feat: add project auto-pull and compaction timeline dividers

[ronak-guliani]

Summary

• Add an opt-in Automatically pull switch under the sidebar project menu → Project settings. Grouped projects let you select the environment to configure.
• Persist autoPull through commands, events, SQL projections, snapshots, and the web store. Migration 083 is idempotent and defaults existing projects to off.
• Share a guarded pull operation across a non-blocking startup sweep, enabling the setting, and existing monitored Git-status refreshes. Refresh both local and remote status after a pull.
• Require a clean default branch with an upstream, no local commits, and no active or queued agent turns using that canonical checkout. Recheck branch, HEAD, upstream, and local work before mutation; explicitly detect hidden untracked/submodule changes and disable autostash. Deduplicate concurrent automatic attempts and back off logged failures.

Adapted from pingdotgg#9277 to this fork’s Git services rather than cherry-picking the upstream VCS refactor.

Behavior and limitations

Only the configured project checkout is updated, not feature branches or other worktrees. Background attempts use existing status monitoring; unopened projects are not continuously polled. Internal turn admission and logical Git operations share a checkout reservation. External terminals, other server processes, and detached provider commands that outlive their turn do not participate, so this is not an atomic filesystem guarantee against external writers. Pulls are fast-forward only: no stash, reset, branch switch, or conflict resolution.

Testing

• pnpm fmt:check, pnpm lint, pnpm typecheck.
• Targeted Vite Plus suite: 87 passing tests covering real Git repositories, startup/enabling triggers, concurrent aliases, failure backoff, dirty/untracked/divergent checkouts, active-agent isolation, migration replay, snapshot hydration, web-store events, and full runtime construction.
• Existing Git RPC paths plus migration: 6 passing selected tests.
• Built web client and exercised the real browser against a workspace-isolated server and local bare Git upstream: enable → checkout advances → reload retains enabled setting → disable. No page errors or failed requests in that pass.
• Collaborative browser inspection was attempted first; its resize/capture path failed, so the final end-to-end pass and screenshot used the existing Playwright installation.

Screenshot

Context compaction

Also adapts the upstream compaction divider UI from pingdotgg#9293. Manual and automatic provider-reported compactions render a muted separator with the inward-arrow icon. Compaction rows remain visible outside collapsed reasoning and work groups, and are included in chat search.

Claude compact boundaries retain valid provider-reported token counts. Completed modern Codex context-compaction items now produce the canonical compaction event, alongside existing legacy notification support. When both counts exist, the caption reads Compacted context 173K → 5.69K tokens; otherwise it reads Compacted context. Existing stored compaction activities receive the new presentation too.

This does not introduce a /compact command or infer compaction from falling token usage. Providers without an explicit compaction notification cannot produce this marker.

Compaction validation

• Required formatting, lint, and type checks pass.
• All 297 tests in the six affected provider, ingestion, session-logic, and timeline suites pass, including missing, zero, and invalid token counts.
• Built-client Chromium pass against isolated projection fixtures covers counted and fallback captions, visibility outside collapsed reasoning, chat search, reload, and a 390px viewport without horizontal overflow. No page errors, console errors, or failed requests.
• The screenshot is a local UI fixture, not a live provider compaction. The collaborative browser snapshot timed out, so this pass used the existing Playwright installation.

Compaction screenshot

Checkout coordination

Implemented in bb80aca9b. One shared, process-local coordinator keys reservations by canonical Git checkout root, including symlink and subdirectory aliases. Automatic pulls try-acquire and skip a busy checkout; foreground operations wait for an existing pull. Idle lock entries are removed.

The reservation covers direct and queued turn admission through the pending-state/read-model commit, checkpoint HEAD/worktree/temp-index/real-index snapshots and restores, GitManager stacked actions and PR preparation, both Git and VCS mutation RPCs, bootstrap worktree creation, provider branch renames, and worktree cleanup. GitCore stays an unlocked implementation detail so composed operations do not acquire the same lock recursively.

Turn activity remains owned by the authoritative read model and provider sessions, not a second turn state machine. Ingestion registers an event-keyed finalization exclusion before publishing an idle session. The checkpoint worker retains it across the completion receipt wait and clears it on its terminal outcome, including failure. Both configured and actual provider checkouts are protected during handoff.

No checkout mutex spans orchestration dispatch, ingestion receipt waits, provider startup, or setup dispatch. Reservations release on interruption. On restart, process-local exclusions disappear and existing startup session reconciliation finishes before automatic pulls start. The coordinator does not replay interrupted checkpoint work. Separate worktrees retain independent file/index locks; Git owns shared-ref locking.

Coordination validation

• pnpm fmt:check, pnpm lint, and pnpm typecheck pass.
• 277 tests pass across 13 focused Git, checkpoint, lifecycle, restart-reconciliation, and full-runtime suites. Another 94 server RPC tests pass.
• Deferred-gated regressions cover both acquisition orders, queued admission, the completion-to-capture interval, successful and failed finalization, consistent snapshot/restore sequences, interruption release, canonical aliases, rebuilt runtime state, and command-worker deadlock prevention.
• The final source backend was restarted against worktree-isolated state. The real built client enabled auto-pull, advanced a disposable checkout to a new local-bare-upstream commit, retained the setting across reload, and disabled it again. No page errors or failed requests in that pass. The screenshot above comes from this run.
• Collaborative browser status/open/snapshot was attempted first. Pairing failed and a subsequent snapshot timed out; the successful pass used the existing Playwright installation.

The shared-mutation implementation blocker is addressed. CI for the new head is still pending; this does not claim the PR is ready to merge.

