@tianmucreations/jeeves 0.2.1 → 0.3.1

package/dist/agent/permissions.js

@@ -1,22 +1,205 @@
 import { session } from '../state/session.js';
+import { trustProject } from './trust.js';
+import { getAddress } from '../platform/config.js';
+// Pure-output commands that never require permission (the rule: harmless
+// output must never prompt). A command is auto-approved only when every stage of
+// it - across pipes, && and || - is one of the commands below, and the only
+// redirection anywhere is to /dev/null. Anything that writes, deletes, installs,
+// or reaches the network still prompts.
+const READ_ONLY_COMMANDS = new Set([
+    'yes',
+    'head',
+    'tail',
+    'cat',
+    'ls',
+    'pwd',
+    'wc',
+    'file',
+    'which',
+    'whoami',
+    'date',
+    'echo',
+    'printf',
+    'seq',
+    'sort',
+    'uniq',
+    'tr',
+    'grep',
+    'awk',
+    'sed',
+    'cut',
+    'fold',
+    'column',
+]);
+// Multi-word commands where the words themselves are the read-only form.
+const READ_ONLY_TWO_WORD_COMMANDS = new Set([
+    'git status',
+    'git log',
+    'git diff',
+    'node --version',
+    'npm --version',
+]);
+// git branch lists branches when nothing but flags follows; any name argument
+// would create, delete, or modify a branch, so only the listing form is allowed.
+function isReadOnlyGitBranch(rest) {
+    return rest.every((token) => token.startsWith('-'));
+}
+// sed with -n only prints (the p command); -i edits files in place, and the w
+// command writes files. The whole argument string is checked for a 'w' because
+// scanning sed script syntax reliably is not worth the risk - a false "ask" is
+// safe, a false "allow" is not.
+function isReadOnlySed(rest) {
+    return rest.includes('-n') && !rest.some((token) => token === '-i' || token.startsWith('-i')) && !rest.join(' ').includes('w');
+}
+// awk reads input unless the program itself writes a file or runs a command;
+// a | inside the program pipes to a command, so it disqualifies too.
+function isReadOnlyAwk(rest) {
+    const program = rest.join(' ');
+    return !program.includes('system(') && !program.includes('>') && !program.includes('|') && !program.includes('getline');
+}
+function isReadOnlyStage(tokens, isFinalStage) {
+    if (tokens.length === 0)
+        return false;
+    const command = tokens[0];
+    const rest = tokens.slice(1);
+    if (command === 'git') {
+        if (rest.length === 0)
+            return false;
+        if (READ_ONLY_TWO_WORD_COMMANDS.has(`git ${rest[0]}`))
+            return true;
+        if (rest[0] === 'branch')
+            return isReadOnlyGitBranch(rest.slice(1));
+        return false;
+    }
+    if (command === 'node' || command === 'npm') {
+        return rest.length === 1 && rest[0] === '--version';
+    }
+    if (command === 'sed')
+        return isReadOnlySed(rest);
+    if (command === 'awk')
+        return isReadOnlyAwk(rest);
+    if (command === 'yes') {
+        // yes on its own streams forever; it qualifies only feeding a pipe that ends.
+        return !isFinalStage;
+    }
+    return READ_ONLY_COMMANDS.has(command);
+}
+// One pipe stage: tokens with any /dev/null redirection stripped. Redirection to
+// any other target disqualifies the whole command.
+function parseStage(stage) {
+    const tokens = [];
+    const parts = stage.trim().split(/\s+/).filter((part) => part.length > 0);
+    for (let i = 0; i < parts.length; i++) {
+        const part = parts[i];
+        // Forms: > /dev/null, 2> /dev/null, &> /dev/null, < /dev/null, and the
+        // no-space variants. Redirection to any other target disqualifies.
