@vibedeckx/darwin-arm64 0.2.17 → 0.2.19

package/dist/bin.js

@@ -186274,7 +186274,7 @@ var createSearchCacheRepos = (kdb, _h) => ({
 });
 
 // src/storage/repositories/workflow-runs.ts
-var ACTIVE = ["waiting_reviewer", "waiting_feedback", "sending_feedback"];
+var ACTIVE = ["waiting_reviewer", "waiting_feedback", "discussing", "sending_feedback"];
 var asRun = (row) => row;
 var createWorkflowRunRepos = (kdb) => ({
   workflowRuns: {
@@ -202331,7 +202331,7 @@ import { existsSync as existsSync3 } from "fs";
 // src/notification-milestones.ts
 var sessionResultReadyId = (sessionId, turnEndEntryIndex) => `session:${sessionId}:turn:${turnEndEntryIndex}:result-ready`;
 var sessionFailedId = (sessionId, turnEndEntryIndex) => `session:${sessionId}:turn:${turnEndEntryIndex}:failed`;
-var reviewReadyId = (workflowRunId) => `workflow:${workflowRunId}:review-ready`;
+var reviewReadyId = (workflowRunId, turnEndEntryIndex) => `workflow:${workflowRunId}:turn:${turnEndEntryIndex}:review-ready`;
 var workflowFailedId = (workflowRunId, stateVersion) => `workflow:${workflowRunId}:failed:${stateVersion}`;
 function findTurnOpeningUserEntry(entries, beforeIndex) {
   let opening;
@@ -225173,6 +225173,19 @@ var AgentSessionManager = class {
       console.error(`[AgentSession] Error in ${label} handler for ${session.id}:`, err);
     });
   }
+  /**
+   * Same serial chain as `enqueueSessionWork`, for a caller that needs the
+   * result back. The chain itself absorbs the outcome (success or failure) so
+   * one queued step can never break the next; the caller gets the real promise.
+   */
+  runSerialForResult(session, work) {
+    const result = session.eventChain.then(work);
+    session.eventChain = result.then(
+      () => void 0,
+      () => void 0
+    );
+    return result;
+  }
   clearGraceTimer(session) {
     if (session.graceTimer) {
       clearTimeout(session.graceTimer);
@@ -226051,6 +226064,86 @@ var AgentSessionManager = class {
     }
     return "ok";
   }
+  /**
+   * Set (or clear, with null) a session's model. The model is a spawn
+   * argument, so it takes effect on the next process the session spawns —
+   * immediately for a dormant session (a branch, or one that was stopped),
+   * and after retiring the idle process for a session that has one.
+   *
+   * Refused ("busy") under exactly the rule switchAgentType uses: a turn in
+   * flight on a session that has history. Both are respawn-shaped changes, so
+   * a divergent rule here would only mean the model chip and the agent chip
+   * lock at different moments in the same header row.
+   *
+   * The name is never validated — an unknown one is passed to the CLI and
+   * fails there, same as at creation.
+   *
+   * The whole transition runs on the session's serial event chain and writes
+   * the row BEFORE touching memory, so the three places a model lives — the
+   * row, `session.model`, and the process spawned from it — can never disagree:
+   * a failed write ("error") leaves all three exactly as they were.
+   */
+  async setModel(sessionId, model) {
+    const session = this.sessions.get(sessionId);
+    if (!session) return "not_found";
+    const normalized = model?.trim() ? model.trim() : null;
+    return this.runSerialForResult(session, async () => {
+      if (session.model === normalized) return "ok";
+      if (this.isModelChangeTooLate(session)) return "busy";
+      console.log(`[AgentSession] Setting session ${sessionId} model ${session.model ?? "default"} \u2192 ${normalized ?? "default"}`);
+      const previous = session.model;
+      if (!session.skipDb) {
+        try {
+          await this.storage.agentSessions.updateModel(sessionId, normalized);
+        } catch (err) {
+          console.error(`[AgentSession] Failed to persist model for ${sessionId}:`, err);
+          return "error";
+        }
+        if (this.isModelChangeTooLate(session)) {
+          try {
+            await this.storage.agentSessions.updateModel(sessionId, previous);
+          } catch (err) {
+            console.error(`[AgentSession] Failed to roll back model for ${sessionId}:`, err);
+          }
+          return "busy";
+        }
+      }
+      session.model = normalized;
+      if (session.process) {
+        const proc = session.process;
+        session.process = null;
+        this.killProcess(proc);
+        this.emitProcessAlive(session, false);
+        await this.finalizeStreamingEntry(session);
+        session.store.currentAssistantIndex = null;
+        session.buffer = "";
+        this.resetCompletion(session);
+        session.dormant = true;
+        if (session.status !== "stopped") {
+          session.status = "stopped";
+          if (!session.skipDb) {
+            try {
+              await this.storage.agentSessions.updateStatus(sessionId, "stopped");
+            } catch (err) {
+              console.error(`[AgentSession] Failed to persist stopped status for ${sessionId}:`, err);
+            }
+          }
+          this.broadcastPatch(sessionId, ConversationPatch.updateStatus("stopped"));
+          this.eventBus?.emit({ type: "session:status", projectId: session.projectId, branch: session.branch, sessionId: session.id, status: "stopped" });
+        }
+      }
+      return "ok";
+    });
+  }
+  /**
+   * True once the model can no longer reach the CLI: a turn is in flight on a
+   * session that has history. Same rule switchAgentType refuses on — both are
+   * respawn-shaped changes, and a divergent rule would only mean the model
+   * chip and the agent chip lock at different moments in the same header row.
