bazilion 0.17.0 → 0.19.0

package/dist/worker.js

@@ -3515,6 +3515,8 @@ function providerBaseUrl(providerName, env) {
       return env.LLAMACPP_URL ?? LOCAL_PROVIDERS.llamacpp?.baseUrl;
     case "vercel-ai-gateway":
       return env.AI_GATEWAY_BASE_URL;
+    case "fireworks":
+      return env.FIREWORKS_BASE_URL ?? "https://api.fireworks.ai/inference";
     default:
       return void 0;
   }
@@ -4046,6 +4048,26 @@ var PROTECTED_REQUIRED_KEYS = new Set(
     (key) => key !== "images" && key !== "questionEnabled" && key !== "containerNamespace"
   )
 );
+var STATIC_REVIEW_KEYS = /* @__PURE__ */ new Set([
+  "kind",
+  "agentId",
+  "message",
+  "turnId",
+  "runtime",
+  "review",
+  "apiKeyRefreshEnabled",
+  "scratch"
+]);
+var VERIFICATION_KEYS = /* @__PURE__ */ new Set([
+  "kind",
+  "agentId",
+  "message",
+  "turnId",
+  "runtime",
+  "verification",
+  "apiKeyRefreshEnabled",
+  "scratch"
+]);
 var REVIEW_KEYS = /* @__PURE__ */ new Set([
   "kind",
   "agentId",
@@ -4169,6 +4191,48 @@ function parseWorkerInput(value) {
     assertMinimalWorkerScratch(input.scratch);
     return value;
   }
+  if (kind === "specialist_verification") {
+    assertExactKeys(input, VERIFICATION_KEYS, "verification worker input", VERIFICATION_KEYS);
+    requireString(input.agentId, "agentId");
+    requireString(input.message, "message");
+    requireString(input.turnId, "turnId");
+    assertProtectedProviderRuntime(input.runtime);
+    if (input.apiKeyRefreshEnabled !== true) {
+      throw new Error("worker: verification input requires bound API key refresh");
+    }
+    assertMinimalWorkerScratch(input.scratch);
+    const verification = objectRecord(input.verification, "verification metadata");
+    assertExactKeys(
+      verification,
+      /* @__PURE__ */ new Set(["requestId", "attemptId"]),
+      "verification metadata",
+      /* @__PURE__ */ new Set(["requestId", "attemptId"])
+    );
+    requireString(verification.requestId, "requestId");
+    requireString(verification.attemptId, "attemptId");
+    return value;
+  }
+  if (kind === "packet_review") {
+    assertExactKeys(input, STATIC_REVIEW_KEYS, "static review worker input", STATIC_REVIEW_KEYS);
+    requireString(input.agentId, "agentId");
+    requireString(input.message, "message");
+    requireString(input.turnId, "turnId");
+    assertProtectedProviderRuntime(input.runtime);
+    if (input.apiKeyRefreshEnabled !== true) {
+      throw new Error("worker: static review requires bound API key refresh");
+    }
+    assertMinimalWorkerScratch(input.scratch);
+    const review = objectRecord(input.review, "review metadata");
+    assertExactKeys(
+      review,
+      /* @__PURE__ */ new Set(["packetId", "attemptId"]),
+      "review metadata",
+      /* @__PURE__ */ new Set(["packetId", "attemptId"])
+    );
+    requireString(review.packetId, "packetId");
+    requireString(review.attemptId, "attemptId");
+    return value;
+  }
   if (kind === "restricted_review") {
     assertExactKeys(input, REVIEW_KEYS, "restricted review worker input", REVIEW_KEYS);
     requireString(input.agentId, "agentId");
@@ -5365,6 +5429,207 @@ function messagingTools(host, fromAgentId) {
   ];
 }
 
+// ../daemon/src/runtime/tools/review.ts
+var ReviewCapabilityError = class extends Error {
+};
+var SEVERITIES = ["blocker", "major", "minor", "info"];
+var CONCLUSIONS = ["changes_requested", "commented", "recommended"];
+function reviewTools(host) {
+  const packetTool = {
+    def: {
+      name: "review_packet",
+      description: "Read the captured revision you are reviewing: its changed paths, whether that revision\u2019s content can still be reproduced from the working tree, the findings recorded so far, and any conclusion already recorded. This is a static review of one captured revision \u2014 it is not the current repository, and nothing here runs code or changes files.",
+      parameters: { type: "object", properties: {}, additionalProperties: false }
+    },
+    async invoke() {
+      return renderBrief(await host.read());
+    }
+  };
+  const pathTool = {
+    def: {
+      name: "review_path",
+      description: "Read one changed path\u2019s patch from the reviewed revision. Only paths listed by review_packet exist in it. If the working tree has moved since the capture, the patch cannot be reproduced and this says so \u2014 a diff of different code is never returned as the reviewed change.",
+      parameters: {
+        type: "object",
+        properties: {
+          path: {
+            type: "string",
+            description: "Repository-relative path, exactly as review_packet listed it."
