@jpkme/diff-review 0.1.15 → 0.1.17

package/web/build/server/chunks/{agent-sessions-C_hlZJKN.js → agent-sessions-BArYLTW6.js}

@@ -1,10 +1,11 @@
-import { o as getRemoteUrl, e as ensureReviewDir, w as writeDiffCache, p as readDiffCache, q as extractBranchDiff, u as loadReviewConfig, v as outputRelPath, m as makeOutputFilename, O as OUTPUT_DIR, x as writeSessionRef, c as companionPaths, d as decodePayload, t as tryResolveGitRoot, f as loadBranchDiff, y as validateAgainst, z as reviewIssues, R as REVIEW_SCHEMA, A as globMatch, C as writeDiffText } from './validate-CAQ31C7k.js';
-import { existsSync, readFileSync, statSync, accessSync, constants, readdirSync, mkdirSync, writeFileSync, copyFileSync, rmSync, realpathSync } from 'node:fs';
-import { spawn } from 'node:child_process';
+import { p as getRemoteUrl, e as ensureReviewDir, w as writeDiffCache, q as readDiffCache, u as extractBranchDiff, v as loadReviewConfig, x as outputRelPath, m as makeOutputFilename, O as OUTPUT_DIR, y as writeSessionRef, c as companionPaths, d as decodePayload, t as tryResolveGitRoot, f as loadBranchDiff, z as validateAgainst, A as reviewIssues, R as REVIEW_SCHEMA, C as globMatch, D as writeDiffText, E as writeHandoffChat } from './validate-CXjTRGnR.js';
+import { existsSync, statSync, accessSync, constants, readFileSync, readdirSync, mkdirSync, writeFileSync, copyFileSync, rmSync, realpathSync, unlinkSync } from 'node:fs';
+import { spawnSync, spawn } from 'node:child_process';
 import { homedir, tmpdir } from 'node:os';
 import { join, delimiter, isAbsolute, resolve, basename, dirname, normalize } from 'node:path';
 import { Writable, Readable } from 'node:stream';
 import * as acp from '@agentclientprotocol/sdk';
+import { randomBytes } from 'node:crypto';
 
 //#region ../lib/agents.mjs
 /**
@@ -40,15 +41,6 @@ function readJson(file) {
 		return null;
 	}
 }
-/** Primer `model = "..."` de nivel raíz de un TOML (antes de cualquier `[sección]`). */
-function topLevelTomlModel(text) {
-	for (const line of String(text).split(/\r?\n/)) {
-		if (/^\s*\[/.test(line)) break;
-		const m = line.match(/^\s*model\s*=\s*["']([^"']+)["']/);
-		if (m) return m[1];
-	}
-	return null;
-}
 /** Versiones tipo `2.1.286` de mayor a menor (las que no parsean, al final). */
 function byVersionDesc(a, b) {
 	const pa = a.split(".").map(Number);
@@ -182,30 +174,6 @@ var AGENTS = [
 			};
 		}
 	},
-	{
-		id: "codex",
-		label: "Codex",
-		bins: ["codex"],
-		models: [],
-		configuredModel: ({ home }) => {
-			try {
-				const model = topLevelTomlModel(readFileSync(join(home, ".codex", "config.toml"), "utf8"));
-				return model ? {
-					model,
-					source: "~/.codex/config.toml"
-				} : null;
-			} catch {
-				return null;
-			}
-		},
-		args: ({ model }) => [
-			"exec",
-			"--sandbox",
-			"workspace-write",
-			...model ? ["-m", model] : [],
-			"-"
-		]
-	},
 	{
 		id: "cursor",
 		label: "Cursor CLI",
@@ -266,21 +234,6 @@ var AGENTS = [
 			file: path,
 			args: ["--acp"]
 		})
-	},
-	{
-		id: "gemini",
-		label: "Gemini CLI",
-		bins: ["gemini"],
-		models: [],
-		configuredModel: ({ home }) => {
-			const model = readJson(join(home, ".gemini", "settings.json"))?.model;
-			const name = typeof model === "string" ? model : model?.name;
-			return typeof name === "string" && name ? {
-				model: name,
-				source: "~/.gemini/settings.json"
-			} : null;
-		},
-		args: ({ model }) => [...model ? ["-m", model] : [], "--yolo"]
 	}
 ];
 /** @param {string} file @param {NodeJS.Platform} platform */
@@ -856,8 +809,9 @@ function checkShell(command, { repo, platform = process.platform } = {}) {
 * habilitó en su agente.
 */
 /**
-* @typedef {"review" | "ask" | "edit"} PolicyMode
-*   review = generar el JSON; ask = preguntas (no puede escribir nada); edit = modificar el JSON.
+* @typedef {"review" | "ask" | "edit" | "fix"} PolicyMode
+*   review = generar el JSON; ask = preguntas (no puede escribir nada); edit = modificar el JSON;
+*   fix = editar código dentro del repo (no solo el JSON).
 * @typedef {{ repo: string, outputFilename: string, mode: PolicyMode }} PolicyContext
 * @typedef {{
 *   kind?: string | null,
@@ -1021,6 +975,16 @@ function decidePermission(toolCall, { repo, outputFilename, mode }) {
 			allow: false,
 			reason: `${kind === "delete" ? "borrado" : "edición"} sin path`
 		};
+		if (mode === "fix") {
+			const outside = paths.find((p) => !isInside(p, repo));
+			return outside ? {
+				allow: false,
+				reason: `path fuera del repo: ${outside}`
+			} : {
+				allow: true,
+				reason: "escritura en el repo"
+			};
+		}
 		const target = resolve(repo, outputRelPath(outputFilename));
 		const outside = paths.find((p) => !samePath(canonicalPath(p), canonicalPath(target)));
 		return outside ? {
@@ -1055,48 +1019,139 @@ function permissionOutcome(options, allow, opts = {}) {
 //#endregion
 //#region ../lib/agent-login.mjs
 /**
-* Login de agentes ACP: mensajes claros + abrir una terminal interactiva cuando se pueda.
+* Login de agentes ACP: clasificación de authMethods, mensajes claros y lanzamiento del CLI de auth.
+*
+* Preferencia de launch:
+* 1. Misma TTY (stdio inherit) si stdin/stdout son TTY — CLI interactiva, exit code real.
+* 2. Proceso hijo oculto (sin ventana de terminal) si no hay TTY — p. ej. web; OAuth abre el browser.
+* 3. Terminal externa solo con `external: true` (raro: login que exige TTY interactiva).
+*
+* En Windows, `cmd /c start /wait` **no** propaga el exit code del proceso iniciado (siempre 0
+* hacia Node). El fallback externo usa un archivo sentinel, igual que macOS/Linux.
 */
 /**
-* @typedef {{ bin: string, args: string[], display: string }} LoginCommand
+* @typedef {{ bin: string, args: string[], display: string, env?: Record<string, string> }} LoginCommand
+* @typedef {'agent' | 'terminal' | 'terminal-meta' | 'unknown'} AuthMethodKind
+* @typedef {'inherit' | 'hidden' | 'external'} LoginLaunchMode
 */
 /**
-* Comando de login interactivo por agente (null = no hay CLI de login, p. ej. Cursor app).
+* Hostname de Copilot (Enterprise). Vacío / `github.com` = cuenta en github.com.
+* @param {string | null | undefined} host
+* @returns {string}
+*/
+function normalizeCopilotLoginHost(host) {
+	const h = String(host || "").trim().replace(/^https?:\/\//i, "").replace(/\/.*$/, "");
+	if (!h || /^github\.com$/i.test(h)) return "";
+	return h;
+}
+/**
+* Agrega `--host` a un comando `copilot login` cuando el usuario eligió Enterprise.
+* No fuerza nada por env: el host lo elige quien llama (CLI/UI).
+* @param {LoginCommand} cmd
+* @param {string | null | undefined} host
+* @returns {LoginCommand}
+*/
+function withCopilotLoginHost(cmd, host) {
+	if (!cmd || cmd.bin == null) return cmd;
+	const h = normalizeCopilotLoginHost(host);
+	if (!h) return cmd;
+	const args = Array.isArray(cmd.args) ? [...cmd.args] : [];
+	const hostIdx = args.findIndex((a) => a === "--host");
+	if (hostIdx >= 0) args[hostIdx + 1] = h;
+	else args.push("--host", h);
+	const withoutHost = String(cmd.display || "").replace(/\s+--host\s+\S+/g, "").trim();
+	return {
+		...cmd,
+		args,
+		display: `${withoutHost} --host ${h}`.trim()
+	};
+}
+/**
+* Comando de login interactivo por agente (fallback si no hay authMethod usable).
 * @param {string} agentId
+* @param {{ host?: string | null }} [opts] solo Copilot: host Enterprise opcional
 * @returns {LoginCommand | null}
 */
-function loginCommand(agentId) {
+function loginCommand(agentId, opts = {}) {
 	switch (agentId) {
 		case "claude": return {
 			bin: "claude",
-			args: ["/login"],
-			display: "claude /login"
-		};
-		case "copilot": return {
-			bin: "gh",
 			args: ["auth", "login"],
-			display: "gh auth login"
+			display: "claude auth login"
 		};
-		case "codex": return {
-			bin: "codex",
+		case "copilot": return withCopilotLoginHost({
+			bin: "copilot",
 			args: ["login"],
-			display: "codex login"
-		};
-		case "gemini": return {
-			bin: "gemini",
-			args: [],
-			display: "gemini"
+			display: "copilot login"
+		}, opts.host);
+		case "cursor": return {
+			bin: "cursor-agent",
+			args: ["login"],
+			display: "cursor-agent login"
 		};
 		default: return null;
 	}
 }
+/**
+* Args de `claude auth login …` a partir de un authMethod ACP.