+   */
+  isModelChangeTooLate(session) {
+    return session.status === "running" && session.store.entries.some(Boolean);
+  }
   /**
    * Switch permission mode for a session (preserves conversation history)
    */
@@ -226811,6 +226904,9 @@ function runUpdatedEventFromRemoteFrame(parsed, sessionId, remoteInfo) {
   const run2 = mapRemoteRun(bare, remoteInfo.remoteServerId, projectId);
   return { type: "workflow:run-updated", projectId, branch: run2.branch, run: run2 };
 }
+function runUpdatedFrameForSubscribers(evt) {
+  return JSON.stringify({ workflowRunUpdated: evt.run });
+}
 
 // src/routes/notification-outbox-routes.ts
 var import_fastify_plugin = __toESM(require_plugin2(), 1);
@@ -226871,7 +226967,8 @@ var routes = async (fastify2) => {
           events: [],
           headCursor,
           nextCursor: headCursor,
-          hasMore: false
+          hasMore: false,
+          sessionTitle: null
         });
         continue;
       }
@@ -226881,12 +226978,14 @@ var routes = async (fastify2) => {
         validated.limit
       );
       const nextCursor = events.length > 0 ? events[events.length - 1].seq : request.after;
+      const session = events.length > 0 ? await fastify2.storage.agentSessions.getById(request.sessionId) : void 0;
       sessions.push({
         sessionId: request.sessionId,
         events,
         headCursor,
         nextCursor,
-        hasMore: nextCursor < headCursor
+        hasMore: nextCursor < headCursor,
+        sessionTitle: session?.title ?? null
       });
     }
     return reply.code(200).send({ sessions });
@@ -226901,7 +227000,10 @@ var WATCH_WINDOW_MS = 30 * 60 * 1e3;
 var WATCH_EXTEND_THROTTLE_MS = 5 * 60 * 1e3;
 var MAX_TRACKED_SESSIONS = 5e3;
 var SYNC_INTERVAL_MS = 6e4;
+var COMPLETION_NUDGE_DEBOUNCE_MS = 250;
+var MAX_CONCURRENT_SERVERS = 4;
 var MAX_PAGES_PER_SYNC = 50;
+var MAX_SESSION_TITLE_LENGTH = 200;
 function localWorkflowRunId(remoteServerId, projectId, remoteRunId) {
   return `remote-${remoteServerId}-${projectId}-${remoteRunId}`;
 }
@@ -226913,10 +227015,19 @@ var RemoteNotificationSync = class {
   notificationService;
   reverseConnectManager;
   proxy;
+  nudgeDebounceMs;
   timer = null;
   stopped = false;
-  /** Serializes sweeps so a came-online sweep can't interleave with the tick. */
-  chain = Promise.resolve();
+  /**
+   * Per-server work queues. Two syncs of the SAME server must not interleave
+   * (they share its cursors), but two different servers have nothing in
+   * common — serializing them globally only meant an unreachable worker's
+   * retry budget delayed every healthy worker's import behind it.
+   */
+  serverChains = /* @__PURE__ */ new Map();
+  /** Local session ids whose completion is waiting for the debounce to fire. */
+  nudgeSessions = /* @__PURE__ */ new Set();
+  nudgeTimer = null;
   /**
    * Remote sessions this front currently believes are RUNNING. They are polled
    * regardless of their persisted watch window: an agent turn can easily run
@@ -226932,6 +227043,7 @@ var RemoteNotificationSync = class {
     this.notificationService = deps.notificationService;
     this.reverseConnectManager = deps.reverseConnectManager;
     this.proxy = deps.proxy ?? proxyToRemoteAuto;
+    this.nudgeDebounceMs = deps.nudgeDebounceMs ?? COMPLETION_NUDGE_DEBOUNCE_MS;
   }
   start() {
     if (this.timer || this.stopped) return;
@@ -226944,6 +227056,9 @@ var RemoteNotificationSync = class {
     this.stopped = true;
     if (this.timer) clearInterval(this.timer);
     this.timer = null;
+    if (this.nudgeTimer) clearTimeout(this.nudgeTimer);
+    this.nudgeTimer = null;
+    this.nudgeSessions.clear();
     this.activeRemoteSessions.clear();
     this.lastWatchExtend.clear();
   }
@@ -226967,6 +227082,7 @@ var RemoteNotificationSync = class {
     } else if (event.type === "session:taskCompleted" || event.type === "session:finished") {
       this.activeRemoteSessions.delete(sessionId);
     }
+    if (isTurnTerminalEvent(event)) this.scheduleCompletionSync(sessionId);
     const now2 = Date.now();
     const last = this.lastWatchExtend.get(sessionId) ?? 0;
     if (now2 - last < WATCH_EXTEND_THROTTLE_MS) return;
@@ -226980,10 +227096,65 @@ var RemoteNotificationSync = class {
       if (now2 - at > WATCH_WINDOW_MS) this.lastWatchExtend.delete(sessionId);
     }
   }
-  /** Fire-and-forget sweep, queued behind any in-flight one. */
+  /**
+   * Fire-and-forget sweep. No longer a global queue: the per-server chains
+   * inside syncAll/syncServer own the mutual exclusion that actually matters
+   * (one server's cursors), so callers here don't wait on unrelated servers.
+   */
   enqueue(work) {
     if (this.stopped) return;
-    this.chain = this.chain.then(work).catch((err) => console.warn("[RemoteNotifications] sync failed:", err));
+    void work().catch((err) => console.warn("[RemoteNotifications] sync failed:", err));
+  }
+  /**
+   * Queue `work` behind whatever is already running for this server, and
+   * nothing else. Errors are contained so one server's failure can't reject
+   * an unrelated caller awaiting the same chain.