+          }
+        },
+        required: ["path"],
+        additionalProperties: false
+      }
+    },
+    async invoke(args) {
+      const path = typeof args.path === "string" ? args.path.trim() : "";
+      if (path === "") throw new ReviewCapabilityError("review_path needs a path");
+      return renderContent(await host.path(path));
+    }
+  };
+  const findingTool = {
+    def: {
+      name: "review_finding",
+      description: "Record one finding against the reviewed revision: a path that appears in review_packet, a severity, and what is wrong. The line range is context for a reader, not identity \u2014 do not attach a finding to a line you have not read. A finding is a statement with evidence, never an approval, and a finding that cannot be correlated to this revision is recorded as unverified rather than guessed at.",
+      parameters: {
+        type: "object",
+        properties: {
+          path: { type: "string", description: "Changed path in the reviewed revision." },
+          severity: {
+            type: "string",
+            enum: [...SEVERITIES],
+            description: "blocker | major | minor | info"
+          },
+          note: {
+            type: "string",
+            description: "What is wrong and what it would take to be satisfied. Be specific."
+          },
+          lineStart: {
+            type: "integer",
+            minimum: 1,
+            description: "Optional first line of context."
+          },
+          lineEnd: { type: "integer", minimum: 1, description: "Optional last line of context." }
+        },
+        required: ["path", "severity", "note"],
+        additionalProperties: false
+      }
+    },
+    async invoke(args) {
+      const path = typeof args.path === "string" ? args.path.trim() : "";
+      const note = typeof args.note === "string" ? args.note.trim() : "";
+      const severity = args.severity;
+      if (path === "") throw new ReviewCapabilityError("review_finding needs a path");
+      if (note === "") throw new ReviewCapabilityError("review_finding needs a note");
+      if (!SEVERITIES.includes(severity)) {
+        throw new ReviewCapabilityError(`severity must be one of: ${SEVERITIES.join(", ")}`);
+      }
+      const result = await host.addFinding({
+        path,
+        severity,
+        note,
+        lineStart: readLine(args.lineStart),
+        lineEnd: readLine(args.lineEnd)
+      });
+      return `Finding ${result.findingId} recorded as [${String(severity)}] on ${path} (finding ${result.ordinal}). Nothing was executed and nothing was changed.`;
+    }
+  };
+  const conclusionTool = {
+    def: {
+      name: "review_conclusion",
+      description: "Record your conclusion for this revision and finish. changes_requested | commented | recommended. A conclusion is your statement about this revision: it is not operator acceptance, not a passing test, and not permission to publish, merge or deploy. Unresolved findings stay visible whatever you conclude, so conclude on the evidence you actually have.",
+      parameters: {
+        type: "object",
+        properties: {
+          conclusion: {
+            type: "string",
+            enum: [...CONCLUSIONS],
+            description: "changes_requested | commented | recommended"
+          },
+          note: { type: "string", description: "A short justification, in evidence terms." }
+        },
+        required: ["conclusion"],
+        additionalProperties: false
+      }
+    },
+    async invoke(args) {
+      const conclusion = args.conclusion;
+      if (!CONCLUSIONS.includes(conclusion)) {
+        throw new ReviewCapabilityError(`conclusion must be one of: ${CONCLUSIONS.join(", ")}`);
+      }
+      const result = await host.conclude({
+        conclusion,
+        note: typeof args.note === "string" ? args.note : null
+      });
+      return `Conclusion recorded: ${result.conclusion}. The review is complete; the requester learns the outcome.`;
+    }
+  };
+  return [packetTool, pathTool, findingTool, conclusionTool];
+}
+function reviewRequestTool(host) {
+  return {
+    def: {
+      name: "request_review",
+      description: "Ask one existing member of this Team to read the change as it is right now and say what they think of it. The daemon captures the change, so later edits are not covered. Use it when a second pair of eyes is worth more than your own summary; then end your turn and wait \u2014 you will be told what they found. This is a static reading: the reviewer runs nothing and changes nothing, and this is not an approval to publish, merge or deploy.",
+      parameters: {
+        type: "object",
+        properties: {
+          reviewer: {
+            type: "string",
+            description: "The same-Team member who should review \u2014 their name or their agent id. A name that matches nobody comes back with the members you can ask."
