@pellux/goodvibes-tui 1.13.0 → 1.14.0

package/src/input/settings-modal.ts

@@ -25,6 +25,9 @@ import {
 } from './settings-modal-secrets.ts';
 import type { FeatureFlagManager } from '@/runtime/index.ts';
 import type { McpRegistry } from '@pellux/goodvibes-sdk/platform/mcp';
+import { isWorktreeSetupListConfigKey, parseWorktreeSetupListInput } from './worktree-setup-config.ts';
+import { isSandboxExecListConfigKey, parseSandboxExecListInput } from './sandbox-exec-config.ts';
+import { isExecEnvScrubAllowlistConfigKey, parseExecEnvScrubAllowlistInput } from './exec-env-scrub-config.ts';
 
 import {
   SETTINGS_CATEGORIES,
@@ -48,6 +51,7 @@ import {
 import { getSettingLabel } from '../renderer/settings-modal-helpers.ts';
 import {
   applySettingValue,
+  applyFlagState,
   type SettingAppliedCallback,
 } from './settings-modal-mutations.ts';
 import {
@@ -56,7 +60,6 @@ import {
 } from './settings-modal-activation.ts';
 import {
   adjustSelected as _adjustSelected,
-  toggleSelectedFlag as _toggleSelectedFlag,
 } from './settings-modal-adjustment.ts';
 import {
   resetSelected as _resetSelected,
@@ -203,7 +206,7 @@ export class SettingsModal {
     this.serviceRegistry = serviceRegistry;
     this.mcpRegistry = mcpRegistry ?? null;
     this.onSettingApplied = options?.onSettingApplied ?? null;
-    this.groups = buildSettingGroups(configManager);
+    this.groups = buildSettingGroups(configManager, featureFlagManager);
     this.flagEntries = buildFlagEntries(featureFlagManager);
     this.mcpEntries = buildMcpEntries(this.mcpRegistry);
     this.subscriptionEntries = buildSubscriptionEntries(subscriptionManager, serviceRegistry);
@@ -378,11 +381,14 @@ export class SettingsModal {
     return items[Math.max(0, Math.min(items.length - 1, this.selectedIndex))] ?? null;
   }
 
-  /** Get the currently selected flag entry (flags tab only). */
+  /**
+   * Get the flag entry for the currently selected feature-unit header row, or
+   * null when the selected row is a plain config setting. Feature-unit headers
+   * now live across topical categories (not a single flags tab), so this reads
+   * the selected SettingEntry's attached flag rather than a separate list.
+   */
   getSelectedFlag(): FlagEntry | null {
-    if (this.currentCategory !== 'flags') return null;
-    if (this.flagEntries.length === 0) return null;
-    return this.flagEntries[Math.max(0, Math.min(this.flagEntries.length - 1, this.selectedIndex))] ?? null;
+    return this.getSelected()?.flag ?? null;
   }
 
   getSelectedMcp(): McpEntry | null {
@@ -493,11 +499,32 @@ export class SettingsModal {
    * only (require restart). runtimeToggleable flags toggle immediately.
    */
   toggleSelectedFlag(): void {
-    _toggleSelectedFlag({
-      featureFlagManager: this.featureFlagManager,
-      configManager: this.configManager,
-      getSelectedFlag: () => this.getSelectedFlag(),
-    });
+    const entry = this.getSelected();
+    if (!entry?.flag) return;
+    if (entry.flag.state === 'killed') return;
+    this._toggleFlagValue(entry.setting.key as ConfigKey, entry.flag.state !== 'enabled');
+  }
+
+  /**
+   * Toggle the feature flag behind a `featureFlags.<id>` header row. Finds the
+   * header entry, applies the desired state through the flag manager (runtime +
+   * persisted override), and refreshes the header row's value/default marker in
+   * place. Killed flags and no-op toggles are ignored.
+   */
+  private _toggleFlagValue(key: ConfigKey, value: unknown): void {
+    if (!this.featureFlagManager || !this.configManager) return;
+    let target: SettingEntry | null = null;
+    for (const entries of this.groups.values()) {
+      const candidate = entries.find((e) => e.setting.key === key && e.flag);
+      if (candidate) { target = candidate; break; }
+    }
+    if (!target?.flag) return;
+    if (target.flag.state === 'killed') return;
+    const desired = value ? 'enabled' : 'disabled';
+    if (target.flag.state === desired) return;
+    applyFlagState(target.flag, desired, this.featureFlagManager, this.configManager);
+    target.currentValue = target.flag.state === 'enabled';
+    target.isDefault = target.flag.state === target.flag.flag.defaultState;
   }
 