+   */
+  runOnServer(remoteServerId, work) {
+    const previous = this.serverChains.get(remoteServerId) ?? Promise.resolve();
+    const next = previous.then(work).catch((err) => console.warn(`[RemoteNotifications] sync for ${remoteServerId} failed:`, err)).finally(() => {
+      if (this.serverChains.get(remoteServerId) === next) this.serverChains.delete(remoteServerId);
+    });
+    this.serverChains.set(remoteServerId, next);
+    return next;
+  }
+  /**
+   * Debounced, per-server pull for sessions whose turn just ended.
+   *
+   * Coalescing state is intentionally separate from `lastWatchExtend`: that
+   * map throttles DB writes on a 5-minute scale, which would swallow nearly
+   * every completion.
+   */
+  scheduleCompletionSync(localSessionId) {
+    if (this.stopped) return;
+    this.nudgeSessions.add(localSessionId);
+    if (this.nudgeTimer) return;
+    this.nudgeTimer = setTimeout(() => {
+      this.nudgeTimer = null;
+      const batch = [...this.nudgeSessions];
+      this.nudgeSessions.clear();
+      void this.syncSessions(batch).catch(
+        (err) => console.warn("[RemoteNotifications] completion sync failed:", err)
+      );
+    }, this.nudgeDebounceMs);
+    this.nudgeTimer.unref?.();
+  }
+  /**
+   * Pull exactly the mappings named, grouped per server. Deliberately does NOT
+   * go through `candidates()`: an explicit completion signal outranks the
+   * watch window, which may well have lapsed during a long turn.
+   */
+  async syncSessions(localSessionIds) {
+    const byServer = /* @__PURE__ */ new Map();
+    for (const localSessionId of localSessionIds) {
+      const mapping = await this.storage.remoteSessionMappings.getByLocal(localSessionId).catch(() => void 0);
+      if (!mapping) continue;
+      const group2 = byServer.get(mapping.remote_server_id);
+      if (group2) group2.push(mapping);
+      else byServer.set(mapping.remote_server_id, [mapping]);
+    }
+    if (byServer.size === 0) return;
+    await this.dispatchByServer([...byServer]);
   }
   /** Extend a mapping's periodic-poll window (create / send / workflow start / live activity). */
   async extendWatch(localSessionId) {
@@ -227033,17 +227204,33 @@ var RemoteNotificationSync = class {
     );
     return true;
   }
-  /** Sweep every mapped remote server. */
+  /** Sweep every mapped remote server, up to MAX_CONCURRENT_SERVERS at a time. */
   async syncAll(opts) {
     const mappings = await this.candidates(opts);
-    for (const [serverId, group2] of groupByServer(mappings)) {
-      await this.syncMappings(serverId, group2);
-    }
+    await this.dispatchByServer([...groupByServer(mappings)]);
   }
   /** Sweep one server — used when a reverse connection comes online. */
   async syncServer(remoteServerId, opts) {
     const mappings = (await this.candidates(opts)).filter((m2) => m2.remote_server_id === remoteServerId);
-    if (mappings.length > 0) await this.syncMappings(remoteServerId, mappings);
+    if (mappings.length > 0) await this.dispatchByServer([[remoteServerId, mappings]]);
+  }
+  /**
+   * Run one group per server, bounded. Each group still queues on its own
+   * server chain, so this composes with a nudge that arrives mid-sweep: same
+   * server → it waits its turn; different server → it runs immediately.
+   */
+  async dispatchByServer(groups) {
+    let next = 0;
+    const workers = Array.from(
+      { length: Math.min(MAX_CONCURRENT_SERVERS, groups.length) },
+      async () => {
+        for (let i = next++; i < groups.length; i = next++) {
+          const [serverId, group2] = groups[i];
+          await this.runOnServer(serverId, () => this.syncMappings(serverId, group2));
+        }
+      }
+    );
+    await Promise.all(workers);
   }
   /**
    * Mappings this sweep should poll: the persisted watch set, plus any session
@@ -227138,6 +227325,7 @@ var RemoteNotificationSync = class {
       console.warn(`[RemoteNotifications] project ${mapping.project_id} not found; skipping ${mapping.local_session_id}`);
       return false;
     }
+    const sessionTitle = typeof session.sessionTitle === "string" ? session.sessionTitle.slice(0, MAX_SESSION_TITLE_LENGTH) : null;
     for (const event of session.events) {
       const notification = await this.notificationService.buildNotification(event, {
         id: localNotificationId(remoteServerId, event.id),
@@ -227145,7 +227333,7 @@ var RemoteNotificationSync = class {
         projectId: mapping.project_id,
         sessionId: mapping.local_session_id,
         workflowRunId: event.workflow_run_id ? localWorkflowRunId(remoteServerId, mapping.project_id, event.workflow_run_id) : null
-      });
+      }, { sessionTitle });
       const { inserted } = await this.storage.notifications.importRemote({
         notification,
         remoteServerId,
@@ -227190,6 +227378,10 @@ var RemoteNotificationSync = class {
     };
   }
 };
+function isTurnTerminalEvent(event) {
+  if (event.type === "session:taskCompleted" || event.type === "session:finished") return true;
+  return event.type === "session:status" && (event.status === "stopped" || event.status === "error");
+}
 function groupByServer(mappings) {
   const groups = /* @__PURE__ */ new Map();
   for (const mapping of mappings) {
@@ -227359,9 +227551,10 @@ function connectPersistentRemoteWs(sessionId, remoteInfo, cache2, wsOptions, rev
         }
       }
     } else if ("workflowRunUpdated" in parsed) {
-      if (eventBus) {
-        const evt = runUpdatedEventFromRemoteFrame(parsed, sessionId, remoteInfo);
-        if (evt) eventBus.emit(evt);
+      const evt = runUpdatedEventFromRemoteFrame(parsed, sessionId, remoteInfo);
+      if (evt) {
+        eventBus?.emit(evt);
+        cache2.broadcast(sessionId, runUpdatedFrameForSubscribers(evt));
       }
     } else if ("processAlive" in parsed) {
       cache2.broadcast(sessionId, raw);
@@ -229950,12 +230143,18 @@ function selfReportSection(report) {
   if (!report) return null;
   return [
     "\n## Author's self-report (unverified)",
-    "The implementing agent described its own work as follows. Treat every claim as unverified \u2014 check each one against the actual code, and look for problems the self-report does not mention.",
+    "The implementing agent described its own work as follows. Treat every claim as unverified \u2014 verify first the claims that bear on whether the work achieves its goal, and look for problems the self-report does not mention.",
     "<author-self-report>",
     report,
     "</author-self-report>"
   ].join("\n");
 }
+var VERDICT_INSTRUCTIONS = [
+  "\nEnd your final message with:",
+  "1. Verdict \u2014 exactly one of: ship / needs-changes / cannot-verify. Use cannot-verify when you could not gather enough evidence to judge, rather than guessing.",
+  "2. Blocking findings \u2014 what must change before shipping, each specific and actionable (say explicitly when there are none).",
+  "3. Non-blocking notes \u2014 style and polish, briefly, clearly separated from the blocking list."
