@a-t-h-i/bot-lobby 0.6.18 → 0.6.20

package/src/delivery/rules.ts

@@ -0,0 +1,46 @@
+import { api, object, pages, strings, type DeliveryContext } from "./transport.ts";
+
+export interface Rules { known: boolean; required: string[]; policies: unknown[]; blocked?: string }
+function effective(raw: unknown, required: Set<string>): string | undefined {
+  const rule = object(raw);
+  if (typeof rule.type !== "string") throw new Error("Malformed repository rule.");
+  if (["deletion", "non_fast_forward"].includes(rule.type)) return undefined;
+  if (rule.type !== "required_status_checks") return `Repository rule ${rule.type} prohibits or cannot safely authorize direct pushes. Use a PR or ask a repository administrator.`;
+  const params = object(rule.parameters);
+  if (typeof params.strict_required_status_checks_policy !== "boolean" || !Array.isArray(params.required_status_checks)) throw new Error("Malformed required status rule.");
+  for (const rawCheck of params.required_status_checks) {
+    const check = object(rawCheck);
+    if (typeof check.context !== "string" || !check.context.trim()) throw new Error("Malformed required check context.");
+    if (check.integration_id !== null && check.integration_id !== undefined) throw new Error("App-bound required checks need verified app identity; use a PR.");
+    required.add(check.context);
+  }
+}
+function legacy(raw: unknown, required: Set<string>): string | undefined {
+  const rule = object(raw);
+  if (rule.required_status_checks !== null) {
+    const checks = object(rule.required_status_checks);
+    if (typeof checks.strict !== "boolean") throw new Error("Malformed legacy status policy.");
+    strings(checks.contexts).forEach((name) => required.add(name));
+    if (!Array.isArray(checks.checks)) throw new Error("Missing required check bindings.");
+    for (const value of checks.checks) { const check = object(value); if (check.app_id !== null) throw new Error("App-bound legacy checks require verified app identity; use a PR."); }
+  }
+  const linear = object(rule.required_linear_history);
+  const signatures = object(rule.required_signatures);
+  if (typeof linear.enabled !== "boolean" || typeof signatures.enabled !== "boolean") throw new Error("Unknown branch protection policy.");
+  if (rule.required_pull_request_reviews !== null || rule.restrictions !== null || linear.enabled || signatures.enabled) return "Branch protection requires PR/review, restricted pushes, linear history or signed commits; use a PR. No bypass is attempted.";
+  if (rule.lock_branch && object(rule.lock_branch).enabled !== false) return "Main is locked; ask a repository administrator.";
+}
+export async function readRules(ctx: DeliveryContext, repo: string): Promise<Rules> {
+  try {
+    const branch = object(await api(ctx, `repos/${repo}/branches/main`));
+    if (branch.name !== "main" || typeof branch.protected !== "boolean") throw new Error("Malformed main branch response.");
+    const policies = await pages(ctx, `repos/${repo}/rules/branches/main`);
+    const required = new Set<string>();
+    const reasons = policies.map((raw) => effective(raw, required)).filter(Boolean);
+    if (branch.protected) {
+      const protection = await api(ctx, `repos/${repo}/branches/main/protection`);
+      policies.push(protection); reasons.push(legacy(protection, required));
+    }
+    return { known: true, required: [...required].sort(), policies, blocked: reasons.filter(Boolean).join(" ") || undefined };
+  } catch (error) { return { known: false, required: [], policies: [], blocked: `${(error as Error).message} Repository rules must be verified before merging; refresh review or use a PR.` }; }
+}