+* El adaptador anuncia `["--cli", "auth", "login", "--claudeai"]` (o lo mismo tras el path del
+* adapter en `_meta.terminal-auth.args`); `--cli` solo entiende el wrapper ACP, no `claude`.
+* @param {any} [method]
+* @returns {string[]}
+*/
+function claudeCliLoginArgs(method) {
+	const meta = method?._meta?.["terminal-auth"];
+	const raw = Array.isArray(meta?.args) ? meta.args.map(String) : Array.isArray(method?.args) ? method.args.map(String) : [];
+	const cliIdx = raw.indexOf("--cli");
+	const after = cliIdx >= 0 ? raw.slice(cliIdx + 1) : raw;
+	if (after[0] === "auth") return after;
+	return [
+		"auth",
+		"login",
+		...after.filter((a) => a.startsWith("--"))
+	];
+}
+/**
+* Clasifica un authMethod de `initialize` según ACP v1 + extensión Copilot `_meta.terminal-auth`.
+* @param {any} method
+* @returns {AuthMethodKind}
+*/
+function classifyAuthMethod(method) {
+	if (!method || typeof method.id !== "string" || !method.id) return "unknown";
+	if (method._meta != null && method._meta["terminal-auth"] != null) return "terminal-meta";
+	if (method.type === "terminal") return "terminal";
+	if (!method.type || method.type === "agent") return "agent";
+	return "unknown";
+}
+/**
+* @param {any[]} authMethods
+* @returns {{ agent: any[], terminal: any[], terminalMeta: any[], unknown: any[] }}
+*/
+function groupAuthMethods(authMethods) {
+	/** @type {{ agent: any[], terminal: any[], terminalMeta: any[], unknown: any[] }} */
+	const groups = {
+		agent: [],
+		terminal: [],
+		terminalMeta: [],
+		unknown: []
+	};
+	for (const method of authMethods || []) {
+		const kind = classifyAuthMethod(method);
+		if (kind === "agent") groups.agent.push(method);
+		else if (kind === "terminal") groups.terminal.push(method);
+		else if (kind === "terminal-meta") groups.terminalMeta.push(method);
+		else groups.unknown.push(method);
+	}
+	return groups;
+}
 /** @param {string} text */
 function looksLikeAuthFailure(text) {
 	const s = String(text || "").toLowerCase();
-	return /(not\s+)?auth|login|unauthor|not logged|sign[\s-]?in|credentials|token.*(invalid|expired|missing)|please\s+run/.test(s);
+	return /(not\s+)?auth|login|unauthor|not logged|sign[\s-]?in|credentials|token.*(invalid|expired|missing)|please\s+run|auth_required/.test(s);
 }
 /**
 * Mensaje en español si el agente murió / falló por falta de login.
+* Sin comandos CLI: el CTA abre el login por el usuario.
 * @param {string} agentId
 * @param {string} agentLabel
 * @param {string} detail
@@ -1104,38 +1159,280 @@ function looksLikeAuthFailure(text) {
 */
 function authFailureMessage$1(agentId, agentLabel, detail) {
 	if (!looksLikeAuthFailure(detail)) return null;
-	const cmd = loginCommand(agentId);
-	if (agentId === "cursor") return `${agentLabel} no está autenticado. Iniciá sesión en la app de Cursor y reintentá.`;
-	if (cmd) return `${agentLabel} no está autenticado. Corré \`${cmd.display}\` en una terminal y reintentá.`;
-	return `${agentLabel} no está autenticado. Revisá el login del agente y reintentá.`;
+	return `Necesitás iniciar sesión en ${String(agentLabel || "").trim() || "el agente"}.`;
+}
+/** Fallo del proceso de login (exit ≠ 0 o cancelado a medias). */
+function loginIncompleteMessage() {
+	return "No se pudo completar el inicio de sesión. Probá de nuevo.";
+}
+/** Estado mientras corre el login (TTY, proceso oculto o terminal externa). */
+function loginWaitingMessage() {
+	return "Esperando que completes el inicio de sesión…";
 }
 /**
-* Abre una terminal nueva con el login del agente (Windows / macOS / Linux).
-* @param {string} agentId
+* Método interactivo a abrir: `_meta.terminal-auth` (Copilot) o `type: terminal` (Claude).
+* Si solo hay métodos `agent` (Cursor), devolvemos null → `resolveLoginCommand` usa el fallback CLI.
+* @param {any[]} [methods]
+* @returns {any | null}
+*/
+function pickLoginAuthMethod(methods) {
+	const grouped = groupAuthMethods(methods || []);
+	return grouped.terminalMeta[0] ?? grouped.terminal[0] ?? null;
+}
+/**
+* ¿Podemos correr el login en la misma terminal (stdio inherit)?
+* La web / procesos sin TTY usan proceso oculto (o `external: true` → ventana).
+* @param {{ external?: boolean }} [opts]
+*/
+function canInheritLoginTty(opts = {}) {
+	if (opts.external) return false;
+	return Boolean(process.stdin?.isTTY && process.stdout?.isTTY);
+}
+/**
+* Modo de launch: inherit (CLI con TTY) → hidden (web / OAuth en browser) → external (forzado).
+* @param {{ wait?: boolean, external?: boolean }} [opts]
+* @returns {LoginLaunchMode}
+*/
+function resolveLoginLaunchMode(opts = {}) {
+	if (Boolean(opts.wait) && canInheritLoginTty(opts)) return "inherit";
+	if (opts.external) return "external";
+	return "hidden";
+}
+/**
+* Arma el comando de login a partir de un authMethod (o fallback por agentId).
+* @param {{ def: { id: string, acp?: Function }, path: string }} agent
+* @param {any} [method]
+* @returns {LoginCommand}
+*/
+function resolveLoginCommand(agent, method) {
+	const kind = method ? classifyAuthMethod(method) : "unknown";
+	const meta = method?._meta?.["terminal-auth"];
+	if (agent?.def?.id === "claude" && method && (kind === "terminal" || kind === "terminal-meta")) {
+		const args = claudeCliLoginArgs(method);
+		return {
+			bin: typeof agent.path === "string" && agent.path.trim() ? agent.path : "claude",
+			args,
+			display: `claude ${args.join(" ")}`.trim(),
+			...method?.env && typeof method.env === "object" ? { env: method.env } : {}
+		};
+	}
+	if ((kind === "terminal-meta" || kind === "terminal") && meta && typeof meta === "object") {
+		const command = typeof meta.command === "string" ? meta.command.trim() : "";
+		if (command) {
+			const args = Array.isArray(meta.args) ? meta.args.map(String) : [];
+			return {
+				bin: command,
+				args,
+				display: (typeof meta.label === "string" && meta.label.trim() ? meta.label.trim() : "") || `${command}${args.length ? ` ${args.join(" ")}` : ""}`.trim(),
+				...method?.env && typeof method.env === "object" ? { env: method.env } : {}
+			};
+		}
+	}
+	if (kind === "terminal" && method && typeof agent?.def?.acp === "function") {
+		const launch = agent.def.acp({ path: agent.path });
+		const extra = Array.isArray(method.args) ? method.args.map(String) : [];
+		const env = {
+			...launch.env && typeof launch.env === "object" ? launch.env : {},
+			...method.env && typeof method.env === "object" ? method.env : {}
+		};
+		const args = [...launch.args || [], ...extra];
+		return {
+			bin: launch.file,
+			args,
+			display: `${launch.file}${args.length ? ` ${args.join(" ")}` : ""}`.trim(),
+			...Object.keys(env).length ? { env } : {}
+		};
+	}
+	const fallback = loginCommand(agent?.def?.id);
+	if (fallback) {
+		if (agent?.def?.id === "claude" && typeof agent.path === "string" && agent.path.trim()) return {
+			...fallback,
+			bin: agent.path
+		};
+		return fallback;
+	}
+	throw new Error("Este agente no tiene un inicio de sesión conocido.");
+}
+/** @param {import('node:child_process').ChildProcess} child */
+function waitExit(child) {
+	return new Promise((resolve, reject) => {
+		child.once("error", reject);
+		child.once("exit", (code, signal) => resolve(signal ? 1 : code ?? 1));
+	});
+}
+/**
+* Lanza el login en background (proceso oculto; no espera). Compat con UI/CTA simples (web sin sesión).