+];
 function buildReviewerPrompt(opts) {
   const intent = opts.originalIntent !== opts.taskContext ? opts.originalIntent : null;
   const brief = opts.intentBrief || null;
@@ -229994,7 +230193,12 @@ Confine your review to these files and changes. Other uncommitted or pre-existin
     "- Inspect the actual workspace state yourself: read the relevant files, run `git diff`, `git status` and `git log`.",
     reviewTargetPromptLine(opts.target),
     noDiffWithAnalysis ? "- Judge correctness and completeness against the task. For this analysis/plan turn the work under review is the reasoning and the proposal, not code quality of a diff. Be specific: reference files and lines." : "- Judge correctness, completeness against the task, and code quality. Be specific: reference files and lines.",
-    "\nEnd your final message with a clear, actionable list of feedback items \u2014 or state explicitly that the work looks good.",
+    // These two only make sense against a distilled brief: tier 2 has no
+    // [settled]/[tentative] marks and no stated scope, and implying it does
+    // would suppress findings on the strength of data that doesn't exist.
+    brief ? "- Where the brief marks a decision, non-goal, or accepted limitation as [settled], do not re-raise the choice itself as a finding; DO report concrete consequences it causes \u2014 failure of the core goal, or a correctness, security, or data loss problem. Items marked [tentative] (or unmarked) get normal review. A violated hard constraint is always blocking." : null,
+    brief ? "- Do not propose enhancements beyond the brief's stated scope \u2014 scope expansion is a product decision, not a review finding." : null,
+    ...VERDICT_INSTRUCTIONS,
     brief ? opts.authorSelfReport ? "\n(review context: distilled intent brief + author self-report + live workspace)" : "\n(review context: distilled intent brief + live workspace)" : hasExcerpt ? "\n(review context: deterministic excerpt of the source conversation + live workspace)" : "\n(review context: live workspace only \u2014 the source conversation was unavailable)"
   ].filter((l) => l !== null).join("\n");
 }
@@ -230018,17 +230222,30 @@ ${opts.reviewFocus}` : null,
     "- Check for regressions and remaining correctness or test gaps.",
     "- Do NOT modify files \u2014 remain in read-only review mode.",
     reviewTargetPromptLine(opts.target),
-    "- End with actionable feedback, or explicitly state that it looks good."
+    ...VERDICT_INSTRUCTIONS
   ].filter((line) => line !== null).join("\n");
 }
 function buildFeedbackMessage(feedback) {
   return [
     "[Review Feedback]",
-    "A reviewer agent examined your last completed work. Please address the following feedback:",
+    "A reviewer agent examined your last completed work. It was in read-only mode and saw only this turn's diff plus a distilled brief of the conversation, so it may be working from wrong premises. Treat its findings as input to verify, not as conclusions.",
+    "",
+    "- Verify each item against the code before changing anything.",
+    "- Push back when you have grounds: say what the item gets wrong and leave the code as it is. Do not change code to be agreeable.",
+    "- Address blocking findings first; non-blocking notes need not be done this turn.",
+    "- Do not widen the scope: no fixes the reviewer did not raise, no abstractions for hypothetical cases.",
+    "- Close with a per-item account: fixed, or not fixed and why.",
     "",
     feedback
   ].join("\n");
 }
+var FINAL_VERDICT_PROMPT = [
+  "[Final verdict request]",
+  "\u8BF7\u628A\u8BA8\u8BBA\u540E\u7684\u6700\u7EC8 review \u610F\u89C1\u5B8C\u6574\u8F93\u51FA\u4E3A\u9762\u5411\u4F5C\u8005\u7684\u5B9A\u7A3F\u3002\u8FD9\u6BB5\u8F93\u51FA\u5C06\u539F\u6837\u53D1\u9001\u7ED9\u4F5C\u8005\u2014\u2014\u4E0D\u8981\u5305\u542B\u5BF9\u8BDD\u6027\u5185\u5BB9\uFF1A\u4E0D\u8981\u5F15\u7528\u8BA8\u8BBA\u8FC7\u7A0B\u672C\u8EAB\uFF0C\u4E0D\u8981\u5411\u6211\u63D0\u95EE\u3002",
+  "- \u5438\u6536\u8BA8\u8BBA\u4E2D\u8FBE\u6210\u4E00\u81F4\u7684\u4FEE\u6B63\uFF1A\u64A4\u56DE\u7684\u6761\u76EE\u4E0D\u518D\u51FA\u73B0\uFF0C\u4FEE\u8BA2\u8FC7\u7684\u6761\u76EE\u4EE5\u4FEE\u8BA2\u540E\u7684\u5F62\u5F0F\u7ED9\u51FA\u3002",
+  "- \u4FDD\u6301\u5177\u4F53\uFF1A\u6BCF\u6761\u6307\u660E\u6587\u4EF6/\u4F4D\u7F6E\u4E0E\u95EE\u9898\uFF0C\u4EE5\u53CA\u671F\u671B\u7684\u4FEE\u590D\u65B9\u5411\u3002",
+  ...VERDICT_INSTRUCTIONS
+].join("\n");
 var REVIEWER_AGENT_TYPES = /* @__PURE__ */ new Set(["claude-code", "codex"]);
 var WorkflowEngine = class {
   constructor(storage, agentOps) {
@@ -230350,7 +230567,7 @@ var WorkflowEngine = class {
         ...driftNote ? { error: driftNote } : {}
       },
       {
-        id: reviewReadyId(run2.id),
+        id: reviewReadyId(run2.id, boundary),
         kind: "review_ready",
         project_id: run2.project_id,
         branch: run2.branch,
@@ -230397,12 +230614,49 @@ var WorkflowEngine = class {
     this.emitRunUpdated(done);
     return done;
   }
+  /**
+   * Discussion → verdict: CAS the run back onto the reviewer track and inject
+   * the final-verdict prompt. From waiting_reviewer the existing
+   * handleTaskCompleted path reopens the gate with the new turn's output.