package/src/delivery/source.ts

@@ -0,0 +1,39 @@
+import { realpathSync } from "node:fs";
+import { resolve, isAbsolute } from "node:path";
+import type { Task } from "../schemas/task.ts";
+import { command, type DeliveryContext } from "./transport.ts";
+
+export interface Source { repository: string; remote: string; github: string; branch: string; commit: string; cwd: string }
+export function sha(value: string): string {
+  if (!/^[a-f0-9]{40}$/.test(value)) throw new Error("Missing or invalid commit identity; commit completed work and refresh review.");
+  return value;
+}
+function githubRemote(remote: string): string {
+  const match = /^(?:https:\/\/github\.com\/|git@github\.com:)([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+?)(?:\.git)?$/.exec(remote);
+  if (!match?.[1] || match[1].split("/").some((v) => v === "." || v === "..")) throw new Error("Origin must identify a GitHub repository without credentials; configure origin and refresh review.");
+  return match[1];
+}
+async function common(ctx: DeliveryContext): Promise<string> {
+  const dir = await command(ctx, "git", ["rev-parse", "--git-common-dir"]);
+  return realpathSync(resolve(ctx.cwd, dir));
+}
+export async function readSource(task: Task, ctx: DeliveryContext): Promise<Source> {
+  if (!task.git) throw new Error("Task has no Git isolation. Preserve the completed work and configure a task branch before delivery.");
+  const branch = task.git.branch;
+  if (!branch || branch === "main" || branch.startsWith("-") || /[\s\x00-\x1f]/.test(branch)) throw new Error("Invalid task branch; delivery cannot use main as its source.");
+  await command(ctx, "git", ["check-ref-format", "--branch", branch]);
+  const repository = await common(ctx);
+  const path = task.git.mode === "worktree" ? task.git.path : ctx.cwd;
+  if (!path || !isAbsolute(path)) throw new Error("Task working directory is missing; restore its isolated worktree.");
+  const sourceCtx = { ...ctx, cwd: realpathSync(path) };
+  if (await common(sourceCtx) !== repository) throw new Error("Task worktree belongs to a different repository; restore isolation.");
+  if (await command(sourceCtx, "git", ["symbolic-ref", "--short", "HEAD"]) !== branch) throw new Error("Task branch is not checked out in its working directory; restore it and refresh review.");
+  if (await command(sourceCtx, "git", ["status", "--porcelain"])) throw new Error("Task source has uncommitted changes. Commit only completed task work, then refresh review.");
+  const commit = sha(await command(sourceCtx, "git", ["rev-parse", `refs/heads/${branch}^{commit}`]));
+  const remote = await command(sourceCtx, "git", ["remote", "get-url", "origin"]);
+  return { repository, remote, github: githubRemote(remote), branch, commit, cwd: sourceCtx.cwd };
+}
+export async function refreshMain(ctx: DeliveryContext): Promise<string> {
+  await command(ctx, "git", ["fetch", "--no-tags", "origin", "+refs/heads/main:refs/remotes/origin/main"]);
+  return sha(await command(ctx, "git", ["rev-parse", "refs/remotes/origin/main^{commit}"]));
+}

package/src/delivery/transport.ts

@@ -0,0 +1,36 @@
+import type { Exec } from "../lobby/issues.ts";
+
+export interface DeliveryContext { exec: Exec; cwd: string }
+export async function command(ctx: DeliveryContext, tool: string, args: string[]): Promise<string> {
+  const result = await ctx.exec(tool, args, { cwd: ctx.cwd, timeout: 20_000 });
+  if (result.code !== 0) throw new Error(`${tool} lookup failed; check remote access and authentication, then refresh review.`);
+  return result.stdout.trim();
+}
+export async function api(ctx: DeliveryContext, endpoint: string): Promise<unknown> {
+  const text = await command(ctx, "gh", ["api", endpoint]);
+  try { return JSON.parse(text); }
+  catch { throw new Error("GitHub returned malformed JSON; refresh review after connectivity recovers."); }
+}
+export function object(value: unknown): Record<string, unknown> {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Malformed GitHub response; refresh review.");
+  return value as Record<string, unknown>;
+}
+export function strings(value: unknown): string[] {
+  if (!Array.isArray(value) || value.some((v) => typeof v !== "string" || !v.trim())) throw new Error("Malformed required check names.");
+  return value as string[];
+}
+export async function pages(ctx: DeliveryContext, endpoint: string, key?: string): Promise<unknown[]> {
+  const all: unknown[] = [];
+  for (let page = 1; page <= 100; page++) {
+    const raw = await api(ctx, `${endpoint}?per_page=100&page=${page}`);
+    const rows = key ? object(raw)[key] : raw;
+    if (!Array.isArray(rows) || rows.length > 100) throw new Error("Malformed GitHub pagination; refresh review.");
+    if (key && (!Number.isInteger(object(raw).total_count) || Number(object(raw).total_count) < all.length + rows.length)) throw new Error("Malformed check count.");
+    all.push(...rows);
+    if (rows.length < 100) {
+      if (key && object(raw).total_count !== all.length) throw new Error("Incomplete check pagination; refresh review.");
+      return all;
+    }
+  }
+  throw new Error("GitHub pagination exceeds safety limit; review checks manually.");
+}