Completion handoff follow-up

Fixed the startup-subscription gap in 154d21a3a. Ingestion now owns the only provider runtime subscription and hands processed events directly to the existing checkpoint queue. Queue acceptance is included in ingestion drain; capture stays independently queued. The checkpoint domain subscription starts first, but correctness does not rely on provider subscriber ordering.

Exclusion ownership transfers without an interruption gap. Failed handoffs, terminal capture outcomes, worker cancellation with queued completions, and late handoffs during shutdown all release their exclusions. No checkout mutex spans dispatch or ingestion receipt waits.

• 134 tests pass across seven focused lifecycle, checkpoint, ingestion, checkout, auto-pull, restart-reconciliation, and full-server suites.
• Startup-gap success/failure tests assert one subscription and one capture. Disabling the owned handoff makes both regressions fail.
• Cancellation coverage includes ingestion, handoff, receipt waits, active capture, queued completions, and post-shutdown handoff.
• pnpm fmt:check, pnpm lint, and pnpm typecheck pass.
• Replied inline to comment 3942335755 and resolved its thread after pushing. CI for this head is pending.

[Copilot]

🟡 Changes recommended

Pending turns can be misclassified as idle, and automatic pulls are not coordinated with other internal checkout mutations.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds opt-in automatic fast-forward pulls for idle default-branch project checkouts.

Changes:

• Persists and exposes the autoPull project setting.
• Adds guarded startup, enablement, and monitored-status pull triggers.
• Adds documentation and tests for migration, hydration, and Git behavior.

File summaries

File	Description
scars.md	Documents automatic Git mutation safeguards.
packages/contracts/src/orchestration.ts	Adds autoPull to project contracts.
docs/project-auto-pull.md	Documents behavior and limitations.
apps/web/src/types.ts	Extends the web project model.
apps/web/src/store.ts	Hydrates and reduces the setting.
apps/web/src/store.test.ts	Tests web-store persistence.
apps/web/src/components/sidebar/ProjectDialogs.tsx	Adds the settings switch.
apps/web/src/components/Sidebar.tsx	Connects settings UI to commands.
apps/server/src/serverRuntimeStartup.ts	Starts the background sweep.
apps/server/src/server.ts	Wires the auto-pull service layer.
apps/server/src/server.test.ts	Updates server test dependencies.
apps/server/src/persistence/Services/ProjectionProjects.ts	Extends the projection schema.
apps/server/src/persistence/Migrations/083_ProjectionProjectsAutoPull.ts	Adds the database column.
apps/server/src/persistence/Migrations/083_ProjectionProjectsAutoPull.test.ts	Tests migration replay.
apps/server/src/persistence/Migrations.ts	Registers migration 083.
apps/server/src/persistence/Layers/ProjectionProjects.ts	Reads and writes auto_pull.
apps/server/src/orchestration/projector.ts	Projects setting events.
apps/server/src/orchestration/Layers/ProjectionSnapshotQuery.ts	Includes the setting in snapshots.
apps/server/src/orchestration/Layers/ProjectionSnapshotQuery.test.ts	Tests snapshot hydration.
apps/server/src/orchestration/Layers/ProjectionPipeline.ts	Persists setting changes.
apps/server/src/orchestration/decider.ts	Emits setting updates.
apps/server/src/orchestration/decider.autoPull.test.ts	Tests command/event handling.
apps/server/src/git/ProjectAutoPull.ts	Implements guarded automatic pulls.
apps/server/src/git/ProjectAutoPull.test.ts	Tests pull eligibility and backoff.
apps/server/src/git/Layers/GitStatusBroadcaster.ts	Integrates pulls with status refreshes.
apps/server/src/git/Layers/GitStatusBroadcaster.test.ts	Updates broadcaster fixtures.

Review details

• Files reviewed: 26/26 changed files
• Comments generated: 4
• Review effort level: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The acknowledged checkout-coordination gap still allows agent starts and manual Git mutations to race an automatic pull.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 40/40 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

🟡 Changes recommended

A provider event received between lifecycle subscriptions can leave a checkout permanently marked as finalizing until restart.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 56/56 changed files
• Comments generated: 1
• Review effort level: Balanced

[ronak-guliani]

Confirmed GitHub reports this branch conflicts with main. Disposition: needs-human approval to merge main into the PR branch and resolve conflicts, per the monitor policy prohibiting merges without explicit approval. No branch changes made. The monitor context/report tools were unavailable during tool discovery, so this disposition is recorded here instead.

[ronak-guliani]

Merged origin/main into this branch and pushed e398278. The PR itself was not merged.

Resolved the snapshot test imports and retained both scars. Preserved project auto-pull, compaction dividers, checkout coordination, and the ingestion-owned checkpoint handoff alongside main’s bounded, transactional snapshot reads.

Both histories used migration 083. The registry retains main’s message-sequence migration at 083 and appends idempotent repair 084, which ensures both schemas without rewriting existing ledger entries. Regression tests cover fresh databases and either historical 083 name, retained enabled auto-pull values, retained message sequences, backfill, indexes, and replay.

Validation: pnpm fmt:check, pnpm lint, and pnpm typecheck pass. Lint reports five existing unused-import warnings in packages/contracts/src/ipc.ts. All 267 targeted tests pass across 11 suites covering migrations, snapshots, projection persistence/bootstrap, auto-pull, ingestion, checkpoints, lifecycle, and server runtime integration.

GitHub now reports MERGEABLE for this head. CI is queued/running, so this is not a ready-to-merge claim. Working tree is clean.

The monitor context tool was available, but its response exceeded the tool output limit before exposing finding IDs. No monitor disposition was changed; this comment records the resolution explicitly.