+   * Send failure rolls the claim back so the finalize button stays actionable —
+   * mirror of approveFeedback's no-auto-retry contract.
+   */
+  async requestFinalVerdict(runId) {
+    const run2 = await this.storage.workflowRuns.getById(runId);
+    if (!run2 || run2.status !== "discussing" || !run2.reviewer_session_id) {
+      throw new WorkflowError("bad-state", "run \u4E0D\u5728\u8BA8\u8BBA\u72B6\u6001");
+    }
+    const reviewerSession = await this.storage.agentSessions.getById(run2.reviewer_session_id);
+    if (reviewerSession && reviewerSession.status === "running") {
+      throw new WorkflowError("session-busy", "reviewer \u6B63\u5728\u56DE\u590D\u4E2D\uFF0C\u8BF7\u7B49\u5F85\u5176\u5B8C\u6210\u540E\u518D\u751F\u6210\u7EC8\u7A3F");
+    }
+    const claimed = await this.storage.workflowRuns.transition(runId, "discussing", "waiting_reviewer", { error: null });
+    if (!claimed) throw new WorkflowError("bad-state", "run \u72B6\u6001\u5DF2\u53D8\u5316\uFF08\u53EF\u80FD\u5DF2\u88AB\u5904\u7406\uFF09");
+    const project = await this.storage.projects.getById(run2.project_id);
+    const sent = await this.agentOps.sendUserMessage(run2.reviewer_session_id, FINAL_VERDICT_PROMPT, project?.path ?? void 0, void 0, REVIEWER_TURN).catch(() => false);
+    if (!sent) {
+      const rolledBack = await this.storage.workflowRuns.transition(runId, "waiting_reviewer", "discussing", {
+        error: "\u53D1\u9001\u5931\u8D25\uFF1Areviewer session \u53EF\u80FD\u672A\u8FD0\u884C\u3002\u8BF7\u5728\u5176\u7A97\u53E3\u4E2D\u5524\u9192\u540E\u91CD\u8BD5\uFF0C\u6216\u7ED3\u675F\u672C\u6B21 review\u3002"
+      });
+      if (!rolledBack) {
+        console.warn(
+          `requestFinalVerdict: rollback CAS lost for run ${runId} \u2014 run moved concurrently (e.g. cancelled) while the send was in flight; rollback skipped`
+        );
+      }
+      const rolled = await this.storage.workflowRuns.getById(runId);
+      if (rolled) this.emitRunUpdated(rolled);
+      throw new WorkflowError("send-failed", "\u5411 reviewer \u53D1\u9001\u7EC8\u7A3F\u8BF7\u6C42\u5931\u8D25");
+    }
+    const updated = await this.storage.workflowRuns.getById(runId);
+    this.emitRunUpdated(updated);
+    return updated;
+  }
   async cancelRun(runId, reason) {
     const run2 = await this.storage.workflowRuns.getById(runId);
     if (!run2) return void 0;
     if (TERMINAL_STATUSES.has(run2.status)) return run2;
     const patch = reason ? { error: reason } : void 0;
-    const cancelled = await this.storage.workflowRuns.transition(runId, "waiting_reviewer", "cancelled", patch) || await this.storage.workflowRuns.transition(runId, "waiting_feedback", "cancelled", patch);
+    const cancelled = await this.storage.workflowRuns.transition(runId, "waiting_reviewer", "cancelled", patch) || await this.storage.workflowRuns.transition(runId, "waiting_feedback", "cancelled", patch) || await this.storage.workflowRuns.transition(runId, "discussing", "cancelled", patch);
     if (!cancelled) {
       const current = await this.storage.workflowRuns.getById(runId);
       if (current?.status === "sending_feedback") {
@@ -230420,6 +230674,10 @@ var WorkflowEngine = class {
   /**
    * Human takeover (spec §3.4): user sent a message directly to a run session.