   /**
@@ -565,7 +592,20 @@ export class SettingsModal {
       return false;
     }
 
-    if (setting.type === 'string' && isSecretConfigKey(setting.key)) {
+    if (isWorktreeSetupListConfigKey(setting.key)) {
+      // Comma-separated display/edit convention for the array-backed
+      // worktree.setup.* keys — see worktree-setup-config.ts.
+      this._setValue(setting.key, parseWorktreeSetupListInput(this.editBuffer));
+    } else if (isSandboxExecListConfigKey(setting.key)) {
+      // Same comma-separated convention for the array-backed
+      // sandbox.egressAllowlist / sandbox.workspaceWritable keys — see
+      // sandbox-exec-config.ts.
+      this._setValue(setting.key, parseSandboxExecListInput(this.editBuffer));
+    } else if (isExecEnvScrubAllowlistConfigKey(setting.key)) {
+      // Same comma-separated convention for permissions.execEnvScrubAllowlist
+      // — see exec-env-scrub-config.ts.
+      this._setValue(setting.key, parseExecEnvScrubAllowlistInput(this.editBuffer));
+    } else if (setting.type === 'string' && isSecretConfigKey(setting.key)) {
       setSecretBackedSettingValue({
         key: setting.key,
         value: String(parsed ?? ''),
@@ -656,11 +696,14 @@ export class SettingsModal {
     }
   }
 
-  /** Returns [] for the flags/mcp/subscriptions categories. */
+  /**
+   * Returns [] for the mcp/subscriptions categories (which render their own
+   * entry types). The 'flags' category now flows through the normal group path
+   * — it holds the no-config feature-unit toggles (Advanced Features).
+   */
   private _currentItems(): SettingEntry[] {
     if (
-      this.currentCategory === 'flags'
-      || this.currentCategory === 'mcp'
+      this.currentCategory === 'mcp'
       || this.currentCategory === 'subscriptions'
     ) return [];
     const items = this.groups.get(this.currentCategory) ?? [];
@@ -673,6 +716,15 @@ export class SettingsModal {
   private _setValue(key: ConfigKey, value: unknown): void {
     if (!this.configManager) return;
 
+    // Feature-unit toggle headers write to `featureFlags.<id>`; route those to
+    // the feature-flag manager (runtime toggle + persisted override) instead of
+    // a plain config write. Reset/adjust/activate all funnel a boolean value
+    // here (true = enabled), so this is the single flag-toggle chokepoint.
+    if (typeof key === 'string' && key.startsWith('featureFlags.')) {
+      this._toggleFlagValue(key, value);
+      return;
+    }
+
     const callback: SettingAppliedCallback | null = this.onSettingApplied
       ? (change) => this.onSettingApplied!(change)
       : null;

package/src/input/submission-router.ts

@@ -7,7 +7,10 @@ export interface SubmissionRouterInput {
   readonly hasAttachments?: boolean;
 }
 
-const PLAN_COMMANDS = new Set(['plan']);
+// The project-planning command (renamed from /plan to /project-plan when /plan
+// became the plan-mode toggle) takes a free-form goal, so it keeps the distinct
+// 'plan' composer intent/label. The /plan mode-toggle is a plain slash command.
+const PLAN_COMMANDS = new Set(['project-plan', 'planning']);
 const REVIEW_COMMANDS = new Set(['review']);
 const PANEL_COMMANDS = new Set(['panel']);
 const ORCHESTRATION_COMMANDS = new Set([