+        if (/^(\d*)>$|^&>$|^<$/.test(part) || /^(?:\d*>|&>|<)\/dev\/null$/.test(part)) {
+            const target = /^(?:\d*>|&>|<)\/dev\/null$/.test(part) ? part.replace(/^(?:\d*>|&>|<)/, '') : parts[++i];
+            if (target !== '/dev/null')
+                return null;
+            continue;
+        }
+        // Any other redirect or input form is a write or an unknown - disqualify.
+        if (/[<>]/.test(part))
+            return null;
+        tokens.push(part);
+    }
+    return { tokens };
+}
+// Splits on a separator character, ignoring quoted text, so a pipe inside quotes
+// (awk '{print $1 | "sort"}') never counts as a shell pipe.
+function splitOutsideQuotes(text, separator) {
+    const parts = [];
+    let current = '';
+    let quote = null;
+    for (let i = 0; i < text.length; i++) {
+        const char = text[i];
+        if (quote) {
+            current += char;
+            if (char === quote)
+                quote = null;
+            continue;
+        }
+        if (char === '"' || char === "'") {
+            quote = char;
+            current += char;
+            continue;
+        }
+        if (text.startsWith(separator, i)) {
+            parts.push(current);
+            current = '';
+            i += separator.length - 1;
+            continue;
+        }
+        current += char;
+    }
+    parts.push(current);
+    return parts;
+}
+// True when the command is composed entirely of read-only stages: pipes, && and
+// || chains of allowlisted commands, with redirection to /dev/null only. Anything
+// else - writes, deletes, installs, network, substitutions, semicolons - is false.
+export function isReadOnlyBashCommand(command) {
+    const trimmed = command.trim();
+    if (trimmed.length === 0)
+        return false;
+    // Substitution constructs can turn any read into a write - and "$(...)" inside
+    // double quotes still executes - so any of these disqualifies outright.
+    if (trimmed.includes('`') || trimmed.includes('$('))
+        return false;
+    if (/[;\n]/.test(stripQuotes(trimmed)))
+        return false;
+    for (const chain of splitOutsideQuotes(trimmed, '&&')) {
+        for (const alternative of splitOutsideQuotes(chain, '||')) {
+            const stages = splitOutsideQuotes(alternative, '|');
+            for (let i = 0; i < stages.length; i++) {
+                const parsed = parseStage(stages[i]);
+                if (parsed === null)
+                    return false;
+                if (!isReadOnlyStage(parsed.tokens, i === stages.length - 1))
+                    return false;
+            }
+        }
+    }
+    return true;
+}
+// Replaces quoted spans with empty quoted strings, so metacharacter checks see
+// only what the shell will actually interpret. Shared with the runBash tool.
+export function stripQuotes(text) {
+    return text.replace(/"[^"]*"/g, '""').replace(/'[^']*'/g, "''");
+}
 // Approvals are queued so that parallel tool calls never overwrite each other's prompt.
 // The amber transcript prompt itself is rendered by the tool line in 'awaiting' state.
 const queue = [];
 export function hasPendingApproval() {
     return queue.length > 0;
 }
-export function requestApproval() {
+export function requestApproval(options = {}) {
     return new Promise((resolve) => {
-        queue.push({ resolve });
+        queue.push({ resolve, trustable: options.trustable === true });
         if (queue.length === 1) {
             session.setActiveApproval();
         }
     });
 }
-export function answerApproval(approved) {
+// Whether the question now on screen may be answered with "always allow".
+export function currentApprovalTrustable() {
+    return queue[0]?.trustable === true;
+}
+// always: "always allow in this project" - approves this change, every other change
+// inside the project already waiting, and all future ones in this folder.