package/src/delivery/types.ts

@@ -0,0 +1,60 @@
+/** Persisted delivery review contract; completion and publication are separate. */
+export type DeliveryStatus = "pending_approval" | "deferred" | "in_progress" | "successful" | "recoverable_failure";
+export type DeliveryAction = "create_pr" | "merge_main";
+export type DeliveryChecksState = "passing" | "failing" | "pending" | "absent" | "unavailable" | "stale";
+
+export interface DeliveryVerification {
+  checks: DeliveryChecksState;
+  summary: string;
+  localVerified: boolean;
+  requiredChecks: string[];
+  rulesKnown: boolean;
+}
+
+export interface DeliveryOperation {
+  id: string;
+  action: DeliveryAction;
+  sourceCommit: string;
+  repository?: string;
+  remote?: string;
+  sourceBranch?: string;
+  target?: "main";
+  fingerprint?: string;
+  reviewId?: string;
+  integrationPath?: string;
+  targetCommit?: string;
+  stage: string;
+  mergeCommit?: string;
+  pullNumber?: number;
+  pullUrl?: string;
+  startedAt: string;
+}
+
+export interface DeliveryResult {
+  action: DeliveryAction;
+  commit?: string;
+  pullNumber?: number;
+  pullUrl?: string;
+}
+
+export interface Delivery {
+  status: DeliveryStatus;
+  reviewId: string;
+  repository?: string;
+  remote?: string;
+  project: string;
+  sourceBranch: string;
+  sourceCommit?: string;
+  target: "main";
+  targetCommit?: string;
+  reviewedAt: string;
+  verification?: DeliveryVerification;
+  /** Fingerprint of reviewed rules and check responses; missing means not reviewed. */
+  fingerprint?: string;
+  blocked: Partial<Record<DeliveryAction, string>>;
+  operation?: DeliveryOperation;
+  /** Reconciled, non-delivered intents superseded only by explicit fresh approval. */
+  previousOperations?: DeliveryOperation[];
+  error?: string;
+  result?: DeliveryResult;
+}

package/src/execution/agent-runner.ts

@@ -7,7 +7,6 @@ import { shortDuration, truncate } from "../text.ts";
 import { EditLog } from "../state/changes.ts";
 import { formatMinutes, REPORT_GRACE_MS } from "../state/budget.ts";
 import { runPiAgent, spawnPiProcess, type PiStreamEvent, type ProcessRunner, type RelayAsk } from "./pi-runner.ts";
-import { isUnavailable, looksUnavailable, markUnavailable, usableFallback } from "./fallback.ts";
 import { ASK_ENV } from "../ask/relay.ts";
 import { ASK_TOOL } from "../ask/types.ts";
 import { agentOfRun, grantOption } from "../excalidraw/sessions.ts";
@@ -42,10 +41,6 @@ export interface AgentRequest {
   context: AgentContext;
   model?: string;
   thinking?: string;
-  /** Where the run goes when its model runs out of usage or is unavailable. */
-  fallback?: { model: string; thinking: string };
-  /** Set by the runner once it has switched: the model that ran out. */
-  fellBackFrom?: string;
   timeoutMs: number;
   cwd: string;
   signal?: AbortSignal;
@@ -141,24 +136,13 @@ function retryable(run: AgentRun): boolean {
  */
 export async function runAgent(request: AgentRequest, run: ProcessRunner = spawnPiProcess): Promise<AgentRun> {
   const startedAt = new Date().toISOString();
-  let attempts = Math.max(1, (request.retries ?? 0) + 1);
+  const attempts = Math.max(1, (request.retries ?? 0) + 1);
   // A failed attempt may have edited files before the retry: the run owns every edit.
   const edits = new EditLog(request.cwd);
   let last: AgentRun | undefined;
-  // A model already known to be out of usage goes straight to the fallback.
-  const other = usableFallback(request.fallback, request.model);
-  if (other && isUnavailable(request.model)) request = switchToFallback(request, other, request.model ?? "the session model");
   for (let attempt = 1; attempt <= attempts; attempt++) {
     last = await runAgentOnce(request, run, attempt, startedAt, edits);
     request.onAttemptEnd?.(last);
-    // Out of usage (or the model unavailable): the same model would fail again, so the fallback takes the retry.
-    const fallback = usableFallback(request.fallback, request.model);
-    if (fallback && !request.fellBackFrom && last.status === "failed" && looksUnavailable(last.error)) {
-      if (request.model) markUnavailable(request.model);
-      request = switchToFallback(request, fallback, request.model ?? "the session model");
-      attempts += 1;
-      continue;
-    }
     if (!retryable(last)) break;
     // Under a budget a retry only uses what is left of the allotment.
     if (request.time && request.time.endsAt - Date.now() < MIN_ATTEMPT_MS) break;
@@ -167,11 +151,6 @@ export async function runAgent(request: AgentRequest, run: ProcessRunner = spawn
   return edited.length > 0 ? { ...last!, edited } : last!;
 }
 