package/src/input/worktree-setup-config.ts

@@ -0,0 +1,93 @@
+/**
+ * worktree-setup-config.ts — TUI-local synthetic settings entries for
+ * worktree.setup.commands / worktree.setup.carryOverGlobs.
+ *
+ * Neither key is in the SDK's ConfigKey union: the SDK's cold-start worktree
+ * setup (platform/runtime/worktree/setup.ts, resolveWorktreeSetupConfig)
+ * reads them off a generic `get(key: string)` rather than the typed
+ * CONFIG_SCHEMA, so without this file they are invisible to /config and the
+ * settings modal even though they fully control what runs when a fresh
+ * isolated worktree is provisioned (setup commands, then untracked-file
+ * carry-over). Same rationale as the other synthetic settings in
+ * settings-modal-data.ts (tts.speed, behavior.notifyAfterSeconds, etc).
+ *
+ * Both keys hold a JSON array of strings on disk. The settings modal's
+ * inline editor is a single-line text field, so — matching the SDK's own
+ * convention for controlPlane.cors.allowedOrigins — they are displayed and
+ * edited as a comma-separated list and parsed back into an array on commit
+ * (see isWorktreeSetupListConfigKey's use in settings-modal.ts#commitEdit).
+ */
+import type { ConfigKey, ConfigManager, ConfigSetting } from '@pellux/goodvibes-sdk/platform/config';
+import type { SettingEntry } from './settings-modal-types.ts';
+
+export const WORKTREE_SETUP_COMMANDS_CONFIG_KEY = 'worktree.setup.commands' as ConfigKey;
+export const WORKTREE_SETUP_CARRY_OVER_GLOBS_CONFIG_KEY = 'worktree.setup.carryOverGlobs' as ConfigKey;
+
+const WORKTREE_SETUP_LIST_CONFIG_KEYS: ReadonlySet<ConfigKey> = new Set([
+  WORKTREE_SETUP_COMMANDS_CONFIG_KEY,
+  WORKTREE_SETUP_CARRY_OVER_GLOBS_CONFIG_KEY,
+]);
+
+/** True for the two worktree-setup keys, whose stored value is a string array edited as a comma-separated list. */
+export function isWorktreeSetupListConfigKey(key: ConfigKey): boolean {
+  return WORKTREE_SETUP_LIST_CONFIG_KEYS.has(key);
+}
+
+/**
+ * Read a config value as a string array — mirrors the SDK's own tolerant
+ * readStringArray (non-array/malformed degrades to empty).
+ *
+ * Defensive try/catch (now belt-and-suspenders): the SDK registers the
+ * `worktree` section in DEFAULT_CONFIG (setup.commands / setup.carryOverGlobs,
+ * both empty lists) as of this repack, so ConfigManager.get no longer throws
+ * for these keys on a fresh store. The guard is retained so an older SDK — or
+ * a config store whose section was pruned — degrades to an empty list here
+ * (this read runs on every settings-modal build) rather than crashing /config
+ * or /settings.
+ */
+export function readWorktreeSetupList(configManager: Pick<ConfigManager, 'get'>, key: ConfigKey): string[] {
+  let raw: unknown;
+  try {
+    raw = configManager.get(key);
+  } catch {
+    return [];
+  }
+  if (!Array.isArray(raw)) return [];
+  return raw.filter((entry): entry is string => typeof entry === 'string' && entry.length > 0);
+}
+
+/** Parse a comma-separated edit-buffer submission back into a string array (trimmed, empties dropped). */
+export function parseWorktreeSetupListInput(text: string): string[] {
+  return text.split(',').map((part) => part.trim()).filter((part) => part.length > 0);
+}
+
+export const WORKTREE_SETUP_COMMANDS_SYNTHETIC_SETTING: ConfigSetting = {
+  key: WORKTREE_SETUP_COMMANDS_CONFIG_KEY,
+  type: 'string',
+  default: [],
+  description: 'Comma-separated shell command lines run in order in a freshly-created isolated worktree before it is handed to an agent (e.g. "bun install, bun run codegen"). A command that exits non-zero stops setup there and marks the worktree failed — visible on /worktree review and the worktree record, never silent. Empty = no setup commands run.',
+};
+
+export const WORKTREE_SETUP_CARRY_OVER_GLOBS_SYNTHETIC_SETTING: ConfigSetting = {
+  key: WORKTREE_SETUP_CARRY_OVER_GLOBS_CONFIG_KEY,
+  type: 'string',
+  default: [],
+  description: 'Comma-separated glob patterns (e.g. ".env, .env.*, config/local.json") of UNTRACKED files copied from the source working tree into a freshly-created isolated worktree, after setup commands run. Only files git reports as untracked are eligible — committed files already carry over through the worktree checkout itself. Empty = nothing carried over.',
+};
+
+function buildWorktreeSetupListEntry(configManager: Pick<ConfigManager, 'get'>, setting: ConfigSetting): SettingEntry {
+  const currentValue = readWorktreeSetupList(configManager, setting.key);
+  return {
+    setting,
+    currentValue,
+    isDefault: currentValue.length === 0,
+  };
+}
+
+export function buildWorktreeSetupCommandsSyntheticEntry(configManager: Pick<ConfigManager, 'get'>): SettingEntry {
+  return buildWorktreeSetupListEntry(configManager, WORKTREE_SETUP_COMMANDS_SYNTHETIC_SETTING);
+}
+
+export function buildWorktreeSetupCarryOverGlobsSyntheticEntry(configManager: Pick<ConfigManager, 'get'>): SettingEntry {
+  return buildWorktreeSetupListEntry(configManager, WORKTREE_SETUP_CARRY_OVER_GLOBS_SYNTHETIC_SETTING);
+}

