@vibedeckx/linux-x64 0.3.40 → 0.3.41

package/dist/bin.js

@@ -29485,9 +29485,9 @@ ${callerStack}`;
     };
     exports.ClientReadableStreamImpl = ClientReadableStreamImpl;
     var ClientWritableStreamImpl = class extends stream_1.Writable {
-      constructor(serialize) {
+      constructor(serialize2) {
         super({ objectMode: true });
-        this.serialize = serialize;
+        this.serialize = serialize2;
       }
       cancel() {
         var _a26;
@@ -29520,9 +29520,9 @@ ${callerStack}`;
     };
     exports.ClientWritableStreamImpl = ClientWritableStreamImpl;
     var ClientDuplexStreamImpl = class extends stream_1.Duplex {
-      constructor(serialize, deserialize2) {
+      constructor(serialize2, deserialize2) {
         super({ objectMode: true });
-        this.serialize = serialize;
+        this.serialize = serialize2;
         this.deserialize = deserialize2;
       }
       cancel() {
@@ -30092,14 +30092,14 @@ var require_client = __commonJS({
           return { metadata: arg1, options: arg2, callback: arg3 };
         }
       }
-      makeUnaryRequest(method, serialize, deserialize2, argument, metadata, options, callback) {
+      makeUnaryRequest(method, serialize2, deserialize2, argument, metadata, options, callback) {
         var _a26, _b18;
         const checkedArguments = this.checkOptionalUnaryResponseArguments(metadata, options, callback);
         const methodDefinition = {
           path: method,
           requestStream: false,
           responseStream: false,
-          requestSerialize: serialize,
+          requestSerialize: serialize2,
           responseDeserialize: deserialize2
         };
         let callProperties = {
@@ -30165,19 +30165,19 @@ var require_client = __commonJS({
         call.halfClose();
         return emitter;
       }
-      makeClientStreamRequest(method, serialize, deserialize2, metadata, options, callback) {
+      makeClientStreamRequest(method, serialize2, deserialize2, metadata, options, callback) {
         var _a26, _b18;
         const checkedArguments = this.checkOptionalUnaryResponseArguments(metadata, options, callback);
         const methodDefinition = {
           path: method,
           requestStream: true,
           responseStream: false,
-          requestSerialize: serialize,
+          requestSerialize: serialize2,
           responseDeserialize: deserialize2
         };
         let callProperties = {
           metadata: checkedArguments.metadata,
-          call: new call_1.ClientWritableStreamImpl(serialize),
+          call: new call_1.ClientWritableStreamImpl(serialize2),
           channel: this[CHANNEL_SYMBOL],
           methodDefinition,
           callOptions: checkedArguments.options,
@@ -30256,14 +30256,14 @@ var require_client = __commonJS({
         }
         return { metadata, options };
       }
-      makeServerStreamRequest(method, serialize, deserialize2, argument, metadata, options) {
+      makeServerStreamRequest(method, serialize2, deserialize2, argument, metadata, options) {
         var _a26, _b18;
         const checkedArguments = this.checkMetadataAndOptions(metadata, options);
         const methodDefinition = {
           path: method,
           requestStream: false,
           responseStream: true,
-          requestSerialize: serialize,
+          requestSerialize: serialize2,
           responseDeserialize: deserialize2
         };
         let callProperties = {
@@ -30314,19 +30314,19 @@ var require_client = __commonJS({
         call.halfClose();
         return stream;
       }
-      makeBidiStreamRequest(method, serialize, deserialize2, metadata, options) {
+      makeBidiStreamRequest(method, serialize2, deserialize2, metadata, options) {
         var _a26, _b18;
         const checkedArguments = this.checkMetadataAndOptions(metadata, options);
         const methodDefinition = {
           path: method,
           requestStream: true,
           responseStream: true,
-          requestSerialize: serialize,
+          requestSerialize: serialize2,
           responseDeserialize: deserialize2
         };
         let callProperties = {
           metadata: checkedArguments.metadata,
-          call: new call_1.ClientDuplexStreamImpl(serialize, deserialize2),
+          call: new call_1.ClientDuplexStreamImpl(serialize2, deserialize2),
           channel: this[CHANNEL_SYMBOL],
           methodDefinition,
           callOptions: checkedArguments.options
@@ -30418,9 +30418,9 @@ var require_make_client = __commonJS({
             methodType = "unary";
           }
         }
-        const serialize = attrs.requestSerialize;
+        const serialize2 = attrs.requestSerialize;
         const deserialize2 = attrs.responseDeserialize;
-        const methodFunc = partial2(requesterFuncs[methodType], attrs.path, serialize, deserialize2);
+        const methodFunc = partial2(requesterFuncs[methodType], attrs.path, serialize2, deserialize2);
         ServiceClientImpl.prototype[name25] = methodFunc;
         Object.assign(ServiceClientImpl.prototype[name25], attrs);
         if (attrs.originalName && !isPrototypePolluted(attrs.originalName)) {
@@ -30431,9 +30431,9 @@ var require_make_client = __commonJS({
       ServiceClientImpl.serviceName = serviceName;
       return ServiceClientImpl;
     }
-    function partial2(fn, path26, serialize, deserialize2) {
+    function partial2(fn, path26, serialize2, deserialize2) {
       return function(...args) {
-        return fn.call(this, path26, serialize, deserialize2, ...args);
+        return fn.call(this, path26, serialize2, deserialize2, ...args);
       };
     }
     function isProtobufTypeDefinition(obj) {
@@ -39265,7 +39265,7 @@ var require_src14 = __commonJS({
       };
     }
     function createSerializer(cls) {
-      return function serialize(arg) {
+      return function serialize2(arg) {
         if (Array.isArray(arg)) {
           throw new Error(`Failed to serialize message: expected object with ${cls.name} structure, got array instead`);
         }
@@ -46809,13 +46809,13 @@ var require_server = __commonJS({
           (0, channelz_1.unregisterChannelzRef)(this.channelzRef);
           this.shutdown = true;
         }
-        register(name25, handler, serialize, deserialize2, type) {
+        register(name25, handler, serialize2, deserialize2, type) {
           if (this.handlers.has(name25)) {
             return false;
           }
           this.handlers.set(name25, {
             func: handler,
-            serialize,
+            serialize: serialize2,
             deserialize: deserialize2,
             type,
             path: name25
@@ -66510,7 +66510,7 @@ var require_redact = __commonJS({
       const {
         paths = [],
         censor = "[REDACTED]",
-        serialize = JSON.stringify,
+        serialize: serialize2 = JSON.stringify,
         strict = true,
         remove = false
       } = options;
@@ -66519,10 +66519,10 @@ var require_redact = __commonJS({
       return function redact(obj) {
         if (strict && (obj === null || typeof obj !== "object")) {
           if (obj === null || obj === void 0) {
-            return serialize ? serialize(obj) : obj;
+            return serialize2 ? serialize2(obj) : obj;
           }
           if (typeof obj !== "object") {
-            return serialize ? serialize(obj) : obj;
+            return serialize2 ? serialize2(obj) : obj;
           }
         }
         const cloned = selectiveClone(obj, pathStructure);
@@ -66532,14 +66532,14 @@ var require_redact = __commonJS({
           actualCensor = censor;
         }
         redactPaths(cloned, paths, actualCensor, remove);
-        if (serialize === false) {
+        if (serialize2 === false) {
           cloned.restore = function() {
             return deepClone(original);
           };
           return cloned;
         }
-        if (typeof serialize === "function") {
-          return serialize(cloned);
+        if (typeof serialize2 === "function") {
+          return serialize2(cloned);
         }
         return JSON.stringify(cloned);
       };
@@ -66628,7 +66628,7 @@ var require_redaction = __commonJS({
     var rx = /[^.[\]]+|\[([^[\]]*?)\]/g;
     var CENSOR = "[Redacted]";
     var strict = false;
-    function redaction(opts, serialize) {
+    function redaction(opts, serialize2) {
       const { paths, censor, remove } = handle(opts);
       const shape = paths.reduce((o, str2) => {
         rx.lastIndex = 0;
@@ -66662,10 +66662,10 @@ var require_redaction = __commonJS({
         return o;
       }, {});
       const result = {
-        [redactFmtSym]: Redact({ paths, censor, serialize, strict, remove })
+        [redactFmtSym]: Redact({ paths, censor, serialize: serialize2, strict, remove })
       };
       const topCensor = (...args) => {
-        return typeof censor === "function" ? serialize(censor(...args)) : serialize(censor);
+        return typeof censor === "function" ? serialize2(censor(...args)) : serialize2(censor);
       };
       return [...Object.keys(shape), ...Object.getOwnPropertySymbols(shape)].reduce((o, k2) => {
         if (shape[k2] === null) {
@@ -66677,7 +66677,7 @@ var require_redaction = __commonJS({
           o[k2] = Redact({
             paths: shape[k2],
             censor: wrappedCensor,
-            serialize,
+            serialize: serialize2,
             strict,
             remove
           });
@@ -71364,17 +71364,17 @@ var require_reply = __commonJS({
     };
     Reply.prototype.status = Reply.prototype.code;
     Reply.prototype.getSerializationFunction = function(schemaOrStatus, contentType2) {
-      let serialize2;
+      let serialize3;
       if (typeof schemaOrStatus === "string" || typeof schemaOrStatus === "number") {
         if (typeof contentType2 === "string") {
-          serialize2 = this[kRouteContext][kSchemaResponse]?.[schemaOrStatus]?.[contentType2];
+          serialize3 = this[kRouteContext][kSchemaResponse]?.[schemaOrStatus]?.[contentType2];
         } else {
-          serialize2 = this[kRouteContext][kSchemaResponse]?.[schemaOrStatus];
+          serialize3 = this[kRouteContext][kSchemaResponse]?.[schemaOrStatus];
         }
       } else if (typeof schemaOrStatus === "object") {
-        serialize2 = this[kRouteContext][kReplyCacheSerializeFns]?.get(schemaOrStatus);
+        serialize3 = this[kRouteContext][kReplyCacheSerializeFns]?.get(schemaOrStatus);
       }
-      return serialize2;
+      return serialize3;
     };
     Reply.prototype.compileSerializationSchema = function(schema, httpStatus = null, contentType2 = null) {
       const { request } = this;
@@ -71400,27 +71400,27 @@ var require_reply = __commonJS({
     };
     Reply.prototype.serializeInput = function(input, schema, httpStatus, contentType2) {
       const possibleContentType = httpStatus;
-      let serialize2;
+      let serialize3;
       httpStatus = typeof schema === "string" || typeof schema === "number" ? schema : httpStatus;
       contentType2 = httpStatus && possibleContentType !== httpStatus ? possibleContentType : contentType2;
       if (httpStatus != null) {
         if (contentType2 != null) {
-          serialize2 = this[kRouteContext][kSchemaResponse]?.[httpStatus]?.[contentType2];
+          serialize3 = this[kRouteContext][kSchemaResponse]?.[httpStatus]?.[contentType2];
         } else {
-          serialize2 = this[kRouteContext][kSchemaResponse]?.[httpStatus];
+          serialize3 = this[kRouteContext][kSchemaResponse]?.[httpStatus];
         }
-        if (serialize2 == null) {
+        if (serialize3 == null) {
           if (contentType2) throw new FST_ERR_MISSING_CONTENTTYPE_SERIALIZATION_FN(httpStatus, contentType2);
           throw new FST_ERR_MISSING_SERIALIZATION_FN(httpStatus);
         }
       } else {
         if (this[kRouteContext][kReplyCacheSerializeFns]?.has(schema)) {
-          serialize2 = this[kRouteContext][kReplyCacheSerializeFns].get(schema);
+          serialize3 = this[kRouteContext][kReplyCacheSerializeFns].get(schema);
         } else {
-          serialize2 = this.compileSerializationSchema(schema, httpStatus, contentType2);
+          serialize3 = this.compileSerializationSchema(schema, httpStatus, contentType2);
         }
       }
-      return serialize2(input);
+      return serialize3(input);
     };
     Reply.prototype.serialize = function(payload) {
       if (this[kReplySerializer] !== null) {
@@ -71429,7 +71429,7 @@ var require_reply = __commonJS({
         if (this[kRouteContext] && this[kRouteContext][kReplySerializerDefault]) {
           return this[kRouteContext][kReplySerializerDefault](payload, this.raw.statusCode);
         } else {
-          return serialize(this[kRouteContext], payload, this.raw.statusCode);
+          return serialize2(this[kRouteContext], payload, this.raw.statusCode);
         }
       }
     };
@@ -71502,7 +71502,7 @@ var require_reply = __commonJS({
         } else if (reply[kRouteContext] && reply[kRouteContext][kReplySerializerDefault]) {
           payload = reply[kRouteContext][kReplySerializerDefault](payload, reply.raw.statusCode);
         } else {
-          payload = serialize(reply[kRouteContext], payload, reply.raw.statusCode, reply[kReplyHeaders]["content-type"]);
+          payload = serialize2(reply[kRouteContext], payload, reply.raw.statusCode, reply[kReplyHeaders]["content-type"]);
         }
       } catch (e) {
         wrapSerializationError(e, reply);
@@ -71853,7 +71853,7 @@ var require_reply = __commonJS({
         internals.preHandlerCallback(null, reply.request, reply);
       }
     }
-    function serialize(context2, data, statusCode, contentType2) {
+    function serialize2(context2, data, statusCode, contentType2) {
       const fnSerialize = getSchemaSerializer(context2, statusCode, contentType2);
       if (fnSerialize) {
         return fnSerialize(data);
@@ -77941,10 +77941,10 @@ var require_fast_uri = __commonJS({
     function normalize(uri, options) {
       if (typeof uri === "string") {
         uri = /** @type {T} */
-        serialize(parse4(uri, options), options);
+        serialize2(parse4(uri, options), options);
       } else if (typeof uri === "object") {
         uri = /** @type {T} */
-        parse4(serialize(uri, options), options);
+        parse4(serialize2(uri, options), options);
       }
       return uri;
     }
@@ -77952,13 +77952,13 @@ var require_fast_uri = __commonJS({
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const resolved = resolveComponent(parse4(baseURI, schemelessOptions), parse4(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
-      return serialize(resolved, schemelessOptions);
+      return serialize2(resolved, schemelessOptions);
     }
     function resolveComponent(base, relative, options, skipNormalization) {
       const target = {};
       if (!skipNormalization) {
-        base = parse4(serialize(base, options), options);
-        relative = parse4(serialize(relative, options), options);
+        base = parse4(serialize2(base, options), options);
+        relative = parse4(serialize2(relative, options), options);
       }
       options = options || {};
       if (!options.tolerant && relative.scheme) {
@@ -78010,19 +78010,19 @@ var require_fast_uri = __commonJS({
     function equal(uriA, uriB, options) {
       if (typeof uriA === "string") {
         uriA = unescape(uriA);
-        uriA = serialize(normalizeComponentEncoding(parse4(uriA, options), true), { ...options, skipEscape: true });
+        uriA = serialize2(normalizeComponentEncoding(parse4(uriA, options), true), { ...options, skipEscape: true });
       } else if (typeof uriA === "object") {
-        uriA = serialize(normalizeComponentEncoding(uriA, true), { ...options, skipEscape: true });
+        uriA = serialize2(normalizeComponentEncoding(uriA, true), { ...options, skipEscape: true });
       }
       if (typeof uriB === "string") {
         uriB = unescape(uriB);
-        uriB = serialize(normalizeComponentEncoding(parse4(uriB, options), true), { ...options, skipEscape: true });
+        uriB = serialize2(normalizeComponentEncoding(parse4(uriB, options), true), { ...options, skipEscape: true });
       } else if (typeof uriB === "object") {
-        uriB = serialize(normalizeComponentEncoding(uriB, true), { ...options, skipEscape: true });
+        uriB = serialize2(normalizeComponentEncoding(uriB, true), { ...options, skipEscape: true });
       }
       return uriA.toLowerCase() === uriB.toLowerCase();
     }
-    function serialize(cmpts, opts) {
+    function serialize2(cmpts, opts) {
       const component = {
         host: cmpts.host,
         scheme: cmpts.scheme,
@@ -78178,7 +78178,7 @@ var require_fast_uri = __commonJS({
       resolve: resolve3,
       resolveComponent,
       equal,
-      serialize,
+      serialize: serialize2,
       parse: parse4
     };
     module.exports = fastUri;
@@ -81734,9 +81734,9 @@ var require_serialize = __commonJS({
         const serializeFuncCode = gen.toString();
         sourceCode = `${gen.scopeRefs(names_1.default.scope)}return ${serializeFuncCode}`;
         const makeSerialize = new Function(`${names_1.default.scope}`, sourceCode);
-        const serialize = makeSerialize(this.scope.get());
-        this.scope.value(serializeName, { ref: serialize });
-        sch.serialize = serialize;
+        const serialize2 = makeSerialize(this.scope.get());
+        this.scope.value(serializeName, { ref: serialize2 });
+        sch.serialize = serialize2;
       } catch (e) {
         if (sourceCode)
           this.logger.error("Error compiling serializer, function code:", sourceCode);
@@ -93805,7 +93805,7 @@ var require_parse_url = __commonJS({
 var require_form_data = __commonJS({
   "../../node_modules/.pnpm/light-my-request@6.6.0/node_modules/light-my-request/lib/form-data.js"(exports, module) {
     "use strict";
-    var { randomUUID: randomUUID27 } = __require("node:crypto");
+    var { randomUUID: randomUUID29 } = __require("node:crypto");
     var { Readable: Readable4 } = __require("node:stream");
     var textEncoder;
     function isFormDataLike(payload) {
@@ -93813,7 +93813,7 @@ var require_form_data = __commonJS({
     }
     function formDataToStream(formdata) {
       textEncoder = textEncoder ?? new TextEncoder();
-      const boundary = `----formdata-${randomUUID27()}`;
+      const boundary = `----formdata-${randomUUID29()}`;
       const prefix = `--${boundary}\r
 Content-Disposition: form-data`;
       const escape2 = (str2) => str2.replace(/\n/g, "%0A").replace(/\r/g, "%0D").replace(/"/g, "%22");
@@ -107959,7 +107959,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net2 = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes5, createHash: createHash10 } = __require("crypto");
+    var { randomBytes: randomBytes5, createHash: createHash11 } = __require("crypto");
     var { Duplex, Readable: Readable4 } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate = require_permessage_deflate();
@@ -108619,7 +108619,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash10("sha1").update(key2 + GUID).digest("base64");
+        const digest = createHash11("sha1").update(key2 + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -108986,7 +108986,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter3 = __require("events");
     var http = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash10 } = __require("crypto");
+    var { createHash: createHash11 } = __require("crypto");
     var extension = require_extension();
     var PerMessageDeflate = require_permessage_deflate();
     var subprotocol = require_subprotocol();
@@ -109287,7 +109287,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash10("sha1").update(key2 + GUID).digest("base64");
+        const digest = createHash11("sha1").update(key2 + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -149412,7 +149412,7 @@ var init_chunk_JW73PKED = __esm({
         "use strict";
         Object.defineProperty(exports, "__esModule", { value: true });
         exports.parse = parse22;
-        exports.serialize = serialize;
+        exports.serialize = serialize2;
         var cookieNameRegExp = /^[\u0021-\u003A\u003C\u003E-\u007E]+$/;
         var cookieValueRegExp = /^[\u0021-\u003A\u003C-\u007E]*$/;
         var domainValueRegExp = /^([.]?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)([.][a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;
@@ -149470,7 +149470,7 @@ var init_chunk_JW73PKED = __esm({
           }
           return min;
         }
-        function serialize(name25, val, options) {
+        function serialize2(name25, val, options) {
           const enc = options?.encode || encodeURIComponent;
           if (!cookieNameRegExp.test(name25)) {
             throw new TypeError(`argument name is invalid: ${name25}`);
@@ -186780,7 +186780,8 @@ var WORKFLOW_ACTIVE_STATUSES = [
   "waiting_reviewer",
   "waiting_feedback",
   "discussing",
-  "sending_feedback"
+  "sending_feedback",
+  "waiting_rereview"
 ];
 
 // src/storage/types.ts
@@ -187052,12 +187053,14 @@ var mapRemoteCreationIntent = (row) => ({
   created_at: row.created_at,
   updated_at: row.updated_at,
   prepare_operation_id: row.prepare_operation_id ?? null,
-  prepared_at: row.prepared_at ?? null
+  prepared_at: row.prepared_at ?? null,
+  first_turn_grant_context: row.first_turn_grant_context ?? null
 });
 var mapRemoteReviewerCreationIntent = (row) => ({
   ...row,
   review_span: row.review_span,
   review_context_mode: row.review_context_mode ?? null,
+  loop_max_rounds: row.loop_max_rounds ?? null,
   status: row.status
 });
 var nowActivityAt = () => sql`cast((julianday('now') - 2440587.5) * 86400000 as integer)`;
@@ -187312,7 +187315,10 @@ var createAgentSessionRepos = (kdb, h) => ({
       return row.history_epoch;
     },
     delete: async (id) => {
-      await kdb.deleteFrom("agent_sessions").where("id", "=", id).execute();
+      await kdb.transaction().execute(async (trx) => {
+        await trx.deleteFrom("agent_sessions").where("id", "=", id).execute();
+        await trx.deleteFrom("agent_session_remote_grants").where("session_id", "=", id).execute();
+      });
     },
     // The original inline statement is `INSERT ... ON CONFLICT(session_id,
     // entry_index) DO UPDATE SET data = excluded.data` (NOT `INSERT OR
@@ -187740,6 +187746,7 @@ var createAgentSessionRepos = (kdb, h) => ({
         if (row) {
           await trx.deleteFrom("notification_sync_cursors").where("remote_server_id", "=", row.remote_server_id).where("remote_session_id", "=", row.remote_session_id).execute();
         }
+        await trx.deleteFrom("agent_session_remote_grants").where("session_id", "=", localSessionId).execute();
         return (result.numDeletedRows ?? 0n) > 0n;
       });
     },
@@ -187770,6 +187777,7 @@ var createAgentSessionRepos = (kdb, h) => ({
         up_to_entry_index: intent.upToEntryIndex ?? null,
         prepare_operation_id: intent.prepareOperationId ?? null,
         prepared_at: null,
+        first_turn_grant_context: null,
         status: "pending",
         error: null,
         created_at: h.nowMs(),
@@ -187806,6 +187814,15 @@ var createAgentSessionRepos = (kdb, h) => ({
     markPrepared: async (localSessionId, preparedAt) => {
       await kdb.updateTable("remote_session_creation_intents").set({ prepared_at: preparedAt, error: null, updated_at: h.nowMs() }).where("local_session_id", "=", localSessionId).execute();
     },
+    // Write-once, then read back whatever won: a concurrent retry must reuse
+    // the first writer's text rather than believe its own.
+    setFirstTurnGrantContext: async (localSessionId, text2) => {
+      return kdb.transaction().execute(async (trx) => {
+        await trx.updateTable("remote_session_creation_intents").set({ first_turn_grant_context: text2 }).where("local_session_id", "=", localSessionId).where("first_turn_grant_context", "is", null).execute();
+        const row = await trx.selectFrom("remote_session_creation_intents").select("first_turn_grant_context").where("local_session_id", "=", localSessionId).executeTakeFirst();
+        return row?.first_turn_grant_context ?? void 0;
+      });
+    },
     discardStaleLifecycleIntents: async ({ cutoff, limit }) => {
       const victims = await kdb.selectFrom("remote_session_creation_intents").select("local_session_id").where("status", "=", "pending").where("prepare_operation_id", "is not", null).where(sql`cast((julianday(updated_at) - 2440587.5) * 86400000 as integer) < ${cutoff}`).limit(limit).execute();
       if (victims.length === 0) return 0;
@@ -187828,6 +187845,7 @@ var createAgentSessionRepos = (kdb, h) => ({
         source_turn_end_index: intent.sourceTurnEndIndex ?? null,
         review_span: intent.reviewSpan,
         review_context_mode: intent.reviewContextMode ?? null,
+        loop_max_rounds: intent.loopMaxRounds ?? null,
         agent_type: intent.agentType,
         intent_brief: intent.intentBrief ?? null,
         user_id: intent.userId ?? null,
@@ -187837,7 +187855,7 @@ var createAgentSessionRepos = (kdb, h) => ({
         updated_at: h.nowMs()
       }).onConflict((oc) => oc.column("local_reviewer_session_id").doNothing()).execute();
       const row = await trx.selectFrom("remote_reviewer_creation_intents").selectAll().where("local_reviewer_session_id", "=", intent.localReviewerSessionId).executeTakeFirstOrThrow();
-      const sameIdentity = row.remote_reviewer_session_id === intent.remoteReviewerSessionId && row.remote_run_id === intent.remoteRunId && row.project_id === intent.projectId && row.remote_server_id === intent.remoteServerId && (row.branch ?? "") === (intent.branch ?? "") && row.remote_path === intent.remotePath && row.source_remote_session_id === intent.sourceRemoteSessionId && row.review_focus === (intent.reviewFocus ?? null) && row.source_turn_end_index === (intent.sourceTurnEndIndex ?? null) && row.review_span === intent.reviewSpan && (row.review_context_mode ?? null) === (intent.reviewContextMode ?? null) && row.agent_type === intent.agentType && row.intent_brief === (intent.intentBrief ?? null) && row.user_id === (intent.userId ?? null);
+      const sameIdentity = row.remote_reviewer_session_id === intent.remoteReviewerSessionId && row.remote_run_id === intent.remoteRunId && row.project_id === intent.projectId && row.remote_server_id === intent.remoteServerId && (row.branch ?? "") === (intent.branch ?? "") && row.remote_path === intent.remotePath && row.source_remote_session_id === intent.sourceRemoteSessionId && row.review_focus === (intent.reviewFocus ?? null) && row.source_turn_end_index === (intent.sourceTurnEndIndex ?? null) && row.review_span === intent.reviewSpan && (row.review_context_mode ?? null) === (intent.reviewContextMode ?? null) && (row.loop_max_rounds ?? null) === (intent.loopMaxRounds ?? null) && row.agent_type === intent.agentType && row.intent_brief === (intent.intentBrief ?? null) && row.user_id === (intent.userId ?? null);
       if (!sameIdentity) {
         throw new Error(`Remote reviewer creation intent ${intent.localReviewerSessionId} has conflicting identity`);
       }
@@ -188147,6 +188165,12 @@ var createCrossRemoteAuditRepo = (kdb) => ({
     insert: async (entry) => {
       await kdb.insertInto("cross_remote_audit").values({ id: crypto3.randomUUID(), created_at: (/* @__PURE__ */ new Date()).toISOString(), ...entry }).execute();
     },
+    listSessionTargets: async (sessionId, userId, limit = 8) => {
+      let query = kdb.selectFrom("cross_remote_audit").select(["target_remote_id"]).select((eb) => eb.fn.max("seq").as("last_seq")).where("session_id", "=", sessionId).where("status", "not in", ["denied", "offline"]);
+      if (userId) query = query.where("user_id", "=", userId);
+      const rows = await query.groupBy("target_remote_id").orderBy("last_seq", "desc").limit(limit).execute();
+      return rows.map((row) => row.target_remote_id);
+    },
     listByTarget: async (targetRemoteId, limit = 100) => {
       const rows = await kdb.selectFrom("cross_remote_audit").selectAll().where("target_remote_id", "=", targetRemoteId).orderBy("seq", "desc").limit(limit).execute();
       return rows.map(mapRow);
@@ -188154,6 +188178,33 @@ var createCrossRemoteAuditRepo = (kdb) => ({
   }
 });
 