-/** The request moved to its fallback model and thinking level. */
-function switchToFallback(request: AgentRequest, fallback: { model: string; thinking?: string }, from: string): AgentRequest {
-  return { ...request, model: fallback.model, thinking: fallback.thinking ?? request.thinking, fellBackFrom: from };
-}
-
 /** Abort every in-flight subagent (session shutdown, user cancel). */
 export function cancelAllRuns(): void {
   for (const controller of activeControllers) controller.abort();
@@ -190,7 +169,6 @@ function baseRun(request: AgentRequest, runId: string, startedAt: string, attemp
     attempts,
     startedAt,
     ...(request.thinking ? { thinking: request.thinking } : {}),
-    ...(request.fellBackFrom ? { fellBackFrom: request.fellBackFrom } : {}),
     ...(request.routedFrom ? { routedFrom: request.routedFrom } : {}),
     ...(request.route ? { route: request.route } : {}),
     ...(request.time ? { allotMs: request.time.allotMs, endsAt: request.time.endsAt } : {}),

package/src/index.ts

@@ -40,7 +40,7 @@ export default function (pi: ExtensionAPI): void {
   // A new request one agent can do alone: the oracle confirms, and the lobby hands it to the quick-fix agent.
   registerRouteTool(pi, CONFIG_DIR_NAME);
   // The questionnaire the oracle (and pi without a task) asks the user with; no other extension is needed for it.
-  registerAskTool(pi);
+  registerAskTool(pi, undefined, CONFIG_DIR_NAME);
   // The web tools, for the researcher and for pi without a task (the oracle leaves them to the researcher).
   registerWebTools(pi);
   // The shared Excalidraw sessions the user assigned to agents: the oracle here, every other agent through its own grant.

package/src/lobby/feed.ts

@@ -71,7 +71,6 @@ export class LobbyFeed {
   private readonly runThoughts = new Map<string, string>();
   private readonly runStatus = new Map<string, AgentRun["status"]>();
   /** Runs already reported as switched to their fallback model. */
-  private readonly fellBack = new Set<string>();
 
   onChange(listener: () => void): () => void {
     this.listeners.add(listener);
@@ -202,10 +201,6 @@ export class LobbyFeed {
       const before = this.runStatus.get(key);
       this.runStatus.set(key, run.status);
       if (before === undefined) this.log(source, `started as ${run.role}`, "info", at);
-      if (run.fellBackFrom && !this.fellBack.has(key)) {
-        this.fellBack.add(key);
-        this.log(source, `${run.fellBackFrom} is out of usage or unavailable: running on the fallback model`, "warning", at);
-      }
       if (run.step && this.runSteps.get(key) !== run.step) {
         this.runSteps.set(key, run.step);
         this.step(source, run.step, key, at);
@@ -231,7 +226,6 @@ export class LobbyFeed {
     this.runSteps.clear();
     this.runThoughts.clear();
     this.runStatus.clear();
-    this.fellBack.clear();
     this.touch();
   }
 }

package/src/lobby/host.ts

@@ -93,6 +93,9 @@ export interface LobbyService {
   feed: LobbyFeed;
   masterBusy(): boolean;
   tasks(): Task[];
+  deliveryDeliver?(taskId: string, request: import("../delivery/operations.ts").DeliveryRequest): Promise<import("../delivery/types.ts").Delivery>;
+  deliveryReview?(taskId: string): Promise<import("../delivery/types.ts").Delivery>;
+  deliveryDefer?(taskId: string, reviewId: string): import("../delivery/types.ts").Delivery;
   plans(): PlannedTask[];
   comments(taskId: string): PlanComment[];
   metrics(): MetricRecord[];

package/src/lobby/planner.ts

@@ -20,7 +20,6 @@
  */
 import { loadPrompt } from "../prompts/loader.ts";
 import { compilePrompt } from "../prompts/compiler.ts";
-import { withFallback } from "../execution/fallback.ts";
 import { runPiAgent, spawnPiProcess, type PiStreamEvent, type ProcessRunner } from "../execution/pi-runner.ts";
 import { grantOption, type Grant } from "../excalidraw/sessions.ts";
 import { describeToolCall } from "../pi/activity.ts";
@@ -823,12 +822,7 @@ export class PlanningSession {
         },
         this.deps.runProcess ?? spawnPiProcess,
       );
-      // A model that is out of usage hands the turn to the fallback the settings name.
-      const { result, switchedFrom } = await withFallback(profile.model, profile.thinking, profile.fallback, attempt);
-      if (switchedFrom && profile.fallback) {
-        this.deps.feed?.log(label, `${switchedFrom} is out of usage or unavailable; ran on ${profile.fallback.model}`, "warning");
-        profile = { ...profile, model: profile.fallback.model, thinking: profile.fallback.thinking };
-      }
+      const result = await attempt(profile.model, profile.thinking);
       outcome = { status: result.status, output: result.output, ...(result.error ? { error: result.error } : {}), ...(result.model ? { model: result.model } : {}), usage: result.usage };
     } catch (error) {
       outcome = { status: "failed", output: "", error: (error as Error).message, usage: { input: 0, output: 0, cost: 0, turns: 0 } };