+export function answerApproval(approved, always = false) {
     const current = queue.shift();
     if (!current)
         return;
+    if (always && approved && current.trustable) {
+        trustProject();
+        session.addNotice(`From now on I won't ask before changing things in this project folder, ${getAddress() ?? 'Sir'} - every change is still backed up, so /undo puts it back. I'll still ask about anything outside it. Type /ask to have me ask every time again.`);
+        for (let i = queue.length - 1; i >= 0; i--) {
+            if (queue[i].trustable)
+                queue.splice(i, 1)[0].resolve(true);
+        }
+    }
     current.resolve(approved);
     if (queue.length > 0) {
         session.setActiveApproval();

package/dist/agent/research-gate.js

@@ -0,0 +1,267 @@
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import fg from 'fast-glob';
+import { z } from 'zod';
+// Research before building, research before patching - enforced in code, because the
+// cheap model skipped a written "check first" rule in every test run (17 Sept).
+//
+// Copied from Claude Code's file-writing tool (src/tools/FileWriteTool/FileWriteTool.ts,
+// validateInput): before a write is even offered for permission, the tool checks what
+// has happened in the conversation and refuses with a message saying what to do first
+// ("File has not been read yet. Read it first before writing to it."). Its plan mode
+// likewise unlocks editing only through a tool the model must call; here that is
+// noteResearch.
+//
+// Two gates:
+// - Building: creating a program file in a folder that has none yet (a new program,
+//   site, app, tool or script), or running a command that starts a new project, is
+//   held until a research note is recorded. Adding a file to an existing program, and
+//   everyday files (letters, spreadsheets, notes), are never held.
+// - Patching: when the same command fails the same way twice, changing existing files
+//   is held until the cause and a fix have been researched.
+// The person can say "skip the research"; it is honoured and noted. Code can make
+// research happen, not make it good - so every note is shown on screen.
+export const HELD_PREFIX = 'Held for research:';
+// Program files: code, web pages, styles and scripts. Everyday files are not.
+export const PROGRAM_EXTENSIONS = [
+    'js', 'mjs', 'cjs', 'ts', 'tsx', 'jsx', 'vue', 'svelte', 'html', 'htm', 'css', 'scss', 'py', 'rb', 'php', 'go', 'rs',
+    'java', 'kt', 'swift', 'c', 'h', 'cpp', 'cs', 'sh', 'bash', 'zsh', 'ps1', 'bat', 'sql', 'lua', 'pl', 'r', 'dart', 'scala',
+];
+export function isProgramFile(file) {
+    const ext = path.extname(file).slice(1).toLowerCase();
+    return PROGRAM_EXTENSIONS.includes(ext);
+}
+// Commands that start a new project from a template or copy one.
+const NEW_PROJECT_COMMAND = /\b(?:(?:npm|pnpm|yarn|bun)\s+(?:init|create)\b|npx\s+(?:--yes\s+|-y\s+)?create-|cargo\s+(?:new|init)\b|rails\s+new\b|django-admin\s+startproject\b|flutter\s+create\b|dotnet\s+new\b|go\s+mod\s+init\b|git\s+clone\b|composer\s+create-project\b|uv\s+init\b|poetry\s+new\b)/i;
+export function startsNewProject(command) {
+    return NEW_PROJECT_COMMAND.test(command);
+}
+// Commands that change an existing file in place: sed/perl editing, or output sent
+// into a file (">" or ">>", but not "2>&1" or "> /dev/null").
+export function commandEditsFiles(command) {
+    if (/\bsed\s+(?:-[a-zA-Z]*i|--in-place)|\bperl\s+-[a-zA-Z]*i/.test(command))
+        return true;
+    return /(?:^|[^0-9&>])>{1,2}\s*(?!&|\/dev\/null)[^\s|;&]+/.test(command);
+}
+// The open licences that allow reuse (with credit, on their terms).
+// A version may be joined on ("GPLv2", "LGPLv3").
+const OPEN_LICENCE = /\b(mit|apache|bsd|isc|mpl|mozilla|gpl|lgpl|agpl|unlicense|cc0|cc[- ]by|creative commons|public domain|zlib|eclipse|epl|wtfpl|0bsd|artistic|python software foundation|psf)(?:v?\d[\d.]*)?\b/i;
+export function isOpenLicence(licence) {
+    return OPEN_LICENCE.test(licence) && !/\b(no licen[cs]e|unknown|none|proprietary|all rights reserved)\b/i.test(licence);
+}
+// What the person said that switches research off for this conversation.