package/src/main.ts

@@ -49,7 +49,7 @@ import { wireSpokenTurnRuntime } from './audio/spoken-turn-wiring.ts';
 import { attachSpokenTurnModelRouting, createSpokenTurnInputOptions } from './audio/spoken-turn-model-routing.ts';
 import { allowTerminalWrite, installTuiTerminalOutputGuard } from './runtime/terminal-output-guard.ts';
 import { installProcessLifecycle } from './runtime/process-lifecycle.ts';
-import { createRenderScheduler } from './runtime/render-scheduler.ts';
+import { createRenderScheduler } from '@pellux/goodvibes-terminal-shell';
 import { buildCommandArgsHint } from './input/command-args-hint.ts';
 import { summarizeRunningAgents } from './renderer/process-summary.ts';
 import { footerFleetCost } from './panels/fleet-read-model.ts';
@@ -57,9 +57,15 @@ import { formatUserFacingErrorLine } from './core/format-user-error.ts';
 import { wireStreamEventMetrics, type StreamMetrics, type WireStreamEventMetricsResult } from './core/stream-event-wiring.ts';
 import { wireTurnEventHandlers } from './core/turn-event-wiring.ts';
 import { buildContextStatusHint } from './renderer/context-status-hint.ts';
+import { isEffectiveDangerMode } from './config/index.ts';
+import { createScriptableStatusline } from './core/scriptable-statusline.ts';
+import { applyComposerCapture } from './input/composer-capture.ts';
+import { createSessionAutoTitler } from './core/session-auto-titler.ts';
+import { makeComposerEditorOpener } from './input/composer-editor.ts';
 import { evaluateSessionMaintenance } from '@/runtime/index.ts';
 import { createCancelGeneration } from './core/turn-cancellation.ts';
 import { wrapRequestPermissionWithAlert } from './core/approval-alert.ts';
+import { createTerminalNotifier } from './core/terminal-notifier.ts';
 import { setPanelFrameRequester } from './panels/base-panel.ts';
 
 import { ALT_SCREEN_ENTER, ALT_SCREEN_EXIT, MOUSE_ENABLE, MOUSE_DISABLE, CURSOR_HIDE, CURSOR_SHOW, CLEAR_SCREEN, KEYBOARD_EXT_ENABLE, KEYBOARD_EXT_DISABLE, PASTE_ENABLE, PASTE_DISABLE, FOCUS_ENABLE, FOCUS_DISABLE } from './renderer/terminal-escapes.ts';
@@ -223,17 +229,16 @@ async function main() {
     setRecoveryInterval: (value) => { recoveryInterval = value; },
     getStopSpokenOutputForExit: () => stopSpokenOutputForExit,
   });
-  const {
-    exitApp,
-    resizeHandler,
-    sigintHandler,
-    unhandledRejectionHandler,
-    uncaughtExceptionHandler,
-    terminationSignalHandler,
-    exitListener,
-  } = lifecycle;
+  const { exitApp, resizeHandler, sigintHandler, unhandledRejectionHandler, uncaughtExceptionHandler, terminationSignalHandler, exitListener } = lifecycle;
   commandContext.exit = exitApp;
 
