upgrade
+       removes the patch surface).
+    2. A transient parse error corrupts a single message in the stream.
+    3. An unexpected ``StopAsyncIteration`` or runtime error occurs mid-stream.
+
+    This wrapper catches per-message errors, logs them, and continues yielding
+    subsequent messages so the agent session can complete its work.
+
+    It also detects rate-limit events (surfaced as ``SystemMessage`` with
+    subtype ``unknown_rate_limit_event``) and logs a user-visible warning.
+
+    Args:
+        client: A ``ClaudeSDKClient`` instance (must be inside ``async with``).
+        caller: Label for log messages (e.g., "session", "agent_runner").
+
+    Yields:
+        Parsed ``Message`` objects from the SDK response stream.
+    """
+    try:
+        async for msg in client.receive_response():
+            # Detect rate-limit events surfaced by the monkey-patch
+            msg_type = type(msg).__name__
+            if msg_type == "SystemMessage":
+                subtype = getattr(msg, "subtype", "")
+                if subtype.startswith("unknown_"):
+                    original_type = subtype[len("unknown_") :]
+                    if "rate_limit" in original_type:
+                        data = getattr(msg, "data", {})
+                        retry_after = data.get("retry_after") or data.get(
+                            "data", {}
+                        ).get("retry_after")
+                        retry_info = (
+                            f" (retry in {retry_after}s)" if retry_after else ""
+                        )
+                        logger.warning(f"[{caller}] Rate limit event{retry_info}")
+                    else:
+                        logger.debug(
+                            f"[{caller}] Skipping unknown SDK message type: {original_type}"
+                        )
+                    continue
+            yield msg
+    except GeneratorExit:
+        return
+    except Exception as e:
+        # If the generator itself raises (e.g., transport error), log and stop
+        # gracefully so callers can process whatever was collected so far.
+        logger.error(f"[{caller}] SDK response stream terminated unexpectedly: {e}")
+        return
@@ -9,8 +9,11 @@ Enhanced with colored output, icons, and better visual formatting.
 """

 import json
+import logging
 from pathlib import Path

+logger = logging.getLogger(__name__)
+
 from core.plan_normalization import normalize_subtask_aliases
 from ui import (
    Icons,
@@ -112,6 +115,65 @@ def is_build_complete(spec_dir: Path) -> bool:
    return total > 0 and completed == total


+def _load_stuck_subtask_ids(spec_dir: Path) -> set[str]:
+    """Load IDs of subtasks marked as stuck from attempt_history.json."""
+    stuck_subtask_ids: set[str] = set()
+    attempt_history_file = spec_dir / "memory" / "attempt_history.json"
+    if attempt_history_file.exists():
+        try:
+            with open(attempt_history_file, encoding="utf-8") as f:
+                attempt_history = json.load(f)
+            for entry in attempt_history.get("stuck_subtasks", []):
+                if "subtask_id" in entry:
+                    stuck_subtask_ids.add(entry["subtask_id"])
+        except (OSError, json.JSONDecodeError, UnicodeDecodeError):
+            # Corrupted attempt history is non-fatal; skip stuck-subtask filtering
+            pass
+    return stuck_subtask_ids
+
+
+def is_build_ready_for_qa(spec_dir: Path) -> bool:
+    """
+    Check if the build is ready for QA validation.
+
+    Unlike is_build_complete() which requires all subtasks to be "completed",
+    this function considers the build ready when all subtasks have reached
+    a terminal state: completed, failed, or stuck (exhausted retries in attempt_history.json).
+
+    Args:
+        spec_dir: Directory containing implementation_plan.json
+
+    Returns:
+        True if all subtasks are in a terminal state, False otherwise
+    """
+    plan_file = spec_dir / "implementation_plan.json"
+    if not plan_file.exists():
+        return False
+
+    stuck_subtask_ids = _load_stuck_subtask_ids(spec_dir)
+
+    try:
+        with open(plan_file, encoding="utf-8") as f:
+            plan = json.load(f)
+
+        total = 0
+        terminal = 0
+
+        for phase in plan.get("phases", []):
+            for subtask in phase.get("subtasks", []):
+                total += 1
+                status = subtask.get("status", "pending")
+                subtask_id = subtask.get("id")
+
+                if status in ("completed", "failed") or subtask_id in stuck_subtask_ids:
+                    terminal += 1
+
+        return total > 0 and terminal == total
+
+    except (OSError, json.JSONDecodeError, UnicodeDecodeError):
+        return False
+
+
 def get_progress_percentage(spec_dir: Path) -> float:
    """
    Get the progress as a percentage.
@@ -230,8 +292,8 @@ def print_progress_summary(spec_dir: Path, show_next: bool = True) -> None:
                        f"  {icon(Icons.ARROW_RIGHT)} Next: {highlight(next_id)} - {next_desc}"
                    )

-        except (OSError, json.JSONDecodeError, UnicodeDecodeError):
-            pass  # Ignore corrupted/unreadable progress files
+        except (OSError, json.JSONDecodeError, UnicodeDecodeError) as e:
+            logger.debug(f"Failed to load plan file for phase summary: {e}")
    else:
        print()
        print_status("No implementation subtasks yet - planner needs to run", "pending")
@@ -404,6 +466,8 @@ def get_next_subtask(spec_dir: Path) -> dict | None:
    """
    Find the next subtask to work on, respecting phase dependencies.

+    Skips subtasks that are marked as stuck in the recovery manager's attempt history.
+
    Args:
        spec_dir: Directory containing implementation_plan.json

@@ -415,6 +479,8 @@ def get_next_subtask(spec_dir: Path) -> dict | None:
    if not plan_file.exists():
        return None

+    stuck_subtask_ids = _load_stuck_subtask_ids(spec_dir)
+
    try:
        with open(plan_file, encoding="utf-8") as f:
            plan = json.load(f)
@@ -432,8 +498,11 @@ def get_next_subtask(spec_dir: Path) -> dict | None:
                str(phase_id_raw) if phase_id_raw is not None else f"unknown:{i}"
            )
            subtasks = phase.get("subtasks", phase.get("chunks", []))
+            # Stuck subtasks count as "resolved" for phase dependency purposes.
+            # This prevents one stuck subtask from blocking all downstream phases.
            phase_complete[phase_id_key] = all(
-                s.get("status") == "completed" for s in subtasks
+                s.get("status") == "completed" or s.get("id") in stuck_subtask_ids
+                for s in subtasks
            )

        # Find next available subtask
@@ -455,9 +524,15 @@ def get_next_subtask(spec_dir: Path) -> dict | None:
            if not deps_satisfied:
                continue

-            # Find first pending subtask in this phase
+            # Find first pending subtask in this phase (skip stuck subtasks)
            for subtask in phase.get("subtasks", phase.get("chunks", [])):
                status = subtask.get("status", "pending")
+                subtask_id = subtask.get("id")
+
+                # Skip stuck subtasks
+                if subtask_id in stuck_subtask_ids:
+                    continue
+
                if status in {"pending", "not_started", "not started"}:
                    subtask_out, _changed = normalize_subtask_aliases(subtask)
                    subtask_out["status"] = "pending"
@@ -186,14 +186,12 @@ def _before_send(event: dict, hint: dict) -> dict | None:

 def init_sentry(
    component: str = "backend",
-    force_enable: bool = False,
 ) -> bool:
    """
    Initialize Sentry for the Python backend.

    Args:
        component: Component name for tagging (e.g., "backend", "github-runner")
-        force_enable: Force enable even without packaged app detection

    Returns:
        True if Sentry was initialized, False otherwise
@@ -212,20 +210,11 @@ def init_sentry(
        logger.debug("[Sentry] No SENTRY_DSN configured - error reporting disabled")
        return False

-    # Check if we should enable Sentry
-    # Enable if:
-    # - Running from packaged app (detected by __compiled__ or frozen)
-    # - SENTRY_DEV=true is set
-    # - force_enable is True
+    # DSN is present (checked above), so Sentry should be enabled.
+    # The Electron main process only passes SENTRY_DSN to subprocesses in
+    # production builds, so its presence is sufficient to gate activation.
+    # In dev, set SENTRY_DSN in your environment to opt-in.
    is_packaged = getattr(sys, "frozen", False) or hasattr(sys, "__compiled__")
-    sentry_dev = os.environ.get("SENTRY_DEV", "").lower() in ("true", "1", "yes")
-    should_enable = is_packaged or sentry_dev or force_enable
-
-    if not should_enable:
-        logger.debug(
-            "[Sentry] Development mode - error reporting disabled (set SENTRY_DEV=true to enable)"
-        )
-        return False

    try:
        import sentry_sdk
@@ -0,0 +1,177 @@
+"""
+Dependency Strategy Mapping
+============================
+
+Maps dependency types to sharing strategies for worktree creation.
+
+Each dependency ecosystem has different constraints:
+
+- **node_modules**: Safe to symlink. Node's resolution algorithm follows symlinks
+  correctly, and the directory is self-contained.
+
+- **venv / .venv**: Symlinked for fast worktree creation. CPython bug #106045
+  (pyvenv.cfg symlink resolution) does not affect typical usage (running scripts,
+  imports, pip). A health check after symlinking verifies usability; if it fails,
+  the caller falls back to recreating the venv.
+
+- **vendor (PHP)**: Safe to symlink. Composer's autoloader uses ``__DIR__``-relative
+  paths that resolve correctly through symlinks.
+
+- **cargo target / go modules**: Skip entirely. Rust's ``target/`` dir contains
+  per-machine build artifacts that must be rebuilt. Go uses a global module cache
+  (``$GOPATH/pkg/mod``), so there is nothing in-tree to share.
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+from pathlib import Path, PurePosixPath, PureWindowsPath
+
+logger = logging.getLogger(__name__)
+
+from .models import DependencyShareConfig, DependencyStrategy
+
+# ---------------------------------------------------------------------------
+# Default strategy map
+# ---------------------------------------------------------------------------
+# Maps dependency type identifiers to the strategy that should be used when
+# sharing that dependency across worktrees.  Data-driven — add new entries
+# here rather than writing if/else branches.
+# ---------------------------------------------------------------------------
+
+DEFAULT_STRATEGY_MAP: dict[str, DependencyStrategy] = {
+    # JavaScript / Node.js — symlink is safe and fast
+    "node_modules": DependencyStrategy.SYMLINK,
+    # Python — symlink for fast worktree creation (health check + fallback to recreate)
+    "venv": DependencyStrategy.SYMLINK,
+    ".venv": DependencyStrategy.SYMLINK,
+    # PHP — Composer vendor dir is safe to symlink
+    "vendor_php": DependencyStrategy.SYMLINK,
+    # Ruby — Bundler vendor/bundle is safe to symlink
+    "vendor_bundle": DependencyStrategy.SYMLINK,
+    # Rust — build output dir, skip (rebuilt per-worktree)
+    "cargo_target": DependencyStrategy.SKIP,
+    # Go — global module cache, nothing in-tree to share
+    "go_modules": DependencyStrategy.SKIP,
+}
+
+
+def get_dependency_configs(
+    project_index: dict | None,
+    project_dir: Path | None = None,
+) -> list[DependencyShareConfig]:
+    """Derive dependency share configs from a project index.
+
+    If *project_index* is ``None`` or lacks ``dependency_locations``,
+    falls back to a hardcoded node_modules config for backward compatibility
+    with existing worktree setups.
+
+    Args:
+        project_index: Parsed ``project_index.json`` dict, or ``None``.
+        project_dir: Project root directory for resolved-path containment
+            checks (defense-in-depth).  Should always be provided when
+            *project_index* is not ``None`` — omitting it disables the
+            resolved-path security check.
+
+    Returns:
+        List of :class:`DependencyShareConfig` objects — one per discovered
+        dependency location.
+    """
+
+    configs: list[DependencyShareConfig] = []
+    seen: set[str] = set()
+
+    if project_index is not None:
+        if project_dir is None:
+            logger.warning(
+                "get_dependency_configs called with project_index but no "
+                "project_dir — resolved-path containment check is disabled"
+            )
+
+        # Use the aggregated top-level dependency_locations which already
+        # contain project-relative paths (e.g. "apps/backend/.venv" instead
+        # of just ".venv").  This avoids a monorepo path resolution bug
+        # where service-relative paths were incorrectly treated as project-
+        # relative.
+        dep_locations = project_index.get("dependency_locations") or []
+        for dep in dep_locations:
+            if not isinstance(dep, dict):
+                continue
+
+            dep_type = dep.get("type", "")
+            rel_path = dep.get("path", "")
+
+            if not dep_type or not rel_path:
+                continue
+
+            # Path containment: reject absolute paths and traversals.
+            # Check both POSIX and Windows path styles for cross-platform safety.
+            p = PurePosixPath(rel_path)
+            if p.is_absolute() or PureWindowsPath(rel_path).is_absolute():
+                continue
+            if ".." in p.parts or ".." in PureWindowsPath(rel_path).parts:
+                continue
+
+            # Defense-in-depth: verify the resolved path stays within project_dir
+            if project_dir is not None:
+                resolved = (project_dir / rel_path).resolve()
+                if not str(resolved).startswith(str(project_dir.resolve()) + os.sep):
+                    continue
+
+            # Deduplicate by relative path
+            if rel_path in seen:
+                continue
+            seen.add(rel_path)
+
+            strategy = DEFAULT_STRATEGY_MAP.get(dep_type, DependencyStrategy.SKIP)
+
+            # Validate requirements_file path containment too
+            req_file = dep.get("requirements_file")
+            if req_file:
+                rp = PurePosixPath(req_file)
+                if (
+                    rp.is_absolute()
+                    or PureWindowsPath(req_file).is_absolute()
+                    or ".." in rp.parts
+                    or ".." in PureWindowsPath(req_file).parts
+                ):
+                    req_file = None
+
+                # Defense-in-depth: resolved-path containment (matches rel_path check)
+                if req_file and project_dir is not None:
+                    resolved_req = (project_dir / req_file).resolve()
+                    if not str(resolved_req).startswith(
+                        str(project_dir.resolve()) + os.sep
+                    ):
+                        req_file = None
+
+            configs.append(
+                DependencyShareConfig(
+                    dep_type=dep_type,
+                    strategy=strategy,
+                    source_rel_path=rel_path,
+                    requirements_file=req_file,
+                    package_manager=dep.get("package_manager"),
+                )
+            )
+
+    # Fallback: if no configs were discovered, default to node_modules-only
+    # so existing worktree behaviour is preserved.
+    if not configs:
+        configs.append(
+            DependencyShareConfig(
+                dep_type="node_modules",
+                strategy=DependencyStrategy.SYMLINK,
+                source_rel_path="node_modules",
+            )
+        )
+        configs.append(
+            DependencyShareConfig(
+                dep_type="node_modules",
+                strategy=DependencyStrategy.SYMLINK,
+                source_rel_path="apps/frontend/node_modules",
+            )
+        )
+
+    return configs
@@ -273,3 +273,30 @@ class SpecNumberLock:
                pass

        return max_num
+
+
+class DependencyStrategy(Enum):
+    """Strategy for sharing dependency directories across worktrees.
+
+    SYMLINK is fast and now safe for Python venvs with runtime health checks.
+    A post-symlink health check validates the venv is usable, automatically
+    falling back to RECREATE if the symlink is broken. This works around
+    CPython's pyvenv.cfg discovery issue (CPython bug #106045) while maintaining
+    fast worktree creation in the common case where symlinking succeeds.
+    """
+
+    SYMLINK = "symlink"  # Create a symlink to the source (fast, works for node_modules)
+    RECREATE = "recreate"  # Re-run the package manager to create a fresh copy
+    COPY = "copy"  # Deep-copy the directory (slow but always correct)
+    SKIP = "skip"  # Do nothing; let the agent handle it
+
+
+@dataclass
+class DependencyShareConfig:
+    """Configuration for how a specific dependency type should be shared."""
+
+    dep_type: str  # e.g. "node_modules", "venv", ".venv"
+    strategy: DependencyStrategy
+    source_rel_path: str  # Relative path from project root, e.g. "node_modules"
+    requirements_file: str | None = None  # e.g. "requirements.txt", "pyproject.toml"
+    package_manager: str | None = None  # e.g. "npm", "uv", "pip"
@@ -14,6 +14,7 @@ import sys
 from pathlib import Path

 from core.git_executable import run_git
+from core.platform import is_windows
 from merge import FileTimelineTracker
 from security.constants import ALLOWLIST_FILENAME, PROFILE_FILENAME
 from ui import (
@@ -28,8 +29,9 @@ from ui import (
 )
 from worktree import WorktreeManager

+from .dependency_strategy import get_dependency_configs
 from .git_utils import has_uncommitted_changes
-from .models import WorkspaceMode
+from .models import DependencyShareConfig, DependencyStrategy, WorkspaceMode

 # Import debug utilities
 try:
@@ -48,6 +50,10 @@ _git_hook_check_done = False

 MODULE = "workspace.setup"

+# Marker file written inside a recreated venv to indicate setup completed successfully.
+# If the marker is absent, the venv is treated as incomplete and will be rebuilt.
+VENV_SETUP_COMPLETE_MARKER = ".setup_complete"
+

 def choose_workspace(
    project_dir: Path,
@@ -189,11 +195,37 @@ def symlink_node_modules_to_worktree(
    """
    Symlink node_modules directories from project root to worktree.

-    This ensures the worktree has access to dependencies for TypeScript checks
-    and other tooling without requiring a separate npm install.
+    .. deprecated::
+        Use :func:`setup_worktree_dependencies` instead, which handles all
+        dependency types (node_modules, venvs, vendor dirs, etc.) via
+        strategy-based dispatch.

-    Works with npm workspace hoisting where dependencies are hoisted to root
-    and workspace-specific dependencies remain in nested node_modules.
+    This is a thin backward-compatibility wrapper that delegates to
+    ``setup_worktree_dependencies()`` with no project index (fallback mode).
+
+    Args:
+        project_dir: The main project directory
+        worktree_path: Path to the worktree
+
+    Returns:
+        List of symlinked paths (relative to worktree)
+    """
+    results = setup_worktree_dependencies(
+        project_dir, worktree_path, project_index=None
+    )
+    # Flatten all processed paths for backward-compatible return value
+    return [path for paths in results.values() for path in paths]
+
+
+def symlink_claude_config_to_worktree(
+    project_dir: Path, worktree_path: Path
+) -> list[str]:
+    """
+    Symlink .claude/ directory from project root to worktree.
+
+    This ensures the worktree has access to Claude Code configuration
+    (settings, CLAUDE.md, MCP servers, etc.) so that terminals opened
+    in the worktree behave identically to the project root.

    Args:
        project_dir: The main project directory
@@ -204,81 +236,52 @@ def symlink_node_modules_to_worktree(
    """
    symlinked = []

-    # Node modules locations to symlink for TypeScript and tooling support.
-    # These are the standard locations for this monorepo structure.
-    #
-    # Design rationale:
-    # - Hardcoded paths are intentional for simplicity and reliability
-    # - Dynamic discovery (reading workspaces from package.json) would add complexity
-    #   and potential failure points without significant benefit
-    # - This monorepo uses npm workspaces with hoisting, so dependencies are primarily
-    #   in root node_modules with workspace-specific deps in apps/frontend/node_modules
-    #
-    # To add new workspace locations:
-    # 1. Add (source_rel, target_rel) tuple below
-    # 2. Update the parallel TypeScript implementation in
-    #    apps/frontend/src/main/ipc-handlers/terminal/worktree-handlers.ts
-    # 3. Update the pre-commit hook check in .husky/pre-commit if needed
-    node_modules_locations = [
-        ("node_modules", "node_modules"),
-        ("apps/frontend/node_modules", "apps/frontend/node_modules"),
-    ]
+    source_path = project_dir / ".claude"
+    target_path = worktree_path / ".claude"

-    for source_rel, target_rel in node_modules_locations:
-        source_path = project_dir / source_rel
-        target_path = worktree_path / target_rel
+    # Skip if source doesn't exist
+    if not source_path.exists():
+        debug(MODULE, "Skipping .claude/ - source does not exist")
+        return symlinked

-        # Skip if source doesn't exist
-        if not source_path.exists():
-            debug(MODULE, f"Skipping {source_rel} - source does not exist")
-            continue
+    # Skip if target already exists
+    if target_path.exists():
+        debug(MODULE, "Skipping .claude/ - target already exists")
+        return symlinked

-        # Skip if target already exists (don't overwrite existing node_modules)
-        if target_path.exists():
-            debug(MODULE, f"Skipping {target_rel} - target already exists")
-            continue
+    # Also skip if target is a symlink (even if broken)
+    if target_path.is_symlink():
+        debug(MODULE, "Skipping .claude/ - symlink already exists (possibly broken)")
+        return symlinked

-        # Also skip if target is a symlink (even if broken - exists() returns False for broken symlinks)
-        if target_path.is_symlink():
-            debug(
-                MODULE,
-                f"Skipping {target_rel} - symlink already exists (possibly broken)",
-            )
-            continue
-
-        # Ensure parent directory exists
-        target_path.parent.mkdir(parents=True, exist_ok=True)
-
-        try:
-            if sys.platform == "win32":
-                # On Windows, use junctions instead of symlinks (no admin rights required)
-                # Junctions require absolute paths
-                result = subprocess.run(
-                    ["cmd", "/c", "mklink", "/J", str(target_path), str(source_path)],
-                    capture_output=True,
-                    text=True,
-                )
-                if result.returncode != 0:
-                    raise OSError(result.stderr or "mklink /J failed")
-            else:
-                # On macOS/Linux, use relative symlinks for portability
-                relative_source = os.path.relpath(source_path, target_path.parent)
-                os.symlink(relative_source, target_path)
-            symlinked.append(target_rel)
-            debug(MODULE, f"Symlinked {target_rel} -> {source_path}")
-        except OSError as e:
-            # Symlink/junction creation can fail on some systems (e.g., FAT32 filesystem)
-            # Log warning but don't fail - worktree is still usable, just without
-            # TypeScript checking
-            debug_warning(
-                MODULE,
-                f"Could not symlink {target_rel}: {e}. TypeScript checks may fail.",
-            )
-            # Warn user - pre-commit hooks may fail without dependencies
-            print_status(
-                f"Warning: Could not link {target_rel} - TypeScript checks may fail",
-                "warning",
+    # Ensure parent directory exists
+    target_path.parent.mkdir(parents=True, exist_ok=True)
+
+    try:
+        if sys.platform == "win32":
+            # On Windows, use junctions instead of symlinks (no admin rights required)
+            result = subprocess.run(
+                ["cmd", "/c", "mklink", "/J", str(target_path), str(source_path)],
+                capture_output=True,
+                text=True,
            )
+            if result.returncode != 0:
+                raise OSError(result.stderr or "mklink /J failed")
+        else:
+            # On macOS/Linux, use relative symlinks for portability
+            relative_source = os.path.relpath(source_path, target_path.parent)
+            os.symlink(relative_source, target_path)
+        symlinked.append(".claude")
+        debug(MODULE, f"Symlinked .claude/ -> {source_path}")
+    except OSError as e:
+        debug_warning(
+            MODULE,
+            f"Could not symlink .claude/: {e}. Claude Code features may not work in worktree terminals.",
+        )
+        print_status(
+            "Warning: Could not link .claude/ - Claude Code features may not work in terminals",
+            "warning",
+        )

    return symlinked

@@ -374,13 +377,33 @@ def setup_workspace(
            f"Environment files copied: {', '.join(copied_env_files)}", "success"
        )

-    # Symlink node_modules to worktree for TypeScript and tooling support
-    # This allows pre-commit hooks to run typecheck without npm install in worktree
-    symlinked_modules = symlink_node_modules_to_worktree(
+    # Set up dependencies in worktree using strategy-based dispatch
+    # Load project index if available for ecosystem-aware dependency handling
+    project_index = None
+    project_index_path = project_dir / ".auto-claude" / "project_index.json"
+    if project_index_path.is_file():
+        try:
+            with open(project_index_path, encoding="utf-8") as f:
+                project_index = json.load(f)
+            debug(MODULE, "Loaded project_index.json for dependency setup")
+        except (OSError, json.JSONDecodeError) as e:
+            debug_warning(MODULE, f"Could not load project_index.json: {e}")
+
+    dep_results = setup_worktree_dependencies(
+        project_dir, worktree_info.path, project_index=project_index
+    )
+    for strategy_name, paths in dep_results.items():
+        if paths:
+            print_status(
+                f"Dependencies ({strategy_name}): {', '.join(paths)}", "success"
+            )
+
+    # Symlink .claude/ config to worktree for Claude Code features (settings, commands, etc.)
+    symlinked_claude = symlink_claude_config_to_worktree(
        project_dir, worktree_info.path
    )
-    if symlinked_modules:
-        print_status(f"Dependencies linked: {', '.join(symlinked_modules)}", "success")
+    if symlinked_claude:
+        print_status(f"Claude config linked: {', '.join(symlinked_claude)}", "success")

    # Copy security configuration files if they exist
    # Note: Unlike env files, security files always overwrite to ensure
@@ -574,6 +597,409 @@ def initialize_timeline_tracking(
        print(muted(f"  Note: Timeline tracking could not be initialized: {e}"))


+def setup_worktree_dependencies(
+    project_dir: Path,
+    worktree_path: Path,
+    project_index: dict | None = None,
+) -> dict[str, list[str]]:
+    """
+    Set up dependencies in a worktree using strategy-based dispatch.
+
+    Reads dependency configs from the project index and applies the correct
+    strategy for each: symlink, recreate, copy, or skip.
+
+    All operations are non-blocking — failures produce warnings but do not
+    prevent worktree creation.
+
+    Args:
+        project_dir: The main project directory
+        worktree_path: Path to the worktree
+        project_index: Parsed project_index.json dict, or None
+
+    Returns:
+        Dict mapping strategy names to lists of paths that were processed.
+    """
+    configs = get_dependency_configs(project_index, project_dir=project_dir)
+    results: dict[str, list[str]] = {}
+
+    for config in configs:
+        strategy_name = config.strategy.value
+        if strategy_name not in results:
+            results[strategy_name] = []
+
+        try:
+            performed = False
+            if config.strategy == DependencyStrategy.SYMLINK:
+                performed = _apply_symlink_strategy(project_dir, worktree_path, config)
+                # For venvs, verify the symlink is usable — fall back to recreate
+                # Run health check whenever a venv symlink exists (not just on creation)
+                if config.dep_type in ("venv", ".venv"):
+                    venv_path = worktree_path / config.source_rel_path
+                    # Check if venv exists (symlinked or otherwise)
+                    if venv_path.exists() or venv_path.is_symlink():
+                        if is_windows():
+                            python_bin = str(venv_path / "Scripts" / "python.exe")
+                        else:
+                            python_bin = str(venv_path / "bin" / "python")
+                        try:
+                            subprocess.run(
+                                [python_bin, "-c", "import sys; print(sys.prefix)"],
+                                capture_output=True,
+                                text=True,
+                                timeout=10,
+                                check=True,
+                            )
+                            debug(
+                                MODULE,
+                                f"Symlinked venv health check passed: {config.source_rel_path}",
+                            )
+                        except (subprocess.SubprocessError, OSError):
+                            debug_warning(
+                                MODULE,
+                                f"Symlinked venv health check failed, falling back to recreate: {config.source_rel_path}",
+                            )
+                            # Remove the broken symlink and recreate
+                            try:
+                                if venv_path.is_symlink():
+                                    venv_path.unlink()
+                                elif venv_path.exists():
+                                    shutil.rmtree(venv_path, ignore_errors=True)
+                            except OSError:
+                                pass  # Best-effort removal; recreate strategy handles existing paths
+                            performed = _apply_recreate_strategy(
+                                project_dir, worktree_path, config
+                            )
+                            # Update strategy name to reflect fallback
+                            if performed:
+                                strategy_name = "recreate"
+                                # Ensure the key exists for the fallback strategy
+                                results.setdefault(strategy_name, [])
+            elif config.strategy == DependencyStrategy.RECREATE:
+                performed = _apply_recreate_strategy(project_dir, worktree_path, config)
+            elif config.strategy == DependencyStrategy.COPY:
+                performed = _apply_copy_strategy(project_dir, worktree_path, config)
+            elif config.strategy == DependencyStrategy.SKIP:
+                _apply_skip_strategy(config)
+                # Don't record skipped entries — only report actual work
+                continue
+            if performed:
+                results[strategy_name].append(config.source_rel_path)
+        except Exception as e:
+            debug_warning(
+                MODULE,
+                f"Failed to apply {strategy_name} strategy for "
+                f"{config.source_rel_path}: {e}",
+            )
+
+    return results
+
+
+def _apply_symlink_strategy(
+    project_dir: Path,
+    worktree_path: Path,
+    config: DependencyShareConfig,
+) -> bool:
+    """Create a symlink (or Windows junction) from worktree to project source.
+
+    Returns True if a symlink was created, False if skipped.
+    """
+    source_path = project_dir / config.source_rel_path
+    target_path = worktree_path / config.source_rel_path
+
+    if not source_path.exists():
+        debug(MODULE, f"Skipping symlink {config.source_rel_path} - source missing")
+        return False
+
+    if target_path.exists() or target_path.is_symlink():
+        debug(MODULE, f"Skipping symlink {config.source_rel_path} - target exists")
+        return False
+
+    target_path.parent.mkdir(parents=True, exist_ok=True)
+
+    try:
+        if is_windows():
+            # Windows: use directory junctions (no admin rights required).
+            # os.symlink creates a directory symlink that needs admin/DevMode,
+            # so we use mklink /J which creates a junction without privileges.
+            result = subprocess.run(
+                ["cmd", "/c", "mklink", "/J", str(target_path), str(source_path)],
+                capture_output=True,
+                text=True,
+                timeout=30,
+            )
+            if result.returncode != 0:
+                raise OSError(result.stderr or "mklink /J failed")
+        else:
+            # macOS/Linux: relative symlinks for portability
+            relative_source = os.path.relpath(source_path, target_path.parent)
+            os.symlink(relative_source, target_path)
+        debug(MODULE, f"Symlinked {config.source_rel_path} -> {source_path}")
+        return True
+    except subprocess.TimeoutExpired:
+        debug_warning(
+            MODULE,
+            f"Symlink creation timed out for {config.source_rel_path}",
+        )
+        print_status(
+            f"Warning: Symlink creation timed out for {config.source_rel_path}",
+            "warning",
+        )
+        return False
+    except OSError as e:
+        debug_warning(
+            MODULE,
+            f"Could not symlink {config.source_rel_path}: {e}",
+        )
+        print_status(f"Warning: Could not link {config.source_rel_path}", "warning")
+        return False
+
+
+def _popen_with_cleanup(
+    cmd: list[str],
+    timeout: int,
+    label: str,
+) -> tuple[int, str, str]:
+    """Run a command via Popen with proper process cleanup on timeout.
+
+    On timeout: terminate → wait(10) → kill → wait(5) to ensure file locks
+    are released before any cleanup (e.g. shutil.rmtree).
+
+    Returns (returncode, stdout, stderr).
+    Raises subprocess.TimeoutExpired if the command exceeds the given timeout (after cleanup is attempted).
+    """
+    proc = subprocess.Popen(
+        cmd,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        text=True,
+    )
+    try:
+        stdout, stderr = proc.communicate(timeout=timeout)
+        return proc.returncode, stdout, stderr
+    except subprocess.TimeoutExpired:
+        debug_warning(MODULE, f"{label} timed out, terminating process")
+        proc.terminate()
+        try:
+            proc.communicate(timeout=10)
+        except subprocess.TimeoutExpired:
+            debug_warning(MODULE, f"{label} did not terminate, killing process")
+            proc.kill()
+            try:
+                proc.communicate(timeout=5)
+            except subprocess.TimeoutExpired:
+                # Final cleanup attempt if kill() also hangs
+                debug_warning(MODULE, f"{label} could not be stopped even after kill()")
+        raise
+    finally:
+        # Ensure pipes are closed and process is reaped to avoid zombie processes
+        if proc.stdout:
+            proc.stdout.close()
+        if proc.stderr:
+            proc.stderr.close()
+        try:
+            proc.wait(timeout=0.1)
+        except subprocess.TimeoutExpired:
+            pass  # Process still running, already logged warning above
+
+
+def _apply_recreate_strategy(
+    project_dir: Path,
+    worktree_path: Path,
+    config: DependencyShareConfig,
+) -> bool:
+    """Create a fresh virtual environment in the worktree and install deps.
+
+    Returns True if the venv was successfully created, False if skipped or failed.
+    """
+    venv_path = worktree_path / config.source_rel_path
+    marker_path = venv_path / VENV_SETUP_COMPLETE_MARKER
+
+    # Check for broken symlinks that exists() would miss
+    if venv_path.is_symlink() and not venv_path.exists():
+        debug(MODULE, f"Removing broken symlink at {config.source_rel_path}")
+        try:
+            venv_path.unlink()
+        except OSError:
+            pass  # Best-effort removal
+    elif venv_path.exists():
+        if marker_path.exists():
+            debug(
+                MODULE,
+                f"Skipping recreate {config.source_rel_path} - already complete (marker present)",
+            )
+            return False
+        # Venv exists but marker is missing — incomplete, remove and rebuild
+        debug(MODULE, f"Removing incomplete venv {config.source_rel_path} (no marker)")
+        shutil.rmtree(venv_path, ignore_errors=True)
+
+    # Detect Python executable from the source venv or fall back to sys.executable
+    source_venv = project_dir / config.source_rel_path
+    python_exec = sys.executable
+
+    if source_venv.exists():
+        # Try to use the same Python version as the source venv
+        for candidate in ("bin/python", "Scripts/python.exe"):
+            candidate_path = source_venv / candidate
+            if candidate_path.exists():
+                python_exec = str(candidate_path.resolve())
+                break
+
+    # Create the venv
+    try:
+        debug(MODULE, f"Creating venv at {venv_path}")
+        returncode, _, stderr = _popen_with_cleanup(
+            [python_exec, "-m", "venv", str(venv_path)],
+            timeout=120,
+            label=f"venv creation ({config.source_rel_path})",
+        )
+        if returncode != 0:
+            debug_warning(MODULE, f"venv creation failed: {stderr}")
+            print_status(
+                f"Warning: Could not create venv at {config.source_rel_path}",
+                "warning",
+            )
+            if venv_path.exists():
+                shutil.rmtree(venv_path, ignore_errors=True)
+            return False
+    except subprocess.TimeoutExpired:
+        print_status(
+            f"Warning: venv creation timed out for {config.source_rel_path}",
+            "warning",
+        )
+        if venv_path.exists():
+            shutil.rmtree(venv_path, ignore_errors=True)
+        return False
+    except OSError as e:
+        debug_warning(MODULE, f"venv creation failed: {e}")
+        print_status(
+            f"Warning: Could not create venv at {config.source_rel_path}",
+            "warning",
+        )
+        if venv_path.exists():
+            shutil.rmtree(venv_path, ignore_errors=True)
+        return False
+
+    # Install from requirements file if specified
+    req_file = config.requirements_file
+    if req_file:
+        req_path = project_dir / req_file
+        if req_path.is_file():
+            # Determine pip executable inside the new venv
+            if is_windows():
+                pip_exec = str(venv_path / "Scripts" / "pip.exe")
+            else:
+                pip_exec = str(venv_path / "bin" / "pip")
+
+            # Build install command based on file type
+            req_basename = Path(req_file).name
+            if req_basename == "pyproject.toml":
+                # pyproject.toml: snapshot-install from the worktree copy.
+                # Non-editable so the venv doesn't symlink back to the source.
+                worktree_req = worktree_path / req_file
+                install_dir = str(
+                    worktree_req.parent if worktree_req.is_file() else req_path.parent
+                )
+                install_cmd = [pip_exec, "install", install_dir]
+            elif req_basename == "Pipfile":
+                # Pipfile: not directly installable via pip, skip
+                debug(
+                    MODULE,
+                    f"Skipping Pipfile-based install for {req_file} "
+                    "(use pipenv in the worktree)",
+                )
+                install_cmd = None
+            else:
+                # requirements.txt or similar: pip install -r
+                install_cmd = [pip_exec, "install", "-r", str(req_path)]
+
+            if install_cmd:
+                try:
+                    debug(MODULE, f"Installing deps from {req_file}")
+                    returncode, _, stderr = _popen_with_cleanup(
+                        install_cmd,
+                        timeout=300,
+                        label=f"pip install ({req_file})",
+                    )
+                    if returncode != 0:
+                        debug_warning(
+                            MODULE,
+                            f"pip install failed (exit {returncode}): {stderr}",
+                        )
+                        print_status(
+                            f"Warning: Dependency install failed for {req_file}",
+                            "warning",
+                        )
+                        if venv_path.exists():
+                            shutil.rmtree(venv_path, ignore_errors=True)
+                        return False
+                except subprocess.TimeoutExpired:
+                    print_status(
+                        f"Warning: Dependency install timed out for {req_file}",
+                        "warning",
+                    )
+                    if venv_path.exists():
+                        shutil.rmtree(venv_path, ignore_errors=True)
+                    return False
+                except OSError as e:
+                    debug_warning(MODULE, f"pip install failed: {e}")
+                    if venv_path.exists():
+                        shutil.rmtree(venv_path, ignore_errors=True)
+                    return False
+
+    # Write completion marker so future runs know this venv is complete
+    try:
+        marker_path.touch()
+    except OSError as e:
+        debug_warning(
+            MODULE, f"Failed to write completion marker at {marker_path}: {e}"
+        )
+
+    debug(MODULE, f"Recreated venv at {config.source_rel_path}")
+    return True
+
+
+def _apply_copy_strategy(
+    project_dir: Path,
+    worktree_path: Path,
+    config: DependencyShareConfig,
+) -> bool:
+    """Deep-copy a dependency directory from project to worktree.
+
+    Returns True if the copy was performed, False if skipped.
+    """
+    source_path = project_dir / config.source_rel_path
+    target_path = worktree_path / config.source_rel_path
+
+    if not source_path.exists():
+        debug(MODULE, f"Skipping copy {config.source_rel_path} - source missing")
+        return False
+
+    if target_path.exists():
+        debug(MODULE, f"Skipping copy {config.source_rel_path} - target exists")
+        return False
+
+    target_path.parent.mkdir(parents=True, exist_ok=True)
+
+    try:
+        if source_path.is_file():
+            shutil.copy2(source_path, target_path)
+        else:
+            shutil.copytree(source_path, target_path)
+        debug(MODULE, f"Copied {config.source_rel_path} to worktree")
+        return True
+    except (OSError, shutil.Error) as e:
+        debug_warning(MODULE, f"Could not copy {config.source_rel_path}: {e}")
+        print_status(f"Warning: Could not copy {config.source_rel_path}", "warning")
+        return False
+
+
+def _apply_skip_strategy(config: DependencyShareConfig) -> None:
+    """Skip — nothing to do for this dependency type."""
+    debug(
+        MODULE, f"Skipping {config.dep_type} ({config.source_rel_path}) - skip strategy"
+    )
+
+
 # Export private functions for backward compatibility
 _ensure_timeline_hook_installed = ensure_timeline_hook_installed
 _initialize_timeline_tracking = initialize_timeline_tracking
@@ -430,6 +430,7 @@ class WorktreeManager:
                        if os.path.samefile(resolved_path, current_path):
                            return line[len("branch refs/heads/") :]
                except OSError:
+                    # File system comparison errors are handled by fallback below
                    pass
                # Fallback to normalized case comparison
                if os.path.normcase(str(resolved_path)) == os.path.normcase(
@@ -510,6 +511,7 @@ class WorktreeManager:
                    if os.path.samefile(resolved_path, registered_path):
                        return True
            except OSError:
+                # File system errors handled by fallback comparison below
                pass
            # Fallback to normalized case comparison for non-existent paths
            if os.path.normcase(str(resolved_path)) == os.path.normcase(
@@ -1209,6 +1211,9 @@ class WorktreeManager:
            )

        target = target_branch or self.base_branch
+        # Strip remote prefix (e.g., "origin/feat/x" → "feat/x") since gh expects branch names only
+        if target.startswith("origin/"):
+            target = target[len("origin/") :]
        pr_title = title or f"auto-claude: {spec_name}"

        # Try AI-powered PR body from project's PR template, fall back to spec summary
@@ -1379,6 +1384,9 @@ class WorktreeManager:
            )

        target = target_branch or self.base_branch
+        # Strip remote prefix (e.g., "origin/feat/x" → "feat/x") since glab expects branch names only
+        if target.startswith("origin/"):
+            target = target[len("origin/") :]
        mr_title = title or f"auto-claude: {spec_name}"

        # Get MR body from spec.md if available
@@ -635,10 +635,20 @@ def get_graphiti_status() -> dict:
    try:
        # Attempt to import the main graphiti_memory module
        import graphiti_core  # noqa: F401
-        from graphiti_core.driver.falkordb_driver import FalkorDriver  # noqa: F401

-        # If we got here, packages are importable
-        status["available"] = True  # pragma: no cover
+        # Try LadybugDB first (preferred for Python 3.12+), fall back to kuzu
+        try:
+            import real_ladybug  # noqa: F401
+        except ImportError:
+            try:
+                import kuzu  # noqa: F401
+            except ImportError:
+                status["available"] = False
+                status["reason"] = (
+                    "Graph database backend not installed (need real_ladybug or kuzu)"
+                )
+                return status
+        status["available"] = True
    except ImportError as e:
        status["available"] = False
        status["reason"] = f"Graphiti packages not installed: {e}"
@@ -5,7 +5,9 @@ Handles database connection, initialization, and lifecycle management.
 Uses LadybugDB as the embedded graph database (no Docker required, Python 3.12+).
 """

+import asyncio
 import logging
+import random
 import sys
 from datetime import datetime, timezone

@@ -14,6 +16,27 @@ from graphiti_config import GraphitiConfig, GraphitiState

 logger = logging.getLogger(__name__)

+# Retry configuration for LadybugDB lock contention
+MAX_LOCK_RETRIES = 5
+INITIAL_BACKOFF_SECONDS = 0.5
+MAX_BACKOFF_SECONDS = 8.0
+JITTER_PERCENT = 0.2
+
+
+def _is_lock_error(error: Exception) -> bool:
+    """Check if an error indicates database lock contention."""
+    error_msg = str(error).lower()
+    return "could not set lock" in error_msg or (
+        "lock" in error_msg and ("file" in error_msg or "database" in error_msg)
+    )
+
+
+def _backoff_with_jitter(attempt: int) -> float:
+    """Calculate exponential backoff with jitter for retry delays."""
+    backoff = min(INITIAL_BACKOFF_SECONDS * (2**attempt), MAX_BACKOFF_SECONDS)
+    jitter = backoff * JITTER_PERCENT * (2 * random.random() - 1)
+    return max(0.01, backoff + jitter)
+

 def _apply_ladybug_monkeypatch() -> bool:
    """
@@ -196,32 +219,36 @@ class GraphitiClient:
                )

                db_path = self.config.get_db_path()
-                try:
-                    self._driver = create_patched_kuzu_driver(db=str(db_path))
-                except (OSError, PermissionError) as e:
-                    logger.warning(
-                        f"Failed to initialize LadybugDB driver at {db_path}: {e}"
-                    )
-                    capture_exception(
-                        e,
-                        error_type=type(e).__name__,
-                        db_path=str(db_path),
-                        llm_provider=self.config.llm_provider,
-                        embedder_provider=self.config.embedder_provider,
-                    )
-                    return False
-                except Exception as e:
-                    logger.warning(
-                        f"Unexpected error initializing LadybugDB driver at {db_path}: {e}"
-                    )
-                    capture_exception(
-                        e,
-                        error_type=type(e).__name__,
-                        db_path=str(db_path),
-                        llm_provider=self.config.llm_provider,
-                        embedder_provider=self.config.embedder_provider,
-                    )
-                    return False
+
+                # Retry with exponential backoff for lock contention
+                for attempt in range(MAX_LOCK_RETRIES + 1):
+                    try:
+                        self._driver = create_patched_kuzu_driver(db=str(db_path))
+                        if attempt > 0:
+                            logger.info(
+                                f"LadybugDB lock acquired after {attempt} retries"
+                            )
+                        break  # Success
+                    except Exception as e:
+                        if _is_lock_error(e) and attempt < MAX_LOCK_RETRIES:
+                            wait_time = _backoff_with_jitter(attempt)
+                            logger.debug(
+                                f"LadybugDB lock contention (attempt {attempt + 1}/{MAX_LOCK_RETRIES}), retrying in {wait_time:.2f}s"
+                            )
+                            await asyncio.sleep(wait_time)
+                            continue
+                        logger.warning(
+                            f"Failed to initialize LadybugDB driver at {db_path}: {e}"
+                        )
+                        capture_exception(
+                            e,
+                            error_type=type(e).__name__,
+                            db_path=str(db_path),
+                            llm_provider=self.config.llm_provider,
+                            embedder_provider=self.config.embedder_provider,
+                        )
+                        return False
+
                logger.info(f"Initialized LadybugDB driver (patched) at: {db_path}")
            except ImportError as e:
                logger.warning(f"KuzuDriver not available: {e}")
@@ -81,16 +81,16 @@ def mock_graphiti_core():


@pytest.fixture
-def mock_falkor_driver():
-    """Mock graphiti_core.driver.falkordb_driver.FalkorDriver.
+def mock_kuzu_driver():
+    """Mock graphiti_core.driver.kuzu_driver.KuzuDriver.