+* @param {string | LoginCommand} agentIdOrCmd
 * @returns {{ display: string }}
 */
-function openLoginTerminal(agentId) {
-	const cmd = loginCommand(agentId);
-	if (!cmd) throw new Error(agentId === "cursor" ? "Cursor se autentica desde la app de escritorio, no desde una terminal." : "Este agente no tiene un comando de login conocido.");
-	const platform = process.platform;
-	if (platform === "win32") spawn("cmd.exe", [
-		"/c",
-		"start",
-		`${cmd.bin} login`,
-		"cmd.exe",
-		"/k",
-		cmd.bin,
-		...cmd.args
-	], {
-		detached: true,
+function openLoginTerminal(agentIdOrCmd) {
+	const cmd = typeof agentIdOrCmd === "string" ? loginCommand(agentIdOrCmd) : agentIdOrCmd;
+	if (!cmd) throw new Error((typeof agentIdOrCmd === "string" ? agentIdOrCmd : "") === "cursor" ? "Necesitás iniciar sesión en Cursor." : "Este agente no tiene un inicio de sesión conocido.");
+	launchLoginProcess(cmd, {
+		wait: false,
+		mode: "hidden"
+	});
+	return { display: cmd.display };
+}
+/**
+* Lanza el login. Con TTY y `wait: true`, corre en esta terminal (inherit); si no, proceso oculto
+* (OAuth en browser). Solo con `external: true` abre una ventana de terminal del OS.
+* @param {LoginCommand} cmd
+* @param {{ wait?: boolean, cwd?: string, external?: boolean }} [opts]
+* @returns {Promise<{ display: string, code: number | null, mode: LoginLaunchMode }>}
+*/
+async function runLoginTerminal(cmd, opts = {}) {
+	const wait = Boolean(opts.wait);
+	const mode = resolveLoginLaunchMode(opts);
+	const code = await launchLoginProcess(cmd, {
+		wait,
+		cwd: opts.cwd,
+		mode
+	});
+	return {
+		display: cmd.display,
+		code: wait ? code : null,
+		mode
+	};
+}
+/** @param {string} arg */
+function quoteBatArg(arg) {
+	const s = String(arg);
+	if (/^[\w./:\\@=-]+$/.test(s)) return s;
+	return `"${s.replace(/"/g, "\"\"")}"`;
+}
+/**
+* Espera a que el sentinel tenga un exit code (macOS/Linux/Windows externo).
+* @param {string} sentinel
+* @param {string} display
+* @returns {Promise<number>}
+*/
+async function waitForExitSentinel(sentinel, display) {
+	const deadline = Date.now() + 1800 * 1e3;
+	while (Date.now() < deadline) {
+		try {
+			const raw = readFileSync(sentinel, "utf8").trim();
+			if (raw !== "") {
+				const code = Number.parseInt(raw, 10);
+				try {
+					unlinkSync(sentinel);
+				} catch {}
+				return Number.isFinite(code) ? code : 1;
+			}
+		} catch {}
+		await new Promise((r) => setTimeout(r, 400));
+	}
+	try {
+		unlinkSync(sentinel);
+	} catch {}
+	throw new Error(`Timeout esperando el login (${display}).`);
+}
+/**
+* Proceso hijo sin ventana de terminal (web / OAuth). Exit code real vía waitExit.
+* @param {LoginCommand} cmd
+* @param {{ wait: boolean, cwd?: string, env: NodeJS.ProcessEnv }} opts
+* @returns {Promise<number>}
+*/
+async function launchHiddenLogin(cmd, { wait, cwd, env }) {
+	const child = spawnCommand(cmd.bin, cmd.args, {
+		cwd,
+		env,
 		stdio: "ignore",
-		windowsHide: false
-	}).unref();
-	else if (platform === "darwin") spawn("osascript", ["-e", `tell application "Terminal" to do script ${JSON.stringify(`${cmd.bin} ${cmd.args.join(" ")}`.trim())}`], {
-		detached: true,
-		stdio: "ignore"
-	}).unref();
-	else {
+		windowsHide: true,
+		...wait ? {} : { detached: true }
+	});
+	if (!wait) {
+		child.unref();
+		return 0;
+	}
+	return waitExit(child);
+}
+/**
+* @param {LoginCommand} cmd
+* @param {{ wait: boolean, cwd?: string, mode: LoginLaunchMode }} opts
+* @returns {Promise<number>}
+*/
+async function launchLoginProcess(cmd, { wait, cwd, mode }) {
+	const env = {
+		...process.env,
+		...cmd.env || {}
+	};
+	if (mode === "inherit") return waitExit(spawnCommand(cmd.bin, cmd.args, {
+		cwd,
+		env,
+		stdio: "inherit"
+	}));
+	if (mode === "hidden") return launchHiddenLogin(cmd, {
+		wait,
+		cwd,
+		env
+	});
+	const platform = process.platform;
+	if (platform === "win32") {
+		if (!wait) {
+			spawn("cmd.exe", [
+				"/c",
+				"start",
+				"diff-review login",
+				"cmd.exe",
+				"/k",
+				cmd.bin,
+				...cmd.args
+			], {
+				cwd,
+				env,
+				detached: true,
+				stdio: "ignore",
+				windowsHide: false
+			}).unref();
+			return 0;
+		}
+		const id = randomBytes(8).toString("hex");
+		const sentinel = join(tmpdir(), `diff-review-login-${id}.exit`);
+		const bat = join(tmpdir(), `diff-review-login-${id}.bat`);
+		const line = [quoteBatArg(cmd.bin), ...cmd.args.map(quoteBatArg)].join(" ");
+		const sentPath = sentinel.replace(/"/g, "\"\"");
+		writeFileSync(bat, [
+			`@echo off`,
+			`call ${line}`,
+			`> "${sentPath}" echo %ERRORLEVEL%`,
+			``
+		].join("\r\n"));
+		try {
+			writeFileSync(sentinel, "");
+		} catch {}
+		const child = spawn("cmd.exe", [
+			"/c",
+			"start",
+			"/wait",
+			"diff-review login",
+			"cmd.exe",
+			"/c",
+			bat
+		], {
+			cwd,
+			env,
+			stdio: "ignore",
+			windowsHide: false
+		});
+		try {
+			await waitExit(child);
+			return await waitForExitSentinel(sentinel, cmd.display);
+		} finally {
+			try {
+				unlinkSync(bat);
+			} catch {}
+		}
+	}
+	if (!wait) {
+		if (platform === "darwin") {
+			spawn("osascript", ["-e", `tell application "Terminal" to do script ${JSON.stringify(`${cmd.bin} ${cmd.args.join(" ")}`.trim())}`], {
+				detached: true,
+				stdio: "ignore",
+				env
+			}).unref();
+			return 0;
+		}
 		const line = `${cmd.bin} ${cmd.args.join(" ")}`.trim();
 		const tried = [
 			["x-terminal-emulator", [
@@ -1163,18 +1460,375 @@ function openLoginTerminal(agentId) {
 				`${line}; exec bash`
 			]]
 		];
-		let ok = false;
 		for (const [bin, args] of tried) try {
 			spawn(bin, args, {
 				detached: true,
-				stdio: "ignore"
+				stdio: "ignore",
+				env,
+				cwd
 			}).unref();
+			return 0;
+		} catch {}
+		throw new Error(`No pude abrir una terminal. Corré a mano: ${cmd.display}`);
+	}
+	const sentinel = join(tmpdir(), `diff-review-login-${randomBytes(8).toString("hex")}.exit`);
+	try {
+		writeFileSync(sentinel, "");
+	} catch {}
+	const line = `${[cmd.bin, ...cmd.args].map((a) => JSON.stringify(a)).join(" ")}; echo $? > ${JSON.stringify(sentinel)}`;
+	if (platform === "darwin") spawn("osascript", ["-e", `tell application "Terminal" to do script ${JSON.stringify(line)}`], {
+		stdio: "ignore",
+		env,
+		cwd
+	});
+	else {
+		const tried = [
+			["gnome-terminal", [
+				"--wait",
+				"--",
+				"bash",
+				"-lc",
+				line
+			]],
+			["x-terminal-emulator", [
+				"-e",
+				"bash",
+				"-lc",
+				line
+			]],
+			["konsole", [
+				"-e",
+				"bash",
+				"-lc",
+				line
+			]],
+			["xterm", [
+				"-e",
+				"bash",
+				"-lc",
+				line
+			]]
+		];
+		let ok = false;
+		for (const [bin, args] of tried) try {
+			await waitExit(spawn(bin, args, {
+				stdio: "ignore",
+				env,
+				cwd
+			}));
 			ok = true;
 			break;
 		} catch {}
 		if (!ok) throw new Error(`No pude abrir una terminal. Corré a mano: ${cmd.display}`);
 	}
-	return { display: cmd.display };
+	return waitForExitSentinel(sentinel, cmd.display);
+}
+/**
+* Cuenta activa del agente (para el header de la web).