+const SKIP_PHRASE = /\b(?:skip|no|without|don'?t do|do not do|don'?t need|do not need)\s+(?:the\s+|any\s+)?research\b|\bdon'?t research\b|\bdo not research\b/i;
+export function asksToSkipResearch(text) {
+    return SKIP_PHRASE.test(text);
+}
+// The state of one conversation; /clear starts a fresh one.
+class GateState {
+    // Pages Jeeves opened with readWebPage, and pages webSearch listed.
+    opened = new Set();
+    listed = new Set();
+    // Set when a web tool could not work (no key, service down).
+    webUnavailable = false;
+    // How many web pages had been opened when patching was held - research for the
+    // problem must come after it.
+    openedAtHold = 0;
+    openedCount = 0;
+    buildNote = null;
+    problems = new Map();
+    // The failure that held patching, until its research is recorded.
+    heldProblem = null;
+    skipped = false;
+}
+let state = new GateState();
+export function resetResearchGate() {
+    state = new GateState();
+}
+export function gateState() {
+    return state;
+}
+// Called by the web tools, so a note can only cite pages really found or opened.
+export function recordPageOpened(url) {
+    const key = normaliseUrl(url);
+    if (!state.opened.has(key))
+        state.openedCount += 1;
+    state.opened.add(key);
+}
+export function recordSearchResults(urls) {
+    for (const url of urls)
+        state.listed.add(normaliseUrl(url));
+}
+export function recordWebUnavailable() {
+    state.webUnavailable = true;
+}
+export function normaliseUrl(url) {
+    try {
+        const parsed = new URL(url.trim());
+        parsed.hash = '';
+        return `${parsed.hostname.replace(/^www\./, '')}${parsed.pathname.replace(/\/+$/, '')}${parsed.search}`.toLowerCase();
+    }
+    catch {
+        return url.trim().toLowerCase();
+    }
+}
+// The person's own words switch research off - never the model's.
+export function noteSkipRequest(userText) {
+    if (state.skipped || !asksToSkipResearch(userText))
+        return null;
+    state.skipped = true;
+    return 'Research skipped for this conversation, as you asked.';
+}
+// A problem's fingerprint: the command, and the first line of its output that names
+// an error, with numbers taken out (line numbers and times change between runs).
+export function problemSignature(command, output) {
+    const lines = output.split('\n').map((line) => line.trim()).filter(Boolean);
+    const errorLine = lines.find((line) => /error|failed|failure|exception|cannot|can't|not found|undefined|denied|traceback|assert/i.test(line) && !/^exit code:/i.test(line)) ??
+        lines.filter((line) => !/^(exit code:|stdout:|stderr:|\$ )/i.test(line)).pop() ??
+        '';
+    const clean = (text) => text.toLowerCase().replace(/\d+/g, '#').replace(/\s+/g, ' ').trim();
+    return `${clean(command).slice(0, 120)} => ${clean(errorLine).slice(0, 160)}`;
+}
+// Called after every command. A command that succeeds clears its record; the same
+// failure a second time holds patching until it has been researched.