    *
+   * Reviewer 分流:向 reviewer 发消息不再是接管——它开启一轮讨论,把 run
+   * 移入 `discussing`(gate 收起),等待显式的 requestFinalVerdict 重新出稿。
+   * 只有向 source session 发消息才算接管,结束 run。
+   *
    * Never-throws contract: this is called inline from the agent-session
    * `/message` route BEFORE the user's message is delivered
    * (agentOps.sendUserMessage). A throw here would abort delivery of that
@@ -230434,8 +230692,23 @@ var WorkflowEngine = class {
   async handleExternalUserMessage(sessionId) {
     const p2 = this.participants.get(sessionId);
     if (!p2) return;
+    if (p2.role === "reviewer") {
+      try {
+        const moved = await this.storage.workflowRuns.transition(p2.runId, "waiting_feedback", "discussing", { error: null }) || await this.storage.workflowRuns.transition(p2.runId, "waiting_reviewer", "discussing", { error: null });
+        if (moved) {
+          const updated = await this.storage.workflowRuns.getById(p2.runId);
+          if (updated) this.emitRunUpdated(updated);
+        }
+      } catch (err) {
+        console.error(
+          `[WorkflowEngine] handleExternalUserMessage: failed moving run ${p2.runId} to discussing; swallowed to honor never-throws contract`,
+          err
+        );
+      }
+      return;
+    }
     try {
-      await this.cancelRun(p2.runId, "\u7528\u6237\u63A5\u7BA1\uFF1A\u76F4\u63A5\u5411 run \u5185\u7684 session \u53D1\u9001\u4E86\u6D88\u606F\uFF0Creview \u5DF2\u7ED3\u675F\u3002");
+      await this.cancelRun(p2.runId, "\u7528\u6237\u63A5\u7BA1\uFF1A\u76F4\u63A5\u5411 source session \u53D1\u9001\u4E86\u6D88\u606F\uFF0Creview \u5DF2\u7ED3\u675F\u3002");
     } catch (err) {
       if (err instanceof WorkflowError && err.code === "bad-state") {
         console.warn(
@@ -232320,8 +232593,12 @@ var NotificationService = class {
    * Assemble the persisted row. `ids` is separate from the event because remote
    * imports substitute front-local identities (see RemoteNotificationSync) while
    * reusing this exact copy generation.
+   *
+   * `opts.sessionTitle` covers the remote-import case: the front has a mapping
+   * but no local session row, so the worker's query-time title is the only way
+   * to label the notification with the session's name.
    */
-  async buildNotification(event, ids) {
+  async buildNotification(event, ids, opts) {
     const session = ids.sessionId ? await this.storage.agentSessions.getById(ids.sessionId) : void 0;
     const project = await this.storage.projects.getById(ids.projectId);
     return {
@@ -232334,7 +232611,7 @@ var NotificationService = class {
       workflow_run_id: ids.workflowRunId,
       title: notificationTitle(event.kind),
       body: notificationBody({
-        sessionTitle: session?.title,
+        sessionTitle: session?.title ?? opts?.sessionTitle,
         branch: event.branch,
         projectName: project?.name
       }),
@@ -235626,8 +235903,8 @@ import { randomUUID as randomUUID15 } from "crypto";
 
 // src/protocol/model-suggestions.ts
 var MODEL_SUGGESTIONS = {
-  "claude-code": ["opus", "sonnet", "haiku"],
-  codex: ["gpt-5.6-sol", "gpt-5.6-codex", "o3"]
+  "claude-code": ["opus", "sonnet", "haiku", "fable"],
+  codex: ["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna", "gpt-5.5"]
 };
 
 // src/routes/agent-session-routes.ts
@@ -236449,6 +236726,54 @@ var routes12 = async (fastify2) => {
       return reply.code(200).send({ success: true, agentType });
     }
   );
+  fastify2.post(
+    "/api/agent-sessions/:sessionId/model",
+    async (req, reply) => {
+      const body = req.body || {};
+      if (body.model === void 0) {
+        return reply.code(400).send({ error: "model is required (null for the CLI default)" });
+      }
+      const { model } = body;
+      if (model !== null && typeof model !== "string") {
+        return reply.code(400).send({ error: "model must be a string or null" });
+      }
+      const userId = requireAuth(req, reply);
+      if (userId === null) return;
+      if (req.params.sessionId.startsWith("remote-")) {
+        const remoteInfo = await getAuthorizedRemoteSessionInfo(req.params.sessionId, userId);
+        if (!remoteInfo) {
+          return reply.code(404).send({ error: "Remote session not found" });
+        }
+        const result = await proxyAuto(
+          remoteInfo.remoteServerId,
+          remoteInfo.remoteUrl,
+          remoteInfo.remoteApiKey,
+          "POST",
+          `/api/agent-sessions/${remoteInfo.remoteSessionId}/model`,
+          { model }
+        );
+        return reply.code(proxyStatus(result)).send(result.data);
+      }
+      const row = await fastify2.storage.agentSessions.getById(req.params.sessionId);
+      if (!row || !await fastify2.storage.projects.getById(row.project_id, userId)) {
+        return reply.code(404).send({ error: "Session not found" });
+      }
+      const outcome = await fastify2.agentSessionManager.setModel(req.params.sessionId, model);
+      if (outcome === "not_found") {
+        return reply.code(404).send({ error: "Session not found" });
+      }
+      if (outcome === "busy") {
+        return reply.code(409).send({ error: "Agent is currently running \u2014 stop it before changing the model" });