package/src/lobby/pr-review.ts

@@ -11,7 +11,6 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { loadPrompt } from "../prompts/loader.ts";
-import { withFallback } from "../execution/fallback.ts";
 import { runPiAgent, spawnPiProcess, type PiStreamEvent, type ProcessRunner } from "../execution/pi-runner.ts";
 import { describeToolCall } from "../pi/activity.ts";
 import { appendMetrics } from "../state/metrics.ts";
@@ -284,12 +283,7 @@ export class PullReviews {
       },
       this.deps.runProcess ?? spawnPiProcess,
     );
-    const { result, switchedFrom } = await withFallback(profile.model, profile.thinking, profile.fallback, attempt);
-    if (switchedFrom && profile.fallback) {
-      review.model = profile.fallback.model;
-      review.thinking = profile.fallback.thinking;
-      this.step(review, `${switchedFrom} is out of usage or unavailable; ran on ${profile.fallback.model}`);
-    }
+    const result = await attempt(profile.model, profile.thinking);
     if (result.model) review.model = result.model;
     review.status = result.status === "success" ? "done" : result.status;
     const text = result.output.trim();

package/src/lobby/prompt-hub.ts

@@ -5,6 +5,7 @@
  * the answer, or with how it was put away. A cancelled caller's `signal`
  * withdraws the prompt.
  */
+import { blockingRequestContext } from "../state/blocking-requests.ts";
 import { lobbyTopics } from "./topics.ts";
 
 export type PromptKind = "questionnaire" | "choose" | "confirm" | "text" | "sessionDialog";
@@ -16,6 +17,9 @@ export interface WebPrompt {
   createdAt: number;
   from: string;
   payload: unknown;
+  taskId?: string;
+  sessionId?: string;
+  blockingRequestId?: string;
 }
 
 interface Pending {
@@ -50,7 +54,9 @@ export class PromptHub {
   /** Show a prompt on every surface; the answer settles it later. */
   open(kind: PromptKind, from: string, payload: unknown): WebPrompt {
     this.seq += 1;
-    const prompt: WebPrompt = { id: nextId(this.seq), kind, createdAt: Date.now(), from, payload };
+    const identity = blockingRequestContext.getStore();
+    const prompt: WebPrompt = { id: nextId(this.seq), kind, createdAt: Date.now(), from, payload,
+      ...(identity ? { taskId: identity.taskId, sessionId: identity.sessionId, blockingRequestId: identity.requestId } : {}) };
     this.pendingMap.set(prompt.id, { prompt });
     lobbyTopics.bump("prompts");
     return prompt;

package/src/lobby/quickfix.ts

@@ -6,7 +6,6 @@
  * and the lobby feed, and every finished job lands in the metrics log.
  */
 import { loadPrompt } from "../prompts/loader.ts";
-import { withFallback } from "../execution/fallback.ts";
 import { runPiAgent, spawnPiProcess, type PiStreamEvent, type ProcessRunner } from "../execution/pi-runner.ts";
 import { grantOption } from "../excalidraw/sessions.ts";
 import { describeToolCall } from "../pi/activity.ts";
@@ -77,7 +76,6 @@ export interface QuickFixProfile {
   timeoutMs: number;
   instructions?: string;
   /** Where the job goes when its model runs out of usage or is unavailable. */
-  fallback?: { model: string; thinking: string };
 }
 