+* @param {string} agentId
+* @param {{ env?: NodeJS.ProcessEnv, run?: typeof spawnSync }} [opts]
+* @returns {{
+*   agentId: string,
+*   loggedIn: boolean,
+*   accountLabel: string | null,
+*   detail: string | null,
+*   source: 'gh' | 'claude' | 'env' | 'unknown' | null,
+*   warnings: string[],
+* }}
+*/
+function agentAccountStatus(agentId, opts = {}) {
+	const id = String(agentId || "").trim();
+	const env = opts.env || process.env;
+	const run = opts.run || spawnSync;
+	/** @type {string[]} */
+	const warnings = [];
+	if (id === "copilot") {
+		const envHits = copilotTokenEnvOverrides(env);
+		if (envHits.length) {
+			warnings.push(`${envHits.join(", ")} en el entorno (pisa otras cuentas).`);
+			return {
+				agentId: id,
+				loggedIn: true,
+				accountLabel: "Token de entorno",
+				detail: envHits.join(", "),
+				source: "env",
+				warnings
+			};
+		}
+		const accounts = listGhAuthAccounts({
+			env,
+			run
+		});
+		const active = accounts.find((a) => a.active) || accounts[0] || null;
+		if (active) return {
+			agentId: id,
+			loggedIn: true,
+			accountLabel: active.user,
+			detail: active.host,
+			source: "gh",
+			warnings
+		};
+		return {
+			agentId: id,
+			loggedIn: false,
+			accountLabel: null,
+			detail: null,
+			source: null,
+			warnings
+		};
+	}
+	if (id === "claude") {
+		const r = run("claude", [
+			"auth",
+			"status",
+			"--json"
+		], {
+			encoding: "utf8",
+			env,
+			windowsHide: true
+		});
+		if (r.error) return {
+			agentId: id,
+			loggedIn: false,
+			accountLabel: null,
+			detail: null,
+			source: null,
+			warnings: [r.error.message]
+		};
+		try {
+			const parsed = JSON.parse(String(r.stdout || "{}"));
+			const loggedIn = Boolean(parsed?.loggedIn);
+			const email = String(parsed?.email || "").trim() || null;
+			const org = String(parsed?.orgName || "").trim() || null;
+			return {
+				agentId: id,
+				loggedIn,
+				accountLabel: loggedIn ? email || "Claude" : null,
+				detail: loggedIn ? org || String(parsed?.authMethod || "") || null : null,
+				source: loggedIn ? "claude" : null,
+				warnings
+			};
+		} catch {
+			return {
+				agentId: id,
+				loggedIn: false,
+				accountLabel: null,
+				detail: null,
+				source: null,
+				warnings: ["No pude leer el estado de Claude."]
+			};
+		}
+	}
+	if (id === "cursor") return {
+		agentId: id,
+		loggedIn: true,
+		accountLabel: "Cursor",
+		detail: "Sesión del CLI / app",
+		source: "unknown",
+		warnings
+	};
+	return {
+		agentId: id,
+		loggedIn: false,
+		accountLabel: null,
+		detail: null,
+		source: null,
+		warnings
+	};
+}
+/**
+* Env vars que Copilot usa antes que OAuth / gh (impiden un cambio de cuenta real).
+* @param {NodeJS.ProcessEnv} [env]
+* @returns {string[]}
+*/
+function copilotTokenEnvOverrides(env = process.env) {
+	/** @type {string[]} */
+	const hit = [];
+	for (const key of [
+		"COPILOT_GITHUB_TOKEN",
+		"GH_TOKEN",
+		"GITHUB_TOKEN"
+	]) if (String(env[key] || "").trim()) hit.push(key);
+	return hit;
+}
+/**
+* Cuentas conocidas por `gh auth status --json hosts`.
+* @param {{ env?: NodeJS.ProcessEnv, run?: typeof spawnSync }} [opts]
+* @returns {{ host: string, user: string, active: boolean }[]}
+*/
+function listGhAuthAccounts(opts = {}) {
+	const env = opts.env || process.env;
+	const r = (opts.run || spawnSync)("gh", [
+		"auth",
+		"status",
+		"--json",
+		"hosts"
+	], {
+		encoding: "utf8",
+		env,
+		windowsHide: true
+	});
+	if (r.error) return [];
+	try {
+		const parsed = JSON.parse(String(r.stdout || "{}"));
+		const hosts = parsed?.hosts && typeof parsed.hosts === "object" ? parsed.hosts : {};
+		/** @type {{ host: string, user: string, active: boolean }[]} */
+		const out = [];
+		for (const [host, accounts] of Object.entries(hosts)) {
+			const list = Array.isArray(accounts) ? accounts : [];
+			for (const acc of list) {
+				const user = String(acc?.login || acc?.user || "").trim();
+				if (!user) continue;
+				out.push({
+					host: String(host),
+					user,
+					active: Boolean(acc?.active)
+				});
+			}
+		}
+		return out;
+	} catch {
+		return [];
+	}
+}
+/**
+* Cierra sesiones de `gh` (Copilot las reusa si no hay OAuth propio).
+* @param {{ env?: NodeJS.ProcessEnv, run?: typeof spawnSync, host?: string | null }} [opts]
+* @returns {{ ok: boolean, loggedOut: { host: string, user: string }[], warnings: string[] }}
+*/
+function logoutGhAuthAccounts(opts = {}) {
+	const env = opts.env || process.env;
+	const run = opts.run || spawnSync;
+	const onlyHost = normalizeCopilotLoginHost(opts.host) || null;
+	const accounts = listGhAuthAccounts({
+		env,
+		run
+	}).filter((a) => onlyHost ? a.host === onlyHost || a.host === `https://${onlyHost}` : true);
+	/** @type {{ host: string, user: string }[]} */
+	const loggedOut = [];
+	/** @type {string[]} */
+	const warnings = [];
+	for (const acc of accounts) {
+		const r = run("gh", [
+			"auth",
+			"logout",
+			"--hostname",
+			acc.host,
+			"--user",
+			acc.user
+		], {
+			encoding: "utf8",
+			env,
+			windowsHide: true
+		});
+		if (r.error) {
+			warnings.push(`No pude cerrar ${acc.user}@${acc.host}: ${r.error.message}`);
+			continue;
+		}
+		if (r.status !== 0) {
+			const err = String(r.stderr || r.stdout || "").trim() || `exit ${r.status}`;
+			warnings.push(`No pude cerrar ${acc.user}@${acc.host}: ${err}`);
+			continue;
+		}
+		loggedOut.push({
+			host: acc.host,
+			user: acc.user
+		});
+	}
+	const envHits = copilotTokenEnvOverrides(env);
+	if (envHits.length) warnings.push(`Hay ${envHits.join(", ")} en el entorno: Copilot seguirá usando ese token hasta que lo saques.`);
+	return {
+		ok: warnings.length === 0 || loggedOut.length > 0,
+		loggedOut,
+		warnings
+	};
+}
+/**
+* Comando de logout CLI por agente (sin depender de gh).
+* @param {string} agentId
+* @returns {LoginCommand | null}
+*/
+function logoutCommand(agentId) {
+	switch (agentId) {
+		case "claude": return {
+			bin: "claude",
+			args: ["auth", "logout"],
+			display: "claude auth logout"
+		};
+		default: return null;
+	}
+}
+/**
+* Cierra la sesión del agente para poder elegir otra cuenta.
+* Copilot: también desloguea cuentas de `gh` (si solo hacés logout OAuth, gh sigue ganando).
+*
+* @param {string} agentId
+* @param {{
+*   host?: string | null,
+*   env?: NodeJS.ProcessEnv,
+*   run?: typeof spawnSync,
+*   runTerminal?: typeof runLoginTerminal,
+*   cwd?: string,
+* }} [opts]
+* @returns {Promise<{ ok: boolean, steps: string[], warnings: string[] }>}
+*/
+async function runAgentLogout(agentId, opts = {}) {
+	const id = String(agentId || "").trim();
+	/** @type {string[]} */
+	const steps = [];
+	/** @type {string[]} */
+	const warnings = [];
+	const env = opts.env || process.env;
+	const run = opts.run || spawnSync;
+	const runTerm = opts.runTerminal || runLoginTerminal;
+	if (id === "copilot") {
+		const gh = logoutGhAuthAccounts({
+			env,
+			run,
+			host: opts.host
+		});
+		for (const a of gh.loggedOut) steps.push(`Cerré ${a.user} en ${a.host} (GitHub CLI)`);
+		warnings.push(...gh.warnings);
+		if (!gh.loggedOut.length && !gh.warnings.length) steps.push("No había cuentas de GitHub CLI activas.");
+		return {
+			ok: true,
+			steps,
+			warnings
+		};
+	}
+	const cmd = logoutCommand(id);
+	if (!cmd) return {
+		ok: false,
+		steps,
+		warnings: ["Este agente no tiene cierre de sesión desde la app."]
+	};
+	try {
+		const result = await runTerm(cmd, {
+			wait: true,
+			cwd: opts.cwd
+		});
+		if (result.code !== 0) {
+			warnings.push(`El logout terminó con código ${result.code ?? "?"}.`);
+			return {
+				ok: false,
+				steps,
+				warnings
+			};
+		}
+		steps.push(`Cerré la sesión (${cmd.display}).`);
+		return {
+			ok: true,
+			steps,
+			warnings
+		};
+	} catch (err) {
+		warnings.push(err instanceof Error ? err.message : String(err));
+		return {
+			ok: false,
+			steps,
+			warnings
+		};
+	}
 }
 /** @returns {string} */
 function modelsCachePath(home = homedir()) {
@@ -1250,6 +1904,23 @@ function writeModelsCache(agentId, data, opts = {}) {
 * review y después para las preguntas y los cambios que se le pidan desde la web. Cada pedido de permiso pasa por
 * `decide` (ver `acp-policy.mjs`): no hay nadie mirando una terminal para aprobar.
 */
+/**
+* session/new (u otra op) requiere login interactivo (terminal / terminal-meta).
+* No es un fallo genérico: la UI debe abrir el login y reintentar.