+// src/storage/repositories/session-remote-grants.ts
+var createSessionRemoteGrantRepo = (kdb) => ({
+  sessionRemoteGrants: {
+    list: async (sessionId) => {
+      const rows = await kdb.selectFrom("agent_session_remote_grants").select("remote_server_id").where("session_id", "=", sessionId).orderBy("granted_at", "asc").orderBy("remote_server_id", "asc").execute();
+      return rows.map((row) => row.remote_server_id);
+    },
+    replace: async (sessionId, userId, remoteServerIds) => {
+      const unique = [...new Set(remoteServerIds)];
+      const grantedAt = (/* @__PURE__ */ new Date()).toISOString();
+      await kdb.transaction().execute(async (trx) => {
+        await trx.deleteFrom("agent_session_remote_grants").where("session_id", "=", sessionId).execute();
+        if (unique.length === 0) return;
+        await trx.insertInto("agent_session_remote_grants").values(unique.map((remoteServerId) => ({
+          session_id: sessionId,
+          remote_server_id: remoteServerId,
+          user_id: userId,
+          granted_at: grantedAt
+        }))).execute();
+      });
+    },
+    deleteBySession: async (sessionId) => {
+      await kdb.deleteFrom("agent_session_remote_grants").where("session_id", "=", sessionId).execute();
+    }
+  }
+});
+
 // src/storage/repositories/merge-targets.ts
 var createMergeTargetsRepo = (kdb) => ({
   mergeTargets: {
@@ -188789,7 +188840,10 @@ var createWorkflowRunRepos = (kdb) => ({
         ...opts,
         reviewer_session_id: opts.reviewer_session_id ?? null,
         review_span: opts.review_span ?? "this_turn",
-        status: opts.status ?? "waiting_reviewer"
+        status: opts.status ?? "waiting_reviewer",
+        loop_id: opts.loop_id ?? null,
+        round: opts.round ?? 1,
+        max_rounds: opts.max_rounds ?? null
       }).execute();
       const row = await kdb.selectFrom("workflow_runs").selectAll().where("id", "=", opts.id).executeTakeFirstOrThrow();
       return asRun(row);
@@ -188817,6 +188871,10 @@ var createWorkflowRunRepos = (kdb) => ({
       const row = await kdb.selectFrom("workflow_runs").selectAll().where("source_session_id", "=", sourceSessionId).where("status", "=", "completed").where("reviewer_session_id", "is not", null).orderBy("created_at", "desc").orderBy(sql`rowid`, "desc").executeTakeFirst();
       return row ? asRun(row) : void 0;
     },
+    getLoopRound: async (loopId, round) => {
+      const row = await kdb.selectFrom("workflow_runs").selectAll().where("loop_id", "=", loopId).where("round", "=", round).orderBy("created_at", "desc").orderBy(sql`rowid`, "desc").executeTakeFirst();
+      return row ? asRun(row) : void 0;
+    },
     listReviewedSourceSessions: async (projectId, branch) => {
       const rows = await kdb.selectFrom("workflow_runs").select("source_session_id").distinct().where("project_id", "=", projectId).where("branch", "is", branch).where("status", "=", "completed").where("reviewer_session_id", "is not", null).execute();
       return rows.map((r) => r.source_session_id);
@@ -188843,6 +188901,51 @@ var createWorkflowRunRepos = (kdb) => ({
         await trx.insertInto("notification_outbox").values(outbox).onConflict((oc) => oc.column("id").doNothing()).execute();
         return true;
       });
+    },
+    // Step CAS, run CAS and the outbox row in ONE transaction. A guard that
+    // fails throws to roll the whole thing back — a claimed step with an
+    // un-advanced run would be unrecoverable after a restart.
+    claimStepAndTransition: async ({ stepId, turnEndIndex, outputSnapshot, run: run2, nextRun }) => {
+      const LOST = /* @__PURE__ */ Symbol("cas-lost");
+      try {
+        await kdb.transaction().execute(async (trx) => {
+          const step = await trx.updateTable("workflow_run_steps").set({
+            status: "claimed",
+            turn_end_index: turnEndIndex,
+            output_snapshot: outputSnapshot,
+            error: null,
+            updated_at: sql`datetime('now')`
+          }).where("id", "=", stepId).where("status", "=", "dispatched").executeTakeFirst();
+          if ((step.numUpdatedRows ?? 0n) === 0n) throw LOST;
+          if (run2) {
+            const moved = await trx.updateTable("workflow_runs").set({ ...run2.patch ?? {}, status: run2.to, updated_at: sql`datetime('now')` }).where("id", "=", run2.id).where("status", "=", run2.from).executeTakeFirst();
+            if ((moved.numUpdatedRows ?? 0n) === 0n) throw LOST;
+            if (run2.outbox) {
+              await trx.insertInto("notification_outbox").values(run2.outbox).onConflict((oc) => oc.column("id").doNothing()).execute();
+            }
+          }
+          if (nextRun) {
+            await sql`
+              INSERT INTO workflow_runs
+                (id, project_id, branch, source_session_id, source_turn_end_index, reviewer_session_id,
+                 review_focus, review_target, review_span, status, loop_id, round, max_rounds)
+              SELECT ${nextRun.id}, ${nextRun.project_id}, ${nextRun.branch}, ${nextRun.source_session_id},
+                     ${nextRun.source_turn_end_index}, NULL, ${nextRun.review_focus}, ${nextRun.review_target},
+                     'this_turn', 'waiting_rereview', ${nextRun.loop_id}, ${nextRun.round}, ${nextRun.max_rounds}
+              WHERE NOT EXISTS (
+                SELECT 1 FROM workflow_runs
+                WHERE status IN (${sql.join(ACTIVE)})
+                  AND (source_session_id = ${nextRun.source_session_id}
+                    OR reviewer_session_id = ${nextRun.source_session_id})
+              )
+            `.execute(trx);
+          }
+        });
+        return true;
+      } catch (err) {
+        if (err === LOST) return false;
+        throw err;
+      }
     }
   }
 });
@@ -188872,6 +188975,79 @@ var createTurnSnapshotRepos = (kdb) => ({
   }
 });
 
+// src/storage/repositories/workflow-run-steps.ts
+var asStep = (row) => row;
+var createWorkflowRunStepRepos = (kdb) => ({
+  workflowRunSteps: {
+    // Lookup and insert share a transaction so two concurrent opens of the
+    // same (run, kind) resolve to one row; the partial unique index is the
+    // backstop if they ever interleave anyway.
+    open: async (opts) => {
+      return kdb.transaction().execute(async (trx) => {
+        const existing = await trx.selectFrom("workflow_run_steps").selectAll().where("run_id", "=", opts.run_id).where("kind", "=", opts.kind).where("status", "=", "dispatched").executeTakeFirst();
+        if (existing) return { step: asStep(existing), reused: true };
+        const max = await trx.selectFrom("workflow_run_steps").select((eb) => eb.fn.max("round").as("round")).where("run_id", "=", opts.run_id).where("status", "!=", "abandoned").executeTakeFirst();
+        const current = Number(max?.round ?? 0);
+        const round = opts.kind === "feedback" ? Math.max(current, 1) : current + 1;
+        await trx.insertInto("workflow_run_steps").values({
+          id: opts.id,
+          run_id: opts.run_id,
+          round,
+          role: opts.role,
+          kind: opts.kind,
+          session_id: opts.session_id,
+          idempotency_key: opts.idempotency_key,
+          payload_hash: opts.payload_hash,
+          status: "dispatched",
+          user_entry_index: null,
+          turn_end_index: null,
+          output_snapshot: null,
+          error: null
+        }).execute();
+        const row = await trx.selectFrom("workflow_run_steps").selectAll().where("id", "=", opts.id).executeTakeFirstOrThrow();
+        return { step: asStep(row), reused: false };
+      });
+    },
+    getById: async (id) => {
+      const row = await kdb.selectFrom("workflow_run_steps").selectAll().where("id", "=", id).executeTakeFirst();
+      return row ? asStep(row) : void 0;
+    },
+    getOpenBySession: async (sessionId) => {
+      const rows = await kdb.selectFrom("workflow_run_steps").selectAll().where("session_id", "=", sessionId).where("status", "=", "dispatched").orderBy("created_at", "asc").orderBy(sql`rowid`, "asc").execute();
+      return rows.map(asStep);
+    },
+    listAllOpen: async () => {
+      const rows = await kdb.selectFrom("workflow_run_steps").selectAll().where("status", "=", "dispatched").orderBy("created_at", "asc").orderBy(sql`rowid`, "asc").execute();
+      return rows.map(asStep);
+    },
+    listByRun: async (runId) => {
+      const rows = await kdb.selectFrom("workflow_run_steps").selectAll().where("run_id", "=", runId).orderBy("round", "asc").orderBy(sql`rowid`, "asc").execute();
+      return rows.map(asStep);
+    },
+    hasAny: async (runId) => {
+      const row = await kdb.selectFrom("workflow_run_steps").select("id").where("run_id", "=", runId).limit(1).executeTakeFirst();
+      return row !== void 0;
+    },
+    setUserEntryIndex: async (id, entryIndex) => {
+      const result = await kdb.updateTable("workflow_run_steps").set({ user_entry_index: entryIndex, updated_at: sql`datetime('now')` }).where("id", "=", id).where("status", "=", "dispatched").executeTakeFirst();
+      return (result.numUpdatedRows ?? 0n) > 0n;
+    },
+    abandon: async (id, error48) => {
+      const result = await kdb.updateTable("workflow_run_steps").set({ status: "abandoned", error: error48, updated_at: sql`datetime('now')` }).where("id", "=", id).where("status", "=", "dispatched").executeTakeFirst();
+      return (result.numUpdatedRows ?? 0n) > 0n;
+    },
+    abandonOpenByRun: async (runId, error48, role) => {
+      let q = kdb.updateTable("workflow_run_steps").set({ status: "abandoned", error: error48, updated_at: sql`datetime('now')` }).where("run_id", "=", runId).where("status", "=", "dispatched");
+      if (role) q = q.where("role", "=", role);
+      const result = await q.executeTakeFirst();
+      return Number(result.numUpdatedRows ?? 0n);
+    },
+    setError: async (id, error48) => {
+      await kdb.updateTable("workflow_run_steps").set({ error: error48, updated_at: sql`datetime('now')` }).where("id", "=", id).where("status", "=", "dispatched").execute();
+    }
+  }
+});
+
 // src/storage/repositories/notifications.ts
 var mapOutbox = (row) => ({
   seq: row.seq,
@@ -204556,6 +204732,22 @@ var initializeSchema = (db) => {
     CREATE INDEX IF NOT EXISTS idx_remote_session_creation_intents_pending
       ON remote_session_creation_intents(status, remote_server_id, updated_at);
 
+    -- Per-session cross-remote allowlist. The machine tier
+    -- (remote_servers.cross_remote_access) is the ceiling; this table is what
+    -- the agent of one session may actually reach. No FK on session_id:
+    -- remote- prefixed sessions live only in remote_session_mappings /
+    -- creation intents, so half the keys would have nothing to point at.
+    CREATE TABLE IF NOT EXISTS agent_session_remote_grants (
+      session_id TEXT NOT NULL,
+      remote_server_id TEXT NOT NULL REFERENCES remote_servers(id) ON DELETE CASCADE,
+      user_id TEXT NOT NULL,
+      granted_at TEXT NOT NULL,
+      PRIMARY KEY (session_id, remote_server_id)
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_session_remote_grants_session
+      ON agent_session_remote_grants(session_id);
+
     CREATE TABLE IF NOT EXISTS remote_reviewer_creation_intents (
       local_reviewer_session_id TEXT PRIMARY KEY,
       remote_reviewer_session_id TEXT NOT NULL,
@@ -204569,6 +204761,7 @@ var initializeSchema = (db) => {
       source_turn_end_index INTEGER,
       review_span TEXT NOT NULL CHECK (review_span IN ('this_turn', 'session_start')),
       review_context_mode TEXT CHECK (review_context_mode IN ('briefed', 'blind')),
+      loop_max_rounds INTEGER,
       agent_type TEXT NOT NULL,
       intent_brief TEXT,
       user_id TEXT,
@@ -204605,6 +204798,12 @@ var initializeSchema = (db) => {
     );
 
     CREATE INDEX IF NOT EXISTS idx_cross_remote_audit_target ON cross_remote_audit(target_remote_id, seq);
+
+    -- listSessionTargets asks "which machines has this session touched?" on the
+    -- path of every artifact hover, so it must not scan a table that grows with
+    -- every gateway call ever made. seq trails session_id to serve the
+    -- most-recent-first ordering from the index.
+    CREATE INDEX IF NOT EXISTS idx_cross_remote_audit_session ON cross_remote_audit(session_id, seq);
   `);
   const workspaceCheckoutsTable = db.prepare(
     "SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'workspace_checkouts'"
@@ -204720,6 +204919,9 @@ var initializeSchema = (db) => {
     db.exec("ALTER TABLE remote_session_creation_intents ADD COLUMN prepare_operation_id TEXT DEFAULT NULL");
     db.exec("ALTER TABLE remote_session_creation_intents ADD COLUMN prepared_at INTEGER DEFAULT NULL");
   }
+  if (!remoteCreationIntentColumns.some((column) => column.name === "first_turn_grant_context")) {
+    db.exec("ALTER TABLE remote_session_creation_intents ADD COLUMN first_turn_grant_context TEXT DEFAULT NULL");
+  }
   db.exec(`
     CREATE UNIQUE INDEX IF NOT EXISTS idx_remote_session_creation_intents_prepare_operation
       ON remote_session_creation_intents(prepare_operation_id)
@@ -205633,6 +205835,10 @@ var initializeSchema = (db) => {
       status TEXT NOT NULL DEFAULT 'waiting_reviewer',
       error TEXT,
       prepared_context TEXT,
+      loop_id TEXT,
+      round INTEGER NOT NULL DEFAULT 1,
+      max_rounds INTEGER,
+      verdict TEXT,
       created_at TEXT NOT NULL DEFAULT (datetime('now')),
       updated_at TEXT NOT NULL DEFAULT (datetime('now')),
       FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE
@@ -205644,6 +205850,35 @@ var initializeSchema = (db) => {
     CREATE INDEX IF NOT EXISTS idx_workflow_runs_project_branch_status
       ON workflow_runs(project_id, branch, status);
 
+    -- One row per logical dispatch from the workflow engine to a session: the
+    -- identity a turn completion is attributed to. Growth: a handful of rows
+    -- per run (one per reviewer prompt / final-verdict request / feedback
+    -- send), deleted with the run. No FK on session_id: like workflow_runs and
+    -- notification_outbox, a step must outlive deletion of its session.
+    CREATE TABLE IF NOT EXISTS workflow_run_steps (
+      id TEXT PRIMARY KEY,
+      run_id TEXT NOT NULL,
+      round INTEGER NOT NULL,
+      role TEXT NOT NULL,
+      kind TEXT NOT NULL,
+      session_id TEXT NOT NULL,
+      idempotency_key TEXT NOT NULL,
+      payload_hash TEXT NOT NULL,
+      status TEXT NOT NULL DEFAULT 'dispatched',
+      user_entry_index INTEGER,
+      turn_end_index INTEGER,
+      output_snapshot TEXT,
+      error TEXT,
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+      FOREIGN KEY (run_id) REFERENCES workflow_runs(id) ON DELETE CASCADE
+    );
+    CREATE INDEX IF NOT EXISTS idx_workflow_run_steps_open ON workflow_run_steps(session_id, status);
+    CREATE INDEX IF NOT EXISTS idx_workflow_run_steps_run ON workflow_run_steps(run_id, round);
+    -- At most one open dispatch per (run, kind): a retry reuses it.
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_workflow_run_steps_one_open
+      ON workflow_run_steps(run_id, kind) WHERE status = 'dispatched';
+
     CREATE TABLE IF NOT EXISTS turn_snapshots (
       session_id TEXT NOT NULL,
       turn_end_index INTEGER NOT NULL,
@@ -205785,10 +206020,23 @@ var initializeSchema = (db) => {
   if (!workflowRunsInfo.some((col) => col.name === "prepared_context")) {
     db.exec("ALTER TABLE workflow_runs ADD COLUMN prepared_context TEXT");
   }
+  for (const [name25, ddl] of [
+    ["loop_id", "loop_id TEXT"],
+    ["round", "round INTEGER NOT NULL DEFAULT 1"],
+    ["max_rounds", "max_rounds INTEGER"],
+    ["verdict", "verdict TEXT"]
+  ]) {
+    if (!workflowRunsInfo.some((col) => col.name === name25)) {
+      db.exec(`ALTER TABLE workflow_runs ADD COLUMN ${ddl}`);
+    }
+  }
   const reviewerIntentsInfo = db.prepare("PRAGMA table_info(remote_reviewer_creation_intents)").all();
   if (!reviewerIntentsInfo.some((col) => col.name === "review_context_mode")) {
     db.exec("ALTER TABLE remote_reviewer_creation_intents ADD COLUMN review_context_mode TEXT CHECK (review_context_mode IN ('briefed', 'blind'))");
   }
+  if (!reviewerIntentsInfo.some((col) => col.name === "loop_max_rounds")) {
+    db.exec("ALTER TABLE remote_reviewer_creation_intents ADD COLUMN loop_max_rounds INTEGER");
+  }
   db.exec(`
     CREATE TABLE IF NOT EXISTS user_settings (
       user_id TEXT NOT NULL,
@@ -205920,10 +206168,12 @@ var createSqliteStorage = async (dbPath) => {
     ...createAgentSessionRepos(kdb, h),
     ...createWorkspaceRepos(kdb, h),
     ...createCrossRemoteAuditRepo(kdb),
+    ...createSessionRemoteGrantRepo(kdb),
     ...createMergeTargetsRepo(kdb),
     ...createSearchCacheRepos(kdb, h),
     ...createWorkflowRunRepos(kdb),
     ...createTurnSnapshotRepos(kdb),
+    ...createWorkflowRunStepRepos(kdb),
     ...createNotificationRepos(kdb),
     ...createProjectChatRepos(kdb),
     close: async () => {
@@ -207604,12 +207854,16 @@ var sessionFailedId = (sessionId, turnEndEntryIndex) => `session:${sessionId}:tu
 var reviewReadyId = (workflowRunId, turnEndEntryIndex) => `workflow:${workflowRunId}:turn:${turnEndEntryIndex}:review-ready`;
 var workflowFailedId = (workflowRunId, stateVersion) => `workflow:${workflowRunId}:failed:${stateVersion}`;
 function findTurnOpeningUserEntry(entries, beforeIndex) {
-  let opening;
+  const index = findTurnOpeningUserEntryIndex(entries, beforeIndex);
+  return index === null ? void 0 : entries[index];
+}
+function findTurnOpeningUserEntryIndex(entries, beforeIndex) {
+  let opening = null;
   for (let i = Math.min(beforeIndex, entries.length) - 1; i >= 0; i--) {
     const entry = entries[i];
     if (!entry) continue;
     if (entry.type === "turn_end") break;
-    if (entry.type === "user") opening = entry;
+    if (entry.type === "user") opening = i;
   }
   return opening;
 }
@@ -207809,6 +208063,13 @@ var ClaudeCodeProvider = class {
   }
 };
 
+// src/protocol/mcp/tool-names.ts
+function qualifiedMcpToolName(tool2, server) {
+  const serverName = server?.trim();
+  if (!serverName || tool2.startsWith("mcp__")) return tool2;
+  return `mcp__${serverName}__${tool2}`;
+}
+
 // src/protocol/codex/codec.ts
 function parseCodexLine(line) {
   let msg;
@@ -208080,7 +208341,7 @@ var CodexProvider = class _CodexProvider {
       }
       case "mcpToolCall": {
         const id = item.id ?? this.generateId();
-        const toolName = item.tool ? canonicalizeSessionToolName(item.tool, item.server) : "MCP";
+        const toolName = item.tool ? qualifiedMcpToolName(canonicalizeSessionToolName(item.tool, item.server), item.server) : "MCP";
         const output = item.error?.message ?? (item.result ? JSON.stringify(item.result) : "");
         return [
           { type: "tool_use", tool: toolName, input: item.arguments, toolUseId: id },
@@ -208395,6 +208656,7 @@ var TOOL_TIERS = {
   remote_mcp_close: "exec"
 };
 var MAX_IN_FLIGHT_PER_SESSION = 4;
+var MAX_SESSION_GRANTS = 64;
 var REMOTE_MCP_CAPABILITIES = [
   "http:POST /api/path/cross-remote/mcp/open",
   "http:POST /api/path/cross-remote/mcp/list-tools",
@@ -208409,11 +208671,8 @@ function isSessionUsable(deps, sessionId) {
   if (sessionId.startsWith("remote-")) return deps.remoteSessionMap.has(sessionId);
   return deps.agentSessionManager.getSessionProcessAlive(sessionId);
 }
-async function resolveTarget(deps, payload, targetRemoteId, requiredTier) {
-  if (payload.sourceRemoteServerId && payload.sourceRemoteServerId === targetRemoteId) {
-    return { ok: false, reason: "not_accessible" };
-  }
-  const server = await deps.storage.remoteServers.getById(targetRemoteId, payload.userId);
+async function canReachRemote(deps, userId, targetRemoteId, requiredTier) {
+  const server = await deps.storage.remoteServers.getById(targetRemoteId, userId);
   if (!server) return { ok: false, reason: "not_accessible" };
   if (!tierSatisfies(server.cross_remote_access, requiredTier)) {
     return { ok: false, reason: "not_accessible" };
@@ -208421,9 +208680,23 @@ async function resolveTarget(deps, payload, targetRemoteId, requiredTier) {
   if (!isOnline(deps, server)) return { ok: false, reason: "offline" };
   return { ok: true, server };
 }
+async function grantedTo(deps, sessionId) {
+  return new Set(await deps.storage.sessionRemoteGrants.list(sessionId));
+}
+async function resolveTarget(deps, payload, targetRemoteId, requiredTier) {
+  if (payload.sourceRemoteServerId && payload.sourceRemoteServerId === targetRemoteId) {
+    return { ok: false, reason: "not_accessible" };
+  }
+  const granted = await grantedTo(deps, payload.sessionId);
+  if (!granted.has(targetRemoteId)) return { ok: false, reason: "not_granted" };
+  return canReachRemote(deps, payload.userId, targetRemoteId, requiredTier);
+}
 async function listAccessibleRemotes(deps, payload) {
-  const servers = await deps.storage.remoteServers.getAll(payload.userId);
-  return servers.filter((s3) => s3.cross_remote_access !== "off").filter((s3) => s3.id !== payload.sourceRemoteServerId).map((s3) => ({
+  const [servers, granted] = await Promise.all([
+    deps.storage.remoteServers.getAll(payload.userId),
+    grantedTo(deps, payload.sessionId)
+  ]);
+  return servers.filter((s3) => s3.cross_remote_access !== "off").filter((s3) => s3.id !== payload.sourceRemoteServerId).filter((s3) => granted.has(s3.id)).map((s3) => ({
     id: s3.id,
     name: s3.name,
     access: s3.cross_remote_access,
@@ -208431,6 +208704,22 @@ async function listAccessibleRemotes(deps, payload) {
     mcp_broker_supported: supportsRemoteMcpBroker(s3)
   }));
 }
+async function validateSessionGrantIds(storage2, ids, userId, sourceRemoteServerId) {
+  if (ids.length > MAX_SESSION_GRANTS) {
+    return `At most ${MAX_SESSION_GRANTS} remotes can be granted to one session`;
+  }
+  for (const id of ids) {
+    if (sourceRemoteServerId && id === sourceRemoteServerId) {
+      return `Remote ${id} is the machine this session runs on`;
+    }
+    const server = await storage2.remoteServers.getById(id, userId);
+    if (!server) return `Remote ${id} not found`;
+    if (server.cross_remote_access === "off") {
+      return `Remote ${server.name} has cross-remote access turned off`;
+    }
+  }
+  return null;
+}
 var SessionConcurrencyGuard = class {
   constructor(maxInFlight = MAX_IN_FLIGHT_PER_SESSION) {
     this.maxInFlight = maxInFlight;
@@ -229930,6 +230219,45 @@ async function resolveFastChatModel(storage2, userId) {
   return resolveModel(config2.fast, config2.apiKeys);
 }
 