 export interface QuickFixDeps {
@@ -265,17 +263,6 @@ export class QuickFixQueue {
         },
         this.deps.runProcess ?? spawnPiProcess,
       );
-      // A model that is out of usage hands the job to the fallback the settings name.
-      const attemptOrFallback = async (model: string | undefined, thinking: string) => {
-        const { result: outcome, switchedFrom } = await withFallback(model, thinking, profile.fallback, attempt);
-        if (switchedFrom && profile.fallback) {
-          job.model = profile.fallback.model;
-          job.thinking = profile.fallback.thinking;
-          this.addStep(job, `${switchedFrom} is out of usage or unavailable; ran on ${profile.fallback.model} (${profile.fallback.thinking})`, Date.now());
-          this.changed();
-        }
-        return outcome;
-      };
       let result;
       if (route) {
         job.route = routeLabel(route);
@@ -283,7 +270,7 @@ export class QuickFixQueue {
         job.thinking = route.thinking;
         if (route.model) job.model = route.model;
         this.changed();
-        result = await attemptOrFallback(route.model, route.thinking);
+        result = await attempt(route.model, route.thinking);
         if (fellShort(result) && !controller.signal.aborted) {
           // The routed attempt counts in the metrics on its own; the job re-runs on the configured profile.
           appendMetrics(this.deps.root, this.deps.configDir, [{ ...quickFixMetric({ ...job, status: result.status, finishedAt: Date.now(), usage: result.usage, ...(result.model ? { model: result.model } : {}) }), id: `${job.id}-routed-${job.startedAt}` }]);
@@ -292,10 +279,10 @@ export class QuickFixQueue {
           delete job.routedFrom;
           job.thinking = profile.thinking;
           if (profile.model) job.model = profile.model;
-          result = await attemptOrFallback(profile.model, profile.thinking);
+          result = await attempt(profile.model, profile.thinking);
         }
       } else {
-        result = await attemptOrFallback(profile.model, profile.thinking);
+        result = await attempt(profile.model, profile.thinking);
       }
       job.status = result.status;
       job.report = result.output.trim() || undefined;

package/src/lobby/service.ts

@@ -5,7 +5,15 @@
  */
 import { SessionManager, type ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { TERMINAL_STATES, type Task } from "../schemas/task.ts";
-import { loadTask, peekTasks } from "../state/persistence.ts";
+import { updateBlockingRequest } from "../state/blocking-requests.ts";
+import { randomUUID } from "node:crypto";
+import { realpathSync } from "node:fs";
+import { resolve } from "node:path";
+import { loadTask, ownedTask, peekTasks, saveTask } from "../state/persistence.ts";
+import { refreshReview, deferReview } from "../delivery/review.ts";
+import { deliver, type DeliveryRequest, type DeliveryStore } from "../delivery/operations.ts";
+import type { LockIdentity } from "../delivery/lock.ts";
+import { execCommand } from "./issues.ts";
 import { releaseAttachments } from "../state/attachments.ts";
 import { loadConfig, saveConfig as writeConfig } from "../state/project.ts";
 import { addPlanComment, editComment, readPlanComments, type PlanComment } from "../state/comments.ts";
@@ -40,6 +48,34 @@ import type { LiveSession, LobbyService, SwitchTarget } from "./host.ts";
 import { pushNotice, type NoticeLevel } from "../webui/notices.ts";
 import type { Runtime } from "./runtime.ts";
 
+function deliveryTask(state: Runtime, taskId: string): Task {
+  if (!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,199}$/.test(taskId) || taskId === "." || taskId === "..") throw new Error("Invalid task ID.");
+  const task = loadTask(state.root, state.configDir, taskId);
+  if (!task || task.state !== "completed" || !task.delivery) throw new Error("Completed task delivery review is unavailable in this project.");
+  return task;
+}
+
+function recoveryDeliveryStore(state: Runtime, identity: LockIdentity): DeliveryStore {
+  if (identity.configDir !== resolve(state.configDir) || realpathSync(identity.projectRoot) !== identity.projectRoot) throw new Error("Interrupted owner has an untrusted project/config identity.");
+  return deliveryStore({ ...state, root: identity.projectRoot }, identity.taskId);
+}
+function deliveryStore(state: Runtime, taskId: string): DeliveryStore {
+  let baseline: string | undefined;
+  return {
+    identity: { projectRoot: realpathSync(state.root), configDir: resolve(state.configDir) },
+    recoveryStore: (identity) => recoveryDeliveryStore(state, identity),
+    load: () => { const task = deliveryTask(state, taskId); baseline = JSON.stringify(task.delivery); return task; },
+    save: (task) => {
+      const latest = deliveryTask(state, taskId);
+      if (JSON.stringify(latest.delivery) !== baseline) throw new Error("Delivery changed during operation; reconcile before retrying.");
+      latest.delivery = structuredClone(task.delivery);
+      saveTask(state.root, state.configDir, latest);
+      baseline = JSON.stringify(latest.delivery);
+      lobbyTopics.bump("tasks");
+    },
+  };
+}
+
 /** The state background callbacks report to; set while the lobby service runs. */
 let serviceState: Runtime | undefined;
 