+*/
+var AcpAuthRequiredError = class extends Error {
+	/**
+	* @param {string} message
+	* @param {{ methods?: any[], agentId?: string, agentLabel?: string }} [info]
+	*/
+	constructor(message, info = {}) {
+		super(message);
+		this.name = "AcpAuthRequiredError";
+		this.methods = Array.isArray(info.methods) ? info.methods : [];
+		this.agentId = info.agentId || "";
+		this.agentLabel = info.agentLabel || "";
+	}
+};
 /** El agente tiene un modo ACP declarado (no todos los agentes lo traen). */
 function supportsAcp(agent) {
 	return typeof agent?.def?.acp === "function";
@@ -1280,7 +1951,7 @@ var ACP_START_TIMEOUT_MS = 9e4;
 * @returns {Promise<AcpSession>}
 */
 async function startAcpSession(agent, opts) {
-	if (!supportsAcp(agent)) throw new Error(`${agent.def.label} no tiene modo ACP.`);
+	if (!supportsAcp(agent)) throw new Error(`${agent.def.label} no se puede usar desde la web.`);
 	const { file, args, env, sessionMeta } = agent.def.acp({ path: agent.path });
 	const child = spawnCommand(file, args, {
 		cwd: opts.cwd,
@@ -1358,16 +2029,21 @@ async function startAcpSession(agent, opts) {
 					readTextFile: false,
 					writeTextFile: false
 				},
-				terminal: false
+				terminal: false,
+				auth: { terminal: true },
+				_meta: { "terminal-auth": true }
 			},
 			clientInfo: {
 				name: "diff-review",
 				version: "0"
 			}
 		});
-		/** Métodos donde el agente maneja el login por `authenticate` (no terminal interactiva). */
-		const agentAuthMethods = (Array.isArray(init.authMethods) ? init.authMethods : []).filter((m) => m && (!m.type || m.type === "agent") && m.id);
-		/** Si session/new falla por auth, pedimos `authenticate` una vez y reintentamos. */
+		const authMethods = Array.isArray(init.authMethods) ? init.authMethods : [];
+		const grouped = groupAuthMethods(authMethods);
+		/** Solo type agent (p. ej. Cursor `cursor_login`). Nunca terminal ni Copilot `_meta.terminal-auth`. */
+		const agentAuthMethods = grouped.agent;
+		const interactiveAuthMethods = [...grouped.terminal, ...grouped.terminalMeta];
+		/** Si session/new falla por auth, pedimos `authenticate` una vez (métodos agent) y reintentamos. */
 		const tryAuthenticate = async () => {
 			for (const method of agentAuthMethods) try {
 				await conn.agent.request(acp.methods.agent.authenticate, { methodId: method.id });
@@ -1375,6 +2051,14 @@ async function startAcpSession(agent, opts) {
 			} catch {}
 			return false;
 		};
+		const authRequired = (msg) => {
+			const label = agent.def.label;
+			return new AcpAuthRequiredError(authFailureMessage$1(agent.def.id, label, msg) || `Necesitás iniciar sesión en ${label}.`, {
+				methods: interactiveAuthMethods.length ? interactiveAuthMethods : authMethods,
+				agentId: agent.def.id,
+				agentLabel: label
+			});
+		};
 		const openNewSession = async () => {
 			try {
 				return await conn.agent.request(acp.methods.agent.session.new, {
@@ -1384,11 +2068,13 @@ async function startAcpSession(agent, opts) {
 				});
 			} catch (err) {
 				const msg = err instanceof Error ? err.message : String(err);
-				if (agentAuthMethods.length && looksLikeAuthFailure(msg) && await tryAuthenticate()) return await conn.agent.request(acp.methods.agent.session.new, {
+				if (!looksLikeAuthFailure(msg)) throw err;
+				if (agentAuthMethods.length && await tryAuthenticate()) return await conn.agent.request(acp.methods.agent.session.new, {
 					cwd: opts.cwd,
 					mcpServers: [],
 					...sessionMeta ? { _meta: sessionMeta } : {}
 				});
+				if (interactiveAuthMethods.length || agentAuthMethods.length || looksLikeAuthFailure(msg)) throw authRequired(msg);
 				throw err;
 			}
 		};
@@ -1420,7 +2106,7 @@ async function startAcpSession(agent, opts) {
 			if (!wanted || wanted === currentModel) return { currentModel };
 			if (!models) return {
 				currentModel,
-				warning: `El agente no deja elegir el modelo por ACP; usa el suyo.`
+				warning: `El agente no deja elegir el modelo; usa el suyo.`
 			};
 			if (!models.options.some((o) => o.value === wanted)) return {
 				currentModel,
@@ -1440,6 +2126,7 @@ async function startAcpSession(agent, opts) {
 			const applied = await setModel(initialWanted);
 			if (applied.warning) modelWarning = applied.warning;
 		}
+		const supportsLogout = Boolean(init.agentCapabilities?.auth?.logout);
 		clearTimeout(timer);
 		return {
 			sessionId,
@@ -1448,6 +2135,7 @@ async function startAcpSession(agent, opts) {
 			get currentModel() {
 				return currentModel;
 			},
+			supportsLogout,
 			...modelWarning ? { modelWarning } : {},
 			setModel,
 			prompt: async (text) => {
@@ -1461,6 +2149,11 @@ async function startAcpSession(agent, opts) {
 				return { stopReason: String(res.stopReason) };
 			},
 			cancel: () => conn.agent.notify(acp.methods.agent.session.cancel, { sessionId }),
+			/** ACP `logout` si el agente lo anunció; no garantiza nada sobre credenciales de `gh`. */
+			logout: async () => {
+				if (!supportsLogout) throw new Error(`${agent.def.label} no admite cerrar sesión desde acá.`);
+				await conn.agent.request(acp.methods.agent.logout, {});
+			},
 			close,
 			closed: conn.closed,
 			stderrTail: () => stderr
@@ -1468,13 +2161,24 @@ async function startAcpSession(agent, opts) {
 	} catch (err) {
 		clearTimeout(timer);
 		close();
+		if (err instanceof AcpAuthRequiredError) throw err;
 		const tail = stderr.trim().split(/\r?\n/).slice(-8).join("\n");
 		if (timedOut) {
 			const msg = `Timeout (${Math.round(timeoutMs / 1e3)}s) al lanzar ${agent.def.label}. ¿Está autenticado el CLI?`;
-			throw new Error(tail ? `${msg}\n${tail}` : msg);
+			const full = tail ? `${msg}\n${tail}` : msg;
+			if (looksLikeAuthFailure(full)) throw new AcpAuthRequiredError(authFailureMessage$1(agent.def.id, agent.def.label, full) || full, {
+				agentId: agent.def.id,
+				agentLabel: agent.def.label
+			});
+			throw new Error(full);
 		}
 		const reason = err instanceof Error ? err.message : String(err);
-		throw new Error(tail ? `${reason}\n${tail}` : reason);
+		const full = tail ? `${reason}\n${tail}` : reason;
+		if (looksLikeAuthFailure(full)) throw new AcpAuthRequiredError(authFailureMessage$1(agent.def.id, agent.def.label, full) || full, {
+			agentId: agent.def.id,
+			agentLabel: agent.def.label
+		});
+		throw new Error(full);
 	}
 }
 /**
@@ -1690,12 +2394,15 @@ function formatCheckReport(file, command, result) {
 /**
 * `agentSession` = la sesión ACP que generó la review, para seguir conversando con el agente desde la web.
 * @param {string} filePath
-* @param {{ agent?: string, model?: string, agentSession?: { agentId: string, sessionId: string, outputFilename: string } }} provenance
+* `modelLabel` = nombre legible que el agente da al modelo ("Haiku 5.5"): `model` puede ser un alias
+* (`haiku`) que más adelante apunte a otra versión.