+          },
+          summary: {
+            type: "string",
+            description: "What the change is for and what to look at, in your words. It is commentary; it is not evidence."
+          }
+        },
+        required: ["reviewer"],
+        additionalProperties: false
+      }
+    },
+    async invoke(args) {
+      const reviewer = typeof args.reviewer === "string" ? args.reviewer.trim() : "";
+      if (reviewer === "") throw new ReviewCapabilityError("request_review needs a reviewer");
+      const receipt = await host.capture({
+        reviewer,
+        ...typeof args.summary === "string" ? { summary: args.summary } : {}
+      });
+      return [
+        `Review packet ${receipt.packetId} is ${receipt.state}, against revision ${receipt.snapshotId}.`,
+        `Reviewer: ${receipt.reviewer}.`,
+        "",
+        "The change is captured as it was at this moment; editing it now does not change what will be",
+        "reviewed. End your turn and wait \u2014 the findings are delivered back to you. A reviewer\u2019s conclusion",
+        "is their statement about this revision, not an approval and not a test result."
+      ].join("\n");
+    }
+  };
+}
+function readLine(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= 1 ? value : null;
+}
+function renderBrief(brief) {
+  const lines = [
+    `Review packet ${brief.packetId}`,
+    `Change: revision ${brief.snapshot.id} (base ${brief.snapshot.baseOid.slice(0, 12)}${brief.snapshot.complete ? "" : ", INCOMPLETE COVERAGE"})`
+  ];
+  if (brief.summary) lines.push(`Requested by the requester: ${brief.summary}`);
+  lines.push(
+    "",
+    `Changed paths (${brief.changes.length}):`,
+    ...brief.changes.map(
+      (change) => `  ${change.status.padEnd(9)} ${change.path}${change.previousPath ? ` (was ${change.previousPath})` : ""}`
+    )
+  );
+  lines.push(
+    "",
+    brief.contentAvailable ? "Content: the working tree still matches this revision, so review_path can show a patch." : `Content: NOT reproducible \u2014 ${brief.contentUnavailableReason ?? "the reviewed revision has moved"}. Review from the change list, the requester\u2019s summary and your own reading of the paths; do not describe lines you could not read.`
+  );
+  if (brief.findings.length > 0) {
+    lines.push("", "Findings so far:");
+    for (const finding of brief.findings) {
+      lines.push(
+        `  [${finding.severity}] ${finding.path} (${finding.authorKind}) \u2014 ${finding.note}`
+      );
+    }
+  } else {
+    lines.push("", "Findings so far: none.");
+  }
+  if (brief.conclusion) lines.push("", `A conclusion is already recorded: ${brief.conclusion}.`);
+  lines.push(
+    "",
+    "You cannot run commands, change files or publish anything. Record findings with review_finding and finish with review_conclusion."