-    Prevents actual FalkorDB connections during tests.
+    Prevents actual LadybugDB/kuzu connections during tests.

    Yields:
        tuple: (mock_driver_class, mock_driver_instance)
    """
    with patch(
-        "integrations.graphiti.queries_pkg.graphiti.graphiti_core.driver.falkordb_driver.FalkorDriver"
+        "integrations.graphiti.queries_pkg.graphiti.graphiti_core.driver.kuzu_driver.KuzuDriver"
    ) as mock_driver:
        mock_instance = MagicMock()
        mock_driver.return_value = mock_instance
@@ -15,7 +15,7 @@ Tests cover:
 import json
 import os
 from pathlib import Path
-from unittest.mock import patch
+from unittest.mock import MagicMock, patch

 import pytest
 from integrations.graphiti.config import (
@@ -1054,20 +1054,48 @@ class TestModuleLevelFunctions:
        assert "OPENAI_API_KEY" in status["errors"][0]

    def test_get_graphiti_status_invalid_config_sets_reason(self, clean_env):
-        """Test get_graphiti_status sets reason when config is invalid.
+        """Test get_graphiti_status with validation errors (embedder misconfigured).

-        This tests lines 628-629 where the reason is set from validation errors.
+        When packages are installed but embedder config has errors, available should
+        still be True (embedder is optional - keyword search fallback exists).
+        Validation errors are reported in the errors list for informational purposes.
        """
        os.environ["GRAPHITI_ENABLED"] = "true"
        os.environ["GRAPHITI_EMBEDDER_PROVIDER"] = "voyage"

-        status = get_graphiti_status()
+        # Mock imports to ensure test is independent of environment
+        with patch.dict(
+            "sys.modules",
+            {"graphiti_core": MagicMock(), "real_ladybug": MagicMock()},
+        ):
+            status = get_graphiti_status()
+
+        assert status["enabled"] is True
+        # available depends on whether mocked packages are resolved correctly;
+        # sys.modules patching should make imports succeed, but guard against
+        # environment quirks (consistent with test_get_graphiti_status_enabled)
+        assert status["available"] is True
+        assert len(status["errors"]) > 0
+        assert "VOYAGE_API_KEY" in status["errors"][0]
+
+    def test_get_graphiti_status_no_graph_backend(self, clean_env):
+        """Test get_graphiti_status when graphiti_core exists but no graph DB backend.
+
+        This tests the error path in config.py lines 645-650 where graphiti_core
+        imports successfully but neither real_ladybug nor kuzu is available.
+        """
+        os.environ["GRAPHITI_ENABLED"] = "true"
+
+        # Mock graphiti_core as present, but ensure real_ladybug and kuzu are absent
+        with patch.dict(
+            "sys.modules",
+            {"graphiti_core": MagicMock(), "real_ladybug": None, "kuzu": None},
+        ):
+            status = get_graphiti_status()

        assert status["enabled"] is True
        assert status["available"] is False
-        # When config is invalid, reason should be set from errors
-        assert status["reason"] != ""
-        assert len(status["errors"]) > 0
+        assert "real_ladybug or kuzu" in status["reason"]

    @pytest.mark.slow
    def test_get_graphiti_status_with_graphiti_installed(self, clean_env):
@@ -1089,9 +1117,9 @@ class TestModuleLevelFunctions:
        assert "reason" in status
        assert "errors" in status

-        # Note: Line 641 (status["available"] = True) requires falkordb to be installed.
-        # Since falkordb is not installed in the test environment, that line is marked
-        # with pragma: no cover. The except clause (lines 642-644) is tested here.
+        # Note: Line 644 (status["available"] = True) requires LadybugDB/kuzu to be installed.
+        # Since LadybugDB/kuzu may not be installed in all test environments, that line
+        # may be marked with pragma: no cover. The except clause is tested here.

    def test_get_available_providers_empty(self, clean_env):
        """Test get_available_providers with no credentials."""
@@ -264,7 +264,7 @@ class TestTestGraphitiConnection:

            # Mock graphiti_core imports to succeed
            mock_graphiti = MagicMock()
-            mock_falkordb_driver = MagicMock()
+            mock_kuzu_driver = MagicMock()

            # Mock provider creation to raise ProviderError
            with patch("graphiti_providers.create_llm_client") as mock_create_llm:
@@ -275,7 +275,7 @@ class TestTestGraphitiConnection:
                    {
                        "graphiti_core": MagicMock(Graphiti=mock_graphiti),
                        "graphiti_core.driver": MagicMock(),
-                        "graphiti_core.driver.falkordb_driver": mock_falkordb_driver,
+                        "graphiti_core.driver.kuzu_driver": mock_kuzu_driver,
                        "graphiti_providers": MagicMock(
                            ProviderError=ProviderError,
                            create_embedder=MagicMock(),
@@ -160,7 +160,7 @@ class TestTestGraphitiConnection:
    """Tests for the test_graphiti_connection async function.

    Note: The function now uses embedded LadybugDB via patched KuzuDriver
-    instead of remote FalkorDB with host/port credentials.
+    instead of remote database with host/port credentials.
    """