+// src/cross-remote-grant-context.ts
+var VREMOTES_BLOCK_RE = /<vremotes(?:\s[^>]*)?>[\s\S]*?<\/vremotes>/g;
+function stripRemoteGrantContext(text2) {
+  return text2.replace(VREMOTES_BLOCK_RE, "").trimEnd();
+}
+async function listGrantedServers(storage2, sessionId, userId) {
+  const ids = await storage2.sessionRemoteGrants.list(sessionId);
+  if (ids.length === 0) return [];
+  const servers = await Promise.all(
+    ids.map((id) => storage2.remoteServers.getById(id, userId).catch(() => void 0))
+  );
+  return servers.filter((s3) => s3 !== void 0).sort((a, b2) => a.name.localeCompare(b2.name));
+}
+async function buildRemoteGrantContext(storage2, sessionId, userId) {
+  const usable = (await listGrantedServers(storage2, sessionId, userId)).filter((s3) => s3.cross_remote_access !== "off");
+  if (usable.length === 0) return null;
+  const listed = usable.map((s3) => `${s3.name} (id: ${s3.id}, ${s3.cross_remote_access})`).join(", ");
+  const names = usable.map((s3) => s3.name.replace(/["<>]/g, "")).join(", ");
+  return [
+    `<vremotes names="${names}">`,
+    `Cross-remote access granted for this session: ${listed}.`,
+    "Use the cross-remote MCP tools when a request concerns one of these machines. Being granted does not mean every command should run there; the local workspace remains the default target.",
+    // Diagnosing on a remote tends to carry over into fixing there, so the
+    // default for changes is spelled out separately from "where to look".
+    "Remote access is for inspection and diagnosis. Make code changes (editing files, git operations, installing dependencies) in the local workspace, even when the problem was found on a remote; only modify a remote machine when the user explicitly asks for the change to be made there. If a fix can only be applied on the remote (for example, machine-specific config), propose it and ask before changing anything.",
+    "</vremotes>"
+  ].join("\n");
+}
+function appendContextBlock(content, block) {
+  if (!block) return content;
+  if (typeof content === "string") return content.length > 0 ? `${content}
+
+${block}` : block;
+  return [...content, { type: "text", text: block }];
+}
+async function appendRemoteGrantContext(storage2, sessionId, userId, content) {
+  return appendContextBlock(content, await buildRemoteGrantContext(storage2, sessionId, userId));
+}
+
 // src/utils/session-title.ts
 var TITLE_MAX_CHARS = 60;
 var AI_TIMEOUT_MS = 15e3;
@@ -229947,8 +230275,8 @@ async function isChatModelConfigured(storage2, userId) {
   return isModelConfigured(config2, config2.fast);
 }
 function extractUserText(content) {
-  if (typeof content === "string") return content;
-  return content.filter((p2) => p2.type === "text").map((p2) => p2.text).join(" ");
+  const text2 = typeof content === "string" ? content : content.filter((p2) => p2.type === "text").map((p2) => p2.text).join(" ");
+  return stripRemoteGrantContext(text2);
 }
 function snippetTitle(text2) {
   const trimmed = text2.trim();
@@ -230675,6 +231003,12 @@ function describeImageToolOutput(output) {
 }
 var AgentSessionManager = class {
   sessions = /* @__PURE__ */ new Map();
+  /**
+   * How long a freshly spawned process gets before the woken session's context
+   * is written to its stdin. The wake awaits this write (see
+   * wakeDormantSessionInner); tests shorten it.
+   */
+  wakeStdinDelayMs = 500;
   storage;
   eventBus = null;
   /**
@@ -232495,7 +232829,7 @@ var AgentSessionManager = class {
         console.error(`[AgentSession] Cannot wake dormant session ${sessionId} without projectPath`);
         return false;
       }
-      return this.wakeDormantSession(session, projectPath, content, userId, opts?.origin, disposition);
+      return this.wakeDormantSession(session, projectPath, content, userId, disposition, opts);
     }
     if (session.workspaceCheckoutId) {
       await this.resolveSessionWorktreePath(session, projectPath ?? session.checkoutPath ?? "");
@@ -232504,7 +232838,8 @@ var AgentSessionManager = class {
       return false;
     }
     this.applyCompletionTimerAction(session, session.completion.userTurnStarted());
-    if (session.status !== "running") {
+    const openedFromIdle = session.status !== "running";
+    if (openedFromIdle) {
       session.status = "running";
       if (!session.skipDb) await this.storage.agentSessions.updateStatus(sessionId, "running");
       this.broadcastPatch(sessionId, ConversationPatch.updateStatus("running"));
@@ -232513,16 +232848,21 @@ var AgentSessionManager = class {
     this.touchSession(session);
     await this.finalizeStreamingEntry(session);
     session.store.currentAssistantIndex = null;
-    const userEntryIndex = await this.pushEntry(sessionId, {
-      type: "user",
-      content,
-      timestamp: Date.now(),
-      ...opts?.origin ? { origin: opts.origin } : {},
-      notificationDisposition: disposition
-      // Lifecycle activation: an entry-write failure must abort before stdin
-      // (strict), or the session would be marked active with no durable turn.
-    }, true, userId, { strictPersist: opts?.onUserEntryPersisted !== void 0 });
-    if (opts?.onUserEntryPersisted) await opts.onUserEntryPersisted(userEntryIndex);
+    try {
+      const userEntryIndex = await this.pushEntry(sessionId, {
+        type: "user",
+        content,
+        timestamp: Date.now(),
+        ...opts?.origin ? { origin: opts.origin } : {},
+        notificationDisposition: disposition
+        // Lifecycle activation: an entry-write failure must abort before stdin
+        // (strict), or the session would be marked active with no durable turn.
+      }, true, userId, { strictPersist: opts?.onUserEntryPersisted !== void 0 });
+      if (opts?.onUserEntryPersisted) await opts.onUserEntryPersisted(userEntryIndex);
+    } catch (error48) {
+      if (openedFromIdle) await this.abortSendBeforeStdin(session);
+      throw error48;
+    }
     try {
       const provider = getProvider(session.agentType);
       const formatted = provider.formatUserInput(content, session.id);
@@ -232547,6 +232887,7 @@ var AgentSessionManager = class {
       return true;
     } catch (error48) {
       console.error(`[AgentSession] Failed to send message:`, error48);
+      if (openedFromIdle && session.turnOpenSince === null) await this.abortSendBeforeStdin(session);
       return false;
     }
   }
@@ -233269,7 +233610,7 @@ var AgentSessionManager = class {
    * — see the `retentionDeleting` / `processStartsInFlight` pair in
    * `beginProcessStart`.
    */
-  async wakeDormantSession(session, projectPath, userMessage, userId = "local", origin, notificationDisposition = "result") {
+  async wakeDormantSession(session, projectPath, userMessage, userId = "local", notificationDisposition = "result", opts) {
     const release = this.beginProcessStart(session);
     if (!release) {
       console.log(`[AgentSession] Refusing to wake ${session.id}: retention is deleting it`);
@@ -233277,21 +233618,21 @@ var AgentSessionManager = class {
     }
     console.log(`[AgentSession] Waking dormant session ${session.id}`);
     try {
-      await this.wakeDormantSessionInner(
+      return await this.wakeDormantSessionInner(
         session,
         projectPath,
         userMessage,
         userId,
-        origin,
-        notificationDisposition
+        notificationDisposition,
+        opts
       );
-      return true;
     } finally {
       release();
       this.unloadIfSpawnAbandoned(session);
     }
   }
-  async wakeDormantSessionInner(session, projectPath, userMessage, userId, origin, notificationDisposition) {
+  async wakeDormantSessionInner(session, projectPath, userMessage, userId, notificationDisposition, opts) {
+    const origin = opts?.origin;
     const absoluteWorktreePath = await this.resolveSessionWorktreePath(session, projectPath);
     await this.hydrateForSpawn(session);
     await this.ensureResidentCapacity(
@@ -233308,27 +233649,69 @@ var AgentSessionManager = class {
     provider.onSessionDestroyed?.(session.id);
     provider.onSessionCreated?.(session.id, session.permissionMode);
     await this.spawnAgent(session, absoluteWorktreePath);
-    await this.pushEntry(session.id, {
-      type: "user",
-      content: userMessage,
-      timestamp: Date.now(),
-      ...origin ? { origin } : {},
-      notificationDisposition
-    }, true, userId);
+    try {
+      const userEntryIndex = await this.pushEntry(session.id, {
+        type: "user",
+        content: userMessage,
+        timestamp: Date.now(),
+        ...origin ? { origin } : {},
+        notificationDisposition
+      }, true, userId, { strictPersist: opts?.onUserEntryPersisted !== void 0 });
+      if (opts?.onUserEntryPersisted) await opts.onUserEntryPersisted(userEntryIndex);
+    } catch (error48) {
+      await this.abortSendBeforeStdin(session);
+      throw error48;
+    }
     session.turnOpenSince = Date.now();
     session.turnDisposition = notificationDisposition;
-    setTimeout(() => {
-      const context2 = this.buildFullConversationContext(session.store.entries);
-      if (context2) {
-        const provider2 = getProvider(session.agentType);
-        const formatted = provider2.formatUserInput(context2, session.id);
+    const written = await new Promise((resolve3) => {
+      setTimeout(() => {
         try {
-          session.process?.stdin?.write(formatted);
+          const context2 = this.buildFullConversationContext(session.store.entries);
+          const stdin = session.process?.stdin;
+          if (!context2 || !stdin) return resolve3(false);
+          stdin.write(getProvider(session.agentType).formatUserInput(context2, session.id));
+          resolve3(true);
         } catch (error48) {
           console.error(`[AgentSession] Failed to send context to woken session:`, error48);
+          resolve3(false);
         }
-      }
-    }, 500);
+      }, this.wakeStdinDelayMs);
+    });
+    if (!written) {
+      session.turnOpenSince = null;
+      await this.abortSendBeforeStdin(session);
+    }
+    return written;
+  }
+  /**
+   * A send flipped an idle session to "running" and then aborted before stdin
+   * was written (strict entry-write failure, a throwing evidence hook, or the
+   * write itself failing). Two things must be undone, or the NEXT send breaks:
+   *
+   *  - the turn boundary: the user entry may already be in the transcript, and
+   *    an entry with no `turn_end` after it reads as the OPENER of whatever
+   *    turn comes next — wrong notification disposition, and a workflow
+   *    dispatch whose recorded index no longer matches its own turn. Close it
+   *    with a `failed` turn_end; `internal` so it notifies nobody.
+   *  - the status: nothing is in flight, so a session left "running" would
+   *    refuse every retry as busy.
+   *
+   * Only while the process is still ours and alive — an exit that landed
+   * meanwhile has already settled both through its own handler.
+   */
+  async abortSendBeforeStdin(session) {
+    if (session.status !== "running" || session.turnOpenSince !== null) return;
+    if (session.process && session.process.exitCode !== null) return;
+    await this.pushTurnEnd(session, "failed", "internal", Date.now());
+    session.status = "stopped";
+    if (!session.skipDb) {
+      await this.storage.agentSessions.updateStatusPreservingTimestamp(session.id, "stopped").catch((err) => {
+        console.error(`[AgentSession] Failed to restore idle status for ${session.id}:`, err);
+      });
+    }
+    this.broadcastPatch(session.id, ConversationPatch.updateStatus("stopped"));
+    this.eventBus?.emit({ type: "session:status", projectId: session.projectId, branch: session.branch, sessionId: session.id, status: "stopped" });
   }
   /**
    * Rebuild an in-memory MessageStore (entries, replay patches, tool tracker,
@@ -234788,6 +235171,7 @@ async function createRemoteWorkflowReviewer(deps, params) {
     reviewContextMode: params.reviewContextMode ?? null,
     agentType: params.reviewerAgentType,
     intentBrief: params.intentBrief ?? null,
+    loopMaxRounds: params.loopMaxRounds ?? null,
     userId: params.userId ?? null
   });
   let registeredLocalSessionId = null;
@@ -234799,7 +235183,9 @@ async function createRemoteWorkflowReviewer(deps, params) {
       reviewSpan: params.reviewSpan,
       reviewerAgentType: params.reviewerAgentType,
       runId: remoteRunId,
-      newReviewerSessionId: remoteReviewerSessionId
+      newReviewerSessionId: remoteReviewerSessionId,
+      // Additive tunnel field; an older worker ignores it (single-pass review).
+      ...params.loopMaxRounds !== void 0 ? { loop: { maxRounds: params.loopMaxRounds } } : {}
     };
     const proxyOpts = { reverseConnectManager: deps.reverseConnectManager ?? void 0 };
     const result = params.phase === "prepare" ? await proxyToRemoteAuto(
@@ -235018,6 +235404,7 @@ function recoverPendingRemoteReviewerOnce(deps, intent) {
         reviewContextMode: intent.review_context_mode ?? void 0,
         reviewerAgentType: intent.agent_type,
         intentBrief: intent.intent_brief ?? void 0,
+        loopMaxRounds: intent.loop_max_rounds ?? void 0,
         userId: intent.user_id ?? void 0,
         remoteRunId: intent.remote_run_id,
         remoteReviewerSessionId: intent.remote_reviewer_session_id,
@@ -240949,11 +241336,79 @@ var ProjectChatManager = class {
 };
 
 // src/workflow-engine.ts
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
+
+// src/instruction-delivery.ts
+import { createHash as createHash3, randomUUID as randomUUID6 } from "crypto";
+var instructionReceiverToken = randomUUID6();
+var instructionDeliveryLocks = /* @__PURE__ */ new Map();
+var sessionMutationLocks = /* @__PURE__ */ new Map();
+async function serialize(table, key2, effect) {
+  const previous = table.get(key2) ?? Promise.resolve();
+  let release;
+  const gate = new Promise((resolve3) => {
+    release = resolve3;
+  });
+  const tail = previous.then(() => gate);
+  table.set(key2, tail);
+  await previous;
+  try {
+    return await effect();
+  } finally {
+    release();
+    if (table.get(key2) === tail) table.delete(key2);
+  }
+}
+function serializeSessionMutation(sessionId, effect) {
+  return serialize(sessionMutationLocks, sessionId, effect);
+}
+function instructionContentHash(content) {
+  const canonical = typeof content === "string" ? JSON.stringify({ type: "string", content }) : JSON.stringify(content.map((part) => part.type === "text" ? { type: "text", text: part.text } : { type: "image", mediaType: part.mediaType, data: part.data }));
+  return createHash3("sha256").update(canonical).digest("hex");
+}
+async function deliverInstruction(input) {
+  const { storage: storage2, sessionId, idempotencyKey } = input;
+  const ledger = storage2.agentInstructionDeliveries;
+  const ref = { sessionId, idempotencyKey, claimToken: instructionReceiverToken };
+  return serialize(instructionDeliveryLocks, `${sessionId}\0${idempotencyKey}`, async () => {
+    const claim = await ledger.claim({ ...ref, contentHash: instructionContentHash(input.rawContent) });
+    if (claim === "conflict") return "conflict";
+    if (claim === "sent") return "replayed";
+    if (claim === "busy") return "busy";
+    let ownershipLost = false;
+    const renew = async () => {
+      try {
+        if (!await ledger.renewClaim(ref)) ownershipLost = true;
+      } catch {
+        ownershipLost = true;
+      }
+    };
+    await renew();
+    const heartbeat = setInterval(() => {
+      void renew();
+    }, 1e4);
+    heartbeat.unref();
+    try {
+      if (ownershipLost) return "ownership_lost_before_send";
+      if (!await input.deliver()) {
+        await ledger.release(ref);
+        return "not_running";
+      }
+      await renew();
+      if (ownershipLost) return "ownership_lost_after_send";
+      return await ledger.markSent(ref) ? "delivered" : "unconfirmed";
+    } catch (error48) {
+      await ledger.release(ref);
+      throw error48;
+    } finally {
+      clearInterval(heartbeat);
+    }
+  });
+}
 
 // src/utils/review-target.ts
 import { execFileSync as execFileSync4 } from "child_process";
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 var MAX_BUFFER2 = 10 * 1024 * 1024;
 function git2(cwd, args) {
   return execFileSync4("git", args, {
@@ -240968,7 +241423,7 @@ function captureReviewTarget(worktreePath) {
     const baseHead = git2(worktreePath, ["rev-parse", "HEAD"]).trim();
     const diff = git2(worktreePath, ["diff"]);
     const status = git2(worktreePath, ["status", "--porcelain"]);
-    const diffDigest = createHash3("sha256").update(diff).update("\0").update(status).digest("hex");
+    const diffDigest = createHash4("sha256").update(diff).update("\0").update(status).digest("hex");
     const diffStat = git2(worktreePath, ["diff", "--shortstat"]).trim() || null;
     return { baseHead, diffDigest, diffStat, capturedAt: Date.now() };
   } catch {
@@ -240987,6 +241442,31 @@ function hasDrifted(worktreePath, target) {
   return current.baseHead !== target.baseHead || current.diffDigest !== target.diffDigest;
 }
 