@@ -210,6 +246,20 @@ function sessionsChanged(): void {
   }
 }
 
+function dialogTracker(state: Runtime): (id: string, pending: boolean, sessionId?: string) => void {
+  const requests = new Map<string, { taskId: string; sessionId: string; requestId: string }>();
+  const prefix = `dialog:${randomUUID()}`;
+  return (id, pending, sessionId) => {
+    if (!sessionId) return;
+    const task = pending ? ownedTask(state.root, state.configDir, sessionId) : undefined;
+    if (task && !requests.has(id)) requests.set(id, { taskId: task.id, sessionId, requestId: `${prefix}:${id}` });
+    const request = requests.get(id);
+    if (!request) return;
+    updateBlockingRequest({ root: state.root, configDir: state.configDir, ...request }, request.requestId, pending);
+    if (!pending) requests.delete(id);
+  };
+}
+
 /** Start a task in its own new pi session, named after the task; the session, or why not. */
 function startSession(state: Runtime, start: { request?: string; plan?: PlannedTask; auto?: boolean }): BackgroundSession | string {
   const request = start.request?.trim();
@@ -224,7 +274,7 @@ function startSession(state: Runtime, start: { request?: string; plan?: PlannedT
   // A request may lead with flags (`--worktree add login`); the session is named after what follows them.
   const name = taskName(plan?.title ?? (stripStartFlags(request!) || request!));
   try {
-    const session = sessionRegistry().start(state.ctx.cwd, { name, ...(plan ? { planId: plan.id } : { request: request! }), ...(start.auto ? { auto: true } : {}) }, sessionModel(state.ctx));
+    const session = sessionRegistry().start(state.ctx.cwd, { name, projectRoot: state.root, onDialog: dialogTracker(state), ...(plan ? { planId: plan.id } : { request: request! }), ...(start.auto ? { auto: true } : {}) }, sessionModel(state.ctx));
     lobbyFeed.log("LOBBY", `started "${name}" in a new session`, "success");
     return session;
   } catch (error) {
@@ -520,6 +570,26 @@ export function createLobbyService(state: Runtime): LobbyService {
     feed: lobbyFeed,
     masterBusy: () => !state.ctx.isIdle(),
     tasks: () => peekTasks(state.root, state.configDir),
+    deliveryDeliver: (taskId, request: DeliveryRequest) => deliver(request, { cwd: state.root, exec: execCommand }, deliveryStore(state, taskId)),
+    deliveryReview: async (taskId) => {
+      const task = deliveryTask(state, taskId);
+      const baseline = JSON.stringify(task.delivery);
+      const delivery = await refreshReview(task, { cwd: state.root, exec: execCommand });
+      // An async lookup must not overwrite intervening deferrals or operations.
+      const latest = deliveryTask(state, taskId);
+      if (JSON.stringify(latest.delivery) !== baseline) throw new Error("Review changed during lookup; refresh again.");
+      latest.delivery = delivery;
+      saveTask(state.root, state.configDir, latest);
+      lobbyTopics.bump("tasks");
+      return delivery;
+    },
+    deliveryDefer: (taskId, reviewId) => {
+      const task = deliveryTask(state, taskId);
+      const delivery = deferReview(task, reviewId);
+      saveTask(state.root, state.configDir, task);
+      lobbyTopics.bump("tasks");
+      return delivery;
+    },
     plans: () => listPlannedTasks(state.root, state.configDir),
     comments: (taskId) => readPlanComments(state.root, state.configDir, taskId),
     metrics: () => readMetrics(state.root, state.configDir),
@@ -584,7 +654,7 @@ export function createLobbyService(state: Runtime): LobbyService {
     workspace: () => state.workspace,
     refreshWorkspace: () => refreshWorkspace(state),
     sessionName: () => state.pi.getSessionName(),
-    sessions: () => backgroundSessions(),
+    sessions: () => backgroundSessions().filter((session) => session.projectRoot === state.root),
     startSession: (start) => startSession(state, start),
     isAuto: (taskId) => autoFor(state, taskId),
     setAuto: (taskId, on) => switchAuto(state, taskId, on),

package/src/lobby/sessions.ts

@@ -39,6 +39,9 @@ export interface SessionProcess {
 export type SessionStatus = "starting" | "idle" | "working" | "exited";
 
 export interface SessionStart {
+  /** Server-owned task association; never supplied by a browser payload. */
+  onDialog?: (id: string, pending: boolean, sessionId?: string) => void;
+  projectRoot?: string;
   /** The display name: the task's title. */
   name: string;
   /** What to send once it is up: the request, or a planned task to start. */
@@ -54,6 +57,7 @@ export const STOP_GRACE_MS = 5000;
 