+  );
+  return lines.join("\n");
+}
+function renderContent(content) {
+  if (content.reason) return `No patch for ${content.path}: ${content.reason}`;
+  if (!content.patch) return `No patch for ${content.path}: the change recorded no content.`;
+  return `Patch for ${content.path}${content.truncated ? " (truncated)" : ""}:
+
+${content.patch}`;
+}
+
 // ../daemon/src/runtime/tools/user-md.ts
 function userMdTools(host, teamId) {
   return [
@@ -5420,6 +5685,227 @@ etag: ${etag}`;
   ];
 }
 
+// ../daemon/src/runtime/tools/verification.ts
+var VerificationCapabilityError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "VerificationCapabilityError";
+  }
+};
+function verificationTools(host) {
+  const attempted = /* @__PURE__ */ new Set();
+  const request = {
+    def: {
+      name: "verification_request",
+      description: "Read the captured verification request: the exact change under verification, the environment the checks were admitted into, and every declared check with its timeout and any outcome so far. A check you were not asked to run cannot be added here \u2014 a different or additional command needs a new request.",
+      parameters: { type: "object", properties: {}, additionalProperties: false }
+    },
+    async invoke() {
+      return renderBrief2(await host.read());
+    }
+  };
+  const check = {
+    def: {
+      name: "verification_check",
+      description: "Invoke exactly one declared check, identified by its ordinal from verification_request. Each check runs at most once: a check that already reported its outcome cannot be run again, and you cannot change its command, cwd, timeout or environment. Report what actually happened, including failures, skips and blockers. A successful exit is evidence about the commands that ran, never proof about later code.",
+      parameters: {
+        type: "object",
+        properties: {
+          ordinal: {
+            type: "integer",
+            minimum: 0,
+            description: "Ordinal of a declared check, as listed by verification_request."
+          }
+        },
+        required: ["ordinal"],
+        additionalProperties: false
+      }
+    },
+    async invoke(args, context) {
+      const ordinal = readOrdinal(args);
+      const brief = await host.read();
+      const declared = brief.checks.find((entry) => entry.ordinal === ordinal);
+      if (!declared) {
+        throw new VerificationCapabilityError(
+          `check ${ordinal} was not captured with this request; only ${brief.checks.map((entry) => entry.ordinal).join(", ")} exist`
+        );
+      }
+      if (declared.state !== "not_executed") {
+        throw new VerificationCapabilityError(
+          `check ${ordinal} already reported '${declared.state}' and cannot be run again`
+        );
+      }
+      if (attempted.has(ordinal)) {
+        throw new VerificationCapabilityError(`check ${ordinal} is already running`);
+      }
+      attempted.add(ordinal);
+      try {
+        const run = await host.invoke(ordinal, { toolCallId: context?.toolCallId ?? "" });
+        return renderRun(run);
+      } catch (error) {
+        attempted.delete(ordinal);
+        throw error;
+      }
+    }
+  };
+  return [request, check];
+}
+function readOrdinal(args) {
+  const keys2 = Object.keys(args).sort();
+  if (keys2.length !== 1 || keys2[0] !== "ordinal") {
+    throw new VerificationCapabilityError("verification_check takes only a declared ordinal");
+  }
+  const ordinal = args.ordinal;
+  if (!Number.isInteger(ordinal) || ordinal < 0) {
+    throw new VerificationCapabilityError("ordinal must be a non-negative integer");
+  }
+  return ordinal;
+}
+function verificationRequestTool(host) {
+  return {
+    def: {
+      name: "request_verification",
+      description: "Hand the current change to one existing member of this Team and ask them to run specific checks against it. The daemon captures the change as it is right now \u2014 you do not capture one yourself \u2014 so later edits are not covered. Use it when a task is finished and an independent check is worth more than your own report; then end your turn and wait. You will be told the outcome. This asks for verification \u2014 it never approves, publishes, merges or deploys anything.",
+      parameters: {
+        type: "object",
+        properties: {
+          specialist: {
+            type: "string",
+            description: "Agent id of the same-Team member who should verify. They must already exist."