+export function recordCommandResult(command, exitCode, output) {
+    const commandKey = problemSignature(command, '').split(' => ')[0];
+    if (exitCode === 0) {
+        for (const key of [...state.problems.keys()])
+            if (key.startsWith(`${commandKey} => `))
+                state.problems.delete(key);
+        return null;
+    }
+    const signature = problemSignature(command, output);
+    const record = state.problems.get(signature) ?? { count: 0 };
+    record.count += 1;
+    state.problems.set(signature, record);
+    if (record.count >= 2 && state.heldProblem === null && !state.skipped) {
+        state.heldProblem = signature;
+        state.openedAtHold = state.openedCount;
+        return (`\n\n${HELD_PREFIX} this is the same failure a second time. Changing files is now held until you research it: ` +
+            'find the cause with webSearch and readWebPage (the tool\'s own documentation, its issue tracker, how others fixed it), ' +
+            'then record it with noteResearch (kind "problem", with the cause, the fix and the pages you opened). Do not guess another patch.');
+    }
+    return null;
+}
+async function folderHasProgramFiles(folder) {
+    if (!existsSync(folder))
+        return false;
+    const found = await fg(`**/*.{${PROGRAM_EXTENSIONS.join(',')}}`, {
+        cwd: folder,
+        deep: 4,
+        onlyFiles: true,
+        ignore: ['**/node_modules/**', '**/.git/**', '**/.venv/**', '**/venv/**', '**/dist/**', '**/build/**'],
+        suppressErrors: true,
+    });
+    return found.length > 0;
+}
+// The project a new file belongs to: the project folder when the file is inside it,
+// otherwise the file's own folder.
+function projectFolderFor(resolved, projectRoot) {
+    const relative = path.relative(projectRoot, resolved);
+    const inside = relative !== '' && !relative.startsWith('..') && !path.isAbsolute(relative);
+    return inside ? projectRoot : path.dirname(resolved);
+}
+const BUILD_HOLD = `${HELD_PREFIX} this starts something new (a program, site, app, tool or script), and Jeeves researches before building. ` +
+    'First look for what already exists: use webSearch and readWebPage to find existing tools, open-source projects and how others have built this. ' +
+    'Then call noteResearch (kind "build") with the pages you opened and your decision - use an existing tool as is, adapt one with credit if its licence allows, or build new and why. Then try again.';
+const PATCH_HOLD = () => `${HELD_PREFIX} the same failure has happened twice (${state.heldProblem}), so changing files is held until it is researched. ` +
+    'Find the cause with webSearch and readWebPage, then call noteResearch (kind "problem") with the cause, the fix and the pages you opened. Then try again.';
+// Checked before writeFile is offered for permission. Returns why it is held, or null.
+export async function holdForWrite(file, resolved, projectRoot) {
+    if (state.skipped)
+        return null;
+    const exists = existsSync(resolved);
+    if (exists && state.heldProblem !== null)
+        return PATCH_HOLD();
+    if (exists || state.buildNote || !isProgramFile(file))
+        return null;
+    const folder = projectFolderFor(resolved, projectRoot);
+    if (await folderHasProgramFiles(folder))
+        return null;
+    return BUILD_HOLD;
+}
+// Checked before a command that changes things is offered for permission.
+export function holdForCommand(command) {
+    if (state.skipped)
+        return null;
+    if (state.heldProblem !== null && commandEditsFiles(command))
+        return PATCH_HOLD();
+    if (!state.buildNote && startsNewProject(command))
+        return BUILD_HOLD;
+    return null;
+}
+export const noteResearchSchema = z.object({
+    kind: z.enum(['build', 'problem']).describe('"build" before making something new; "problem" after the same failure twice'),
+    subject: z.string().min(3).describe('What is being built, or the problem'),
+    sources: z.array(z.string()).describe('Addresses of the pages you opened with readWebPage in this conversation'),
+    decision: z
+        .enum(['use-existing', 'adapt', 'build-new'])
+        .optional()
+        .describe('For "build": use an existing tool as is, adapt one (licence permitting), or build new'),
+    licence: z.string().optional().describe('For use-existing or adapt: the licence of what is reused, exactly as its page states'),
+    reason: z.string().optional().describe('For "build": why this decision, in one or two sentences'),
+    cause: z.string().optional().describe('For "problem": the cause, as the sources explain it'),
+    fix: z.string().optional().describe('For "problem": the fix the sources support'),
+    noWebAccess: z.boolean().optional().describe('True only if the web tools could not be used in this conversation'),
+});
+function domain(url) {
+    try {
+        return new URL(url).hostname.replace(/^www\./, '');
+    }
+    catch {
+        return url;
+    }
+}
+const DECISION_WORDS = {
+    'use-existing': 'use an existing tool as is',
+    adapt: 'adapt existing work, with credit',
+    'build-new': 'build new',
+};
+// Records a note, or explains what is missing. Returns the reply for the model and,
+// when accepted, the line shown to the person.