+// src/utils/review-verdict.ts
+var VERDICTS = ["ship", "needs-changes", "cannot-verify"];
+function bareValue(line) {
+  return line.replace(/^\s*(?:#+|>|[-*+]|\d+[.)、])\s*/, "").replace(/[*_`]/g, "").replace(/verdict/gi, "").replace(/^[\s:：—–\-.。]+|[\s:：—–\-.。]+$/g, "").toLowerCase();
+}
+function parseVerdict(text2) {
+  if (!text2) return null;
+  const lines = text2.split(/\r?\n/);
+  let labelLine = -1;
+  for (let i = lines.length - 1; i >= 0; i--) {
+    if (/verdict/i.test(lines[i])) {
+      labelLine = i;
+      break;
+    }
+  }
+  if (labelLine < 0) return null;
+  let value = bareValue(lines[labelLine]);
+  if (value === "") {
+    const next = lines.slice(labelLine + 1).find((l) => l.trim() !== "");
+    if (next === void 0) return null;
+    value = bareValue(next);
+  }
+  return VERDICTS.includes(value) ? value : null;
+}
+
 // src/workflow-engine.ts
 var WorkflowError = class extends Error {
   constructor(code, message) {
@@ -240996,6 +241476,10 @@ var WorkflowError = class extends Error {
   code;
 };
 var TERMINAL_STATUSES = /* @__PURE__ */ new Set(["completed", "cancelled", "failed"]);
+var DELIVERY_UNKNOWN_PREFIX = "\u6295\u9012\u7ED3\u679C\u672A\u77E5";
+var REREVIEW_DELIVERY_UNKNOWN = `${DELIVERY_UNKNOWN_PREFIX}\uFF1A\u590D\u5BA1\u4EFB\u52A1\u53EF\u80FD\u5DF2\u9001\u8FBE reviewer\u3002\u82E5\u5176\u5B8C\u6210\uFF0C\u7ED3\u679C\u4F1A\u81EA\u52A8\u5F52\u5C5E\uFF1B\u5426\u5219\u8BF7\u7ED3\u675F\u672C\u6B21 review \u540E\u91CD\u65B0\u53D1\u8D77\u3002`;
+var DispatchSupersededError = class extends Error {
+};
 var REVIEWER_TURN = {
   origin: "workflow",
   notificationDisposition: "milestone-managed"
@@ -241227,6 +241711,8 @@ function describeActivationFailure(result) {
       return `reviewer \u65E0\u6CD5\u542F\u52A8\uFF08${result.errorCode}\uFF09`;
   }
 }
+var LOOP_MAX_ROUNDS_DEFAULT = 3;
+var LOOP_MAX_ROUNDS_LIMIT = 10;
 var WorkflowEngine = class {
   constructor(storage2, agentOps) {
     this.storage = storage2;
@@ -241255,9 +241741,11 @@ var WorkflowEngine = class {
   }
   /** Boot recovery (spec §3.4). Call once after storage is ready. */
   async init() {
+    const settled = await this.reconcileOpenSteps();
     const active = await this.storage.workflowRuns.getAllActive();
     for (const run2 of active) {
-      if (run2.status === "sending_feedback") {
+      if (settled.has(run2.id)) {
+      } else if (run2.status === "sending_feedback") {
         await this.storage.workflowRuns.update(run2.id, {
           status: "waiting_feedback",
           error: "\u53D1\u9001\u72B6\u6001\u672A\u77E5\uFF1A\u670D\u52A1\u5728\u53D1\u9001\u53CD\u9988\u671F\u95F4\u91CD\u542F\u3002\u8BF7\u68C0\u67E5 source session \u662F\u5426\u5DF2\u6536\u5230\u53CD\u9988\uFF0C\u518D\u51B3\u5B9A\u91CD\u53D1\u6216\u7ED3\u675F\u3002"
@@ -241277,6 +241765,101 @@ var WorkflowEngine = class {
       this.trackParticipants(run2);
     }
   }
+  /**
+   * Restart reconciliation (design §2.7). A crash emits no completion event —
+   * crash repair writes `turn_end{server_restart}` silently — so every step
+   * still `dispatched` is decided here, from evidence:
+   *
+   *  - no entry index (for a fresh reviewer: neither on the step nor on the
+   *    session row) ⇒ stdin was never written ⇒ proven no side effect: abandon
+   *    and roll the run back exactly as a live send failure would. The user
+   *    gets the ordinary button back and may even edit before re-sending.
+   *  - an index, and the turn it opened completed ⇒ late claim, same
+   *    transaction as a live one.
+   *  - an index, and that turn ended any other way ⇒ abandon; whether the
+   *    instruction was acted on is unprovable, so the run keeps an honest note.
+   *  - an index and no turn_end after it ⇒ leave it; nothing to decide yet.
+   *
+   * Returns the ids of runs whose state this pass decided.
+   */
+  async reconcileOpenSteps() {
+    const settled = /* @__PURE__ */ new Set();
+    const steps = this.storage.workflowRunSteps;
+    for (const step of await steps.listAllOpen()) {
+      try {
+        const run2 = await this.storage.workflowRuns.getById(step.run_id);
+        if (!run2) {
+          await steps.abandon(step.id, "run no longer exists");
+          continue;
+        }
+        const entryIndex = await this.effectiveEntryIndex(step);
+        if (entryIndex === null) {
+          await steps.abandon(step.id, "never delivered: no entry index was recorded before the restart");
+          if (await this.rollBackUndeliveredStep(run2, step)) settled.add(run2.id);
+          continue;
+        }
+        const entries = await this.agentOps.getRawMessages(step.session_id);
+        let turnEndIndex = null;
+        for (let i = entryIndex + 1; i < entries.length; i++) {
+          if (entries[i]?.type === "turn_end") {
+            turnEndIndex = i;
+            break;
+          }
+        }
+        if (turnEndIndex === null) continue;
+        const turnEnd = entries[turnEndIndex];
+        const outcome = turnEnd.outcome ?? "completed";
+        const completed = outcome === "completed" || outcome === "completed_with_pending_tasks";
+        if (completed && findTurnOpeningUserEntryIndex(entries, turnEndIndex) === entryIndex) {
+          await this.claimStep(step, entries, turnEndIndex);
+          settled.add(run2.id);
+          continue;
+        }
+        await steps.abandon(step.id, `turn ended: ${outcome}`);
+        if (TERMINAL_STATUSES.has(run2.status)) continue;
+        if (step.kind === "feedback") {
+          await this.storage.workflowRuns.transition(run2.id, "sending_feedback", "waiting_feedback", {
+            error: "\u53D1\u9001\u72B6\u6001\u672A\u77E5\uFF1A\u670D\u52A1\u5728\u53D1\u9001\u53CD\u9988\u671F\u95F4\u91CD\u542F\u3002\u8BF7\u68C0\u67E5 source session \u662F\u5426\u5DF2\u6536\u5230\u53CD\u9988\uFF0C\u518D\u51B3\u5B9A\u91CD\u53D1\u6216\u7ED3\u675F\u3002"
+          });
+        } else if (run2.status === "waiting_reviewer") {
+          await this.storage.workflowRuns.update(run2.id, {
+            error: "reviewer \u7684\u8FD9\u4E00\u8F6E\u56E0\u670D\u52A1\u91CD\u542F\u800C\u4E2D\u65AD\uFF0C\u6CA1\u6709\u4EA7\u51FA\u53EF\u7528\u7684\u7ED3\u8BBA\u3002\u53EF\u5728\u5176\u7A97\u53E3\u4E2D\u7EE7\u7EED\u5BF9\u8BDD\u540E\u91CD\u65B0\u751F\u6210\u7EC8\u7A3F\uFF0C\u6216\u7ED3\u675F\u672C\u6B21 review\u3002"
+          });
+        }
+        settled.add(run2.id);
+      } catch (err) {
+        console.error(`[WorkflowEngine] reconciling step ${step.id} failed; left dispatched:`, err);
+      }
+    }
+    return settled;
+  }
+  /** The run-side half of "this dispatch provably never reached stdin". */
+  async rollBackUndeliveredStep(run2, step) {
+    if (TERMINAL_STATUSES.has(run2.status)) return false;
+    const note = "\u4E0A\u6B21\u6295\u9012\u56E0\u670D\u52A1\u91CD\u542F\u672A\u9001\u8FBE\uFF08\u76EE\u6807 session \u6CA1\u6709\u6536\u5230\u4EFB\u4F55\u5185\u5BB9\uFF09\uFF0C\u53EF\u76F4\u63A5\u91CD\u65B0\u64CD\u4F5C\u3002";
+    switch (step.kind) {
+      case "feedback":
+        if (!await this.storage.workflowRuns.transition(run2.id, "sending_feedback", "waiting_feedback", { error: note }) && run2.status === "waiting_feedback") {
+          await this.storage.workflowRuns.update(run2.id, { error: note });
+        }
+        return true;
+      case "final_verdict":
+        return this.storage.workflowRuns.transition(run2.id, "waiting_reviewer", "discussing", { error: note });
+      case "rereview_prompt":
+        if (run2.loop_id && run2.round > 1) {
+          return this.storage.workflowRuns.transition(run2.id, "waiting_reviewer", "waiting_rereview", {
+            reviewer_session_id: null,
+            error: "\u590D\u5BA1\u4EFB\u52A1\u56E0\u670D\u52A1\u91CD\u542F\u672A\u9001\u8FBE reviewer\uFF0C\u53EF\u76F4\u63A5\u91CD\u65B0\u53D1\u8D77\u8FD9\u4E00\u8F6E\u590D\u5BA1\u3002"
+          });
+        }
+        await this.failRun(run2, "\u590D\u5BA1\u4EFB\u52A1\u56E0\u670D\u52A1\u91CD\u542F\u672A\u9001\u8FBE reviewer\u3002\u8BF7\u91CD\u65B0\u53D1\u8D77 review\u3002");
+        return true;
+      case "reviewer_prompt":
+        if (run2.status === "preparing") return false;
+        await this.failRun(run2, "reviewer \u7684\u9996\u6761\u6307\u4EE4\u56E0\u670D\u52A1\u91CD\u542F\u672A\u9001\u8FBE\u3002\u8BF7\u91CD\u65B0\u53D1\u8D77 review\u3002");
+        return true;
+    }
+  }
   trackParticipants(run2) {
     this.participants.set(run2.source_session_id, { runId: run2.id, role: "source" });
     if (run2.reviewer_session_id) {
@@ -241351,6 +241934,325 @@ var WorkflowEngine = class {
    * when one exists, otherwise the source session (a run can fail before its
    * reviewer is ever created).
    */
+  // ---------- review loop (Phase 2 cut 1) ----------
+  /**
+   * The gate run for the next round, if this finished round continues a loop:
+   * a loop run whose verdict was not `ship`, and whose source has not been
+   * taken by a review the user started in the meantime. The source was
+   * released when the feedback was sent, and this claim is asynchronous — a
+   * newer review wins and the old loop simply stops. This in-memory check
+   * mirrors the start entry's synchronous reservation; the insert itself is
+   * guarded again inside the transaction against the persisted active runs.
+   */
+  nextRoundGate(run2, sourceTurnEndIndex) {
+    if (!run2.loop_id || run2.verdict === "ship") return void 0;
+    const holder = this.participants.get(run2.source_session_id);
+    if (holder && holder.runId !== run2.id) return void 0;
+    return {
+      id: randomUUID7(),
+      project_id: run2.project_id,
+      branch: run2.branch,
+      source_session_id: run2.source_session_id,
+      source_turn_end_index: sourceTurnEndIndex,
+      review_focus: run2.review_focus,
+      // Captured when the re-review is actually confirmed — the workspace may
+      // keep changing while the gate waits.
+      review_target: null,
+      loop_id: run2.loop_id,
+      round: run2.round + 1,
+      max_rounds: run2.max_rounds
+    };
+  }
+  /** The insert is conditional (see claimStepAndTransition); read it back to know. */
+  async announceNextRoundGate(nextRunId) {
+    if (!nextRunId) return;
+    const gate = await this.storage.workflowRuns.getById(nextRunId);
+    if (!gate) return;
+    this.trackParticipants(gate);
+    this.emitRunUpdated(gate);
+  }
+  /** The reviewer the loop continues with: the previous round's. */
+  async loopReviewerSessionId(gate) {
+    if (!gate.loop_id) return null;
+    const previous = await this.storage.workflowRuns.getLoopRound(gate.loop_id, gate.round - 1);
+    return previous?.reviewer_session_id ?? null;
+  }
+  /**
+   * Gate action `rereview`: confirm the next round. From here on the round is
+   * an ordinary re-review on the reuse path.
+   *
+   * Unlike the one-shot start, a prompt that provably did not leave does NOT
+   * fail the run — one concurrent chat with the reviewer must not end the
+   * loop. The run returns to the gate with the reviewer unbound, and the same
+   * gate can be retried. An unknown outcome stays in `waiting_reviewer` under
+   * the usual step reconciliation.
+   */
+  async approveRereview(runId, opts = {}) {
+    const gate = await this.storage.workflowRuns.getById(runId);
+    if (!gate || gate.status !== "waiting_rereview") {
+      throw new WorkflowError("bad-state", "run \u4E0D\u5728\u7B49\u5F85\u590D\u5BA1\u786E\u8BA4\u7684\u72B6\u6001");
+    }
+    const overCap = gate.max_rounds !== null && gate.round > gate.max_rounds;
+    if (overCap && !opts.extend) {
+      throw new WorkflowError("bad-state", `\u5DF2\u8FBE\u8F6E\u6B21\u4E0A\u9650\uFF08${gate.max_rounds} \u8F6E\uFF09\uFF0C\u9700\u8981\u786E\u8BA4\u8FFD\u52A0\u4E00\u8F6E`);
+    }
+    const project = await this.storage.projects.getById(gate.project_id);
+    if (!project?.path) throw new WorkflowError("reviewer-unavailable", "\u9879\u76EE\u5728\u672C\u673A\u6CA1\u6709\u53EF\u7528\u8DEF\u5F84");
+    const reviewerSessionId = await this.loopReviewerSessionId(gate);
+    if (!reviewerSessionId) throw new WorkflowError("reviewer-unavailable", "\u627E\u4E0D\u5230\u4E0A\u4E00\u8F6E\u7684 reviewer session");
+    const held = this.participants.get(reviewerSessionId);
+    if (held) {
+      throw held.runId === gate.id ? new WorkflowError("bad-state", "\u8FD9\u4E00\u8F6E\u590D\u5BA1\u6B63\u5728\u53D1\u8D77\u4E2D") : new WorkflowError("session-busy", "\u4E0A\u4E00\u8F6E\u7684 reviewer \u6B63\u5728\u53E6\u4E00\u4E2A review \u91CC");
+    }
+    this.participants.set(reviewerSessionId, { runId: gate.id, role: "reviewer" });
+    const releaseReservation = () => {
+      const current = this.participants.get(reviewerSessionId);
+      if (current?.runId === gate.id && current.role === "reviewer") this.participants.delete(reviewerSessionId);
+    };
+    let reviewerSession;
+    let entries;
+    let turnEndIndex;
+    let target;
+    try {
+      const activeElsewhere = await this.storage.workflowRuns.getActiveBySession(reviewerSessionId);
+      if (activeElsewhere && activeElsewhere.id !== gate.id) {
+        throw new WorkflowError("session-busy", "\u4E0A\u4E00\u8F6E\u7684 reviewer \u6B63\u5728\u53E6\u4E00\u4E2A review \u91CC");
+      }
+      const reviewerNow = await this.storage.agentSessions.getById(reviewerSessionId);
+      if (reviewerNow?.status === "running") {
+        throw new WorkflowError("session-busy", "reviewer \u6B63\u5728\u56DE\u590D\u4E2D\uFF0C\u8BF7\u7B49\u5F85\u5176\u5B8C\u6210\u540E\u518D\u53D1\u8D77\u590D\u5BA1");
+      }
+      reviewerSession = await this.assertReviewerReusable(reviewerSessionId, gate.project_id, gate.branch);
+      const sourceSession = await this.storage.agentSessions.getById(gate.source_session_id);
+      if (sourceSession?.status === "running") {
+        throw new WorkflowError("source-running", "source session \u6B63\u5728\u8FD0\u884C\uFF0C\u8BF7\u7B49\u5F85\u5F53\u524D turn \u5B8C\u6210\u540E\u518D\u53D1\u8D77\u590D\u5BA1");
+      }
+      entries = await this.agentOps.getRawMessages(gate.source_session_id);
+      turnEndIndex = extractLatestTurnEndIndex(entries) ?? gate.source_turn_end_index;
+      const sourceProjection = await this.storage.agentSessions.getActivityById(gate.source_session_id, "workflow-reviewer");
+      const worktreePath = sourceProjection?.worktreePath ?? resolveWorktreePath(project.path, gate.branch);
+      target = captureReviewTarget(worktreePath);
+      const claimed = await this.storage.workflowRuns.transition(gate.id, "waiting_rereview", "waiting_reviewer", {
+        reviewer_session_id: reviewerSessionId,
+        error: null
+      });
+      if (!claimed) throw new WorkflowError("bad-state", "run \u72B6\u6001\u5DF2\u53D8\u5316\uFF08\u53EF\u80FD\u5DF2\u88AB\u5904\u7406\uFF09");
+    } catch (err) {
+      releaseReservation();
+      throw err;
+    }
+    await this.storage.workflowRuns.update(gate.id, {
+      source_turn_end_index: turnEndIndex,
+      review_target: JSON.stringify(target),
+      ...overCap ? { max_rounds: gate.round } : {}
+    });
+    const run2 = await this.storage.workflowRuns.getById(gate.id);
+    const outcome = await this.dispatchRereview({
+      run: run2,
+      reviewerSession,
+      project: { id: project.id, path: project.path },
+      entries,
+      turnEndIndex,
+      target
+    });
+    if (outcome.kind === "mode-switch-failed" || outcome.kind === "no_side_effect") {
+      const busy = outcome.kind === "no_side_effect" && outcome.busy;
+      const reason = outcome.kind === "mode-switch-failed" ? "\u65E0\u6CD5\u5C06 reviewer \u6062\u590D\u4E3A\u53EA\u8BFB plan \u6A21\u5F0F\uFF0C\u590D\u5BA1\u672A\u53D1\u51FA\u3002\u53EF\u91CD\u8BD5\uFF0C\u6216\u7ED3\u675F\u5FAA\u73AF\u3002" : busy ? "reviewer \u6B63\u5728\u56DE\u590D\u4E2D\uFF0C\u590D\u5BA1\u672A\u53D1\u51FA\u3002\u8BF7\u7B49\u5F85\u5176\u5B8C\u6210\u540E\u91CD\u8BD5\u3002" : "\u590D\u5BA1\u4EFB\u52A1\u672A\u9001\u8FBE reviewer\uFF08\u5176 session \u53EF\u80FD\u672A\u8FD0\u884C\uFF09\u3002\u53EF\u91CD\u8BD5\uFF0C\u6216\u7ED3\u675F\u5FAA\u73AF\u3002";
+      const back = await this.storage.workflowRuns.transition(gate.id, "waiting_reviewer", "waiting_rereview", {
+        reviewer_session_id: null,
+        error: reason
+      });
+      if (back) releaseReservation();
+      const rolled = await this.storage.workflowRuns.getById(gate.id);
+      if (rolled) this.emitRunUpdated(rolled);
+      throw new WorkflowError(busy ? "session-busy" : outcome.kind === "mode-switch-failed" ? "reviewer-unavailable" : "send-failed", reason);
+    }
+    const started = outcome.kind === "unknown" ? await this.storage.workflowRuns.update(gate.id, { error: REREVIEW_DELIVERY_UNKNOWN }) ?? run2 : run2;
+    this.emitRunUpdated(started);
+    return started;
+  }
+  /**
+   * Gate action `accept`: take the reviewer's result as final and finish the
+   * run WITHOUT sending anything to the source. The natural exit on a `ship`
+   * verdict (the panel makes it the primary action there), but allowed on any
+   * verdict — it is the user's call. A loop ends here: no feedback step, so no
+   * next-round gate.
+   */
+  async acceptResult(runId) {
+    const accepted = await this.storage.workflowRuns.transition(runId, "waiting_feedback", "completed", { error: null });
+    if (!accepted) throw new WorkflowError("bad-state", "run \u4E0D\u5728\u7B49\u5F85\u53CD\u9988\u786E\u8BA4\u7684\u72B6\u6001");
+    const done = await this.storage.workflowRuns.getById(runId);
+    this.untrackRun(done);
+    this.emitRunUpdated(done);
+    return done;
+  }
+  // ---------- re-review (reuse path), shared by the start entry and the loop gate ----------
+  /**
+   * The checks that make an existing session usable as this workspace's
+   * reviewer right now. Throws `reviewer-unavailable`; returns the row.
+   */
+  async assertReviewerReusable(reviewerSessionId, projectId, branch) {
+    const reviewerSession = await this.storage.agentSessions.getById(reviewerSessionId);
+    if (!reviewerSession) {
+      throw new WorkflowError("reviewer-unavailable", "\u4E0A\u6B21 reviewer session \u5DF2\u4E0D\u5B58\u5728");
+    }
+    const reviewerProjection = await this.storage.agentSessions.getActivityById(reviewerSessionId, "workflow-reviewer");
+    if (!reviewerProjection || reviewerProjection.projectId !== projectId) {
+      throw new WorkflowError("reviewer-unavailable", "reviewer session \u4E0D\u5C5E\u4E8E\u5F53\u524D\u9879\u76EE");
+    }
+    if (reviewerProjection.branch !== branch) {
+      throw new WorkflowError("reviewer-unavailable", "reviewer session \u4E0D\u5C5E\u4E8E\u5F53\u524D branch");
+    }
+    if (reviewerProjection.binding === "checkout" && (reviewerProjection.checkoutDeletedAt !== null || reviewerProjection.checkoutStatus !== "ready")) {
+      throw new WorkflowError("reviewer-unavailable", "reviewer session \u7684 workspace checkout \u4E0D\u53EF\u7528");
+    }
+    if (!REVIEWER_AGENT_TYPES.has(reviewerSession.agent_type)) {
+      throw new WorkflowError("reviewer-unavailable", "reviewer agent \u7C7B\u578B\u4E0D\u53EF\u7528");
+    }
+    if (reviewerSession.status !== "stopped") {
+      throw new WorkflowError("reviewer-unavailable", "reviewer session \u6B63\u5728\u8FD0\u884C\u6216\u4E0D\u53EF\u7528");
+    }
+    return reviewerSession;
+  }
+  /**
+   * Put the reviewer back in read-only plan mode if needed and dispatch the
+   * re-review prompt. Reports what happened and decides nothing: the one-shot
+   * start fails its run on a prompt that did not leave, the loop gate returns
+   * to the gate.
+   */
+  async dispatchRereview(opts) {
+    if (opts.reviewerSession.permission_mode !== "plan") {
+      let switched = false;
+      try {
+        switched = await this.agentOps.switchMode(opts.reviewerSession.id, opts.project.path, "plan");
+      } catch {
+      }
+      if (!switched) return { kind: "mode-switch-failed" };
+    }
+    const prompt = buildRereviewerPrompt({
+      taskContext: extractTaskContextBefore(opts.entries, opts.turnEndIndex),
+      // Scoped to the fix turn: an older turn's summary would describe the
+      // pre-review state and mislead the acceptance pass.
+      authorSelfReport: extractAuthorSelfReport(opts.entries, opts.turnEndIndex, { withinTurn: true }),
+      reviewFocus: opts.run.review_focus,
+      target: opts.target
+    });
+    return this.dispatchStep({
+      run: opts.run,
+      kind: "rereview_prompt",
+      role: "reviewer",
+      sessionId: opts.reviewerSession.id,
+      payload: prompt,
+      projectPath: opts.project.path,
+      turn: REVIEWER_TURN
+    });
+  }
+  // ---------- dispatch identity (Phase 2 prerequisite design §2) ----------
+  /**
+   * The user-entry index a step's dispatch was written at. The send path's
+   * evidence hook stores it strictly before stdin, so `null` means stdin was
+   * never written. A fresh reviewer's first instruction goes through the
+   * lifecycle service, which records the same evidence on the session row; the
+   * engine copies it over after activation returns, and this read covers the
+   * gap (a completion or a crash can land first).
+   */
+  async effectiveEntryIndex(step) {
+    if (step.user_entry_index !== null) return step.user_entry_index;
+    if (step.kind !== "reviewer_prompt") return null;
+    const row = await this.storage.agentSessions.getLifecycleById(step.session_id);
+    return row?.activation_user_entry_index ?? null;
+  }
+  /**
+   * A retry must be the SAME instruction. If this run already has an open
+   * step of this kind (its outcome is unknown, or it is still in flight) and
+   * the payload differs, refuse: re-using the key with new content is a ledger
+   * conflict, and silently sending the old content would ignore the edit.
+   * Call BEFORE any run CAS so a refusal leaves the run untouched.
+   */
+  async assertRetryIsSameInstruction(runId, kind, payload) {
+    const open5 = (await this.storage.workflowRunSteps.listByRun(runId)).find((st) => st.kind === kind && st.status === "dispatched");
+    if (open5 && open5.payload_hash !== instructionContentHash(payload)) {
+      throw new WorkflowError("bad-state", "\u4E0A\u4E00\u6B21\u6295\u9012\u7ED3\u679C\u672A\u77E5\uFF1A\u8BF7\u5148\u6309\u539F\u6587\u91CD\u8BD5\uFF0C\u6216\u7ED3\u675F\u672C\u6B21 review \u540E\u91CD\u65B0\u53D1\u8D77\u3002");
+    }
+  }
+  /**
+   * One keyed dispatch to an ALREADY-ACTIVE session (everything except a
+   * fresh reviewer's activation). Only idle sessions are dispatched to, and
+   * the idle check shares the per-session mutex with the user's `/message`
+   * route: a dispatch that lands mid-turn would be queued or injected by the
+   * CLI and could no longer be told apart from the turn it rode in on. An idle
+   * dispatch always opens its own turn, which is what lets attribution be the
+   * single rule "the turn's opening entry is the step's entry".
+   */
+  async dispatchStep(opts) {
+    const steps = this.storage.workflowRunSteps;
+    const stepId = randomUUID7();
+    const { step, reused } = await steps.open({
+      id: stepId,
+      run_id: opts.run.id,
+      role: opts.role,
+      kind: opts.kind,
+      session_id: opts.sessionId,
+      idempotency_key: `run:${opts.run.id}:step:${stepId}`,
+      payload_hash: instructionContentHash(opts.payload)
+    });
+    return serializeSessionMutation(opts.sessionId, async () => {
+      const target = await this.storage.agentSessions.getById(opts.sessionId);
+      if (target?.status === "running") {
+        if (!reused) await steps.abandon(step.id, "target session busy");
+        return { kind: "no_side_effect", busy: true, reason: "target session is mid-turn" };
+      }
+      let runtimeAccepted = false;
+      try {
+        const result = await deliverInstruction({
+          storage: this.storage,
+          sessionId: opts.sessionId,
+          idempotencyKey: step.idempotency_key,
+          rawContent: opts.payload,
+          deliver: async () => {
+            runtimeAccepted = await this.agentOps.sendUserMessage(
+              opts.sessionId,
+              opts.payload,
+              opts.projectPath,
+              void 0,
+              {
+                ...opts.turn,
+                onUserEntryPersisted: async (entryIndex) => {
+                  if (!await steps.setUserEntryIndex(step.id, entryIndex)) throw new DispatchSupersededError();
+                }
+              }
+            );
+            return runtimeAccepted;
+          }
+        });
+        switch (result) {
+          case "delivered":
+          case "replayed":
+            await steps.setError(step.id, null);
+            return { kind: "accepted", step };
+          case "unconfirmed":
+          case "ownership_lost_after_send":
+            console.warn(`[WorkflowEngine] step ${step.id}: delivered but ledger result was ${result}`);
+            return { kind: "accepted", step };
+          case "not_running":
+          case "conflict":
+          case "ownership_lost_before_send":
+            await steps.abandon(step.id, `not delivered: ${result}`);
+            return { kind: "no_side_effect", busy: false, reason: result };
+          case "busy":
+            await steps.setError(step.id, DELIVERY_UNKNOWN_PREFIX);
+            return { kind: "unknown", step, reason: result };
+        }
+      } catch (err) {
+        if (runtimeAccepted) {
+          console.warn(`[WorkflowEngine] step ${step.id}: delivered, then ledger threw:`, err);
+          return { kind: "accepted", step };
+        }
+        await steps.abandon(step.id, `not delivered: ${err instanceof Error ? err.message : String(err)}`);
+        return { kind: "no_side_effect", busy: false, reason: "send threw before stdin" };
+      }
+    });
+  }
   async failRun(run2, error48) {
     if (TERMINAL_STATUSES.has(run2.status)) return;
     const from = run2.status;
@@ -241373,6 +242275,7 @@ var WorkflowEngine = class {
       }
     );
     if (!ok) return;
+    await this.storage.workflowRunSteps.abandonOpenByRun(run2.id, "run failed");
     const failed = await this.storage.workflowRuns.getById(run2.id);
     if (failed) {
       this.untrackRun(failed);
@@ -241480,7 +242383,7 @@ var WorkflowEngine = class {
     if (opts.blind && opts.reviewerSessionId) {
       throw new WorkflowError("reviewer-unavailable", "blind review \u4E0D\u80FD\u590D\u7528\u5DF2\u6709 reviewer session");
     }
-    const runId = opts.runId ?? randomUUID6();
+    const runId = opts.runId ?? randomUUID7();
     const existingRun = opts.runId ? await this.storage.workflowRuns.getById(runId) : void 0;
     if (existingRun) {
       const sameRequest = existingRun.project_id === opts.project.id && existingRun.branch === opts.branch && existingRun.source_session_id === opts.sourceSessionId && existingRun.review_focus === (opts.reviewFocus ?? null) && existingRun.review_span === (opts.reviewSpan ?? "this_turn");
@@ -241536,29 +242439,7 @@ var WorkflowEngine = class {
       }
       const worktreePath = sourceProjection.worktreePath ?? resolveWorktreePath(opts.project.path, opts.branch);
       const target = captureReviewTarget(worktreePath);
-      let reviewerSession = null;
-      if (opts.reviewerSessionId) {
-        reviewerSession = await this.storage.agentSessions.getById(opts.reviewerSessionId);
-        if (!reviewerSession) {
-          throw new WorkflowError("reviewer-unavailable", "\u4E0A\u6B21 reviewer session \u5DF2\u4E0D\u5B58\u5728");
-        }
-        const reviewerProjection = await this.storage.agentSessions.getActivityById(opts.reviewerSessionId, "workflow-reviewer");
-        if (!reviewerProjection || reviewerProjection.projectId !== opts.project.id) {
-          throw new WorkflowError("reviewer-unavailable", "reviewer session \u4E0D\u5C5E\u4E8E\u5F53\u524D\u9879\u76EE");
-        }
-        if (reviewerProjection.branch !== opts.branch) {
-          throw new WorkflowError("reviewer-unavailable", "reviewer session \u4E0D\u5C5E\u4E8E\u5F53\u524D branch");
-        }
-        if (reviewerProjection.binding === "checkout" && (reviewerProjection.checkoutDeletedAt !== null || reviewerProjection.checkoutStatus !== "ready")) {
-          throw new WorkflowError("reviewer-unavailable", "reviewer session \u7684 workspace checkout \u4E0D\u53EF\u7528");
-        }
-        if (!REVIEWER_AGENT_TYPES.has(reviewerSession.agent_type)) {
-          throw new WorkflowError("reviewer-unavailable", "reviewer agent \u7C7B\u578B\u4E0D\u53EF\u7528");
-        }
-        if (reviewerSession.status !== "stopped") {
-          throw new WorkflowError("reviewer-unavailable", "reviewer session \u6B63\u5728\u8FD0\u884C\u6216\u4E0D\u53EF\u7528");
-        }
-      }
+      const reviewerSession = opts.reviewerSessionId ? await this.assertReviewerReusable(opts.reviewerSessionId, opts.project.id, opts.branch) : null;
       if (existingRun && existingRun.source_turn_end_index !== turnEndIndex) {
         throw new WorkflowError("reviewer-unavailable", "workflow run cutoff does not match the replay request");
       }
@@ -241574,7 +242455,8 @@ var WorkflowEngine = class {
         review_span: opts.reviewSpan ?? "this_turn",
         // Reuse skips the preparing state entirely: its prompt is delivered
         // below, before this method returns.
-        status: opts.reviewerSessionId ? "waiting_reviewer" : "preparing"
+        status: opts.reviewerSessionId ? "waiting_reviewer" : "preparing",
+        ...opts.loop ? { loop_id: runId, round: 1, max_rounds: opts.loop.maxRounds } : {}
       });
       this.trackParticipants(run2);
       if (existingRun && !existingRun.reviewer_session_id && !opts.reviewerSessionId && run2.status === "waiting_reviewer") {
@@ -241583,32 +242465,26 @@ var WorkflowEngine = class {
         run2.status = "preparing";
       }
       if (opts.reviewerSessionId && reviewerSession) {
-        if (reviewerSession.permission_mode !== "plan") {
-          let switched = false;
-          try {
-            switched = await this.agentOps.switchMode(opts.reviewerSessionId, opts.project.path, "plan");
-          } catch {
-          }
-          if (!switched) {
-            await this.failRun(run2, "\u65E0\u6CD5\u5C06 reviewer \u6062\u590D\u4E3A\u53EA\u8BFB plan \u6A21\u5F0F");
-            throw new WorkflowError("reviewer-unavailable", "\u65E0\u6CD5\u5C06 reviewer \u6062\u590D\u4E3A\u53EA\u8BFB plan \u6A21\u5F0F");
-          }
-        }
-        const prompt = buildRereviewerPrompt({
-          taskContext: extractTaskContextBefore(entries, turnEndIndex),
-          // Scoped to the fix turn: an older turn's summary would describe the
-          // pre-review state and mislead the acceptance pass.
-          authorSelfReport: extractAuthorSelfReport(entries, turnEndIndex, { withinTurn: true }),
-          reviewFocus: opts.reviewFocus ?? null,
+        const outcome = await this.dispatchRereview({
+          run: run2,
+          reviewerSession,
+          project: opts.project,
+          entries,
+          turnEndIndex,
           target
         });
-        const sent = await this.agentOps.sendUserMessage(opts.reviewerSessionId, prompt, opts.project.path, void 0, REVIEWER_TURN).catch(() => false);
-        if (!sent) {
-          await this.failRun(run2, "\u5411\u4E0A\u6B21 reviewer \u6295\u9012\u590D\u5BA1\u4EFB\u52A1\u5931\u8D25");
-          throw new WorkflowError("send-failed", "\u5411\u4E0A\u6B21 reviewer \u6295\u9012\u590D\u5BA1\u4EFB\u52A1\u5931\u8D25");
+        if (outcome.kind === "mode-switch-failed") {
+          await this.failRun(run2, "\u65E0\u6CD5\u5C06 reviewer \u6062\u590D\u4E3A\u53EA\u8BFB plan \u6A21\u5F0F");
+          throw new WorkflowError("reviewer-unavailable", "\u65E0\u6CD5\u5C06 reviewer \u6062\u590D\u4E3A\u53EA\u8BFB plan \u6A21\u5F0F");
         }
-        this.emitRunUpdated(run2);
-        return run2;
+        if (outcome.kind === "no_side_effect") {
+          const message = outcome.busy ? "\u4E0A\u6B21 reviewer \u6B63\u5728\u8FD0\u884C\uFF0C\u65E0\u6CD5\u6295\u9012\u590D\u5BA1\u4EFB\u52A1" : "\u5411\u4E0A\u6B21 reviewer \u6295\u9012\u590D\u5BA1\u4EFB\u52A1\u5931\u8D25";
+          await this.failRun(run2, message);
+          throw new WorkflowError(outcome.busy ? "session-busy" : "send-failed", message);
+        }
+        const started = outcome.kind === "unknown" ? await this.storage.workflowRuns.update(run2.id, { error: REREVIEW_DELIVERY_UNKNOWN }) ?? run2 : run2;
+        this.emitRunUpdated(started);
+        return started;
       }
       let scope = null;
       let endSnap = null;
@@ -241712,6 +242588,7 @@ var WorkflowEngine = class {
     }
     const pending = this.pendingActivations.get(runId) ?? parsePreparedContext(run2.prepared_context);
     let outcome;
+    let step;
     try {
       const entries = pending ? null : await this.agentOps.getRawMessages(run2.source_session_id);
       const prompt = buildReviewerPrompt({
@@ -241724,6 +242601,15 @@ var WorkflowEngine = class {
         target: JSON.parse(run2.review_target),
         scope: pending?.scope ?? null
       });
+      step = (await this.storage.workflowRunSteps.open({
+        id: randomUUID7(),
+        run_id: run2.id,
+        role: "reviewer",
+        kind: "reviewer_prompt",
+        session_id: run2.reviewer_session_id,
+        idempotency_key: reviewerActivationKey(run2.id),
+        payload_hash: instructionContentHash(prompt)
+      })).step;
       outcome = await this.agentOps.activateReviewer({
         sessionId: run2.reviewer_session_id,
         activationKey: reviewerActivationKey(run2.id),
@@ -241734,6 +242620,9 @@ var WorkflowEngine = class {
       await this.failRun(run2, `\u6FC0\u6D3B reviewer \u5931\u8D25\uFF1A${err instanceof Error ? err.message : String(err)}`);
       throw new WorkflowError("spawn-failed", "\u6FC0\u6D3B reviewer session \u5931\u8D25");
     }
+    if ((outcome.kind === "activated" || outcome.kind === "replayed" || outcome.kind === "uncertain") && outcome.view.userEntryIndex !== null) {
+      await this.storage.workflowRunSteps.setUserEntryIndex(step.id, outcome.view.userEntryIndex);
+    }
     switch (outcome.kind) {
       case "activated":
       case "replayed":
@@ -241765,25 +242654,150 @@ var WorkflowEngine = class {
     this.emitRunUpdated(updated);
     return updated;
   }
+  /**
+   * Attribute a turn completion. One rule (design §2.5): the index of the user
+   * entry that OPENED the completed turn equals the entry index recorded on a
+   * `dispatched` step of this session. Nothing is inferred from "this session
+   * is a reviewer and its run is waiting" — a session is re-used across rounds
+   * and the user talks to it in between.
+   *
+   * The engine is the only claimant. Runs created before steps existed have no
+   * step rows at all and keep the old whole-session rule for one release.
+   */
   async handleTaskCompleted(event) {
-    const p2 = this.participants.get(event.sessionId);
-    if (!p2 || p2.role !== "reviewer") return;
-    const run2 = await this.storage.workflowRuns.getById(p2.runId);
-    if (!run2 || run2.status !== "waiting_reviewer") return;
+    const open5 = await this.storage.workflowRunSteps.getOpenBySession(event.sessionId);
+    if (open5.length === 0) {
+      await this.handleLegacyReviewerCompletion(event);
+      return;
+    }
     const entries = await this.agentOps.getRawMessages(event.sessionId);
     const boundary = event.turnEndEntryIndex ?? extractLatestTurnEndIndex(entries) ?? entries.length;
-    const feedback = extractLastAssistantInTurn(entries, boundary) ?? "(reviewer \u6CA1\u6709\u8F93\u51FA\u53EF\u7528\u7684\u53CD\u9988\u6587\u672C)";
-    let driftNote = null;
+    const openingIndex = findTurnOpeningUserEntryIndex(entries, boundary);
+    let step;
+    if (openingIndex !== null) {
+      for (const candidate of open5) {
+        if (await this.effectiveEntryIndex(candidate) === openingIndex) {
+          step = candidate;
+          break;
+        }
+      }
+    }
+    if (!step) {
+      for (const candidate of open5) {
+        if (candidate.role !== "reviewer") continue;
+        const waiting = await this.storage.workflowRuns.getById(candidate.run_id);
+        if (waiting?.status !== "waiting_reviewer") continue;
+        const noted = await this.storage.workflowRuns.update(waiting.id, {
+          error: "\u6536\u5230 reviewer \u7684\u5B8C\u6210\u4E8B\u4EF6\uFF0C\u4F46\u65E0\u6CD5\u786E\u8BA4\u5B83\u5BF9\u5E94\u672C\u6B21\u6D3E\u53D1\u3002\u8BF7\u6253\u5F00\u5176\u7A97\u53E3\u67E5\u770B\uFF0C\u6216\u7ED3\u675F\u672C\u6B21 review\u3002"
+        });
+        if (noted) this.emitRunUpdated(noted);
+      }
+      return;
+    }
+    await this.claimStep(step, entries, boundary);
+  }
+  /**
+   * Attribute the turn ending at `boundary` to `step`. Shared by the live
+   * completion event and restart reconciliation, so a late claim goes through
+   * exactly the transaction a live one does.
+   */
+  async claimStep(step, entries, boundary) {
+    const output = extractLastAssistantInTurn(entries, boundary);
+    if (step.kind === "feedback") {
+      const run3 = await this.storage.workflowRuns.getById(step.run_id);
+      const nextRun = run3 ? this.nextRoundGate(run3, boundary) : void 0;
+      if (run3 && (run3.status === "sending_feedback" || run3.status === "waiting_feedback")) {
+        const completed = await this.storage.workflowRuns.claimStepAndTransition({
+          stepId: step.id,
+          turnEndIndex: boundary,
+          outputSnapshot: output,
+          run: { id: run3.id, from: run3.status, to: "completed", patch: { error: null } },
+          nextRun
+        });
+        if (completed) {
+          const done = await this.storage.workflowRuns.getById(run3.id);
+          if (done) {
+            this.untrackRun(done);
+            this.emitRunUpdated(done);
+          }
+          await this.announceNextRoundGate(nextRun?.id);
+          return;
+        }
+      }
+      const claimed = await this.storage.workflowRuns.claimStepAndTransition({
+        stepId: step.id,
+        turnEndIndex: boundary,
+        outputSnapshot: output,
+        nextRun
+      });
+      if (claimed) await this.announceNextRoundGate(nextRun?.id);
+      return;
+    }
+    const run2 = await this.storage.workflowRuns.getById(step.run_id);
+    if (!run2 || run2.status !== "waiting_reviewer") return;
+    const feedback = output ?? "(reviewer \u6CA1\u6709\u8F93\u51FA\u53EF\u7528\u7684\u53CD\u9988\u6587\u672C)";
+    const driftNote = await this.computeDriftNote(run2);
+    const ok = await this.storage.workflowRuns.claimStepAndTransition({
+      stepId: step.id,
+      turnEndIndex: boundary,
+      outputSnapshot: feedback,
+      run: {
+        id: run2.id,
+        from: "waiting_reviewer",
+        to: "waiting_feedback",
+        // `error: null` also clears a "delivery outcome unknown" note: the
+        // completion just answered it.
+        // Parsed by exact match; null = unrecognised = the human decides.
+        patch: { feedback_snapshot: feedback, error: driftNote, verdict: parseVerdict(output) },
+        outbox: this.reviewReadyOutbox(run2, step.session_id, boundary)
+      }
+    });
+    if (!ok) return;
+    this.onMilestoneCreated?.();
+    const updated = await this.storage.workflowRuns.getById(run2.id);
+    if (updated) this.emitRunUpdated(updated);
+  }
+  async computeDriftNote(run2) {
     try {
       const target = run2.review_target ? JSON.parse(run2.review_target) : null;
       const project = await this.storage.projects.getById(run2.project_id);
       const sourceProjection = await this.storage.agentSessions.getActivityById(run2.source_session_id, "workflow-reviewer");
       const worktreePath = sourceProjection?.worktreePath ?? (project ? resolveWorktreePath(project.path ?? "", run2.branch) : null);
       if (target && worktreePath && hasDrifted(worktreePath, target)) {
-        driftNote = "\u6CE8\u610F\uFF1Aworkspace \u5728 review \u671F\u95F4\u53D1\u751F\u4E86\u53D8\u5316\uFF0C\u90E8\u5206\u53CD\u9988\u53EF\u80FD\u9488\u5BF9\u7684\u4E0D\u662F\u88AB\u5BA1\u5DE5\u4F5C\u3002";
+        return "\u6CE8\u610F\uFF1Aworkspace \u5728 review \u671F\u95F4\u53D1\u751F\u4E86\u53D8\u5316\uFF0C\u90E8\u5206\u53CD\u9988\u53EF\u80FD\u9488\u5BF9\u7684\u4E0D\u662F\u88AB\u5BA1\u5DE5\u4F5C\u3002";
       }
     } catch {
     }
+    return null;
+  }
+  reviewReadyOutbox(run2, reviewerSessionId, boundary) {
+    return {
+      id: reviewReadyId(run2.id, boundary),
+      kind: "review_ready",
+      project_id: run2.project_id,
+      branch: run2.branch,
+      // Target the reviewer: that's where the feedback and the
+      // approve/discard controls are.
+      session_id: reviewerSessionId,
+      workflow_run_id: run2.id,
+      created_at: Date.now()
+    };
+  }
+  /**
+   * Pre-step runs only (created before `workflow_run_steps` existed): the old
+   * whole-session rule. A run that HAS step rows never comes through here — a
+   * completion it cannot attribute is not accepted. Remove after one release.
+   */
+  async handleLegacyReviewerCompletion(event) {
+    const p2 = this.participants.get(event.sessionId);
+    if (!p2 || p2.role !== "reviewer") return;
+    const run2 = await this.storage.workflowRuns.getById(p2.runId);
+    if (!run2 || run2.status !== "waiting_reviewer") return;
+    if (await this.storage.workflowRunSteps.hasAny(run2.id)) return;
+    const entries = await this.agentOps.getRawMessages(event.sessionId);
+    const boundary = event.turnEndEntryIndex ?? extractLatestTurnEndIndex(entries) ?? entries.length;
+    const feedback = extractLastAssistantInTurn(entries, boundary) ?? "(reviewer \u6CA1\u6709\u8F93\u51FA\u53EF\u7528\u7684\u53CD\u9988\u6587\u672C)";
+    const driftNote = await this.computeDriftNote(run2);
     const ok = await this.storage.workflowRuns.transitionWithOutbox(
       run2.id,
       "waiting_reviewer",
@@ -241792,17 +242806,7 @@ var WorkflowEngine = class {
         feedback_snapshot: feedback,
         ...driftNote ? { error: driftNote } : {}
       },
-      {
-        id: reviewReadyId(run2.id, boundary),
-        kind: "review_ready",
-        project_id: run2.project_id,
-        branch: run2.branch,
-        // Target the reviewer: that's where the feedback and the
-        // approve/discard controls are.
-        session_id: event.sessionId,
-        workflow_run_id: run2.id,
-        created_at: Date.now()
-      }
+      this.reviewReadyOutbox(run2, event.sessionId, boundary)
     );
     if (!ok) return;
     this.onMilestoneCreated?.();
@@ -241814,20 +242818,38 @@ var WorkflowEngine = class {
     if (!run2 || run2.status !== "waiting_feedback") {
       throw new WorkflowError("bad-state", "run \u4E0D\u5728\u7B49\u5F85\u53CD\u9988\u786E\u8BA4\u7684\u72B6\u6001");
     }
+    const feedback = editedPayload ?? run2.feedback_snapshot ?? "";
+    const payload = buildFeedbackMessage(feedback);
+    await this.assertRetryIsSameInstruction(runId, "feedback", payload);
+    const sourceSession = await this.storage.agentSessions.getById(run2.source_session_id);
+    if (sourceSession?.status === "running") {
+      throw new WorkflowError("session-busy", "source session \u6B63\u5728\u8FD0\u884C\uFF0C\u8BF7\u7B49\u5F85\u5176\u5B8C\u6210\u540E\u518D\u53D1\u9001\u53CD\u9988");
+    }
     const claimed = await this.storage.workflowRuns.transition(runId, "waiting_feedback", "sending_feedback", {
       ...editedPayload !== void 0 ? { feedback_snapshot: editedPayload } : {},
       error: null
       // clear stale warnings (error column is nullable)
     });
     if (!claimed) throw new WorkflowError("bad-state", "run \u72B6\u6001\u5DF2\u53D8\u5316\uFF08\u53EF\u80FD\u5DF2\u88AB\u5904\u7406\uFF09");
-    const feedback = editedPayload ?? run2.feedback_snapshot ?? "";
     const project = await this.storage.projects.getById(run2.project_id);
-    const ok = await this.agentOps.sendUserMessage(run2.source_session_id, buildFeedbackMessage(feedback), project?.path ?? void 0, void 0, FEEDBACK_TURN).catch(() => false);
-    if (!ok) {
-      await this.storage.workflowRuns.transition(runId, "sending_feedback", "waiting_feedback", {
-        error: "\u53D1\u9001\u5931\u8D25\uFF1A\u76EE\u6807 session \u53EF\u80FD\u672A\u8FD0\u884C\u3002\u8BF7\u5728\u5176\u7A97\u53E3\u4E2D\u5524\u9192\u540E\u91CD\u8BD5\uFF0C\u6216\u7ED3\u675F\u672C\u6B21 review\u3002"
-      });
-      throw new WorkflowError("send-failed", "\u53D1\u9001\u53CD\u9988\u5931\u8D25");
+    const outcome = await this.dispatchStep({
+      run: run2,
+      kind: "feedback",
+      role: "source",
+      sessionId: run2.source_session_id,
+      payload,
+      projectPath: project?.path ?? void 0,
+      turn: FEEDBACK_TURN
+    });
+    if (outcome.kind !== "accepted") {
+      const error48 = outcome.kind === "unknown" ? `${DELIVERY_UNKNOWN_PREFIX}\uFF1A\u53CD\u9988\u53EF\u80FD\u5DF2\u9001\u8FBE source session\u3002\u8BF7\u68C0\u67E5\u5176\u7A97\u53E3\uFF1B\u518D\u6B21\u786E\u8BA4\u4F1A\u6309\u539F\u6587\u91CD\u8BD5\uFF08\u5DF2\u9001\u8FBE\u5219\u4E0D\u4F1A\u91CD\u590D\u53D1\u9001\uFF09\u3002` : outcome.busy ? "source session \u6B63\u5728\u8FD0\u884C\uFF0C\u8BF7\u7B49\u5F85\u5176\u5B8C\u6210\u540E\u518D\u53D1\u9001\u53CD\u9988\u3002" : "\u53D1\u9001\u5931\u8D25\uFF1A\u76EE\u6807 session \u53EF\u80FD\u672A\u8FD0\u884C\u3002\u8BF7\u5728\u5176\u7A97\u53E3\u4E2D\u5524\u9192\u540E\u91CD\u8BD5\uFF0C\u6216\u7ED3\u675F\u672C\u6B21 review\u3002";
+      await this.storage.workflowRuns.transition(runId, "sending_feedback", "waiting_feedback", { error: error48 });
+      const rolled = await this.storage.workflowRuns.getById(runId);
+      if (rolled) this.emitRunUpdated(rolled);
+      if (outcome.kind === "no_side_effect" && outcome.busy) {
+        throw new WorkflowError("session-busy", "source session \u6B63\u5728\u8FD0\u884C\uFF0C\u8BF7\u7B49\u5F85\u5176\u5B8C\u6210\u540E\u518D\u53D1\u9001\u53CD\u9988");
+      }
+      throw new WorkflowError("send-failed", outcome.kind === "unknown" ? "\u53CD\u9988\u6295\u9012\u7ED3\u679C\u672A\u77E5" : "\u53D1\u9001\u53CD\u9988\u5931\u8D25");
     }
     const completedOk = await this.storage.workflowRuns.transition(runId, "sending_feedback", "completed");
     if (!completedOk) {
@@ -241849,7 +242871,7 @@ var WorkflowEngine = class {
    */
   async requestFinalVerdict(runId) {
     const run2 = await this.storage.workflowRuns.getById(runId);
-    if (!run2 || run2.status !== "discussing" || !run2.reviewer_session_id) {
+    if (!run2 || !run2.reviewer_session_id || run2.status !== "discussing") {
       throw new WorkflowError("bad-state", "run \u4E0D\u5728\u8BA8\u8BBA\u72B6\u6001");
     }
     const reviewerSession = await this.storage.agentSessions.getById(run2.reviewer_session_id);
@@ -241859,10 +242881,25 @@ var WorkflowEngine = class {
     const claimed = await this.storage.workflowRuns.transition(runId, "discussing", "waiting_reviewer", { error: null });
     if (!claimed) throw new WorkflowError("bad-state", "run \u72B6\u6001\u5DF2\u53D8\u5316\uFF08\u53EF\u80FD\u5DF2\u88AB\u5904\u7406\uFF09");
     const project = await this.storage.projects.getById(run2.project_id);
-    const sent = await this.agentOps.sendUserMessage(run2.reviewer_session_id, FINAL_VERDICT_PROMPT, project?.path ?? void 0, void 0, REVIEWER_TURN).catch(() => false);
-    if (!sent) {
+    const outcome = await this.dispatchStep({
+      run: run2,
+      kind: "final_verdict",
+      role: "reviewer",
+      sessionId: run2.reviewer_session_id,
+      payload: FINAL_VERDICT_PROMPT,
+      projectPath: project?.path ?? void 0,
+      turn: REVIEWER_TURN
+    });
+    if (outcome.kind === "unknown") {
+      const noted = await this.storage.workflowRuns.update(runId, {
+        error: `${DELIVERY_UNKNOWN_PREFIX}\uFF1A\u7EC8\u7A3F\u8BF7\u6C42\u53EF\u80FD\u5DF2\u9001\u8FBE reviewer\u3002\u82E5\u5176\u5B8C\u6210\uFF0C\u7ED3\u679C\u4F1A\u81EA\u52A8\u5F52\u5C5E\uFF1B\u5426\u5219\u53EF\u5728 reviewer \u7A97\u53E3\u7EE7\u7EED\u5BF9\u8BDD\u540E\u91CD\u65B0\u751F\u6210\u7EC8\u7A3F\uFF0C\u6216\u7ED3\u675F\u672C\u6B21 review\u3002`
+      });
+      if (noted) this.emitRunUpdated(noted);
+      throw new WorkflowError("send-failed", "\u7EC8\u7A3F\u8BF7\u6C42\u6295\u9012\u7ED3\u679C\u672A\u77E5");
+    }
+    if (outcome.kind === "no_side_effect") {
       const rolledBack = await this.storage.workflowRuns.transition(runId, "waiting_reviewer", "discussing", {
-        error: "\u53D1\u9001\u5931\u8D25\uFF1Areviewer session \u53EF\u80FD\u672A\u8FD0\u884C\u3002\u8BF7\u5728\u5176\u7A97\u53E3\u4E2D\u5524\u9192\u540E\u91CD\u8BD5\uFF0C\u6216\u7ED3\u675F\u672C\u6B21 review\u3002"
+        error: outcome.busy ? "reviewer \u6B63\u5728\u56DE\u590D\u4E2D\uFF0C\u8BF7\u7B49\u5F85\u5176\u5B8C\u6210\u540E\u518D\u751F\u6210\u7EC8\u7A3F\u3002" : "\u53D1\u9001\u5931\u8D25\uFF1Areviewer session \u53EF\u80FD\u672A\u8FD0\u884C\u3002\u8BF7\u5728\u5176\u7A97\u53E3\u4E2D\u5524\u9192\u540E\u91CD\u8BD5\uFF0C\u6216\u7ED3\u675F\u672C\u6B21 review\u3002"
       });
       if (!rolledBack) {
         console.warn(
@@ -241871,6 +242908,7 @@ var WorkflowEngine = class {
       }
       const rolled = await this.storage.workflowRuns.getById(runId);
       if (rolled) this.emitRunUpdated(rolled);
+      if (outcome.busy) throw new WorkflowError("session-busy", "reviewer \u6B63\u5728\u56DE\u590D\u4E2D\uFF0C\u8BF7\u7B49\u5F85\u5176\u5B8C\u6210\u540E\u518D\u751F\u6210\u7EC8\u7A3F");
       throw new WorkflowError("send-failed", "\u5411 reviewer \u53D1\u9001\u7EC8\u7A3F\u8BF7\u6C42\u5931\u8D25");
     }
     const updated = await this.storage.workflowRuns.getById(runId);
@@ -241882,7 +242920,8 @@ var WorkflowEngine = class {
     if (!run2) return void 0;
     if (TERMINAL_STATUSES.has(run2.status)) return run2;
     const patch = reason ? { error: reason } : void 0;
-    const cancelled = await this.storage.workflowRuns.transition(runId, "preparing", "cancelled", patch) || await this.storage.workflowRuns.transition(runId, "waiting_reviewer", "cancelled", patch) || await this.storage.workflowRuns.transition(runId, "waiting_feedback", "cancelled", patch) || await this.storage.workflowRuns.transition(runId, "discussing", "cancelled", patch);
+    const cancelled = await this.storage.workflowRuns.transition(runId, "preparing", "cancelled", patch) || await this.storage.workflowRuns.transition(runId, "waiting_reviewer", "cancelled", patch) || await this.storage.workflowRuns.transition(runId, "waiting_feedback", "cancelled", patch) || await this.storage.workflowRuns.transition(runId, "discussing", "cancelled", patch) || // Declining the next round: the loop ends here.
+    await this.storage.workflowRuns.transition(runId, "waiting_rereview", "cancelled", patch);
     if (!cancelled) {
       const current = await this.storage.workflowRuns.getById(runId);
       if (current?.status === "sending_feedback") {
@@ -241890,6 +242929,7 @@ var WorkflowEngine = class {
       }
       return current;
     }
+    await this.storage.workflowRunSteps.abandonOpenByRun(runId, "run cancelled");
     const updated = await this.storage.workflowRuns.getById(runId);
     if (updated) {
       this.untrackRun(updated);
@@ -241917,7 +242957,10 @@ var WorkflowEngine = class {
     if (!p2) return;
     if (p2.role === "reviewer") {
       try {
-        await this.storage.workflowRuns.transition(p2.runId, "waiting_feedback", "discussing", { error: null }) || await this.storage.workflowRuns.transition(p2.runId, "waiting_reviewer", "discussing", { error: null });
+        const fromGate = await this.storage.workflowRuns.transition(p2.runId, "waiting_feedback", "discussing", { error: null });
+        if (!fromGate && await this.storage.workflowRuns.transition(p2.runId, "waiting_reviewer", "discussing", { error: null })) {
+          await this.storage.workflowRunSteps.abandonOpenByRun(p2.runId, "user started a discussion", "reviewer");
+        }
         const updated = await this.storage.workflowRuns.getById(p2.runId);
         if (updated) this.emitRunUpdated(updated);
       } catch (err) {
@@ -242322,7 +243365,7 @@ var RemotePatchCache = class {
 };
 