    @pytest.mark.asyncio
@@ -14,6 +14,7 @@ from core.progress import (
    get_plan_summary,
    get_progress_percentage,
    is_build_complete,
+    is_build_ready_for_qa,
    print_build_complete_banner,
    print_paused_banner,
    print_progress_summary,
@@ -29,6 +30,7 @@ __all__ = [
    "get_plan_summary",
    "get_progress_percentage",
    "is_build_complete",
+    "is_build_ready_for_qa",
    "print_build_complete_banner",
    "print_paused_banner",
    "print_progress_summary",
@@ -24,7 +24,7 @@ You MUST create `spec.md` with ALL required sections (see template below).
 ## PHASE 0: LOAD ALL CONTEXT (MANDATORY)

 ```bash
-# Read all input files
+# Read all input files (some may not exist for greenfield/empty projects)
 cat project_index.json
 cat requirements.json
 cat context.json
@@ -35,6 +35,12 @@ Extract from these files:
 - **From requirements.json**: Task description, workflow type, services, acceptance criteria
 - **From context.json**: Files to modify, files to reference, patterns

+**IMPORTANT**: If any input file is missing, empty, or shows 0 files, this is likely a **greenfield/new project**. Adapt accordingly:
+- Skip sections that reference existing code (e.g., "Files to Modify", "Patterns to Follow")
+- Instead, focus on files to CREATE and the initial project structure
+- Define the tech stack, dependencies, and setup instructions from scratch
+- Use industry best practices as patterns rather than referencing existing code
+
 ---

 ## PHASE 1: ANALYZE CONTEXT
@@ -8,7 +8,7 @@ Manages acceptance criteria validation and status tracking.
 import json
 from pathlib import Path

-from progress import is_build_complete
+from progress import is_build_ready_for_qa

 # =============================================================================
 # IMPLEMENTATION PLAN I/O
@@ -95,10 +95,10 @@ def should_run_qa(spec_dir: Path) -> bool:
    Determine if QA validation should run.

    QA should run when:
-    - All subtasks are completed
+    - All subtasks have reached a terminal state (completed, failed, or stuck)
    - QA has not yet approved
    """
-    if not is_build_complete(spec_dir):
+    if not is_build_ready_for_qa(spec_dir):
        return False

    if is_qa_approved(spec_dir):
@@ -15,7 +15,11 @@ from pathlib import Path
 from agents.base import sanitize_error_message
 from agents.memory_manager import get_graphiti_context, save_session_memory
 from claude_agent_sdk import ClaudeSDKClient
-from core.error_utils import is_rate_limit_error, is_tool_concurrency_error
+from core.error_utils import (
+    is_rate_limit_error,
+    is_tool_concurrency_error,
+    safe_receive_messages,
+)
 from debug import debug, debug_detailed, debug_error, debug_section, debug_success
 from security.tool_input_validator import get_safe_tool_input
 from task_logger import (
@@ -141,7 +145,7 @@ async def run_qa_fixer_session(

        response_text = ""
        debug("qa_fixer", "Starting to receive response stream...")
-        async for msg in client.receive_response():
+        async for msg in safe_receive_messages(client, caller="qa_fixer"):
            msg_type = type(msg).__name__
            message_count += 1
            debug_detailed(
@@ -28,7 +28,7 @@ from phase_config import (
    get_phase_model_betas,
 )
 from phase_event import ExecutionPhase, emit_phase
-from progress import count_subtasks, is_build_complete
+from progress import count_subtasks, is_build_ready_for_qa
 from security.constants import PROJECT_DIR_ENV_VAR
 from task_logger import (
    LogPhase,
@@ -114,14 +114,25 @@ async def run_qa_validation_loop(
    # Initialize task logger for the validation phase
    task_logger = get_task_logger(spec_dir)

-    # Verify build is complete
-    if not is_build_complete(spec_dir):
-        debug_warning("qa_loop", "Build is not complete, cannot run QA")
-        print("\n❌ Build is not complete. Cannot run QA validation.")
-        completed, total = count_subtasks(spec_dir)
-        debug("qa_loop", "Build progress", completed=completed, total=total)
-        print(f"   Progress: {completed}/{total} subtasks completed")
-        return False
+    # Check if there's pending human feedback that needs to be processed
+    fix_request_file = spec_dir / "QA_FIX_REQUEST.md"
+    has_human_feedback = fix_request_file.exists()
+
+    # Human feedback takes priority — if the user explicitly asked to proceed,
+    # skip the build completeness gate entirely
+    if not has_human_feedback:
+        # Verify build is ready for QA (all subtasks in terminal state)
+        if not is_build_ready_for_qa(spec_dir):
+            debug_warning(
+                "qa_loop", "Build is not ready for QA - subtasks still in progress"
+            )
+            print("\n❌ Build is not ready for QA validation.")
+            completed, total = count_subtasks(spec_dir)
+            debug("qa_loop", "Build progress", completed=completed, total=total)
+            print(
+                f"   Progress: {completed}/{total} subtasks in terminal state (completed/failed/stuck)"
+            )
+            return False

    # Emit phase event at start of QA validation (before any early returns)
    emit_phase(ExecutionPhase.QA_REVIEW, "Starting QA validation")
@@ -136,10 +147,6 @@ async def run_qa_validation_loop(
        f"[Fast Mode] {'ENABLED' if fast_mode else 'disabled'} for QA validation",
    )

-    # Check if there's pending human feedback that needs to be processed
-    fix_request_file = spec_dir / "QA_FIX_REQUEST.md"
-    has_human_feedback = fix_request_file.exists()
-
    # Check if already approved - but if there's human feedback, we need to process it first
    if is_qa_approved(spec_dir) and not has_human_feedback:
        debug_success("qa_loop", "Build already approved by QA")
@@ -215,6 +222,7 @@ async def run_qa_validation_loop(
                        "Removed QA_FIX_REQUEST.md after permanent fixer error",
                    )
                except OSError:
+                    # File removal failure is not critical here
                    pass
            return False

@@ -230,6 +238,7 @@ async def run_qa_validation_loop(
            fix_request_file.unlink()
            debug("qa_loop", "Removed processed QA_FIX_REQUEST.md")
        except OSError:
+            # File removal failure is not critical here
            pass  # Ignore if file removal fails

    # Check for no-test projects
@@ -16,7 +16,11 @@ from pathlib import Path
 from agents.base import sanitize_error_message
 from agents.memory_manager import get_graphiti_context, save_session_memory
 from claude_agent_sdk import ClaudeSDKClient
-from core.error_utils import is_rate_limit_error, is_tool_concurrency_error
+from core.error_utils import (
+    is_rate_limit_error,
+    is_tool_concurrency_error,
+    safe_receive_messages,
+)
 from debug import debug, debug_detailed, debug_error, debug_section, debug_success
 from prompts_pkg import get_qa_reviewer_prompt
 from security.tool_input_validator import get_safe_tool_input
@@ -195,7 +199,7 @@ This is attempt {previous_error.get("consecutive_errors", 1) + 1}. If you fail t

        response_text = ""
        debug("qa_reviewer", "Starting to receive response stream...")
-        async for msg in client.receive_response():
+        async for msg in safe_receive_messages(client, caller="qa_reviewer"):
            msg_type = type(msg).__name__
            message_count += 1
            debug_detailed(
@@ -1,7 +1,8 @@
 # Auto-Build Framework Dependencies
-# SDK 0.1.33+ required for Opus 4.6 adaptive thinking support
-# Earlier versions lacked effort parameter and thinking type configuration
-claude-agent-sdk>=0.1.33
+# SDK 0.1.39+ required for Opus 4.6 adaptive thinking support and stability fixes
+# Earlier versions lacked effort parameter, thinking type configuration,
+# and crashed on unhandled CLI message types (e.g., rate_limit_event)
+claude-agent-sdk>=0.1.39
 python-dotenv>=1.0.0

 # TOML parsing fallback for Python < 3.11
@@ -12,7 +12,7 @@ from __future__ import annotations

 import json
 from dataclasses import dataclass, field
-from datetime import datetime
+from datetime import datetime, timezone
 from enum import Enum
 from pathlib import Path

@@ -22,6 +22,11 @@ except (ImportError, ValueError, SystemError):
    from file_lock import locked_json_update, locked_json_write


+def _utc_now_iso() -> str:
+    """Return current UTC time as ISO 8601 string with timezone info."""
+    return datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+
+
 class ReviewSeverity(str, Enum):
    """Severity levels for PR review findings."""

@@ -521,7 +526,7 @@ class PRReviewResult:
    summary: str = ""
    overall_status: str = "comment"  # approve, request_changes, comment
    review_id: int | None = None
-    reviewed_at: str = field(default_factory=lambda: datetime.now().isoformat())
+    reviewed_at: str = field(default_factory=lambda: _utc_now_iso())
    error: str | None = None

    # NEW: Enhanced verdict system
@@ -567,6 +572,9 @@ class PRReviewResult:
    )  # IDs of posted findings
    posted_at: str | None = None  # Timestamp when findings were posted

+    # In-progress review tracking
+    in_progress_since: str | None = None  # ISO timestamp when active review started
+
    def to_dict(self) -> dict:
        return {
            "pr_number": self.pr_number,
@@ -598,6 +606,8 @@ class PRReviewResult:
            "has_posted_findings": self.has_posted_findings,
            "posted_finding_ids": self.posted_finding_ids,
            "posted_at": self.posted_at,
+            # In-progress review tracking
+            "in_progress_since": self.in_progress_since,
        }

    @classmethod
@@ -610,7 +620,7 @@ class PRReviewResult:
            summary=data.get("summary", ""),
            overall_status=data.get("overall_status", "comment"),
            review_id=data.get("review_id"),
-            reviewed_at=data.get("reviewed_at", datetime.now().isoformat()),
+            reviewed_at=data.get("reviewed_at", _utc_now_iso()),
            error=data.get("error"),
            # NEW fields
            verdict=MergeVerdict(data.get("verdict", "ready_to_merge")),
@@ -645,6 +655,8 @@ class PRReviewResult:
            has_posted_findings=data.get("has_posted_findings", False),
            posted_finding_ids=data.get("posted_finding_ids", []),
            posted_at=data.get("posted_at"),
+            # In-progress review tracking
+            in_progress_since=data.get("in_progress_since"),
        )

    async def save(self, github_dir: Path) -> None:
@@ -691,7 +703,7 @@ class PRReviewResult:
                reviews.append(entry)

            current_data["reviews"] = reviews
-            current_data["last_updated"] = datetime.now().isoformat()
+            current_data["last_updated"] = _utc_now_iso()

            return current_data

@@ -762,7 +774,7 @@ class TriageResult:
    suggested_breakdown: list[str] = field(default_factory=list)
    priority: str = "medium"  # high, medium, low
    comment: str | None = None
-    triaged_at: str = field(default_factory=lambda: datetime.now().isoformat())
+    triaged_at: str = field(default_factory=lambda: _utc_now_iso())

    def to_dict(self) -> dict:
        return {
@@ -798,7 +810,7 @@ class TriageResult:
            suggested_breakdown=data.get("suggested_breakdown", []),
            priority=data.get("priority", "medium"),
            comment=data.get("comment"),
-            triaged_at=data.get("triaged_at", datetime.now().isoformat()),
+            triaged_at=data.get("triaged_at", _utc_now_iso()),
        )

    async def save(self, github_dir: Path) -> None:
@@ -836,8 +848,8 @@ class AutoFixState:
    pr_url: str | None = None
    bot_comments: list[str] = field(default_factory=list)
    error: str | None = None
-    created_at: str = field(default_factory=lambda: datetime.now().isoformat())
-    updated_at: str = field(default_factory=lambda: datetime.now().isoformat())
+    created_at: str = field(default_factory=lambda: _utc_now_iso())
+    updated_at: str = field(default_factory=lambda: _utc_now_iso())

    def to_dict(self) -> dict:
        return {
@@ -875,8 +887,8 @@ class AutoFixState:
            pr_url=data.get("pr_url"),
            bot_comments=data.get("bot_comments", []),
            error=data.get("error"),
-            created_at=data.get("created_at", datetime.now().isoformat()),
-            updated_at=data.get("updated_at", datetime.now().isoformat()),
+            created_at=data.get("created_at", _utc_now_iso()),
+            updated_at=data.get("updated_at", _utc_now_iso()),
        )

    def update_status(self, status: AutoFixStatus) -> None:
@@ -886,7 +898,7 @@ class AutoFixState:
                f"Invalid state transition: {self.status.value} -> {status.value}"
            )
        self.status = status
-        self.updated_at = datetime.now().isoformat()
+        self.updated_at = _utc_now_iso()

    async def save(self, github_dir: Path) -> None:
        """Save auto-fix state to .auto-claude/github/issues/ with file locking."""
@@ -938,7 +950,7 @@ class AutoFixState:
                queue.append(entry)

            current_data["auto_fix_queue"] = queue
-            current_data["last_updated"] = datetime.now().isoformat()
+            current_data["last_updated"] = _utc_now_iso()

            return current_data

@@ -395,8 +395,28 @@ class GitHubOrchestrator:
                    else:
                        # No existing review found, create skip result
                        return await self._create_skip_result(pr_number, skip_reason)
+                elif "Review already in progress" in skip_reason:
+                    # Return an in-progress result WITHOUT saving to disk
+                    # to avoid overwriting the partial result being written by the active review
+                    started_at = self.bot_detector.state.in_progress_reviews.get(
+                        str(pr_number)
+                    )
+                    safe_print(
+                        f"[BOT DETECTION] Review in progress for PR #{pr_number} "
+                        f"(started: {started_at})",
+                        flush=True,
+                    )
+                    return PRReviewResult(
+                        pr_number=pr_number,
+                        repo=self.config.repo,
+                        success=True,
+                        findings=[],
+                        summary="Review in progress",
+                        overall_status="in_progress",
+                        in_progress_since=started_at,
+                    )
                else:
-                    # For other skip reasons (bot-authored, cooling off, in-progress), create a skip result
+                    # For other skip reasons (bot-authored, cooling off), create a skip result
                    return await self._create_skip_result(pr_number, skip_reason)

            # Mark review as started (prevents concurrent reviews)
@@ -235,6 +235,12 @@ async def cmd_review_pr(args) -> int:
        safe_print(f"[DEBUG] review_pr returned, success={result.success}")

    if result.success:
+        # For in_progress results (not saved to disk), output JSON so the frontend
+        # can parse it from stdout instead of relying on the disk file.
+        if result.overall_status == "in_progress":
+            safe_print(f"__RESULT_JSON__:{json.dumps(result.to_dict())}")
+            return 0
+
        safe_print(f"\n{'=' * 60}")
        safe_print(f"PR #{result.pr_number} Review Complete")
        safe_print(f"{'=' * 60}")
@@ -18,7 +18,6 @@ from __future__ import annotations
 import hashlib
 import logging
 import re
-from datetime import datetime
 from pathlib import Path
 from typing import TYPE_CHECKING, Any

@@ -26,6 +25,8 @@ if TYPE_CHECKING:
    from ..models import FollowupReviewContext, GitHubRunnerConfig

 try:
+    from ...core.client import create_client
+    from ...phase_config import resolve_model_id
    from ..gh_client import GHClient
    from ..models import (
        MergeVerdict,
@@ -33,12 +34,16 @@ try:
        PRReviewResult,
        ReviewCategory,
        ReviewSeverity,
+        _utc_now_iso,
    )
    from .category_utils import map_category
    from .io_utils import safe_print
    from .prompt_manager import PromptManager
-    from .pydantic_models import FollowupReviewResponse
+    from .pydantic_models import FollowupExtractionResponse, FollowupReviewResponse
+    from .recovery_utils import create_finding_from_summary
+    from .sdk_utils import process_sdk_stream
 except (ImportError, ValueError, SystemError):
+    from core.client import create_client
    from gh_client import GHClient
    from models import (
        MergeVerdict,
@@ -46,11 +51,18 @@ except (ImportError, ValueError, SystemError):
        PRReviewResult,
        ReviewCategory,
        ReviewSeverity,
+        _utc_now_iso,
    )
+    from phase_config import resolve_model_id
    from services.category_utils import map_category
    from services.io_utils import safe_print
    from services.prompt_manager import PromptManager
-    from services.pydantic_models import FollowupReviewResponse
+    from services.pydantic_models import (
+        FollowupExtractionResponse,
+        FollowupReviewResponse,
+    )
+    from services.recovery_utils import create_finding_from_summary
+    from services.sdk_utils import process_sdk_stream

 logger = logging.getLogger(__name__)

@@ -265,7 +277,7 @@ class FollowupReviewer:
            verdict=verdict,
            verdict_reasoning=verdict_reasoning,
            blockers=blockers,
-            reviewed_at=datetime.now().isoformat(),
+            reviewed_at=_utc_now_iso(),
            # Follow-up specific fields
            reviewed_commit_sha=context.current_commit_sha,
            reviewed_file_blobs=file_blobs,
@@ -697,6 +709,9 @@ Analyze this follow-up review context and provide your structured response.
            )
            safe_print(f"[Followup] SDK query with output_format, model={model}")

+            # Capture assistant text for extraction fallback
+            captured_text = ""
+
            # Iterate through messages from the query
            # Note: max_turns=2 because structured output uses a tool call + response
            async for message in query(
@@ -721,7 +736,9 @@ Analyze this follow-up review context and provide your structured response.
                    content = getattr(message, "content", [])
                    for block in content:
                        block_type = type(block).__name__
-                        if block_type == "ToolUseBlock":
+                        if block_type == "TextBlock":
+                            captured_text += getattr(block, "text", "")
+                        elif block_type == "ToolUseBlock":
                            tool_name = getattr(block, "name", "")
                            if tool_name == "StructuredOutput":
                                # Extract structured data from tool input
@@ -764,9 +781,31 @@ Analyze this follow-up review context and provide your structured response.
                        logger.warning(
                            "Claude could not produce valid structured output after retries"
                        )
+                        # Attempt extraction call recovery before giving up
+                        if captured_text:
+                            safe_print(
+                                "[Followup] Attempting extraction call recovery...",
+                                flush=True,
+                            )
+                            extraction_result = await self._attempt_extraction_call(
+                                captured_text, context
+                            )
+                            if extraction_result is not None:
+                                return extraction_result
                        return None

            logger.warning("No structured output received from AI")
+            # Attempt extraction call recovery before giving up
+            if captured_text:
+                safe_print(
+                    "[Followup] No structured output — attempting extraction call recovery...",
+                    flush=True,
+                )
+                extraction_result = await self._attempt_extraction_call(
+                    captured_text, context
+                )
+                if extraction_result is not None:
+                    return extraction_result
            return None

        except ValueError as e:
@@ -839,6 +878,124 @@ Analyze this follow-up review context and provide your structured response.
            "verdict_reasoning": result.verdict_reasoning,
        }

+    async def _attempt_extraction_call(
+        self,
+        text: str,
+        context: FollowupReviewContext,
+    ) -> dict[str, Any] | None:
+        """Attempt a short SDK call with minimal schema to recover review data.
+
+        This is the extraction recovery step when full structured output validation fails.
+        Uses FollowupExtractionResponse (small schema with ExtractedFindingSummary nesting)
+        which has near-100% success rate.
+
+        Uses create_client() + process_sdk_stream() for proper OAuth handling,
+        matching the pattern in parallel_followup_reviewer.py.
+
+        Returns parsed result dict on success, None on failure.
+        """
+        if not text or not text.strip():
+            return None
+
+        try:
+            extraction_prompt = (
+                "Extract the key review data from the following AI analysis output. "
+                "Return the verdict, reasoning, resolved finding IDs, unresolved finding IDs, "
+                "structured summaries of any new findings (including severity, description, file path, and line number), "
+                "and counts of confirmed/dismissed findings.\n\n"
+                f"--- AI ANALYSIS OUTPUT ---\n{text[:8000]}\n--- END ---"
+            )
+
+            model_shorthand = self.config.model or "sonnet"
+            model = resolve_model_id(model_shorthand)
+
+            extraction_client = create_client(
+                project_dir=self.project_dir,
+                spec_dir=self.github_dir,
+                model=model,
+                agent_type="pr_followup_extraction",
+                output_format={
+                    "type": "json_schema",
+                    "schema": FollowupExtractionResponse.model_json_schema(),
+                },
+            )
+
+            async with extraction_client:
+                await extraction_client.query(extraction_prompt)
+
+                stream_result = await process_sdk_stream(
+                    client=extraction_client,
+                    context_name="FollowupExtraction",
+                    model=model,
+                    system_prompt=extraction_prompt,
+                    max_messages=20,
+                )
+
+            if stream_result.get("error"):
+                logger.warning(
+                    f"[Followup] Extraction call also failed: {stream_result['error']}"
+                )
+                return None
+
+            extraction_output = stream_result.get("structured_output")
+            if not extraction_output:
+                logger.warning(
+                    "[Followup] Extraction call returned no structured output"
+                )
+                return None
+
+            extracted = FollowupExtractionResponse.model_validate(extraction_output)
+
+            # Convert extraction to internal format with reconstructed findings
+            new_findings = []
+            for i, summary_obj in enumerate(extracted.new_finding_summaries):
+                new_findings.append(
+                    create_finding_from_summary(
+                        summary=summary_obj.description,
+                        index=i,
+                        id_prefix="FR",
+                        severity_override=summary_obj.severity,
+                        file=summary_obj.file,
+                        line=summary_obj.line,
+                    )
+                )
+
+            # Build finding_resolutions from extraction data for _apply_ai_resolutions
+            # (unresolved findings are handled via finding_resolutions + _apply_ai_resolutions)
+            finding_resolutions = []
+            for fid in extracted.resolved_finding_ids:
+                finding_resolutions.append(
+                    {"finding_id": fid, "status": "resolved", "resolution_notes": None}
+                )
+            for fid in extracted.unresolved_finding_ids:
+                finding_resolutions.append(
+                    {
+                        "finding_id": fid,
+                        "status": "unresolved",
+                        "resolution_notes": None,
+                    }
+                )
+
+            safe_print(
+                f"[Followup] Extraction recovered: verdict={extracted.verdict}, "
+                f"{len(extracted.resolved_finding_ids)} resolved, "
+                f"{len(extracted.unresolved_finding_ids)} unresolved, "
+                f"{len(new_findings)} new findings",
+                flush=True,
+            )
+
+            return {
+                "finding_resolutions": finding_resolutions,
+                "new_findings": new_findings,
+                "comment_findings": [],
+                "verdict": extracted.verdict,
+                "verdict_reasoning": f"[Recovered via extraction] {extracted.verdict_reasoning}",
+            }
+
+        except Exception as e:
+            logger.warning(f"[Followup] Extraction call failed: {e}")
+            return None
+
    def _apply_ai_resolutions(
        self,
        previous_findings: list[PRReviewFinding],
@@ -51,7 +51,8 @@ try:
    from .category_utils import map_category
    from .io_utils import safe_print
    from .pr_worktree_manager import PRWorktreeManager
-    from .pydantic_models import ParallelFollowupResponse
+    from .pydantic_models import FollowupExtractionResponse, ParallelFollowupResponse
+    from .recovery_utils import create_finding_from_summary
    from .sdk_utils import process_sdk_stream
 except (ImportError, ValueError, SystemError):
    from context_gatherer import _validate_git_ref
@@ -75,7 +76,11 @@ except (ImportError, ValueError, SystemError):
    from services.category_utils import map_category
    from services.io_utils import safe_print
    from services.pr_worktree_manager import PRWorktreeManager
-    from services.pydantic_models import ParallelFollowupResponse
+    from services.pydantic_models import (
+        FollowupExtractionResponse,
+        ParallelFollowupResponse,
+    )
+    from services.recovery_utils import create_finding_from_summary
    from services.sdk_utils import process_sdk_stream


@@ -576,16 +581,36 @@ The SDK will run invoked agents in parallel automatically.
                )

                # Check for stream processing errors
-                if stream_result.get("error"):
-                    logger.error(
-                        f"[ParallelFollowup] SDK stream failed: {stream_result['error']}"
-                    )
-                    raise RuntimeError(
-                        f"SDK stream processing failed: {stream_result['error']}"
-                    )
+                stream_error = stream_result.get("error")
+                if stream_error:
+                    if stream_result.get("error_recoverable"):
+                        # Recoverable error — attempt extraction call fallback
+                        logger.warning(
+                            f"[ParallelFollowup] Recoverable error: {stream_error}. "
+                            f"Attempting extraction call fallback."
+                        )
+                        safe_print(
+                            f"[ParallelFollowup] WARNING: {stream_error} — "
+                            f"attempting recovery with minimal extraction...",
+                            flush=True,
+                        )
+                    else:
+                        # Fatal error — raise as before
+                        logger.error(
+                            f"[ParallelFollowup] SDK stream failed: {stream_error}"
+                        )
+                        raise RuntimeError(
+                            f"SDK stream processing failed: {stream_error}"
+                        )

                result_text = stream_result["result_text"]
-                structured_output = stream_result["structured_output"]
+                last_assistant_text = stream_result.get("last_assistant_text", "")
+                # Nullify structured output on recoverable errors to force Tier 2 fallback
+                structured_output = (
+                    None
+                    if (stream_error and stream_result.get("error_recoverable"))
+                    else stream_result["structured_output"]
+                )
                agents_invoked = stream_result["agents_invoked"]
                msg_count = stream_result["msg_count"]

@@ -596,22 +621,28 @@ The SDK will run invoked agents in parallel automatically.
                pr_number=context.pr_number,
            )

-            # Parse findings from output
+            # Parse findings from output (three-tier recovery cascade)
            if structured_output:
                result_data = self._parse_structured_output(structured_output, context)
            else:
-                # Log when structured output is missing - this shouldn't happen normally
-                # when output_format is configured, so it indicates a problem
+                # Structured output missing or validation failed.
+                # Tier 2: Attempt extraction call with minimal schema
                logger.warning(
-                    "[ParallelFollowup] No structured output received from SDK - "
-                    "falling back to text parsing. Resolution data may be incomplete."
+                    "[ParallelFollowup] No structured output — attempting extraction call"
                )
-                safe_print(
-                    "[ParallelFollowup] WARNING: Structured output not captured, "
-                    "using text fallback (resolution tracking may be incomplete)",
-                    flush=True,
+                # Use last_assistant_text (cleaner) if available, fall back to full transcript
+                fallback_text = last_assistant_text or result_text
+                result_data = await self._attempt_extraction_call(
+                    fallback_text, context
                )
-                result_data = self._parse_text_output(result_text, context)
+                if result_data is None:
+                    # Tier 3: Fall back to basic text parsing
+                    safe_print(
+                        "[ParallelFollowup] WARNING: Extraction call failed, "
+                        "using text fallback (resolution tracking may be incomplete)",
+                        flush=True,
+                    )
+                    result_data = self._parse_text_output(result_text, context)

            # Extract data
            findings = result_data.get("findings", [])
@@ -730,7 +761,9 @@ The SDK will run invoked agents in parallel automatically.
                    blockers.append(f"{finding.category.value}: {finding.title}")

            # Extract validation counts
-            dismissed_count = len(result_data.get("dismissed_false_positive_ids", []))
+            dismissed_count = len(
+                result_data.get("dismissed_false_positive_ids", [])
+            ) or result_data.get("dismissed_finding_count", 0)
            confirmed_count = result_data.get("confirmed_valid_count", 0)
            needs_human_count = result_data.get("needs_human_review_count", 0)

@@ -1074,17 +1107,172 @@ The SDK will run invoked agents in parallel automatically.
        elif "needs revision" in text_lower or "request changes" in text_lower:
            verdict = MergeVerdict.NEEDS_REVISION
        else:
-            verdict = MergeVerdict.MERGE_WITH_CHANGES
+            verdict = MergeVerdict.NEEDS_REVISION

        return {
            "findings": findings,
            "resolved_ids": [],
            "unresolved_ids": [],
            "new_finding_ids": [],
+            "dismissed_false_positive_ids": [],
+            "confirmed_valid_count": 0,
+            "dismissed_finding_count": 0,
+            "needs_human_review_count": 0,
            "verdict": verdict,
            "verdict_reasoning": text[:500] if text else "Unable to parse response",
+            "agents_invoked": [],
        }

+    async def _attempt_extraction_call(
+        self, text: str, context: FollowupReviewContext
+    ) -> dict | None:
+        """Attempt a short SDK call with a minimal schema to recover review data.
+
+        This is the Tier 2 recovery step when full structured output validation fails.
+        Uses FollowupExtractionResponse (small schema with ExtractedFindingSummary nesting)
+        which has near-100% success rate.
+
+        Returns parsed result dict on success, None on failure.
+        """
+        if not text or not text.strip():
+            logger.warning("[ParallelFollowup] No text available for extraction call")
+            return None
+
+        try:
+            safe_print(
+                "[ParallelFollowup] Attempting recovery with minimal extraction schema...",
+                flush=True,
+            )
+
+            extraction_prompt = (
+                "Extract the key review data from the following AI analysis output. "
+                "Return the verdict, reasoning, resolved finding IDs, unresolved finding IDs, "
+                "structured summaries of any new findings (including severity, description, file path, and line number), "
+                "and counts of confirmed/dismissed findings.\n\n"
+                f"--- AI ANALYSIS OUTPUT ---\n{text[:8000]}\n--- END ---"
+            )
+
+            model_shorthand = self.config.model or "sonnet"
+            model = resolve_model_id(model_shorthand)
+
+            extraction_client = create_client(
+                project_dir=self.project_dir,
+                spec_dir=self.github_dir,
+                model=model,
+                agent_type="pr_followup_extraction",
+                fast_mode=self.config.fast_mode,
+                output_format={
+                    "type": "json_schema",
+                    "schema": FollowupExtractionResponse.model_json_schema(),
+                },
+            )
+
+            async with extraction_client:
+                await extraction_client.query(extraction_prompt)
+
+                stream_result = await process_sdk_stream(
+                    client=extraction_client,
+                    context_name="FollowupExtraction",
+                    model=model,
+                    system_prompt=extraction_prompt,
+                    max_messages=20,
+                )
+
+            if stream_result.get("error"):
+                logger.warning(
+                    f"[ParallelFollowup] Extraction call also failed: {stream_result['error']}"
+                )
+                return None
+
+            extraction_output = stream_result.get("structured_output")
+            if not extraction_output:
+                logger.warning(
+                    "[ParallelFollowup] Extraction call returned no structured output"
+                )
+                return None
+
+            # Parse the minimal extraction response
+            extracted = FollowupExtractionResponse.model_validate(extraction_output)
+
+            # Map verdict string to MergeVerdict enum
+            verdict_map = {
+                "READY_TO_MERGE": MergeVerdict.READY_TO_MERGE,
+                "MERGE_WITH_CHANGES": MergeVerdict.MERGE_WITH_CHANGES,
+                "NEEDS_REVISION": MergeVerdict.NEEDS_REVISION,
+                "BLOCKED": MergeVerdict.BLOCKED,
+            }
+            verdict = verdict_map.get(extracted.verdict, MergeVerdict.NEEDS_REVISION)
+
+            # Reconstruct findings from extraction data
+            findings = []
+            new_finding_ids = []
+
+            # 1. Convert new_finding_summaries to PRReviewFinding objects
+            # ExtractedFindingSummary objects carry file/line from extraction
+            for i, summary_obj in enumerate(extracted.new_finding_summaries):
+                finding = create_finding_from_summary(
+                    summary=summary_obj.description,
+                    index=i,
+                    id_prefix="FU",
+                    severity_override=summary_obj.severity,
+                    file=summary_obj.file,
+                    line=summary_obj.line,
+                )
+                new_finding_ids.append(finding.id)
+                findings.append(finding)
+
+            # 2. Reconstruct unresolved findings from previous review context
+            if extracted.unresolved_finding_ids and context.previous_review.findings:
+                previous_map = {f.id: f for f in context.previous_review.findings}
+                for uid in extracted.unresolved_finding_ids:
+                    original = previous_map.get(uid)
+                    if original:
+                        findings.append(
+                            PRReviewFinding(
+                                id=original.id,
+                                severity=original.severity,
+                                category=original.category,
+                                title=f"[UNRESOLVED] {original.title}",
+                                description=original.description,
+                                file=original.file,
+                                line=original.line,
+                                suggested_fix=original.suggested_fix,
+                                fixable=original.fixable,
+                                is_impact_finding=original.is_impact_finding,
+                            )
+                        )
+
+            safe_print(
+                f"[ParallelFollowup] Extraction recovered: verdict={extracted.verdict}, "
+                f"{len(extracted.resolved_finding_ids)} resolved, "
+                f"{len(extracted.unresolved_finding_ids)} unresolved, "
+                f"{len(new_finding_ids)} new findings, "
+                f"{len(findings)} total findings reconstructed",
+                flush=True,
+            )
+
+            return {
+                "findings": findings,
+                "resolved_ids": extracted.resolved_finding_ids,
+                "unresolved_ids": extracted.unresolved_finding_ids,
+                "new_finding_ids": new_finding_ids,
+                "dismissed_false_positive_ids": [],
+                "confirmed_valid_count": extracted.confirmed_finding_count,
+                "dismissed_finding_count": extracted.dismissed_finding_count,
+                "needs_human_review_count": 0,
+                "verdict": verdict,
+                "verdict_reasoning": f"[Recovered via extraction] {extracted.verdict_reasoning}",
+                "agents_invoked": [],
+            }
+
+        except Exception as e:
+            logger.warning(f"[ParallelFollowup] Extraction call failed: {e}")
+            safe_print(
+                f"[ParallelFollowup] Extraction call failed: {e}",
+                flush=True,
+            )
+            return None
+
    def _create_empty_result(self) -> dict:
        """Create empty result structure."""
        return {
@@ -1092,8 +1280,13 @@ The SDK will run invoked agents in parallel automatically.
            "resolved_ids": [],
            "unresolved_ids": [],
            "new_finding_ids": [],
+            "dismissed_false_positive_ids": [],
+            "confirmed_valid_count": 0,
+            "dismissed_finding_count": 0,
+            "needs_human_review_count": 0,
            "verdict": MergeVerdict.NEEDS_REVISION,
            "verdict_reasoning": "Unable to parse review results",
+            "agents_invoked": [],
        }

    def _extract_partial_data(self, data: dict) -> dict | None:
@@ -1102,6 +1295,7 @@ The SDK will run invoked agents in parallel automatically.

        This handles cases where the AI produced valid data but it doesn't exactly
        match the expected schema (missing optional fields, type mismatches, etc.).
+        Defensively extracts findings from the raw dict so partial results are preserved.
        """
        if not isinstance(data, dict):
            return None
@@ -1109,6 +1303,7 @@ The SDK will run invoked agents in parallel automatically.
        resolved_ids = []
        unresolved_ids = []
        new_finding_ids = []
+        findings = []

        # Try to extract resolution verifications
        resolution_verifications = data.get("resolution_verifications", [])
@@ -1127,14 +1322,68 @@ The SDK will run invoked agents in parallel automatically.
                        ):
                            unresolved_ids.append(finding_id)

-        # Try to extract new findings
-        new_findings = data.get("new_findings", [])
-        if isinstance(new_findings, list):
-            for nf in new_findings:
-                if isinstance(nf, dict):
-                    finding_id = nf.get("id", "")
-                    if finding_id:
-                        new_finding_ids.append(finding_id)
+        # Try to extract new findings as PRReviewFinding objects
+        new_findings_raw = data.get("new_findings", [])
+        if isinstance(new_findings_raw, list):
+            for nf in new_findings_raw:
+                if not isinstance(nf, dict):
+                    continue
+                try:
+                    finding_id = nf.get("id", "") or self._generate_finding_id(
+                        nf.get("file", "unknown"),
+                        nf.get("line", 0),
+                        nf.get("title", "unknown"),
+                    )
+                    new_finding_ids.append(finding_id)
+                    findings.append(
+                        PRReviewFinding(
+                            id=finding_id,
+                            severity=_map_severity(nf.get("severity", "medium")),
+                            category=map_category(nf.get("category", "quality")),
+                            title=nf.get("title", "Unknown issue"),
+                            description=nf.get("description", ""),
+                            file=nf.get("file", "unknown"),
+                            line=nf.get("line", 0) or 0,
+                            suggested_fix=nf.get("suggested_fix"),
+                            fixable=bool(nf.get("fixable", False)),
+                            is_impact_finding=bool(nf.get("is_impact_finding", False)),
+                        )
+                    )
+                except Exception as e:
+                    logger.debug(
+                        f"[ParallelFollowup] Skipping malformed new finding: {e}"
+                    )
+
+        # Try to extract comment findings as PRReviewFinding objects
+        comment_findings_raw = data.get("comment_findings", [])
+        if isinstance(comment_findings_raw, list):
+            for cf in comment_findings_raw:
+                if not isinstance(cf, dict):
+                    continue
+                try:
+                    finding_id = cf.get("id", "") or self._generate_finding_id(
+                        cf.get("file", "unknown"),
+                        cf.get("line", 0),
+                        cf.get("title", "unknown"),
+                    )
+                    new_finding_ids.append(finding_id)
+                    findings.append(
+                        PRReviewFinding(
+                            id=finding_id,
+                            severity=_map_severity(cf.get("severity", "medium")),
+                            category=map_category(cf.get("category", "quality")),
+                            title=f"[FROM COMMENTS] {cf.get('title', 'Unknown issue')}",
+                            description=cf.get("description", ""),
+                            file=cf.get("file", "unknown"),
+                            line=cf.get("line", 0) or 0,
+                            suggested_fix=cf.get("suggested_fix"),
+                            fixable=bool(cf.get("fixable", False)),
+                        )
+                    )
+                except Exception as e:
+                    logger.debug(
+                        f"[ParallelFollowup] Skipping malformed comment finding: {e}"
+                    )

        # Try to extract verdict
        verdict_str = data.get("verdict", "NEEDS_REVISION")
@@ -1149,14 +1398,15 @@ The SDK will run invoked agents in parallel automatically.
        verdict_reasoning = data.get("verdict_reasoning", "Extracted from partial data")

        # Only return if we got any useful data
-        if resolved_ids or unresolved_ids or new_finding_ids:
+        if resolved_ids or unresolved_ids or new_finding_ids or findings:
            return {
-                "findings": [],  # Can't reliably extract full findings without validation
+                "findings": findings,
                "resolved_ids": resolved_ids,
                "unresolved_ids": unresolved_ids,
                "new_finding_ids": new_finding_ids,
                "dismissed_false_positive_ids": [],
                "confirmed_valid_count": 0,
+                "dismissed_finding_count": 0,
                "needs_human_review_count": 0,
                "verdict": verdict,
                "verdict_reasoning": f"[Partial extraction] {verdict_reasoning}",
@@ -633,7 +633,14 @@ Report findings with specific file paths, line numbers, and code evidence.
                logger.error(
                    f"[Specialist:{specialist_name}] Failed to parse structured output: {e}"
                )
-                # Fall through to text parsing
+                # Attempt to extract findings from raw dict before falling to text parsing
+                findings = self._extract_specialist_partial_data(
+                    specialist_name, structured_output
+                )
+                if findings:
+                    logger.info(
+                        f"[Specialist:{specialist_name}] Recovered {len(findings)} findings from partial extraction"
+                    )

        if not findings and result_text:
            # Fallback to text parsing
@@ -643,6 +650,63 @@ Report findings with specific file paths, line numbers, and code evidence.

        return findings

+    def _extract_specialist_partial_data(
+        self,
+        specialist_name: str,
+        data: dict[str, Any],
+    ) -> list[PRReviewFinding]:
+        """Extract findings from raw specialist dict when Pydantic validation fails.
+
+        Defensively extracts each finding individually so partial results are preserved
+        even if some findings have validation issues.
+        """
+        findings = []
+        raw_findings = data.get("findings", [])
+        if not isinstance(raw_findings, list):
+            return findings
+
+        for f in raw_findings:
+            if not isinstance(f, dict):
+                continue
+            try:
+                file_path = f.get("file", "unknown")
+                line = f.get("line", 0) or 0
+                title = f.get("title", "Unknown issue")
+
+                finding_id = hashlib.md5(
+                    f"{file_path}:{line}:{title}".encode(),
+                    usedforsecurity=False,
+                ).hexdigest()[:12]
+
+                category = map_category(f.get("category", "quality"))
+
+                try:
+                    severity = ReviewSeverity(str(f.get("severity", "medium")).lower())
+                except ValueError:
+                    severity = ReviewSeverity.MEDIUM
+
+                finding = PRReviewFinding(
+                    id=finding_id,
+                    file=file_path,
+                    line=line,
+                    end_line=f.get("end_line"),
+                    title=title,
+                    description=f.get("description", ""),
+                    category=category,
+                    severity=severity,
+                    suggested_fix=f.get("suggested_fix", ""),
+                    evidence=f.get("evidence"),
+                    source_agents=[specialist_name],
+                    is_impact_finding=bool(f.get("is_impact_finding", False)),
+                )
+                findings.append(finding)
+            except Exception as e:
+                logger.debug(
+                    f"[Specialist:{specialist_name}] Skipping malformed finding: {e}"
+                )
+
+        return findings
+
    async def _run_parallel_specialists(
        self,
        context: PRContext,
@@ -910,13 +974,15 @@ The SDK will run invoked agents in parallel automatically.
        except ValueError:
            severity = ReviewSeverity.MEDIUM

-        # Extract evidence: prefer verification.code_examined, fallback to evidence field
-        evidence = finding_data.evidence
+        # Extract evidence from verification.code_examined if available
+        evidence = None
        if hasattr(finding_data, "verification") and finding_data.verification:
-            # Structured verification has more detailed evidence
            verification = finding_data.verification
            if hasattr(verification, "code_examined") and verification.code_examined:
                evidence = verification.code_examined
+        # Fallback to evidence field if present (e.g. from dict-based parsing)
+        if not evidence:
+            evidence = getattr(finding_data, "evidence", None)

        # Extract end_line if present
        end_line = getattr(finding_data, "end_line", None)
@@ -1223,12 +1289,30 @@ The SDK will run invoked agents in parallel automatically.
                f"{len(filtered_findings)} filtered"
            )

-            # No confidence routing - validation is binary via finding-validator
-            unique_findings = validated_findings
-            logger.info(f"[PRReview] Final findings: {len(unique_findings)} validated")
+            # Separate active findings (drive verdict) from dismissed (shown in UI only)
+            active_findings = []
+            dismissed_findings = []
+            for f in validated_findings:
+                if f.validation_status == "dismissed_false_positive":
+                    dismissed_findings.append(f)
+                else:
+                    active_findings.append(f)

+            safe_print(
+                f"[ParallelOrchestrator] Final: {len(active_findings)} active, "
+                f"{len(dismissed_findings)} disputed by validator",
+                flush=True,
+            )
            logger.info(
-                f"[ParallelOrchestrator] Review complete: {len(unique_findings)} findings"
+                f"[PRReview] Final findings: {len(active_findings)} active, "
+                f"{len(dismissed_findings)} disputed"
+            )
+
+            # All findings (active + dismissed) go in the result for UI display
+            all_review_findings = validated_findings
+            logger.info(
+                f"[ParallelOrchestrator] Review complete: {len(all_review_findings)} findings "
+                f"({len(active_findings)} active, {len(dismissed_findings)} disputed)"
            )

            # Fetch CI status for verdict consideration
@@ -1238,9 +1322,9 @@ The SDK will run invoked agents in parallel automatically.
                f"{ci_status.get('failing', 0)} failing, {ci_status.get('pending', 0)} pending"
            )

-            # Generate verdict (includes merge conflict check, branch-behind check, and CI status)
+            # Generate verdict from ACTIVE findings only (dismissed don't affect verdict)
            verdict, verdict_reasoning, blockers = self._generate_verdict(
-                unique_findings,
+                active_findings,
                has_merge_conflicts=context.has_merge_conflicts,
                merge_state_status=context.merge_state_status,
                ci_status=ci_status,
@@ -1251,7 +1335,7 @@ The SDK will run invoked agents in parallel automatically.
                verdict=verdict,
                verdict_reasoning=verdict_reasoning,
                blockers=blockers,
-                findings=unique_findings,
+                findings=all_review_findings,
                agents_invoked=agents_invoked,
            )

@@ -1296,7 +1380,7 @@ The SDK will run invoked agents in parallel automatically.
                pr_number=context.pr_number,
                repo=self.config.repo,
                success=True,
-                findings=unique_findings,
+                findings=all_review_findings,
                summary=summary,
                overall_status=overall_status,
                verdict=verdict,
@@ -1785,6 +1869,7 @@ For EACH finding above:
                            or "concurrency" in error_str
                            or "circuit breaker" in error_str
                            or "tool_use" in error_str
+                            or "structured_output" in error_str
                        )

                        if is_retryable and attempt < MAX_VALIDATION_RETRIES:
@@ -1805,6 +1890,7 @@ For EACH finding above:
                        break

            except Exception as e:
+                # Part of retry loop structure - handles retryable errors
                error_str = str(e).lower()
                is_retryable = (
                    "400" in error_str
@@ -1869,12 +1955,38 @@ For EACH finding above:
                validated_findings.append(finding)

            elif validation.validation_status == "dismissed_false_positive":
-                # Dismiss - do not include
-                dismissed_count += 1
-                logger.info(
-                    f"[PRReview] Dismissed {finding.id} as false positive: "
-                    f"{validation.explanation[:100]}"
-                )
+                # Protect cross-validated findings from dismissal —
+                # if multiple specialists independently found the same issue,
+                # a single validator should not override that consensus
+                if finding.cross_validated:
+                    finding.validation_status = "confirmed_valid"
+                    finding.validation_evidence = validation.code_evidence
+                    finding.validation_explanation = (
+                        f"[Auto-kept: cross-validated by {len(finding.source_agents)} agents] "
+                        f"{validation.explanation}"
+                    )
+                    validated_findings.append(finding)
+                    safe_print(
+                        f"[FindingValidator] Kept cross-validated finding '{finding.title}' "
+                        f"despite dismissal (agents={finding.source_agents})",
+                        flush=True,
+                    )
+                else:
+                    # Keep finding but mark as dismissed (user can see it in UI)
+                    finding.validation_status = "dismissed_false_positive"
+                    finding.validation_evidence = validation.code_evidence
+                    finding.validation_explanation = validation.explanation
+                    validated_findings.append(finding)
+                    dismissed_count += 1
+                    safe_print(
+                        f"[FindingValidator] Disputed '{finding.title}': "
+                        f"{validation.explanation} (file={finding.file}:{finding.line})",
+                        flush=True,
+                    )
+                    logger.info(
+                        f"[PRReview] Disputed {finding.id}: "
+                        f"{validation.explanation[:200]}"
+                    )

            elif validation.validation_status == "needs_human_review":
                # Keep but flag
@@ -2059,11 +2171,16 @@ For EACH finding above:
                sev = f.severity.value
                emoji = severity_emoji.get(sev, "⚪")

+                is_disputed = f.validation_status == "dismissed_false_positive"
+
                # Finding header with location
                line_range = f"L{f.line}"
                if f.end_line and f.end_line != f.line:
                    line_range = f"L{f.line}-L{f.end_line}"
-                lines.append(f"#### {emoji} [{sev.upper()}] {f.title}")
+                if is_disputed:
+                    lines.append(f"#### ⚪ [DISPUTED] ~~{f.title}~~")
+                else:
+                    lines.append(f"#### {emoji} [{sev.upper()}] {f.title}")
                lines.append(f"**File:** `{f.file}` ({line_range})")

                # Cross-validation badge
@@ -2093,6 +2210,7 @@ For EACH finding above:
                    status_label = {
                        "confirmed_valid": "Confirmed",
                        "needs_human_review": "Needs human review",
+                        "dismissed_false_positive": "Disputed by validator",
                    }.get(f.validation_status, f.validation_status)
                    lines.append("")
                    lines.append(f"**Validation:** {status_label}")
@@ -2114,18 +2232,27 @@ For EACH finding above:

                lines.append("")

-            # Findings count summary
+            # Findings count summary (exclude dismissed from active count)
+            active_count = 0
+            dismissed_count = 0
            by_severity: dict[str, int] = {}
            for f in findings:
+                if f.validation_status == "dismissed_false_positive":
+                    dismissed_count += 1
+                    continue
+                active_count += 1
                sev = f.severity.value
                by_severity[sev] = by_severity.get(sev, 0) + 1
            summary_parts = []
            for sev in ["critical", "high", "medium", "low"]:
                if sev in by_severity:
                    summary_parts.append(f"{by_severity[sev]} {sev}")
-            lines.append(
-                f"**Total:** {len(findings)} finding(s) ({', '.join(summary_parts)})"
+            count_text = (
+                f"**Total:** {active_count} finding(s) ({', '.join(summary_parts)})"
            )
+            if dismissed_count > 0:
+                count_text += f" + {dismissed_count} disputed"
+            lines.append(count_text)
            lines.append("")

        lines.append("---")
@@ -26,10 +26,10 @@ from __future__ import annotations

 from typing import Literal

-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, field_validator

 # =============================================================================
-# Verification Evidence (Required for All Findings)
+# Verification Evidence (Optional for findings — only code_examined is consumed)
 # =============================================================================


@@ -50,102 +50,28 @@ class VerificationEvidence(BaseModel):


 # =============================================================================
-# Common Finding Types
+# Severity / Category Validators
 # =============================================================================

-
-class BaseFinding(BaseModel):
-    """Base class for all finding types."""
-
-    id: str = Field(description="Unique identifier for this finding")
-    severity: Literal["critical", "high", "medium", "low"] = Field(
-        description="Issue severity level"
-    )
-    title: str = Field(description="Brief issue title (max 80 chars)")
-    description: str = Field(description="Detailed explanation of the issue")
-    file: str = Field(description="File path where issue was found")
-    line: int = Field(0, description="Line number of the issue")
-    suggested_fix: str | None = Field(None, description="How to fix this issue")
-    fixable: bool = Field(False, description="Whether this can be auto-fixed")
-    evidence: str | None = Field(
-        None,
-        description="DEPRECATED: Use verification.code_examined instead. Will be removed in Phase 5.",
-    )
-    verification: VerificationEvidence = Field(
-        description="Evidence that this finding was verified against actual code"
-    )
+_VALID_SEVERITIES = {"critical", "high", "medium", "low"}


-class SecurityFinding(BaseFinding):
-    """A security vulnerability finding."""
-
-    category: Literal["security"] = Field(
-        default="security", description="Always 'security' for security findings"
-    )
+def _normalize_severity(v: str) -> str:
+    """Normalize severity to a valid value, defaulting to 'medium'."""
+    if isinstance(v, str):
+        v = v.lower().strip()
+    if v not in _VALID_SEVERITIES:
+        return "medium"
+    return v


-class QualityFinding(BaseFinding):
-    """A code quality or redundancy finding."""
-
-    category: Literal[
-        "redundancy", "quality", "test", "performance", "pattern", "docs"
-    ] = Field(description="Issue category")
-    redundant_with: str | None = Field(
-        None, description="Reference to duplicate code (file:line) if redundant"
-    )
-
-
-class DeepAnalysisFinding(BaseFinding):
-    """A finding from deep analysis with verification info."""
-
-    category: Literal[
-        "verification_failed",
-        "redundancy",
-        "quality",
-        "pattern",
-        "performance",
-        "logic",
-    ] = Field(description="Issue category")
-    verification_note: str | None = Field(
-        None, description="What evidence is missing or couldn't be verified"
-    )
-
-
-class StructuralIssue(BaseModel):
-    """A structural issue with the PR."""
-
-    id: str = Field(description="Unique identifier")
-    issue_type: Literal[
-        "feature_creep", "scope_creep", "architecture_violation", "poor_structure"
-    ] = Field(description="Type of structural issue")
-    severity: Literal["critical", "high", "medium", "low"] = Field(
-        description="Issue severity"
-    )
-    title: str = Field(description="Brief issue title")
-    description: str = Field(description="Detailed explanation")
-    impact: str = Field(description="Why this matters")
-    suggestion: str = Field(description="How to fix")
-
-
-class AICommentTriage(BaseModel):
-    """Triage result for an AI tool comment."""
-
-    comment_id: int = Field(description="GitHub comment ID")
-    tool_name: str = Field(
-        description="AI tool name (CodeRabbit, Cursor, Greptile, etc.)"
-    )
-    verdict: Literal[
-        "critical",
-        "important",
-        "nice_to_have",
-        "trivial",
-        "addressed",
-        "false_positive",
-    ] = Field(description="Verdict on the comment")
-    reasoning: str = Field(description="Why this verdict was chosen")
-    response_comment: str | None = Field(
-        None, description="Optional comment to post in reply"
-    )
+def _normalize_category(v: str, valid_set: set[str], default: str = "quality") -> str:
+    """Normalize category to a valid value, defaulting to given default."""
+    if isinstance(v, str):
+        v = v.lower().strip().replace("-", "_")
+    if v not in valid_set:
+        return default
+    return v


 # =============================================================================
@@ -163,25 +89,34 @@ class FindingResolution(BaseModel):
    )


+_FOLLOWUP_CATEGORIES = {"security", "quality", "logic", "test", "docs"}
+
+
 class FollowupFinding(BaseModel):
-    """A new finding from follow-up review (simpler than initial review)."""
+    """A new finding from follow-up review (simpler than initial review).
+
+    verification is intentionally omitted — not consumed by followup_reviewer.py.
+    """

    id: str = Field(description="Unique identifier for this finding")
-    severity: Literal["critical", "high", "medium", "low"] = Field(
-        description="Issue severity level"
-    )
-    category: Literal["security", "quality", "logic", "test", "docs"] = Field(
-        description="Issue category"
-    )
+    severity: str = Field(description="Issue severity level")
+    category: str = Field(description="Issue category")
    title: str = Field(description="Brief issue title")
    description: str = Field(description="Detailed explanation of the issue")
    file: str = Field(description="File path where issue was found")
    line: int = Field(0, description="Line number of the issue")
    suggested_fix: str | None = Field(None, description="How to fix this issue")
    fixable: bool = Field(False, description="Whether this can be auto-fixed")
-    verification: VerificationEvidence = Field(
-        description="Evidence that this finding was verified against actual code"
-    )
+
+    @field_validator("severity", mode="before")
+    @classmethod
+    def _normalize_severity(cls, v: str) -> str:
+        return _normalize_severity(v)
+
+    @field_validator("category", mode="before")
+    @classmethod
+    def _normalize_category(cls, v: str) -> str:
+        return _normalize_category(v, _FOLLOWUP_CATEGORIES)


 class FollowupReviewResponse(BaseModel):
@@ -203,81 +138,6 @@ class FollowupReviewResponse(BaseModel):
    verdict_reasoning: str = Field(description="Explanation for the verdict")


-# =============================================================================
-# Initial Review Responses (Multi-Pass)
-# =============================================================================
-
-
-class QuickScanResult(BaseModel):
-    """Result from the quick scan pass."""
-
-    purpose: str = Field(description="Brief description of what the PR claims to do")
-    actual_changes: str = Field(
-        description="Brief description of what the code actually does"
-    )
-    purpose_match: bool = Field(
-        description="Whether actual changes match the claimed purpose"
-    )
-    purpose_match_note: str | None = Field(
-        None, description="Explanation if purpose doesn't match actual changes"
-    )
-    risk_areas: list[str] = Field(
-        default_factory=list, description="Areas needing careful review"
-    )
-    red_flags: list[str] = Field(
-        default_factory=list, description="Obvious issues or concerns"
-    )
-    requires_deep_verification: bool = Field(
-        description="Whether deep verification is needed"
-    )
-    complexity: Literal["low", "medium", "high"] = Field(description="PR complexity")
-
-
-class SecurityPassResult(BaseModel):
-    """Result from the security pass - array of security findings."""
-
-    findings: list[SecurityFinding] = Field(
-        default_factory=list, description="Security vulnerabilities found"
-    )
-
-
-class QualityPassResult(BaseModel):
-    """Result from the quality pass - array of quality findings."""
-
-    findings: list[QualityFinding] = Field(
-        default_factory=list, description="Quality and redundancy issues found"
-    )
-
-
-class DeepAnalysisResult(BaseModel):
-    """Result from the deep analysis pass."""
-
-    findings: list[DeepAnalysisFinding] = Field(
-        default_factory=list,
-        description="Deep analysis findings with verification info",
-    )
-
-
-class StructuralPassResult(BaseModel):
-    """Result from the structural pass."""
-
-    issues: list[StructuralIssue] = Field(
-        default_factory=list, description="Structural issues found"
-    )
-    verdict: Literal[
-        "READY_TO_MERGE", "MERGE_WITH_CHANGES", "NEEDS_REVISION", "BLOCKED"
-    ] = Field(description="Structural verdict")
-    verdict_reasoning: str = Field(description="Explanation for the verdict")
-
-
-class AICommentTriageResult(BaseModel):
-    """Result from AI comment triage pass."""
-
-    triages: list[AICommentTriage] = Field(
-        default_factory=list, description="Triage results for each AI comment"
-    )
-
-
 # =============================================================================
 # Issue Triage Response
 # =============================================================================
@@ -320,88 +180,21 @@ class IssueTriageResponse(BaseModel):
    comment: str | None = Field(None, description="Optional bot comment to post")


-# =============================================================================
-# Orchestrator Review Response
-# =============================================================================
-
-
-class OrchestratorFinding(BaseModel):
-    """A finding from the orchestrator review."""
-
-    file: str = Field(description="File path where issue was found")
-    line: int = Field(0, description="Line number of the issue")
-    title: str = Field(description="Brief issue title")
-    description: str = Field(description="Detailed explanation of the issue")
-    category: Literal[
-        "security",
-        "quality",
-        "style",
-        "docs",
-        "redundancy",
-        "verification_failed",
-        "pattern",
-        "performance",
-        "logic",
-        "test",
-    ] = Field(description="Issue category")
-    severity: Literal["critical", "high", "medium", "low"] = Field(
-        description="Issue severity level"
-    )
-    suggestion: str | None = Field(None, description="How to fix this issue")
-    evidence: str | None = Field(
-        None,
-        description="DEPRECATED: Use verification.code_examined instead. Will be removed in Phase 5.",
-    )
-    verification: VerificationEvidence = Field(
-        description="Evidence that this finding was verified against actual code"
-    )
-
-
-class OrchestratorReviewResponse(BaseModel):
-    """Complete response schema for orchestrator PR review."""
-
-    verdict: Literal[
-        "READY_TO_MERGE", "MERGE_WITH_CHANGES", "NEEDS_REVISION", "BLOCKED"
-    ] = Field(description="Overall merge verdict")
-    verdict_reasoning: str = Field(description="Explanation for the verdict")
-    findings: list[OrchestratorFinding] = Field(
-        default_factory=list, description="Issues found during review"
-    )
-    summary: str = Field(description="Brief summary of the review")
-
-
 # =============================================================================
 # Parallel Orchestrator Review Response (SDK Subagents)
 # =============================================================================

-
-class LogicFinding(BaseFinding):
-    """A logic/correctness finding from the logic review agent."""
-
-    category: Literal["logic"] = Field(
-        default="logic", description="Always 'logic' for logic findings"
-    )
-    example_input: str | None = Field(
-        None, description="Concrete input that triggers the bug"
-    )
-    actual_output: str | None = Field(None, description="What the buggy code produces")
-    expected_output: str | None = Field(
-        None, description="What the code should produce"
-    )
-
-
-class CodebaseFitFinding(BaseFinding):
-    """A codebase fit finding from the codebase fit review agent."""
-
-    category: Literal["codebase_fit"] = Field(
-        default="codebase_fit", description="Always 'codebase_fit' for fit findings"
-    )
-    existing_code: str | None = Field(
-        None, description="Reference to existing code that should be used instead"
-    )
-    codebase_pattern: str | None = Field(
-        None, description="Description of the established pattern being violated"
-    )
+_ORCHESTRATOR_CATEGORIES = {
+    "security",
+    "quality",
+    "logic",
+    "codebase_fit",
+    "test",
+    "docs",
+    "redundancy",
+    "pattern",
+    "performance",
+}


 class ParallelOrchestratorFinding(BaseModel):
@@ -413,26 +206,11 @@ class ParallelOrchestratorFinding(BaseModel):
    end_line: int | None = Field(None, description="End line for multi-line issues")
    title: str = Field(description="Brief issue title (max 80 chars)")
    description: str = Field(description="Detailed explanation of the issue")
-    category: Literal[
-        "security",
-        "quality",
-        "logic",
-        "codebase_fit",
-        "test",
-        "docs",
-        "redundancy",
-        "pattern",
-        "performance",
-    ] = Field(description="Issue category")
-    severity: Literal["critical", "high", "medium", "low"] = Field(
-        description="Issue severity level"
-    )
-    evidence: str | None = Field(
+    category: str = Field(description="Issue category")
+    severity: str = Field(description="Issue severity level")
+    verification: VerificationEvidence | None = Field(
        None,
-        description="DEPRECATED: Use verification.code_examined instead. Will be removed in Phase 5.",
-    )
-    verification: VerificationEvidence = Field(
-        description="Evidence that this finding was verified against actual code"
+        description="Evidence that this finding was verified against actual code",
    )
    is_impact_finding: bool = Field(
        False,
@@ -459,6 +237,16 @@ class ParallelOrchestratorFinding(BaseModel):
        False, description="Whether multiple agents agreed on this finding"
    )

+    @field_validator("severity", mode="before")
+    @classmethod
+    def _normalize_severity(cls, v: str) -> str:
+        return _normalize_severity(v)
+
+    @field_validator("category", mode="before")
+    @classmethod
+    def _normalize_category(cls, v: str) -> str:
+        return _normalize_category(v, _ORCHESTRATOR_CATEGORIES)
+

 class AgentAgreement(BaseModel):
    """Tracks agreement between agents on findings."""
@@ -514,15 +302,22 @@ class ValidationSummary(BaseModel):
    )


+_SPECIALIST_CATEGORIES = {
+    "security",
+    "quality",
+    "logic",
+    "performance",
+    "pattern",
+    "test",
+    "docs",
+}
+
+
 class SpecialistFinding(BaseModel):
    """A finding from a specialist agent (used in parallel SDK sessions)."""

-    severity: Literal["critical", "high", "medium", "low"] = Field(
-        description="Issue severity level"
-    )
-    category: Literal[
-        "security", "quality", "logic", "performance", "pattern", "test", "docs"
-    ] = Field(description="Issue category")
+    severity: str = Field(description="Issue severity level")
+    category: str = Field(description="Issue category")
    title: str = Field(description="Brief issue title (max 80 chars)")
    description: str = Field(description="Detailed explanation of the issue")
    file: str = Field(description="File path where issue was found")
@@ -530,14 +325,24 @@ class SpecialistFinding(BaseModel):
    end_line: int | None = Field(None, description="End line number if multi-line")
    suggested_fix: str | None = Field(None, description="How to fix this issue")
    evidence: str = Field(
-        min_length=1,
-        description="Actual code snippet examined that shows the issue. Required.",
+        default="",
+        description="Actual code snippet examined that shows the issue.",
    )
    is_impact_finding: bool = Field(
        False,
        description="True if this is about affected code outside the PR (callers, dependencies)",
    )

+    @field_validator("severity", mode="before")
+    @classmethod
+    def _normalize_severity(cls, v: str) -> str:
+        return _normalize_severity(v)
+
+    @field_validator("category", mode="before")
+    @classmethod
+    def _normalize_category(cls, v: str) -> str:
+        return _normalize_category(v, _SPECIALIST_CATEGORIES)
+

 class SpecialistResponse(BaseModel):
    """Response schema for individual specialist agent (parallel SDK sessions).
@@ -611,6 +416,17 @@ class ResolutionVerification(BaseModel):
    )


+_PARALLEL_FOLLOWUP_CATEGORIES = {
+    "security",
+    "quality",
+    "logic",
+    "test",
+    "docs",
+    "regression",
+    "incomplete_fix",
+}
+
+
 class ParallelFollowupFinding(BaseModel):
    """A finding from parallel follow-up review."""

@@ -619,18 +435,8 @@ class ParallelFollowupFinding(BaseModel):
    line: int = Field(0, description="Line number of the issue")
    title: str = Field(description="Brief issue title")
    description: str = Field(description="Detailed explanation of the issue")
-    category: Literal[
-        "security",
-        "quality",
-        "logic",
-        "test",
-        "docs",
-        "regression",
-        "incomplete_fix",
-    ] = Field(description="Issue category")
-    severity: Literal["critical", "high", "medium", "low"] = Field(
-        description="Issue severity level"
-    )
+    category: str = Field(description="Issue category")
+    severity: str = Field(description="Issue severity level")
    suggested_fix: str | None = Field(None, description="How to fix this issue")
    fixable: bool = Field(False, description="Whether this can be auto-fixed")
    is_impact_finding: bool = Field(
@@ -638,6 +444,16 @@ class ParallelFollowupFinding(BaseModel):
        description="True if this finding is about impact on OTHER files outside the PR diff",
    )

+    @field_validator("severity", mode="before")
+    @classmethod
+    def _normalize_severity(cls, v: str) -> str:
+        return _normalize_severity(v)
+
+    @field_validator("category", mode="before")
+    @classmethod
+    def _normalize_category(cls, v: str) -> str:
+        return _normalize_category(v, _PARALLEL_FOLLOWUP_CATEGORIES)
+

 class ParallelFollowupResponse(BaseModel):
    """Complete response schema for parallel follow-up PR review.
@@ -710,3 +526,55 @@ class FindingValidationResponse(BaseModel):
            "how many dismissed, how many need human review"
        )
    )
+
+
+# =============================================================================
+# Minimal Extraction Schema (Fallback for structured output validation failure)
+# =============================================================================
+
+
+class ExtractedFindingSummary(BaseModel):
+    """Per-finding summary with file location for extraction recovery."""
+
+    severity: str = Field(description="Severity level: LOW, MEDIUM, HIGH, or CRITICAL")
+    description: str = Field(description="One-line description of the finding")
+    file: str = Field(
+        default="unknown", description="File path where the issue was found"
+    )
+    line: int = Field(default=0, description="Line number in the file (0 if unknown)")
+
+    @field_validator("severity", mode="before")
+    @classmethod
+    def _normalize_severity(cls, v: str) -> str:
+        return _normalize_severity(v)
+
+
+class FollowupExtractionResponse(BaseModel):
+    """Minimal extraction schema for recovering data when full structured output fails.
+
+    Uses ExtractedFindingSummary for new findings to preserve file/line information.
+    Used as an intermediate recovery step before falling back to raw text parsing.
+    """
+
+    verdict: Literal[
+        "READY_TO_MERGE", "MERGE_WITH_CHANGES", "NEEDS_REVISION", "BLOCKED"
+    ] = Field(description="Overall merge verdict")
+    verdict_reasoning: str = Field(description="Explanation for the verdict")
+    resolved_finding_ids: list[str] = Field(
+        default_factory=list,
+        description="IDs of previous findings that are now resolved",
+    )
+    unresolved_finding_ids: list[str] = Field(
+        default_factory=list,
+        description="IDs of previous findings that remain unresolved",
+    )
+    new_finding_summaries: list[ExtractedFindingSummary] = Field(
+        default_factory=list,
+        description="Structured summary of each new finding with file location",
+    )
+    confirmed_finding_count: int = Field(
+        0, description="Number of findings confirmed as valid"
+    )
+    dismissed_finding_count: int = Field(
+        0, description="Number of findings dismissed as false positives"
+    )
@@ -0,0 +1,120 @@
+"""
+Recovery Utilities for PR Review
+=================================
+
+Shared helpers for extraction recovery in followup and parallel followup reviewers.
+
+These utilities consolidate duplicated logic for:
+- Parsing "SEVERITY: description" patterns from extraction summaries
+- Generating consistent, traceable finding IDs with prefixes
+- Creating PRReviewFinding objects from extraction data
+"""
+
+from __future__ import annotations
+
+import hashlib
+
+try:
+    from ..models import (
+        PRReviewFinding,
+        ReviewCategory,
+        ReviewSeverity,
+    )
+except (ImportError, ValueError, SystemError):
+    from models import (
+        PRReviewFinding,
+        ReviewCategory,
+        ReviewSeverity,
+    )
+
+# Severity mapping for parsing "SEVERITY: description" patterns
+_EXTRACTION_SEVERITY_MAP: list[tuple[str, ReviewSeverity]] = [
+    ("CRITICAL:", ReviewSeverity.CRITICAL),
+    ("HIGH:", ReviewSeverity.HIGH),
+    ("MEDIUM:", ReviewSeverity.MEDIUM),
+    ("LOW:", ReviewSeverity.LOW),
+]
+
+
+def parse_severity_from_summary(
+    summary: str,
+) -> tuple[ReviewSeverity, str]:
+    """Parse a "SEVERITY: description" pattern from an extraction summary.
+
+    Args:
+        summary: Raw summary string, e.g. "HIGH: Missing null check in parser.py"
+
+    Returns:
+        Tuple of (severity, cleaned_description).
+        Defaults to MEDIUM severity if no prefix is found.
+    """
+    upper_summary = summary.upper()
+    for sev_name, sev_val in _EXTRACTION_SEVERITY_MAP:
+        if upper_summary.startswith(sev_name):
+            return sev_val, summary[len(sev_name) :].strip()
+    return ReviewSeverity.MEDIUM, summary
+
+
+def generate_recovery_finding_id(
+    index: int, description: str, prefix: str = "FR"
+) -> str:
+    """Generate a consistent, traceable finding ID for recovery findings.
+
+    Args:
+        index: The index of the finding in the extraction list.
+        description: The finding description (used for hash uniqueness).
+        prefix: ID prefix for traceability. Default "FR" (Followup Recovery).
+                Use "FU" for parallel followup findings.
+
+    Returns:
+        A prefixed finding ID like "FR-A1B2C3D4" or "FU-A1B2C3D4".
+    """
+    content = f"extraction-{index}-{description}"
+    hex_hash = (
+        hashlib.md5(content.encode(), usedforsecurity=False).hexdigest()[:8].upper()
+    )
+    return f"{prefix}-{hex_hash}"
+
+
+def create_finding_from_summary(
+    summary: str,
+    index: int,
+    id_prefix: str = "FR",
+    severity_override: str | None = None,
+    file: str = "unknown",
+    line: int = 0,
+) -> PRReviewFinding:
+    """Create a PRReviewFinding from an extraction summary string.
+
+    Parses "SEVERITY: description" patterns, generates a traceable finding ID,
+    and returns a fully constructed PRReviewFinding.
+
+    Args:
+        summary: Raw summary string, e.g. "HIGH: Missing null check in parser.py"
+        index: The index of the finding in the extraction list.
+        id_prefix: ID prefix for traceability. Default "FR" (Followup Recovery).
+        severity_override: If provided, use this severity instead of parsing from summary.
+        file: File path where the issue was found (default "unknown").
+        line: Line number in the file (default 0).
+
+    Returns:
+        A PRReviewFinding with parsed severity, generated ID, and description.
+    """
+    severity, description = parse_severity_from_summary(summary)
+
+    # Use severity_override if provided
+    if severity_override is not None:
+        severity_map = {k.rstrip(":"): v for k, v in _EXTRACTION_SEVERITY_MAP}
+        severity = severity_map.get(severity_override.upper(), severity)
+
+    finding_id = generate_recovery_finding_id(index, description, prefix=id_prefix)
+
+    return PRReviewFinding(
+        id=finding_id,
+        severity=severity,
+        category=ReviewCategory.QUALITY,
+        title=description[:80],
+        description=f"[Recovered via extraction] {description}",
+        file=file,
+        line=line,
+    )
@@ -133,6 +133,13 @@ def _get_tool_detail(tool_name: str, tool_input: dict[str, Any]) -> str:
 # Prevents runaway retry loops from consuming unbounded resources
 MAX_MESSAGE_COUNT = 500

+# Errors that are recoverable (callers can fall back to text parsing or retry)
+# vs fatal errors (auth failures, circuit breaker) that should propagate
+RECOVERABLE_ERRORS = {
+    "structured_output_validation_failed",
+    "tool_use_concurrency_error",
+}
+
 # Abort after 1 consecutive repeat (2 total identical responses).
 # Low threshold catches error loops quickly (e.g., auth errors returned as AI text).
 # Normal AI responses never produce the exact same text block twice in a row.
@@ -261,8 +268,11 @@ async def process_sdk_stream(
        - msg_count: Total message count
        - subagent_tool_ids: Mapping of tool_id -> agent_name
        - error: Error message if stream processing failed (None on success)
+        - error_recoverable: Boolean indicating if the error is recoverable (fallback possible) vs fatal
+        - last_assistant_text: Last non-empty assistant text block (for cleaner fallback parsing)
    """
    result_text = ""
+    last_assistant_text = ""  # Last assistant text block (for cleaner fallback parsing)
    structured_output = None
    agents_invoked = []
    msg_count = 0
@@ -481,6 +491,9 @@ async def process_sdk_stream(
                        block_type = type(block).__name__
                        if block_type == "TextBlock" and hasattr(block, "text"):
                            result_text += block.text
+                            # Track last non-empty text for fallback parsing
+                            if block.text.strip():
+                                last_assistant_text = block.text
                            # Check for auth/access error returned as AI response text.
                            # Note: break exits this inner for-loop over msg.content;
                            # the outer message loop exits via `if stream_error: break`.
@@ -647,11 +660,16 @@ async def process_sdk_stream(
            f"[{context_name}] Tool use concurrency error detected - caller should retry"
        )

+    # Categorize error as recoverable (fallback possible) vs fatal
+    error_recoverable = stream_error in RECOVERABLE_ERRORS if stream_error else False
+
    return {
        "result_text": result_text,
+        "last_assistant_text": last_assistant_text,
        "structured_output": structured_output,
        "agents_invoked": agents_invoked,
        "msg_count": msg_count,
        "subagent_tool_ids": subagent_tool_ids,
        "error": stream_error,
+        "error_recoverable": error_recoverable,
    }
@@ -8,8 +8,10 @@ about a codebase. It can also suggest tasks based on the conversation.

 import argparse
 import asyncio
+import base64
 import json
 import sys
+import tempfile
 from pathlib import Path

 # Add auto-claude to path
@@ -111,6 +113,107 @@ def load_project_context(project_dir: str) -> str:
    )


+ALLOWED_MIME_TYPES = frozenset(
+    ["image/png", "image/jpeg", "image/jpg", "image/gif", "image/webp"]
+)
+
+MAX_IMAGE_FILE_SIZE = 10 * 1024 * 1024  # 10 MB (aligned with frontend MAX_IMAGE_SIZE)
+
+
+def load_images_from_manifest(manifest_path: str) -> list[dict]:
+    """Load images from a manifest JSON file.
+
+    The manifest contains an array of objects with 'path' and 'mimeType' fields.
+    Each image file is read as binary and encoded to base64.
+
+    Returns a list of dicts with 'media_type' and 'data' (base64-encoded) fields.
+    """
+    images = []
+    tmp_dir = Path(tempfile.gettempdir()).resolve()
+
+    try:
+        with open(manifest_path, encoding="utf-8") as f:
+            manifest = json.load(f)
+
+        for entry in manifest:
+            image_path = entry.get("path")
+            mime_type = entry.get("mimeType", "image/png")
+
+            if not image_path:
+                debug_error(
+                    "insights_runner",
+                    "Image entry missing path field",
+                )
+                continue
+
+            # Validate path is within temp directory before checking existence
+            try:
+                resolved = Path(image_path).resolve()
+                if not resolved.is_relative_to(tmp_dir):
+                    debug_error(
+                        "insights_runner",
+                        f"Image path outside temp directory, skipping: {image_path}",
+                    )
+                    continue
+            except (ValueError, OSError):
+                debug_error(
+                    "insights_runner",
+                    f"Invalid image path, skipping: {image_path}",
+                )
+                continue
+
+            if not resolved.exists():
+                debug_error(
+                    "insights_runner",
+                    f"Image file not found: {image_path}",
+                )
+                continue
+
+            # Validate MIME type against allowlist
+            if mime_type not in ALLOWED_MIME_TYPES:
+                debug_error(
+                    "insights_runner",
+                    f"Invalid MIME type '{mime_type}', skipping: {image_path}",
+                )
+                continue
+
+            # Validate file size
+            file_size = resolved.stat().st_size
+            if file_size > MAX_IMAGE_FILE_SIZE:
+                debug_error(
+                    "insights_runner",
+                    f"Image too large ({file_size} bytes), skipping: {image_path}",
+                )
+                continue
+
+            try:
+                with open(resolved, "rb") as img_f:
+                    image_data = base64.b64encode(img_f.read()).decode("utf-8")
+                images.append(
+                    {
+                        "media_type": mime_type,
+                        "data": image_data,
+                    }
+                )
+                debug(
+                    "insights_runner",
+                    "Loaded image",
+                    path=image_path,
+                    mime_type=mime_type,
+                    size_bytes=file_size,
+                )
+            except Exception as e:
+                debug_error(
+                    "insights_runner",
+                    f"Failed to read image {image_path}: {e}",
+                )
+
+    except (json.JSONDecodeError, OSError) as e:
+        debug_error("insights_runner", f"Failed to load images manifest: {e}")
+
+    return images
+
+
 def build_system_prompt(project_dir: str) -> str:
    """Build the system prompt for the insights agent."""
    context = load_project_context(project_dir)
@@ -143,11 +246,12 @@ async def run_with_sdk(
    history: list,
    model: str = "sonnet",  # Shorthand - resolved via API Profile if configured
    thinking_level: str = "medium",
+    images: list[dict] | None = None,
 ) -> None:
    """Run the chat using Claude SDK with streaming."""
    if not SDK_AVAILABLE:
        print("Claude SDK not available, falling back to simple mode", file=sys.stderr)
-        run_simple(project_dir, message, history)
+        run_simple(project_dir, message, history, images)
        return

    if not get_auth_token():
@@ -155,7 +259,7 @@ async def run_with_sdk(
            "No authentication token found, falling back to simple mode",
            file=sys.stderr,
        )
-        run_simple(project_dir, message, history)
+        run_simple(project_dir, message, history, images)
        return

    # Ensure SDK can find the token
@@ -205,8 +309,24 @@ Current question: {message}"""

        # Use async context manager pattern
        async with client:
-            # Send the query
-            await client.query(full_prompt)
+            # Build the query - images are stored for reference but SDK doesn't support multi-modal input yet
+            if images:
+                debug(
+                    "insights_runner",
+                    "Images attached but SDK does not support multi-modal input",
+                    image_count=len(images),
+                )
+
+                # TODO: When the SDK adds support for multi-modal content blocks, update this.
+                image_note = f"\n\n[Note: The user attached {len(images)} image(s), but the current SDK version does not support multi-modal input. Please ask the user to describe the image content instead.]"
+                print(
+                    "Warning: Image attachments cannot be sent to the model in SDK mode. Sending text-only query.",
+                    file=sys.stderr,
+                )
+                await client.query(full_prompt + image_note)
+            else:
+                # Send the query as plain text
+                await client.query(full_prompt)

            # Stream the response
            response_text = ""
@@ -280,13 +400,21 @@ Current question: {message}"""
        import traceback

        traceback.print_exc(file=sys.stderr)
-        run_simple(project_dir, message, history)
+        run_simple(project_dir, message, history, images)


-def run_simple(project_dir: str, message: str, history: list) -> None:
+def run_simple(
+    project_dir: str, message: str, history: list, images: list[dict] | None = None
+) -> None:
    """Simple fallback mode without SDK - uses subprocess to call claude CLI."""
    import subprocess

+    if images:
+        print(
+            "Warning: Image attachments are not supported in simple mode and will be skipped.",
+            file=sys.stderr,
+        )
+
    system_prompt = build_system_prompt(project_dir)

    # Build conversation context
@@ -355,6 +483,10 @@ def main():
        default="medium",
        help="Thinking level for extended reasoning (low, medium, high)",
    )
+    parser.add_argument(
+        "--images-file",
+        help="Path to JSON manifest file listing image file paths and MIME types",
+    )
    args = parser.parse_args()

    # Validate and sanitize thinking level (handles legacy values like 'ultrathink')
@@ -398,9 +530,25 @@ def main():
        debug_error("insights_runner", f"Failed to load history: {e}")
        history = []

+    # Load images from manifest file if provided
+    images = None
+    if args.images_file:
+        debug("insights_runner", "Loading images from manifest", file=args.images_file)
+        images = load_images_from_manifest(args.images_file)
+        if images:
+            debug(
+                "insights_runner",
+                "Loaded images for multi-modal query",
+                image_count=len(images),
+            )
+        else:
+            debug("insights_runner", "No valid images loaded from manifest")
+
    # Run the async SDK function
    debug("insights_runner", "Running SDK query")
-    asyncio.run(run_with_sdk(project_dir, user_message, history, model, thinking_level))
+    asyncio.run(
+        run_with_sdk(project_dir, user_message, history, model, thinking_level, images)
+    )
    debug_success("insights_runner", "Query completed")


@@ -31,6 +31,7 @@ class CompetitorAnalyzer:
        self.refresh = refresh
        self.agent_executor = agent_executor
        self.analysis_file = output_dir / "competitor_analysis.json"
+        self.manual_competitors_file = output_dir / "manual_competitors.json"
        self.discovery_file = output_dir / "roadmap_discovery.json"
        self.project_index_file = output_dir / "project_index.json"

@@ -42,7 +43,10 @@ class CompetitorAnalyzer:
        """
        if not enabled:
            print_status("Competitor analysis not enabled, skipping", "info")
+            manual_competitors = self._get_manual_competitors()
            self._create_disabled_analysis_file()
+            if manual_competitors:
+                self._merge_manual_competitors(manual_competitors)
            return RoadmapPhaseResult(
                "competitor_analysis", True, [str(self.analysis_file)], [], 0
            )
@@ -53,6 +57,9 @@ class CompetitorAnalyzer:
                "competitor_analysis", True, [str(self.analysis_file)], [], 0
            )

+        # Preserve manual competitors before any path that overwrites the file
+        manual_competitors = self._get_manual_competitors()
+
        if not self.discovery_file.exists():
            print_status(
                "Discovery file not found, skipping competitor analysis", "warning"
@@ -60,6 +67,8 @@ class CompetitorAnalyzer:
            self._create_error_analysis_file(
                "Discovery file not found - cannot analyze competitors without project context"
            )
+            if manual_competitors:
+                self._merge_manual_competitors(manual_competitors)
            return RoadmapPhaseResult(
                "competitor_analysis",
                True,
@@ -84,6 +93,8 @@ class CompetitorAnalyzer:
            if success and self.analysis_file.exists():
                validation_result = self._validate_analysis()
                if validation_result is not None:
+                    if manual_competitors:
+                        self._merge_manual_competitors(manual_competitors)
                    return validation_result
                errors.append(f"Attempt {attempt + 1}: Validation failed")
            else:
@@ -100,12 +111,82 @@ class CompetitorAnalyzer:
            print(f"  {muted('Error:')} {err}")

        self._create_error_analysis_file("Analysis failed after retries", errors)
+        if manual_competitors:
+            self._merge_manual_competitors(manual_competitors)

        # Return success=True for graceful degradation (don't block roadmap generation)
        return RoadmapPhaseResult(
            "competitor_analysis", True, [str(self.analysis_file)], errors, MAX_RETRIES
        )

+    def _get_manual_competitors(self) -> list[dict]:
+        """Extract manually-added competitors from the dedicated manual file and analysis file.
+
+        Reads from manual_competitors.json (primary, never overwritten by agent) and
+        falls back to competitor_analysis.json. Deduplicates by competitor ID.
+        Returns a list of competitor dicts where source == 'manual'.
+        """
+        competitors_by_id: dict[str, dict] = {}
+
+        # Primary source: dedicated manual competitors file (never overwritten by agent)
+        if self.manual_competitors_file.exists():
+            try:
+                with open(self.manual_competitors_file, encoding="utf-8") as f:
+                    data = json.load(f)
+                for c in data.get("competitors", []):
+                    if isinstance(c, dict) and c.get("id"):
+                        competitors_by_id[c["id"]] = c
+            except (json.JSONDecodeError, OSError) as e:
+                print_status(
+                    f"Warning: could not read manual competitors file: {e}", "warning"
+                )
+
+        # Fallback: also check analysis file for manual competitors
+        if self.analysis_file.exists():
+            try:
+                with open(self.analysis_file, encoding="utf-8") as f:
+                    data = json.load(f)
+                for c in data.get("competitors", []):
+                    if (
+                        isinstance(c, dict)
+                        and c.get("source") == "manual"
+                        and c.get("id")
+                        and c["id"] not in competitors_by_id
+                    ):
+                        competitors_by_id[c["id"]] = c
+            except (json.JSONDecodeError, OSError) as e:
+                print_status(
+                    f"Warning: could not read manual competitors from analysis: {e}",
+                    "warning",
+                )
+
+        return list(competitors_by_id.values())
+
+    def _merge_manual_competitors(self, manual_competitors: list[dict]) -> None:
+        """Merge manual competitors back into the newly-generated analysis file.
+
+        Appends manual competitors that don't already exist (by ID) in the file.
+        """
+        if not manual_competitors:
+            return
+
+        try:
+            with open(self.analysis_file, encoding="utf-8") as f:
+                data = json.load(f)
+        except (json.JSONDecodeError, OSError) as e:
+            print_status(f"Warning: failed to merge manual competitors: {e}", "warning")
+            return
+
+        existing_ids = {
+            c.get("id") for c in data.get("competitors", []) if isinstance(c, dict)
+        }
+
+        for competitor in manual_competitors:
+            if competitor.get("id") not in existing_ids:
+                data.setdefault("competitors", []).append(competitor)
+
+        write_json_atomic(self.analysis_file, data, indent=2)
+
    def _build_context(self) -> str:
        """Build context string for the competitor analysis agent."""
        return f"""
@@ -140,8 +221,11 @@ Output your findings to competitor_analysis.json.
                    "competitor_analysis", True, [str(self.analysis_file)], [], 0
                )

-        except json.JSONDecodeError:
-            pass
+        except json.JSONDecodeError as e:
+            print_status(
+                f"Warning: competitor analysis file is not valid JSON: {e}",
+                "warning",
+            )

        return None

@@ -2,11 +2,6 @@
  "project_root": "/Users/andremikalsen/Documents/Coding/autonomous-coding",
  "project_type": "single",
  "services": {},
-  "infrastructure": {
-    "docker_compose": "docker-compose.yml",
-    "docker_services": [
-      "falkordb"
-    ]
-  },
+  "infrastructure": {},
  "conventions": {}
 }
@@ -136,7 +136,7 @@ Examples:
  python spec_runner.py --task "Update text" --complexity simple

  # Complex integration (auto-detected)
-  python spec_runner.py --task "Add Graphiti memory integration with FalkorDB"
+  python spec_runner.py --task "Add Graphiti memory integration with LadybugDB"

  # Interactive mode
  python spec_runner.py --interactive
@@ -14,12 +14,21 @@ Key Features:
 """

 import json
+import logging
 import subprocess
 from dataclasses import dataclass
-from datetime import datetime
+from datetime import datetime, timedelta, timezone
 from enum import Enum
 from pathlib import Path

+from core.file_utils import write_json_atomic
+
+# Recovery manager configuration
+ATTEMPT_WINDOW_SECONDS = 7200  # Only count attempts within last 2 hours
+MAX_ATTEMPT_HISTORY_PER_SUBTASK = 50  # Cap stored attempts per subtask
+
+logger = logging.getLogger(__name__)
+

 class FailureType(Enum):
    """Types of failures that can occur during autonomous builds."""
@@ -82,8 +91,8 @@ class RecoveryManager:
            "subtasks": {},
            "stuck_subtasks": [],
            "metadata": {
-                "created_at": datetime.now().isoformat(),
-                "last_updated": datetime.now().isoformat(),
+                "created_at": datetime.now(timezone.utc).isoformat(),
+                "last_updated": datetime.now(timezone.utc).isoformat(),
            },
        }
        with open(self.attempt_history_file, "w", encoding="utf-8") as f:
@@ -95,8 +104,8 @@ class RecoveryManager:
            "commits": [],
            "last_good_commit": None,
            "metadata": {
-                "created_at": datetime.now().isoformat(),
-                "last_updated": datetime.now().isoformat(),
+                "created_at": datetime.now(timezone.utc).isoformat(),
+                "last_updated": datetime.now(timezone.utc).isoformat(),
            },
        }
        with open(self.build_commits_file, "w", encoding="utf-8") as f:
@@ -114,7 +123,7 @@ class RecoveryManager:

    def _save_attempt_history(self, data: dict) -> None:
        """Save attempt history to JSON file."""
-        data["metadata"]["last_updated"] = datetime.now().isoformat()
+        data["metadata"]["last_updated"] = datetime.now(timezone.utc).isoformat()
        with open(self.attempt_history_file, "w", encoding="utf-8") as f:
            json.dump(data, f, indent=2)

@@ -130,7 +139,7 @@ class RecoveryManager:

    def _save_build_commits(self, data: dict) -> None:
        """Save build commits to JSON file."""
-        data["metadata"]["last_updated"] = datetime.now().isoformat()
+        data["metadata"]["last_updated"] = datetime.now(timezone.utc).isoformat()
        with open(self.build_commits_file, "w", encoding="utf-8") as f:
            json.dump(data, f, indent=2)

@@ -185,17 +194,44 @@ class RecoveryManager:

    def get_attempt_count(self, subtask_id: str) -> int:
        """
-        Get how many times this subtask has been attempted.
+        Get how many times this subtask has been attempted within the time window.
+
+        Only counts attempts within ATTEMPT_WINDOW_SECONDS (default: 2 hours).
+        This prevents unbounded accumulation across crash/restart cycles.

        Args:
            subtask_id: ID of the subtask

        Returns:
-            Number of attempts
+            Number of attempts within the time window
        """
        history = self._load_attempt_history()
        subtask_data = history["subtasks"].get(subtask_id, {})
-        return len(subtask_data.get("attempts", []))
+        attempts = subtask_data.get("attempts", [])
+
+        # Calculate cutoff time for the window
+        cutoff_time = datetime.now(timezone.utc) - timedelta(
+            seconds=ATTEMPT_WINDOW_SECONDS
+        )
+        # For backward compatibility with naive timestamps, also create naive cutoff
+        cutoff_time_naive = datetime.now() - timedelta(seconds=ATTEMPT_WINDOW_SECONDS)
+
+        # Count only attempts within the time window
+        recent_count = 0
+        for attempt in attempts:
+            try:
+                attempt_time = datetime.fromisoformat(attempt["timestamp"])
+                # Use appropriate cutoff based on whether timestamp is naive or aware
+                cutoff = (
+                    cutoff_time_naive if attempt_time.tzinfo is None else cutoff_time
+                )
+                if attempt_time >= cutoff:
+                    recent_count += 1
+            except (KeyError, ValueError):
+                # If timestamp is missing or invalid, count it (backward compatibility)
+                recent_count += 1
+
+        return recent_count

    def record_attempt(
        self,
@@ -208,6 +244,8 @@ class RecoveryManager:
        """
        Record an attempt at a subtask.

+        Automatically trims old attempts if the history exceeds MAX_ATTEMPT_HISTORY_PER_SUBTASK.
+
        Args:
            subtask_id: ID of the subtask
            session: Session number
@@ -224,13 +262,24 @@ class RecoveryManager:
        # Add the attempt
        attempt = {
            "session": session,
-            "timestamp": datetime.now().isoformat(),
+            "timestamp": datetime.now(timezone.utc).isoformat(),
            "approach": approach,
            "success": success,
            "error": error,
        }
        history["subtasks"][subtask_id]["attempts"].append(attempt)

+        # Hard cap: trim oldest attempts if we exceed the maximum