+          },
+          checks: {
+            type: "array",
+            maxItems: 8,
+            description: "The exact commands to run against the captured change. Each runs once, as written.",
+            items: {
+              type: "object",
+              properties: {
+                command: {
+                  type: "string",
+                  description: "Shell command, run in the captured tree."
+                },
+                purpose: { type: "string", description: "What this command establishes." },
+                cwd: {
+                  type: "string",
+                  description: "Team-relative directory. Defaults to the root."
+                },
+                timeoutSeconds: {
+                  type: "integer",
+                  minimum: 1,
+                  maximum: 300,
+                  description: "Timeout. Defaults to 120 seconds."
+                }
+              },
+              required: ["command", "purpose"],
+              additionalProperties: false
+            }
+          },
+          summary: {
+            type: "string",
+            description: "Short acceptance summary: what the change should do, and what to look for."
+          },
+          writablePaths: {
+            type: "array",
+            maxItems: 16,
+            items: { type: "string" },
+            description: "Team-relative paths where checks are expected to write generated output. Advisory: it is recorded and reported, but it does not confine writes."
+          }
+        },
+        required: ["specialist", "checks"],
+        additionalProperties: false
+      }
+    },
+    async invoke(args) {
+      const intent = readIntent(args);
+      const receipt = await host.capture(intent);
+      return renderRequestReceipt(receipt);
+    }
+  };
+}
+function readIntent(args) {
+  const specialist = args.specialist;
+  if (typeof specialist !== "string" || specialist.trim() === "") {
+    throw new Error("request_verification needs the id of an existing same-Team specialist");
+  }
+  if (!Array.isArray(args.checks) || args.checks.length === 0) {
+    throw new Error("request_verification needs at least one check");
+  }
+  if (args.checks.length > 8) {
+    throw new Error("request_verification accepts at most eight checks");
+  }
+  const checks = args.checks.map((entry, index) => {
+    const check = entry;
+    if (typeof check?.command !== "string" || check.command.trim() === "") {
+      throw new Error(`check ${index} has no command`);
+    }
+    if (typeof check?.purpose !== "string" || check.purpose.trim() === "") {
+      throw new Error(`check ${index} has no purpose`);
+    }
+    return {
+      command: check.command,
+      purpose: check.purpose,
+      ...typeof check.cwd === "string" ? { cwd: check.cwd } : {},
+      ...typeof check.timeoutSeconds === "number" ? { timeoutSeconds: check.timeoutSeconds } : {}
+    };
+  });
+  return {
+    specialist: specialist.trim(),
+    checks,
+    ...typeof args.summary === "string" ? { summary: args.summary } : {},
+    ...Array.isArray(args.writablePaths) ? {
+      writablePaths: args.writablePaths.filter(
+        (path) => typeof path === "string"
+      )
+    } : {}
+  };
+}
+function renderRequestReceipt(receipt) {
+  const lines = [
+    `Verification request ${receipt.requestId} is ${receipt.state}, against snapshot ${receipt.snapshotId}.`,
+    `Specialist: ${receipt.specialist}.`,
+    "",
+    "Captured checks:"
+  ];
+  for (const check of receipt.checks) {
+    lines.push(`  [${check.ordinal}] ${check.command} (cwd ${check.cwd}, ${check.timeoutMs} ms)`);
+  }
+  lines.push(
+    "",
+    "The change is captured as it was at this moment; editing it now does not change what will be",
+    "verified. End your turn and wait \u2014 the outcome is delivered back to you. This request is not an",
+    "approval to publish, merge or deploy, and a passing check is evidence about these commands only."