+export function recordNote(input) {
+    const refuse = (reply) => ({ ok: false, reply: `Not recorded: ${reply}` });
+    const sources = input.sources.map((url) => url.trim()).filter(Boolean);
+    if (input.noWebAccess) {
+        if (!state.webUnavailable)
+            return refuse('the web tools have not failed in this conversation - research with webSearch and readWebPage first.');
+    }
+    else {
+        if (sources.length === 0)
+            return refuse('list the pages you opened with readWebPage.');
+        const unknown = sources.filter((url) => !state.opened.has(normaliseUrl(url)) && !state.listed.has(normaliseUrl(url)));
+        if (unknown.length > 0)
+            return refuse(`only list pages found or opened in this conversation - ${unknown.join(', ')} ${unknown.length === 1 ? 'was' : 'were'} not.`);
+        if (!sources.some((url) => state.opened.has(normaliseUrl(url))))
+            return refuse('open at least one of these pages with readWebPage first - search results alone are not research.');
+    }
+    const web = input.noWebAccess ? 'no web access, so from general knowledge only' : `${sources.length} source${sources.length === 1 ? '' : 's'}: ${[...new Set(sources.map(domain))].join(', ')}`;
+    if (input.kind === 'build') {
+        if (!input.decision)
+            return refuse('give a decision: use-existing, adapt or build-new.');
+        if (!input.reason || input.reason.trim().length < 10)
+            return refuse('give the reason for the decision.');
+        if (input.decision !== 'build-new') {
+            if (!input.licence?.trim())
+                return refuse('state the licence of what you would reuse, as its page states it.');
+            if (input.decision === 'adapt' && !isOpenLicence(input.licence)) {
+                return refuse(`"${input.licence}" does not allow reuse - learn the approach only, and record the decision as build-new.`);
+            }
+        }
+        state.buildNote = { kind: 'build', subject: input.subject };
+        const licence = input.decision !== 'build-new' && input.licence ? ` (licence: ${input.licence.trim()})` : '';
+        const shown = `Research — ${input.subject}: ${web}. Decision: ${DECISION_WORDS[input.decision]}${licence} — ${input.reason.trim()}`;
+        return { ok: true, reply: 'Recorded. Building is no longer held for this conversation.', shown };
+    }
+    if (!input.cause?.trim() || !input.fix?.trim())
+        return refuse('give the cause and the fix, as the sources explain them.');
+    if (state.heldProblem !== null && !input.noWebAccess && state.openedCount <= state.openedAtHold) {
+        return refuse('open at least one page about this problem with readWebPage after it happened the second time.');
+    }
+    const wasHeld = state.heldProblem;
+    state.heldProblem = null;
+    if (wasHeld)
+        state.problems.delete(wasHeld);
+    const shown = `Research — ${input.subject}: ${web}. Cause: ${input.cause.trim()} Fix: ${input.fix.trim()}`;
+    return { ok: true, reply: wasHeld ? 'Recorded. Changing files is no longer held.' : 'Recorded.', shown };
+}

package/dist/agent/review.js

@@ -0,0 +1,135 @@
+import path from 'node:path';
+import { session } from '../state/session.js';
+import { AUTO_PROFILES, autoProfile } from './auto-ids.js';
+import { conversationForExpert, workerModel, autoCatalogue } from './auto.js';
+import { expertChat } from './expert-chat.js';
+import { isProgramFile } from './research-gate.js';
+import { isReadOnlyBashCommand } from './permissions.js';
+// Auto's double-check of finished work (plan step 3).