+        attempts = history["subtasks"][subtask_id]["attempts"]
+        if len(attempts) > MAX_ATTEMPT_HISTORY_PER_SUBTASK:
+            trimmed_count = len(attempts) - MAX_ATTEMPT_HISTORY_PER_SUBTASK
+            history["subtasks"][subtask_id]["attempts"] = attempts[
+                -MAX_ATTEMPT_HISTORY_PER_SUBTASK:
+            ]
+            logger.debug(
+                f"Trimmed {trimmed_count} old attempts for subtask {subtask_id} (cap: {MAX_ATTEMPT_HISTORY_PER_SUBTASK})"
+            )
+
        # Update status
        if success:
            history["subtasks"][subtask_id]["status"] = "completed"
@@ -405,7 +454,7 @@ class RecoveryManager:
        commit_record = {
            "hash": commit_hash,
            "subtask_id": subtask_id,
-            "timestamp": datetime.now().isoformat(),
+            "timestamp": datetime.now(timezone.utc).isoformat(),
        }

        commits["commits"].append(commit_record)
@@ -450,7 +499,7 @@ class RecoveryManager:
        stuck_entry = {
            "subtask_id": subtask_id,
            "reason": reason,
-            "escalated_at": datetime.now().isoformat(),
+            "escalated_at": datetime.now(timezone.utc).isoformat(),
            "attempt_count": self.get_attempt_count(subtask_id),
        }

@@ -467,6 +516,36 @@ class RecoveryManager:

        self._save_attempt_history(history)

+        # Also update the subtask status in implementation_plan.json
+        # so that other callers (like is_build_ready_for_qa) see accurate status
+        try:
+            plan_file = self.spec_dir / "implementation_plan.json"
+            if plan_file.exists():
+                with open(plan_file, encoding="utf-8") as f:
+                    plan = json.load(f)
+
+                updated = False
+                for phase in plan.get("phases", []):
+                    for subtask in phase.get("subtasks", []):
+                        if subtask.get("id") == subtask_id:
+                            subtask["status"] = "failed"
+                            stuck_note = f"Marked as stuck: {reason}"
+                            existing = subtask.get("actual_output", "")
+                            subtask["actual_output"] = (
+                                f"{stuck_note}\n{existing}" if existing else stuck_note
+                            )
+                            updated = True
+                            break
+                    if updated:
+                        break
+
+                if updated:
+                    write_json_atomic(plan_file, plan, indent=2)
+        except (OSError, json.JSONDecodeError, UnicodeDecodeError) as e:
+            logger.warning(
+                f"Failed to update implementation_plan.json for stuck subtask {subtask_id}: {e}"
+            )
+
    def get_stuck_subtasks(self) -> list[dict]:
        """
        Get all subtasks marked as stuck.
@@ -6,18 +6,54 @@ Phases for spec document creation and quality assurance.
 """

 import json
-from typing import TYPE_CHECKING
+from pathlib import Path

 from .. import validator, writer
+from ..discovery import get_project_index_stats
 from .models import MAX_RETRIES, PhaseResult

-if TYPE_CHECKING:
-    pass
+
+def _is_greenfield_project(spec_dir: Path) -> bool:
+    """Check if the project is empty/greenfield (0 discovered files)."""
+    stats = get_project_index_stats(spec_dir)
+    if not stats:
+        return False  # Can't determine - don't assume greenfield
+    return stats.get("file_count", 0) == 0
+
+
+def _greenfield_context() -> str:
+    """Return additional context for greenfield/empty projects."""
+    return """
+**GREENFIELD PROJECT**: This is an empty or new project with no existing code.
+There are no existing files to reference or modify. You are creating everything from scratch.
+
+Adapt your approach:
+- Do NOT reference existing files, patterns, or code structures
+- Focus on what needs to be CREATED, not modified
+- Define the initial project structure, files, and directories
+- Specify the tech stack, frameworks, and dependencies to install
+- Provide setup instructions for the new project
+- For "Files to Modify" and "Files to Reference" sections, list files to CREATE instead
+- For "Patterns to Follow", describe industry best practices rather than existing code
+"""


 class SpecPhaseMixin:
    """Mixin for spec writing and critique phase methods."""

+    def _check_and_log_greenfield(self) -> bool:
+        """Check if the project is greenfield and log if so.
+
+        Returns:
+            True if the project is greenfield (no existing files).
+        """
+        is_greenfield = _is_greenfield_project(self.spec_dir)
+        if is_greenfield:
+            self.ui.print_status(
+                "Greenfield project detected - adapting spec for new project", "info"
+            )
+        return is_greenfield
+
    async def phase_quick_spec(self) -> PhaseResult:
        """Quick spec for simple tasks - combines context and spec in one step."""
        spec_file = self.spec_dir / "spec.md"
@@ -29,6 +65,8 @@ class SpecPhaseMixin:
                "quick_spec", True, [str(spec_file), str(plan_file)], [], 0
            )

+        is_greenfield = self._check_and_log_greenfield()
+
        errors = []
        for attempt in range(MAX_RETRIES):
            self.ui.print_status(
@@ -42,7 +80,7 @@ class SpecPhaseMixin:

 This is a SIMPLE task. Create a minimal spec and implementation plan directly.
 No research or extensive analysis needed.
-
+{_greenfield_context() if is_greenfield else ""}
 Create:
 1. A concise spec.md with just the essential sections
 2. A simple implementation_plan.json with 1-2 subtasks
@@ -80,6 +118,9 @@ Create:
                "spec.md exists but has issues, regenerating...", "warning"
            )

+        is_greenfield = self._check_and_log_greenfield()
+        greenfield_ctx = _greenfield_context() if is_greenfield else ""
+
        errors = []
        for attempt in range(MAX_RETRIES):
            self.ui.print_status(
@@ -88,6 +129,7 @@ Create:

            success, output = await self.run_agent_fn(
                "spec_writer.md",
+                additional_context=greenfield_ctx,
                phase_name="spec_writing",
            )

@@ -12,6 +12,7 @@ from ui.capabilities import configure_safe_encoding

 configure_safe_encoding()

+from core.error_utils import safe_receive_messages
 from debug import debug, debug_detailed, debug_error, debug_section, debug_success
 from security.tool_input_validator import get_safe_tool_input
 from task_logger import (
@@ -162,7 +163,7 @@ class AgentRunner:

                response_text = ""
                debug("agent_runner", "Starting to receive response stream...")
-                async for msg in client.receive_response():
+                async for msg in safe_receive_messages(client, caller="agent_runner"):
                    msg_type = type(msg).__name__
                    message_count += 1
                    debug_detailed(
@@ -203,19 +203,19 @@ def generate_spec_name(task_description: str) -> str:
    return "-".join(name_parts) if name_parts else "spec"


-def rename_spec_dir_from_requirements(spec_dir: Path) -> bool:
+def rename_spec_dir_from_requirements(spec_dir: Path) -> Path:
    """Rename spec directory based on requirements.json task description.

    Args:
        spec_dir: The current spec directory

    Returns:
-        Tuple of (success, new_spec_dir). If success is False, new_spec_dir is the original.
+        The new spec directory path (or the original if no rename was needed/possible).
    """
    requirements_file = spec_dir / "requirements.json"

    if not requirements_file.exists():
-        return False
+        return spec_dir

    try:
        with open(requirements_file, encoding="utf-8") as f:
@@ -223,7 +223,7 @@ def rename_spec_dir_from_requirements(spec_dir: Path) -> bool:

        task_desc = req.get("task_description", "")
        if not task_desc:
-            return False
+            return spec_dir

        # Generate new name
        new_name = generate_spec_name(task_desc)
@@ -240,11 +240,11 @@ def rename_spec_dir_from_requirements(spec_dir: Path) -> bool:

        # Don't rename if it's already a good name (not "pending")
        if "pending" not in current_name:
-            return True
+            return spec_dir

        # Don't rename if target already exists
        if new_spec_dir.exists():
-            return True
+            return spec_dir

        # Rename the directory
        shutil.move(str(spec_dir), str(new_spec_dir))
@@ -253,11 +253,11 @@ def rename_spec_dir_from_requirements(spec_dir: Path) -> bool:
        update_task_logger_path(new_spec_dir)

        print_status(f"Spec folder: {highlight(new_dir_name)}", "success")
-        return True
+        return new_spec_dir

    except (json.JSONDecodeError, OSError) as e:
        print_status(f"Could not rename spec folder: {e}", "warning")
-        return False
+        return spec_dir


 # Phase display configuration
@@ -6,6 +6,7 @@ Main orchestration logic for spec creation with dynamic complexity adaptation.
 """

 import json
+import types
 from collections.abc import Callable
 from pathlib import Path

@@ -18,6 +19,7 @@ from review import run_review_checkpoint
 from task_logger import (
    LogEntryType,
    LogPhase,
+    TaskLogger,
    get_task_logger,
 )
 from ui import (
@@ -238,6 +240,47 @@ class SpecOrchestrator:
        task_logger.start_phase(LogPhase.PLANNING, "Starting spec creation process")
        TaskEventEmitter.from_spec_dir(self.spec_dir).emit("PLANNING_STARTED")

+        # Track whether we've already ended the planning phase (to avoid double-end)
+        self._planning_phase_ended = False
+
+        try:
+            return await self._run_phases(interactive, auto_approve, task_logger, ui)
+        except Exception as e:
+            # Emit PLANNING_FAILED so the frontend XState machine transitions to error state
+            # instead of leaving the task stuck in "planning" forever
+            try:
+                task_emitter = TaskEventEmitter.from_spec_dir(self.spec_dir)
+                task_emitter.emit(
+                    "PLANNING_FAILED",
+                    {"error": str(e), "recoverable": True},
+                )
+            except Exception:
+                pass  # Don't mask the original error
+            if not self._planning_phase_ended:
+                self._planning_phase_ended = True
+                try:
+                    task_logger.end_phase(
+                        LogPhase.PLANNING,
+                        success=False,
+                        message=f"Spec creation crashed: {e}",
+                    )
+                except Exception:
+                    pass  # Best effort - don't mask the original error when logging fails
+            raise
+
+    async def _run_phases(
+        self,
+        interactive: bool,
+        auto_approve: bool,
+        task_logger: TaskLogger,
+        ui: types.ModuleType,
+    ) -> bool:
+        """Internal method that runs all spec creation phases.
+
+        Separated from run() so that run() can wrap this in a try/except
+        to emit PLANNING_FAILED on unhandled exceptions.
+        """
+
        print(
            box(
                f"Spec Directory: {self.spec_dir}\n"
@@ -291,9 +334,11 @@ class SpecOrchestrator:
        results.append(result)
        if not result.success:
            print_status("Discovery failed", "error")
+            self._planning_phase_ended = True
            task_logger.end_phase(
                LogPhase.PLANNING, success=False, message="Discovery failed"
            )
+            self._emit_planning_failed("Discovery phase failed")
            return False
        # Store summary for subsequent phases (compaction)
        await self._store_phase_summary("discovery")
@@ -305,17 +350,26 @@ class SpecOrchestrator:
        results.append(result)
        if not result.success:
            print_status("Requirements gathering failed", "error")
+            self._planning_phase_ended = True
            task_logger.end_phase(
                LogPhase.PLANNING,
                success=False,
                message="Requirements gathering failed",
            )
+            self._emit_planning_failed("Requirements gathering failed")
            return False
        # Store summary for subsequent phases (compaction)
        await self._store_phase_summary("requirements")

        # Rename spec folder with better name from requirements
-        rename_spec_dir_from_requirements(self.spec_dir)
+        # IMPORTANT: Update self.spec_dir after rename so subsequent phases use the correct path
+        new_spec_dir = rename_spec_dir_from_requirements(self.spec_dir)
+        if new_spec_dir != self.spec_dir:
+            self.spec_dir = new_spec_dir
+            self.validator = SpecValidator(self.spec_dir)
+            # Update phase executor to use the renamed directory
+            phase_executor.spec_dir = self.spec_dir
+            phase_executor.spec_validator = self.validator

        # Update task description from requirements
        req = requirements.load_requirements(self.spec_dir)
@@ -335,9 +389,11 @@ class SpecOrchestrator:
        results.append(result)
        if not result.success:
            print_status("Complexity assessment failed", "error")
+            self._planning_phase_ended = True
            task_logger.end_phase(
                LogPhase.PLANNING, success=False, message="Complexity assessment failed"
            )
+            self._emit_planning_failed("Complexity assessment failed")
            return False

        # Map of all available phases
@@ -396,17 +452,22 @@ class SpecOrchestrator:
                    f"Phase '{phase_name}' failed: {'; '.join(result.errors)}",
                    LogEntryType.ERROR,
                )
+                self._planning_phase_ended = True
                task_logger.end_phase(
                    LogPhase.PLANNING,
                    success=False,
                    message=f"Phase {phase_name} failed",
                )
+                self._emit_planning_failed(
+                    f"Phase '{phase_name}' failed: {'; '.join(result.errors)}"
+                )
                return False

        # Summary
        self._print_completion_summary(results, phases_executed)

        # End planning phase successfully
+        self._planning_phase_ended = True
        task_logger.end_phase(
            LogPhase.PLANNING, success=True, message="Spec creation complete"
        )
@@ -638,6 +699,25 @@ class SpecOrchestrator:
            )
        )

+    def _emit_planning_failed(self, error: str) -> None:
+        """Emit PLANNING_FAILED event so the frontend transitions to error state.
+
+        Without this, the task stays stuck in 'planning' / 'in_progress' forever
+        when spec creation fails, because the XState machine never receives a
+        terminal event.
+
+        Args:
+            error: Human-readable error description
+        """
+        try:
+            task_emitter = TaskEventEmitter.from_spec_dir(self.spec_dir)
+            task_emitter.emit(
+                "PLANNING_FAILED",
+                {"error": error, "recoverable": True},
+            )
+        except Exception:
+            pass  # Best effort - don't mask the original failure
+
    def _run_review_checkpoint(self, auto_approve: bool) -> bool:
        """Run the human review checkpoint.

@@ -661,9 +741,8 @@ class SpecOrchestrator:
                print_status("Build will not proceed without approval.", "warning")
                return False

-        except SystemExit as e:
-            if e.code != 0:
-                return False
+        except SystemExit:
+            # Review checkpoint may call sys.exit(); treat any exit as unapproved
            return False
        except KeyboardInterrupt:
            print()
@@ -696,19 +775,25 @@ class SpecOrchestrator:
        The functionality has been moved to models.rename_spec_dir_from_requirements.

        Returns:
-            True if successful or not needed, False on error
+            True if successful or not needed, False if prerequisites are missing
        """
-        result = rename_spec_dir_from_requirements(self.spec_dir)
-        # Update self.spec_dir if it was renamed
-        if result and self.spec_dir.name.endswith("-pending"):
-            # Find the renamed directory
-            parent = self.spec_dir.parent
-            prefix = self.spec_dir.name[:4]  # e.g., "001-"
-            for candidate in parent.iterdir():
-                if (
-                    candidate.name.startswith(prefix)
-                    and "pending" not in candidate.name
-                ):
-                    self.spec_dir = candidate
-                    break
-        return result
+        # Check prerequisites first
+        requirements_file = self.spec_dir / "requirements.json"
+        if not requirements_file.exists():
+            return False
+
+        try:
+            with open(requirements_file, encoding="utf-8") as f:
+                req = json.load(f)
+            task_desc = req.get("task_description", "")
+            if not task_desc:
+                return False
+        except (json.JSONDecodeError, OSError):
+            return False
+
+        # Attempt rename
+        new_spec_dir = rename_spec_dir_from_requirements(self.spec_dir)
+        if new_spec_dir != self.spec_dir:
+            self.spec_dir = new_spec_dir
+            self.validator = SpecValidator(self.spec_dir)
+        return True
@@ -28,34 +28,19 @@ We encountered and fixed this bug during development as it was blocking our test
 |-------|-------------|--------|
 | Phase 1 | Create XState machine definition (task-machine.ts) | ✅ Complete |
 | Phase 2 | Create TaskStateManager singleton wrapper | ✅ Complete |
-| Phase 3 | Integrate into agent-events-handlers.ts | ⏸️ Partially done |
-| Phase 4 | Remove legacy TaskStateMachine class | ❌ Not started |
+| Phase 3 | Integrate into agent-events-handlers.ts | ✅ Complete |
+| Phase 4 | Remove legacy TaskStateMachine class | ✅ Complete |

-### Why We Stopped at Phase 2
+### Migration Complete

-The original scope was to introduce XState as the new state management approach. Full integration (Phase 3-4) requires:
-
- Extensive refactoring of agent-events-handlers.ts to remove all legacy decision logic
- Removing the old TaskStateMachine class entirely
- Migration of all status persistence to go through XState
-
-We delivered Phases 1-2 to establish the foundation. The current state has both systems running in parallel with XState as primary:
-
- **XState is primary:** When TaskStateManager returns a valid state transition, that decision is used
- **Legacy as fallback:** The old TaskStateMachine logic only applies when XState doesn't produce a decision
- **Safe rollback:** If XState causes issues, the legacy system is still present and can take over
-
-This dual-system approach allows:
- Validation that XState produces correct state transitions in production
- Safe rollback if issues arise
- Incremental adoption path for Phase 3-4
+All four phases are now complete. The XState-based `TaskStateManager` is the sole state management system — the legacy `TaskStateMachine` class and `validateStatusTransition()` function have been fully removed. `agent-events-handlers.ts` uses the XState-based `taskStateManager` singleton exclusively.

 ## What Changed

-### Before (Old Architecture)
+### Before (Old Architecture — Now Removed)
 - Status decisions scattered across agent-events-handlers.ts, execution-handlers.ts, worktree-handlers.ts
 - `validateStatusTransition()` function with complex conditional logic
- TaskStateMachine class that was essentially an event emitter wrapper
+- `TaskStateMachine` class that was essentially an event emitter wrapper
 - Multiple places persisting status to implementation_plan.json
 - Race conditions possible when multiple handlers tried to update status

@@ -118,14 +103,6 @@ The state machine responds to these events:
 | CREATE_PR | User initiates PR creation |
 | PR_CREATED | PR successfully created |

-## Rollback Plan
-
-If issues arise post-merge:
-
-1. **Quick rollback:** `git revert <merge-commit>`
-2. **Restore point:** Commit 3e5f004a has old code intact
-3. **Legacy persistence still works:** implementation_plan.json continues to store status
-
 ## Testing

 | Test Suite | Result |
@@ -163,7 +140,7 @@ If issues arise post-merge:
 - Add @stately-ai/inspect for runtime devtools
 - **Subtask state management** - Track individual subtask states within the machine using XState parallel states
 - Add more granular QA states (qa_round_1, qa_round_2, etc.)
- Complete Phase 3-4: Full integration and removal of legacy TaskStateMachine class
+

 ## Visualization

@@ -1,6 +1,6 @@
 {
  "name": "auto-claude-ui",
-  "version": "2.7.6-beta.3",
+  "version": "2.7.6",
  "type": "module",
  "description": "Desktop UI for Auto Claude autonomous coding framework",
  "homepage": "https://github.com/AndyMik90/Auto-Claude",
@@ -186,7 +186,7 @@ describe('Subprocess Spawn Integration', () => {
          'Test task description'
        ]),
        expect.objectContaining({
-          cwd: AUTO_CLAUDE_SOURCE,  // Process runs from auto-claude source directory
+          cwd: TEST_PROJECT_PATH,  // Process runs from project directory to avoid cross-drive issues on Windows (#1661)
          env: expect.objectContaining({
            PYTHONUNBUFFERED: '1'
          })
@@ -218,7 +218,7 @@ describe('Subprocess Spawn Integration', () => {
          'spec-001'
        ]),
        expect.objectContaining({
-          cwd: AUTO_CLAUDE_SOURCE  // Process runs from auto-claude source directory
+          cwd: TEST_PROJECT_PATH  // Process runs from project directory to avoid cross-drive issues on Windows (#1661)
        })
      );
    }, 30000);  // Increase timeout for Windows CI (dynamic imports are slow)
@@ -248,7 +248,7 @@ describe('Subprocess Spawn Integration', () => {
          '--qa'
        ]),
        expect.objectContaining({
-          cwd: AUTO_CLAUDE_SOURCE  // Process runs from auto-claude source directory
+          cwd: TEST_PROJECT_PATH  // Process runs from project directory to avoid cross-drive issues on Windows (#1661)
        })
      );
    }, 30000);  // Increase timeout for Windows CI (dynamic imports are slow)
@@ -0,0 +1,301 @@
+/**
+ * Unit tests for FileWatcher concurrency mechanisms
+ * Tests deduplication, supersession, cancellation, and unwatchAll behaviour
+ * under concurrent watch()/unwatch() call patterns.
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { EventEmitter } from 'events';
+import path from 'path';
+
+// ---------------------------------------------------------------------------
+// Mock chokidar BEFORE importing FileWatcher so the module sees our mock.
+// ---------------------------------------------------------------------------
+
+// A minimal FSWatcher stub that lets us control when close() resolves.
+class MockFSWatcher extends EventEmitter {
+  close: ReturnType<typeof vi.fn>;
+  constructor(closeImpl?: () => Promise<void>) {
+    super();
+    this.close = vi.fn(closeImpl ?? (() => Promise.resolve()));
+  }
+}
+
+// Track every watcher created so tests can inspect them.
+let createdWatchers: MockFSWatcher[] = [];
+// Factory override — tests replace this to inject custom stubs.
+let watchFactory: (() => MockFSWatcher) | null = null;
+
+vi.mock('chokidar', () => ({
+  default: {
+    watch: vi.fn((_path: string, _opts: unknown) => {
+      const watcher = watchFactory ? watchFactory() : new MockFSWatcher();
+      createdWatchers.push(watcher);
+      return watcher;
+    })
+  }
+}));
+
+// Mock 'fs' so we can control existsSync / readFileSync without touching disk.
+vi.mock('fs', () => ({
+  existsSync: vi.fn(() => true),
+  readFileSync: vi.fn(() => JSON.stringify({ phases: [] }))
+}));
+
+// ---------------------------------------------------------------------------
+// Import after mocks are registered
+// ---------------------------------------------------------------------------
+import { FileWatcher } from '../file-watcher';
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe('FileWatcher concurrency', () => {
+  let fw: FileWatcher;
+
+  beforeEach(() => {
+    fw = new FileWatcher();
+    createdWatchers = [];
+    watchFactory = null;
+    vi.clearAllMocks();
+  });
+
+  afterEach(async () => {
+    // Clean up any watchers that are still open.
+    await fw.unwatchAll();
+  });
+
+  // -------------------------------------------------------------------------
+  // 1. Deduplication — same taskId + same specDir
+  // -------------------------------------------------------------------------
+  describe('deduplication: second watch() with same specDir is a no-op', () => {
+    it('should only create one FSWatcher when watch() is called twice with the same specDir while the first is still in-flight', async () => {
+      const specDir = '/project/.auto-claude/specs/001-task';
+      const taskId = 'task-1';
+
+      // To create a real async gap we need an existing watcher whose close() is slow.
+      // First, set up a watcher for taskId (completes synchronously).
+      await fw.watch(taskId, specDir);
+      expect(createdWatchers).toHaveLength(1);
+
+      // Replace close() with a slow one so the next watch() call has an async gap.
+      const existingWatcher = createdWatchers[0];
+      let resolveClose!: () => void;
+      existingWatcher.close = vi.fn(
+        () => new Promise<void>((res) => { resolveClose = res; })
+      );
+
+      // Now start two concurrent watch() calls for the SAME specDir.
+      // Both will try to enter, but the second should be deduplicated.
+      const watchPromise1 = fw.watch(taskId, specDir);
+      const watchPromise2 = fw.watch(taskId, specDir);
+
+      // Resolve the close so both can proceed.
+      resolveClose();
+      await Promise.all([watchPromise1, watchPromise2]);
+
+      // Only one new FSWatcher should have been created (the second call was a no-op).
+      // createdWatchers[0] is the original; createdWatchers[1] is the new one.
+      expect(createdWatchers).toHaveLength(2);
+      expect(fw.isWatching(taskId)).toBe(true);
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // 2. Supersession — same taskId, different specDir
+  // -------------------------------------------------------------------------
+  describe('supersession: watch() with different specDir replaces the in-flight call', () => {
+    it('should let the second call win when the first is awaiting close()', async () => {
+      const taskId = 'task-2';
+      const specDir1 = path.join('/project', '.auto-claude', 'specs', '001-first');
+      const specDir2 = path.join('/project', '.auto-claude', 'specs', '002-second');
+
+      // First call installs an existing watcher (simulate: the watcher for
+      // specDir1 is already set up so the second watch() needs to close it).
+      // We do this by running the first watch() to completion first.
+      await fw.watch(taskId, specDir1);
+      expect(createdWatchers).toHaveLength(1);
+
+      // Now make the close() of the first watcher slow so there's an async gap
+      // during which the second watch() can enter and supersede.
+      const existingWatcher = createdWatchers[0];
+      let resolveClose!: () => void;
+      existingWatcher.close = vi.fn(
+        () => new Promise<void>((res) => { resolveClose = res; })
+      );
+
+      // Start the second watch() — it will try to close the first watcher's
+      // FSWatcher and will be awaiting that.
+      const watch2Promise = fw.watch(taskId, specDir2);
+
+      // While the second watch() is awaiting close, start a THIRD call with
+      // yet another specDir — this supersedes the second call.
+      // Actually for the test described in the finding, we want:
+      // - First call bails, second call creates the watcher.
+      // Let's resolve the close and let watch2 finish.
+      resolveClose();
+      await watch2Promise;
+
+      // The final watcher should be for specDir2.
+      expect(fw.getWatchedSpecDir(taskId)).toBe(specDir2);
+      // Two watchers were created in total (one for each specDir).
+      expect(createdWatchers).toHaveLength(2);
+    });
+
+    it('first watch() bails when pendingWatches changes to a different specDir', async () => {
+      const taskId = 'task-super';
+      const specDir1 = path.join('/project', '.auto-claude', 'specs', 'super-first');
+      const specDir2 = path.join('/project', '.auto-claude', 'specs', 'super-second');
+
+      // Make the first watcher's close() slow so we can interleave.
+      let resolveFirstClose!: () => void;
+      watchFactory = () => {
+        const w = new MockFSWatcher(() => new Promise<void>((res) => { resolveFirstClose = res; }));
+        return w;
+      };
+
+      // Start first watch().
+      const watch1Promise = fw.watch(taskId, specDir1);
+
+      // Immediately start second watch() — before the first has resolved the
+      // slow close(). At this point specDir1 watch hasn't even created an
+      // FSWatcher yet (it's the very first call so there's no existing watcher
+      // to close), so watch1Promise may resolve synchronously up to watcher
+      // creation. Reset factory to normal for subsequent watcher creations.
+      watchFactory = null;
+
+      const watch2Promise = fw.watch(taskId, specDir2);
+
+      // Let any remaining microtasks run.
+      await Promise.resolve();
+      if (resolveFirstClose) resolveFirstClose();
+
+      await Promise.all([watch1Promise, watch2Promise]);
+
+      // The winning call (specDir2) should own the watcher.
+      expect(fw.getWatchedSpecDir(taskId)).toBe(specDir2);
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // 3. Cancellation — unwatch() during in-flight watch()
+  // -------------------------------------------------------------------------
+  describe('cancellation: unwatch() during in-flight watch() prevents watcher creation', () => {
+    it('should not create a watcher when unwatch() is called before the async gap resolves', async () => {
+      const taskId = 'task-3';
+      const specDir = '/project/.auto-claude/specs/003-cancel';
+
+      // There's no pre-existing watcher, so watch() won't call close(). But it
+      // does go async (chokidar.watch is sync but we can test the cancellation
+      // flag by calling unwatch() before watch() runs).
+      // The real async gap in watch() is the existing.watcher.close() call.
+      // For this test, let's pre-install a watcher so close() is called.
+
+      // Install a slow-close watcher for taskId by manually populating the map.
+      // We can do that by running a first watch(), then replacing close().
+      await fw.watch(taskId, specDir);
+
+      // Replace the watcher's close() with a slow one.
+      const existingWatcher = createdWatchers[0];
+      let resolveExistingClose!: () => void;
+      existingWatcher.close = vi.fn(
+        () => new Promise<void>((res) => { resolveExistingClose = res; })
+      );
+
+      // Start a second watch() — it will await the slow close().
+      const specDir2 = '/project/.auto-claude/specs/003-cancel-v2';
+      const watchPromise = fw.watch(taskId, specDir2);
+
+      // While watch() is in-flight, call unwatch().
+      await fw.unwatch(taskId);
+
+      // Now resolve the slow close so watch() can continue past the await.
+      resolveExistingClose();
+      await watchPromise;
+
+      // No new watcher should have been registered.
+      expect(fw.isWatching(taskId)).toBe(false);
+      // Only one FSWatcher was ever created (the original one for specDir).
+      expect(createdWatchers).toHaveLength(1);
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // 4. unwatchAll() with pending watches
+  // -------------------------------------------------------------------------
+  describe('unwatchAll() cancels all pending watches', () => {
+    it('should cancel pending watch() calls and clear pendingWatches', async () => {
+      const taskId1 = 'task-4a';
+      const taskId2 = 'task-4b';
+      const specDir1 = '/project/.auto-claude/specs/004a';
+      const specDir2 = '/project/.auto-claude/specs/004b';
+
+      // Set up slow-close scenario for taskId1 (so watch() is in-flight).
+      await fw.watch(taskId1, specDir1);
+      const watcher1 = createdWatchers[0];
+      let resolveClose1!: () => void;
+      watcher1.close = vi.fn(
+        () => new Promise<void>((res) => { resolveClose1 = res; })
+      );
+
+      // Start a new watch for taskId1 with a different specDir — this is now in-flight.
+      const newSpecDir1 = '/project/.auto-claude/specs/004a-v2';
+      const watchPromise1 = fw.watch(taskId1, newSpecDir1);
+
+      // Start a fresh watch for taskId2.
+      await fw.watch(taskId2, specDir2);
+
+      // Call unwatchAll() while watchPromise1 is still pending.
+      const unwatchAllPromise = fw.unwatchAll();
+
+      // Resolve the slow close so everything can proceed.
+      resolveClose1();
+      await Promise.all([watchPromise1, unwatchAllPromise]);
+
+      // After unwatchAll, no watchers should be active.
+      expect(fw.isWatching(taskId1)).toBe(false);
+      expect(fw.isWatching(taskId2)).toBe(false);
+
+      // pendingWatches should be cleared (we verify indirectly: a fresh
+      // watch() call for taskId1 must succeed without treating it as a duplicate).
+      const specDirFresh = path.join('/project', '.auto-claude', 'specs', '004a-fresh');
+      await fw.watch(taskId1, specDirFresh);
+      expect(fw.isWatching(taskId1)).toBe(true);
+      expect(fw.getWatchedSpecDir(taskId1)).toBe(specDirFresh);
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // 5. getWatchedSpecDir() returns correct specDir
+  // -------------------------------------------------------------------------
+  describe('getWatchedSpecDir()', () => {
+    it('returns the specDir that was passed to watch()', async () => {
+      const taskId = 'task-5';
+      const specDir = path.join('/project', '.auto-claude', 'specs', '005-specdir');
+
+      await fw.watch(taskId, specDir);
+
+      expect(fw.getWatchedSpecDir(taskId)).toBe(specDir);
+    });
+
+    it('returns null when the task is not being watched', () => {
+      expect(fw.getWatchedSpecDir('unknown-task')).toBeNull();
+    });
+
+    it('returns updated specDir after re-watch with different specDir', async () => {
+      const taskId = 'task-5b';
+      const specDir1 = path.join('/project', '.auto-claude', 'specs', '005b-first');
+      const specDir2 = path.join('/project', '.auto-claude', 'specs', '005b-second');
+
+      await fw.watch(taskId, specDir1);
+      expect(fw.getWatchedSpecDir(taskId)).toBe(specDir1);
+
+      await fw.watch(taskId, specDir2);
+      expect(fw.getWatchedSpecDir(taskId)).toBe(specDir2);
+    });
+  });
+});
@@ -0,0 +1,333 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { PRReviewStateManager } from '../pr-review-state-manager';
+import type { PRReviewResult, PRReviewProgress } from '../../preload/api/modules/github-api';
+
+// Mock dependencies
+const mockSafeSendToRenderer = vi.fn();
+vi.mock('../ipc-handlers/utils', () => ({
+  safeSendToRenderer: (...args: unknown[]) => mockSafeSendToRenderer(...args)
+}));
+
+function createMockGetMainWindow() {
+  return vi.fn(() => ({ id: 1 }) as unknown as Electron.BrowserWindow);
+}
+
+function createMockProgress(overrides: Partial<PRReviewProgress> = {}): PRReviewProgress {
+  return {
+    phase: 'analyzing',
+    progress: 50,
+    message: 'Analyzing files...',
+    ...overrides
+  } as PRReviewProgress;
+}
+
+function createMockResult(overrides: Partial<PRReviewResult> = {}): PRReviewResult {
+  return {
+    overallStatus: 'approved',
+    summary: 'Looks good',
+    ...overrides
+  } as PRReviewResult;
+}
+
+describe('PRReviewStateManager', () => {
+  let manager: PRReviewStateManager;
+  const projectId = 'project-1';
+  const prNumber = 42;
+
+  beforeEach(() => {
+    manager = new PRReviewStateManager(createMockGetMainWindow());
+    vi.clearAllMocks();
+  });
+
+  afterEach(() => {
+    manager.clearAll();
+  });
+
+  describe('actor lifecycle', () => {
+    it('should create actor on first handleStartReview call', () => {
+      manager.handleStartReview(projectId, prNumber);
+      const snapshot = manager.getState(projectId, prNumber);
+      expect(snapshot).not.toBeNull();
+    });
+
+    it('should reuse existing actor for same PR key', () => {
+      manager.handleStartReview(projectId, prNumber);
+      const snapshot1 = manager.getState(projectId, prNumber);
+      // Calling again should not create a new actor
+      manager.handleStartReview(projectId, prNumber);
+      const snapshot2 = manager.getState(projectId, prNumber);
+      expect(snapshot1).not.toBeNull();
+      expect(snapshot2).not.toBeNull();
+    });
+
+    it('should create separate actors for different PRs', () => {
+      manager.handleStartReview(projectId, 1);
+      manager.handleStartReview(projectId, 2);
+      const snapshot1 = manager.getState(projectId, 1);
+      const snapshot2 = manager.getState(projectId, 2);
+      expect(snapshot1).not.toBeNull();
+      expect(snapshot2).not.toBeNull();
+    });
+
+    it('should start actor before events are sent', () => {
+      manager.handleStartReview(projectId, prNumber);
+      const snapshot = manager.getState(projectId, prNumber);
+      // If actor wasn't started, getSnapshot would fail or return unexpected state
+      expect(snapshot).not.toBeNull();
+      expect(String(snapshot!.value)).toBe('reviewing');
+    });
+  });
+
+  describe('event routing', () => {
+    it('should transition to reviewing on handleStartReview', () => {
+      manager.handleStartReview(projectId, prNumber);
+      const snapshot = manager.getState(projectId, prNumber);
+      expect(String(snapshot!.value)).toBe('reviewing');
+    });
+
+    it('should send START_FOLLOWUP_REVIEW with previousResult', () => {
+      const previousResult = createMockResult();
+      manager.handleStartFollowupReview(projectId, prNumber, previousResult);
+      const snapshot = manager.getState(projectId, prNumber);
+      expect(String(snapshot!.value)).toBe('reviewing');
+      expect(snapshot!.context.isFollowup).toBe(true);
+      expect(snapshot!.context.previousResult).toBe(previousResult);
+    });
+
+    it('should send START_REVIEW when handleStartFollowupReview has no previousResult', () => {
+      manager.handleStartFollowupReview(projectId, prNumber);
+      const snapshot = manager.getState(projectId, prNumber);
+      expect(String(snapshot!.value)).toBe('reviewing');
+      expect(snapshot!.context.isFollowup).toBe(false);
+    });
+
+    it('should update context on handleProgress', () => {
+      manager.handleStartReview(projectId, prNumber);
+      const progress = createMockProgress();
+      manager.handleProgress(projectId, prNumber, progress);
+      const snapshot = manager.getState(projectId, prNumber);
+      expect(snapshot!.context.progress).toEqual(progress);
+    });
+
+    it('should ignore handleProgress for unknown PR', () => {
+      // Should not throw
+      manager.handleProgress(projectId, 999, createMockProgress());
+      expect(manager.getState(projectId, 999)).toBeNull();
+    });
+
+    it('should transition to completed on handleComplete', () => {
+      manager.handleStartReview(projectId, prNumber);
+      const result = createMockResult();
+      manager.handleComplete(projectId, prNumber, result);
+      const snapshot = manager.getState(projectId, prNumber);
+      expect(String(snapshot!.value)).toBe('completed');
+      expect(snapshot!.context.result).toEqual(result);
+    });
+
+    it('should create actor for handleComplete on unknown PR (late-arriving result)', () => {
+      const result = createMockResult();
+      // No handleStartReview called — handleComplete should create the actor
+      manager.handleComplete(projectId, prNumber, result);
+      const snapshot = manager.getState(projectId, prNumber);
+      expect(snapshot).not.toBeNull();
+      expect(snapshot!.context.result).toEqual(result);
+    });
+
+    it('should send DETECT_EXTERNAL_REVIEW when overallStatus is in_progress', () => {
+      manager.handleStartReview(projectId, prNumber);
+      const result = createMockResult({ overallStatus: 'in_progress' });
+      manager.handleComplete(projectId, prNumber, result);
+      const snapshot = manager.getState(projectId, prNumber);
+      expect(String(snapshot!.value)).toBe('externalReview');
+    });
+
+    it('should transition to error on handleError', () => {
+      manager.handleStartReview(projectId, prNumber);
+      manager.handleError(projectId, prNumber, 'Something went wrong');
+      const snapshot = manager.getState(projectId, prNumber);
+      expect(String(snapshot!.value)).toBe('error');
+      expect(snapshot!.context.error).toBe('Something went wrong');
+    });
+
+    it('should transition to error on handleCancel', () => {
+      manager.handleStartReview(projectId, prNumber);
+      manager.handleCancel(projectId, prNumber);
+      const snapshot = manager.getState(projectId, prNumber);
+      expect(String(snapshot!.value)).toBe('error');
+    });
+  });
+
+  describe('state emission', () => {
+    it('should emit state changes to renderer via safeSendToRenderer', () => {
+      manager.handleStartReview(projectId, prNumber);
+      expect(mockSafeSendToRenderer).toHaveBeenCalled();
+    });
+
+    it('should use GITHUB_PR_REVIEW_STATE_CHANGE IPC channel', () => {
+      manager.handleStartReview(projectId, prNumber);
+      expect(mockSafeSendToRenderer).toHaveBeenCalledWith(
+        expect.any(Function),
+        'github:pr:reviewStateChange',
+        expect.any(String),
+        expect.objectContaining({ state: expect.any(String) })
+      );
+    });
+
+    it('should emit PRReviewStatePayload with correct shape', () => {
+      manager.handleStartReview(projectId, prNumber);
+      // Find the call that emits 'reviewing' state
+      const reviewingCall = mockSafeSendToRenderer.mock.calls.find(
+        (call: unknown[]) => {
+          const payload = call[3] as Record<string, unknown> | undefined;
+          return payload && typeof payload === 'object' && payload.state === 'reviewing';
+        }
+      );
+      expect(reviewingCall).toBeDefined();
+      expect(reviewingCall![2]).toBe(`${projectId}:${prNumber}`);
+      const payload = reviewingCall![3] as Record<string, unknown>;
+      expect(payload).toEqual(expect.objectContaining({
+        state: 'reviewing',
+        prNumber,
+        projectId,
+        isReviewing: true,
+        startedAt: expect.any(String),
+        progress: null,
+        result: null,
+        previousResult: null,
+        error: null,
+        isExternalReview: false,
+        isFollowup: false,
+      }));
+    });
+
+    it('should use projectId:prNumber as key format', () => {
+      manager.handleStartReview(projectId, prNumber);
+      const calls = mockSafeSendToRenderer.mock.calls;
+      const prCall = calls.find((call: unknown[]) => call[2] === `${projectId}:${prNumber}`);
+      expect(prCall).toBeDefined();
+    });
+  });
+
+  describe('deduplication', () => {
+    it('should NOT emit duplicate IPC for same state + same context', () => {
+      manager.handleStartReview(projectId, prNumber);
+      const callCountAfterStart = mockSafeSendToRenderer.mock.calls.length;
+
+      // Sending START_REVIEW again won't transition (guard prevents it), so no new emission
+      manager.handleStartReview(projectId, prNumber);
+      expect(mockSafeSendToRenderer.mock.calls.length).toBe(callCountAfterStart);
+    });
+
+    it('should emit for same state but different context (progress update)', () => {
+      manager.handleStartReview(projectId, prNumber);
+      const callCountAfterStart = mockSafeSendToRenderer.mock.calls.length;
+
+      manager.handleProgress(projectId, prNumber, createMockProgress({ progress: 25, message: 'Step 1' }));
+      expect(mockSafeSendToRenderer.mock.calls.length).toBeGreaterThan(callCountAfterStart);
+
+      const callCountAfterProgress1 = mockSafeSendToRenderer.mock.calls.length;
+      manager.handleProgress(projectId, prNumber, createMockProgress({ progress: 75, message: 'Step 2' }));
+      expect(mockSafeSendToRenderer.mock.calls.length).toBeGreaterThan(callCountAfterProgress1);
+    });
+
+    it('should always emit for different state transitions', () => {
+      manager.handleStartReview(projectId, prNumber);
+      const callCountAfterStart = mockSafeSendToRenderer.mock.calls.length;
+
+      manager.handleComplete(projectId, prNumber, createMockResult());
+      expect(mockSafeSendToRenderer.mock.calls.length).toBeGreaterThan(callCountAfterStart);
+    });
+  });
+
+  describe('cleanup', () => {
+    it('should stop actor and remove from map on handleClearReview', () => {
+      manager.handleStartReview(projectId, prNumber);
+      expect(manager.getState(projectId, prNumber)).not.toBeNull();
+
+      manager.handleClearReview(projectId, prNumber);
+      expect(manager.getState(projectId, prNumber)).toBeNull();
+    });
+
+    it('should emit exactly one cleared state IPC on handleClearReview (no double emission)', () => {
+      manager.handleStartReview(projectId, prNumber);
+      mockSafeSendToRenderer.mockClear();
+
+      manager.handleClearReview(projectId, prNumber);
+
+      // Should emit exactly 1 cleared state, not 2 (no double emission from
+      // sending CLEAR_REVIEW to actor subscription + manual emitClearedState)
+      expect(mockSafeSendToRenderer).toHaveBeenCalledTimes(1);
+      const payload = mockSafeSendToRenderer.mock.calls[0][3] as Record<string, unknown>;
+      expect(payload).toEqual(expect.objectContaining({ state: 'idle' }));
+    });
+
+    it('should stop ALL actors and clear maps on handleAuthChange', () => {
+      manager.handleStartReview(projectId, 1);
+      manager.handleStartReview(projectId, 2);
+
+      manager.handleAuthChange();
+
+      expect(manager.getState(projectId, 1)).toBeNull();
+      expect(manager.getState(projectId, 2)).toBeNull();
+    });
+
+    it('should emit cleared state to renderer on handleAuthChange', () => {
+      manager.handleStartReview(projectId, 1);
+      manager.handleStartReview(projectId, 2);
+      mockSafeSendToRenderer.mockClear();
+
+      manager.handleAuthChange();
+
+      // Should emit idle/null state for each PR
+      expect(mockSafeSendToRenderer).toHaveBeenCalledTimes(2);
+      for (const call of mockSafeSendToRenderer.mock.calls) {
+        const payload = call[3] as Record<string, unknown>;
+        expect(payload).toEqual(expect.objectContaining({ state: 'idle' }));
+      }
+    });
+
+    it('should stop all actors on clearAll', () => {
+      manager.handleStartReview(projectId, 1);
+      manager.handleStartReview(projectId, 2);
+
+      manager.clearAll();
+
+      expect(manager.getState(projectId, 1)).toBeNull();
+      expect(manager.getState(projectId, 2)).toBeNull();
+    });
+  });
+
+  describe('concurrent PRs', () => {
+    it('should support multiple PRs with independent actors', () => {
+      manager.handleStartReview(projectId, 1);
+      manager.handleStartReview(projectId, 2);
+
+      manager.handleComplete(projectId, 1, createMockResult());
+
+      expect(String(manager.getState(projectId, 1)!.value)).toBe('completed');
+      expect(String(manager.getState(projectId, 2)!.value)).toBe('reviewing');
+    });
+
+    it('should route events to correct actor by key', () => {
+      manager.handleStartReview(projectId, 1);
+      manager.handleStartReview(projectId, 2);
+
+      manager.handleError(projectId, 2, 'Error on PR 2');
+
+      expect(String(manager.getState(projectId, 1)!.value)).toBe('reviewing');
+      expect(String(manager.getState(projectId, 2)!.value)).toBe('error');
+      expect(manager.getState(projectId, 2)!.context.error).toBe('Error on PR 2');
+    });
+
+    it('should not affect other PRs when clearing one', () => {
+      manager.handleStartReview(projectId, 1);
+      manager.handleStartReview(projectId, 2);
+
+      manager.handleClearReview(projectId, 1);
+
+      expect(manager.getState(projectId, 1)).toBeNull();
+      expect(manager.getState(projectId, 2)).not.toBeNull();
+      expect(String(manager.getState(projectId, 2)!.value)).toBe('reviewing');
+    });
+  });
+});
@@ -1012,3 +1012,115 @@ Please add credits to continue.`;
    });
  });
 });
+
+describe('ensureCleanProfileEnv', () => {
+  beforeEach(() => {
+    vi.resetModules();
+  });
+
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe('with CLAUDE_CONFIG_DIR set', () => {
+    it('should preserve CLAUDE_CONFIG_DIR while clearing CLAUDE_CODE_OAUTH_TOKEN', async () => {
+      const { ensureCleanProfileEnv } = await import('../rate-limit-detector');
+
+      const env = {
+        CLAUDE_CONFIG_DIR: '/tmp/profile-1',
+        CLAUDE_CODE_OAUTH_TOKEN: 'oauth-token-123',
+        ANTHROPIC_API_KEY: 'sk-ant-key-456'
+      };
+      const result = ensureCleanProfileEnv(env);
+
+      expect(result.CLAUDE_CONFIG_DIR).toBe('/tmp/profile-1');
+      expect(result.CLAUDE_CODE_OAUTH_TOKEN).toBe('');
+      expect(result.ANTHROPIC_API_KEY).toBe('');
+    });
+
+    it('should preserve other environment variables', async () => {
+      const { ensureCleanProfileEnv } = await import('../rate-limit-detector');
+
+      const env = {
+        CLAUDE_CONFIG_DIR: '/tmp/profile-1',
+        CLAUDE_CODE_OAUTH_TOKEN: 'token',
+        ANTHROPIC_API_KEY: 'key',
+        SOME_OTHER_VAR: 'value'
+      };
+      const result = ensureCleanProfileEnv(env);
+
+      expect(result.CLAUDE_CONFIG_DIR).toBe('/tmp/profile-1');
+      expect(result.SOME_OTHER_VAR).toBe('value');
+      expect(result.CLAUDE_CODE_OAUTH_TOKEN).toBe('');
+      expect(result.ANTHROPIC_API_KEY).toBe('');
+    });
+
+    it('should clear tokens even if they are not present in input', async () => {
+      const { ensureCleanProfileEnv } = await import('../rate-limit-detector');
+
+      const env = {
+        CLAUDE_CONFIG_DIR: '/tmp/profile-1'
+      };
+      const result = ensureCleanProfileEnv(env);
+
+      expect(result.CLAUDE_CONFIG_DIR).toBe('/tmp/profile-1');
+      expect(result.CLAUDE_CODE_OAUTH_TOKEN).toBe('');
+      expect(result.ANTHROPIC_API_KEY).toBe('');
+    });
+  });
+
+  describe('without CLAUDE_CONFIG_DIR', () => {
+    it('should return env unchanged when CLAUDE_CONFIG_DIR is not set', async () => {
+      const { ensureCleanProfileEnv } = await import('../rate-limit-detector');
+
+      const env = {
+        CLAUDE_CODE_OAUTH_TOKEN: 'oauth-token-123',
+        ANTHROPIC_API_KEY: 'sk-ant-key-456'
+      };
+      const result = ensureCleanProfileEnv(env);
+
+      expect(result).toEqual(env);
+      expect(result.CLAUDE_CODE_OAUTH_TOKEN).toBe('oauth-token-123');
+      expect(result.ANTHROPIC_API_KEY).toBe('sk-ant-key-456');
+    });
+  });
+
+  describe('edge cases', () => {
+    it('should handle empty profile env', async () => {
+      const { ensureCleanProfileEnv } = await import('../rate-limit-detector');
+
+      const result = ensureCleanProfileEnv({});
+
+      // Empty env has no CLAUDE_CONFIG_DIR, so should return as-is
+      expect(result).toEqual({});
+    });
+
+    it('should handle env with empty string CLAUDE_CONFIG_DIR', async () => {
+      const { ensureCleanProfileEnv } = await import('../rate-limit-detector');
+
+      const env = {
+        CLAUDE_CONFIG_DIR: '',
+        CLAUDE_CODE_OAUTH_TOKEN: 'token'
+      };
+      const result = ensureCleanProfileEnv(env);
+
+      // Empty string is falsy, so should not trigger clearing
+      expect(result.CLAUDE_CODE_OAUTH_TOKEN).toBe('token');
+    });
+
+    it('should return a new object when clearing (not mutate input)', async () => {
+      const { ensureCleanProfileEnv } = await import('../rate-limit-detector');
+
+      const env = {
+        CLAUDE_CONFIG_DIR: '/tmp/profile-1',
+        CLAUDE_CODE_OAUTH_TOKEN: 'token'
+      };
+      const result = ensureCleanProfileEnv(env);
+
+      // Original should not be mutated
+      expect(env.CLAUDE_CODE_OAUTH_TOKEN).toBe('token');
+      expect(result.CLAUDE_CODE_OAUTH_TOKEN).toBe('');
+      expect(result).not.toBe(env);
+    });
+  });
+});
@@ -329,7 +329,9 @@ export class AgentManager extends EventEmitter {
    this.registerTaskWithOperationRegistry(taskId, 'spec-creation', { projectPath, taskDescription, specDir });

    // Note: This is spec-creation but it chains to task-execution via run.py
-    await this.processManager.spawnProcess(taskId, autoBuildSource, args, combinedEnv, 'task-execution', projectId);
+    // Use projectPath as cwd instead of autoBuildSource to avoid cross-drive file access
+    // issues on Windows. The script path is absolute so Python finds its modules via sys.path[0]. (#1661)
+    await this.processManager.spawnProcess(taskId, projectPath, args, combinedEnv, 'task-execution', projectId);
  }

  /**
@@ -410,7 +412,10 @@ export class AgentManager extends EventEmitter {
    // Register with unified OperationRegistry for proactive swap support