+  );
+  return lines.join("\n");
+}
+function renderBrief2(brief) {
+  const lines = [
+    `Verification request ${brief.requestId}`,
+    `Change: snapshot ${brief.snapshot.id} (base ${brief.snapshot.baseOid.slice(0, 12)}${brief.snapshot.complete ? "" : ", INCOMPLETE COVERAGE"})`,
+    `Environment: image ${brief.environment.image}, shell ${brief.environment.sandbox}${brief.environment.cwd ? `, cwd ${brief.environment.cwd}` : ""}`,
+    `Applicability: ${brief.applicability === "identical" ? "unchanged since capture" : brief.applicability}`
+  ];
+  if (brief.summary) lines.push(`Requested by the requester: ${brief.summary}`);
+  if (brief.writablePaths.length > 0) {
+    lines.push(
+      `Declared generated-output paths (where a check is expected to write; this does not confine writes): ${brief.writablePaths.join(", ")}`
+    );
+  }
+  lines.push("", "Captured checks:");
+  for (const entry of brief.checks) {
+    const outcome = entry.state === "not_executed" ? "not run yet" : `${entry.state}${entry.exitCode === null ? "" : ` (exit ${entry.exitCode})`}${entry.commandId ? ` receipt ${entry.commandId}` : ""}`;
+    lines.push(
+      `  [${entry.ordinal}] ${entry.command} (cwd ${entry.cwd}, ${entry.timeoutMs} ms, ${entry.purpose}) \u2014 ${outcome}`
+    );
+  }
+  lines.push("", "Run each captured check with verification_check. Report failures as failures.");
+  return lines.join("\n");
+}
+function renderRun(run) {
+  const head = `Check ${run.ordinal}: ${run.state}${run.exitCode === null ? "" : ` (exit ${run.exitCode})`}${run.commandId ? ` \u2014 receipt ${run.commandId}` : ""}${run.truncated ? " [output truncated]" : ""}`;
+  return run.output.trim() ? `${head}
+${run.output}` : head;
+}
+
 // ../daemon/src/runtime/tools/web.ts
 import { fetch as undiciFetch2 } from "undici";
 
@@ -6096,6 +6582,12 @@ function createBazilionCustomTools(opts) {
   if (opts.fileSink) {
     handlers.push(deliverFileTool(opts.agent.team.path, opts.fileSink, opts.sessionId));
   }
+  if (opts.verificationRequestHost) {
+    handlers.push(verificationRequestTool(opts.verificationRequestHost));
+  }
+  if (opts.reviewRequestHost) {
+    handlers.push(reviewRequestTool(opts.reviewRequestHost));
+  }
   if (opts.askUser) handlers.push(askUserTool(opts.askUser));
   return handlers.map(ourToolToPiTool);
 }
@@ -6109,6 +6601,12 @@ function createProtectedBazilionCustomTools(opts) {
     ...userMdTools(opts.userMdHost, opts.agent.team.id),
     deliverFileTool(opts.agent.team.path, opts.fileSink, opts.sessionId)
   ];
+  if (opts.verificationRequestHost) {
+    handlers.push(verificationRequestTool(opts.verificationRequestHost));
+  }
+  if (opts.reviewRequestHost) {
+    handlers.push(reviewRequestTool(opts.reviewRequestHost));
+  }
   if (opts.askUser) handlers.push(askUserTool(opts.askUser));
   return handlers.map(ourToolToPiTool);
 }
@@ -6212,7 +6710,9 @@ async function createBazilionSession(opts) {
     fileSink,
     askUser,
     sessionId: sessionManager.getSessionId(),
-    env
+    env,
+    verificationRequestHost: opts.verificationRequestHost,
+    reviewRequestHost: opts.reviewRequestHost
   });
   if (repository) bazilionTools.push(repository.tool);
   if (repository && opts.codingHost && shellTools && shellTools.config.sandboxMode === "docker" && !opts.preparedDocker)
@@ -6334,7 +6834,9 @@ async function createProtectedBazilionSession(opts) {
     userMdHost: opts.userMdHost,
     fileSink: opts.fileSink,
     askUser: opts.askUser,
-    sessionId: sessionManager.getSessionId()
+    sessionId: sessionManager.getSessionId(),
+    verificationRequestHost: opts.verificationRequestHost,
+    reviewRequestHost: opts.reviewRequestHost
   });
   if (repository) bazilionTools.push(repository.tool);
   const redactionSecrets = uniqueSecrets(protectedRuntimeSecrets(opts.runtime));
@@ -6799,8 +7301,35 @@ function createReviewState(evidenceItems) {
     tools
   };
 }
+function createIpcVerificationRequestHost(ipcCall) {
+  return {
+    capture: (intent) => ipcCall("verificationCapture", intent)
+  };
+}
+function createIpcReviewRequestHost(ipcCall) {
+  return {
+    capture: (intent) => ipcCall("reviewPacketCapture", intent)
+  };
+}
+function createIpcChangeReviewHost(ipcCall, identity2) {
+  const { packetId, attemptId } = identity2;
+  return {
+    read: () => ipcCall("reviewPacketRead", { packetId, attemptId }),
+    path: (path) => ipcCall("reviewPathRead", { packetId, attemptId, path }),
+    addFinding: (finding) => ipcCall("reviewFindingAdd", { packetId, attemptId, finding }),
+    conclude: (conclusion) => ipcCall("reviewConclusion", { packetId, attemptId, conclusion })
+  };
+}
+function createIpcVerificationHost(ipcCall, identity2) {
+  return {
+    // The request identity is bound here from the worker's own input, so a tool call cannot address
+    // another request's attempt: only an ordinal travels.