+//
+// When: measured on 18 Sept (bench, 61 everyday runs + the 17 Sept hard jobs), the cheap
+// worker's mistakes were in writing for someone else to read (invented details, a gap
+// left to fill in) and in hard logic from a written specification - never in data files,
+// sums, dates, moving files, or jobs touching several files. So the check runs when a
+// job changed a program file or wrote a document, and not otherwise.
+//
+// How: a reviewer on 17 Sept broke a correct job by "fixing" a problem that wasn't there.
+// So every problem must come with a concrete example, problems without one are dropped,
+// and the worker must reproduce each before changing anything (the approach of Agentless,
+// OpenAutoCoder/Agentless: reproduce the issue before accepting a fix) - enforced by
+// holding file changes until it has looked or run something after the review.
+// Documents written for people: prose, not data.
+const DOCUMENT_EXTENSIONS = ['txt', 'md', 'rtf', 'doc', 'docx', 'odt', 'eml', 'tex'];
+export function isDocumentFile(file) {
+    return DOCUMENT_EXTENSIONS.includes(path.extname(file).slice(1).toLowerCase());
+}
+// The file a writeFile line is about: its summary is "path (N characters)".
+function writtenPath(summary) {
+    return summary.replace(/\s+\(\d+ characters\)$/, '');
+}
+// Whether this job's actions call for the double-check.
+export function jobNeedsReview(entries) {
+    return entries.some((entry) => {
+        if (entry.kind !== 'tool' || entry.data.state !== 'done')
+            return false;
+        if (entry.data.tool === 'writeFile') {
+            const file = writtenPath(entry.data.summary);
+            return isProgramFile(file) || isDocumentFile(file);
+        }
+        if (entry.data.tool === 'runBash' && !isReadOnlyBashCommand(entry.data.summary)) {
+            // A command that names a program file it may change (an edit, a redirect).
+            return /\.(js|mjs|cjs|ts|tsx|jsx|py|rb|php|go|rs|java|sh|html?|css)\b/i.test(entry.data.summary) && /(>|sed\s|perl\s|tee\s|cp\s|mv\s)/.test(entry.data.summary);
+        }
+        return false;
+    });
+}
+export const REVIEW_INSTRUCTIONS = `You are the expert reviewer for an assistant doing a job on a computer for someone with no technical background. The assistant believes the job is finished. You see the whole conversation: the request, every action, every file written, and every result.
+Check the work against what the person asked for - including cases the request clearly implies but does not list. For writing meant for someone else, check that it uses only the facts the person gave and leaves nothing to fill in.
+If nothing is wrong, reply with exactly: OK
+Otherwise list each problem in exactly this form, and nothing else:
+PROBLEM: what is wrong, in one sentence
+EXAMPLE: a concrete case that shows it - an input to try, or the exact words quoted from the file
+EXPECTED: what should happen or be written
+ACTUAL: what the work does or says now
+Only report a problem the conversation shows. A problem without a concrete EXAMPLE will be ignored. Never guess.`;
+// Reads the reviewer's reply. Problems without a concrete example are dropped, so a
+// vague "this might be wrong" can never send the worker off changing correct work.