+  // In-terminal (OSC 9) notifier (approval-wait/turn-end/agent-blocked); writes
+  // are restore-gated so no escape sequence lands after the shell resumes.
+  const terminalNotifier = createTerminalNotifier({
+    stdout, focusTracker: ctx.services.focusTracker, isReleased: () => lifecycle.isTerminalRestored(),
+    configGet: (k: string) => configManager.get(k as Parameters<typeof configManager.get>[0]),
+  });
+
   const spokenTurns = wireSpokenTurnRuntime({
     voiceService: ctx.services.voiceService,
     configManager,
@@ -243,6 +248,15 @@ async function main() {
   // Exit-path stop: bounded drain of the audio already playing (see stopForExit).
   stopSpokenOutputForExit = () => spokenTurns.stopForExit();
   unsubs.push(...spokenTurns.unsubs);
+  // Scriptable status line: runs the user's `statusline.command` at turn boundaries.
+  const scriptableStatusline = createScriptableStatusline({ configManager, cwd: workingDir, turns: uiServices.events.turns, onChange: () => render() });
+  unsubs.push(...scriptableStatusline.unsubs);
+  // Auto-title an untitled session via the weak/fast tool model (session.autoTitle, off by default).
+  const sessionAutoTitler = createSessionAutoTitler({
+    conversation, model: ctx.services.toolLLM, configManager, turns: uiServices.events.turns,
+    onTitled: (title) => { systemMessageRouter.high(`[Session] Auto-titled: "${title}"`); render(); },
+  });
+  unsubs.push(...sessionAutoTitler.unsubs);
   unsubs.push(attachSpokenTurnModelRouting({
     orchestrator,
     providerRegistry,
@@ -269,18 +283,11 @@ async function main() {
       }
       processedText = processedText.replace(atModelMatch[0], '').trim();
     }
-    if (processedText.startsWith('!#')) {
-      const memoryText = processedText.slice(2).trim();
-      if (!memoryText) {
-        systemMessageRouter.high('[Memory] Usage: !# <text to pin as session memory>');
-        render();
-        processedText = '';
-      } else {
-        const memId = ctx.services.sessionMemoryStore.add(memoryText);
-        systemMessageRouter.high(`[Memory] Pinned: "${memoryText}" (${memId})`);
-        processedText = memoryText;
-      }
-    }
+    // Composer capture markers: `!#` pins + sends; `#` saves a note without sending.
+    processedText = applyComposerCapture(processedText, {
+      sessionMemoryStore: ctx.services.sessionMemoryStore,
+      notify: (message) => systemMessageRouter.high(message),
+    }).text;
     if (processedText || content) {
       void (async () => {
         const inputOptions = options.spokenOutput ? createSpokenTurnInputOptions() : undefined;
@@ -323,27 +330,27 @@ async function main() {
 
   commandContext.submitInput = submitInput;
   commandContext.submitSpokenInput = (text, content) => submitInput(text, content, { spokenOutput: true });
-  commandContext.stopSpokenOutput = () => spokenTurns.stop();
-  commandContext.pasteFromClipboard = () => input.handlePaste();
+  commandContext.stopSpokenOutput = () => spokenTurns.stop(); commandContext.pasteFromClipboard = () => input.handlePaste();
   commandContext.executeCommand = (name, args) => commandRegistry.execute(name, args, commandContext);
+  // Late-patched: bootstrap.ts populates uiServices.platform.externalServices AFTER commandContext is built.
+  commandContext.platform.externalServices = uiServices.platform.externalServices;
   commandContext.cancelGeneration = cancelGeneration;
   commandContext.isGenerating = () => orchestrator.isThinking;
-  commandContext.jumpToBookmark = jumpToBookmark;
-  commandContext.scrollToLine = scrollToLine;
+  commandContext.jumpToBookmark = jumpToBookmark; commandContext.scrollToLine = scrollToLine;
   commandContext.clearScreen = () => {
     compositor.resetDiff();
     allowTerminalWrite(() => stdout.write(CLEAR_SCREEN));
     render();
   };
-  commandContext.requestFullRepaint = () => { compositor.resetDiff(); render(); };
+  commandContext.requestFullRepaint = () => { compositor.resetDiff(); render(); }; commandContext.beginConcealedInput = (req) => input.beginConcealedInput(req);
   permissionPromptRef.requestPermission = wrapRequestPermissionWithAlert((request) =>
     new Promise((resolve) => {
       pendingPermission = {
         ...request,
-        ...buildPendingPermissionExtras(request, resolve),
+        ...buildPendingPermissionExtras(request, resolve, approvalBroker),
       };
       render();
-    }), { focusTracker: ctx.services.focusTracker, configGet: (k: string) => configManager.get(k as Parameters<typeof configManager.get>[0]), webhookNotifier: ctx.services.webhookNotifier });
+    }), { focusTracker: ctx.services.focusTracker, configGet: (k: string) => configManager.get(k as Parameters<typeof configManager.get>[0]), webhookNotifier: ctx.services.webhookNotifier, terminalNotifier });
 
   const input: InputHandler = new InputHandler(
     () => render(),
@@ -403,6 +410,7 @@ async function main() {
   orchestratorRefs.scrollToEnd = scrollToEnd;
 