+    read: () => ipcCall("verificationRead", identity2),
+    invoke: (ordinal) => ipcCall("verificationRun", { ...identity2, ordinal })
+  };
+}
 async function createSessionForInput(input, ipcCall) {
-  if (input.kind !== "restricted_review" && !input.repositoryContext)
+  if (input.kind !== "restricted_review" && input.kind !== "specialist_verification" && input.kind !== "packet_review" && !input.repositoryContext)
     throw new Error("Coding turn requires daemon-prepared repository context");
   if (input.kind === "configured_operator_http") {
     const paths = resolvePaths();
@@ -6835,6 +7364,10 @@ async function createSessionForInput(input, ipcCall) {
       enabledProviders: new Set(input.enabledProviders),
       messagingHost: messagingHost2,
       userMdHost: userMdHost2,
+      // The requester's halves of specialist verification and review. Only the configured/browser-enabled
+      // worker kind reaches this builder, and it is an ordinary coding turn.
+      verificationRequestHost: createIpcVerificationRequestHost(ipcCall),
+      reviewRequestHost: createIpcReviewRequestHost(ipcCall),
       apiKey: input.apiKey,
       refreshApiKey: refreshApiKey2,
       browserHost,
@@ -6858,6 +7391,28 @@ async function createSessionForInput(input, ipcCall) {
     agentId: input.kind === "protected" ? input.agent.agent.id : input.agentId,
     turnId: input.turnId
   });
+  if (input.kind === "specialist_verification") {
+    const handle2 = await createRestrictedReviewSession({
+      runtime: input.runtime,
+      scratch: input.scratch,
+      systemPrompt: VERIFICATION_SYSTEM_PROMPT,
+      tools: verificationTools(createIpcVerificationHost(ipcCall, input.verification)).map(
+        ourToolToPiTool
+      ),
+      refreshApiKey
+    });
+    return { handle: handle2 };
+  }
+  if (input.kind === "packet_review") {
+    const handle2 = await createRestrictedReviewSession({
+      runtime: input.runtime,
+      scratch: input.scratch,
+      systemPrompt: STATIC_REVIEW_SYSTEM_PROMPT,
+      tools: reviewTools(createIpcChangeReviewHost(ipcCall, input.review)).map(ourToolToPiTool),
+      refreshApiKey
+    });
+    return { handle: handle2 };
+  }
   if (input.kind === "restricted_review") {
     const reviewState = createReviewState(input.review.evidence);
     const handle2 = await createRestrictedReviewSession({
@@ -6894,6 +7449,8 @@ async function createSessionForInput(input, ipcCall) {
     messagingHost,
     userMdHost,
     bashApprovalHost,
+    verificationRequestHost: createIpcVerificationRequestHost(ipcCall),
+    reviewRequestHost: createIpcReviewRequestHost(ipcCall),
     askUser: input.questionEnabled ? (toolCallId, question) => ipcCall("askUser", { toolCallId, question }) : void 0,
     refreshApiKey,
     fileSink: async (file, source) => {
@@ -6934,7 +7491,7 @@ async function main() {
   session = handle.session;
   const consumptionAcks = /* @__PURE__ */ new Set();
   const unsubscribe = session.subscribe((piEvent) => {
-    if (input.kind !== "restricted_review" && input.questionEnabled && piEvent.type === "message_end" && piEvent.message.role === "toolResult" && piEvent.message.toolName === "ask_user" && !piEvent.message.isError) {
+    if (input.kind !== "restricted_review" && input.kind !== "specialist_verification" && input.kind !== "packet_review" && input.questionEnabled && piEvent.type === "message_end" && piEvent.message.role === "toolResult" && piEvent.message.toolName === "ask_user" && !piEvent.message.isError) {
       const message = piEvent.message;