 // src/reverse-connect-manager.ts
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 var PING_INTERVAL_MS = 3e4;
 var PONG_TIMEOUT_MS = 1e4;
 var DEFAULT_HTTP_TIMEOUT_MS = 3e4;
@@ -242416,7 +243459,7 @@ var ReverseConnectManager = class {
         errorCode: "network_error"
       };
     }
-    const requestId = randomUUID7();
+    const requestId = randomUUID8();
     const frame = {
       type: "http_request",
       requestId,
@@ -242451,7 +243494,7 @@ var ReverseConnectManager = class {
     if (!conn || conn.ws.readyState !== 1) {
       return { ok: false, status: 0, headers: {}, body: "" };
     }
-    const requestId = randomUUID7();
+    const requestId = randomUUID8();
     const frame = {
       type: "http_request",
       requestId,
@@ -242787,7 +243830,7 @@ var BrowserManager = class {
 };
 
 // src/remote-executor-monitor.ts
-import { randomUUID as randomUUID8 } from "crypto";
+import { randomUUID as randomUUID9 } from "crypto";
 var RemoteExecutorMonitor = class {
   constructor(reverseConnectManager, eventBus, storage2, remoteExecutorMap) {
     this.reverseConnectManager = reverseConnectManager;
@@ -242826,7 +243869,7 @@ var RemoteExecutorMonitor = class {
       console.log(`[RemoteExecutorMonitor] remote ${remoteInfo.remoteServerId} not connected for ${localProcessId}, deferring`);
       return;
     }
-    const channelId = randomUUID8();
+    const channelId = randomUUID9();
     const wsPath = `/api/executor-processes/${remoteInfo.remoteProcessId}/logs`;
     const adapter = new VirtualWsAdapter(
       (data) => rcm.sendChannelData(remoteInfo.remoteServerId, channelId, data),
@@ -242910,7 +243953,7 @@ var RemoteExecutorMonitor = class {
 };
 