+      }
+      if (outcome === "error") {
+        return reply.code(500).send({ error: "Couldn't save the model \u2014 the session kept its current one" });
+      }
+      return reply.code(200).send({
+        success: true,
+        model: fastify2.agentSessionManager.getSession(req.params.sessionId)?.model ?? null
+      });
+    }
+  );
   fastify2.post(
     "/api/agent-sessions/:sessionId/branch",
     async (req, reply) => {
@@ -237578,6 +237903,7 @@ var import_fastify_plugin20 = __toESM(require_plugin2(), 1);
 
 // src/utils/review-brief.ts
 var BASE_TIMEOUT_MS = 15e3;
+var JUDGMENT_TIMEOUT_MS = 9e4;
 var TIMEOUT_MS_PER_1K_CHARS = 120;
 var MAX_TIMEOUT_MS = 6e4;
 var PER_MESSAGE_MAX_CHARS = 6e3;
@@ -237587,11 +237913,11 @@ var RECENT_VERBATIM_RATIO = 0.3;
 var MIN_RECENT_VERBATIM_CHARS = 2e3;
 var MAX_FOLD_CALLS = 8;
 var COMPACT_SUMMARY_MAX_CHARS = 6e3;
-var COMPACT_SUMMARY_MAX_TOKENS = 1500;
+var COMPACT_SUMMARY_MAX_TOKENS = 3e3;
 var REVERSALS_MAX_CHARS = 2e3;
-var REVERSALS_MAX_TOKENS = 500;
+var REVERSALS_MAX_TOKENS = 2e3;
 var BRIEF_MAX_CHARS = 4e3;
-var BRIEF_MAX_TOKENS = 1e3;
+var BRIEF_MAX_TOKENS = 3e3;
 var REVERSAL_MIN_CHARS = 6e3;
 var SEP = "\n\n";
 var COMPACTION_NOTE = "_Note: the source conversation was compressed before distillation \u2014 older turns were summarized rather than read verbatim._";
@@ -237599,13 +237925,17 @@ var BRIEF_TRUNCATION_NOTE = "\n\n_[brief truncated at the length limit \u2014 tr
 var SYSTEM_PROMPT2 = [
   "You distill a coding-agent conversation into an intent brief for an independent code reviewer.",
   "The reviewer will NOT see the conversation \u2014 only your brief plus the actual code, so capture what the code alone cannot show:",
+  "0. Dominant question \u2014 1 or 2 sentences: the single question the reviewer must answer to judge this work (what must actually work, toward what goal). Derive it from the conversation's own emphasis \u2014 what the user repeated, finally decided, or reversed course over \u2014 never from your own engineering judgment. If the conversation does not clearly support one, write 'unclear' instead of inventing one.",
   "1. The original request and its goal.",
-  "2. Constraints and decisions, including approaches that were rejected and why. A rejection counts whether the user made it or the agent made it under a principle the user set.",
-  "3. Trade-offs or limitations that were acknowledged and accepted.",
-  "4. Behaviour established by actually running something \u2014 observed output, exit codes, error text, which stream an error arrived on. Report what was observed; that is evidence the reviewer cannot recover by reading code.",
+  "2. Hard constraints \u2014 requirements whose violation the user would treat as failure regardless of everything else (security, data loss, an explicit compatibility or behaviour promise). Only list ones the user actually stated; an empty section is fine.",
+  "3. Constraints and decisions, including approaches that were rejected and why. A rejection counts whether the user made it or the agent made it under a principle the user set.",
+  "4. Non-goals, trade-offs and limitations that were acknowledged and accepted.",
+  "5. Behaviour established by actually running something \u2014 observed output, exit codes, error text, which stream an error arrived on. Report what was observed; that is evidence the reviewer cannot recover by reading code.",
+  "Tag every item under headings 3 and 4 with exactly [settled] or [tentative] \u2014 the bare tag; keep any justification to a few words or omit it, always after the tag, never inside the brackets. Settled ONLY when the user explicitly confirmed it, instructed it, or reversed course to it; an agent proposal the user never answered is tentative \u2014 silence is never settled.",
+  "Within each heading, order items by how much they matter to the dominant question, not by when they were said.",
   "Later statements supersede earlier ones on the same topic. An option explored at length early is often rejected later in a single sentence, and the rejection wins. Where the conversation ends in a decision table or summary, that is authoritative wherever it conflicts with earlier prose.",
   "The input may arrive as numbered compressed slices followed by verbatim recent turns. Slice numbers are chronological: a later slice overrules an earlier one.",
-  "Decisions the agent made that the user did not contradict are binding \u2014 silence is agreement.",
+  "Decisions the agent made that the user did not contradict are worth reporting, but user silence only ever yields tentative status.",
   "Do NOT include the agent's self-assessment or any claim that the work is correct or complete \u2014 the reviewer must judge that independently.",
   "Every statement must trace to something in the conversation. If a heading has nothing real to report, say so rather than inventing plausible-sounding content.",
   "Write concise markdown bullets under those numbered headings, under 500 words total, in the same language as the conversation. Reply with the brief only."