    this.registerTaskWithOperationRegistry(taskId, 'task-execution', { projectPath, specId, options });

-    await this.processManager.spawnProcess(taskId, autoBuildSource, args, combinedEnv, 'task-execution', projectId);
+    // Use projectPath as cwd instead of autoBuildSource to avoid cross-drive file access
+    // issues on Windows. The script path (runPath) is absolute so Python finds its modules
+    // via sys.path[0] which is set to the script's directory. (#1661)
+    await this.processManager.spawnProcess(taskId, projectPath, args, combinedEnv, 'task-execution', projectId);
  }

  /**
@@ -448,7 +453,8 @@ export class AgentManager extends EventEmitter {

    const args = [runPath, '--spec', specId, '--project-dir', projectPath, '--qa'];

-    await this.processManager.spawnProcess(taskId, autoBuildSource, args, combinedEnv, 'qa-process', projectId);
+    // Use projectPath as cwd instead of autoBuildSource to avoid cross-drive issues on Windows (#1661)
+    await this.processManager.spawnProcess(taskId, projectPath, args, combinedEnv, 'qa-process', projectId);
  }

  /**
@@ -799,4 +799,127 @@ describe('AgentProcessManager - API Profile Env Injection (Story 2.3)', () => {
      expect(envArg.GITHUB_CLI_PATH).toBe('/opt/homebrew/bin/gh');
    });
  });
+
+  describe('CLAUDE_CONFIG_DIR Propagation', () => {
+    let originalEnv: NodeJS.ProcessEnv;
+
+    beforeEach(() => {
+      originalEnv = { ...process.env };
+      delete process.env.CLAUDE_CONFIG_DIR;
+    });
+
+    afterEach(() => {
+      process.env = originalEnv;
+    });
+
+    it('should propagate CLAUDE_CONFIG_DIR from profile env in OAuth mode', async () => {
+      // OAuth mode - no active API profile
+      vi.mocked(profileService.getAPIProfileEnv).mockResolvedValue({});
+
+      // Profile provides CLAUDE_CONFIG_DIR (OAuth subscription profile)
+      vi.mocked(rateLimitDetector.getBestAvailableProfileEnv).mockReturnValue({
+        env: {
+          CLAUDE_CONFIG_DIR: '/home/user/.config/claude-profile-1',
+          CLAUDE_CODE_OAUTH_TOKEN: 'oauth-token-abc'
+        },
+        profileId: 'profile-1',
+        profileName: 'Profile 1',
+        wasSwapped: false
+      });
+
+      await processManager.spawnProcess('task-1', '/fake/cwd', ['run.py'], {}, 'task-execution');
+
+      expect(spawnCalls).toHaveLength(1);
+      const envArg = spawnCalls[0].options.env as Record<string, unknown>;
+
+      // CLAUDE_CONFIG_DIR should be present in spawn env
+      expect(envArg.CLAUDE_CONFIG_DIR).toBe('/home/user/.config/claude-profile-1');
+    });
+
+    it('should clear ANTHROPIC_API_KEY in OAuth mode with CLAUDE_CONFIG_DIR', async () => {
+      // Simulate stale ANTHROPIC_API_KEY in process.env
+      process.env.ANTHROPIC_API_KEY = 'sk-stale-key';
+
+      // OAuth mode - no active API profile
+      vi.mocked(profileService.getAPIProfileEnv).mockResolvedValue({});
+
+      // Profile provides CLAUDE_CONFIG_DIR
+      vi.mocked(rateLimitDetector.getBestAvailableProfileEnv).mockReturnValue({
+        env: {
+          CLAUDE_CONFIG_DIR: '/home/user/.config/claude-profile-2',
+          CLAUDE_CODE_OAUTH_TOKEN: 'oauth-token-def'
+        },
+        profileId: 'profile-2',
+        profileName: 'Profile 2',
+        wasSwapped: false
+      });
+
+      await processManager.spawnProcess('task-1', '/fake/cwd', ['run.py'], {}, 'task-execution');
+
+      expect(spawnCalls).toHaveLength(1);
+      const envArg = spawnCalls[0].options.env as Record<string, unknown>;
+
+      // ANTHROPIC_API_KEY should be cleared (empty string) in OAuth mode
+      expect(envArg.ANTHROPIC_API_KEY).toBe('');
+      // CLAUDE_CONFIG_DIR should still be set
+      expect(envArg.CLAUDE_CONFIG_DIR).toBe('/home/user/.config/claude-profile-2');
+    });
+
+    it('should pass ANTHROPIC_* vars without CLAUDE_CONFIG_DIR interference in API profile mode', async () => {
+      // API Profile mode - active profile with custom endpoint
+      const mockApiProfileEnv = {
+        ANTHROPIC_AUTH_TOKEN: 'sk-api-profile-key',
+        ANTHROPIC_BASE_URL: 'https://custom-api.example.com',
+        ANTHROPIC_MODEL: 'claude-sonnet-4-5-20250929'
+      };
+      vi.mocked(profileService.getAPIProfileEnv).mockResolvedValue(mockApiProfileEnv);
+
+      // Profile env without CLAUDE_CONFIG_DIR (API profile mode)
+      vi.mocked(rateLimitDetector.getBestAvailableProfileEnv).mockReturnValue({
+        env: {},
+        profileId: 'api-profile-1',
+        profileName: 'Custom API',
+        wasSwapped: false
+      });
+
+      await processManager.spawnProcess('task-1', '/fake/cwd', ['run.py'], {}, 'task-execution');
+
+      expect(spawnCalls).toHaveLength(1);
+      const envArg = spawnCalls[0].options.env as Record<string, unknown>;
+
+      // ANTHROPIC_* vars from API profile should be passed through
+      expect(envArg.ANTHROPIC_AUTH_TOKEN).toBe('sk-api-profile-key');
+      expect(envArg.ANTHROPIC_BASE_URL).toBe('https://custom-api.example.com');
+      expect(envArg.ANTHROPIC_MODEL).toBe('claude-sonnet-4-5-20250929');
+
+      // CLAUDE_CONFIG_DIR should NOT be present since profile didn't provide it
+      expect(envArg.CLAUDE_CONFIG_DIR).toBeUndefined();
+    });
+
+    it('should clear CLAUDE_CODE_OAUTH_TOKEN when CLAUDE_CONFIG_DIR is provided by profile', async () => {
+      // OAuth mode
+      vi.mocked(profileService.getAPIProfileEnv).mockResolvedValue({});
+
+      // Profile provides CLAUDE_CONFIG_DIR - agent should use config dir for auth
+      vi.mocked(rateLimitDetector.getBestAvailableProfileEnv).mockReturnValue({
+        env: {
+          CLAUDE_CONFIG_DIR: '/home/user/.config/claude-profile-3',
+          CLAUDE_CODE_OAUTH_TOKEN: 'oauth-token-ghi'
+        },
+        profileId: 'profile-3',
+        profileName: 'Profile 3',
+        wasSwapped: false
+      });
+
+      await processManager.spawnProcess('task-1', '/fake/cwd', ['run.py'], {}, 'task-execution');
+
+      expect(spawnCalls).toHaveLength(1);
+      const envArg = spawnCalls[0].options.env as Record<string, unknown>;
+
+      // When CLAUDE_CONFIG_DIR is present, CLAUDE_CODE_OAUTH_TOKEN should be cleared
+      // because Claude Code resolves auth from the config dir instead
+      expect(envArg.CLAUDE_CONFIG_DIR).toBe('/home/user/.config/claude-profile-3');
+      expect(envArg.CLAUDE_CODE_OAUTH_TOKEN).toBeFalsy();
+    });
+  });
 });
@@ -22,10 +22,11 @@ import { pythonEnvManager, getConfiguredPythonPath } from '../python-env-manager
 import { buildMemoryEnvVars } from '../memory-env-builder';
 import { readSettingsFile } from '../settings-utils';
 import type { AppSettings } from '../../shared/types/settings';
-import { getOAuthModeClearVars } from './env-utils';
+import { getOAuthModeClearVars, normalizeEnvPathKey, mergePythonEnvPath } from './env-utils';
 import { getAugmentedEnv } from '../env-utils';
 import { getToolInfo, getClaudeCliPathForSdk } from '../cli-tool-manager';
-import { killProcessGracefully, isWindows } from '../platform';
+import { killProcessGracefully, isWindows, getPathDelimiter } from '../platform';
+import { debugLog } from '../../shared/utils/debug-logger';

 /**
 * Type for supported CLI tools
@@ -178,6 +179,29 @@ export class AgentProcessManager {
    // Get best available Claude profile environment (automatically handles rate limits)
    const profileResult = getBestAvailableProfileEnv();
    const profileEnv = profileResult.env;
+
+    debugLog('[AgentProcess:setupEnv] Profile result:', {
+      profileId: profileResult.profileId,
+      hasOAuthToken: !!profileEnv.CLAUDE_CODE_OAUTH_TOKEN,
+      hasApiKey: !!profileEnv.ANTHROPIC_API_KEY,
+      hasConfigDir: !!profileEnv.CLAUDE_CONFIG_DIR,
+      configDir: profileEnv.CLAUDE_CONFIG_DIR || '(not set)',
+      oauthTokenPrefix: profileEnv.CLAUDE_CODE_OAUTH_TOKEN?.substring(0, 8) || '(not set)',
+      apiKeyPrefix: profileEnv.ANTHROPIC_API_KEY?.substring(0, 8) || '(not set)',
+    });
+
+    // Warn if profile lacks CLAUDE_CONFIG_DIR - this means the profile has no configDir
+    // and subscription metadata may not propagate correctly to the agent subprocess
+    if (!profileEnv.CLAUDE_CONFIG_DIR) {
+      console.warn('[AgentProcess:setupEnv] WARNING: Profile env lacks CLAUDE_CONFIG_DIR - profile may not have a configDir set. Subscription metadata may not reach agent subprocess.');
+    }
+
+    debugLog('[AgentProcess:setupEnv] extraEnv auth keys:', {
+      hasOAuthToken: !!extraEnv.CLAUDE_CODE_OAUTH_TOKEN,
+      hasApiKey: !!extraEnv.ANTHROPIC_API_KEY,
+      hasConfigDir: !!extraEnv.CLAUDE_CONFIG_DIR,
+    });
+
    // Use getAugmentedEnv() to ensure common tool paths (dotnet, homebrew, etc.)
    // are available even when app is launched from Finder/Dock
    const augmentedEnv = getAugmentedEnv();
@@ -205,7 +229,9 @@ export class AgentProcessManager {
    const ghCliEnv = this.detectAndSetCliPath('gh');
    const glabCliEnv = this.detectAndSetCliPath('glab');

-    return {
+    // Profile env is spread last to ensure CLAUDE_CONFIG_DIR and auth vars
+    // from the active profile always win over extraEnv or augmentedEnv.
+    const mergedEnv = {
      ...augmentedEnv,
      ...gitBashEnv,
      ...claudeCliEnv,
@@ -217,6 +243,29 @@ export class AgentProcessManager {
      PYTHONIOENCODING: 'utf-8',
      PYTHONUTF8: '1'
    } as NodeJS.ProcessEnv;
+
+    // When the active profile provides CLAUDE_CONFIG_DIR, clear CLAUDE_CODE_OAUTH_TOKEN
+    // from the spawn environment. CLAUDE_CONFIG_DIR lets Claude Code resolve its own
+    // OAuth tokens from the config directory, making an explicit token unnecessary.
+    // This matches the terminal pattern in claude-integration-handler.ts where
+    // configDir is preferred over direct token injection.
+    // We check profileEnv specifically (not mergedEnv) to avoid clearing the token
+    // when CLAUDE_CONFIG_DIR comes from the shell environment rather than the profile.
+    if (profileEnv.CLAUDE_CONFIG_DIR) {
+      mergedEnv.CLAUDE_CODE_OAUTH_TOKEN = '';
+      debugLog('[AgentProcess:setupEnv] Profile provides CLAUDE_CONFIG_DIR, cleared CLAUDE_CODE_OAUTH_TOKEN from spawn env');
+    }
+
+    debugLog('[AgentProcess:setupEnv] Final merged env auth state:', {
+      hasOAuthToken: !!mergedEnv.CLAUDE_CODE_OAUTH_TOKEN,
+      hasApiKey: !!mergedEnv.ANTHROPIC_API_KEY,
+      hasConfigDir: !!mergedEnv.CLAUDE_CONFIG_DIR,
+      configDir: mergedEnv.CLAUDE_CONFIG_DIR || '(not set)',
+      oauthTokenPrefix: mergedEnv.CLAUDE_CODE_OAUTH_TOKEN?.substring(0, 8) || '(not set)',
+      apiKeyPrefix: mergedEnv.ANTHROPIC_API_KEY?.substring(0, 8) || '(not set)',
+    });
+
+    return mergedEnv;
  }

  private handleProcessFailure(
@@ -615,7 +664,32 @@ export class AgentProcessManager {
    // Get OAuth mode clearing vars (clears stale ANTHROPIC_* vars when in OAuth mode)
    const oauthModeClearVars = getOAuthModeClearVars(apiProfileEnv);

-    // Parse Python commandto handle space-separated commands like "py -3"
+    debugLog('[AgentProcess:spawnProcess] Environment merge chain for task:', taskId, {
+      baseEnv: {
+        hasOAuthToken: !!env.CLAUDE_CODE_OAUTH_TOKEN,
+        hasApiKey: !!env.ANTHROPIC_API_KEY,
+        hasConfigDir: !!env.CLAUDE_CONFIG_DIR,
+        configDir: env.CLAUDE_CONFIG_DIR || '(not set)',
+      },
+      oauthModeClearVars: Object.keys(oauthModeClearVars),
+      apiProfileEnv: {
+        hasApiKey: !!apiProfileEnv.ANTHROPIC_API_KEY,
+        hasBaseUrl: !!apiProfileEnv.ANTHROPIC_BASE_URL,
+        apiKeyPrefix: apiProfileEnv.ANTHROPIC_API_KEY?.substring(0, 8) || '(not set)',
+      },
+    });
+
+    // Merge PATH from pythonEnv with augmented PATH from env.
+    // pythonEnv may contain its own PATH (e.g., on Windows with pywin32_system32 prepended).
+    // Simply spreading pythonEnv after env would overwrite the augmented PATH (which includes
+    // npm globals, homebrew, etc.), causing "Claude code not found" on Windows (#1661).
+    // mergePythonEnvPath() normalizes PATH key casing and prepends pythonEnv-specific paths.
+    const mergedPythonEnv = { ...pythonEnv };
+    const pathSep = getPathDelimiter();
+
+    mergePythonEnvPath(env as Record<string, string | undefined>, mergedPythonEnv as Record<string, string | undefined>, pathSep);
+
+    // Parse Python command to handle space-separated commands like "py -3"
    const [pythonCommand, pythonBaseArgs] = parsePythonCommand(this.getPythonPath());
    let childProcess;
    try {
@@ -623,7 +697,7 @@ export class AgentProcessManager {
        cwd,
        env: {
          ...env, // Already includes process.env, extraEnv, profileEnv, PYTHONUNBUFFERED, PYTHONUTF8
-          ...pythonEnv, // Include Python environment (PYTHONPATH for bundled packages)
+          ...mergedPythonEnv, // Python env with merged PATH (preserves augmented PATH entries)
          ...oauthModeClearVars, // Clear stale ANTHROPIC_* vars when in OAuth mode
          ...apiProfileEnv // Include active API profile config (highest priority for ANTHROPIC_* vars)
        }
@@ -10,7 +10,7 @@ import type { IdeationConfig, Idea } from '../../shared/types';
 import { AUTO_BUILD_PATHS } from '../../shared/constants';
 import { detectRateLimit, createSDKRateLimitInfo, getBestAvailableProfileEnv } from '../rate-limit-detector';
 import { getAPIProfileEnv } from '../services/profile';
-import { getOAuthModeClearVars } from './env-utils';
+import { getOAuthModeClearVars, normalizeEnvPathKey } from './env-utils';
 import { debugLog, debugError } from '../../shared/utils/debug-logger';
 import { stripAnsiCodes } from '../../shared/utils/ansi-sanitizer';
 import { parsePythonCommand } from '../python-detector';
@@ -397,6 +397,12 @@ export class AgentQueueManager {
      PYTHONUTF8: '1'
    };

+    // Normalize PATH key to a single uppercase 'PATH' entry.
+    // On Windows, process.env spread produces 'Path' while pythonEnv may write 'PATH',
+    // resulting in duplicate keys in the final object. Without normalization the child
+    // process inherits both keys, which can cause tool-not-found errors (#1661).
+    normalizeEnvPathKey(finalEnv as Record<string, string | undefined>);
+
    // Debug: Show OAuth token source (token values intentionally omitted for security - AC4)
    const tokenSource = profileEnv['CLAUDE_CODE_OAUTH_TOKEN']
      ? 'Electron app profile'
@@ -730,6 +736,12 @@ export class AgentQueueManager {
      PYTHONUTF8: '1'
    };

+    // Normalize PATH key to a single uppercase 'PATH' entry.
+    // On Windows, process.env spread produces 'Path' while pythonEnv may write 'PATH',
+    // resulting in duplicate keys in the final object. Without normalization the child
+    // process inherits both keys, which can cause tool-not-found errors (#1661).
+    normalizeEnvPathKey(finalEnv as Record<string, string | undefined>);
+
    // Debug: Show OAuth token source (token values intentionally omitted for security - AC4)
    const tokenSource = profileEnv['CLAUDE_CODE_OAUTH_TOKEN']
      ? 'Electron app profile'
@@ -4,7 +4,7 @@
 */

 import { describe, it, expect } from 'vitest';
-import { getOAuthModeClearVars } from './env-utils';
+import { getOAuthModeClearVars, normalizeEnvPathKey, mergePythonEnvPath } from './env-utils';

 describe('getOAuthModeClearVars', () => {
  describe('OAuth mode (no active API profile)', () => {
@@ -132,3 +132,166 @@ describe('getOAuthModeClearVars', () => {
    });
  });
 });
+
+describe('normalizeEnvPathKey', () => {
+  it('should leave an already-uppercase PATH key untouched', () => {
+    const env: Record<string, string | undefined> = { PATH: '/usr/bin:/bin', HOME: '/home/user' };
+    normalizeEnvPathKey(env);
+    expect(env).toEqual({ PATH: '/usr/bin:/bin', HOME: '/home/user' });
+  });
+
+  it('should rename a lowercase-variant "Path" key to "PATH"', () => {
+    const env: Record<string, string | undefined> = { Path: 'C:\\Windows\\system32', HOME: '/home/user' };
+    normalizeEnvPathKey(env);
+    expect(env['PATH']).toBe('C:\\Windows\\system32');
+    expect('Path' in env).toBe(false);
+  });
+
+  it('should prefer existing "PATH" and remove "Path" when both keys coexist', () => {
+    // Simulates process.env spread ('Path') after getAugmentedEnv writes ('PATH')
+    const env: Record<string, string | undefined> = {
+      Path: 'C:\\old',
+      PATH: 'C:\\Windows\\system32;C:\\augmented',
+      HOME: '/home/user'
+    };
+    normalizeEnvPathKey(env);
+    expect(env.PATH).toBe('C:\\Windows\\system32;C:\\augmented');
+    expect('Path' in env).toBe(false);
+  });
+
+  it('should remove all case-variant PATH duplicates when PATH is already present', () => {
+    const env: Record<string, string | undefined> = {
+      PATH: '/correct',
+      Path: '/old1',
+      path: '/old2'
+    };
+    normalizeEnvPathKey(env);
+    expect(env.PATH).toBe('/correct');
+    expect('Path' in env).toBe(false);
+    expect('path' in env).toBe(false);
+  });
+
+  it('should handle env with no PATH-like key gracefully', () => {
+    const env: Record<string, string | undefined> = { HOME: '/home/user', SHELL: '/bin/zsh' };
+    normalizeEnvPathKey(env);
+    expect(env).toEqual({ HOME: '/home/user', SHELL: '/bin/zsh' });
+  });
+
+  it('should return the same env object reference (mutates in place)', () => {
+    const env: Record<string, string | undefined> = { PATH: '/usr/bin' };
+    const result = normalizeEnvPathKey(env);
+    expect(result).toBe(env);
+  });
+});
+
+describe('mergePythonEnvPath - Windows PATH merge logic (#1661)', () => {
+  const SEP = ';'; // Use Windows separator for these tests
+
+  it('should prepend pythonEnv-only entries to the augmented PATH', () => {
+    const env: Record<string, string | undefined> = {
+      PATH: 'C:\\npm;C:\\homebrew'
+    };
+    const mergedPythonEnv: Record<string, string | undefined> = {
+      PATH: 'C:\\pywin32_system32;C:\\npm;C:\\homebrew'
+    };
+
+    mergePythonEnvPath(env, mergedPythonEnv, SEP);
+
+    // pywin32_system32 is unique to pythonEnv, so it should be prepended
+    expect(mergedPythonEnv.PATH).toBe('C:\\pywin32_system32;C:\\npm;C:\\homebrew');
+  });
+
+  it('should deduplicate entries that already exist in augmented PATH', () => {
+    const env: Record<string, string | undefined> = {
+      PATH: 'C:\\npm;C:\\homebrew;C:\\pywin32_system32'
+    };
+    const mergedPythonEnv: Record<string, string | undefined> = {
+      PATH: 'C:\\pywin32_system32;C:\\npm'
+    };
+
+    mergePythonEnvPath(env, mergedPythonEnv, SEP);
+
+    // All pythonEnv entries are already in env.PATH, so mergedPythonEnv.PATH should equal env.PATH
+    expect(mergedPythonEnv.PATH).toBe('C:\\npm;C:\\homebrew;C:\\pywin32_system32');
+  });
+
+  it('should normalize Windows-style "Path" key in pythonEnv to "PATH"', () => {
+    const env: Record<string, string | undefined> = {
+      PATH: 'C:\\npm;C:\\homebrew'
+    };
+    // pythonEnv uses 'Path' (Windows native casing)
+    const mergedPythonEnv: Record<string, string | undefined> = {
+      Path: 'C:\\pywin32_system32;C:\\npm'
+    };
+
+    mergePythonEnvPath(env, mergedPythonEnv, SEP);
+
+    // 'Path' should be normalized to 'PATH' and pythonEnv-specific entry prepended
+    expect('Path' in mergedPythonEnv).toBe(false);
+    expect(mergedPythonEnv.PATH).toBe('C:\\pywin32_system32;C:\\npm;C:\\homebrew');
+  });
+
+  it('should normalize Windows-style "Path" in env and deduplicate duplicates', () => {
+    // Simulates process.env spread ('Path') + getAugmentedEnv write ('PATH') leaving both
+    const env: Record<string, string | undefined> = {
+      Path: 'C:\\old',
+      PATH: 'C:\\npm;C:\\homebrew'
+    };
+    const mergedPythonEnv: Record<string, string | undefined> = {
+      PATH: 'C:\\pywin32_system32;C:\\npm'
+    };
+
+    mergePythonEnvPath(env, mergedPythonEnv, SEP);
+
+    // env 'Path' should be removed; augmented 'PATH' value preserved
+    expect('Path' in env).toBe(false);
+    expect(env.PATH).toBe('C:\\npm;C:\\homebrew');
+    // Only the unique pywin32_system32 entry prepended
+    expect(mergedPythonEnv.PATH).toBe('C:\\pywin32_system32;C:\\npm;C:\\homebrew');
+  });
+
+  it('should use env.PATH unchanged when pythonEnv has no unique entries', () => {
+    const env: Record<string, string | undefined> = {
+      PATH: 'C:\\npm;C:\\homebrew'
+    };
+    const mergedPythonEnv: Record<string, string | undefined> = {
+      PATH: 'C:\\npm;C:\\homebrew'
+    };
+
+    mergePythonEnvPath(env, mergedPythonEnv, SEP);
+
+    expect(mergedPythonEnv.PATH).toBe('C:\\npm;C:\\homebrew');
+  });
+
+  it('should work correctly with Unix colon separator', () => {
+    const unixSep = ':';
+    const env: Record<string, string | undefined> = {
+      PATH: '/usr/bin:/bin'
+    };
+    const mergedPythonEnv: Record<string, string | undefined> = {
+      PATH: '/opt/pyenv/shims:/usr/bin:/bin'
+    };
+
+    mergePythonEnvPath(env, mergedPythonEnv, unixSep);
+
+    // /opt/pyenv/shims is unique and should be prepended
+    expect(mergedPythonEnv.PATH).toBe('/opt/pyenv/shims:/usr/bin:/bin');
+  });
+
+  it('should handle missing PATH in pythonEnv gracefully (no-op)', () => {
+    const env: Record<string, string | undefined> = {
+      PATH: 'C:\\npm;C:\\homebrew'
+    };
+    // pythonEnv has no PATH at all
+    const mergedPythonEnv: Record<string, string | undefined> = {
+      PYTHONPATH: '/site-packages'
+    };
+
+    mergePythonEnvPath(env, mergedPythonEnv, SEP);
+
+    // Nothing should change
+    expect(mergedPythonEnv.PATH).toBeUndefined();
+    expect(mergedPythonEnv.PYTHONPATH).toBe('/site-packages');
+    expect(env.PATH).toBe('C:\\npm;C:\\homebrew');
+  });
+});
@@ -2,6 +2,88 @@
 * Utility functions for managing environment variables in agent spawning
 */

+/**
+ * Normalize the PATH key in an environment object to a single uppercase 'PATH' key.
+ *
+ * On Windows, process.env spreads as 'Path' (the native casing) while getAugmentedEnv()
+ * writes 'PATH'. Without normalization, both keys coexist in the object and the child
+ * process receives duplicate PATH entries, causing tool-not-found errors like #1661.
+ *
+ * Mutates the provided env object in place and returns it for convenience.
+ *
+ * @param env - Mutable environment record to normalize
+ * @returns The same env object with PATH normalized to uppercase
+ */
+export function normalizeEnvPathKey(env: Record<string, string | undefined>): Record<string, string | undefined> {
+  // If 'PATH' already exists, delete all other case-variant keys (e.g. 'Path')
+  if ('PATH' in env) {
+    for (const key of Object.keys(env)) {
+      if (key !== 'PATH' && key.toUpperCase() === 'PATH') {
+        delete env[key];
+      }
+    }
+    return env;
+  }
+
+  // No uppercase 'PATH' key - find the first case-variant and rename it
+  const pathKey = Object.keys(env).find(k => k.toUpperCase() === 'PATH');
+  if (pathKey) {
+    env['PATH'] = env[pathKey];
+    delete env[pathKey];
+    // Remove any remaining case-variant keys
+    for (const key of Object.keys(env)) {
+      if (key !== 'PATH' && key.toUpperCase() === 'PATH') {
+        delete env[key];
+      }
+    }
+  }
+
+  return env;
+}
+
+/**
+ * Merge pythonEnv PATH entries with the augmented PATH in env, deduplicating entries.
+ *
+ * pythonEnv may carry its own PATH (e.g. pywin32_system32 prepended on Windows).
+ * Simply spreading pythonEnv after env would overwrite the augmented PATH (which
+ * includes npm globals, Homebrew, etc.), causing "Claude code not found" (#1661).
+ *
+ * Strategy:
+ *  1. Normalize PATH key casing in both env and pythonEnv to uppercase 'PATH'.
+ *  2. Extract only pythonEnv PATH entries that are not already in env.PATH.
+ *  3. Prepend those unique entries to env.PATH and store the result in pythonEnv.PATH.
+ *
+ * Mutates mergedPythonEnv in place (caller should pass a shallow copy if immutability is needed).
+ *
+ * @param env - The base environment (already augmented with tool paths)
+ * @param mergedPythonEnv - Shallow copy of pythonEnv to merge PATH into
+ * @param pathSep - Platform path separator (';' on Windows, ':' elsewhere)
+ */
+export function mergePythonEnvPath(
+  env: Record<string, string | undefined>,
+  mergedPythonEnv: Record<string, string | undefined>,
+  pathSep: string
+): void {
+  // Normalize PATH key to uppercase in both objects
+  normalizeEnvPathKey(env);
+  normalizeEnvPathKey(mergedPythonEnv);
+
+  if (mergedPythonEnv['PATH'] && env['PATH']) {
+    const augmentedPathEntries = new Set(
+      (env['PATH'] as string).split(pathSep).filter(Boolean)
+    );
+    // Extract only new entries from pythonEnv.PATH that aren't already in the augmented PATH
+    const pythonPathEntries = (mergedPythonEnv['PATH'] as string)
+      .split(pathSep)
+      .filter(entry => entry && !augmentedPathEntries.has(entry));
+
+    // Prepend python-specific paths (e.g., pywin32_system32) to the augmented PATH
+    mergedPythonEnv['PATH'] = pythonPathEntries.length > 0
+      ? [...pythonPathEntries, env['PATH'] as string].join(pathSep)
+      : env['PATH'] as string;
+  }
+}
+
 /**
 * Get environment variables to clear ANTHROPIC_* vars when in OAuth mode
 *
@@ -38,6 +38,18 @@ log.transports.file.fileName = 'main.log';
 // Console transport - always show warnings and errors, debug only in dev mode
 log.transports.console.level = process.env.NODE_ENV === 'development' ? 'debug' : 'warn';
 log.transports.console.format = '[{h}:{i}:{s}] [{level}] {text}';
+// Guard console transport writes so broken stdio streams do not crash the app.
+{
+  const originalConsoleWriteFn = log.transports.console.writeFn as (...args: unknown[]) => void;
+  log.transports.console.writeFn = (...args: unknown[]) => {
+    try {
+      originalConsoleWriteFn(...args);
+    } catch (error) {
+      const err = error instanceof Error ? `${error.name}: ${error.message}` : String(error);
+      safeStderrWrite(`[app-logger] console transport write failed: ${err}`);
+    }
+  };
+}

 // Determine if this is a beta version
 function isBetaVersion(): boolean {
@@ -204,14 +216,44 @@ export const appLog = {
  log: (...args: unknown[]) => log.info(...args),
 };

+/**
+ * Best-effort stderr fallback used when electron-log itself throws (e.g. EIO).
+ * Must never throw, especially inside uncaught exception handlers.
+ */
+function safeStderrWrite(message: string): void {
+  try {
+    process.stderr.write(`${message}\n`);
+  } catch {
+    // Ignore - nothing else we can safely do here.
+  }
+}
+
+/**
+ * Log an unhandled error without risking recursive crashes if logger transport fails.
+ */
+function safeLogUnhandled(prefix: string, value: unknown): void {
+  try {
+    log.error(prefix, value);
+  } catch (loggingError) {
+    const loggingFailure = loggingError instanceof Error
+      ? `${loggingError.name}: ${loggingError.message}`
+      : String(loggingError);
+    const original = value instanceof Error
+      ? (value.stack || `${value.name}: ${value.message}`)
+      : String(value);
+    safeStderrWrite(`[app-logger] ${prefix} (logger failed: ${loggingFailure})`);
+    safeStderrWrite(original);
+  }
+}
+
 // Log unhandled errors
 export function setupErrorLogging(): void {
  process.on('uncaughtException', (error) => {
-    log.error('Uncaught exception:', error);
+    safeLogUnhandled('Uncaught exception:', error);
  });

  process.on('unhandledRejection', (reason) => {
-    log.error('Unhandled rejection:', reason);
+    safeLogUnhandled('Unhandled rejection:', reason);
  });

  log.info('Error logging initialized');
@@ -88,16 +88,18 @@ function htmlToMarkdown(html: string): string {
  md = md.replace(/<br\s*\/?>/gi, '\n');
  md = md.replace(/<hr\s*\/?>/gi, '---\n\n');

-  // Remove any remaining HTML tags
-  md = md.replace(/<[^>]+>/g, '');
+  // Remove any remaining HTML tags (loop to handle nested tag fragments)
+  while (/<[^>]+>/.test(md)) {
+    md = md.replace(/<[^>]+>/g, '');
+  }

-  // Decode common HTML entities
-  md = md.replace(/&amp;/g, '&');
+  // Decode common HTML entities (&amp; LAST to prevent double-unescaping like &amp;lt; → &lt; → <)
  md = md.replace(/&lt;/g, '<');
  md = md.replace(/&gt;/g, '>');
  md = md.replace(/&quot;/g, '"');
  md = md.replace(/&#39;/g, "'");
  md = md.replace(/&nbsp;/g, ' ');
+  md = md.replace(/&amp;/g, '&');

  // Clean up excessive whitespace
  md = md.replace(/\n{3,}/g, '\n\n');
@@ -56,6 +56,7 @@ import {
  expandHomePath,
  getEmailFromConfigDir
 } from './claude-profile/profile-utils';
+import { debugLog } from '../shared/utils/debug-logger';

 /**
 * Manages Claude Code profiles for multi-account support.
@@ -86,6 +87,8 @@ export class ClaudeProfileManager {
      return;
    }

+    console.log('[ClaudeProfileManager] Starting initialization...');
+
    // Ensure directory exists (async) - mkdir with recursive:true is idempotent
    await mkdir(this.configDir, { recursive: true });

@@ -93,6 +96,9 @@ export class ClaudeProfileManager {
    const loadedData = await loadProfileStoreAsync(this.storePath);
    if (loadedData) {
      this.data = loadedData;
+      debugLog('[ClaudeProfileManager] Loaded profile store with', this.data.profiles.length, 'profiles');
+    } else {
+      debugLog('[ClaudeProfileManager] No existing profile store found, using defaults');
    }

    // Run one-time migration to fix corrupted emails
@@ -104,6 +110,7 @@ export class ClaudeProfileManager {
    this.populateSubscriptionMetadata();

    this.initialized = true;
+    console.log('[ClaudeProfileManager] Initialization complete');
  }

  /**
@@ -149,13 +156,20 @@ export class ClaudeProfileManager {
  private populateSubscriptionMetadata(): void {
    let needsSave = false;

+    debugLog('[ClaudeProfileManager] populateSubscriptionMetadata: checking', this.data.profiles.length, 'profiles');
+
    for (const profile of this.data.profiles) {
      if (!profile.configDir) {
+        debugLog('[ClaudeProfileManager] populateSubscriptionMetadata: skipping profile', profile.id, '(no configDir)');
        continue;
      }

      // Skip if profile already has subscription metadata
      if (profile.subscriptionType && profile.rateLimitTier) {
+        debugLog('[ClaudeProfileManager] populateSubscriptionMetadata: profile', profile.id, 'already has metadata:', {
+          subscriptionType: profile.subscriptionType,
+          rateLimitTier: profile.rateLimitTier
+        });
        continue;
      }

@@ -542,8 +556,27 @@ export class ClaudeProfileManager {
      if (process.env.DEBUG === 'true') {
        console.warn('[ClaudeProfileManager] Using CLAUDE_CONFIG_DIR for profile:', profile.name, expandedConfigDir);
      }
-    } else {
-      console.warn('[ClaudeProfileManager] Profile has no configDir configured:', profile?.name);
+    } else if (profile) {
+      // Fallback: retrieve OAuth token directly from Keychain when configDir is missing.
+      // Without configDir, Claude CLI cannot resolve credentials automatically,
+      // so we inject CLAUDE_CODE_OAUTH_TOKEN as a direct override.
+      debugLog(
+        '[ClaudeProfileManager] Profile has no configDir configured:',
+        profile.name,
+        '- falling back to Keychain token lookup. Subscription display may be degraded.'
+      );
+
+      const credentials = getCredentialsFromKeychain(undefined, true);
+      if (credentials.token) {
+        env.CLAUDE_CODE_OAUTH_TOKEN = credentials.token;
+        debugLog('[ClaudeProfileManager] Injected CLAUDE_CODE_OAUTH_TOKEN from Keychain for profile:', profile.name);
+      } else {
+        debugLog(
+          '[ClaudeProfileManager] No token found in Keychain for profile without configDir:',
+          profile.name,
+          credentials.error ? `(error: ${credentials.error})` : ''
+        );
+      }
    }

    return env;
@@ -801,8 +834,26 @@ export class ClaudeProfileManager {
      return {};
    }

-    // If no configDir is defined, fall back to default
    if (!profile.configDir) {
+      // Fallback: retrieve OAuth token directly from Keychain when configDir is missing.
+      // Without configDir, Claude CLI cannot resolve credentials automatically,
+      // so we inject CLAUDE_CODE_OAUTH_TOKEN as a direct override.
+      // This mirrors the fallback in getActiveProfileEnv().
+      debugLog(
+        '[ClaudeProfileManager] getProfileEnv: profile has no configDir:',
+        profile.name,
+        '- falling back to Keychain token lookup.'
+      );
+
+      const credentials = getCredentialsFromKeychain(undefined, true);
+      if (credentials.token) {
+        debugLog('[ClaudeProfileManager] getProfileEnv: injected CLAUDE_CODE_OAUTH_TOKEN from Keychain for profile:', profile.name);
+        return { CLAUDE_CODE_OAUTH_TOKEN: credentials.token };
+      }
+      debugLog(
+        '[ClaudeProfileManager] getProfileEnv: no token found in Keychain for profile without configDir:',
+        profile.name
+      );
      return {};
    }

@@ -1825,6 +1825,7 @@ function updateLinuxFileCredentials(
    }

    // Write to file with secure permissions (0600)
+    // lgtm[js/http-to-file-access] - credentialsPath is from controlled configDir
    writeFileSync(credentialsPath, credentialsJson, { mode: 0o600, encoding: 'utf-8' });

    if (isDebug) {
@@ -2086,6 +2087,7 @@ function updateWindowsFileCredentials(
    const tempPath = `${credentialsPath}.${Date.now()}.tmp`;
    try {
      // Write to temp file
+      // lgtm[js/http-to-file-access] - credentialsPath is from controlled configDir
      writeFileSync(tempPath, credentialsJson, { encoding: 'utf-8' });

      // Restrict temp file permissions to current user only (mimics Unix 0600)
@@ -6,7 +6,8 @@
 * and can be copied between profiles to enable session continuity after profile switches.
 */

-import { existsSync, mkdirSync, copyFileSync, cpSync, unlinkSync } from 'fs';
+import { existsSync } from 'fs';
+import { mkdir, copyFile, cp, unlink } from 'fs/promises';
 import { join, dirname } from 'path';
 import { homedir } from 'os';
 import { isNodeError } from '../utils/type-guards';
@@ -95,12 +96,12 @@ export interface SessionMigrationResult {
 * @param sessionId - The session UUID to migrate
 * @returns Migration result with success status and details
 */
-export function migrateSession(
+export async function migrateSession(
  sourceConfigDir: string,
  targetConfigDir: string,
  cwd: string,
  sessionId: string
-): SessionMigrationResult {
+): Promise<SessionMigrationResult> {
  const result: SessionMigrationResult = {
    success: false,
    sessionId,
@@ -118,13 +119,14 @@ export function migrateSession(
  try {
    // Ensure target directory exists (do this first, before any file operations)
    const targetParentDir = dirname(targetFile);
-    mkdirSync(targetParentDir, { recursive: true });
+    await mkdir(targetParentDir, { recursive: true });
    console.warn('[SessionUtils] Ensured target directory exists:', targetParentDir);

    // Attempt to copy the session .jsonl file
    // This will throw if source doesn't exist or target cannot be written
+    // Note: copyFile silently overwrites by default (no COPYFILE_EXCL flag)
    try {
-      copyFileSync(sourceFile, targetFile);
+      await copyFile(sourceFile, targetFile);
      result.filesCopied++;
      console.warn('[SessionUtils] Copied session file:', sourceFile, '->', targetFile);
    } catch (copyError) {
@@ -132,12 +134,6 @@ export function migrateSession(
      if (isNodeError(copyError)) {
        if (copyError.code === 'ENOENT') {
          result.error = `Source session file not found: ${sourceFile}`;
-        } else if (copyError.code === 'EEXIST') {
-          // Target already exists - this is OK, treat as successful skip
-          console.warn('[SessionUtils] Session already exists in target profile, skipping copy');
-          result.success = true;
-          result.filesCopied = 0;
-          return result;
        } else {
          result.error = `Failed to copy session file: ${copyError.message}`;
        }
@@ -153,7 +149,7 @@ export function migrateSession(
    // Attempt to copy the session directory (tool-results) if it exists
    // Use try-catch instead of existsSync to avoid TOCTOU race
    try {
-      cpSync(sourceDir, targetDir, { recursive: true });
+      await cp(sourceDir, targetDir, { recursive: true });
      result.filesCopied++;
      console.warn('[SessionUtils] Copied session directory:', sourceDir, '->', targetDir);
    } catch (dirCopyError) {
@@ -182,7 +178,7 @@ export function migrateSession(
    // Clean up partially migrated session file to enable retry
    // Use try-catch instead of existsSync to avoid TOCTOU race
    try {
-      unlinkSync(targetFile);
+      await unlink(targetFile);
      console.warn('[SessionUtils] Cleaned up partial migration file:', targetFile);
    } catch (cleanupError) {
      // If file doesn't exist during cleanup, that's fine
@@ -15,64 +15,122 @@ interface WatcherInfo {
 */
 export class FileWatcher extends EventEmitter {
  private watchers: Map<string, WatcherInfo> = new Map();
+  // Maps taskId -> specDir for the in-flight watch() call.
+  // Allows re-watch calls with a different specDir to proceed while
+  // still preventing duplicate calls for the exact same specDir.
+  private pendingWatches: Map<string, string> = new Map();
+  // Tracks taskIds that had unwatch() called while watch() was in-flight.
+  // Checked after each await point in watch() to avoid creating a leaked watcher.
+  private cancelledWatches: Set<string> = new Set();

  /**
   * Start watching a task's implementation plan
   */
  async watch(taskId: string, specDir: string): Promise<void> {
-    // Stop any existing watcher for this task
-    await this.unwatch(taskId);
-
-    const planPath = path.join(specDir, 'implementation_plan.json');
-
-    // Check if plan file exists
-    if (!existsSync(planPath)) {
-      this.emit('error', taskId, `Plan file not found: ${planPath}`);
+    // Prevent overlapping watch() calls for the same taskId + specDir combination.
+    // Since watch() is async, rapid-fire callers could enter concurrently
+    // before the first call updates state, creating duplicate watchers.
+    // A call with a different specDir is a legitimate re-watch and is allowed through.
+    const pendingSpecDir = this.pendingWatches.get(taskId);
+    if (pendingSpecDir !== undefined && pendingSpecDir === specDir) {
      return;
    }
+    this.pendingWatches.set(taskId, specDir);

-    // Create watcher with settings to handle frequent writes
-    const watcher = chokidar.watch(planPath, {
-      persistent: true,
-      ignoreInitial: true,
-      awaitWriteFinish: {
-        stabilityThreshold: 300,
-        pollInterval: 100
+    try {
+      // Close any existing watcher for this task.
+      // Delete from the map BEFORE awaiting close so that a concurrent watch()
+      // call entering after the await cannot obtain the same FSWatcher reference
+      // and attempt a second close() on the same object.
+      const existing = this.watchers.get(taskId);
+      if (existing) {
+        this.watchers.delete(taskId);
+        await existing.watcher.close();
      }
-    });

-    // Store watcher info
-    this.watchers.set(taskId, {
-      taskId,
-      watcher,
-      planPath
-    });
+      // Check if a newer watch() call has superseded this one while we were awaiting.
+      // If the pending specDir changed, another concurrent watch() took over — bail out
+      // to avoid overwriting the watcher it is about to create.
+      if (this.pendingWatches.get(taskId) !== specDir) {
+        return;
+      }

-    // Handle file changes
-    watcher.on('change', () => {
+      // Check if unwatch() was called while we were awaiting above.
+      if (this.cancelledWatches.has(taskId)) {
+        this.cancelledWatches.delete(taskId);
+        return;
+      }
+
+      const planPath = path.join(specDir, 'implementation_plan.json');
+
+      // Check if plan file exists
+      if (!existsSync(planPath)) {
+        this.emit('error', taskId, `Plan file not found: ${planPath}`);
+        return;
+      }
+
+      // Create watcher with settings to handle frequent writes
+      const watcher = chokidar.watch(planPath, {
+        persistent: true,
+        ignoreInitial: true,
+        awaitWriteFinish: {
+          stabilityThreshold: 300,
+          pollInterval: 100
+        }
+      });
+
+      // Check again after the synchronous watcher creation (no await, but defensive).
+      if (this.cancelledWatches.has(taskId)) {
+        this.cancelledWatches.delete(taskId);
+        await watcher.close();
+        return;
+      }
+
+      // Store watcher info
+      this.watchers.set(taskId, {
+        taskId,
+        watcher,
+        planPath
+      });
+
+      // Handle file changes
+      watcher.on('change', () => {
+        try {
+          const content = readFileSync(planPath, 'utf-8');
+          const plan: ImplementationPlan = JSON.parse(content);
+          this.emit('progress', taskId, plan);
+        } catch {
+          // File might be in the middle of being written
+          // Ignore parse errors, next change event will have complete file
+        }
+      });
+
+      // Handle errors
+      watcher.on('error', (error: unknown) => {
+        const message = error instanceof Error ? error.message : String(error);
+        this.emit('error', taskId, message);
+      });
+
+      // Read and emit initial state
      try {
        const content = readFileSync(planPath, 'utf-8');
        const plan: ImplementationPlan = JSON.parse(content);
        this.emit('progress', taskId, plan);
      } catch {
-        // File might be in the middle of being written
-        // Ignore parse errors, next change event will have complete file
+        // Initial read failed - not critical
+      }
+    } finally {
+      // Only clean up if this call still owns the entry. If a superseding
+      // concurrent watch() call has already updated pendingWatches with a
+      // different specDir, leave that entry intact so the superseding call
+      // can proceed correctly.
+      if (this.pendingWatches.get(taskId) === specDir) {
+        this.pendingWatches.delete(taskId);
+        // The delete above guarantees has() is now false, so there is no
+        // longer any in-flight watch() for this taskId. Clear the
+        // cancellation flag so it doesn't linger for future watch() calls.
+        this.cancelledWatches.delete(taskId);
      }
-    });
-
-    // Handle errors
-    watcher.on('error', (error: unknown) => {
-      const message = error instanceof Error ? error.message : String(error);
-      this.emit('error', taskId, message);
-    });
-
-    // Read and emit initial state
-    try {
-      const content = readFileSync(planPath, 'utf-8');
-      const plan: ImplementationPlan = JSON.parse(content);
-      this.emit('progress', taskId, plan);
-    } catch {
-      // Initial read failed - not critical
    }
  }

@@ -80,6 +138,13 @@ export class FileWatcher extends EventEmitter {
   * Stop watching a task
   */
  async unwatch(taskId: string): Promise<void> {
+    // If watch() is currently in-flight for this taskId, it is already closing the
+    // existing watcher. Just set the cancellation flag and return to avoid a
+    // double-close of the same FSWatcher.
+    if (this.pendingWatches.has(taskId)) {
+      this.cancelledWatches.add(taskId);
+      return;
+    }
    const watcherInfo = this.watchers.get(taskId);
    if (watcherInfo) {
      await watcherInfo.watcher.close();
@@ -91,6 +156,17 @@ export class FileWatcher extends EventEmitter {
   * Stop all watchers
   */
  async unwatchAll(): Promise<void> {
+    // Cancel any in-flight watch() calls so they don't create new watchers
+    // after this cleanup completes.
+    for (const taskId of this.pendingWatches.keys()) {
+      this.cancelledWatches.add(taskId);
+    }
+    this.pendingWatches.clear();
+    // Clear cancellation flags now that pendingWatches is empty: the in-flight
+    // calls will bail via the supersession check (pendingWatches.get() returns
+    // undefined) and will not clean up cancelledWatches themselves. Clearing
+    // here ensures the instance is fully reset for subsequent use.
+    this.cancelledWatches.clear();
    const closePromises = Array.from(this.watchers.values()).map(
      async (info) => {
        await info.watcher.close();
@@ -107,6 +183,15 @@ export class FileWatcher extends EventEmitter {
    return this.watchers.has(taskId);
  }

+  /**
+   * Get the spec directory currently being watched for a task
+   */
+  getWatchedSpecDir(taskId: string): string | null {
+    const watcherInfo = this.watchers.get(taskId);
+    if (!watcherInfo) return null;
+    return path.dirname(watcherInfo.planPath);
+  }
+
  /**
   * Get current plan state for a task
   */
@@ -49,7 +49,7 @@ import { initializeAppUpdater, stopPeriodicUpdates } from './app-updater';
 import { DEFAULT_APP_SETTINGS, IPC_CHANNELS, SPELL_CHECK_LANGUAGE_MAP, DEFAULT_SPELL_CHECK_LANGUAGE, ADD_TO_DICTIONARY_LABELS } from '../shared/constants';
 import { getAppLanguage, initAppLanguage } from './app-language';
 import { readSettingsFile } from './settings-utils';
-import { setupErrorLogging } from './app-logger';
+import { appLog, setupErrorLogging } from './app-logger';
 import { initSentryMain } from './sentry';
 import { preWarmToolCache } from './cli-tool-manager';
 import { initializeClaudeProfileManager, getClaudeProfileManager } from './claude-profile-manager';
@@ -143,6 +143,11 @@ let mainWindow: BrowserWindow | null = null;
 let agentManager: AgentManager | null = null;
 let terminalManager: TerminalManager | null = null;

+// Capture child process exits (renderer/GPU/utility) for crash diagnostics.
+app.on('child-process-gone', (_event, details) => {
+  appLog.error('[main] child-process-gone:', details);
+});
+
 // Re-entrancy guard for before-quit handler.
 // The first before-quit call pauses quit for async cleanup, then calls app.quit() again.
 // The second call sees isQuitting=true and allows quit to proceed immediately.
@@ -214,6 +219,11 @@ function createWindow(): void {
    mainWindow?.show();
  });

+  // Capture renderer process crashes/termination reasons for diagnostics.
+  mainWindow.webContents.on('render-process-gone', (_event, details) => {
+    appLog.error('[main] render-process-gone:', details);
+  });
+
  // Configure initial spell check languages with proper fallback logic
  // Uses shared constant for consistency with the IPC handler
  const defaultLanguage = 'en';
@@ -330,6 +340,10 @@ function createWindow(): void {

  // Clean up on close
  mainWindow.on('closed', () => {
+    // Kill all agents when window closes (prevents orphaned processes)
+    agentManager?.killAll?.()?.catch((err: unknown) => {
+      console.warn('[main] Error killing agents on window close:', err);
+    });
    mainWindow = null;
  });
 }
@@ -3,8 +3,10 @@ import type {
  InsightsSession,
  InsightsSessionSummary,
  InsightsChatMessage,
-  InsightsModelConfig
+  InsightsModelConfig,
+  ImageAttachment
 } from '../shared/types';
+import { MAX_IMAGES_PER_TASK } from '../shared/constants';
 import { InsightsConfig } from './insights/config';
 import { InsightsPaths } from './insights/paths';
 import { SessionStorage } from './insights/session-storage';
@@ -70,8 +72,8 @@ export class InsightsService extends EventEmitter {
  /**
   * List all sessions for a project
   */
-  listSessions(projectPath: string): InsightsSessionSummary[] {
-    return this.sessionManager.listSessions(projectPath);
+  listSessions(projectPath: string, includeArchived = false): InsightsSessionSummary[] {
+    return this.sessionManager.listSessions(projectPath, includeArchived);
  }

  /**
@@ -95,6 +97,34 @@ export class InsightsService extends EventEmitter {
    return this.sessionManager.deleteSession(projectId, projectPath, sessionId);
  }

+  /**
+   * Archive a session
+   */
+  archiveSession(projectId: string, projectPath: string, sessionId: string): boolean {
+    return this.sessionManager.archiveSession(projectId, projectPath, sessionId);
+  }
+
+  /**
+   * Unarchive a session
+   */
+  unarchiveSession(projectPath: string, sessionId: string): boolean {
+    return this.sessionManager.unarchiveSession(projectPath, sessionId);
+  }
+
+  /**
+   * Delete multiple sessions
+   */
+  deleteSessions(projectId: string, projectPath: string, sessionIds: string[]): { deletedIds: string[]; failedIds: string[] } {
+    return this.sessionManager.deleteSessions(projectId, projectPath, sessionIds);
+  }
+
+  /**
+   * Archive multiple sessions
+   */
+  archiveSessions(projectId: string, projectPath: string, sessionIds: string[]): { archivedIds: string[]; failedIds: string[] } {
+    return this.sessionManager.archiveSessions(projectId, projectPath, sessionIds);
+  }
+
  /**
   * Rename a session
   */
@@ -116,7 +146,8 @@ export class InsightsService extends EventEmitter {
    projectId: string,
    projectPath: string,
    message: string,
-    modelConfig?: InsightsModelConfig
+    modelConfig?: InsightsModelConfig,
+    images?: ImageAttachment[]
  ): Promise<void> {
    // Cancel any existing session
    this.executor.cancelSession(projectId);
@@ -139,22 +170,44 @@ export class InsightsService extends EventEmitter {
      session.title = this.storage.generateTitle(message);
    }

-    // Add user message
+    // Guard: cap images to MAX_IMAGES_PER_TASK
+    if (images && images.length > MAX_IMAGES_PER_TASK) {
+      images = images.slice(0, MAX_IMAGES_PER_TASK);
+    }
+
+    // Add user message (store thumbnails only for persistence, strip full data)
+    const persistImages = images?.map(img => ({
+      ...img,
+      data: undefined
+    }));
    const userMessage: InsightsChatMessage = {
      id: `msg-${Date.now()}`,
      role: 'user',
      content: message,
-      timestamp: new Date()
+      timestamp: new Date(),
+      images: persistImages && persistImages.length > 0 ? persistImages : undefined
    };
    session.messages.push(userMessage);
    session.updatedAt = new Date();
    this.sessionManager.saveSession(projectPath, session);

    // Build conversation history for context
-    const conversationHistory = session.messages.map(m => ({
-      role: m.role,
-      content: m.content
-    }));
+    // Add notation when images are present so the AI has context
+    // For historical messages (all but the last), use past tense to avoid confusion
+    const conversationHistory = session.messages.map((m, index) => {
+      const imageCount = m.images?.length ?? 0;
+      const isLastMessage = index === session.messages.length - 1;
+      let imageNotation = '';
+      if (imageCount > 0 && m.role === 'user') {
+        imageNotation = isLastMessage
+          ? `\n[User attached ${imageCount} image(s)]`
+          : `\n[User previously attached ${imageCount} image(s) - not visible in this context]`;
+      }
+      return {
+        role: m.role,
+        content: imageNotation ? m.content + imageNotation : m.content
+      };
+    });

    // Use provided modelConfig or fall back to session's config
    const configToUse = modelConfig || session.modelConfig;
@@ -166,7 +219,8 @@ export class InsightsService extends EventEmitter {
        projectPath,
        message,
        conversationHistory,
-        configToUse
+        configToUse,
+        images
      );

      // Add assistant message to session
@@ -1,5 +1,7 @@
 import { spawn, ChildProcess } from 'child_process';
-import { existsSync, writeFileSync, unlinkSync } from 'fs';
+import { existsSync, unlinkSync } from 'fs';
+import { writeFile } from 'fs/promises';
+import { randomBytes } from 'crypto';
 import path from 'path';
 import os from 'os';
 import { EventEmitter } from 'events';
@@ -8,12 +10,23 @@ import type {
  InsightsChatStatus,
  InsightsStreamChunk,
  InsightsToolUsage,
-  InsightsModelConfig
+  InsightsModelConfig,
+  ImageAttachment
 } from '../../shared/types';
-import { MODEL_ID_MAP } from '../../shared/constants';
+import { MODEL_ID_MAP, MAX_IMAGES_PER_TASK, MAX_IMAGE_SIZE } from '../../shared/constants';
 import { InsightsConfig } from './config';
 import { detectRateLimit, createSDKRateLimitInfo } from '../rate-limit-detector';

+// Safe extension map for image MIME types — prevents path traversal via crafted mimeType
+// SVG excluded: contains active script content and is unsupported by Claude Vision API
+const SAFE_EXT_MAP: Record<string, string> = {
+  'image/png': 'png',
+  'image/jpeg': 'jpg',
+  'image/jpg': 'jpg',
+  'image/gif': 'gif',
+  'image/webp': 'webp'
+};
+
 /**
 * Message processor result
 */
@@ -63,7 +76,8 @@ export class InsightsExecutor extends EventEmitter {
    projectPath: string,
    message: string,
    conversationHistory: Array<{ role: string; content: string }>,
-    modelConfig?: InsightsModelConfig
+    modelConfig?: InsightsModelConfig,
+    images?: ImageAttachment[]
  ): Promise<ProcessorResult> {
    // Cancel any existing session
    this.cancelSession(projectId);
@@ -90,18 +104,80 @@ export class InsightsExecutor extends EventEmitter {
    // Write conversation history to temp file to avoid Windows command-line length limit
    const historyFile = path.join(
      os.tmpdir(),
-      `insights-history-${projectId}-${Date.now()}.json`
+      `insights-history-${projectId}-${Date.now()}-${randomBytes(8).toString('hex')}.json`
    );

    let historyFileCreated = false;
    try {