+export function parseReview(text) {
+    if (/^\s*OK\s*\.?\s*$/i.test(text))
+        return { ok: true, problems: [] };
+    const problems = [];
+    for (const block of text.split(/(?=^\s*(?:\d+[.)]\s*)?\**PROBLEM\**\s*:)/im)) {
+        const field = (name) => block.match(new RegExp(`\\**${name}\\**\\s*:\\s*([\\s\\S]*?)(?=\\n\\s*\\**(?:PROBLEM|EXAMPLE|EXPECTED|ACTUAL)\\**\\s*:|$)`, 'i'))?.[1].trim() ?? '';
+        const item = { problem: field('PROBLEM'), example: field('EXAMPLE'), expected: field('EXPECTED'), actual: field('ACTUAL') };
+        if (item.problem && item.example.length >= 3)
+            problems.push(item);
+    }
+    return { ok: problems.length === 0, problems };
+}
+export function fixRequest(problems) {
+    const list = problems
+        .map((p, i) => `${i + 1}. ${p.problem}\n   Example: ${p.example}\n   Expected: ${p.expected || '(not given)'}\n   Actual: ${p.actual || '(not given)'}`)
+        .join('\n');
+    return `An expert reviewed your work and reported these problems:\n${list}\n\nThe expert can be wrong. For each one, first reproduce it: run the example, or read the file and find the exact words. Only fix a problem you have reproduced; if you cannot reproduce one, leave the work as it is for that one. Then check the result again. Tell the person, briefly, that the job is done, then in one sentence what the double-check caught and what you changed (or that its concern did not hold). They never saw the earlier version, so do not describe your reply as a fix to something they saw.`;
+}
+// The reviewers, in order: the service's expert models still in its catalogue.
+export function reviewers(catalogue = autoCatalogue(), providerId = session.providerId) {
+    const experts = (autoProfile(providerId) ?? AUTO_PROFILES.openrouter).experts;
+    if (catalogue.length === 0)
+        return experts.slice();
+    return experts.filter((id) => {
+        const params = catalogue.find((model) => model.id === id)?.supportedParameters ?? [];
+        return params.includes('tools') || params.includes('tool_choice');
+    });
+}
+// Asks each reviewer in turn until one answers; says so plainly when none can.
+export async function reviewJob(messages, chat = expertChat, candidates = reviewers()) {
+    const lineId = session.addToolLine('askExpert', 'final check of the work', 'running');
+    try {
+        for (const reviewer of candidates) {
+            session.setActiveModel(reviewer);
+            try {
+                const reply = await chat(reviewer, [
+                    { role: 'system', content: REVIEW_INSTRUCTIONS },
+                    { role: 'user', content: `Conversation:\n${conversationForExpert(messages, 80_000, 6_000)}` },
+                ], 1500);
+                const parsed = parseReview(reply);
+                session.updateToolLine(lineId, { state: 'done', label: parsed.ok ? 'Expert checked the work' : 'Expert found something to check' });
+                return parsed.ok ? { kind: 'ok', reviewer } : { kind: 'problems', reviewer, problems: parsed.problems };
+            }
+            catch {
+                // This reviewer is unavailable - try the next one.
+            }
+        }
+        session.updateToolLine(lineId, { state: 'failed', label: 'no expert was available' });
+        return { kind: 'unavailable' };
+    }
+    finally {
+        session.setActiveModel(workerModel());
+    }
+}
+export const UNCHECKED_NOTICE = "I couldn't have this work double-checked just now - the checking service wasn't reachable. Please look it over before relying on it.";
+// While the worker fixes reviewed work, changing files waits until it has reproduced a
+// problem: read a file or run something after the review.
+let reproducing = false;
+export function startReproducing() {
+    reproducing = true;
+}
+export function stopReproducing() {
+    reproducing = false;
+}
+export const REPRODUCE_HOLD = 'Held for research: reproduce the reported problem before changing anything - run the example or read the file to find the exact words, then make the fix.';
+// Called before a tool runs: a look (readFile, listDir) or a command that is not
+// itself an edit counts as reproducing; a change before that is held.
+export function holdUntilReproduced(tool, detail, editsFiles) {
+    if (!reproducing)
+        return null;
+    if (tool === 'readFile' || tool === 'listDir' || (tool === 'runBash' && !editsFiles)) {
+        reproducing = false;
+        return null;
+    }
+    if (tool === 'writeFile' || (tool === 'runBash' && editsFiles))
+        return REPRODUCE_HOLD;
+    void detail;
+    return null;
+}