@@ -237623,7 +237953,7 @@ var COMPACT_SYSTEM_PROMPT = [
   "You are told which slice of how many this is. Other slices are compressed separately and you cannot see them, so never present a conclusion here as final \u2014 a later slice may overturn it.",
   "Preserve, in this order of priority:",
   "1. Reversals and corrections \u2014 any conclusion that was dropped, replaced, or corrected. Quote the deciding sentence verbatim.",
-  "2. Constraints and decisions the user stated, and approaches that were rejected, with the reason.",
+  "2. Constraints and decisions the user stated, and approaches that were rejected, with the reason. Preserve who made each decision \u2014 an explicit user confirmation must stay distinguishable from an agent proposal the user never answered; quote the user's deciding sentence when there is one.",
   "3. Behaviour established by actually running something: observed output, exit codes, error text, which stream an error arrived on.",
   "4. Trade-offs that were acknowledged and accepted.",
   "Drop: exploration narrative, restated background, tool mechanics, and anything a reviewer could recover by reading the code.",
@@ -237719,8 +238049,16 @@ ${chunk}`,
       maxOutputTokens: COMPACT_SUMMARY_MAX_TOKENS,
       experimental_telemetry: telemetryFor("review-intent-brief-compact", userId)
     });
-    const text2 = (result.text ?? "").trim();
-    if (text2.length === 0) return null;
+    const { text: rawText, finishReason } = result;
+    if (finishReason === "length") {
+      console.warn(`[ReviewBrief] slice ${part}/${total} summary hit the token cap \u2014 discarding`);
+      return null;
+    }
+    const text2 = (rawText ?? "").trim();
+    if (text2.length === 0) {
+      console.warn(`[ReviewBrief] slice ${part}/${total} came back empty (finishReason: ${finishReason ?? "unknown"})`);
+      return null;
+    }
     return withinLimit(text2, COMPACT_SUMMARY_MAX_CHARS, `slice ${part}/${total} summary`) ? text2 : null;
   } catch (error48) {
     if (isSizeRelatedFailure(error48)) throw error48;
@@ -237774,11 +238112,16 @@ async function extractReversalsWithModel(model, conversation, options = {}) {
       prompt: `Report the reversals in this conversation:
 
 ${conversation}`,
-      timeout: timeoutForInput(conversation.length),
+      timeout: JUDGMENT_TIMEOUT_MS,
       maxOutputTokens: REVERSALS_MAX_TOKENS,
       experimental_telemetry: telemetryFor("review-intent-brief-reversals", options.userId)
     });
-    const text2 = (result.text ?? "").trim();
+    const { text: rawText, finishReason } = result;
+    if (finishReason === "length") {
+      console.warn("[ReviewBrief] reversal list hit the token cap \u2014 discarding");
+      return null;
+    }
+    const text2 = (rawText ?? "").trim();
     if (text2.length === 0 || /^none\b/i.test(text2)) return null;
     return withinLimit(text2, REVERSALS_MAX_CHARS, "reversal list") ? text2 : null;
   } catch (error48) {
@@ -237794,12 +238137,17 @@ async function generateIntentBriefWithModel(model, conversation, options = {}) {
       model,
       system: SYSTEM_PROMPT2,
       prompt: buildBriefPrompt(conversation, options.reversals ?? null),
-      timeout: timeoutForInput(conversation.length),
+      timeout: JUDGMENT_TIMEOUT_MS,
       maxOutputTokens: BRIEF_MAX_TOKENS,
       experimental_telemetry: telemetryFor("review-intent-brief", options.userId)
     });
-    const text2 = (result.text ?? "").trim();
-    if (text2.length === 0) return null;
+    const { text: rawText, finishReason } = result;
+    const text2 = (rawText ?? "").trim();
+    if (text2.length === 0) {
+      console.warn(`[ReviewBrief] model returned empty text (finishReason: ${finishReason ?? "unknown"})`);
+      return null;
+    }
+    if (finishReason === "length") return text2.slice(0, BRIEF_MAX_CHARS) + BRIEF_TRUNCATION_NOTE;
     return text2.length <= BRIEF_MAX_CHARS ? text2 : text2.slice(0, BRIEF_MAX_CHARS) + BRIEF_TRUNCATION_NOTE;
   } catch (error48) {
     if (options.rethrowSizeFailures && isSizeRelatedFailure(error48)) throw error48;
@@ -237813,13 +238161,17 @@ async function distill(model, conversation, userId, rethrowSizeFailures) {
 }
 async function generateIntentBrief(storage, userId, messages) {
   try {
-    if (!await isChatModelConfigured(storage, userId)) return null;
+    const config2 = await getChatProviderConfig(storage, userId);
+    const mainOk = isModelConfigured(config2, config2.main);
+    const fastOk = isModelConfigured(config2, config2.fast);
+    if (!mainOk && !fastOk) return null;
     const conversation = serializeConversationForBrief(messages);
     if (!conversation) return null;
-    const model = await resolveFastChatModel(storage, userId);
+    const distillModel = mainOk ? await resolveChatModel(storage, userId) : await resolveFastChatModel(storage, userId);
+    const compactModel = fastOk ? await resolveFastChatModel(storage, userId) : distillModel;
     if (conversation.length <= COMPACT_TRIGGER_CHARS) {
       try {
-        const brief = await distill(model, conversation, userId, true);
+        const brief = await distill(distillModel, conversation, userId, true);
         return brief === null ? null : appendCompactionNote(brief, false);
       } catch (error48) {
         if (!isSizeRelatedFailure(error48)) throw error48;
@@ -237828,9 +238180,9 @@ async function generateIntentBrief(storage, userId, messages) {
     }
     for (const sliceChars of COMPACT_SLICE_BUDGETS) {
       try {
-        const compacted = await compactConversation(model, messages, { userId, sliceChars });
+        const compacted = await compactConversation(compactModel, messages, { userId, sliceChars });
         if (compacted === null) return null;
-        const brief = await distill(model, compacted, userId, true);
+        const brief = await distill(distillModel, compacted, userId, true);
         return brief === null ? null : appendCompactionNote(brief, true);
       } catch (error48) {
         if (!isSizeRelatedFailure(error48)) throw error48;
@@ -238229,7 +238581,11 @@ async function routes19(fastify2) {
           const run2 = await fastify2.workflowEngine.cancelRun(req.params.id);
           return reply.send({ run: run2 });
         }
-        return reply.code(400).send({ error: "action must be approve or cancel" });
+        if (action === "finalize") {
+          const run2 = await fastify2.workflowEngine.requestFinalVerdict(req.params.id);
+          return reply.send({ run: run2 });
+        }
+        return reply.code(400).send({ error: "action must be approve, cancel or finalize" });
       } catch (err) {
         const status = errStatus(err);
         if (status) return reply.code(status).send({ error: err.message });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibedeckx/darwin-arm64",
-  "version": "0.2.17",
+  "version": "0.2.19",
   "description": "Vibedeckx platform binaries for macOS ARM64",
   "os": [
     "darwin"