 // src/scheduler.ts
-import { createHash as createHash4, randomUUID as randomUUID9 } from "crypto";
+import { createHash as createHash5, randomUUID as randomUUID10 } from "crypto";
 import { existsSync as existsSync5 } from "fs";
 import path8 from "path";
 var OUTPUT_CAP = 2e5;
@@ -242918,7 +243961,7 @@ var RUNS_KEEP = 50;
 var CLAIM_LEASE_MS = 3e4;
 var CLAIM_HEARTBEAT_MS = 1e4;
 function effectFingerprint(value) {
-  return createHash4("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash5("sha256").update(JSON.stringify(value)).digest("hex");
 }
 var REPORT_INSTRUCTION = "\n\n---\nWhen the task is complete, end your final message with a concise Markdown report: what you did, files changed, key results, and any problems encountered.";
 function buildRunContent(task) {
@@ -242949,7 +243992,7 @@ var SchedulerService = class {
   storage;
   processManager;
   remote;
-  ownerToken = randomUUID9();
+  ownerToken = randomUUID10();
   jobs = /* @__PURE__ */ new Map();
   /** scheduleId -> runId of the currently active run (overlap guard). */
   activeRuns = /* @__PURE__ */ new Map();
@@ -243046,7 +244089,7 @@ var SchedulerService = class {
   async executeRun(scheduleId, preallocatedRunId) {
     const task = await this.storage.scheduledTasks.getById(scheduleId);
     if (!task) return { error: "Schedule not found" };
-    const runId = preallocatedRunId ?? randomUUID9();
+    const runId = preallocatedRunId ?? randomUUID10();
     const activeRunId = this.activeRuns.get(scheduleId);
     if (activeRunId) {
       if (activeRunId === runId) return { runId, skipped: false };
@@ -243976,7 +245019,7 @@ var SessionRetentionSweeper = class {
 };
 
 // src/agent-session-lifecycle.ts
-import { createHash as createHash5, randomUUID as randomUUID10 } from "node:crypto";
+import { createHash as createHash6, randomUUID as randomUUID11 } from "node:crypto";
 function lifecycleHttpStatus(kind) {
   switch (kind) {
     case "activated":
@@ -244073,7 +245116,7 @@ var ActivationLeaseLostError = class extends Error {
 };
 function hashInstruction(instruction) {
   const canonical = typeof instruction === "string" ? JSON.stringify({ text: instruction }) : JSON.stringify(instruction);
-  return createHash5("sha256").update(canonical).digest("hex");
+  return createHash6("sha256").update(canonical).digest("hex");
 }
 var branchOf = (row) => row.branch === "" ? null : row.branch;
 function viewOf(row, now3) {
@@ -244130,7 +245173,8 @@ var AgentSessionLifecycleService = class {
       model: input.model,
       purpose: input.purpose,
       owner: input.owner,
-      startSnapshot: input.startSnapshot
+      startSnapshot: input.startSnapshot,
+      grants: input.grants
     });
     if (prepared.kind === "idempotency_conflict" || prepared.kind === "workspace_unavailable") return prepared;
     if (prepared.kind === "expired") return { kind: "expired", view: prepared.view };
@@ -244167,8 +245211,11 @@ var AgentSessionLifecycleService = class {
     }
     const projectPath = await this.resolveProjectPath(input.projectId);
     if (!projectPath) return { kind: "workspace_unavailable", detail: "project not found" };
-    const sessionId = input.sessionId ?? randomUUID10();
+    const sessionId = input.sessionId ?? randomUUID11();
     const model = input.model?.trim() ? input.model.trim() : null;
+    if (input.grants) {
+      await this.storage.sessionRemoteGrants.replace(sessionId, input.grants.userId, input.grants.remoteServerIds);
+    }
     try {
       await this.runtime.prepareSessionRow({
         sessionId,
@@ -244186,7 +245233,15 @@ var AgentSessionLifecycleService = class {
       });
     } catch (error48) {
       const raced = await this.storage.agentSessions.getLifecycleByPrepareOperationId(input.operationId);
-      if (raced) return this.replayPrepare(raced, input, now3);
+      if (raced) {
+        if (input.grants && raced.id !== sessionId) {
+          await this.storage.sessionRemoteGrants.deleteBySession(sessionId).catch(() => {
+          });
+        }
+        return this.replayPrepare(raced, input, now3);
+      }
+      if (input.grants) await this.storage.sessionRemoteGrants.deleteBySession(sessionId).catch(() => {
+      });
       if (error48 instanceof WorkspaceCheckoutUnavailableError || /workspace checkout/i.test(String(error48?.message))) {
         return { kind: "workspace_unavailable", detail: error48.message };
       }
@@ -244218,7 +245273,7 @@ var AgentSessionLifecycleService = class {
   // -------------------------------------------------------------------------
   async activate(input) {
     const contentHash = hashInstruction(input.instruction);
-    const leaseOwner = randomUUID10();
+    const leaseOwner = randomUUID11();
     for (let pass = 0; pass < 3; pass++) {
       const now3 = this.now();
       const row2 = await this.storage.agentSessions.getLifecycleById(input.sessionId);
@@ -244330,11 +245385,18 @@ var AgentSessionLifecycleService = class {
         const view = viewOf(beforeSend, this.now());
         return beforeSend.lifecycle_state === "expired" ? { kind: "expired", view } : { kind: "activation_conflict", view };
       }
+      if (input.grants) {
+        await this.storage.sessionRemoteGrants.replace(sessionId, input.grants.userId, input.grants.remoteServerIds);
+      }
+      const instruction = await appendRemoteGrantContext(this.storage, sessionId, input.userId, input.instruction).catch((err) => {
+        console.error(`[SessionLifecycle] grant context build failed for ${sessionId}:`, err);
+        return input.instruction;
+      });
       let userEntryIndex = null;
       let accepted = false;
       let sendError;
       try {
-        accepted = await this.runtime.sendUserMessage(sessionId, input.instruction, projectPath, input.userId ?? "local", {
+        accepted = await this.runtime.sendUserMessage(sessionId, instruction, projectPath, input.userId ?? "local", {
           origin: input.origin,
           notificationDisposition: input.notificationDisposition,
           onUserEntryPersisted: async (entryIndex) => {
@@ -244521,7 +245583,7 @@ var AgentSessionLifecycleService = class {
 };
 
 // src/remote-session-lifecycle.ts
-import { randomUUID as randomUUID11 } from "node:crypto";
+import { randomUUID as randomUUID12 } from "node:crypto";
 var LIFECYCLE_PREPARE_CAPABILITY = "http:POST /api/path/agent-sessions/prepare";
 function parseWorkerBody(data) {
   if (!data || typeof data !== "object") return null;
@@ -244579,6 +245641,12 @@ var RemoteSessionLifecycleAdapter = class {
       this.deps.remoteSessionMap.set(localSessionId, { remoteServerId: params.remoteServerId, remoteSessionId, branch: params.branch });
     }
     const crossRemoteMcp = await this.mintFor(localSessionId, params.userId, params.remoteServerId);
+    const frozen = await this.withFrozenGrantContext(localSessionId, params.userId, params.instruction);
+    if (!frozen.ok) {
+      if (preRegistered) this.deps.remoteSessionMap.delete(localSessionId);
+      return { kind: "remote_unreachable", status: 0, detail: frozen.error };
+    }
+    const instruction = frozen.instruction;
     const activityAt = this.now();
     const result = await proxyToRemoteAuto(
       params.remoteServerId,
@@ -244594,7 +245662,7 @@ var RemoteSessionLifecycleAdapter = class {
         operationId: params.operationId,
         purpose: params.purpose,
         owner: params.owner ?? null,
-        instruction: params.instruction,
+        instruction,
         force: params.force === true,
         origin: params.origin,
         notificationDisposition: params.notificationDisposition,
@@ -244640,8 +245708,11 @@ var RemoteSessionLifecycleAdapter = class {
       if (!same) return { kind: "idempotency_conflict", view: null, detail: "same prepare operation with different configuration" };
       return { kind: "ids", localSessionId: existing.local_session_id, remoteSessionId: existing.remote_session_id, existing };
     }
-    const remoteSessionId = params.remoteSessionId ?? randomUUID11();
+    const remoteSessionId = params.remoteSessionId ?? randomUUID12();
     const localSessionId = params.localSessionId ?? `remote-${params.remoteServerId}-${params.projectId}-${remoteSessionId}`;
+    if (params.grantedRemoteIds) {
+      await this.deps.storage.sessionRemoteGrants.replace(localSessionId, params.userId ?? "", params.grantedRemoteIds);
+    }
     await intents.begin({
       localSessionId,
       remoteSessionId,
@@ -244658,6 +245729,30 @@ var RemoteSessionLifecycleAdapter = class {
     });
     return { kind: "ids", localSessionId, remoteSessionId, existing: void 0 };
   }
+  /**
+   * The grant block for a remote session's FIRST instruction, frozen on the
+   * intent row (§6).
+   *
+   * The worker hashes the whole instruction to decide whether a retry of the
+   * same activation key is a replay or a conflict, and a failed activation
+   * (`resident_limit`, `spawn_failed`) keeps that hash. Regenerating the block
+   * from current grants would therefore turn "activation failed, user grants
+   * the machine, retries" — the very flow the composer invites — into
+   * `idempotency_conflict`. So the first text wins for every later attempt;
+   * the gateway still judges by the live grant table, and the next ordinary
+   * message regenerates the block from scratch.
+   */
+  async withFrozenGrantContext(localSessionId, userId, instruction) {
+    let frozen;
+    try {
+      const fresh = await buildRemoteGrantContext(this.deps.storage, localSessionId, userId) ?? "";
+      frozen = await this.deps.storage.remoteSessionCreationIntents.setFirstTurnGrantContext(localSessionId, fresh) ?? fresh;
+    } catch (err) {
+      console.error(`[RemoteLifecycle] grant context freeze failed for ${localSessionId}:`, err);
+      return { ok: false, error: `grant context could not be recorded: ${err?.message ?? err}` };
+    }
+    return { ok: true, instruction: appendContextBlock(instruction, frozen.length > 0 ? frozen : null) };
+  }
   mintFor(localSessionId, userId, remoteServerId) {
     return mintCrossRemoteMcpConfig(
       { storage: this.deps.storage },
@@ -244711,6 +245806,14 @@ var RemoteSessionLifecycleAdapter = class {
     const target = await this.resolve(params.localSessionId);
     if (!target) return { kind: "not_found" };
     const { remoteServerId, remoteSessionId, projectId, branch, remotePath, mapping, intent } = target;
+    if (params.grantedRemoteIds) {
+      await this.deps.storage.sessionRemoteGrants.replace(params.localSessionId, params.userId ?? "", params.grantedRemoteIds);
+    }
+    const frozen = await this.withFrozenGrantContext(params.localSessionId, params.userId, params.instruction);
+    if (!frozen.ok) {
+      return { kind: "remote_unreachable", status: 0, detail: frozen.error };
+    }
+    params = { ...params, instruction: frozen.instruction };
     if (!await this.supports(remoteServerId)) {
       return this.legacyActivate(params, target);
     }
@@ -246380,12 +247483,23 @@ var sharedServices = async (fastify2, opts) => {
         sendAgentInstruction: async (input) => {
           if (input.target === "local") {
             const project = await opts.storage.projects.getById(input.projectId, input.userId);
-            return Boolean(project?.path) && agentSessionManager.sendUserMessage(
-              input.sessionId,
-              input.instruction,
-              project.path,
-              input.userId
-            );
+            if (!project?.path) return false;
+            const projectPath = project.path;
+            return serializeSessionMutation(input.sessionId, async () => {
+              const result2 = await deliverInstruction({
+                storage: opts.storage,
+                sessionId: input.sessionId,
+                idempotencyKey: input.idempotencyKey,
+                rawContent: input.instruction,
+                deliver: () => agentSessionManager.sendUserMessage(
+                  input.sessionId,
+                  input.instruction,
+                  projectPath,
+                  input.userId
+                )
+              });
+              return result2 === "delivered" || result2 === "replayed";
+            });
           }
           const activityAt = Date.now();
           const result = await proxyToRemoteAuto(
@@ -246654,7 +247768,7 @@ var shared_services_default = (0, import_fastify_plugin2.default)(sharedServices
 var import_fastify_plugin3 = __toESM(require_plugin2(), 1);
 import path10 from "path";
 import { exec as exec3 } from "child_process";
-import { randomUUID as randomUUID12 } from "crypto";
+import { randomUUID as randomUUID13 } from "crypto";
 import { readdir, mkdir as mkdir3 } from "fs/promises";
 
 // src/dialog.ts
@@ -246783,7 +247897,7 @@ var routes2 = async (fastify2) => {
         return reply.code(409).send({ error: "Project with this path already exists" });
       }
     }
-    const id = randomUUID12();
+    const id = randomUUID13();
     const project = await fastify2.storage.projects.create({
       id,
       name: name25,
@@ -247491,7 +248605,7 @@ var project_remote_routes_default = (0, import_fastify_plugin6.default)(routes5,
 
 // src/routes/executor-routes.ts
 var import_fastify_plugin7 = __toESM(require_plugin2(), 1);
-import { randomUUID as randomUUID13 } from "crypto";
+import { randomUUID as randomUUID14 } from "crypto";
 function normalizeSqlTimestamp(value) {
   if (!value) return null;
   if (value.includes("T") && /(Z|[+-]\d{2}:?\d{2})$/.test(value)) return value;
@@ -247571,7 +248685,7 @@ var routes6 = async (fastify2) => {
     }
     const parsedType2 = executor_type === "prompt" ? "prompt" : "command";
     const parsedProvider = prompt_provider === "codex" ? "codex" : "claude";
-    const id = randomUUID13();
+    const id = randomUUID14();
     const executor = await fastify2.storage.executors.create({
       id,
       project_id: req.params.projectId,
@@ -247664,8 +248778,145 @@ var executor_routes_default = (0, import_fastify_plugin7.default)(routes6, { nam
 // src/routes/process-routes.ts
 var import_fastify_plugin8 = __toESM(require_plugin2(), 1);
 import path11 from "path";
-import { randomUUID as randomUUID14 } from "crypto";
+import { randomUUID as randomUUID16 } from "crypto";
+
+// src/remote-executor-starts.ts
+import { createHash as createHash7, randomUUID as randomUUID15 } from "crypto";
+var IDEMPOTENT_EXECUTE_MIN_WORKER_VERSION = "0.3.1";
+var isTransportFailure = (result) => result.status === 0 || result.errorCode === "timeout" || result.errorCode === "network_error";
+async function listWorkerRunningProcessIds(fastify2, remoteServerId) {
+  const result = await proxyToRemoteAuto(
+    remoteServerId,
+    "GET",
+    "/api/executor-processes/running",
+    void 0,
+    { reverseConnectManager: fastify2.reverseConnectManager }
+  );
+  if (!result.ok) return null;
+  const processes = result.data?.processes;
+  if (!Array.isArray(processes)) return null;
+  const ids = /* @__PURE__ */ new Set();
+  for (const proc of processes) {
+    const id = proc?.id;
+    if (typeof id === "string") ids.add(id);
+  }
+  return ids;
+}
+function createRemoteExecutorStarts(fastify2) {
+  const pending = /* @__PURE__ */ new Map();
+  const supportsIdempotentExecute = async (remoteServerId) => {
+    const server = await fastify2.storage.remoteServers.getById(remoteServerId);
+    const version2 = server?.worker_version;
+    if (!version2) return false;
+    return (compareVersionStrings(version2, IDEMPOTENT_EXECUTE_MIN_WORKER_VERSION) ?? -1) >= 0;
+  };
+  const register = async (start2, remoteProcessId) => {
+    const localProcessId = `remote-${start2.executorId}-${remoteProcessId}`;
+    if (fastify2.remoteExecutorMap.has(localProcessId)) return localProcessId;
+    const remoteInfo = {
+      remoteServerId: start2.remoteServerId,
+      remoteProcessId,
+      executorId: start2.executorId,
+      projectId: start2.projectId
+    };
+    fastify2.remoteExecutorMap.set(localProcessId, remoteInfo);
+    fastify2.remoteExecutorMonitor.watch(localProcessId, remoteInfo);
+    await fastify2.storage.remoteExecutorProcesses.insert(localProcessId, {
+      remoteServerId: start2.remoteServerId,
+      remoteProcessId,
+      executorId: start2.executorId,
+      projectId: start2.projectId,
+      branch: start2.branch ?? void 0,
+      machineId: fastify2.reverseConnectManager.getMachineId(start2.remoteServerId)
+    });
+    fastify2.eventBus.emit({
+      type: "executor:started",
+      projectId: start2.projectId,
+      executorId: start2.executorId,
+      processId: localProcessId,
+      target: start2.remoteServerId
+    });
+    return localProcessId;
+  };
+  const start = async (request) => {
+    for (const [localProcessId, info] of fastify2.remoteExecutorMap) {
+      if (info.executorId === request.executorId && info.remoteServerId === request.remoteServerId) {
+        return { kind: "already_running", processId: localProcessId };
+      }
+    }
+    const key2 = `${request.executorId}:${request.remoteServerId}`;
+    let entry = pending.get(key2);
+    if (entry?.inFlight) return { kind: "starting" };
+    if (!entry) {
+      entry = {
+        ...request,
+        processId: randomUUID15(),
+        effectFingerprint: createHash7("sha256").update(JSON.stringify({ executorId: request.executorId, remoteServerId: request.remoteServerId, body: request.body })).digest("hex"),
+        inFlight: false
+      };
+      pending.set(key2, entry);
+    }
+    const current = entry;
+    current.inFlight = true;
+    try {
+      const result = await proxyToRemoteAuto(
+        current.remoteServerId,
+        "POST",
+        "/api/path/execute",
+        { ...current.body, processId: current.processId, effectFingerprint: current.effectFingerprint },
+        { reverseConnectManager: fastify2.reverseConnectManager }
+      );
+      if (result.ok) {
+        pending.delete(key2);
+        const remoteProcessId = result.data.processId;
+        return { kind: "started", processId: await register(current, remoteProcessId) };
+      }
+      if (isTransportFailure(result)) {
+        if (!await supportsIdempotentExecute(current.remoteServerId)) pending.delete(key2);
+        const reason = result.data?.error ?? "Remote server unreachable";
+        return { kind: "unknown", error: reason };
+      }
+      pending.delete(key2);
+      return { kind: "rejected", result };
+    } finally {
+      current.inFlight = false;
+    }
+  };
+  const reconcile = async (remoteServerId) => {
+    const candidates = [...pending.entries()].filter(
+      ([, entry]) => entry.remoteServerId === remoteServerId && !entry.inFlight
+    );
+    if (candidates.length === 0) return;
+    for (const [, entry] of candidates) entry.inFlight = true;
+    try {
+      const running = await listWorkerRunningProcessIds(fastify2, remoteServerId);
+      if (!running) return;
+      for (const [key2, entry] of candidates) {
+        if (!running.has(entry.processId) || pending.get(key2) !== entry) continue;
+        pending.delete(key2);
+        await register(entry, entry.processId);
+        console.log(`[RemoteExecutorStarts] confirmed start after reconnect: executor=${entry.executorId} target=${remoteServerId} process=${entry.processId}`);
+      }
+    } finally {
+      for (const [, entry] of candidates) entry.inFlight = false;
+    }
+  };
+  fastify2.reverseConnectManager.setStatusChangeHandler((_remoteServerId, status) => {
+    if (status !== "online") return;
+    const servers = new Set([...pending.values()].map((entry) => entry.remoteServerId));
+    for (const serverId of servers) {
+      if (!fastify2.reverseConnectManager.isConnected(serverId)) continue;
+      reconcile(serverId).catch((error48) => {
+        console.error(`[RemoteExecutorStarts] reconcile failed for ${serverId}:`, error48);
+      });
+    }
+  });
+  return { start, reconcile };
+}
+
+// src/routes/process-routes.ts
 var routes7 = async (fastify2) => {
+  const remoteStarts = createRemoteExecutorStarts(fastify2);
   fastify2.post("/api/path/execute", async (req, reply) => {
     const userId = requireAuth(req, reply);
     if (userId === null) return;
@@ -247682,7 +248933,7 @@ var routes7 = async (fastify2) => {
     const resolvedBase = resolveWorktreePath(projectPath, branch ?? null);
     const resolvedCwd = cwd ? path11.join(resolvedBase, cwd) : null;
     const tempExecutor = {
-      id: randomUUID14(),
+      id: randomUUID16(),
       project_id: project.id,
       workspace_id: "",
       name: "remote-command",
@@ -247749,11 +249000,12 @@ var routes7 = async (fastify2) => {
       if (!remoteConfig) {
         return reply.code(400).send({ error: `Remote server configuration not found for executor_mode="${executorMode}"` });
       }
-      const result = await proxyToRemoteAuto(
-        executorMode,
-        "POST",
-        `/api/path/execute`,
-        {
+      const outcome = await remoteStarts.start({
+        executorId: executor.id,
+        projectId: project.id,
+        remoteServerId: executorMode,
+        branch,
+        body: {
           path: remoteConfig.remote_path,
           command: executor.command,
           executor_type: executor.executor_type,
@@ -247761,38 +249013,27 @@ var routes7 = async (fastify2) => {
           branch: branch ?? void 0,
           cwd: executor.cwd || void 0,
           pty: executor.pty
-        },
-        { reverseConnectManager: fastify2.reverseConnectManager }
-      );
-      if (result.ok) {
-        const remoteData = result.data;
-        const localProcessId = `remote-${executor.id}-${remoteData.processId}`;
-        const remoteInfo = {
-          remoteServerId: executorMode,
-          remoteProcessId: remoteData.processId,
-          executorId: executor.id,
-          projectId: project.id
-        };
-        fastify2.remoteExecutorMap.set(localProcessId, remoteInfo);
-        fastify2.remoteExecutorMonitor.watch(localProcessId, remoteInfo);
-        await fastify2.storage.remoteExecutorProcesses.insert(localProcessId, {
-          remoteServerId: executorMode,
-          remoteProcessId: remoteData.processId,
-          executorId: executor.id,
-          projectId: project.id,
-          branch: branch ?? void 0,
-          machineId: fastify2.reverseConnectManager.getMachineId(executorMode)
-        });
-        fastify2.eventBus.emit({
-          type: "executor:started",
-          projectId: project.id,
-          executorId: executor.id,
-          processId: localProcessId,
-          target: executorMode
-        });
-        return reply.code(200).send({ processId: localProcessId });
+        }
+      });
+      switch (outcome.kind) {
+        case "started":
+          return reply.code(200).send({ processId: outcome.processId });
+        case "already_running":
+          return reply.code(409).send({
+            error: "Executor is already running on this target",
+            code: "already_running",
+            processId: outcome.processId
+          });
+        case "starting":
+          return reply.code(409).send({ error: "Executor is already starting on this target", code: "starting" });
+        case "unknown":
+          return reply.code(503).send({
+            error: `Start result unknown (${outcome.error}). Starting again once the remote is back is safe.`,
+            code: "start_unknown"
+          });
+        case "rejected":
+          return reply.code(proxyStatus(outcome.result)).send(outcome.result.data);
       }
-      return reply.code(proxyStatus(result)).send(result.data);
     }
     if (!project.path) {
       return reply.code(400).send({ error: "Project has no local path" });
@@ -247822,15 +249063,27 @@ var routes7 = async (fastify2) => {
           void 0,
           { reverseConnectManager: fastify2.reverseConnectManager }
         );
-        if (result.ok) {
-          fastify2.eventBus.emit({
-            type: "executor:stopped",
-            projectId: remoteInfo.projectId ?? "",
-            executorId: remoteInfo.executorId,
-            processId: req.params.processId,
-            exitCode: 0,
-            target: remoteInfo.remoteServerId
-          });
+        if (!result.ok && result.status === 404) {
+          const running = await listWorkerRunningProcessIds(fastify2, remoteInfo.remoteServerId);
+          if (!running || running.has(remoteInfo.remoteProcessId)) {
+            return reply.code(502).send({
+              error: running ? "Remote process could not be stopped and is still running" : "Remote process could not be stopped and its state could not be verified"
+            });
+          }
+        }
+        if (result.ok || result.status === 404) {
+          fastify2.remoteExecutorMonitor.unwatch(req.params.processId);
+          if (!remoteInfo.stoppedEmitted) {
+            remoteInfo.stoppedEmitted = true;
+            fastify2.eventBus.emit({
+              type: "executor:stopped",
+              projectId: remoteInfo.projectId ?? "",
+              executorId: remoteInfo.executorId,
+              processId: req.params.processId,
+              exitCode: 0,
+              target: remoteInfo.remoteServerId
+            });
+          }
           fastify2.remoteExecutorMap.delete(req.params.processId);
           await fastify2.storage.remoteExecutorProcesses.markFinished(req.params.processId, 0, "killed");
         }
@@ -249529,6 +250782,53 @@ import fs3 from "fs/promises";
 import { createReadStream as createReadStream2, constants as fsConstants } from "fs";
 import { execFile } from "child_process";
 import { promisify as promisify2 } from "util";
+
+// src/artifact-read-targets.ts
+function isOutsideArtifactPath(filePath) {
+  return filePath.startsWith("/") || filePath === "~" || filePath.startsWith("~/");
+}
+var UUID = "[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}";
+var REMOTE_SESSION_PROJECT_RE = new RegExp(`^remote-${UUID}-(${UUID})-`);
+async function sessionBelongsToProject(deps, sessionId, projectId) {
+  const embedded = REMOTE_SESSION_PROJECT_RE.exec(sessionId)?.[1];
+  if (embedded) return embedded === projectId;
+  if (sessionId.startsWith("remote-")) return false;
+  const session = await deps.storage.agentSessions.getById(sessionId);
+  return session?.project_id === projectId;
+}
+async function resolveArtifactReadTargets(deps, opts) {
+  const candidates = [];
+  const sessionId = opts.sessionId && await sessionBelongsToProject(deps, opts.sessionId, opts.projectId) ? opts.sessionId : null;
+  if (sessionId) {
+    const sessionServerId = deps.remoteSessionMap.get(sessionId)?.remoteServerId;
+    if (sessionServerId) candidates.push(sessionServerId);
+    candidates.push(
+      ...await deps.storage.crossRemoteAudit.listSessionTargets(sessionId, opts.userId)
+    );
+  }
+  const targets = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const serverId of candidates) {
+    if (seen.has(serverId)) continue;
+    seen.add(serverId);
+    if (opts.primary?.serverId === serverId) {
+      targets.push(opts.primary);
+      continue;
+    }
+    const link = await deps.storage.projectRemotes.getByProjectAndServer(opts.projectId, serverId);
+    if (link) {
+      targets.push({ serverId, remotePath: link.remote_path, branch: opts.branch ?? null });
+      continue;
+    }
+    const reach = await canReachRemote(deps, opts.userId, serverId, "read");
+    if (reach.ok) targets.push({ serverId, remotePath: "/", branch: null });
+  }
+  if (opts.primary && !seen.has(opts.primary.serverId)) targets.push(opts.primary);
+  return targets;
+}
+
+// src/routes/file-routes.ts
+var SOURCE_SERVER_HEADER = "X-Vibedeckx-Source-Server";
 async function getRemoteConfig3(fastify2, project) {
   const remotes = await fastify2.storage.projectRemotes.getByProject(project.id);
   if (remotes.length === 0) return null;
@@ -249538,6 +250838,42 @@ async function getRemoteConfig3(fastify2, project) {
     remotePath: primary.remote_path
   };
 }
+async function readTargetsFor(fastify2, opts) {
+  const remoteConfig = await getRemoteConfig3(fastify2, opts.project);
+  const primary = remoteConfig ? { ...remoteConfig, branch: opts.branch ?? null } : null;
+  if (!isOutsideArtifactPath(opts.filePath)) return primary ? [primary] : [];
+  return resolveArtifactReadTargets(fastify2, {
+    projectId: opts.project.id,
+    userId: opts.userId,
+    sessionId: opts.sessionId,
+    branch: opts.branch,
+    primary
+  });
+}
+function readParams(target, filePath) {
+  const params = [
+    `path=${encodeURIComponent(target.remotePath)}`,
+    `filePath=${encodeURIComponent(filePath)}`
+  ];
+  if (target.branch) params.push(`branch=${encodeURIComponent(target.branch)}`);
+  return params.join("&");
+}
+async function firstRemoteHit(targets, send) {
+  let firstMiss = null;
+  let firstError = null;
+  for (const target of targets) {
+    const result = await send(target);
+    const attempt = { result, serverId: target.serverId };
+    const status = proxyStatus(result);
+    if (status === 200) return attempt;
+    if (status === 404 || status === 403 || result.status === 0) firstMiss ??= attempt;
+    else firstError ??= attempt;
+  }
+  return firstError ?? firstMiss ?? {
+    result: { ok: false, status: 404, data: { error: "File not found" } },
+    serverId: ""
+  };
+}
 function emitFilesChanged(fastify2, projectId, branch, change) {
   try {
     fastify2.eventBus.emit({ type: "files:changed", projectId, branch, change });
@@ -250058,23 +251394,30 @@ var routes10 = async (fastify2) => {
     const target = req.query.target;
     const useRemote = target === "remote" || !target && !project.path;
     if (useRemote) {
-      const remoteConfig = await getRemoteConfig3(fastify2, project);
-      if (!remoteConfig) {
+      const targets = await readTargetsFor(fastify2, {
+        project,
+        filePath,
+        branch,
+        sessionId: req.query.sessionId,
+        userId
+      });
+      if (targets.length === 0) {
         return reply.code(400).send({ error: "Project has no remote configuration" });
       }
-      const params = [
-        `path=${encodeURIComponent(remoteConfig.remotePath)}`,
-        `filePath=${encodeURIComponent(filePath)}`
-      ];
-      if (branch) params.push(`branch=${encodeURIComponent(branch)}`);
-      const result = await proxyToRemoteAuto(
-        remoteConfig.serverId,
-        "GET",
-        `/api/path/file-content?${params.join("&")}`,
-        void 0,
-        { reverseConnectManager: fastify2.reverseConnectManager }
+      const { result, serverId } = await firstRemoteHit(
+        targets,
+        (target2) => proxyToRemoteAuto(
+          target2.serverId,
+          "GET",
+          `/api/path/file-content?${readParams(target2, filePath)}`,
+          void 0,
+          { reverseConnectManager: fastify2.reverseConnectManager }
+        )
       );
-      return reply.code(proxyStatus(result)).send(result.data);
+      const status = proxyStatus(result);
+      if (status === 200 && serverId) reply.header(SOURCE_SERVER_HEADER, serverId);
+      const body = status === 200 && result.data && typeof result.data === "object" ? { ...result.data, serverId } : result.data;
+      return reply.code(status).send(body);
     }
     if (!project.path) {
       return reply.code(400).send({ error: "Project has no local path" });
@@ -250165,22 +251508,27 @@ var routes10 = async (fastify2) => {
     const target = req.query.target;
     const useRemote = target === "remote" || !target && !project.path;
     if (useRemote) {
-      const remoteConfig = await getRemoteConfig3(fastify2, project);
-      if (!remoteConfig) {
+      const targets = await readTargetsFor(fastify2, {
+        project,
+        filePath,
+        branch,
+        sessionId: req.query.sessionId,
+        userId
+      });
+      if (targets.length === 0) {
         return reply.code(400).send({ error: "Project has no remote configuration" });
       }
-      const params = [
-        `path=${encodeURIComponent(remoteConfig.remotePath)}`,
-        `filePath=${encodeURIComponent(filePath)}`
-      ];
-      if (branch) params.push(`branch=${encodeURIComponent(branch)}`);
-      const result = await proxyToRemoteAuto(
-        remoteConfig.serverId,
-        "GET",
-        `/api/path/file-download?${params.join("&")}`,
-        void 0,
-        { reverseConnectManager: fastify2.reverseConnectManager }
+      const { result, serverId } = await firstRemoteHit(
+        targets,
+        (target2) => proxyToRemoteAuto(
+          target2.serverId,
+          "GET",
+          `/api/path/file-download?${readParams(target2, filePath)}`,
+          void 0,
+          { reverseConnectManager: fastify2.reverseConnectManager }
+        )
       );
+      if (proxyStatus(result) === 200 && serverId) reply.header(SOURCE_SERVER_HEADER, serverId);
       if (Buffer.isBuffer(result.data)) {
         const fileName2 = path13.basename(filePath);
         return reply.code(proxyStatus(result)).header("Content-Disposition", `attachment; filename="${fileName2}"`).type("application/octet-stream").send(result.data);
@@ -250347,7 +251695,7 @@ var import_fastify_plugin12 = __toESM(require_plugin2(), 1);
 import { chmod, mkdir as mkdir4, open as open2 } from "node:fs/promises";
 import { constants as fsConstants2 } from "node:fs";
 import path15 from "node:path";
-import { randomUUID as randomUUID15 } from "node:crypto";
+import { randomUUID as randomUUID17 } from "node:crypto";
 