   input.setCommandRegistry(commandRegistry, commandContext);
+  commandContext.openComposerEditor = makeComposerEditorOpener({ buffer: input, stdin, stdout, writeGuard: allowTerminalWrite, repaint: () => { compositor.resetDiff(); render(); }, cwd: workingDir, env: process.env, notify: (m) => systemMessageRouter.high(m) });
   input.setConversationManager(conversation);
   input.setContentWidth(getPromptContentWidth());
   input.filePicker.setOnUpdate(() => render());
@@ -481,21 +489,13 @@ async function main() {
       provider: runtime.provider,
       contextWindow,
       contextStatusHint,
+      scriptableStatusLine: scriptableStatusline.current(),
       // Compact footer posture on short terminals so the shell stays usable.
       compact: height < 30,
       // behavior.autoCompactThreshold is stored as a percent integer (e.g. 80);
       // the meter expects a fraction [0..1]. Clamp to [0,1] to guard nonsense values.
       compactThreshold: Math.min(1, Math.max(0, (configManager.get('behavior.autoCompactThreshold') as number) / 100)),
-      dangerMode: (() => {
-        if (configManager.get('behavior.autoApprove')) return true;
-        const permMode = configManager.get('permissions.mode');
-        if (permMode === 'allow-all') return true;
-        if (permMode === 'custom') {
-          const tools = configManager.getCategory('permissions').tools;
-          if (Object.values(tools).every(v => v === 'allow')) return true;
-        }
-        return false;
-      })(),
+      dangerMode: isEffectiveDangerMode(configManager),
       lastInputTokens: orchestrator.lastInputTokens,
       commandArgsHint,
       hitlMode: modeManager.getHITLMode(),
@@ -508,7 +508,7 @@ async function main() {
       composerMode: composerState.modeLabel,
       composerStatus: composerState.statusLabel,
       composerFlags: composerState.flags,
-      composerPendingRisk: composerState.pendingRisk,
+      composerPendingRisk: composerState.pendingRisk, permissionMode: configManager.get('permissions.mode') as string,
     }).lines;
 
     const onboardingOwnsScreen = input.onboardingWizard.active;
@@ -547,7 +547,7 @@ async function main() {
     // Calculate how many rows are consumed by overlays (thinking, permissions, queue, file picker)
     let overlayRows = 0;
     if (orchestrator.isThinking) overlayRows += 2; // spinner + blank
-    if (pendingPermission) overlayRows += PermissionPromptUI.getPromptHeight(pendingPermission, pendingPermission.hunkState, pendingPermission.detailsExpanded);
+    if (pendingPermission) overlayRows += PermissionPromptUI.getPromptHeight(pendingPermission, pendingPermission.hunkState, pendingPermission.detailsExpanded, pendingPermission.requestedBy);
     overlayRows += orchestrator.messageQueue.length * 3; // queued messages
     // File picker and model picker overlay rows computed from actual rendered line count below
     // Selection modal overlay rows are computed from actual rendered line count below
@@ -597,7 +597,7 @@ async function main() {
     }
 
     if (pendingPermission) {
-      viewport.push(...PermissionPromptUI.createPromptLines(conversationWidth, pendingPermission, pendingPermission.hunkState, pendingPermission.detailsExpanded));
+      viewport.push(...PermissionPromptUI.createPromptLines(conversationWidth, pendingPermission, pendingPermission.hunkState, pendingPermission.detailsExpanded, pendingPermission.requestedBy));
     }
 
     orchestrator.messageQueue.forEach(msg => {
@@ -687,7 +687,7 @@ async function main() {
     gitStatusProvider,
     lastGitInfoRef,
     buildSessionContinuityHints,
-    render, webhookNotifier: ctx.services.webhookNotifier, focusTracker: ctx.services.focusTracker,
+    render, webhookNotifier: ctx.services.webhookNotifier, focusTracker: ctx.services.focusTracker, terminalNotifier, runtimeBus: uiServices.runtime.runtimeBus,
   });
   unsubs.push(...turnUnsubs);
 

package/src/panels/builtin/development.ts

@@ -1,6 +1,7 @@
 import type { PanelManager } from '../panel-manager.ts';
 import { GitPanel } from '../git-panel.ts';
 import { DiffPanel } from '../diff-panel.ts';
+import { DiffReviewPanel } from '../diff-review-panel.ts';
 import { CostTrackerPanel } from '../cost-tracker-panel.ts';
 import type { ResolvedBuiltinPanelDeps } from './shared.ts';
 import { requireUiServices, withUnconfiguredFallback } from './shared.ts';
@@ -42,6 +43,19 @@ export function registerDevelopmentPanels(manager: PanelManager, deps: ResolvedB
     factory: () => new DiffPanel(requireUiServices(deps).environment.workingDirectory, deps.requestRender),
   });
 