 export class BackgroundSession {
   readonly key: string;
+  readonly projectRoot?: string;
   readonly name: string;
   /** The planned task it was started from. */
   readonly planId?: string;
@@ -67,6 +71,7 @@ export class BackgroundSession {
   exitCode?: number | null;
   /** Dialogs the session waits on, oldest first. */
   readonly dialogs: SessionDialog[] = [];
+  private readonly onDialog: NonNullable<SessionStart["onDialog"]>;
   private readonly proc: SessionProcess;
   private buffer = "";
   private stderr = "";
@@ -79,7 +84,9 @@ export class BackgroundSession {
     counter += 1;
     this.key = `S${counter}`;
     this.name = start.name;
+    this.projectRoot = start.projectRoot;
     if (start.planId) this.planId = start.planId;
+    this.onDialog = start.onDialog ?? (() => {});
     this.proc = proc;
     this.onChange = onChange;
     proc.stdout?.on("data", (chunk) => this.receive(String(chunk)));
@@ -102,6 +109,7 @@ export class BackgroundSession {
     if (this.status === "exited") return;
     this.status = "exited";
     this.exitCode = code;
+    for (const dialog of this.dialogs) this.onDialog(dialog.id, false, this.sessionId);
     this.dialogs.length = 0;
     if (this.killTimer) clearTimeout(this.killTimer);
     this.feed.say("note", reason);
@@ -148,6 +156,7 @@ export class BackgroundSession {
 
   /** Stop the oracle's running turn (the session stays up). */
   abort(): void {
+    for (const dialog of [...this.dialogs]) this.answer(dialog.id, { cancelled: true });
     if (this.busy) this.write({ type: "abort" });
   }
 
@@ -156,6 +165,7 @@ export class BackgroundSession {
     const index = this.dialogs.findIndex((dialog) => dialog.id === id);
     if (index < 0) return;
     this.dialogs.splice(index, 1);
+    this.onDialog(id, false, this.sessionId);
     if (this.alive && this.proc.stdin) this.proc.stdin.write(`${JSON.stringify({ type: "extension_ui_response", id, ...answer })}\n`);
     this.onChange();
   }
@@ -213,6 +223,7 @@ export class BackgroundSession {
       if (event.command === "get_state" && data) {
         this.sessionId = data.sessionId;
         this.sessionFile = data.sessionFile;
+        for (const dialog of this.dialogs) this.onDialog(dialog.id, true, this.sessionId);
         if (this.status === "starting") this.status = "idle";
       } else if (event.success === false && typeof event.error === "string") {
         this.feed.log("LOBBY", `the session refused a request: ${event.error}`, "warning");
@@ -240,6 +251,7 @@ export class BackgroundSession {
         ...(typeof event.placeholder === "string" ? { placeholder: event.placeholder } : {}),
         ...(typeof event.prefill === "string" ? { prefill: event.prefill } : {}),
       });
+      this.onDialog(id, true, this.sessionId);
       this.feed.log("LOBBY", `waiting for you: ${String(event.title ?? "a question").split("\n")[0]}`, "warning");
     } else if (method === "notify") {
       const level = event.notifyType === "error" ? "error" : event.notifyType === "warning" ? "warning" : "info";

package/src/lobby/task-rows.ts

@@ -1,11 +1,16 @@
 /** The shapes of the Tasks tab's rows, shared by the web API and the page's words. */
 
+import type { TimingProjection } from "../state/phase-timing.ts";
+import type { Delivery } from "../delivery/types.ts";
+
 export type TaskSection = "mine" | "others" | "pending" | "recent" | "archived";
 
 /** How a row is ticked off: still to do (a plan, or a task under way), completed, or abandoned. */
 export type CheckState = "open" | "done" | "dropped";
 
 export interface TaskRow {
+  timing?: TimingProjection;
+  delivery?: Pick<Delivery, "status" | "reviewId">;
   /** A task on the list, a saved plan, or a task in the archive. */
   kind: "task" | "plan" | "archived";
   id: string;

package/src/master/master.ts

@@ -52,7 +52,7 @@ export interface ScoutRequest {
 /** Model, thinking and time limit for one run, from settings. */
 function profileFields(config: BotLobbyConfig, resolver: ProfileResolver | undefined, domain: Domain, role: AgentRequest["role"]) {
   const profile = profileFor(config, resolver, domain, role);
-  return { model: profile.model, thinking: profile.thinking, timeoutMs: profile.timeoutMs, ...(profile.fallback ? { fallback: profile.fallback } : {}) };
+  return { model: profile.model, thinking: profile.thinking, timeoutMs: profile.timeoutMs };
 }
 
 function scoutInstruction(request: ScoutRequest, domain: Domain): string {