       const content = message.content[0];
       if (content?.type === "text") {
@@ -6964,8 +7521,9 @@ async function main() {
   });
   try {
     const promptMessage = redactJsonValue(input.message, activeAccessTokens);
-    const sanitizedImages = input.kind === "restricted_review" ? [] : redactJsonValue(input.images ?? [], activeAccessTokens);
-    const promptImages = input.kind === "restricted_review" ? [] : sanitizedImages.map((image) => ({
+    const restricted = input.kind === "restricted_review" || input.kind === "specialist_verification" || input.kind === "packet_review";
+    const sanitizedImages = restricted ? [] : redactJsonValue(input.images ?? [], activeAccessTokens);
+    const promptImages = restricted ? [] : sanitizedImages.map((image) => ({
       type: "image",
       data: image.data,
       mimeType: image.mimeType
@@ -7008,6 +7566,39 @@ main().catch((error) => {
   }
   process.exit(1);
 });
+var STATIC_REVIEW_SYSTEM_PROMPT = `You are a restricted code reviewer. You review one captured
+revision and report what you find. Call review_packet to read the revision, review_path to read a patch,
+review_finding to record a finding, and finish with review_conclusion.
+
+Boundaries you cannot cross, and must not try to:
+- You review the *captured revision*, not the current repository. If its content is not reproducible, say
+  so and do not describe lines you could not read: the change list and the requester's summary are what
+  you have.
+- You have no shell, no editor, no browser and no network tool. You cannot run a test, apply a fix, stage
+  anything, commit, merge or deploy. If something would need running to be sure, say that it needs running.
+- You cannot publish, and your conclusion is not an approval. It is your statement about this revision.
+
+Report what you actually found, with the path it concerns. Say when you are unsure, and say when you could
+not verify something rather than guessing. Do not repeat a finding that is already recorded.
+`;
+var VERIFICATION_SYSTEM_PROMPT = `You are a restricted verification specialist. You verify one
+captured change against the checks your requester selected. Call verification_request to read the
+request, then verification_check once per declared check, in order.
+
+Boundaries you cannot cross, and must not try to:
+- Only the declared ordinal of a captured check can run, once. You cannot change its command, cwd,
+  timeout or environment, add a check, or retry a check that already reported.
+- You have no shell, no editor, no browser, no network tool and no deployment credential. A missing
+  toolchain, service or approval is an explicit blocker to report, never something to work around.
+- Generated output may only be written to the declared writable paths.
+
+Report what actually happened. A non-zero exit is a failure of that check; say so plainly. An exit
+code is evidence about the commands that ran, never proof about later code, and never a statement
+that the change is ready to merge. Distinguish a failure from a check you did not run, and never
+describe an unrun check as passing.
+
+Finish with a short summary: the snapshot you verified, each check with its outcome and receipt, and
+any blocker or limitation that stopped a check. Do not recommend deployment.`;
 var REVIEW_SYSTEM_PROMPT = `You are a restricted learning reviewer. Analyze only the supplied
 transcript digest and approved-lesson index. You cannot act on the world. Call propose_lesson once
 with zero to five proposals, then stop.