+  manager.registerType({
+    id: 'review',
+    name: 'Review',
+    icon: 'R',
+    category: 'development',
+    description: 'Comment on session diff hunks and steer the comments to the model',
+    factory: () => new DiffReviewPanel(
+      requireUiServices(deps).environment.workingDirectory,
+      deps.requestRender,
+      deps.sessionChangeTracker ? () => deps.sessionChangeTracker!.getChangedFiles() : undefined,
+    ),
+  });
+
   // WO-110: 'inspector' registration moved to builtin/agent.ts (category
   // 'agent') — it now absorbs the merged agent-logs capabilities.
 

package/src/panels/diff-review-model.ts

@@ -0,0 +1,189 @@
+// ---------------------------------------------------------------------------
+// Diff review model — pure parsing + steering-payload helpers for the
+// comment-on-hunk review loop (see diff-review-panel.ts).
+//
+// The diff this operates on is the git working tree vs a base ref (HEAD),
+// filtered to the files the current session actually edited (the SDK's
+// SessionChangeTracker). That is the honest source: it is CURRENT working-tree
+// content, not a turn-start snapshot — the panel labels it exactly that way.
+// ---------------------------------------------------------------------------
+
+/** One hunk of one file's diff, with enough structure to steer a comment at it. */
+export interface ReviewHunk {
+  readonly filePath: string;
+  readonly fileIndex: number;
+  readonly hunkIndex: number;
+  /** The raw `@@ -a,b +c,d @@` header line. */
+  readonly header: string;
+  readonly oldStart: number;
+  readonly oldCount: number;
+  readonly newStart: number;
+  readonly newCount: number;
+  /** Raw hunk body lines, each still carrying its leading ' ', '+' or '-'. */
+  readonly bodyLines: readonly string[];
+  readonly added: number;
+  readonly removed: number;
+}
+
+export interface ReviewFile {
+  readonly filePath: string;
+  readonly fileIndex: number;
+  readonly hunks: readonly ReviewHunk[];
+}
+
+/** Extract the target file path from one `diff --git`-delimited chunk. */
+function extractFilePath(chunk: string): string {
+  const quotedGit = chunk.match(/^diff --git "a\/(.+)" "b\/(.+)"$/m);
+  if (quotedGit) return quotedGit[2]!;
+  const plainGit = chunk.match(/^diff --git a\/.+? b\/(.+)$/m);
+  if (plainGit) return plainGit[1]!;
+  const combined = chunk.match(/^diff --(?:cc|combined) "?([^"\n]+?)"?$/m);
+  if (combined) return combined[1]!;
+  const plus = chunk.match(/^\+\+\+ (?:b\/)?"?([^"\n]+?)"?\s*$/m);
+  if (plus && plus[1] !== '/dev/null') return plus[1]!;
+  const minus = chunk.match(/^--- (?:a\/)?"?([^"\n]+?)"?\s*$/m);
+  if (minus && minus[1] !== '/dev/null') return minus[1]!;
+  return 'unknown';
+}
+
+const HUNK_HEADER_RE = /^@@\s+-([0-9]+)(?:,([0-9]+))?\s+\+([0-9]+)(?:,([0-9]+))?\s+@@/;
+
+/** Parse a multi-file unified `git diff` into per-file, per-hunk structures. */
+export function parseReviewDiff(raw: string): ReviewFile[] {
+  const files: ReviewFile[] = [];
+  const chunks = raw.split(/(?=^diff --git |^diff --cc |^diff --combined )/m);
+  let fileIndex = 0;
+  for (const chunk of chunks) {
+    if (!chunk.trim()) continue;
+    const filePath = extractFilePath(chunk);
+    const hunks: ReviewHunk[] = [];
+    const lines = chunk.split('\n');
+    let current: { header: string; oldStart: number; oldCount: number; newStart: number; newCount: number; body: string[] } | null = null;
+    const flush = (): void => {
+      if (!current) return;
+      let added = 0;
+      let removed = 0;
+      for (const l of current.body) {
+        if (l.startsWith('+')) added++;
+        else if (l.startsWith('-')) removed++;
+      }
+      hunks.push({
+        filePath,
+        fileIndex,
+        hunkIndex: hunks.length,
+        header: current.header,
+        oldStart: current.oldStart,
+        oldCount: current.oldCount,
+        newStart: current.newStart,
+        newCount: current.newCount,
+        bodyLines: current.body,
+        added,
+        removed,
+      });
+      current = null;
+    };
+    for (const line of lines) {
+      const m = line.match(HUNK_HEADER_RE);
+      if (m) {
+        flush();
+        current = {
+          header: line,