 // src/utils/temp-file-sweep.ts
 import { readdir as readdir2, rm, stat as stat2 } from "node:fs/promises";
@@ -250392,7 +251740,7 @@ var FILE_FLAGS = fsConstants2.O_WRONLY | fsConstants2.O_CREAT | fsConstants2.O_E
 async function writePasteToTempFile(content) {
   await mkdir4(PASTE_DIR, { recursive: true, mode: DIR_MODE });
   await chmod(PASTE_DIR, DIR_MODE);
-  const filePath = path15.join(PASTE_DIR, `${randomUUID15()}.txt`);
+  const filePath = path15.join(PASTE_DIR, `${randomUUID17()}.txt`);
   const handle = await open2(filePath, FILE_FLAGS, FILE_MODE);
   try {
     await handle.writeFile(content, "utf8");
@@ -250407,7 +251755,7 @@ async function writePasteToTempFile(content) {
 import { chmod as chmod2, mkdir as mkdir5, open as open3 } from "node:fs/promises";
 import { constants as fsConstants3 } from "node:fs";
 import path16 from "node:path";
-import { randomUUID as randomUUID16 } from "node:crypto";
+import { randomUUID as randomUUID18 } from "node:crypto";
 var MAX_ATTACHMENT_BYTES = 20 * 1024 * 1024;
 var ATTACHMENT_BODY_LIMIT = Math.ceil(MAX_ATTACHMENT_BYTES * 4 / 3) + 1024 * 1024;
 var DIR_MODE2 = 448;
@@ -250429,7 +251777,7 @@ async function writeAttachmentToTempFile(rawName, data) {
   const name25 = sanitizeAttachmentName(rawName);
   await mkdir5(ATTACHMENT_DIR, { recursive: true, mode: DIR_MODE2 });
   await chmod2(ATTACHMENT_DIR, DIR_MODE2);
-  const dir = path16.join(ATTACHMENT_DIR, randomUUID16());
+  const dir = path16.join(ATTACHMENT_DIR, randomUUID18());
   await mkdir5(dir, { mode: DIR_MODE2 });
   const filePath = path16.join(dir, name25);
   const handle = await open3(filePath, FILE_FLAGS2, FILE_MODE2);
@@ -250442,8 +251790,30 @@ async function writeAttachmentToTempFile(rawName, data) {
   return { path: filePath, name: name25, size: data.length };
 }
 
+// src/routes/session-ownership.ts
+async function authorizeLocalSession(storage2, sessionId, authResult) {
+  const activity = await storage2.agentSessions.getActivityById(sessionId, "runtime");
+  if (!activity) return false;
+  return Boolean(await storage2.projects.getById(activity.projectId, authResult));
+}
+async function authorizeRemoteSession(storage2, sessionId, authResult) {
+  const { projectId } = await resolveRemoteSessionOwner(storage2, sessionId);
+  if (!projectId) return false;
+  return Boolean(await storage2.projects.getById(projectId, authResult));
+}
+async function resolveRemoteSessionOwner(storage2, sessionId) {
+  const [intent, mapping] = await Promise.all([
+    storage2.remoteSessionCreationIntents.getByLocal(sessionId),
+    storage2.remoteSessionMappings.getByLocal(sessionId)
+  ]);
+  return {
+    projectId: mapping?.project_id ?? intent?.project_id,
+    remoteServerId: mapping?.remote_server_id ?? intent?.remote_server_id
+  };
+}
+
 // src/utils/review-brief.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 var BASE_TIMEOUT_MS = 15e3;
 var JUDGMENT_TIMEOUT_MS = 9e4;
 var TIMEOUT_MS_PER_1K_CHARS = 120;
@@ -250711,7 +252081,7 @@ var BRIEF_CACHE_MAX_ENTRIES = 50;
 var briefCache = /* @__PURE__ */ new Map();
 var briefInFlight = /* @__PURE__ */ new Map();
 function cacheKey(userId, conversation) {
-  return createHash6("sha256").update(userId).update("\0").update(conversation).digest("hex");
+  return createHash8("sha256").update(userId).update("\0").update(conversation).digest("hex");
 }
 function readBriefCache(key2) {
   const hit = briefCache.get(key2);
@@ -250811,7 +252181,7 @@ function workspaceMissingOnRemoteBody(missing) {
 }
 
 // src/routes/agent-session-routes.ts
-import { createHash as createHash7, randomUUID as randomUUID17 } from "crypto";
+import { randomUUID as randomUUID19 } from "crypto";
 
 // src/protocol/model-suggestions.ts
 var MODEL_SUGGESTIONS = {
@@ -250838,45 +252208,6 @@ function messageTextLength(content) {
   return n;
 }
 var routes11 = async (fastify2) => {
-  const instructionReceiverToken = randomUUID17();
-  const instructionDeliveryLocks = /* @__PURE__ */ new Map();
-  const sessionMutationLocks = /* @__PURE__ */ new Map();
-  async function serializeInstructionDelivery(key2, effect) {
-    const previous = instructionDeliveryLocks.get(key2) ?? Promise.resolve();
-    let release;
-    const gate = new Promise((resolve3) => {
-      release = resolve3;
-    });
-    const tail = previous.then(() => gate);
-    instructionDeliveryLocks.set(key2, tail);
-    await previous;
-    try {
-      return await effect();
-    } finally {
-      release();
-      if (instructionDeliveryLocks.get(key2) === tail) instructionDeliveryLocks.delete(key2);
-    }
-  }
-  async function serializeSessionMutation(sessionId, effect) {
-    const previous = sessionMutationLocks.get(sessionId) ?? Promise.resolve();
-    let release;
-    const gate = new Promise((resolve3) => {
-      release = resolve3;
-    });
-    const tail = previous.then(() => gate);
-    sessionMutationLocks.set(sessionId, tail);
-    await previous;
-    try {
-      return await effect();
-    } finally {
-      release();
-      if (sessionMutationLocks.get(sessionId) === tail) sessionMutationLocks.delete(sessionId);
-    }
-  }
-  function instructionContentHash(content) {
-    const canonical = typeof content === "string" ? JSON.stringify({ type: "string", content }) : JSON.stringify(content.map((part) => part.type === "text" ? { type: "text", text: part.text } : { type: "image", mediaType: part.mediaType, data: part.data }));
-    return createHash7("sha256").update(canonical).digest("hex");
-  }
   function proxyAuto(remoteServerId, method, apiPath, body) {
     return proxyToRemoteAuto(remoteServerId, method, apiPath, body, {
       reverseConnectManager: fastify2.reverseConnectManager
@@ -251712,7 +253043,7 @@ var routes11 = async (fastify2) => {
       return reply.code(400).send({ error: "Project has no local path" });
     }
     try {
-      const preSessionId = randomUUID17();
+      const preSessionId = randomUUID19();
       const crossRemoteMcp = await mintCrossRemoteMcpConfig(
         { storage: fastify2.storage },
         { userId, sessionId: preSessionId, sourceRemoteServerId: null }
@@ -251982,22 +253313,39 @@ var routes11 = async (fastify2) => {
     const authResult = requireUserFacingUserId(req, reply);
     if (authResult === null) return;
     const userId = resolveUserId(authResult);
-    const { content, idempotencyKey } = req.body;
+    const { content: rawContent, idempotencyKey } = req.body;
     console.log(`[API] POST /message: sessionId=${req.params.sessionId}, isRemote=${req.params.sessionId.startsWith("remote-")}, remoteMapSize=${fastify2.remoteSessionMap.size}`);
-    const isValidString = typeof content === "string" && content.trim().length > 0;
-    const isValidArray = Array.isArray(content) && content.length > 0;
+    const isValidString = typeof rawContent === "string" && rawContent.trim().length > 0;
+    const isValidArray = Array.isArray(rawContent) && rawContent.length > 0;
     if (!isValidString && !isValidArray) {
       return reply.code(400).send({ error: "Content is required" });
     }
     if (idempotencyKey !== void 0 && (typeof idempotencyKey !== "string" || idempotencyKey.length < 1 || idempotencyKey.length > 512)) {
       return reply.code(400).send({ error: "idempotencyKey must contain 1-512 characters" });
     }
-    const textLen = messageTextLength(content);
+    const textLen = messageTextLength(rawContent);
     if (textLen > MESSAGE_TEXT_CHAR_LIMIT) {
       return reply.code(413).send({
         error: `Message text exceeds ${MESSAGE_TEXT_CHAR_LIMIT} characters (got ${textLen}). Use /api/agent-sessions/:id/paste for long content.`
       });
     }
+    if (req.body.grantedRemoteIds !== void 0) {
+      const raw = req.body.grantedRemoteIds;
+      if (!Array.isArray(raw) || raw.some((id) => typeof id !== "string")) {
+        return reply.code(400).send({ error: "grantedRemoteIds must be an array of strings" });
+      }
+      const owned = req.params.sessionId.startsWith("remote-") ? await authorizeRemoteSession(fastify2.storage, req.params.sessionId, authResult) : await authorizeLocalSession(fastify2.storage, req.params.sessionId, authResult);
+      if (!owned) return reply.code(404).send({ error: "Session not found" });
+      const ids = [...new Set(raw)];
+      const sourceRemoteServerId = req.params.sessionId.startsWith("remote-") ? (await resolveRemoteSessionOwner(fastify2.storage, req.params.sessionId)).remoteServerId : void 0;
+      const rejection = await validateSessionGrantIds(fastify2.storage, ids, authResult, sourceRemoteServerId);
+      if (rejection) return reply.code(400).send({ error: rejection });
+      await fastify2.storage.sessionRemoteGrants.replace(req.params.sessionId, userId, ids);
+    }
+    const content = await appendRemoteGrantContext(fastify2.storage, req.params.sessionId, userId, rawContent).catch((err) => {
+      console.error(`[API] grant context build failed for ${req.params.sessionId}:`, err);
+      return rawContent;
+    });
     if (req.params.sessionId.startsWith("remote-")) {
       const remoteInfo = await getAuthorizedRemoteSessionInfo(req.params.sessionId, authResult);
       if (!remoteInfo) {
@@ -252126,70 +253474,30 @@ var routes11 = async (fastify2) => {
         }
         return reply.code(200).send({ success: true });
       }
-      const deliveryKey = `${req.params.sessionId}\0${idempotencyKey}`;
-      return serializeInstructionDelivery(deliveryKey, async () => {
-        const claim = await fastify2.storage.agentInstructionDeliveries.claim({
-          sessionId: req.params.sessionId,
-          idempotencyKey,
-          contentHash: instructionContentHash(content),
-          claimToken: instructionReceiverToken
-        });
-        if (claim === "conflict") {
+      const result = await deliverInstruction({
+        storage: fastify2.storage,
+        sessionId: req.params.sessionId,
+        idempotencyKey,
+        rawContent,
+        deliver
+      });
+      switch (result) {
+        case "delivered":
+          return reply.code(200).send({ success: true });
+        case "replayed":
+          return reply.code(200).send({ success: true, replayed: true });
+        case "conflict":
           return reply.code(409).send({ error: "Idempotency key was already used with different content" });
-        }
-        if (claim === "sent") return reply.code(200).send({ success: true, replayed: true });
-        if (claim === "busy") {
+        case "busy":
           return reply.code(409).send({ error: "Instruction delivery is already in progress" });
-        }
-        let ownershipLost = false;
-        const renew = async () => {
-          try {
-            if (!await fastify2.storage.agentInstructionDeliveries.renewClaim({
-              sessionId: req.params.sessionId,
-              idempotencyKey,
-              claimToken: instructionReceiverToken
-            })) ownershipLost = true;
-          } catch {
-            ownershipLost = true;
-          }
-        };
-        await renew();
-        const heartbeat = setInterval(() => {
-          void renew();
-        }, 1e4);
-        heartbeat.unref();
-        try {
-          if (ownershipLost) return reply.code(409).send({ error: "Instruction delivery ownership was lost" });
-          if (!await deliver()) {
-            await fastify2.storage.agentInstructionDeliveries.release({
-              sessionId: req.params.sessionId,
-              idempotencyKey,
-              claimToken: instructionReceiverToken
-            });
-            return reply.code(404).send({ error: "Session not found or not running" });
-          }
-          await renew();
-          if (ownershipLost) return reply.code(409).send({ error: "Instruction delivery ownership was lost" });
-          const confirmed = await fastify2.storage.agentInstructionDeliveries.markSent({
-            sessionId: req.params.sessionId,
-            idempotencyKey,
-            claimToken: instructionReceiverToken
-          });
-          if (!confirmed) {
-            return reply.code(503).send({ error: "Instruction delivery could not be confirmed" });
-          }
-          return reply.code(200).send({ success: true });
-        } catch (error48) {
-          await fastify2.storage.agentInstructionDeliveries.release({
-            sessionId: req.params.sessionId,
-            idempotencyKey,
-            claimToken: instructionReceiverToken
-          });
-          throw error48;
-        } finally {
-          clearInterval(heartbeat);
-        }
-      });
+        case "not_running":
+          return reply.code(404).send({ error: "Session not found or not running" });
+        case "ownership_lost_before_send":
+        case "ownership_lost_after_send":
+          return reply.code(409).send({ error: "Instruction delivery ownership was lost" });
+        case "unconfirmed":
+          return reply.code(503).send({ error: "Instruction delivery could not be confirmed" });
+      }
     });
   });
   async function resolveUploadTargetRemoteInfo(sessionId, userId) {
@@ -252576,7 +253884,7 @@ var routes11 = async (fastify2) => {
           messages
         });
       }
-      const preSessionId = randomUUID17();
+      const preSessionId = randomUUID19();
       const crossRemoteMcp = await mintCrossRemoteMcpConfig(
         { storage: fastify2.storage },
         { userId, sessionId: preSessionId, sourceRemoteServerId: null }
@@ -252953,6 +254261,15 @@ var routes12 = async (fastify2, opts) => {
   };
   const ALL_PURPOSES = ["interactive", "interactive_upload", "commander", "project_chat", "workflow_review"];
   const CLIENT_PURPOSES = ["interactive", "interactive_upload"];
+  async function checkGrants(value, userId, sourceRemoteServerId) {
+    if (value === void 0) return { ok: true, ids: void 0 };
+    if (!Array.isArray(value) || value.some((id) => typeof id !== "string")) {
+      return { ok: false, error: "grantedRemoteIds must be an array of strings" };
+    }
+    const ids = [...new Set(value)];
+    const rejection = await validateSessionGrantIds(fastify2.storage, ids, userId, sourceRemoteServerId);
+    return rejection ? { ok: false, error: rejection } : { ok: true, ids };
+  }
   fastify2.post("/api/path/agent-sessions/prepare", async (req, reply) => {
     const authResult = requireAuth(req, reply);
     if (authResult === null) return;
@@ -253034,6 +254351,8 @@ var routes12 = async (fastify2, opts) => {
     if (!validKey(req.body.operationId)) return reply.code(400).send({ error: "operationId must contain 1-512 characters" });
     const purpose = purposeOf(req.body.purpose, CLIENT_PURPOSES);
     if (!purpose) return reply.code(400).send({ error: "Invalid purpose" });
+    const grants = await checkGrants(req.body.grantedRemoteIds, ctx.userId, ctx.remote?.serverId ?? null);
+    if (!grants.ok) return reply.code(400).send({ error: grants.error });
     const common = {
       operationId: req.body.operationId,
       branch: req.body.branch ?? null,
@@ -253054,14 +254373,16 @@ var routes12 = async (fastify2, opts) => {
         projectId: ctx.project.id,
         remoteServerId: ctx.remote.serverId,
         remotePath: ctx.remote.path,
-        userId: ctx.userId
+        userId: ctx.userId,
+        grantedRemoteIds: grants.ids
       });
       return send(reply, result2);
     }
     const result = await fastify2.agentSessionLifecycle.prepare({
       ...common,
       sessionId: typeof req.body.sessionId === "string" ? req.body.sessionId : void 0,
-      projectId: ctx.project.id
+      projectId: ctx.project.id,
+      grants: grants.ids && { userId: ctx.userId, remoteServerIds: grants.ids }
     });
     return send(reply, result);
   });
@@ -253071,6 +254392,8 @@ var routes12 = async (fastify2, opts) => {
     if (!validKey(req.body.operationId)) return reply.code(400).send({ error: "operationId must contain 1-512 characters" });
     if (!validInstruction(req.body.instruction)) return reply.code(400).send({ error: "Instruction is required" });
     if (req.body.purpose !== void 0 && req.body.purpose !== "interactive") return reply.code(400).send({ error: "Invalid purpose" });
+    const grants = await checkGrants(req.body.grantedRemoteIds, ctx.userId, ctx.remote?.serverId ?? null);
+    if (!grants.ok) return reply.code(400).send({ error: grants.error });
     const common = {
       operationId: req.body.operationId,
       branch: req.body.branch ?? null,
@@ -253094,7 +254417,8 @@ var routes12 = async (fastify2, opts) => {
         purpose: "interactive",
         projectId: ctx.project.id,
         remoteServerId: ctx.remote.serverId,
-        remotePath: ctx.remote.path
+        remotePath: ctx.remote.path,
+        grantedRemoteIds: grants.ids
       });
       return send(reply, result2, fallback);
     }
@@ -253105,24 +254429,13 @@ var routes12 = async (fastify2, opts) => {
       purpose: "interactive",
       sessionId,
       projectId: ctx.project.id,
-      crossRemoteMcp
+      crossRemoteMcp,
+      grants: grants.ids && { userId: ctx.userId, remoteServerIds: grants.ids }
     });
     return send(reply, result, fallback);
   });
-  async function authorizeLocal(sessionId, authResult) {
-    const activity = await fastify2.storage.agentSessions.getActivityById(sessionId, "runtime");
-    if (!activity) return false;
-    return Boolean(await fastify2.storage.projects.getById(activity.projectId, authResult));
-  }
-  async function authorizeRemote(sessionId, authResult) {
-    const [intent, mapping] = await Promise.all([
-      fastify2.storage.remoteSessionCreationIntents.getByLocal(sessionId),
-      fastify2.storage.remoteSessionMappings.getByLocal(sessionId)
-    ]);
-    const projectId = mapping?.project_id ?? intent?.project_id;
-    if (!projectId) return false;
-    return Boolean(await fastify2.storage.projects.getById(projectId, authResult));
-  }
+  const authorizeLocal = (sessionId, authResult) => authorizeLocalSession(fastify2.storage, sessionId, authResult);
+  const authorizeRemote = (sessionId, authResult) => authorizeRemoteSession(fastify2.storage, sessionId, authResult);
   fastify2.post("/api/agent-sessions/:sessionId/activate", { bodyLimit: 10 * 1024 * 1024 }, async (req, reply) => {
     const authResult = requireUserFacingUserId(req, reply);
     if (authResult === null) return;
@@ -253139,19 +254452,29 @@ var routes12 = async (fastify2, opts) => {
     if (sessionId.startsWith("remote-")) {
       if (!await authorizeRemote(sessionId, authResult)) return reply.code(404).send({ kind: "not_found", error: "Session not found" });
       const intent = await fastify2.storage.remoteSessionCreationIntents.getByLocal(sessionId);
-      return send(reply, await remote().activate({ ...common, localSessionId: sessionId, userId: authResult }), {
+      const remoteGrants = await checkGrants(req.body.grantedRemoteIds, authResult, intent?.remote_server_id ?? null);
+      if (!remoteGrants.ok) return reply.code(400).send({ error: remoteGrants.error });
+      return send(reply, await remote().activate({
+        ...common,
+        localSessionId: sessionId,
+        userId: authResult,
+        grantedRemoteIds: remoteGrants.ids
+      }), {
         permissionMode: intent?.permission_mode ?? "edit",
         agentType: intent?.agent_type ?? "claude-code",
         model: intent?.model ?? null
       });
     }
     if (!await authorizeLocal(sessionId, authResult)) return reply.code(404).send({ kind: "not_found", error: "Session not found" });
+    const grants = await checkGrants(req.body.grantedRemoteIds, authResult, null);
+    if (!grants.ok) return reply.code(400).send({ error: grants.error });
     const crossRemoteMcp = crossRemoteOf(req.body.crossRemoteMcp) ?? await mintCrossRemoteMcpConfig({ storage: fastify2.storage }, { userId: authResult, sessionId, sourceRemoteServerId: null }).catch(() => void 0);
     const result = await fastify2.agentSessionLifecycle.activate({
       ...common,
       sessionId,
       crossRemoteMcp,
-      userId: resolveUserId(authResult)
+      userId: resolveUserId(authResult),
+      grants: grants.ids && { userId: resolveUserId(authResult), remoteServerIds: grants.ids }
     });
     return send(reply, result, { permissionMode: "edit", agentType: "claude-code", model: null });
   });
@@ -253623,7 +254946,7 @@ var chat_session_routes_default = (0, import_fastify_plugin16.default)(routes15,
 