+* @param {{ agent?: string, model?: string, modelLabel?: string, agentSession?: { agentId: string, sessionId: string, outputFilename: string } }} provenance
 * @returns {boolean}
 */
-function stampReviewProvenance(filePath, { agent, model, agentSession } = {}) {
+function stampReviewProvenance(filePath, { agent, model, modelLabel, agentSession } = {}) {
 	const agentName = String(agent || "").trim();
 	const modelId = String(model || "").trim();
+	const label = String(modelLabel || "").trim();
 	if (!agentName && !modelId && !agentSession) return false;
 	let payload;
 	try {
@@ -1707,7 +2414,11 @@ function stampReviewProvenance(filePath, { agent, model, agentSession } = {}) {
 	const current = payload.meta;
 	const meta = current && typeof current === "object" && !Array.isArray(current) ? { ...current } : {};
 	if (agentName) meta.agent = agentName;
-	if (modelId) meta.model = modelId;
+	if (modelId) {
+		meta.model = modelId;
+		if (label && label !== modelId) meta.modelLabel = label;
+		else delete meta.modelLabel;
+	}
 	if (agentSession) meta.agentSession = { ...agentSession };
 	payload.meta = meta;
 	writeFileSync(filePath, `${JSON.stringify(payload, null, 2)}\n`, "utf8");
@@ -1736,7 +2447,7 @@ var OUTPUT_SCHEMA_BLOCK = `{
       "id": "t1",
       "kind": "feat|fix|refactor|perf|test|chore|docs|infra",
       "title": "string, aim for ≤72 chars, imperative, no kind prefix",
-      "intent": "string"
+      "intent": "string: why this theme exists + what it changes for the reader (not a restatement of the title)"
     }
   ],
   "blocks": [
@@ -1749,8 +2460,8 @@ var OUTPUT_SCHEMA_BLOCK = `{
       "start": 40,
       "end": 58,
       "op": "add|mod|del|rename",
-      "what": "string, aim for ≤120 chars: concrete change + effect",
-      "why": "string, aim for ≤120 chars",
+      "what": "string: concrete change + effect (aim ≤120 chars; longer OK if needed for clarity)",
+      "why": "string: motivation / why this change belongs in the branch (aim ≤120 chars)",
       "source": "code|commit|pr|issue|inferred"
     }
   ],
@@ -1764,8 +2475,8 @@ var OUTPUT_SCHEMA_BLOCK = `{
       "file": "relative/path.ext",
       "line": 87,
       "block": "b1",
-      "what": "string, aim for ≤120 chars: concrete cause + observable consequence (what fails / risk / cost)",
-      "fix": "string, aim for ≤120 chars: suggested change + what the reader gains or avoids if applied"
+      "what": "string: cause + why it is a problem + observable consequence (aim ≤120 chars; prefer clarity over brevity)",
+      "fix": "string: suggested change + why that change resolves the problem / what it avoids (aim ≤120 chars)"
     }
   ],
   "skipped": [
@@ -1779,13 +2490,16 @@ var RULES = `- Ids: themes use \`t1\`, \`t2\`, …; findings use \`f1\`, \`f2\`,
 - Line anchors: "lines"/"start"/"end"/"line" MUST match the chosen "side" ("new" = post-image / right side of @@; "old" = pre-image, typically deletions). One block per coherent change span, not one per line. Point findings at that block; leave "block" empty only if cross-cutting.
 - Do NOT report: pre-existing code outside the diff; linter/formatter noise; naming/style prefs with no real consequence; intentional branch behavior; silenced lint rules; "missing docs/coverage" without a concrete broken scenario.
 - Quality findings must name a concrete cost, not a vague feeling.
-- Finding "what": state the concrete cause and the observable consequence (what fails, the risk, or the cost) — not only a symptom.
-- Finding "fix": state the suggested change and what the reader gains or avoids if they apply it.
+- Theme "intent": explain why the theme exists and what it changes for the reader — not a paraphrase of "title". One short sentence is too little; aim for 1–3 sentences with cause and scope.
+- Top-level "intent": 2–4 sentences on what the branch solves and why it matters.
+- Finding "what": cover (1) the concrete cause in the diff, (2) why it is a problem (failure mode, risk, or cost), and (3) the observable consequence. Do not stop at a symptom label.
+- Finding "fix": cover (1) the suggested change and (2) why that change resolves the problem / what the reader gains or avoids. Vague advice ("mejorar el manejo") is not enough.
 - Signal over volume: prefer fewer high-signal findings. Order findings by severity (high, then nit). Use "nit" sparingly.
 - "blocking": true ONLY if the branch should not merge as-is. Use only with class "risk".
-- When several read-only lookups are independent (files, searches), batch them in the same turn if your tools allow parallel calls.
+- Parallelize: when several read-only lookups are independent (Read, Grep/search, Glob, etc.), issue them in the same turn if your tools allow parallel calls. Do not serialize independent work — finish faster by batching.
 - Write human-readable strings (intent, title, what, why, fix, notes) in Spanish. Keep enums/ids/paths/JSON keys exactly as in the schema.
-- Length is a soft target, not a check: aim for title ≤72 characters and what/why/fix ≤120 characters. Prefer clarity over shortening. Longer text is still valid. Do not rewrite the file only to shorten it.`;
+- Length is a soft target, not a check: aim for title ≤72 characters and what/why/fix ≤120 characters when possible. Prefer clarity over shortening — thin one-liners that omit cause, impact, or why-the-fix-works are worse than a slightly longer explanation. Longer text is still valid. Do not rewrite the file only to shorten it.
+- If the output JSON already exists and findings have \`resolution\` ({ kind: ignored|fix|corrected, detail?: string }), preserve those fields on rewrite (coverage / edit / regenerate). Keep existing finding ids when possible; do not drop or reshuffle resolutions.`;
 /** @param {{ hasDiff?: boolean }} [ctx] */
 function workflowLocal(base, branch, ctx = {}) {
 	if (ctx.hasDiff) return `Workflow:
@@ -1934,9 +2648,9 @@ Write the result to \`${outputPath}\` (relative to the repo root; use forward sl
 
 ${outputSchemaBlock(meta)}
 
-Include "meta" with the source/repo/branch/base above (and origin "remoteUrl" when local). "agent" and "model" are required: set "agent" to the product you are (Claude Code, Cursor, Codex, Copilot, Gemini, …) and "model" to the exact model id you are running. Do not leave placeholders or omit them; validation fails without both. "generatedAt" is optional (ISO-8601 now).
+Include "meta" with the source/repo/branch/base above (and origin "remoteUrl" when local). "agent" and "model" are required: set "agent" to the product you are (Claude Code, Cursor, Copilot, …) and "model" to the exact model id you are running. Do not leave placeholders or omit them; validation fails without both. "generatedAt" is optional (ISO-8601 now).
 
-Do NOT include diffs or a "files" array. The tool loads the companion \`.diff\` (or computes with git if missing) when opening the report. Do not invent hunks or paste patches into the JSON.
+Do NOT include diffs or a "files" array. The tool loads the companion \`.diff\` (or computes with git if missing) when opening the report. Do not invent hunks or paste patches into the JSON. If you are rewriting an existing review JSON, copy through any per-finding \`resolution\` already present.
 
 ${validateSection}`;
 }
@@ -2102,7 +2816,7 @@ function agentModels(agentId, cwd, opts) {
 function findAgent(agentId) {
 	const agent = detectAgents().find((a) => a.def.id === agentId);
 	if (!agent) throw new Error(`No encontré el agente "${agentId}" instalado.`);
-	if (!supportsAcp(agent)) throw new Error(`${agent.def.label} no tiene modo ACP.`);
+	if (!supportsAcp(agent)) throw new Error(`${agent.def.label} no se puede usar desde la web.`);
 	return agent;
 }
 function info(entry) {
@@ -2126,9 +2840,137 @@ function info(entry) {
 function authFailureMessage(agentId, agentLabel, detail) {
 	return authFailureMessage$1(agentId, agentLabel, detail);
 }
-/** Abre una terminal con el login del agente (Claude `/login`, `gh auth login`, …). */
-function openAgentLogin(agentId) {
-	return openLoginTerminal(String(agentId || ""));
+/**
+* Abre el login del agente.
+* - Con `sessionId`: comando según authMethods ACP (proceso oculto sin TTY), espera exit 0, reconecta y retoma.
+* - Solo `agentId`: lanza el comando fallback en background (p. ej. fallo al listar modelos).
+*/
+async function openAgentLogin(input) {
+	const sessionId = String(input?.sessionId || "").trim();
+	const agentId = String(input?.agentId || "").trim();
+	const host = input?.host != null ? String(input.host) : void 0;
+	if (sessionId) {
+		const entry = sessions.get(sessionId);
+		if (!entry) throw new Error("La sesión del agente ya no existe. Recargá la página.");
+		const method = pickLoginAuthMethod(entry.pendingAuthMethods || []);
+		let cmd;
+		try {
+			cmd = resolveLoginCommand(entry.agent, method);
+		} catch {
+			cmd = loginCommand(entry.agentId, { host });
+			if (!cmd) throw new Error("Este agente no tiene un inicio de sesión conocido.");
+		}
+		if (entry.agentId === "copilot" || agentId === "copilot") cmd = withCopilotLoginHost(cmd, host);
+		setStatus(entry, "starting", loginWaitingMessage());
+		entry.busy = true;
+		try {
+			const result = await runLoginTerminal(cmd, {
+				wait: true,
+				cwd: entry.repo
+			});
+			if (result.code !== 0) {
+				entry.busy = false;
+				const msg = loginIncompleteMessage();
+				setStatus(entry, "needs_auth", msg);
+				throw new Error(msg);
+			}
+			try {
+				entry.acp?.close();
+			} catch {}
+			entry.acp = null;
+			entry.pendingAuthMethods = null;
+			const resume = entry.authResume || "chat";
+			entry.authResume = null;
+			entry.busy = false;
+			if (resume === "review") {
+				setStatus(entry, "starting", "Login ok. Reintentando la review…");
+				continueReviewAfterDiff(entry, {
+					repo: entry.repo,
+					branch: entry.branch,
+					base: entry.base,
+					outputFilename: entry.outputFilename,
+					model: entry.model || void 0
+				});
+			} else {
+				setStatus(entry, "starting", "Login ok. Reconectando con el agente…");
+				try {
+					await ensureAcp(entry, entry.model || void 0);
+					setStatus(entry, "idle");
+				} catch (err) {
+					entry.busy = false;
+					if (isAuthError(err)) markNeedsAuth(entry, err, "chat");
+					else {
+						const raw = err instanceof Error ? err.message : String(err);
+						setStatus(entry, "error", authFailureMessage(entry.agentId, entry.agentLabel, raw) || raw);
+					}
+					throw err;
+				}
+			}
+			return {
+				display: result.display,
+				resumed: true,
+				code: result.code
+			};
+		} catch (err) {
+			entry.busy = false;
+			if (entry.status !== "needs_auth" && entry.status !== "error" && entry.status !== "starting") setStatus(entry, "needs_auth", err instanceof Error ? err.message : String(err));
+			throw err;
+		}
+	}
+	if (!agentId) throw new Error("Falta agentId o sessionId.");
+	const cmd = loginCommand(agentId, { host });
+	if (!cmd) throw new Error("Este agente no tiene un inicio de sesión conocido.");
+	return openLoginTerminal(cmd);
+}
+/**
+* Cierra la sesión del agente (y cuentas `gh` si es Copilot) para poder elegir otra cuenta.