+          oldStart: parseInt(m[1]!, 10),
+          oldCount: m[2] !== undefined ? parseInt(m[2], 10) : 1,
+          newStart: parseInt(m[3]!, 10),
+          newCount: m[4] !== undefined ? parseInt(m[4], 10) : 1,
+          body: [],
+        };
+        continue;
+      }
+      if (current) current.body.push(line);
+    }
+    flush();
+    if (hunks.length > 0) files.push({ filePath, fileIndex, hunks });
+    fileIndex++;
+  }
+  return files;
+}
+
+/** Flatten files into a single navigable hunk list, in file/hunk order. */
+export function flattenHunks(files: readonly ReviewFile[]): ReviewHunk[] {
+  const out: ReviewHunk[] = [];
+  for (const file of files) out.push(...file.hunks);
+  return out;
+}
+
+/** The new-file line range a hunk covers (1-based, inclusive). */
+export function hunkLineRange(hunk: ReviewHunk): { start: number; end: number } {
+  const start = hunk.newStart;
+  const end = hunk.newCount > 0 ? hunk.newStart + hunk.newCount - 1 : hunk.newStart;
+  return { start, end };
+}
+
+/** A short excerpt of a hunk's patch, header included, capped to `maxLines` body lines. */
+export function hunkExcerpt(hunk: ReviewHunk, maxLines = 8): string {
+  const body = hunk.bodyLines.slice(0, maxLines);
+  const truncated = hunk.bodyLines.length > maxLines ? [`… (+${hunk.bodyLines.length - maxLines} more lines)`] : [];
+  return [hunk.header, ...body, ...truncated].join('\n');
+}
+
+/** The full unified-diff hunk text (header + body) for one ReviewHunk — the input checkpoints.revertHunk takes. */
+export function hunkPatchText(hunk: ReviewHunk): string {
+  return [hunk.header, ...hunk.bodyLines].join('\n');
+}
+
+/** The subset of checkpoints.revertHunk's receipt the transcript block renders. */
+export interface HunkRevertReceiptInput {
+  readonly path: string;
+  readonly hunkHeader: string;
+  readonly addedLinesRemoved: number;
+  readonly removedLinesRestored: number;
+  readonly safetyCheckpointId: string | null;
+}
+
+/**
+ * Build the distinct `[Revert]` transcript block for one applied hunk revert.
+ * Pure. The `[Revert]` prefix is force-surfaced inline (system-message-router.ts)
+ * so a working-tree mutation from /review is never a silent change.
+ */
+export function buildHunkRevertReceiptBlock(receipt: HunkRevertReceiptInput): string {
+  const plural = (n: number, word: string): string => `${n} ${word}${n === 1 ? '' : 's'}`;
+  const lines = [
+    `[Revert] Receipt — reverted one hunk in ${receipt.path} (${receipt.hunkHeader}).`,
+    `  Restored ${plural(receipt.removedLinesRestored, 'deleted line')}, removed ${plural(receipt.addedLinesRemoved, 'added line')}.`,
+    receipt.safetyCheckpointId
+      ? `  Reversible: a pre-revert checkpoint was taken — /checkpoints restore ${receipt.safetyCheckpointId} undoes it.`
+      : '  Reversible: the working tree already matched the latest checkpoint (nothing extra to snapshot).',
+  ];
+  return lines.join('\n');
+}
+
+/** A comment attached to a specific hunk, ready to steer. */
+export interface HunkComment {
+  readonly hunk: ReviewHunk;
+  readonly comment: string;
+}
+
+/**
+ * Build the structured steering message a review comment submits to the session.
+ * Each block names the file, the new-file line range, the comment, and a short
+ * patch excerpt so the model knows exactly what the comment targets. The
+ * `sourceLabel` states the honest provenance of the diff (working tree vs base).
+ */
+export function buildSteerMessage(items: readonly HunkComment[], sourceLabel: string): string {
+  const blocks = items.map(({ hunk, comment }) => {
+    const range = hunkLineRange(hunk);
+    return [
+      `Review comment on ${hunk.filePath} (lines ${range.start}-${range.end}, new file):`,
+      comment,
+      '',
+      'Referenced change:',
+      '```diff',
+      hunkExcerpt(hunk),
+      '```',
+    ].join('\n');
+  });
+  const header = items.length === 1
+    ? `I am reviewing the current changes (${sourceLabel}) and left a comment on a specific hunk. Please address it.`
+    : `I am reviewing the current changes (${sourceLabel}) and left comments on ${items.length} hunks. Please address each one.`;
+  return [header, '', ...blocks].join('\n\n');
+}