-      writeFileSync(historyFile, JSON.stringify(conversationHistory), 'utf-8');
+      await writeFile(historyFile, JSON.stringify(conversationHistory), { encoding: 'utf-8', mode: 0o600 });
      historyFileCreated = true;
    } catch (err) {
      console.error('[Insights] Failed to write history file:', err);
      throw new Error('Failed to write conversation history to temp file');
    }

+    // Write image files and manifest if images are provided
+    const imagesTempFiles: string[] = [];
+    let imagesManifestFile: string | undefined;
+
+    // Defense-in-depth: cap image count and filter oversized images in the executor
+    if (images && images.length > MAX_IMAGES_PER_TASK) {
+      images = images.slice(0, MAX_IMAGES_PER_TASK);
+    }
+    if (images) {
+      images = images.filter(img => !img.data || Buffer.byteLength(img.data, 'base64') <= MAX_IMAGE_SIZE);
+    }
+
+    if (images && images.length > 0) {
+      try {
+        const manifest: Array<{ path: string; mimeType: string }> = [];
+        const timestamp = Date.now();
+
+        for (let i = 0; i < images.length; i++) {
+          const image = images[i];
+          if (!image.data) continue;
+
+          // Validate mimeType against allowlist (defense-in-depth for main process)
+          const ext = SAFE_EXT_MAP[image.mimeType];
+          if (!ext) {
+            console.warn(`[Insights] Skipping image with invalid mimeType: ${image.mimeType}`);
+            continue;
+          }
+
+          const imagePath = path.join(
+            os.tmpdir(),
+            `insights-image-${projectId}-${timestamp}-${i}-${randomBytes(8).toString('hex')}.${ext}`
+          );
+          await writeFile(imagePath, Buffer.from(image.data, 'base64'), { mode: 0o600 });
+          imagesTempFiles.push(imagePath);
+          manifest.push({ path: imagePath, mimeType: image.mimeType });
+        }
+
+        // Only write manifest file if we actually wrote any images
+        if (manifest.length > 0) {
+          imagesManifestFile = path.join(
+            os.tmpdir(),
+            `insights-images-manifest-${projectId}-${timestamp}-${randomBytes(8).toString('hex')}.json`
+          );
+          imagesTempFiles.push(imagesManifestFile); // Push before writeFile for cleanup on failure
+          await writeFile(imagesManifestFile, JSON.stringify(manifest), { encoding: 'utf-8', mode: 0o600 });
+        }
+      } catch (err) {
+        // Clean up any already-written image files
+        for (const tmpFile of imagesTempFiles) {
+          try {
+            if (existsSync(tmpFile)) unlinkSync(tmpFile);
+          } catch { /* ignore cleanup errors */ }
+        }
+        // Also clean up the history file (cleanupTempFiles isn't defined yet at this point)
+        if (existsSync(historyFile)) {
+          try { unlinkSync(historyFile); } catch { /* ignore */ }
+        }
+        console.error('[Insights] Failed to write image files:', err);
+        throw new Error('Failed to write image files to temp directory');
+      }
+    }
+
    // Build command arguments
    const args = [
      runnerPath,
@@ -110,6 +186,11 @@ export class InsightsExecutor extends EventEmitter {
      '--history-file', historyFile
    ];

+    // Add images manifest file if images were provided
+    if (imagesManifestFile) {
+      args.push('--images-file', imagesManifestFile);
+    }
+
    // Add model config if provided
    if (modelConfig) {
      const modelId = MODEL_ID_MAP[modelConfig.model] || MODEL_ID_MAP['sonnet'];
@@ -125,6 +206,27 @@ export class InsightsExecutor extends EventEmitter {

    this.activeSessions.set(projectId, proc);

+    // Shared cleanup for temp files used across close/error handlers
+    let cleanedUp = false;
+    const cleanupTempFiles = () => {
+      if (cleanedUp) return;
+      cleanedUp = true;
+      if (historyFileCreated && existsSync(historyFile)) {
+        try {
+          unlinkSync(historyFile);
+        } catch (cleanupErr) {
+          console.error('[Insights] Failed to cleanup history file:', cleanupErr);
+        }
+      }
+      for (const tmpFile of imagesTempFiles) {
+        try {
+          if (existsSync(tmpFile)) unlinkSync(tmpFile);
+        } catch (cleanupErr) {
+          console.error('[Insights] Failed to cleanup image temp file:', cleanupErr);
+        }
+      }
+    };
+
    return new Promise((resolve, reject) => {
      let fullResponse = '';
      const suggestedTasks: InsightsChatMessage['suggestedTasks'] = [];
@@ -170,15 +272,7 @@ export class InsightsExecutor extends EventEmitter {

      proc.on('close', (code) => {
        this.activeSessions.delete(projectId);
-
-        // Cleanup temp file
-        if (historyFileCreated && existsSync(historyFile)) {
-          try {
-            unlinkSync(historyFile);
-          } catch (cleanupErr) {
-            console.error('[Insights] Failed to cleanup history file:', cleanupErr);
-          }
-        }
+        cleanupTempFiles();

        // Check for rate limit if process failed
        if (code !== 0) {
@@ -217,15 +311,7 @@ export class InsightsExecutor extends EventEmitter {

      proc.on('error', (err) => {
        this.activeSessions.delete(projectId);
-
-        // Cleanup temp file
-        if (historyFileCreated && existsSync(historyFile)) {
-          try {
-            unlinkSync(historyFile);
-          } catch (cleanupErr) {
-            console.error('[Insights] Failed to cleanup history file:', cleanupErr);
-          }
-        }
+        cleanupTempFiles();

        this.emit('error', projectId, err.message);
        reject(err);
@@ -23,10 +23,21 @@ export class InsightsPaths {
    return path.join(this.getInsightsDir(projectPath), SESSIONS_DIR);
  }

+  /**
+   * Validate that a session ID matches the expected safe pattern.
+   * Prevents path traversal attacks via crafted session IDs.
+   */
+  private validateSessionId(sessionId: string): void {
+    if (!/^session-\d{1,20}$/.test(sessionId)) {
+      throw new Error('Invalid session ID format');
+    }
+  }
+
  /**
   * Get session file path for a specific session
   */
  getSessionPath(projectPath: string, sessionId: string): string {
+    this.validateSessionId(sessionId);
    return path.join(this.getSessionsDir(projectPath), `${sessionId}.json`);
  }

@@ -20,8 +20,9 @@ export class SessionManager {
   */
  loadSession(projectId: string, projectPath: string): InsightsSession | null {
    // Check in-memory cache first
-    if (this.sessions.has(projectId)) {
-      return this.sessions.get(projectId)!;
+    const cachedSession = this.sessions.get(projectId);
+    if (cachedSession) {
+      return cachedSession;
    }

    // Migrate old format if needed
@@ -40,10 +41,10 @@ export class SessionManager {
  /**
   * List all sessions for a project
   */
-  listSessions(projectPath: string): InsightsSessionSummary[] {
+  listSessions(projectPath: string, includeArchived = false): InsightsSessionSummary[] {
    // Migrate old format if needed
    this.storage.migrateOldSession(projectPath);
-    return this.storage.listSessions(projectPath);
+    return this.storage.listSessions(projectPath, includeArchived);
  }

  /**
@@ -105,6 +106,80 @@ export class SessionManager {
    return true;
  }

+  /**
+   * Archive a session
+   */
+  archiveSession(projectId: string, projectPath: string, sessionId: string): boolean {
+    const success = this.storage.archiveSession(projectPath, sessionId);
+    if (!success) return false;
+
+    // If this was the current session, auto-switch
+    const currentSession = this.sessions.get(projectId);
+    if (currentSession?.id === sessionId) {
+      this.sessions.delete(projectId);
+
+      const remaining = this.listSessions(projectPath);
+      if (remaining.length > 0) {
+        this.switchSession(projectId, projectPath, remaining[0].id);
+      } else {
+        this.storage.clearCurrentSessionId(projectPath);
+      }
+    }
+
+    return true;
+  }
+
+  /**
+   * Unarchive a session
+   */
+  unarchiveSession(projectPath: string, sessionId: string): boolean {
+    return this.storage.unarchiveSession(projectPath, sessionId);
+  }
+
+  /**
+   * Delete multiple sessions
+   */
+  deleteSessions(projectId: string, projectPath: string, sessionIds: string[]): { deletedIds: string[]; failedIds: string[] } {
+    const result = this.storage.deleteSessions(projectPath, sessionIds);
+
+    // Check if current cached session was among deleted
+    const currentSession = this.sessions.get(projectId);
+    if (currentSession && result.deletedIds.includes(currentSession.id)) {
+      this.sessions.delete(projectId);
+
+      const remaining = this.listSessions(projectPath);
+      if (remaining.length > 0) {
+        this.switchSession(projectId, projectPath, remaining[0].id);
+      } else {
+        this.storage.clearCurrentSessionId(projectPath);
+      }
+    }
+
+    return result;
+  }
+
+  /**
+   * Archive multiple sessions
+   */
+  archiveSessions(projectId: string, projectPath: string, sessionIds: string[]): { archivedIds: string[]; failedIds: string[] } {
+    const result = this.storage.archiveSessions(projectPath, sessionIds);
+
+    // Check if current cached session was among archived
+    const currentSession = this.sessions.get(projectId);
+    if (currentSession && result.archivedIds.includes(currentSession.id)) {
+      this.sessions.delete(projectId);
+
+      const remaining = this.listSessions(projectPath);
+      if (remaining.length > 0) {
+        this.switchSession(projectId, projectPath, remaining[0].id);
+      } else {
+        this.storage.clearCurrentSessionId(projectPath);
+      }
+    }
+
+    return result;
+  }
+
  /**
   * Rename a session
   */
@@ -115,6 +190,17 @@ export class SessionManager {
    session.title = newTitle;
    session.updatedAt = new Date();
    this.storage.saveSession(projectPath, session);
+
+    // Update cache if this session is cached
+    for (const [projectId, cachedSession] of this.sessions) {
+      if (cachedSession.id === sessionId) {
+        cachedSession.title = newTitle;
+        cachedSession.updatedAt = session.updatedAt;
+        this.sessions.set(projectId, cachedSession);
+        break;
+      }
+    }
+
    return true;
  }

@@ -133,7 +219,7 @@ export class SessionManager {
    for (const [projectId, cachedSession] of this.sessions) {
      if (cachedSession.id === sessionId) {
        cachedSession.modelConfig = modelConfig;
-        cachedSession.updatedAt = new Date();
+        cachedSession.updatedAt = session.updatedAt;
        this.sessions.set(projectId, cachedSession);
        break;
      }
@@ -1,6 +1,6 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, unlinkSync } from 'fs';
 import path from 'path';
-import type { InsightsSession, InsightsSessionSummary } from '../../shared/types';
+import type { InsightsSession, InsightsSessionSummary, ImageAttachment } from '../../shared/types';
 import { InsightsPaths } from './paths';

 /**
@@ -27,15 +27,18 @@ export class SessionStorage {
   * Load a specific session from disk
   */
  loadSessionById(projectPath: string, sessionId: string): InsightsSession | null {
-    const sessionPath = this.paths.getSessionPath(projectPath, sessionId);
-    if (!existsSync(sessionPath)) return null;
-
    try {
+      const sessionPath = this.paths.getSessionPath(projectPath, sessionId);
+      if (!existsSync(sessionPath)) return null;
+
      const content = readFileSync(sessionPath, 'utf-8');
      const session = JSON.parse(content) as InsightsSession;
      // Convert date strings back to Date objects
      session.createdAt = new Date(session.createdAt);
      session.updatedAt = new Date(session.updatedAt);
+      if (session.archivedAt) {
+        session.archivedAt = new Date(session.archivedAt);
+      }
      session.messages = session.messages.map(m => ({
        ...m,
        timestamp: new Date(m.timestamp),
@@ -55,23 +58,98 @@ export class SessionStorage {
   * Save session to disk
   */
  saveSession(projectPath: string, session: InsightsSession): void {
-    const sessionsDir = this.paths.getSessionsDir(projectPath);
-    if (!existsSync(sessionsDir)) {
-      mkdirSync(sessionsDir, { recursive: true });
+    try {
+      const sessionsDir = this.paths.getSessionsDir(projectPath);
+      if (!existsSync(sessionsDir)) {
+        mkdirSync(sessionsDir, { recursive: true });
+      }
+
+      const sessionPath = this.paths.getSessionPath(projectPath, session.id);
+      writeFileSync(sessionPath, JSON.stringify(session, null, 2), 'utf-8');
+    } catch (error) {
+      console.error(`[SessionStorage] Failed to save session ${session.id}:`, error);
+      throw error;
+    }
+  }
+
+  /**
+   * Archive a session
+   */
+  archiveSession(projectPath: string, sessionId: string): boolean {
+    const session = this.loadSessionById(projectPath, sessionId);
+    if (!session) return false;
+
+    try {
+      session.archivedAt = new Date();
+      this.saveSession(projectPath, session);
+      return true;
+    } catch (error) {
+      console.error(`[SessionStorage] Failed to archive session ${sessionId}:`, error);
+      return false;
+    }
+  }
+
+  /**
+   * Unarchive a session
+   */
+  unarchiveSession(projectPath: string, sessionId: string): boolean {
+    const session = this.loadSessionById(projectPath, sessionId);
+    if (!session) return false;
+
+    try {
+      delete session.archivedAt;
+      this.saveSession(projectPath, session);
+      return true;
+    } catch (error) {
+      console.error(`[SessionStorage] Failed to unarchive session ${sessionId}:`, error);
+      return false;
+    }
+  }
+
+  /**
+   * Delete multiple sessions
+   */
+  deleteSessions(projectPath: string, sessionIds: string[]): { deletedIds: string[]; failedIds: string[] } {
+    const deletedIds: string[] = [];
+    const failedIds: string[] = [];
+
+    for (const sessionId of sessionIds) {
+      if (this.deleteSession(projectPath, sessionId)) {
+        deletedIds.push(sessionId);
+      } else {
+        failedIds.push(sessionId);
+      }
    }

-    const sessionPath = this.paths.getSessionPath(projectPath, session.id);
-    writeFileSync(sessionPath, JSON.stringify(session, null, 2), 'utf-8');
+    return { deletedIds, failedIds };
+  }
+
+  /**
+   * Archive multiple sessions
+   */
+  archiveSessions(projectPath: string, sessionIds: string[]): { archivedIds: string[]; failedIds: string[] } {
+    const archivedIds: string[] = [];
+    const failedIds: string[] = [];
+
+    for (const sessionId of sessionIds) {
+      if (this.archiveSession(projectPath, sessionId)) {
+        archivedIds.push(sessionId);
+      } else {
+        failedIds.push(sessionId);
+      }
+    }
+
+    return { archivedIds, failedIds };
  }

  /**
   * Delete a session from disk
   */
  deleteSession(projectPath: string, sessionId: string): boolean {
-    const sessionPath = this.paths.getSessionPath(projectPath, sessionId);
-    if (!existsSync(sessionPath)) return false;
-
    try {
+      const sessionPath = this.paths.getSessionPath(projectPath, sessionId);
+      if (!existsSync(sessionPath)) return false;
+
      unlinkSync(sessionPath);
      return true;
    } catch {
@@ -82,7 +160,7 @@ export class SessionStorage {
  /**
   * List all sessions for a project
   */
-  listSessions(projectPath: string): InsightsSessionSummary[] {
+  listSessions(projectPath: string, includeArchived = false): InsightsSessionSummary[] {
    const sessionsDir = this.paths.getSessionsDir(projectPath);
    if (!existsSync(sessionsDir)) return [];

@@ -104,13 +182,20 @@ export class SessionStorage {
              : 'Untitled Conversation';
          }

+          // Skip archived sessions unless explicitly included
+          if (!includeArchived && session.archivedAt) {
+            continue;
+          }
+
          sessions.push({
            id: session.id,
            projectId: session.projectId,
            title: title || 'New Conversation',
            messageCount: session.messages.length,
+            modelConfig: session.modelConfig,
            createdAt: new Date(session.createdAt),
-            updatedAt: new Date(session.updatedAt)
+            updatedAt: new Date(session.updatedAt),
+            ...(session.archivedAt ? { archivedAt: new Date(session.archivedAt) } : {})
          });
        } catch {
          // Skip invalid session files
@@ -165,6 +250,23 @@ export class SessionStorage {
    }
  }

+  /**
+   * Strip full-resolution image data from a session for persistence.
+   * Keeps only thumbnail, id, filename, mimeType, and size to prevent bloated JSON files.
+   */
+  private stripImageDataForPersistence(session: InsightsSession): InsightsSession {
+    return {
+      ...session,
+      messages: session.messages.map(m => {
+        if (!m.images || m.images.length === 0) return m;
+        return {
+          ...m,
+          images: m.images.map(({ data, path: _path, ...rest }: ImageAttachment) => rest)
+        };
+      })
+    };
+  }
+
  /**
   * Migrate old session format to new multi-session format
   */
@@ -7,19 +7,25 @@ import type {
  AuthFailureInfo,
  ImplementationPlan,
 } from "../../shared/types";
-import { XSTATE_SETTLED_STATES, XSTATE_TO_PHASE, mapStateToLegacy } from "../../shared/state-machines";
+import { XSTATE_SETTLED_STATES, XSTATE_ACTIVE_STATES, XSTATE_TO_PHASE, mapStateToLegacy } from "../../shared/state-machines";
 import { AgentManager } from "../agent";
 import type { ProcessType, ExecutionProgressData } from "../agent";
 import { titleGenerator } from "../title-generator";
 import { fileWatcher } from "../file-watcher";
 import { notificationService } from "../notification-service";
-import { persistPlanLastEventSync, getPlanPath, persistPlanPhaseSync, persistPlanStatusAndReasonSync } from "./task/plan-file-utils";
+import { persistPlanLastEventSync, getPlanPath, persistPlanPhaseSync, persistPlanStatusAndReasonSync, hasPlanWithSubtasks } from "./task/plan-file-utils";
 import { findTaskWorktree } from "../worktree-paths";
 import { findTaskAndProject } from "./task/shared";
 import { safeSendToRenderer } from "./utils";
 import { getClaudeProfileManager } from "../claude-profile-manager";
 import { taskStateManager } from "../task-state-manager";

+// Timeout for fallback safety net to check if task is still stuck after process exit
+const STUCK_TASK_FALLBACK_TIMEOUT_MS = 500;
+
+// Map to store active fallback timers so they can be cancelled on task restart
+const fallbackTimers = new Map<string, NodeJS.Timeout>();
+
 /**
 * Register all agent-events-related IPC handlers
 */
@@ -96,9 +102,53 @@ export function registerAgenteventsHandlers(

    taskStateManager.handleProcessExited(taskId, code, exitTask, exitProject);

+    // Fallback safety net: If XState failed to transition the task out of an active state,
+    // force it to human_review after a short delay. This prevents tasks from getting stuck
+    // when the process exits without XState properly handling it.
+    // We check XState's current state directly to avoid stale cache issues from projectStore.
+    // Store timer reference so it can be cancelled if task restarts within the window.
+    const timer = setTimeout(() => {
+      const currentState = taskStateManager.getCurrentState(taskId);
+
+      if (currentState && XSTATE_ACTIVE_STATES.has(currentState)) {
+        const { task: checkTask, project: checkProject } = findTaskAndProject(taskId, projectId);
+        if (checkTask && checkProject) {
+          // Use shared utility to determine if a valid implementation plan exists
+          const hasPlan = hasPlanWithSubtasks(checkProject, checkTask);
+
+          console.warn(
+            `[agent-events-handlers] Task ${taskId} still in XState ${currentState} ` +
+            `${STUCK_TASK_FALLBACK_TIMEOUT_MS}ms after exit, forcing USER_STOPPED (hasPlan: ${hasPlan})`
+          );
+          taskStateManager.handleUiEvent(taskId, { type: 'USER_STOPPED', hasPlan }, checkTask, checkProject);
+        }
+      }
+      // Clean up timer reference after it fires
+      fallbackTimers.delete(taskId);
+    }, STUCK_TASK_FALLBACK_TIMEOUT_MS);
+
+    // Store timer reference for potential cancellation
+    fallbackTimers.set(taskId, timer);
+
    // Send final plan state to renderer BEFORE unwatching
    // This ensures the renderer has the final subtask data (fixes 0/0 subtask bug)
-    const finalPlan = fileWatcher.getCurrentPlan(taskId);
+    // Try the file watcher's current path first, then fall back to worktree path
+    let finalPlan = fileWatcher.getCurrentPlan(taskId);
+    if (!finalPlan && exitTask && exitProject) {
+      // File watcher may have been watching the wrong path (main vs worktree)
+      // Try reading directly from the worktree
+      const worktreePath = findTaskWorktree(exitProject.path, exitTask.specId);
+      if (worktreePath) {
+        const specsBaseDir = getSpecsDir(exitProject.autoBuildPath);
+        const worktreePlanPath = path.join(worktreePath, specsBaseDir, exitTask.specId, AUTO_BUILD_PATHS.IMPLEMENTATION_PLAN);
+        try {
+          const content = readFileSync(worktreePlanPath, 'utf-8');
+          finalPlan = JSON.parse(content);
+        } catch {
+          // Worktree plan file not readable - not critical
+        }
+      }
+    }
    if (finalPlan) {
      safeSendToRenderer(
        getMainWindow,
@@ -109,7 +159,9 @@ export function registerAgenteventsHandlers(
      );
    }

-    fileWatcher.unwatch(taskId);
+    fileWatcher.unwatch(taskId).catch((err) => {
+      console.error(`[agent-events-handlers] Failed to unwatch for ${taskId}:`, err);
+    });

    if (processType === "spec-creation") {
      console.warn(`[Task ${taskId}] Spec creation completed with code ${code}`);
@@ -211,25 +263,46 @@ export function registerAgenteventsHandlers(
      const worktreePath = findTaskWorktree(project.path, task.specId);
      if (worktreePath) {
        const specsBaseDir = getSpecsDir(project.autoBuildPath);
+        const worktreeSpecDir = path.join(worktreePath, specsBaseDir, task.specId);
        const worktreePlanPath = path.join(
-          worktreePath,
-          specsBaseDir,
-          task.specId,
+          worktreeSpecDir,
          AUTO_BUILD_PATHS.IMPLEMENTATION_PLAN
        );
        if (existsSync(worktreePlanPath)) {
          persistPlanPhaseSync(worktreePlanPath, progress.phase, project.id);
        }
+
+        // Re-watch the worktree path if the file watcher is still watching the main project path.
+        // This handles the case where the task started before the worktree existed:
+        // the initial watch fell back to the main project spec dir, but now the worktree
+        // is available and implementation_plan.json is being written there.
+        const currentWatchDir = fileWatcher.getWatchedSpecDir(taskId);
+        if (currentWatchDir && currentWatchDir !== worktreeSpecDir && existsSync(worktreePlanPath)) {
+          console.warn(`[agent-events-handlers] Re-watching worktree path for ${taskId}: ${worktreeSpecDir}`);
+          fileWatcher.watch(taskId, worktreeSpecDir).catch((err) => {
+            console.error(`[agent-events-handlers] Failed to re-watch worktree for ${taskId}:`, err);
+          });
+        }
      }
    } else if (xstateInTerminalState && progress.phase) {
      console.debug(`[agent-events-handlers] Skipping persistPlanPhaseSync for ${taskId}: XState in '${currentXState}', not overwriting with phase '${progress.phase}'`);
    }

-    // Skip sending execution-progress to renderer when XState has settled.
-    // XState's emitPhaseFromState already sent the correct phase to the renderer.
+    // Skip sending execution-progress to renderer when XState has settled,
+    // UNLESS this is a final phase update (complete/failed) AND the task is still in_progress.
+    // This prevents UI flicker where a failed phase arrives after the status has already changed to human_review.
+    const isFinalPhaseUpdate = progress.phase === 'complete' || progress.phase === 'failed';
    if (xstateInTerminalState) {
-      console.debug(`[agent-events-handlers] Skipping execution-progress to renderer for ${taskId}: XState in '${currentXState}', ignoring phase '${progress.phase}'`);
-      return;
+      if (!isFinalPhaseUpdate) {
+        console.debug(`[agent-events-handlers] Skipping execution-progress to renderer for ${taskId}: XState in '${currentXState}', ignoring phase '${progress.phase}'`);
+        return;
+      }
+      // For final phase updates, only send if task is still in_progress to prevent flicker
+      const { task } = findTaskAndProject(taskId, taskProjectId);
+      if (task && task.status !== 'in_progress') {
+        console.debug(`[agent-events-handlers] Skipping final phase '${progress.phase}' for ${taskId}: task status is '${task.status}', not 'in_progress'`);
+        return;
+      }
    }
    safeSendToRenderer(
      getMainWindow,
@@ -285,3 +358,17 @@ export function registerAgenteventsHandlers(
    safeSendToRenderer(getMainWindow, IPC_CHANNELS.TASK_ERROR, taskId, error, project?.id);
  });
 }
+
+/**
+ * Cancel any pending fallback timer for a task.
+ * Should be called when a task is restarted to prevent the stale timer
+ * from incorrectly stopping the new process.
+ */
+export function cancelFallbackTimer(taskId: string): void {
+  const timer = fallbackTimers.get(taskId);
+  if (timer) {
+    clearTimeout(timer);
+    fallbackTimers.delete(taskId);
+    console.debug(`[agent-events-handlers] Cancelled fallback timer for task ${taskId}`);
+  }
+}
@@ -51,6 +51,10 @@ function sendAuthChangedToRenderer(oldUsername: string | null, newUsername: stri
  for (const win of windows) {
    win.webContents.send(IPC_CHANNELS.GITHUB_AUTH_CHANGED, payload);
  }
+  // Uses EventEmitter.emit (not IPC send) so main-process listeners can react.
+  // The listener (PRReviewStateManager) intentionally ignores all args — it only
+  // needs the event signal, not the payload.
+  ipcMain.emit(IPC_CHANNELS.GITHUB_AUTH_CHANGED, payload);
 }

 /**
@@ -26,7 +26,7 @@ import { getMemoryService, getDefaultDbPath } from "../../memory-service";
 import type { Project, AppSettings } from "../../../shared/types";
 import { createContextLogger } from "./utils/logger";
 import { withProjectOrNull } from "./utils/project-middleware";
-import { createIPCCommunicators } from "./utils/ipc-communicator";
+import { PRReviewStateManager } from "../../pr-review-state-manager";
 import { getRunnerEnv } from "./utils/runner-env";
 import {
  runPythonSubprocess,
@@ -36,6 +36,8 @@ import {
  buildRunnerArgs,
 } from "./utils/subprocess-runner";
 import { getPRStatusPoller } from "../../services/pr-status-poller";
+import { safeBreadcrumb, safeCaptureException } from "../../sentry";
+import { sanitizeForSentry } from "../../../shared/utils/sentry-privacy";
 import type {
  StartPollingRequest,
  StopPollingRequest,
@@ -110,6 +112,7 @@ async function githubGraphQL<T>(
  query: string,
  variables: Record<string, unknown> = {}
 ): Promise<T> {
+  // lgtm[js/file-access-to-http] - Official GitHub GraphQL API endpoint
  const response = await fetch("https://api.github.com/graphql", {
    method: "POST",
    headers: {
@@ -265,6 +268,10 @@ export interface PRReviewFinding {
  endLine?: number;
  suggestedFix?: string;
  fixable: boolean;
+  validationStatus?: "confirmed_valid" | "dismissed_false_positive" | "needs_human_review" | null;
+  validationExplanation?: string;
+  sourceAgents?: string[];
+  crossValidated?: boolean;
 }

 /**
@@ -276,7 +283,7 @@ export interface PRReviewResult {
  success: boolean;
  findings: PRReviewFinding[];
  summary: string;
-  overallStatus: "approve" | "request_changes" | "comment";
+  overallStatus: "approve" | "request_changes" | "comment" | "in_progress";
  reviewId?: number;
  reviewedAt: string;
  error?: string;
@@ -292,6 +299,8 @@ export interface PRReviewResult {
  hasPostedFindings?: boolean;
  postedFindingIds?: string[];
  postedAt?: string;
+  // In-progress review tracking
+  inProgressSince?: string;
 }

 /**
@@ -1336,6 +1345,10 @@ function getReviewResult(project: Project, prNumber: number): PRReviewResult | n
          endLine: f.end_line,
          suggestedFix: f.suggested_fix,
          fixable: f.fixable ?? false,
+          validationStatus: f.validation_status ?? null,
+          validationExplanation: f.validation_explanation ?? undefined,
+          sourceAgents: f.source_agents ?? [],
+          crossValidated: f.cross_validated ?? false,
        })) ?? [],
      summary: data.summary ?? "",
      overallStatus: data.overall_status ?? "comment",
@@ -1354,6 +1367,8 @@ function getReviewResult(project: Project, prNumber: number): PRReviewResult | n
      hasPostedFindings: data.has_posted_findings ?? false,
      postedFindingIds: data.posted_finding_ids ?? [],
      postedAt: data.posted_at,
+      // In-progress review tracking
+      inProgressSince: data.in_progress_since,
    };
  } catch {
    // File doesn't exist or couldn't be read
@@ -1369,7 +1384,7 @@ function sendReviewStateUpdate(
  project: Project,
  prNumber: number,
  projectId: string,
-  getMainWindow: () => BrowserWindow | null,
+  prReviewStateManager: PRReviewStateManager,
  context: string
 ): void {
  try {
@@ -1378,18 +1393,8 @@ function sendReviewStateUpdate(
      debugLog("Could not retrieve updated review result for UI notification", { prNumber, context });
      return;
    }
-    const mainWindow = getMainWindow();
-    if (!mainWindow) return;
-    const { sendComplete } = createIPCCommunicators<PRReviewProgress, PRReviewResult>(
-      mainWindow,
-      {
-        progress: IPC_CHANNELS.GITHUB_PR_REVIEW_PROGRESS,
-        error: IPC_CHANNELS.GITHUB_PR_REVIEW_ERROR,
-        complete: IPC_CHANNELS.GITHUB_PR_REVIEW_COMPLETE,
-      },
-      projectId
-    );
-    sendComplete(updatedResult);
+    // Route through state manager so the XState actor emits the state change
+    prReviewStateManager.handleComplete(projectId, prNumber, updatedResult);
    debugLog(`Sent PR review state update ${context}`, { prNumber });
  } catch (uiError) {
    debugLog("Failed to send UI update (non-critical)", {
@@ -1430,7 +1435,8 @@ function getGitHubPRSettings(): { model: string; thinkingLevel: string } {
 async function runPRReview(
  project: Project,
  prNumber: number,
-  mainWindow: BrowserWindow
+  mainWindow: BrowserWindow,
+  prReviewStateManager: PRReviewStateManager
 ): Promise<PRReviewResult> {
  // Comprehensive validation of GitHub module
  const validation = await validateGitHubModule(project);
@@ -1441,15 +1447,9 @@ async function runPRReview(

  const backendPath = validation.backendPath!;

-  const { sendProgress } = createIPCCommunicators<PRReviewProgress, PRReviewResult>(
-    mainWindow,
-    {
-      progress: IPC_CHANNELS.GITHUB_PR_REVIEW_PROGRESS,
-      error: IPC_CHANNELS.GITHUB_PR_REVIEW_ERROR,
-      complete: IPC_CHANNELS.GITHUB_PR_REVIEW_COMPLETE,
-    },
-    project.id
-  );
+  const sendProgress = (progress: PRReviewProgress): void => {
+    prReviewStateManager.handleProgress(project.id, prNumber, progress);
+  };

  const { model, thinkingLevel } = getGitHubPRSettings();
  const args = buildRunnerArgs(
@@ -1462,6 +1462,20 @@ async function runPRReview(

  debugLog("Spawning PR review process", { args, model, thinkingLevel });

+  safeBreadcrumb({
+    category: 'pr-review',
+    message: 'Spawning PR review subprocess',
+    level: 'info',
+    data: {
+      pythonPath: getPythonPath(backendPath),
+      runnerPath: getRunnerPath(backendPath),
+      cwd: backendPath,
+      model,
+      thinkingLevel,
+      prNumber,
+    },
+  });
+
  // Create log collector for this review
  const config = getGitHubConfig(project);
  const repo = config?.repo || project.name || "unknown";
@@ -1470,6 +1484,19 @@ async function runPRReview(
  // Build environment with project settings
  const subprocessEnv = await getRunnerEnv(getClaudeMdEnv(project));

+  safeBreadcrumb({
+    category: 'github.pr-review',
+    message: `Subprocess env for PR #${prNumber} review`,
+    level: 'info',
+    data: {
+      prNumber,
+      hasGITHUB_CLI_PATH: !!subprocessEnv.GITHUB_CLI_PATH,
+      GITHUB_CLI_PATH: subprocessEnv.GITHUB_CLI_PATH ?? 'NOT SET',
+      hasGITHUB_TOKEN: !!subprocessEnv.GITHUB_TOKEN,
+      hasPYTHONPATH: !!subprocessEnv.PYTHONPATH,
+    },
+  });
+
  // Create operation ID for this review
  const reviewKey = getReviewKey(project.id, prNumber);

@@ -1498,7 +1525,32 @@ async function runPRReview(
      debugLog("Auth failure detected in PR review", authFailureInfo);
      mainWindow.webContents.send(IPC_CHANNELS.CLAUDE_AUTH_FAILURE, authFailureInfo);
    },
-    onComplete: () => {
+    onComplete: (stdout: string) => {
+      // Check stdout for in_progress JSON marker (not saved to disk by backend)
+      const inProgressMarker = "__RESULT_JSON__:";
+      for (const line of stdout.split("\n")) {
+        if (line.startsWith(inProgressMarker)) {
+          try {
+            const data = JSON.parse(line.slice(inProgressMarker.length));
+            if (data.overall_status === "in_progress") {
+              debugLog("In-progress result parsed from stdout", { prNumber });
+              return {
+                prNumber: data.pr_number,
+                repo: data.repo,
+                success: data.success,
+                findings: [],
+                summary: data.summary ?? "",
+                overallStatus: "in_progress" as const,
+                reviewedAt: data.reviewed_at ?? new Date().toISOString(),
+                inProgressSince: data.in_progress_since,
+              };
+            }
+          } catch {
+            debugLog("Failed to parse __RESULT_JSON__ line", { line });
+          }
+        }
+      }
+
      // Load the result from disk
      const reviewResult = getReviewResult(project, prNumber);
      if (!reviewResult) {
@@ -1525,9 +1577,22 @@ async function runPRReview(
    // Wait for the process to complete
    const result = await promise;

+    safeBreadcrumb({
+      category: 'pr-review',
+      message: `PR review subprocess exited`,
+      level: result.success ? 'info' : 'error',
+      data: { exitCode: result.exitCode, success: result.success, prNumber },
+    });
+
    if (!result.success) {
      // Finalize logs with failure
      logCollector.finalize(false);
+
+      safeCaptureException(
+        new Error(`PR review subprocess failed: ${result.error ?? 'unknown error'}`),
+        { extra: { exitCode: result.exitCode, prNumber, stderr: sanitizeForSentry(result.stderr.slice(0, 500)) } }
+      );
+
      throw new Error(result.error ?? "Review failed");
    }

@@ -1615,6 +1680,32 @@ async function fetchPRsFromGraphQL(
 export function registerPRHandlers(getMainWindow: () => BrowserWindow | null): void {
  debugLog("Registering PR handlers");

+  // Create the XState-based PR review state manager
+  const prReviewStateManager = new PRReviewStateManager(getMainWindow);
+
+  // Clear all PR review actors when GitHub auth changes (account swap)
+  ipcMain.on(IPC_CHANNELS.GITHUB_AUTH_CHANGED, () => {
+    // Cancel all running review subprocesses and CI wait controllers
+    for (const [reviewKey, entry] of runningReviews) {
+      if (entry === CI_WAIT_PLACEHOLDER) {
+        const abortController = ciWaitAbortControllers.get(reviewKey);
+        if (abortController) {
+          abortController.abort();
+          ciWaitAbortControllers.delete(reviewKey);
+        }
+      } else {
+        try {
+          entry.kill("SIGTERM");
+        } catch {
+          // Process may have already exited
+        }
+      }
+    }
+    runningReviews.clear();
+    ciWaitAbortControllers.clear();
+    prReviewStateManager.handleAuthChange();
+  });
+
  // List open PRs - fetches up to 100 open PRs at once, returns hasNextPage and endCursor from API
  ipcMain.handle(
    IPC_CHANNELS.GITHUB_PR_LIST,
@@ -1822,25 +1913,27 @@ export function registerPRHandlers(getMainWindow: () => BrowserWindow | null): v

    try {
      await withProjectOrNull(projectId, async (project) => {
-        const { sendProgress, sendComplete } = createIPCCommunicators<
-          PRReviewProgress,
-          PRReviewResult
-        >(
-          mainWindow,
-          {
-            progress: IPC_CHANNELS.GITHUB_PR_REVIEW_PROGRESS,
-            error: IPC_CHANNELS.GITHUB_PR_REVIEW_ERROR,
-            complete: IPC_CHANNELS.GITHUB_PR_REVIEW_COMPLETE,
-          },
-          projectId
-        );
+        const sendProgress = (progress: PRReviewProgress): void => {
+          prReviewStateManager.handleProgress(projectId, prNumber, progress);
+        };

-        // Check if already running
+        // Check if already running — notify renderer so it can display ongoing logs
        if (runningReviews.has(reviewKey)) {
-          debugLog("Review already running", { reviewKey });
+          debugLog("Review already running, notifying renderer", { reviewKey });
+          const currentSnapshot = prReviewStateManager.getState(projectId, prNumber);
+          const currentProgress = currentSnapshot?.context?.progress?.progress ?? 50;
+          sendProgress({
+            phase: "analyzing",
+            prNumber,
+            progress: currentProgress,
+            message: "Review is already in progress. Reconnecting to ongoing review...",
+          });
          return;
        }

+        // Notify state manager that review is starting (after duplicate check)
+        prReviewStateManager.handleStartReview(projectId, prNumber);
+
        // Register as running BEFORE CI wait to prevent race conditions
        // Use CI_WAIT_PLACEHOLDER sentinel until real process is spawned
        runningReviews.set(reviewKey, CI_WAIT_PLACEHOLDER);
@@ -1905,17 +1998,18 @@ export function registerPRHandlers(getMainWindow: () => BrowserWindow | null): v
            message: "Fetching PR data...",
          });

-          const result = await runPRReview(project, prNumber, mainWindow);
+          const result = await runPRReview(project, prNumber, mainWindow, prReviewStateManager);

          debugLog("PR review completed", { prNumber, findingsCount: result.findings.length });
          sendProgress({
            phase: "complete",
            prNumber,
            progress: 100,
-            message: "Review complete!",
+            message: result.overallStatus === "in_progress" ? "Review already in progress" : "Review complete!",
          });

-          sendComplete(result);
+          // Route through manager — handles external review detection internally
+          prReviewStateManager.handleComplete(projectId, prNumber, result);
        } finally {
          // Clean up in case we exit before runPRReview was called (e.g., cancelled during CI wait)
          // runPRReview also has its own cleanup, but delete is idempotent
@@ -1932,16 +2026,7 @@ export function registerPRHandlers(getMainWindow: () => BrowserWindow | null): v
        prNumber,
        error: error instanceof Error ? error.message : error,
      });
-      const { sendError } = createIPCCommunicators<PRReviewProgress, PRReviewResult>(
-        mainWindow,
-        {
-          progress: IPC_CHANNELS.GITHUB_PR_REVIEW_PROGRESS,
-          error: IPC_CHANNELS.GITHUB_PR_REVIEW_ERROR,
-          complete: IPC_CHANNELS.GITHUB_PR_REVIEW_COMPLETE,
-        },
-        projectId
-      );
-      sendError(error instanceof Error ? error.message : "Failed to run PR review");
+      prReviewStateManager.handleError(projectId, prNumber, error instanceof Error ? error.message : "Failed to run PR review");
    }
  });

@@ -2146,7 +2231,7 @@ export function registerPRHandlers(getMainWindow: () => BrowserWindow | null): v
          }

          // Send state update event to refresh UI immediately (non-blocking)
-          sendReviewStateUpdate(project, prNumber, projectId, getMainWindow, "after posting");
+          sendReviewStateUpdate(project, prNumber, projectId, prReviewStateManager, "after posting");

          return true;
        } catch (error) {
@@ -2185,7 +2270,7 @@ export function registerPRHandlers(getMainWindow: () => BrowserWindow | null): v
          debugLog("Marked review as posted", { prNumber });

          // Send state update event to refresh UI immediately (non-blocking)
-          sendReviewStateUpdate(project, prNumber, projectId, getMainWindow, "after marking posted");
+          sendReviewStateUpdate(project, prNumber, projectId, prReviewStateManager, "after marking posted");

          return true;
        } catch (error) {
@@ -2303,7 +2388,7 @@ export function registerPRHandlers(getMainWindow: () => BrowserWindow | null): v
          }

          // Send state update event to refresh UI immediately (non-blocking)
-          sendReviewStateUpdate(project, prNumber, projectId, getMainWindow, "after deletion");
+          sendReviewStateUpdate(project, prNumber, projectId, prReviewStateManager, "after deletion");

          return true;
        } catch (error) {
@@ -2415,6 +2500,8 @@ export function registerPRHandlers(getMainWindow: () => BrowserWindow | null): v
          ciWaitAbortControllers.delete(reviewKey);
        }
        runningReviews.delete(reviewKey);
+        // Notify state manager of cancellation
+        prReviewStateManager.handleCancel(projectId, prNumber);
        debugLog("CI wait cancelled", { reviewKey });
        return true;
      }
@@ -2435,6 +2522,8 @@ export function registerPRHandlers(getMainWindow: () => BrowserWindow | null): v

        // Clean up the registry
        runningReviews.delete(reviewKey);
+        // Notify state manager of cancellation
+        prReviewStateManager.handleCancel(projectId, prNumber);
        debugLog("Review process cancelled", { reviewKey });
        return true;
      } catch (error) {
@@ -2447,6 +2536,21 @@ export function registerPRHandlers(getMainWindow: () => BrowserWindow | null): v
    }
  );

+  // Notify main process about external review completion or timeout
+  // Called by renderer when its polling detects an external review has finished on disk
+  ipcMain.handle(
+    IPC_CHANNELS.GITHUB_PR_NOTIFY_EXTERNAL_REVIEW_COMPLETE,
+    async (_, projectId: string, prNumber: number, result: PRReviewResult | null): Promise<void> => {
+      debugLog("notifyExternalReviewComplete handler called", { projectId, prNumber, hasResult: !!result });
+      if (result) {
+        prReviewStateManager.handleComplete(projectId, prNumber, result);
+      } else {
+        // Timeout — no result found within polling window
+        prReviewStateManager.handleError(projectId, prNumber, "External review timed out after 30 minutes");
+      }
+    }
+  );
+
  // Check for new commits since last review
  ipcMain.handle(
    IPC_CHANNELS.GITHUB_PR_CHECK_NEW_COMMITS,
@@ -2832,34 +2936,40 @@ export function registerPRHandlers(getMainWindow: () => BrowserWindow | null): v

      try {
        await withProjectOrNull(projectId, async (project) => {
-          const { sendProgress, sendError, sendComplete } = createIPCCommunicators<
-            PRReviewProgress,
-            PRReviewResult
-          >(
-            mainWindow,
-            {
-              progress: IPC_CHANNELS.GITHUB_PR_REVIEW_PROGRESS,
-              error: IPC_CHANNELS.GITHUB_PR_REVIEW_ERROR,
-              complete: IPC_CHANNELS.GITHUB_PR_REVIEW_COMPLETE,
-            },
-            projectId
-          );
+          const sendProgress = (progress: PRReviewProgress): void => {
+            prReviewStateManager.handleProgress(projectId, prNumber, progress);
+          };
+
+          const reviewKey = getReviewKey(projectId, prNumber);
+
+          // Check if already running — notify renderer so it can display ongoing logs
+          if (runningReviews.has(reviewKey)) {
+            debugLog("Follow-up review already running, notifying renderer", { reviewKey });
+            const currentSnapshot = prReviewStateManager.getState(projectId, prNumber);
+            const currentProgress = currentSnapshot?.context?.progress?.progress ?? 50;
+            sendProgress({
+              phase: "analyzing",
+              prNumber,
+              progress: currentProgress,
+              message: "Follow-up review is already in progress. Reconnecting to ongoing review...",
+            });
+            return;
+          }
+
+          // Get previous result for followup context
+          const previousResult = getReviewResult(project, prNumber) ?? undefined;
+
+          // Notify state manager that followup review is starting (after duplicate check)
+          prReviewStateManager.handleStartFollowupReview(projectId, prNumber, previousResult);

          // Comprehensive validation of GitHub module
          const validation = await validateGitHubModule(project);
          if (!validation.valid) {
-            sendError({ prNumber, error: validation.error || "GitHub module validation failed" });
+            prReviewStateManager.handleError(projectId, prNumber, validation.error || "GitHub module validation failed");
            return;
          }

          const backendPath = validation.backendPath!;
-          const reviewKey = getReviewKey(projectId, prNumber);
-
-          // Check if already running
-          if (runningReviews.has(reviewKey)) {
-            debugLog("Follow-up review already running", { reviewKey });
-            return;
-          }

          // Register as running BEFORE CI wait to prevent race conditions
          // Use CI_WAIT_PLACEHOLDER sentinel until real process is spawned
@@ -2907,6 +3017,20 @@ export function registerPRHandlers(getMainWindow: () => BrowserWindow | null): v

          debugLog("Spawning follow-up review process", { args, model, thinkingLevel });

+          safeBreadcrumb({
+            category: 'pr-review',
+            message: 'Spawning follow-up PR review subprocess',
+            level: 'info',
+            data: {
+              pythonPath: getPythonPath(backendPath),
+              runnerPath: getRunnerPath(backendPath),
+              cwd: backendPath,
+              model,
+              thinkingLevel,
+              prNumber,
+            },
+          });
+
          // Create log collector for this follow-up review (config already declared above)
          const repo = config?.repo || project.name || "unknown";
          const logCollector = new PRLogCollector(project, prNumber, repo, true, mainWindow);
@@ -2914,6 +3038,19 @@ export function registerPRHandlers(getMainWindow: () => BrowserWindow | null): v
          // Build environment with project settings
          const followupEnv = await getRunnerEnv(getClaudeMdEnv(project));

+          safeBreadcrumb({
+            category: 'github.pr-review',
+            message: `Subprocess env for PR #${prNumber} follow-up review`,
+            level: 'info',
+            data: {
+              prNumber,
+              hasGITHUB_CLI_PATH: !!followupEnv.GITHUB_CLI_PATH,
+              GITHUB_CLI_PATH: followupEnv.GITHUB_CLI_PATH ?? 'NOT SET',
+              hasGITHUB_TOKEN: !!followupEnv.GITHUB_TOKEN,
+              hasPYTHONPATH: !!followupEnv.PYTHONPATH,
+            },
+          });
+
          const { process: childProcess, promise } = runPythonSubprocess<PRReviewResult>({
            pythonPath: getPythonPath(backendPath),
            args,
@@ -2964,9 +3101,22 @@ export function registerPRHandlers(getMainWindow: () => BrowserWindow | null): v

            const result = await promise;

+            safeBreadcrumb({
+              category: 'pr-review',
+              message: 'Follow-up PR review subprocess exited',
+              level: result.success ? 'info' : 'error',
+              data: { exitCode: result.exitCode, success: result.success, prNumber },
+            });
+
            if (!result.success) {
              // Finalize logs with failure
              logCollector.finalize(false);
+
+              safeCaptureException(
+                new Error(`Follow-up PR review subprocess failed: ${result.error ?? 'unknown error'}`),
+                { extra: { exitCode: result.exitCode, prNumber, stderr: sanitizeForSentry(result.stderr.slice(0, 500)) } }
+              );
+
              throw new Error(result.error ?? "Follow-up review failed");
            }

@@ -2989,7 +3139,8 @@ export function registerPRHandlers(getMainWindow: () => BrowserWindow | null): v
              message: "Follow-up review complete!",
            });

-            sendComplete(result.data!);
+            // Route through state manager
+            prReviewStateManager.handleComplete(projectId, prNumber, result.data!);
          } finally {
            // Always clean up registry, whether we exit normally or via error
            runningReviews.delete(reviewKey);
@@ -3002,19 +3153,7 @@ export function registerPRHandlers(getMainWindow: () => BrowserWindow | null): v
          prNumber,
          error: error instanceof Error ? error.message : error,
        });
-        const { sendError } = createIPCCommunicators<PRReviewProgress, PRReviewResult>(
-          mainWindow,
-          {
-            progress: IPC_CHANNELS.GITHUB_PR_REVIEW_PROGRESS,
-            error: IPC_CHANNELS.GITHUB_PR_REVIEW_ERROR,
-            complete: IPC_CHANNELS.GITHUB_PR_REVIEW_COMPLETE,
-          },
-          projectId
-        );
-        sendError({
-          prNumber,
-          error: error instanceof Error ? error.message : "Failed to run follow-up review",
-        });
+        prReviewStateManager.handleError(projectId, prNumber, error instanceof Error ? error.message : "Failed to run follow-up review");
      }
    }
  );
@@ -137,6 +137,7 @@ export async function createSpecForIssue(
      status: 'pending',
      phases: []
    };
+    // lgtm[js/http-to-file-access] - specDir is controlled, slugifiedTitle sanitizes input
    writeFileSync(
      path.join(specDir, AUTO_BUILD_PATHS.IMPLEMENTATION_PLAN),
      JSON.stringify(implementationPlan, null, 2),
@@ -148,6 +149,7 @@ export async function createSpecForIssue(
      task_description: safeDescription,
      workflow_type: 'feature'
    };
+    // lgtm[js/http-to-file-access] - specDir is controlled, slugifiedTitle sanitizes input
    writeFileSync(
      path.join(specDir, AUTO_BUILD_PATHS.REQUIREMENTS),
      JSON.stringify(requirements, null, 2),
@@ -167,6 +169,7 @@ export async function createSpecForIssue(
      // This comes from project.settings.mainBranch or task-level override
      ...(baseBranch && { baseBranch })
    };
+    // lgtm[js/http-to-file-access] - specDir is controlled, slugifiedTitle sanitizes input
    writeFileSync(
      path.join(specDir, 'task_metadata.json'),
      JSON.stringify(metadata, null, 2),
@@ -30,6 +30,15 @@ vi.mock('../../utils', () => ({
  getGitHubTokenForSubprocess: () => mockGetGitHubTokenForSubprocess(),
 }));

+vi.mock('../../../../cli-tool-manager', () => ({
+  getToolInfo: () => ({ found: false, path: undefined, source: undefined }),
+}));
+
+vi.mock('../../../../sentry', () => ({
+  getSentryEnvForSubprocess: () => ({}),
+  safeBreadcrumb: () => {},
+}));
+
 import { getRunnerEnv } from '../runner-env';

 describe('getRunnerEnv', () => {
@@ -3,6 +3,8 @@ import { getAPIProfileEnv } from '../../../services/profile';
 import { getBestAvailableProfileEnv } from '../../../rate-limit-detector';
 import { pythonEnvManager } from '../../../python-env-manager';
 import { getGitHubTokenForSubprocess } from '../utils';
+import { getSentryEnvForSubprocess, safeBreadcrumb } from '../../../sentry';
+import { getToolInfo } from '../../../cli-tool-manager';

 /**
 * Get environment variables for Python runner subprocesses.
@@ -42,12 +44,31 @@ export async function getRunnerEnv(
  const githubToken = await getGitHubTokenForSubprocess();
  const githubEnv: Record<string, string> = githubToken ? { GITHUB_TOKEN: githubToken } : {};

+  // Resolve gh CLI path so Python subprocess can find it in bundled apps
+  // (bundled Electron apps have a stripped PATH that doesn't include Homebrew etc.)
+  const ghInfo = getToolInfo('gh');
+  const ghCliEnv: Record<string, string> = ghInfo.found && ghInfo.path ? { GITHUB_CLI_PATH: ghInfo.path } : {};
+  safeBreadcrumb({
+    category: 'github.runner-env',
+    message: `gh CLI for subprocess: found=${ghInfo.found}, path=${ghInfo.path ?? 'none'}, source=${ghInfo.source ?? 'none'}`,
+    level: ghInfo.found ? 'info' : 'warning',
+    data: {
+      found: ghInfo.found,
+      path: ghInfo.path ?? null,
+      source: ghInfo.source ?? null,
+      willSetGITHUB_CLI_PATH: !!(ghInfo.found && ghInfo.path),
+      hasGITHUB_TOKEN: !!githubToken,
+    },
+  });
+
  return {
    ...pythonEnv,  // Python environment including PYTHONPATH (fixes #139)
    ...apiProfileEnv,
    ...oauthModeClearVars,
    ...profileEnv,  // OAuth token from profile manager (fixes #563, rate-limit aware)
    ...githubEnv,  // Fresh GitHub token from gh CLI (fixes #151)
-    ...extraEnv,
+    ...ghCliEnv,  // gh CLI path for bundled apps (Python backend uses GITHUB_CLI_PATH)
+    ...getSentryEnvForSubprocess(),  // Sentry DSN + sample rates for Python subprocess
+    ...extraEnv,  // extraEnv last so callers can still override
  };
 }
@@ -20,6 +20,8 @@ import { isWindows, isMacOS } from '../../../platform';
 import { getEffectiveSourcePath } from '../../../updater/path-resolver';