 // src/routes/project-chat-routes.ts
 var import_fastify_plugin17 = __toESM(require_plugin2(), 1);
-import { createHash as createHash8, randomUUID as randomUUID18 } from "crypto";
+import { createHash as createHash9, randomUUID as randomUUID20 } from "crypto";
 var MAX_TITLE_LENGTH = 200;
 var MAX_MESSAGE_LENGTH = 1e5;
 var THREAD_PAGE_LIMIT = 50;
@@ -253791,20 +255114,20 @@ var routes16 = async (fastify2) => {
     if (!project) return reply.code(404).send({ error: "Project not found" });
     const body = parseCreateBody(req.body);
     if (!body) return reply.code(400).send({ error: "Body must contain only an optional non-empty message" });
-    const createRequestId = body.createRequestId ?? randomUUID18();
-    const createPayloadHash = createHash8("sha256").update(JSON.stringify({ message: body.message ?? null })).digest("hex");
+    const createRequestId = body.createRequestId ?? randomUUID20();
+    const createPayloadHash = createHash9("sha256").update(JSON.stringify({ message: body.message ?? null })).digest("hex");
     let accepted;
     try {
       accepted = await fastify2.storage.projectChatThreads.createIdempotent({
-        id: randomUUID18(),
+        id: randomUUID20(),
         project_id: projectId,
         user_id: userId,
         title: null,
         create_request_id: createRequestId,
         create_payload_hash: createPayloadHash,
         ...body.message !== void 0 ? { initialTurn: {
-          messageId: randomUUID18(),
-          workItemId: randomUUID18(),
+          messageId: randomUUID20(),
+          workItemId: randomUUID20(),
           content: body.message
         } } : {}
       });
@@ -254085,7 +255408,7 @@ var project_activity_routes_default = (0, import_fastify_plugin18.default)(route
 
 // src/routes/task-routes.ts
 var import_fastify_plugin19 = __toESM(require_plugin2(), 1);
-import { randomUUID as randomUUID19 } from "crypto";
+import { randomUUID as randomUUID21 } from "crypto";
 var routes18 = async (fastify2) => {
   fastify2.get(
     "/api/projects/:projectId/tasks",
@@ -254149,7 +255472,7 @@ Description: ${description}`,
         title = description.length > 50 ? description.slice(0, 50) + "..." : description;
       }
     }
-    const id = randomUUID19();
+    const id = randomUUID21();
     const task = await fastify2.storage.tasks.create({
       id,
       project_id: req.params.projectId,
@@ -254250,7 +255573,7 @@ var task_routes_default = (0, import_fastify_plugin19.default)(routes18, { name:
 
 // src/routes/rule-routes.ts
 var import_fastify_plugin20 = __toESM(require_plugin2(), 1);
-import { randomUUID as randomUUID20 } from "crypto";
+import { randomUUID as randomUUID22 } from "crypto";
 var routes19 = async (fastify2) => {
   fastify2.get(
     "/api/projects/:projectId/rules",
@@ -254277,7 +255600,7 @@ var routes19 = async (fastify2) => {
     if (!name25 || !content) {
       return reply.code(400).send({ error: "name and content are required" });
     }
-    const id = randomUUID20();
+    const id = randomUUID22();
     const rule = await fastify2.storage.rules.create({
       id,
       project_id: req.params.projectId,
@@ -254341,7 +255664,7 @@ var rule_routes_default = (0, import_fastify_plugin20.default)(routes19, { name:
 
 // src/routes/command-routes.ts
 var import_fastify_plugin21 = __toESM(require_plugin2(), 1);
-import { randomUUID as randomUUID21 } from "crypto";
+import { randomUUID as randomUUID23 } from "crypto";
 var routes20 = async (fastify2) => {
   fastify2.get(
     "/api/projects/:projectId/commands",
@@ -254368,7 +255691,7 @@ var routes20 = async (fastify2) => {
     if (!name25 || !content) {
       return reply.code(400).send({ error: "name and content are required" });
     }
-    const id = randomUUID21();
+    const id = randomUUID23();
     const command = await fastify2.storage.commands.create({
       id,
       project_id: req.params.projectId,
@@ -254419,6 +255742,15 @@ function parseReviewerAgentType(raw) {
   if (raw === void 0) return void 0;
   return typeof raw === "string" && REVIEWER_AGENT_TYPES.has(raw) ? raw : null;
 }
+function parseLoop(raw) {
+  if (raw === void 0 || raw === null) return void 0;
+  if (typeof raw !== "object") return null;
+  const maxRounds = raw.maxRounds;
+  if (maxRounds === void 0) return { maxRounds: LOOP_MAX_ROUNDS_DEFAULT };
+  if (typeof maxRounds !== "number" || !Number.isInteger(maxRounds) || maxRounds < 1 || maxRounds > LOOP_MAX_ROUNDS_LIMIT) return null;
+  return { maxRounds };
+}
+var LOOP_ERROR = `loop.maxRounds must be an integer between 1 and ${LOOP_MAX_ROUNDS_LIMIT}`;
 function parseReviewSpan(raw) {
   if (raw === void 0) return "this_turn";
   return raw === "this_turn" || raw === "session_start" ? raw : null;
@@ -254644,6 +255976,8 @@ async function routes21(fastify2) {
     if (reviewerAgentType === null) return reply.code(400).send({ error: "reviewerAgentType must be one of: claude-code, codex" });
     const reviewSpan = parseReviewSpan(req.body?.reviewSpan);
     if (reviewSpan === null) return reply.code(400).send({ error: "reviewSpan must be one of: this_turn, session_start" });
+    const loop = parseLoop(req.body?.loop);
+    if (loop === null) return reply.code(400).send({ error: LOOP_ERROR });
     const reviewerSessionIdRaw = req.body?.reviewerSessionId;
     if (reviewerSessionIdRaw !== void 0 && (typeof reviewerSessionIdRaw !== "string" || reviewerSessionIdRaw.trim() === "")) {
       return reply.code(400).send({ error: "reviewerSessionId must be a non-empty string" });
@@ -254701,7 +256035,10 @@ async function routes21(fastify2) {
           sourceTurnEndIndex,
           reviewSpan,
           reviewerSessionId: bareReviewerSessionId,
-          intentBrief: clientBrief
+          intentBrief: clientBrief,
+          // Additive tunnel field: a worker that predates review loops ignores
+          // it and runs a single-pass review (the run comes back without loop_id).
+          loop
         });
         if (!result.ok) return sendProxyFailure(reply, result);
         bareRun = result.data.run;
@@ -254741,6 +256078,7 @@ async function routes21(fastify2) {
           reviewContextMode,
           reviewerAgentType: reviewerAgentType ?? "claude-code",
           intentBrief,
+          loopMaxRounds: loop?.maxRounds,
           userId,
           ...twoPhase ? { phase: "prepare" } : {}
         });
@@ -254807,7 +256145,8 @@ async function routes21(fastify2) {
           reviewFocus,
           sourceTurnEndIndex,
           reviewSpan,
-          reviewerAgentType
+          reviewerAgentType,
+          loop
         });
       } catch (err) {
         const status = errStatus(err);
@@ -254835,7 +256174,8 @@ async function routes21(fastify2) {
         reviewSpan,
         reviewerSessionId,
         intentBrief: clientBrief,
-        blind
+        blind,
+        loop
       });
       return reply.code(201).send({ run: run2 });
     } catch (err) {
@@ -255019,7 +256359,15 @@ async function routes21(fastify2) {
           const run2 = await fastify2.workflowEngine.requestFinalVerdict(req.params.id);
           return reply.send({ run: run2 });
         }
-        return reply.code(400).send({ error: "action must be approve, cancel or finalize" });
+        if (action === "accept") {
+          const run2 = await fastify2.workflowEngine.acceptResult(req.params.id);
+          return reply.send({ run: run2 });
+        }
+        if (action === "rereview") {
+          const run2 = await fastify2.workflowEngine.approveRereview(req.params.id, { extend: req.body?.extend === true });
+          return reply.send({ run: run2 });
+        }
+        return reply.code(400).send({ error: "action must be approve, cancel, finalize, accept or rereview" });
       } catch (err) {
         const status = errStatus(err);
         if (status) return reply.code(status).send({ error: err.message });
@@ -255060,6 +256408,8 @@ async function routes21(fastify2) {
     if (!sourceSessionId) return reply.code(400).send({ error: "sourceSessionId is required" });
     const reviewSpan = parseReviewSpan(req.body?.reviewSpan);
     if (reviewSpan === null) return reply.code(400).send({ error: "reviewSpan must be one of: this_turn, session_start" });
+    const loop = parseLoop(req.body?.loop);
+    if (loop === null) return reply.code(400).send({ error: LOOP_ERROR });
     const reviewContextMode = parseReviewContextMode(req.body?.reviewContextMode);
     if (reviewContextMode === null) return reply.code(400).send({ error: "reviewContextMode must be one of: briefed, blind" });
     const blind = reviewContextMode === "blind";
@@ -255106,6 +256456,7 @@ async function routes21(fastify2) {
         reviewerSessionId,
         intentBrief,
         blind,
+        loop,
         runId: runId || void 0,
         newReviewerSessionId: newReviewerSessionId || void 0
       });
@@ -255135,6 +256486,8 @@ async function routes21(fastify2) {
     if (!sourceSessionId) return reply.code(400).send({ error: "sourceSessionId is required" });
     const reviewSpan = parseReviewSpan(req.body?.reviewSpan);
     if (reviewSpan === null) return reply.code(400).send({ error: "reviewSpan must be one of: this_turn, session_start" });
+    const loop = parseLoop(req.body?.loop);
+    if (loop === null) return reply.code(400).send({ error: LOOP_ERROR });
     const reviewerAgentType = parseReviewerAgentType(req.body?.reviewerAgentType);
     if (reviewerAgentType === null) return reply.code(400).send({ error: "reviewerAgentType must be one of: claude-code, codex" });
     const runId = typeof req.body?.runId === "string" ? req.body.runId.trim() : "";
@@ -255161,6 +256514,7 @@ async function routes21(fastify2) {
           sourceTurnEndIndex,
           reviewSpan,
           reviewerAgentType,
+          loop,
           runId,
           newReviewerSessionId
         });
@@ -255660,7 +257014,7 @@ var translate_routes_default = (0, import_fastify_plugin24.default)(routes23, {
 var import_fastify_plugin25 = __toESM(require_plugin2(), 1);
 
 // src/routes/executor-stream-handlers.ts
-import { randomUUID as randomUUID22 } from "crypto";
+import { randomUUID as randomUUID24 } from "crypto";
 function attachLocalProcessStream(fastify2, processId, send, onTerminal) {
   const noop4 = { cleanup: () => {
   }, handleInput: () => {
@@ -255736,7 +257090,7 @@ function attachRemoteProcessStream(fastify2, processId, send, onTerminal) {
       return;
     }
     console.log(`[diag:remote-stop] ${(/* @__PURE__ */ new Date()).toISOString()} attach processId=${processId} executorId=${info.executorId} server=${info.remoteServerId} transport=reverse-connect remoteProcessId=${info.remoteProcessId}`);
-    const channelId = randomUUID22();
+    const channelId = randomUUID24();
     const wsPath = `/api/executor-processes/${info.remoteProcessId}/logs`;
     const adapter = new VirtualWsAdapter(
       (data) => fastify2.reverseConnectManager.sendChannelData(info.remoteServerId, channelId, data),
@@ -255817,13 +257171,18 @@ function attachRemoteProcessStream(fastify2, processId, send, onTerminal) {
     remoteWs.on("close", async () => {
       clearInterval(pingInterval);
       if (!terminalSignalSent) {
+        let row;
         try {
-          const row = await fastify2.storage.remoteExecutorProcesses.getById(processId);
-          console.log(`[diag:remote-stop] ${(/* @__PURE__ */ new Date()).toISOString()} upstream CLOSE without real finished \u2192 FABRICATING finished processId=${processId} executorId=${info.executorId} transport=reverse-connect dbStatus=${row?.status} dbExitCode=${row?.exit_code ?? "null"} sentExitCode=${row?.exit_code ?? 0} \u2014 THIS flips UI to Stopped while remote process may still be running`);
-          send({ type: "finished", exitCode: row?.exit_code ?? 0 });
+          row = await fastify2.storage.remoteExecutorProcesses.getById(processId);
         } catch (error48) {
           console.error(`[ExecutorStream] Failed to fetch process row on close:`, error48);
-          send({ type: "finished", exitCode: 0 });
+        }
+        if (row && row.status !== "running") {
+          console.log(`[diag:remote-stop] ${(/* @__PURE__ */ new Date()).toISOString()} upstream CLOSE without real finished, row already terminal processId=${processId} dbStatus=${row.status} dbExitCode=${row.exit_code ?? "null"}`);
+          send({ type: "finished", exitCode: row.exit_code ?? 0 });
+        } else {
+          console.log(`[diag:remote-stop] ${(/* @__PURE__ */ new Date()).toISOString()} upstream CLOSE without real finished processId=${processId} executorId=${info.executorId} dbStatus=${row?.status ?? "missing"} \u2014 sending retryable error, process state unchanged`);
+          send({ type: "error", message: "Remote connection lost", retryable: true });
         }
         terminalSignalSent = true;
       } else {
@@ -256499,7 +257858,7 @@ var websocket_routes_default = (0, import_fastify_plugin25.default)(routes24, {
 
 // src/routes/reverse-connect-routes.ts
 var import_fastify_plugin26 = __toESM(require_plugin2(), 1);
-import { randomBytes as randomBytes4, createHash as createHash9, verify as cryptoVerify } from "crypto";
+import { randomBytes as randomBytes4, createHash as createHash10, verify as cryptoVerify } from "crypto";
 
 // src/utils/rate-limited-warn.ts
 function createRateLimitedWarn(windowMs, maxKeys) {
@@ -256649,7 +258008,7 @@ var routes25 = async (fastify2) => {
               socket.close(4003, "Bad machine signature");
               return;
             }
-            const fingerprint = createHash9("sha256").update(publicKey).digest("hex");
+            const fingerprint = createHash10("sha256").update(publicKey).digest("hex");
             const { owned, created } = await fastify2.storage.machineIdentity.claimOrVerify(fingerprint, publicKey, ownerId);
             if (!owned) {
               console.warn(`[ReverseConnect] Machine ${fingerprint.slice(0, 12)} owner mismatch \u2014 rejecting ${serverId}`);
@@ -257016,7 +258375,7 @@ var browser_routes_default = (0, import_fastify_plugin29.default)(routes28, { na
 
 // src/routes/browser-proxy-routes.ts
 var import_fastify_plugin30 = __toESM(require_plugin2(), 1);
-import { randomUUID as randomUUID23 } from "crypto";
+import { randomUUID as randomUUID25 } from "crypto";
 
 // src/utils/ssrf-guard.ts
 var import_undici2 = __toESM(require_undici(), 1);
@@ -257606,7 +258965,7 @@ var routes29 = async (fastify2) => {
     const rcm = fastify2.reverseConnectManager;
     if (resolved.remoteServerId && rcm.isConnected(resolved.remoteServerId)) {
       const remoteServerId = resolved.remoteServerId;
-      const channelId = randomUUID23();
+      const channelId = randomUUID25();
       const parsed = new URL(resolved.fetchUrl);
       const wsPath = parsed.pathname;
       const wsQuery = parsed.search ? parsed.search.slice(1) : void 0;
@@ -257758,7 +259117,7 @@ function runOneShot(command, opts) {
 }
 
 // src/remote-mcp-session-manager.ts
-import { randomUUID as randomUUID24 } from "node:crypto";
+import { randomUUID as randomUUID26 } from "node:crypto";
 
 // src/protocol/mcp/client.ts
 var McpClientError = class extends Error {
@@ -262832,7 +264191,7 @@ var RemoteMcpSessionManager = class {
       try {
         const tools = await client.listTools(clampTimeout(timeoutMs));
         if (generation !== this.generation) throw new McpClientError("MCP broker was reset while opening");
-        const workerHandle = randomUUID24();
+        const workerHandle = randomUUID26();
         this.sessions.set(workerHandle, { client, transport: spec.type, serverInfo, tools, lastUsedAt: Date.now() });
         return { workerHandle, transport: spec.type, serverInfo, tools };
       } catch (error48) {
@@ -263087,13 +264446,16 @@ var import_fastify_plugin32 = __toESM(require_plugin2(), 1);
 var PROTOCOL_VERSION = "2024-11-05";
 var AUDIT_ARGS_MAX = 1024;
 var NOT_ACCESSIBLE = "remote not found or not accessible";
+var NOT_GRANTED = "remote not granted to this session; ask the user to allow it from the composer's + menu (Remote access)";
 var REMOTE_ID_PROP = {
   remoteId: { type: "string", description: "Target remote server id from list_accessible_remotes" }
 };
 var CROSS_REMOTE_MCP_INSTRUCTIONS = [
   "Use these tools when the task requires inspecting or operating another remote machine, or using an MCP server reachable from that remote.",
   "Treat a machine or host name in the user's request (for example, 'look at the ubuntu machine') as an explicit target signal, not as a request to inspect the current local workspace. Call `list_accessible_remotes` and match the user's wording against the returned remote names and ids before reading files or running local commands.",
-  "If exactly one accessible remote matches the named machine, perform the requested work on that remote. If multiple remotes match, or the wording could reasonably refer to either the local machine or a remote, ask the user which target they mean before operating. If no remote matches, say so instead of silently falling back to local.",
+  "If exactly one accessible remote matches the named machine, perform the requested inspection on that remote. If multiple remotes match, or the wording could reasonably refer to either the local machine or a remote, ask the user which target they mean before operating.",
+  "Naming a machine targets the investigation, not the fix: make code changes (editing files, git operations, installing dependencies) in the local workspace, even when the problem was found on a remote. Only modify a remote machine when the user explicitly asks for the change to be made there; if a fix can only be applied on the remote, propose it and ask first.",
+  "The user grants remotes to this session from the composer's + menu (Remote access). If the list is empty, or the machine the user named is missing from it, tell them to grant it there; never silently fall back to the local workspace.",
   "Cross-remote can discover accessible machines, inspect files, directories, paths, and processes, run commands on exec-tier remotes, and persistently use MCP servers reachable from those remotes. Available operations depend on the remote's access tier, online state, and worker capabilities.",
   "Call `list_accessible_remotes` first to discover the remote id, access tier, online state, and whether its MCP broker is supported.",
   "For a remote MCP server, call `remote_mcp_open` once, use the returned tool schemas and handle for repeated `remote_mcp_call` calls, then call `remote_mcp_close` when the work is complete. Do not reopen the MCP server for every tool call.",
@@ -263104,7 +264466,7 @@ var CROSS_REMOTE_MCP_INSTRUCTIONS = [
 var TOOLS = [
   {
     name: "list_accessible_remotes",
-    description: "List remote machines this agent may access, including their names, ids, access tiers, and online status. Call this before acting whenever the user names or otherwise identifies a machine/host, so the request is routed to the intended target instead of the current local machine.",
+    description: "List the remote machines the user has granted to this session, including their names, ids, access tiers, and online status. Call this before acting whenever the user names or otherwise identifies a machine/host, so the request is routed to the intended target instead of the current local machine.",
     inputSchema: { type: "object", properties: {}, additionalProperties: false }
   },
   {
@@ -263146,7 +264508,7 @@ var TOOLS = [
   },
   {
     name: "remote_bash",
-    description: "Run a shell command on a target remote machine. Requires 'exec' access.",
+    description: "Run a shell command on a target remote machine. Requires 'exec' access. Use it for inspection and diagnosis; do not edit code or change state on the remote unless the user explicitly asked for that change there.",
     inputSchema: {
       type: "object",
       properties: {
@@ -263425,7 +264787,8 @@ var routes31 = async (fastify2) => {
     if (!resolved.ok) {
       const status = resolved.reason === "offline" ? "offline" : "denied";
       await audit(payload, remoteId, toolName, target.summary, status, null, startedAt);
-      return textResult(resolved.reason === "offline" ? `Remote ${remoteId} is offline` : NOT_ACCESSIBLE, true);
+      if (resolved.reason === "offline") return textResult(`Remote ${remoteId} is offline`, true);
+      return textResult(resolved.reason === "not_granted" ? NOT_GRANTED : NOT_ACCESSIBLE, true);
     }
     if (isMcpTool && !supportsRemoteMcpBroker(resolved.server)) {
       await audit(payload, remoteId, toolName, target.summary, "denied", null, startedAt);
@@ -263606,7 +264969,7 @@ var session_mcp_routes_default = (0, import_fastify_plugin33.default)(routes32,
 
 // src/routes/schedule-routes.ts
 var import_fastify_plugin34 = __toESM(require_plugin2(), 1);
-import { randomUUID as randomUUID25 } from "crypto";
+import { randomUUID as randomUUID27 } from "crypto";
 import path20 from "path";
 var RUN_TYPES = ["command", "prompt"];
 var CWD_MODES = ["branch", "directory"];
@@ -263709,7 +265072,7 @@ var routes33 = async (fastify2) => {
         if (!owned) return reply.code(400).send({ error: "Invalid source" });
         source = { session_id: b2.source.session_id, tool_use_id: b2.source.tool_use_id };
       }
-      const newId = randomUUID25();
+      const newId = randomUUID27();
       const schedule = await fastify2.storage.scheduledTasks.create({
         id: newId,
         project_id: req.params.projectId,
@@ -264607,7 +265970,7 @@ var createServer = async (opts) => {
     reply.header("access-control-allow-origin", "*");
     reply.header("access-control-allow-methods", "GET, POST, PUT, DELETE, OPTIONS");
     reply.header("access-control-allow-headers", "Content-Type, Upgrade, Connection, X-Vibedeckx-Api-Key, X-Request-Id, Authorization, traceparent");
-    reply.header("access-control-expose-headers", "traceparent");
+    reply.header("access-control-expose-headers", "traceparent, X-Vibedeckx-Source-Server");
     done();
   });
   server.addHook("onRequest", (req, reply, done) => {
@@ -264647,7 +266010,12 @@ var createServer = async (opts) => {
     // check this before calling /api/reverse-connect/identity so an auth
     // middleware 401 from an older hub (which lacks the endpoint AND its
     // exemptions) is never confused with a genuinely rejected token.
-    reverseConnectIdentity: true
+    reverseConnectIdentity: true,
+    // Per-session cross-remote grants (the composer's "Remote access").
+    // Off without a public URL (no gateway token is minted at all) and off in
+    // solo/no-auth mode (the mint refuses an unscoped token), so the UI hides
+    // the entry rather than offering a control that cannot do anything.
+    crossRemoteSessionGrants: crossRemoteMcpEnabled() && authEnabled
   }));
   server.register(shared_services_default, { storage: opts.storage, authEnabled });
   server.register(import_websocket2.default);
@@ -265474,7 +266842,7 @@ var ReverseConnectClient = class {
 
 // src/connect-daemon.ts
 import { spawn as spawn6 } from "node:child_process";
-import { randomUUID as randomUUID26 } from "node:crypto";
+import { randomUUID as randomUUID28 } from "node:crypto";
 import fs8 from "node:fs";
 import path23 from "node:path";
 var CONNECT_DAEMON_CHILD_ENV = "VIBEDECKX_INTERNAL_CONNECT_DAEMON";
@@ -265893,7 +267261,7 @@ function createDaemonStateLockCandidate(lockPath) {
     schemaVersion: 1,
     pid: process.pid,
     processStartTicks,
-    nonce: randomUUID26()
+    nonce: randomUUID28()
   };
   const candidatePath = `${lockPath}.candidate-${process.pid}-${owner.nonce}`;
   fs8.mkdirSync(candidatePath, { mode: 448 });