+* Deja la entry en `needs_auth` lista para un nuevo login.
+*/
+async function openAgentLogout(input) {
+	const sessionId = String(input?.sessionId || "").trim();
+	const host = input?.host != null ? String(input.host) : void 0;
+	let agentId = String(input?.agentId || "").trim();
+	/** @type {Entry | undefined} */
+	let entry;
+	if (sessionId) {
+		entry = sessions.get(sessionId);
+		if (!entry) throw new Error("La sesión del agente ya no existe. Recargá la página.");
+		agentId = entry.agentId || agentId;
+	}
+	if (!agentId) throw new Error("Falta agentId o sessionId.");
+	/** @type {string[]} */
+	const steps = [];
+	/** @type {string[]} */
+	const warnings = [];
+	if (entry?.acp?.supportsLogout) try {
+		await entry.acp.logout();
+		steps.push("Cerré la sesión del agente.");
+	} catch (err) {
+		warnings.push(err instanceof Error ? err.message : String(err));
+	}
+	try {
+		entry?.acp?.close();
+	} catch {}
+	if (entry) {
+		entry.acp = null;
+		entry.starting = null;
+		entry.busy = false;
+		entry.pendingAuthMethods = null;
+		entry.authResume = entry.authResume || (entry.seed || entry.diffText ? "review" : "chat");
+	}
+	const cli = await runAgentLogout(agentId, {
+		host,
+		cwd: entry?.repo
+	});
+	steps.push(...cli.steps);
+	warnings.push(...cli.warnings);
+	const msg = warnings.length && !cli.ok ? warnings[0] : "Sesión cerrada. Elegí con qué cuenta iniciar de nuevo.";
+	if (entry) setStatus(entry, "needs_auth", msg);
+	return {
+		ok: cli.ok || steps.length > 0,
+		steps,
+		warnings
+	};
 }
 /** Escribe seed (JSON + .diff) en `.diff-review/` para que el agente los lea. */
 function materializeSeed(entry) {
@@ -2145,15 +2987,25 @@ function materializeSeed(entry) {
 		});
 	} catch {}
 }
+/** Escribe (pisa) el companion `.chat.md` de handoff si hay markdown pendiente. */
+function materializeHandoffChat(entry) {
+	const text = entry.handoffChatMarkdown;
+	if (text == null) return;
+	try {
+		writeHandoffChat(entry.repo, entry.outputFilename, text);
+	} catch {}
+	entry.handoffChatMarkdown = null;
+}
 /** Prefijo del primer mensaje cuando la sesión ACP es nueva. */
-function contextPreamble(entry) {
+function contextPreamble(entry, handoffNote) {
 	materializeSeed(entry);
+	materializeHandoffChat(entry);
 	const paths = companionPaths(entry.repo, entry.outputFilename);
 	const jsonRel = outputRelPath(entry.outputFilename);
 	const diffRel = `${outputRelPath(entry.outputFilename).replace(/\.json$/i, "")}.diff`;
 	const hasJson = existsSync(paths.json);
 	const hasDiff = existsSync(paths.diff);
-	return [
+	const lines = [
 		"Context for this chat (new agent session — read these files before answering):",
 		`- Repo: ${entry.repo}`,
 		`- Branch under review: ${entry.branch}`,
@@ -2161,8 +3013,14 @@ function contextPreamble(entry) {
 		hasJson ? `- Review JSON (relative to repo root): \`${jsonRel}\` — read this file.` : `- Review JSON: not available on disk (no seed/payload was provided). Say so if you need it.`,
 		hasDiff ? `- Diff (relative to repo root): \`${diffRel}\` — read this file.` : `- Diff file: not available on disk (no seed/diff and git cache failed). Say so if you need it.`,
 		"",
-		"User message:"
-	].join("\n");
+		"The user question or fix request is the priority. The review JSON is reference context — do not re-litigate or re-review findings unless the user asks.",
+		"",
+		"Findings may include optional `resolution` ({ kind: ignored|fix|corrected, detail?: string }) written by the UI. Preserve those fields when editing the JSON. Corrected findings and their detail are prior work — use them as context; do not undo them unless the user asks."
+	];
+	const note = String(handoffNote || "").trim();
+	if (note) lines.push("", note);
+	lines.push("", "User message:");
+	return lines.join("\n");
 }
 function permissionReasonLabel(allow, scope, deniedReason) {
 	if (!allow) return deniedReason;
@@ -2263,14 +3121,36 @@ function emit(entry, event) {
 }
 function setStatus(entry, status, message) {
 	entry.status = status;
-	if (status === "error") entry.statusMessage = message || entry.statusMessage || "Error del agente.";
+	if (status === "error" || status === "needs_auth") entry.statusMessage = message || entry.statusMessage || "Error del agente.";
 	else if (message !== void 0) delete entry.statusMessage;
 	emit(entry, {
 		type: "status",
 		status,
-		...message || status === "error" ? { message: message || entry.statusMessage } : {}
+		...message || status === "error" || status === "needs_auth" ? { message: message || entry.statusMessage } : {}
 	});
 }
+function markNeedsAuth(entry, err, resume) {
+	const authErr = err instanceof AcpAuthRequiredError ? err : null;
+	const raw = err instanceof Error ? err.message : String(err);
+	const msg = authErr?.message || authFailureMessage(entry.agentId, entry.agentLabel, raw) || raw;
+	entry.pendingAuthMethods = authErr?.methods?.length ? authErr.methods : entry.pendingAuthMethods;
+	entry.authResume = resume;
+	entry.acp = null;
+	setStatus(entry, "needs_auth", msg);
+}
+function isAuthError(err) {
+	if (err instanceof AcpAuthRequiredError) return true;
+	return looksLikeAuthFailure(err instanceof Error ? err.message : String(err));
+}
+/** Sin sesión CLI y con login desde la app (Claude / Copilot / Cursor). */
+function needsInteractiveLogin(agentId) {
+	if (!loginCommand(agentId)) return false;
+	try {
+		return !agentAccountStatus(agentId).loggedIn;
+	} catch {
+		return false;
+	}
+}
 /** SessionUpdate de ACP → evento de la web (lo que no se muestra se descarta). */
 function toEvent(update) {
 	switch (update.sessionUpdate) {
@@ -2354,13 +3234,13 @@ async function ensureAcp(entry, model) {
 				entry.busy = false;
 				const auth = authFailureMessage(entry.agentId, entry.agentLabel, stderr);
 				if (auth) {
-					setStatus(entry, "error", auth);
+					markNeedsAuth(entry, new Error(auth), entry.mode === "review" ? "review" : "chat");
 					return;
 				}
 				const raw = stderr.trim() || `código ${code ?? "?"}`;
 				const authFromCode = authFailureMessage(entry.agentId, entry.agentLabel, raw);
 				if (authFromCode) {
-					setStatus(entry, "error", authFromCode);
+					markNeedsAuth(entry, new Error(authFromCode), entry.mode === "review" ? "review" : "chat");
 					return;
 				}
 				const tail = stderr.trim().split(/\r?\n/).slice(-3).join(" · ");
@@ -2428,7 +3308,7 @@ function checkEntryReport(entry) {
 function invalidJsonFixPrompt(entry, path, result) {
 	return `${formatCheckReport(path, validateCliCommand(entry.outputFilename), result)}
 
-Critical: do NOT only bump meta.generatedAt or rewrite notes. Edit \`${outputRelPath(entry.outputFilename).replace(/\\/g, "/")}\` so every problem above is fixed (add blocks or skipped for each missing path). Do not claim success until coverage is complete.
+Critical: fix ONLY the listed schema/validation errors above. Do NOT regenerate or reshuffle findings unnecessarily. Preserve existing finding ids and any \`resolution\` fields when possible. Do NOT only bump meta.generatedAt or rewrite notes. Edit \`${outputRelPath(entry.outputFilename).replace(/\\/g, "/")}\` so every problem above is fixed (add blocks or skipped for each missing path). Do not claim success until coverage is complete.