 import { pythonEnvManager, getConfiguredPythonPath } from '../../../python-env-manager';
 import { getTaskkillExePath, getWhereExePath } from '../../../utils/windows-paths';
+import { safeCaptureException, safeBreadcrumb } from '../../../sentry';
+import { getToolInfo } from '../../../cli-tool-manager';

 const execAsync = promisify(exec);
 const execFileAsync = promisify(execFile);
@@ -214,6 +216,17 @@ export function runPythonSubprocess<T = unknown>(
    let killedDueToAuthFailure = false; // Track if subprocess was killed due to auth failure
    let billingFailureEmitted = false; // Track if we've already emitted a billing failure
    let killedDueToBillingFailure = false; // Track if subprocess was killed due to billing failure
+    let receivedOutput = false; // Track if any stdout/stderr has been received
+
+    // Health-check: report to Sentry if no output received within 120 seconds
+    const healthCheckTimeout = setTimeout(() => {
+      if (!receivedOutput) {
+        safeCaptureException(
+          new Error('[SubprocessRunner] No output received from subprocess after 120s'),
+          { extra: { pythonPath: options.pythonPath, args: options.args, cwd: options.cwd, envKeys: options.env ? Object.keys(options.env) : [] } }
+        );
+      }
+    }, 120_000);

    // Default progress pattern: [ 30%] message OR [30%] message
    const progressPattern = options.progressPattern ?? /\[\s*(\d+)%\]\s*(.+)/;
@@ -337,6 +350,7 @@ export function runPythonSubprocess<T = unknown>(
    };

    child.stdout.on('data', (data: Buffer) => {
+      receivedOutput = true;
      const text = data.toString('utf-8');
      stdout += text;

@@ -364,6 +378,7 @@ export function runPythonSubprocess<T = unknown>(
    });

    child.stderr.on('data', (data: Buffer) => {
+      receivedOutput = true;
      const text = data.toString('utf-8');
      stderr += text;

@@ -382,6 +397,7 @@ export function runPythonSubprocess<T = unknown>(
    });

    child.on('close', (code: number | null) => {
+      clearTimeout(healthCheckTimeout);
      // Treat null exit code (killed with SIGKILL) as failure, not success
      const exitCode = code ?? -1;

@@ -461,6 +477,7 @@ export function runPythonSubprocess<T = unknown>(
    });

    child.on('error', (err: Error) => {
+      clearTimeout(healthCheckTimeout);
      options.onError?.(err.message);
      resolve({
        success: false,
@@ -543,6 +560,7 @@ export interface GitHubModuleValidation {
  pythonEnvValid: boolean;
  error?: string;
  backendPath?: string;
+  ghCliPath?: string;
 }

 /**
@@ -606,33 +624,36 @@ export async function validateGitHubModule(project: Project): Promise<GitHubModu
    return result;
  }

-  // 2. Check gh CLI installation (cross-platform)
-  try {
-    if (isWindows()) {
-      await execFileAsync(getWhereExePath(), ['gh'], { timeout: 5000 });
-    } else {
-      await execAsync('which gh');
-    }
+  // 2. Check gh CLI installation (uses CLI tool manager for bundled app compatibility)
+  const ghInfo = getToolInfo('gh');
+  safeBreadcrumb({
+    category: 'github.validation',
+    message: `gh CLI lookup: found=${ghInfo.found}, path=${ghInfo.path ?? 'none'}, source=${ghInfo.source ?? 'none'}`,
+    level: ghInfo.found ? 'info' : 'warning',
+    data: { found: ghInfo.found, path: ghInfo.path ?? null, source: ghInfo.source ?? null },
+  });
+  if (ghInfo.found && ghInfo.path) {
    result.ghCliInstalled = true;
-  } catch (error: unknown) {
+    result.ghCliPath = ghInfo.path;
+  } else {
    result.ghCliInstalled = false;
-    const errCode = (error as NodeJS.ErrnoException).code;
-    if (errCode === 'ENOENT' && isWindows()) {
-      result.error = `System utility 'where.exe' not found. Check Windows installation.`;
-    } else {
-      const installInstructions = isWindows()
-        ? 'winget install --id GitHub.cli'
-        : isMacOS()
-          ? 'brew install gh'
-          : 'See https://cli.github.com/';
-      result.error = `GitHub CLI (gh) is not installed. Install it with:\n  ${installInstructions}`;
-    }
+    const installInstructions = isWindows()
+      ? 'winget install --id GitHub.cli'
+      : isMacOS()
+        ? 'brew install gh'
+        : 'See https://cli.github.com/';
+    result.error = `GitHub CLI (gh) is not installed. Install it with:\n  ${installInstructions}`;
+    safeCaptureException(new Error('gh CLI not found in bundled app'), {
+      tags: { component: 'github-validation' },
+      extra: { ghInfo, isPackaged: require('electron').app?.isPackaged ?? 'unknown' },
+    });
    return result;
  }

-  // 3. Check gh authentication
+  // 3. Check gh authentication (use resolved path for bundled app compatibility)
  try {
-    await execAsync('gh auth status 2>&1');
+    const ghPath = result.ghCliPath || 'gh';
+    await execAsync(`"${ghPath}" auth status 2>&1`);
    result.ghAuthenticated = true;
  } catch (error: any) {
    // gh auth status returns non-zero when not authenticated
@@ -8,8 +8,8 @@ import { IPC_CHANNELS } from '../../../shared/constants';
 import type { GitLabInvestigationStatus, GitLabInvestigationResult } from '../../../shared/types';
 import { projectStore } from '../../project-store';
 import { getGitLabConfig, gitlabFetch, encodeProjectPath } from './utils';
-import type { GitLabAPIIssue, GitLabAPINote } from './types';
-import { buildIssueContext, createSpecForIssue } from './spec-utils';
+import type { GitLabAPIIssue, GitLabAPINoteBasic } from './types';
+import { createSpecForIssue, fetchAllIssueNotes } from './spec-utils';
 import type { AgentManager } from '../../agent';

 // Debug logging helper
@@ -109,51 +109,31 @@ export function registerInvestigateIssue(
          `/projects/${encodedProject}/issues/${issueIid}`
        ) as GitLabAPIIssue;

-        // Fetch notes if any selected
-        let selectedNotes: GitLabAPINote[] = [];
+        // Fetch notes if any selected (with pagination to get all notes)
+        let filteredNotes: GitLabAPINoteBasic[] = [];
        if (selectedNoteIds && selectedNoteIds.length > 0) {
-          const allNotes = await gitlabFetch(
-            config.token,
-            config.instanceUrl,
-            `/projects/${encodedProject}/issues/${issueIid}/notes`
-          ) as GitLabAPINote[];
-
-          selectedNotes = allNotes.filter(note => selectedNoteIds.includes(note.id));
+          // Fetch all notes using the paginated utility function
+          const allNotes = await fetchAllIssueNotes(config, encodedProject, issueIid);
+          // Filter notes based on selection
+          filteredNotes = allNotes.filter(note => selectedNoteIds.includes(note.id));
        }

-        // Phase 2: Analyzing
-        sendProgress(getMainWindow, project.id, {
-          phase: 'analyzing',
-          issueIid,
-          progress: 30,
-          message: 'Analyzing issue with AI...'
-        });
-
-        // Note: Context building previously done here has been moved to createSpecForIssue utility.
-        // The buildIssueContext() function and selectedNotes processing are now handled internally
-        // by the spec creation pipeline. This avoids duplicate context generation.
-        // TODO: If advanced context customization is needed in the future, consider extracting
-        // context building into a reusable utility function.
-
-        // Use agent manager to investigate
-        // Note: This is a simplified version - full implementation would use Claude SDK
-        sendProgress(getMainWindow, project.id, {
-          phase: 'analyzing',
-          issueIid,
-          progress: 50,
-          message: 'AI analyzing the issue...'
-        });
-
-        // Phase 3: Creating task
+        // Phase 2: Creating task
        sendProgress(getMainWindow, project.id, {
          phase: 'creating_task',
          issueIid,
-          progress: 80,
-          message: 'Creating task from analysis...'
+          progress: 50,
+          message: 'Creating task from issue...'
        });

-        // Create spec for the issue
-        const task = await createSpecForIssue(project, issue, config, project.settings?.mainBranch);
+        // Create spec for the issue with notes
+        const task = await createSpecForIssue(
+          project,
+          issue,
+          config,
+          project.settings?.mainBranch,
+          filteredNotes
+        );

        if (!task) {
          sendError(getMainWindow, project.id, 'Failed to create task from issue');
@@ -6,7 +6,7 @@
 import { mkdir, writeFile, readFile, stat } from 'fs/promises';
 import path from 'path';
 import type { Project } from '../../../shared/types';
-import type { GitLabAPIIssue, GitLabConfig } from './types';
+import type { GitLabAPIIssue, GitLabAPINoteBasic, GitLabConfig } from './types';
 import { labelMatchesWholeWord } from '../shared/label-utils';
 import { sanitizeText, sanitizeStringArray } from '../shared/sanitize';

@@ -208,7 +208,12 @@ function generateSpecDirName(issueIid: number, title: string): string {
 /**
 * Build issue context for spec creation
 */
-export function buildIssueContext(issue: IssueLike, projectPath: string, instanceUrl: string): string {
+export function buildIssueContext(
+  issue: IssueLike,
+  projectPath: string,
+  instanceUrl: string,
+  notes?: GitLabAPINoteBasic[]
+): string {
  const lines: string[] = [];
  const safeProjectPath = sanitizeText(projectPath, 200);
  const safeIssue = sanitizeIssueForSpec(issue, instanceUrl);
@@ -238,6 +243,19 @@ export function buildIssueContext(issue: IssueLike, projectPath: string, instanc
  lines.push('');
  lines.push(`**Web URL:** ${safeIssue.web_url}`);

+  // Add notes section if notes are provided
+  if (notes && notes.length > 0) {
+    lines.push('');
+    lines.push(`## Notes (${notes.length})`);
+    lines.push('');
+    for (const note of notes) {
+      const safeAuthor = sanitizeText(note.author?.username || 'unknown', 100);
+      const safeBody = sanitizeText(note.body, 20000, true);
+      lines.push(`**${safeAuthor}:** ${safeBody}`);
+      lines.push('');
+    }
+  }
+
  return lines.join('\n');
 }

@@ -253,6 +271,103 @@ async function pathExists(filePath: string): Promise<boolean> {
  }
 }

+/**
+ * Fetches all notes for a GitLab issue with pagination.
+ * Handles rate limiting and authentication errors gracefully.
+ *
+ * @param config GitLab configuration with token and instance URL
+ * @param encodedProject URL-encoded project path
+ * @param issueIid Issue IID to fetch notes for
+ * @returns Array of basic note objects with id, body, and author
+ */
+export async function fetchAllIssueNotes(
+  config: { token: string; instanceUrl: string },
+  encodedProject: string,
+  issueIid: number
+): Promise<GitLabAPINoteBasic[]> {
+  const { gitlabFetch } = await import('./utils');
+  const { GitLabAPIError } = await import('./utils');
+
+  const allNotes: GitLabAPINoteBasic[] = [];
+  let page = 1;
+  const perPage = 100;
+  const MAX_PAGES = 50; // Safety limit: max 5000 notes
+  let hasMore = true;
+
+  while (hasMore && page <= MAX_PAGES) {
+    try {
+      const notesPage = await gitlabFetch(
+        config.token,
+        config.instanceUrl,
+        `/projects/${encodedProject}/issues/${issueIid}/notes?page=${page}&per_page=${perPage}`
+      ) as unknown[];
+
+      // Runtime validation: ensure we got an array
+      if (!Array.isArray(notesPage)) {
+        debugLog('GitLab notes API returned non-array, stopping pagination');
+        break;
+      }
+
+      if (notesPage.length === 0) {
+        hasMore = false;
+      } else {
+        // Extract only needed fields with null-safe defaults
+        const noteSummaries: GitLabAPINoteBasic[] = notesPage
+          .filter((note: unknown): note is Record<string, unknown> =>
+            note !== null && typeof note === 'object' && typeof (note as Record<string, unknown>).id === 'number'
+          )
+          .map((note) => {
+            // Validate author structure defensively
+            const author = note.author;
+            const username = (author !== null && typeof author === 'object' && typeof (author as Record<string, unknown>).username === 'string')
+              ? (author as Record<string, unknown>).username as string
+              : 'unknown';
+            return {
+              id: note.id as number,
+              body: (note.body as string | undefined) || '',
+              author: { username },
+            };
+          });
+        allNotes.push(...noteSummaries);
+        if (notesPage.length < perPage) {
+          hasMore = false;
+        } else {
+          page++;
+        }
+      }
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : String(error);
+
+      // Check for authentication/rate-limit errors using structured status codes
+      const isAuthError = error instanceof GitLabAPIError && (error.statusCode === 401 || error.statusCode === 403);
+      const isRateLimited = error instanceof GitLabAPIError && error.statusCode === 429;
+
+      if (isAuthError || isRateLimited) {
+        // Re-throw critical errors to let the caller surface them to the user
+        const statusCode = error instanceof GitLabAPIError ? error.statusCode : undefined;
+        console.warn(`[GitLab Notes] ${isAuthError ? 'Authentication' : 'Rate limit'} error during notes fetch`, { page, error: errorMessage, statusCode });
+        throw error;
+      }
+
+      // For transient errors on page 1, warn the user but continue
+      if (page === 1 && allNotes.length === 0) {
+        console.warn('[GitLab Notes] Failed to fetch any notes, proceeding without notes context', { error: errorMessage });
+      } else {
+        // Log pagination failure for subsequent pages
+        debugLog('Failed to fetch notes page, using partial notes', { page, error: errorMessage, notesRetrieved: allNotes.length });
+      }
+      hasMore = false;
+    }
+  }
+
+  // Warn if we hit the pagination limit
+  if (page > MAX_PAGES && hasMore) {
+    debugLog('Pagination limit reached, some notes may be missing', { maxPages: MAX_PAGES, notesRetrieved: allNotes.length });
+  }
+
+  return allNotes;
+}
+
 /**
 * Create a task spec from a GitLab issue
 */
@@ -260,7 +375,8 @@ export async function createSpecForIssue(
  project: Project,
  issue: GitLabAPIIssue,
  config: GitLabConfig,
-  baseBranch?: string
+  baseBranch?: string,
+  notes?: GitLabAPINoteBasic[]
 ): Promise<GitLabTaskInfo | null> {
  try {
    // Validate and sanitize network data before writing to disk
@@ -319,8 +435,8 @@ export async function createSpecForIssue(
    // Create spec directory
    await mkdir(specDir, { recursive: true });

-    // Create TASK.md with issue context
-    const taskContent = buildIssueContext(safeIssue, safeProject, config.instanceUrl);
+    // Create TASK.md with issue context (including selected notes)
+    const taskContent = buildIssueContext(safeIssue, safeProject, safeInstanceUrl, notes);
    await writeFile(path.join(specDir, 'TASK.md'), taskContent, 'utf-8');

    // Create metadata.json (legacy format for GitLab-specific data)
@@ -420,6 +420,7 @@ export function registerTriageHandlers(
            }

            // Save result
+            // lgtm[js/http-to-file-access] - triageDir from controlled project path, issue_iid is numeric
            fs.writeFileSync(
              path.join(triageDir, `triage_${sanitizedResult.issue_iid}.json`),
              JSON.stringify(sanitizedResult, null, 2),
@@ -51,6 +51,13 @@ export interface GitLabAPINote {
  system: boolean;
 }

+// Basic note type with only fields needed by investigation handlers
+export interface GitLabAPINoteBasic {
+  id: number;
+  body: string;
+  author: { username: string };
+}
+
 export interface GitLabAPIMergeRequest {
  id: number;
  iid: number;
@@ -13,6 +13,19 @@ import { getIsolatedGitEnv } from '../../utils/git-isolation';

 const DEFAULT_GITLAB_URL = 'https://gitlab.com';

+/**
+ * Custom error class for GitLab API errors with structured status code
+ */
+export class GitLabAPIError extends Error {
+  public readonly statusCode: number;
+
+  constructor(message: string, statusCode: number) {
+    super(message);
+    this.name = 'GitLabAPIError';
+    this.statusCode = statusCode;
+  }
+}
+
 function parseInstanceUrl(value: string): string | null {
  const candidate = value.trim();
  if (!candidate) return null;
@@ -261,13 +274,16 @@ export async function gitlabFetch(

    if (!response.ok) {
      const errorBody = await response.text();
-      throw new Error(`GitLab API error: ${response.status} ${response.statusText} - ${errorBody}`);
+      throw new GitLabAPIError(
+        `GitLab API error: ${response.status} ${response.statusText} - ${errorBody}`,
+        response.status
+      );
    }

    return response.json();
  } catch (error) {
    if (error instanceof Error && error.name === 'AbortError') {
-      throw new Error(`GitLab API timeout after ${GITLAB_API_TIMEOUT_MS / 1000}s: ${url}`);
+      throw new GitLabAPIError(`GitLab API timeout after ${GITLAB_API_TIMEOUT_MS / 1000}s: ${url}`, 0);
    }
    throw error;
  } finally {
@@ -316,7 +332,10 @@ export async function gitlabFetchWithCount(

    if (!response.ok) {
      const errorBody = await response.text();
-      throw new Error(`GitLab API error: ${response.status} ${response.statusText} - ${errorBody}`);
+      throw new GitLabAPIError(
+        `GitLab API error: ${response.status} ${response.statusText} - ${errorBody}`,
+        response.status
+      );
    }

    // Get total count from X-Total header (GitLab's pagination header)
@@ -327,7 +346,7 @@ export async function gitlabFetchWithCount(
    return { data, totalCount };
  } catch (error) {
    if (error instanceof Error && error.name === 'AbortError') {
-      throw new Error(`GitLab API timeout after ${GITLAB_API_TIMEOUT_MS / 1000}s: ${url}`);
+      throw new GitLabAPIError(`GitLab API timeout after ${GITLAB_API_TIMEOUT_MS / 1000}s: ${url}`, 0);
    }
    throw error;
  } finally {
@@ -35,6 +35,7 @@ import { registerProfileHandlers } from './profile-handlers';
 import { registerScreenshotHandlers } from './screenshot-handlers';
 import { registerTerminalWorktreeIpcHandlers } from './terminal';
 import { notificationService } from '../notification-service';
+import { setAgentManagerRef } from './utils';

 /**
 * Setup all IPC handlers across all domains
@@ -53,6 +54,9 @@ export function setupIpcHandlers(
  // Initialize notification service
  notificationService.initialize(getMainWindow);

+  // Wire up agent manager for circuit breaker cleanup
+  setAgentManagerRef(agentManager);
+
  // Project handlers (including Python environment setup)
  registerProjectHandlers(pythonEnvManager, agentManager, getMainWindow);

@@ -16,6 +16,7 @@ import type {
  InsightsSession,
  InsightsSessionSummary,
  InsightsModelConfig,
+  ImageAttachment,
  Task,
  TaskMetadata,
  AppSettings,
@@ -81,7 +82,7 @@ export function registerInsightsHandlers(getMainWindow: () => BrowserWindow | nu

  ipcMain.on(
    IPC_CHANNELS.INSIGHTS_SEND_MESSAGE,
-    async (_, projectId: string, message: string, modelConfig?: InsightsModelConfig) => {
+    async (_, projectId: string, message: string, modelConfig?: InsightsModelConfig, images?: ImageAttachment[]) => {
      const project = projectStore.getProject(projectId);
      if (!project) {
        safeSendToRenderer(
@@ -112,7 +113,7 @@ export function registerInsightsHandlers(getMainWindow: () => BrowserWindow | nu
      // the handler returns. This fixes race conditions on Windows where
      // environment setup wouldn't complete before process spawn.
      try {
-        await insightsService.sendMessage(projectId, project.path, message, configWithSettings);
+        await insightsService.sendMessage(projectId, project.path, message, configWithSettings, images);
      } catch (error) {
        // Errors during sendMessage (executor errors) are already emitted via
        // the 'error' event, but we catch here to prevent unhandled rejection
@@ -249,17 +250,95 @@ export function registerInsightsHandlers(getMainWindow: () => BrowserWindow | nu
  // List all sessions for a project
  ipcMain.handle(
    IPC_CHANNELS.INSIGHTS_LIST_SESSIONS,
-    async (_, projectId: string): Promise<IPCResult<InsightsSessionSummary[]>> => {
+    async (_, projectId: string, includeArchived?: boolean): Promise<IPCResult<InsightsSessionSummary[]>> => {
      const project = projectStore.getProject(projectId);
      if (!project) {
        return { success: false, error: "Project not found" };
      }

-      const sessions = insightsService.listSessions(project.path);
+      const sessions = insightsService.listSessions(project.path, includeArchived ?? false);
      return { success: true, data: sessions };
    }
  );

+  // Delete multiple sessions
+  ipcMain.handle(
+    IPC_CHANNELS.INSIGHTS_DELETE_SESSIONS,
+    async (_, projectId: string, sessionIds: string[]): Promise<IPCResult<{ deletedIds: string[]; failedIds: string[] }>> => {
+      if (!Array.isArray(sessionIds) || sessionIds.length === 0) {
+        return { success: false, error: "No sessions specified" };
+      }
+
+      const project = projectStore.getProject(projectId);
+      if (!project) {
+        return { success: false, error: "Project not found" };
+      }
+
+      const result = insightsService.deleteSessions(projectId, project.path, sessionIds);
+      return {
+        success: result.failedIds.length === 0,
+        data: result,
+        ...(result.failedIds.length > 0 && { error: `Failed to delete ${result.failedIds.length} session(s)` })
+      };
+    }
+  );
+
+  // Archive a session
+  ipcMain.handle(
+    IPC_CHANNELS.INSIGHTS_ARCHIVE_SESSION,
+    async (_, projectId: string, sessionId: string): Promise<IPCResult> => {
+      const project = projectStore.getProject(projectId);
+      if (!project) {
+        return { success: false, error: "Project not found" };
+      }
+
+      const success = insightsService.archiveSession(projectId, project.path, sessionId);
+      if (success) {
+        return { success: true };
+      }
+      return { success: false, error: "Failed to archive session" };
+    }
+  );
+
+  // Archive multiple sessions
+  ipcMain.handle(
+    IPC_CHANNELS.INSIGHTS_ARCHIVE_SESSIONS,
+    async (_, projectId: string, sessionIds: string[]): Promise<IPCResult<{ archivedIds: string[]; failedIds: string[] }>> => {
+      if (!Array.isArray(sessionIds) || sessionIds.length === 0) {
+        return { success: false, error: "No sessions specified" };
+      }
+
+      const project = projectStore.getProject(projectId);
+      if (!project) {
+        return { success: false, error: "Project not found" };
+      }
+
+      const result = insightsService.archiveSessions(projectId, project.path, sessionIds);
+      return {
+        success: result.failedIds.length === 0,
+        data: result,
+        ...(result.failedIds.length > 0 && { error: `Failed to archive ${result.failedIds.length} session(s)` })
+      };
+    }
+  );
+
+  // Unarchive a session
+  ipcMain.handle(
+    IPC_CHANNELS.INSIGHTS_UNARCHIVE_SESSION,
+    async (_, projectId: string, sessionId: string): Promise<IPCResult> => {
+      const project = projectStore.getProject(projectId);
+      if (!project) {
+        return { success: false, error: "Project not found" };
+      }
+
+      const success = insightsService.unarchiveSession(project.path, sessionId);
+      if (success) {
+        return { success: true };
+      }
+      return { success: false, error: "Failed to unarchive session" };
+    }
+  );
+
  // Create a new session
  ipcMain.handle(
    IPC_CHANNELS.INSIGHTS_NEW_SESSION,
@@ -507,6 +507,7 @@ ${safeDescription || 'No description provided.'}
              status: 'pending',
              phases: []
            };
+            // lgtm[js/http-to-file-access] - specDir is controlled, Linear data sanitized
            writeFileSync(path.join(specDir, AUTO_BUILD_PATHS.IMPLEMENTATION_PLAN), JSON.stringify(implementationPlan, null, 2), 'utf-8');

            // Create requirements.json
@@ -514,6 +515,7 @@ ${safeDescription || 'No description provided.'}
              task_description: description,
              workflow_type: 'feature'
            };
+            // lgtm[js/http-to-file-access] - specDir is controlled, Linear data sanitized
            writeFileSync(path.join(specDir, AUTO_BUILD_PATHS.REQUIREMENTS), JSON.stringify(requirements, null, 2), 'utf-8');

            // Build metadata
@@ -524,6 +526,7 @@ ${safeDescription || 'No description provided.'}
              linearUrl: safeUrl,
              category: 'feature'
            };
+            // lgtm[js/http-to-file-access] - specDir is controlled, Linear data sanitized
            writeFileSync(path.join(specDir, 'task_metadata.json'), JSON.stringify(metadata, null, 2), 'utf-8');

            // Start spec creation with the existing spec directory
@@ -1,6 +1,5 @@
-import { ipcMain, app } from 'electron';
-import { existsSync, } from 'fs';
-import path from 'path';
+import { ipcMain } from 'electron';
+import { existsSync } from 'fs';
 import { execFileSync } from 'child_process';
 import { IPC_CHANNELS } from '../../shared/constants';
 import type {
@@ -154,16 +153,24 @@ function getGitBranchesWithInfo(projectPath: string): GitBranchDetail[] {
        .map(b => b.trim())
        // Remove HEAD pointer entries like "origin/HEAD"
        .filter(b => !b.endsWith('/HEAD'))
-        .map(name => ({
-          name,
-          type: 'remote' as const,
-          displayName: name,
-          isCurrent: false
-        }));
+        .map(fullName => {
+          // Strip "origin/" prefix so branch names are clean for PR targets etc.
+          const name = fullName.replace(/^origin\//, '');
+          return {
+            name,
+            type: 'remote' as const,
+            displayName: name,
+            isCurrent: false
+          };
+        });
    } catch {
      // Remote branches may not exist, continue with local only
    }

+    // Deduplicate: if a branch exists locally and remotely, keep only the local entry
+    const localNames = new Set(localBranches.map(b => b.name));
+    remoteBranches = remoteBranches.filter(b => !localNames.has(b.name));
+
    // Combine and sort: local branches first, then remote branches, alphabetically within each group
    const allBranches = [...localBranches, ...remoteBranches];

@@ -127,6 +127,7 @@ export function registerRoadmapHandlers(
                })),
                strengths: (c.strengths as string[]) || [],
                marketPosition: (c.market_position as string) || "",
+                source: c.source || undefined,
              })),
              marketGaps: (rawCompetitor.market_gaps || []).map((g: Record<string, unknown>) => ({
                id: g.id,
@@ -792,6 +793,148 @@ ${(feature.acceptance_criteria || []).map((c: string) => `- [ ] ${c}`).join("\n"
    }
  );

+  // ============================================
+  // Competitor Analysis Save
+  // ============================================
+
+  ipcMain.handle(
+    IPC_CHANNELS.COMPETITOR_ANALYSIS_SAVE,
+    async (
+      _,
+      projectId: string,
+      competitorAnalysis: CompetitorAnalysis
+    ): Promise<IPCResult> => {
+      const project = projectStore.getProject(projectId);
+      if (!project) {
+        return { success: false, error: "Project not found" };
+      }
+
+      const roadmapDir = path.join(project.path, AUTO_BUILD_PATHS.ROADMAP_DIR);
+      const competitorAnalysisPath = path.join(
+        roadmapDir,
+        AUTO_BUILD_PATHS.COMPETITOR_ANALYSIS
+      );
+
+      try {
+        // Ensure roadmap directory exists
+        if (!existsSync(roadmapDir)) {
+          mkdirSync(roadmapDir, { recursive: true });
+        }
+
+        await withFileLock(competitorAnalysisPath, async () => {
+          // Transform camelCase to snake_case for JSON file
+          const serialized = {
+            project_context: {
+              project_name: competitorAnalysis.projectContext.projectName,
+              project_type: competitorAnalysis.projectContext.projectType,
+              target_audience: competitorAnalysis.projectContext.targetAudience,
+            },
+            competitors: competitorAnalysis.competitors.map((c) => ({
+              id: c.id,
+              name: c.name,
+              url: c.url,
+              description: c.description,
+              relevance: c.relevance,
+              pain_points: c.painPoints.map((p) => ({
+                id: p.id,
+                description: p.description,
+                source: p.source,
+                severity: p.severity,
+                frequency: p.frequency,
+                opportunity: p.opportunity,
+              })),
+              strengths: c.strengths,
+              market_position: c.marketPosition,
+              source: c.source,
+            })),
+            market_gaps: competitorAnalysis.marketGaps.map((g) => ({
+              id: g.id,
+              description: g.description,
+              affected_competitors: g.affectedCompetitors,
+              opportunity_size: g.opportunitySize,
+              suggested_feature: g.suggestedFeature,
+            })),
+            insights_summary: {
+              top_pain_points: competitorAnalysis.insightsSummary.topPainPoints,
+              differentiator_opportunities:
+                competitorAnalysis.insightsSummary.differentiatorOpportunities,
+              market_trends: competitorAnalysis.insightsSummary.marketTrends,
+            },
+            research_metadata: {
+              search_queries_used:
+                competitorAnalysis.researchMetadata.searchQueriesUsed,
+              sources_consulted:
+                competitorAnalysis.researchMetadata.sourcesConsulted,
+              limitations: competitorAnalysis.researchMetadata.limitations,
+            },
+            metadata: {
+              created_at: competitorAnalysis.createdAt
+                ? new Date(competitorAnalysis.createdAt).toISOString()
+                : new Date().toISOString(),
+              updated_at: new Date().toISOString(),
+            },
+          };
+
+          await writeFileWithRetry(
+            competitorAnalysisPath,
+            JSON.stringify(serialized, null, 2),
+            { encoding: 'utf-8' }
+          );
+        });
+
+        // Also persist manual competitors to a separate file that the backend
+        // agent never overwrites, preventing data loss during concurrent analysis
+        const manualCompetitors = competitorAnalysis.competitors.filter(
+          (c) => c.source === "manual"
+        );
+        if (manualCompetitors.length > 0) {
+          const manualCompetitorsPath = path.join(
+            roadmapDir,
+            AUTO_BUILD_PATHS.MANUAL_COMPETITORS
+          );
+          const manualSerialized = {
+            competitors: manualCompetitors.map((c) => ({
+              id: c.id,
+              name: c.name,
+              url: c.url,
+              description: c.description,
+              relevance: c.relevance,
+              pain_points: c.painPoints.map((p) => ({
+                id: p.id,
+                description: p.description,
+                source: p.source,
+                severity: p.severity,
+                frequency: p.frequency,
+                opportunity: p.opportunity,
+              })),
+              strengths: c.strengths,
+              market_position: c.marketPosition,
+              source: c.source,
+            })),
+            updated_at: new Date().toISOString(),
+          };
+          await writeFileWithRetry(
+            manualCompetitorsPath,
+            JSON.stringify(manualSerialized, null, 2),
+            { encoding: "utf-8" }
+          );
+        }
+
+        debugLog("[Roadmap Handler] Saved competitor analysis:", { projectId });
+        return { success: true };
+      } catch (error) {
+        debugError("[Roadmap Handler] Failed to save competitor analysis:", error);
+        return {
+          success: false,
+          error:
+            error instanceof Error
+              ? error.message
+              : "Failed to save competitor analysis",
+        };
+      }
+    }
+  );
+
  // ============================================
  // Roadmap Agent Events → Renderer
  // ============================================
@@ -15,12 +15,14 @@ import {
  getPlanPath,
  persistPlanStatus,
  createPlanIfNotExists,
-  resetStuckSubtasks
+  resetStuckSubtasks,
+  hasPlanWithSubtasks
 } from './plan-file-utils';
 import { writeFileAtomicSync } from '../../utils/atomic-file';
 import { findTaskWorktree } from '../../worktree-paths';
 import { projectStore } from '../../project-store';
 import { getIsolatedGitEnv, detectWorktreeBranch } from '../../utils/git-isolation';
+import { cancelFallbackTimer } from '../agent-events-handlers';

 /**
 * Safe file read that handles missing files without TOCTOU issues.
@@ -81,6 +83,22 @@ async function ensureProfileManagerInitialized(): Promise<
  }
 }

+/**
+ * Get the spec directory for file watching, preferring the worktree path if it exists.
+ * When a task runs in a worktree, implementation_plan.json is written there,
+ * not in the main project's spec directory.
+ */
+function getSpecDirForWatcher(projectPath: string, specsBaseDir: string, specId: string): string {
+  const worktreePath = findTaskWorktree(projectPath, specId);
+  if (worktreePath) {
+    const worktreeSpecDir = path.join(worktreePath, specsBaseDir, specId);
+    if (existsSync(path.join(worktreeSpecDir, 'implementation_plan.json'))) {
+      return worktreeSpecDir;
+    }
+  }
+  return path.join(projectPath, specsBaseDir, specId);
+}
+
 /**
 * Register task execution handlers (start, stop, review, status management, recovery)
 */
@@ -95,6 +113,11 @@ export function registerTaskExecutionHandlers(
    IPC_CHANNELS.TASK_START,
    async (_, taskId: string, _options?: TaskStartOptions) => {
      console.warn('[TASK_START] Received request for taskId:', taskId);
+
+      // Cancel any pending fallback timer from previous process exit
+      // This prevents the stale timer from incorrectly stopping the newly restarted task
+      cancelFallbackTimer(taskId);
+
      const mainWindow = getMainWindow();
      if (!mainWindow) {
        console.warn('[TASK_START] No main window found');
@@ -161,6 +184,31 @@ export function registerTaskExecutionHandlers(

      console.warn('[TASK_START] Found task:', task.specId, 'status:', task.status, 'reviewReason:', task.reviewReason, 'subtasks:', task.subtasks.length);

+      // Clear stale tracking state from any previous execution so that:
+      // - terminalEventSeen doesn't suppress future PROCESS_EXITED events
+      // - lastSequenceByTask doesn't drop events from the new process
+      taskStateManager.prepareForRestart(taskId);
+
+      // Check if implementation_plan.json has valid subtasks BEFORE XState handling.
+      // This is more reliable than task.subtasks.length which may not be loaded yet.
+      const specsBaseDir = getSpecsDir(project.autoBuildPath);
+      const specDir = path.join(
+        project.path,
+        specsBaseDir,
+        task.specId
+      );
+      const planFilePath = path.join(specDir, AUTO_BUILD_PATHS.IMPLEMENTATION_PLAN);
+      let planHasSubtasks = false;
+      const planContent = safeReadFileSync(planFilePath);
+      if (planContent) {
+        try {
+          const plan = JSON.parse(planContent);
+          planHasSubtasks = checkSubtasksCompletion(plan).totalCount > 0;
+        } catch {
+          // Invalid/corrupt plan file - treat as no subtasks
+        }
+      }
+
      // Immediately mark as started so the UI moves the card to In Progress.
      // Use XState actor state as source of truth (if actor exists), with task data as fallback.
      // - plan_review: User approved the plan, send PLAN_APPROVED to transition to coding
@@ -173,6 +221,11 @@ export function registerTaskExecutionHandlers(
        // XState says plan_review - send PLAN_APPROVED
        console.warn('[TASK_START] XState: plan_review -> coding via PLAN_APPROVED');
        taskStateManager.handleUiEvent(taskId, { type: 'PLAN_APPROVED' }, task, project);
+      } else if (currentXState === 'error' && !planHasSubtasks) {
+        // FIX (#1562): Task crashed during planning (no subtasks yet).
+        // Uses planHasSubtasks from implementation_plan.json (more reliable than task.subtasks.length).
+        console.warn('[TASK_START] XState: error with no plan subtasks -> planning via PLANNING_STARTED');
+        taskStateManager.handleUiEvent(taskId, { type: 'PLANNING_STARTED' }, task, project);
      } else if (currentXState === 'human_review' || currentXState === 'error') {
        // XState says human_review or error - send USER_RESUMED
        console.warn('[TASK_START] XState:', currentXState, '-> coding via USER_RESUMED');
@@ -186,6 +239,11 @@ export function registerTaskExecutionHandlers(
        // No XState actor - fallback to task data (e.g., after app restart)
        console.warn('[TASK_START] No XState actor, task data: plan_review -> coding via PLAN_APPROVED');
        taskStateManager.handleUiEvent(taskId, { type: 'PLAN_APPROVED' }, task, project);
+      } else if (task.status === 'error' && !planHasSubtasks) {
+        // FIX (#1562): No XState actor, task crashed during planning (no subtasks).
+        // Uses planHasSubtasks from implementation_plan.json (more reliable than task.subtasks.length).
+        console.warn('[TASK_START] No XState actor, error with no plan subtasks -> planning via PLANNING_STARTED');
+        taskStateManager.handleUiEvent(taskId, { type: 'PLANNING_STARTED' }, task, project);
      } else if (task.status === 'human_review' || task.status === 'error') {
        // No XState actor - fallback to task data for resuming
        console.warn('[TASK_START] No XState actor, task data:', task.status, '-> coding via USER_RESUMED');
@@ -205,24 +263,27 @@ export function registerTaskExecutionHandlers(
      }

      // Start file watcher for this task
-      const specsBaseDir = getSpecsDir(project.autoBuildPath);
-      const specDir = path.join(
-        project.path,
-        specsBaseDir,
-        task.specId
-      );
-      fileWatcher.watch(taskId, specDir);
+      // Use worktree path if it exists, since the backend writes implementation_plan.json there
+      const watchSpecDir = getSpecDirForWatcher(project.path, specsBaseDir, task.specId);
+      fileWatcher.watch(taskId, watchSpecDir).catch((err) => {
+        console.error(`[TASK_START] Failed to watch spec dir for ${taskId}:`, err);
+      });

      // Check if spec.md exists (indicates spec creation was already done or in progress)
+      // Check main project path for spec file (spec is created before worktree)
      const specFilePath = path.join(specDir, AUTO_BUILD_PATHS.SPEC_FILE);
      const hasSpec = existsSync(specFilePath);

      // Check if this task needs spec creation first (no spec file = not yet created)
      // OR if it has a spec but no implementation plan subtasks (spec created, needs planning/building)
      const needsSpecCreation = !hasSpec;
-      const needsImplementation = hasSpec && task.subtasks.length === 0;
+      // FIX (#1562): Check actual plan file for subtasks, not just task.subtasks.length.
+      // When a task crashes during planning, it may have spec.md but an empty/missing
+      // implementation_plan.json. Previously, this path would call startTaskExecution
+      // (run.py) which expects subtasks to exist. Now we check the actual plan file.
+      const needsImplementation = hasSpec && !planHasSubtasks;

-      console.warn('[TASK_START] hasSpec:', hasSpec, 'needsSpecCreation:', needsSpecCreation, 'needsImplementation:', needsImplementation);
+      console.warn('[TASK_START] hasSpec:', hasSpec, 'planHasSubtasks:', planHasSubtasks, 'needsSpecCreation:', needsSpecCreation, 'needsImplementation:', needsImplementation);

      // Get base branch: task-level override takes precedence over project settings
      const baseBranch = task.metadata?.baseBranch || project.settings?.mainBranch;
@@ -237,18 +298,12 @@ export function registerTaskExecutionHandlers(
        // Also pass baseBranch so worktrees are created from the correct branch
        agentManager.startSpecCreation(taskId, project.path, taskDescription, specDir, task.metadata, baseBranch, project.id);
      } else if (needsImplementation) {
-        // Spec exists but no subtasks - run run.py to create implementation plan and execute
-        // Read the spec.md to get the task description
-        const _taskDescription = task.description || task.title;
-        try {
-          readFileSync(specFilePath, 'utf-8');
-        } catch {
-          // Use default description
-        }
-
-        console.warn('[TASK_START] Starting task execution (no subtasks) for:', task.specId);
-        // Start task execution which will create the implementation plan
-        // Note: No parallel mode for planning phase - parallel only makes sense with multiple subtasks
+        // Spec exists but no valid subtasks in implementation plan
+        // FIX (#1562): Use startTaskExecution (run.py) which will create the planner
+        // agent session to generate the implementation plan. run.py handles the case
+        // where implementation_plan.json is missing or has no subtasks - the planner
+        // agent will generate the plan before the coder starts.
+        console.warn('[TASK_START] Starting task execution (no valid subtasks in plan) for:', task.specId);
        agentManager.startTaskExecution(
          taskId,
          project.path,
@@ -289,25 +344,17 @@ export function registerTaskExecutionHandlers(
   */
  ipcMain.on(IPC_CHANNELS.TASK_STOP, (_, taskId: string) => {
    agentManager.killTask(taskId);
-    fileWatcher.unwatch(taskId);
+    fileWatcher.unwatch(taskId).catch((err) => {
+      console.error('[TASK_STOP] Failed to unwatch:', err);
+    });

    // Find task and project to emit USER_STOPPED with plan context
    const { task, project } = findTaskAndProject(taskId);

    if (!task || !project) return;

-    let hasPlan = false;
-    try {
-      const planPath = getPlanPath(project, task);
-      const planContent = safeReadFileSync(planPath);
-      if (planContent) {
-        const plan = JSON.parse(planContent);
-        const { totalCount } = checkSubtasksCompletion(plan);
-        hasPlan = totalCount > 0;
-      }
-    } catch {
-      hasPlan = false;
-    }
+    // Use shared utility to determine if a valid implementation plan exists
+    const hasPlan = hasPlanWithSubtasks(project, task);

    taskStateManager.handleUiEvent(
      taskId,
@@ -315,6 +362,9 @@ export function registerTaskExecutionHandlers(
      task,
      project
    );
+
+    // Clear stale tracking state so a subsequent restart works correctly
+    taskStateManager.prepareForRestart(taskId);
  });

  /**
@@ -484,6 +534,9 @@ export function registerTaskExecutionHandlers(
          return { success: false, error: 'Failed to write QA fix request file' };
        }

+        // Clear stale tracking state before starting new QA process
+        taskStateManager.prepareForRestart(taskId);
+
        // Restart QA process - use worktree path if it exists, otherwise main project
        // The QA process needs to run where the implementation_plan.json with completed subtasks is
        const qaProjectPath = hasWorktree ? worktreePath : project.path;
@@ -513,7 +566,7 @@ export function registerTaskExecutionHandlers(
      _,
      taskId: string,
      status: TaskStatus,
-      options?: { forceCleanup?: boolean }
+      options?: { forceCleanup?: boolean; keepWorktree?: boolean }
    ): Promise<IPCResult & { worktreeExists?: boolean; worktreePath?: string }> => {
      // Find task and project first (needed for worktree check)
      const { task, project } = findTaskAndProject(taskId);
@@ -525,13 +578,17 @@ export function registerTaskExecutionHandlers(
      // Validate status transition - 'done' can only be set through merge handler
      // UNLESS there's no worktree (limbo state - already merged/discarded or failed)
      // OR forceCleanup is requested (user confirmed they want to delete the worktree)
+      // OR keepWorktree is requested (user wants to mark done without deleting worktree)
      if (status === 'done') {
        // Check if worktree exists (task.specId matches worktree folder name)
        const worktreePath = findTaskWorktree(project.path, task.specId);
        const hasWorktree = worktreePath !== null;

        if (hasWorktree) {
-          if (options?.forceCleanup) {
+          if (options?.keepWorktree) {
+            // User explicitly chose to keep worktree - allow marking as done
+            console.warn(`[TASK_UPDATE_STATUS] Marking task ${taskId} as done while keeping worktree at ${worktreePath}`);
+          } else if (options?.forceCleanup) {
            // User confirmed cleanup - delete worktree and branch
            console.warn(`[TASK_UPDATE_STATUS] Cleaning up worktree for task ${taskId} (user confirmed)`);
            try {
@@ -658,6 +715,8 @@ export function registerTaskExecutionHandlers(

        // Auto-start task when status changes to 'in_progress' and no process is running
        if (status === 'in_progress' && !agentManager.isRunning(taskId)) {
+          // Clear stale tracking state before starting a new process
+          taskStateManager.prepareForRestart(taskId);
          const mainWindow = getMainWindow();

          // Check git status before auto-starting
@@ -702,6 +761,10 @@ export function registerTaskExecutionHandlers(

          console.warn('[TASK_UPDATE_STATUS] Auto-starting task:', taskId);

+          // Cancel any pending fallback timer from previous process exit
+          // This prevents the stale timer from incorrectly stopping the newly started task
+          cancelFallbackTimer(taskId);
+
          // Reset any stuck subtasks before starting execution
          // This handles recovery from previous rate limits or crashes
          const resetResult = await resetStuckSubtasks(planPath, project.id);
@@ -710,13 +773,29 @@ export function registerTaskExecutionHandlers(
          }

          // Start file watcher for this task
-          fileWatcher.watch(taskId, specDir);
+          // Use worktree path if it exists, since the backend writes implementation_plan.json there
+          const watchSpecDir = getSpecDirForWatcher(project.path, specsBaseDir, task.specId);
+          fileWatcher.watch(taskId, watchSpecDir).catch((err) => {
+            console.error(`[TASK_UPDATE_STATUS] Failed to watch spec dir for ${taskId}:`, err);
+          });

          // Check if spec.md exists
          const specFilePath = path.join(specDir, AUTO_BUILD_PATHS.SPEC_FILE);
          const hasSpec = existsSync(specFilePath);
          const needsSpecCreation = !hasSpec;
-          const needsImplementation = hasSpec && task.subtasks.length === 0;
+          // FIX (#1562): Check actual plan file for subtasks, not just task.subtasks.length
+          const updatePlanFilePath = path.join(specDir, AUTO_BUILD_PATHS.IMPLEMENTATION_PLAN);
+          let updatePlanHasSubtasks = false;
+          const updatePlanContent = safeReadFileSync(updatePlanFilePath);
+          if (updatePlanContent) {
+            try {
+              const plan = JSON.parse(updatePlanContent);
+              updatePlanHasSubtasks = checkSubtasksCompletion(plan).totalCount > 0;
+            } catch {
+              // Invalid/corrupt plan file - treat as no subtasks
+            }
+          }
+          const needsImplementation = hasSpec && !updatePlanHasSubtasks;

          console.warn('[TASK_UPDATE_STATUS] hasSpec:', hasSpec, 'needsSpecCreation:', needsSpecCreation, 'needsImplementation:', needsImplementation);

@@ -1062,14 +1141,64 @@ export function registerTaskExecutionHandlers(
          }

          console.log(`[Recovery] Total ${totalResetCount} subtask(s) reset across all locations`);
+
+          // Clear attempt_history.json to break infinite recovery loops.
+          // Without this, the backend re-reads stuck markers from attempt_history
+          // and immediately re-stucks the same subtasks after recovery.
+          const specDirsToClean = new Set<string>([specDir]);
+          if (mainSpecDir !== specDir) specDirsToClean.add(mainSpecDir);
+          if (worktreeSpecDir && worktreeSpecDir !== specDir) specDirsToClean.add(worktreeSpecDir);
+
+          for (const dir of specDirsToClean) {
+            const attemptHistoryPath = path.join(dir, 'memory', 'attempt_history.json');
+            const historyContent = safeReadFileSync(attemptHistoryPath);
+            if (!historyContent) continue;
+
+            try {
+              const history = JSON.parse(historyContent);
+
+              // Collect stuck subtask IDs before clearing
+              const stuckIds = new Set<string>(
+                (history.stuck_subtasks || [])
+                  .map((s: { subtask_id?: string }) => s.subtask_id)
+                  .filter((id: string | undefined): id is string => Boolean(id))
+              );
+
+              // Clear stuck_subtasks array
+              history.stuck_subtasks = [];
+
+              // Reset attempt entries for previously-stuck subtasks
+              if (history.subtasks && stuckIds.size > 0) {
+                for (const stuckId of stuckIds) {
+                  if (history.subtasks[stuckId]) {
+                    history.subtasks[stuckId] = { attempts: [], status: 'pending' };
+                  }
+                }
+              }
+
+              history.metadata = {
+                ...history.metadata,
+                last_updated: new Date().toISOString()
+              };
+
+              writeFileAtomicSync(attemptHistoryPath, JSON.stringify(history, null, 2));
+              console.log(`[Recovery] Cleared attempt_history.json at: ${dir} (reset ${stuckIds.size} stuck entries)`);
+            } catch (historyErr) {
+              console.warn(`[Recovery] Could not parse attempt_history at ${dir}:`, historyErr);
+            }
+          }
        }

        // Stop file watcher if it was watching this task
-        fileWatcher.unwatch(taskId);
+        fileWatcher.unwatch(taskId).catch((err) => {
+          console.error('[TASK_RECOVER_STUCK] Failed to unwatch:', err);
+        });

        // Auto-restart the task if requested
        let autoRestarted = false;
        if (autoRestart) {
+          // Clear stale tracking state before restarting
+          taskStateManager.prepareForRestart(taskId);
          // Check git status before auto-restarting
          const gitStatusForRestart = checkGitStatus(project.path);
          if (!gitStatusForRestart.isGitRepo || !gitStatusForRestart.hasCommits) {
@@ -1120,6 +1249,10 @@ export function registerTaskExecutionHandlers(
          }

          try {
+            // Cancel any pending fallback timer from previous process exit
+            // This prevents the stale timer from incorrectly stopping the restarted task
+            cancelFallbackTimer(taskId);
+
            // Set status to in_progress for the restart
            newStatus = 'in_progress';

@@ -1146,12 +1279,16 @@ export function registerTaskExecutionHandlers(

            // Start the task execution
            // Start file watcher for this task
-            const specsBaseDir = getSpecsDir(project.autoBuildPath);
-            const specDirForWatcher = path.join(project.path, specsBaseDir, task.specId);
-            fileWatcher.watch(taskId, specDirForWatcher);
+            // Use worktree path if it exists, since the backend writes implementation_plan.json there
+            const watchSpecDir = getSpecDirForWatcher(project.path, specsBaseDir, task.specId);
+            fileWatcher.watch(taskId, watchSpecDir).catch((err) => {
+              console.error(`[Recovery] Failed to watch spec dir for ${taskId}:`, err);
+            });

            // Check if spec.md exists to determine whether to run spec creation or task execution
-            const specFilePath = path.join(specDirForWatcher, AUTO_BUILD_PATHS.SPEC_FILE);
+            // Check main project path for spec file (spec is created before worktree)
+            // mainSpecDir is declared earlier in the handler scope
+            const specFilePath = path.join(mainSpecDir, AUTO_BUILD_PATHS.SPEC_FILE);
            const hasSpec = existsSync(specFilePath);
            const needsSpecCreation = !hasSpec;

@@ -1162,7 +1299,7 @@ export function registerTaskExecutionHandlers(
              // No spec file - need to run spec_runner.py to create the spec
              const taskDescription = task.description || task.title;
              console.warn(`[Recovery] Starting spec creation for: ${task.specId}`);
-              agentManager.startSpecCreation(taskId, project.path, taskDescription, specDirForWatcher, task.metadata, baseBranchForRecovery, project.id);
+              agentManager.startSpecCreation(taskId, project.path, taskDescription, mainSpecDir, task.metadata, baseBranchForRecovery, project.id);
            } else {
              // Spec exists - run task execution
              console.warn(`[Recovery] Starting task execution for: ${task.specId}`);
--- a/Show More
+++ b/Show More