 
 ${TOOL_RULES}
 
@@ -2478,6 +3358,7 @@ async function checkOutput(entry, since, retriesLeft) {
 		stampReviewProvenance(path, {
 			agent: entry.agentLabel,
 			model: entry.model,
+			modelLabel: entry.acp?.models.find((o) => o.value === entry.model)?.name,
 			agentSession: {
 				agentId: entry.agentId,
 				sessionId: entry.acpSessionId,
@@ -2545,6 +3426,11 @@ async function runTurn(entry, text, mode, opts) {
 		mode: mode === "review" ? "review" : mode
 	});
 	try {
+		if (!entry.acp && needsInteractiveLogin(entry.agentId)) {
+			entry.busy = false;
+			markNeedsAuth(entry, /* @__PURE__ */ new Error("not logged in"), mode === "review" ? "review" : "chat");
+			return;
+		}
 		if (!entry.acp) setStatus(entry, "starting", `Lanzando ${entry.agentLabel}…`);
 		const acp = await ensureAcp(entry, opts.model);
 		if (entry.cancelled) {
@@ -2566,7 +3452,7 @@ async function runTurn(entry, text, mode, opts) {
 			setStatus(entry, "idle", "Cancelado.");
 			return;
 		}
-		if (mode !== "ask") await checkOutput(entry, since, OUTPUT_AUTO_RETRIES);
+		if (mode !== "ask" && mode !== "fix") await checkOutput(entry, since, OUTPUT_AUTO_RETRIES);
 		entry.busy = false;
 		if (entry.cancelled) setStatus(entry, "idle", "Cancelado.");
 		else setStatus(entry, "idle");
@@ -2576,6 +3462,10 @@ async function runTurn(entry, text, mode, opts) {
 			setStatus(entry, "idle", "Cancelado.");
 			return;
 		}
+		if (isAuthError(err)) {
+			markNeedsAuth(entry, err, mode === "review" ? "review" : "chat");
+			return;
+		}
 		const raw = err instanceof Error ? err.message : String(err);
 		setStatus(entry, "error", authFailureMessage(entry.agentId, entry.agentLabel, raw) || raw);
 	} finally {
@@ -2608,10 +3498,14 @@ function newEntry(agent, fields) {
 		rejections: [],
 		needsContext: false,
 		seed: null,
+		handoffNote: null,
+		handoffChatMarkdown: null,
 		diffPaths: null,
 		pendingPermissions: /* @__PURE__ */ new Map(),
 		sessionAllowDenied: false,
-		cancelled: false
+		cancelled: false,
+		pendingAuthMethods: null,
+		authResume: null
 	};
 	sessions.set(entry.id, entry);
 	return entry;
@@ -2697,9 +3591,13 @@ async function continueReviewAfterDiff(entry, input) {
 */
 async function openChat(input) {
 	const sessionId = String(input.sessionId || "").trim();
+	const handoffNote = String(input.handoffNote || "").trim() || null;
+	const handoffChat = input.handoffChatMarkdown != null ? String(input.handoffChatMarkdown) : null;
 	if (sessionId) {
 		for (const entry of sessions.values()) if (entry.acpSessionId === sessionId && entry.repo === input.repo) {
 			if (input.seed) entry.seed = input.seed;
+			if (handoffNote) entry.handoffNote = handoffNote;
+			if (handoffChat != null) entry.handoffChatMarkdown = handoffChat;
 			return info(entry);
 		}
 	}
@@ -2709,14 +3607,23 @@ async function openChat(input) {
 		acpSessionId: sessionId
 	});
 	if (input.seed) entry.seed = input.seed;
+	if (handoffNote) entry.handoffNote = handoffNote;
+	if (handoffChat != null) entry.handoffChatMarkdown = handoffChat;
 	if (!sessionId) entry.needsContext = true;
+	if (needsInteractiveLogin(entry.agentId)) {
+		markNeedsAuth(entry, /* @__PURE__ */ new Error("not logged in"), "chat");
+		return info(entry);
+	}
 	try {
 		if (!entry.acp) setStatus(entry, "starting", `Lanzando ${entry.agentLabel}…`);
 		await ensureAcp(entry, input.model);
 		if (entry.status === "starting") setStatus(entry, "idle");
 	} catch (err) {
-		const raw = err instanceof Error ? err.message : String(err);
-		setStatus(entry, "error", authFailureMessage(entry.agentId, entry.agentLabel, raw) || raw);
+		if (isAuthError(err)) markNeedsAuth(entry, err, "chat");
+		else {
+			const raw = err instanceof Error ? err.message : String(err);
+			setStatus(entry, "error", authFailureMessage(entry.agentId, entry.agentLabel, raw) || raw);
+		}
 	}
 	return info(entry);
 }
@@ -2726,13 +3633,17 @@ function sendMessage(id, text, mode, opts) {
 	const body = text.trim();
 	if (!body) throw new Error("El mensaje está vacío.");
 	if (entry.busy) throw new Error("El agente todavía está trabajando en el pedido anterior.");
+	const sendHandoff = String(opts?.handoffNote || "").trim();
+	if (sendHandoff) entry.handoffNote = sendHandoff;
+	if (opts?.handoffChatMarkdown != null) entry.handoffChatMarkdown = String(opts.handoffChatMarkdown);
 	let agentText = body;
 	if (entry.needsContext) {
-		agentText = `${contextPreamble(entry)}\n${body}`;
+		agentText = `${contextPreamble(entry, entry.handoffNote)}\n${body}`;
 		entry.needsContext = false;
+		entry.handoffNote = null;
 		entry.seed = null;
 	}
-	runTurn(entry, mode === "edit" ? `${agentText}\n\nApply this by editing ${entry.outputFilename} in place (keep everything else as is). Reply briefly in Spanish with what you changed.\n\n${SERVER_VALIDATES}` : `${agentText}\n\nAnswer in Spanish. This is a question about the review: do not modify any file.`, mode, {
+	runTurn(entry, mode === "edit" ? `${agentText}\n\nApply this by editing ${entry.outputFilename} in place (keep everything else as is; preserve finding ids and any \`resolution\` fields). Reply briefly in Spanish with what you changed.\n\n${SERVER_VALIDATES}` : mode === "fix" ? `${agentText}\n\nApply ONLY the listed code fixes by editing files inside this repo. Do not rewrite the review JSON. Touch nothing else. Reply briefly in Spanish with a short per-finding detail suitable for resolution.detail.` : `${agentText}\n\nAnswer in Spanish. This is a question about the review: do not modify any file.`, mode, {
 		shown: body,
 		model: String(opts?.model || "").trim() || void 0
 	});
@@ -2747,6 +3658,23 @@ function retryReview(id) {
 	const entry = sessions.get(String(id || ""));
 	if (!entry) throw new Error("La sesión del agente ya no existe. Recargá la página.");
 	if (entry.busy) throw new Error("El agente todavía está trabajando en el pedido anterior.");
+	if (entry.status === "needs_auth" || entry.status === "error" && looksLikeAuthFailure(entry.statusMessage || "")) {
+		entry.pendingAuthMethods = null;
+		entry.authResume = null;
+		try {
+			entry.acp?.close();
+		} catch {}
+		entry.acp = null;
+		setStatus(entry, "starting", "Reintentando la review…");
+		continueReviewAfterDiff(entry, {
+			repo: entry.repo,
+			branch: entry.branch,
+			base: entry.base,
+			outputFilename: entry.outputFilename,
+			model: entry.model || void 0
+		});
+		return info(entry);
+	}
 	if (entry.status === "error") throw new Error(entry.statusMessage || "La sesión está en error; iniciá una nueva review.");
 	const posixRel = outputRelPath(entry.outputFilename).replace(/\\/g, "/");
 	const existing = checkEntryReport(entry);
@@ -2853,6 +3781,35 @@ async function cancelTurn(id) {
 	entry.busy = false;
 	setStatus(entry, "idle", "Cancelado.");
 }
+/**
+* Cierra la sesión de chat: ACP, Map y permisos pendientes.
+* La UI lo usa al cambiar de agente (el reporte / triage se mantienen).
+*/
+async function closeChat(id) {
+	const entry = sessions.get(String(id || ""));
+	if (!entry) return;
+	entry.cancelled = true;
+	for (const [requestId, pending] of [...entry.pendingPermissions]) {
+		clearTimeout(pending.timer);
+		entry.pendingPermissions.delete(requestId);
+		try {
+			pending.resolve(false, { quiet: true });
+		} catch {}
+	}
+	if (entry.idleTimer) {
+		clearTimeout(entry.idleTimer);
+		entry.idleTimer = null;
+	}
+	try {
+		if (entry.acp && entry.busy) try {
+			await entry.acp.cancel();
+		} catch {}
+		entry.acp?.close();
+	} catch {}
+	entry.acp = null;
+	entry.listeners.clear();
+	sessions.delete(entry.id);
+}
 function subscribe(id, listener) {
 	const entry = sessions.get(id);
 	if (!entry) return null;
@@ -2876,5 +3833,5 @@ function startPendingAgentRun() {
 	}
 }
 
-export { agentModels as a, startReview as b, sendMessage as c, setPermissionTrust as d, cancelTurn as e, retryReview as f, openAgentLogin as g, loginCommand as h, subscribe as i, startPendingAgentRun as j, listAcpAgents as l, openChat as o, respondPermission as r, sessionInfo as s };
-//# sourceMappingURL=agent-sessions-C_hlZJKN.js.map
+export { agentModels as a, startReview as b, sendMessage as c, setPermissionTrust as d, cancelTurn as e, closeChat as f, retryReview as g, agentAccountStatus as h, openAgentLogin as i, openAgentLogout as j, subscribe as k, listAcpAgents as l, startPendingAgentRun as m, openChat as o, respondPermission as r, sessionInfo as s };
+//# sourceMappingURL=agent-sessions-BArYLTW6.js.map