chorus-codes 0.8.24 → 0.8.26

package/dist/daemon/runner/reviewer-driver.js

@@ -45,6 +45,8 @@ const cli_precheck_js_1 = require("../../lib/cli-precheck.js");
 const index_js_1 = require("../../lib/db/index.js");
 const permissions_js_1 = require("../../lib/settings/permissions.js");
 const transport_js_1 = require("../../lib/settings/transport.js");
+const concurrency_js_1 = require("../../lib/settings/concurrency.js");
+const cli_semaphore_js_1 = require("../cli-semaphore.js");
 const index_js_2 = require("../agents/index.js");
 const output_watcher_js_1 = require("../output-watcher.js");
 const participantAborts = __importStar(require("../participant-aborts.js"));
@@ -55,13 +57,25 @@ const sanitize_name_js_1 = require("./sanitize-name.js");
 const swap_sidecar_js_1 = require("./swap-sidecar.js");
 const template_fallback_js_1 = require("./template-fallback.js");
 const verdict_js_1 = require("./verdict.js");
-// Cap concurrent reviewer subprocesses per chat. Templates with 4+
-// reviewer candidates would otherwise spawn the full set in parallel —
-// which in practice means simultaneous LLM-CLI subprocesses each holding
-// a shim child + stream parser, plus per-chat cwd. At load=133 last week
-// the root cause was unbounded fan-out across re-attached SSE sessions;
-// the per-chat ceiling stops a single big template from melting the host.
-const REVIEWER_CONCURRENCY = 3;
+/**
+ * Local-CLI reviewer concurrency is enforced daemon-wide by
+ * `cli-semaphore.ts` — global cap (`maxParallelCli`) + per-CLI cap
+ * (`perCli['opencode-cli']` etc.). Settings are user-tunable via
+ * /settings; defaults are the same numbers we used to hardcode here
+ * (3 global, opencode/gemini/kimi capped at 2 each). The semaphore is
+ * shared across chats, not per-chat — that's where the OOM risk lives.
+ *
+ * HTTP-dispatched shims (openrouter and friends) bypass the semaphore
+ * entirely — they're network calls and don't consume local resources.
+ */
+/**
+ * Type guard for shim names that map to our capped CLI lineage keys.
+ * Anything that isn't one of these is treated as a non-cap'd lineage
+ * (defensive — covers future shim names we forgot to add to CLI_LINEAGES).
+ */
+function isCappedLineage(shimName) {
+    return concurrency_js_1.CLI_LINEAGES.includes(shimName);
+}
 async function runReviewers(chatDir, chatId, phase, phaseIdx, round, doerOutput, work, filesBlock, tmuxMgr, errorDetector, onEvent, abortSignal, templateFallbackReviewer) {
     if (!phase.reviewer || phase.reviewer.candidates.length === 0) {
         return { agreed: true, summary: '', allFailed: false };
@@ -78,13 +92,14 @@ async function runReviewers(chatDir, chatId, phase, phaseIdx, round, doerOutput,
     const required = phase.reviewer.require;
     // Split candidates by transport. HTTP-dispatched shims (openrouter,
     // future API-only shims) consume zero local CPU/RAM — they're just
-    // network calls — so capping them at REVIEWER_CONCURRENCY=3 alongside
-    // local CLI subprocesses is wrong: an openrouter reviewer would sit in
-    // a "Queued — waiting for an open slot" state behind 3 in-flight
-    // codex/opencode subprocesses, even though firing it adds no resource
-    // pressure beyond the upstream rate limit. The cap exists to prevent
-    // the user's box melting under N parallel CLI shim children, not to
-    // throttle HTTP fan-out.
+    // network calls — so they bypass the cli-semaphore entirely and run
+    // unbounded parallel. Per-shim rate limiting (e.g. OpenRouter's 429
+    // with Retry-After) is the upstream's job; chorus shouldn't double-
+    // throttle. Local CLI candidates go through the semaphore which
+    // enforces both the global cap and the per-CLI cap; the wait happens
+    // INSIDE runReviewer right before spawn so a reviewer that's queued
+    // still emits its phase_start / participant cards, just in a
+    // "waiting for slot" state.
     const localCandidateIdxs = [];
     const httpCandidateIdxs = [];
     for (let i = 0; i < candidates.length; i++) {
@@ -116,26 +131,15 @@ async function runReviewers(chatDir, chatId, phase, phaseIdx, round, doerOutput,
             });
         }
     }
-    // Local CLI bucket: shared cursor + REVIEWER_CONCURRENCY worker pool.
-    // Same diagnostic-transparency rule as before — every reviewer runs to
-    // completion, no cancel-on-consensus.
-    let localCursor = 0;
-    async function localWorker() {
-        while (true) {
-            if (abortSignal.aborted)
-                return;
-            const i = localCursor++;
-            if (i >= localCandidateIdxs.length)
-                return;
-            await runOne(localCandidateIdxs[i]);
-        }
-    }
-    const localWorkerCount = Math.min(REVIEWER_CONCURRENCY, localCandidateIdxs.length);
-    // HTTP bucket: unbounded parallel — Promise.all over runOne directly.
-    // Per-shim rate limiting (e.g. OpenRouter's 429 with Retry-After) is
-    // the upstream's job; chorus shouldn't double-throttle.
+    // Both buckets fire in parallel — the cli-semaphore inside
+    // runReviewer is what enforces the local-CLI caps, so we don't need
+    // a worker pool here. Reviewers continue to all run to completion
+    // (no cancel-on-consensus); that's the established behaviour from
+    // chorus-085 (see memory `feedback_let_all_reviewers_finish`),
+    // unchanged by this PR. We're only swapping the worker-pool
+    // implementation for a daemon-wide semaphore.
     await Promise.all([
-        ...Array.from({ length: localWorkerCount }, () => localWorker()),
+        ...localCandidateIdxs.map((i) => runOne(i)),
         ...httpCandidateIdxs.map((i) => runOne(i)),
     ]);
     const agreedCount = reviews.filter((r) => r.outcome === 'agreed').length;
@@ -160,12 +164,13 @@ async function runReviewer(chatDir, chatId, phase, phaseIdx, round, reviewerIdx,
     const reviewerModel = candidate.models?.[0];
     const shim = (0, index_js_2.pickShimForVoice)(candidate.lineage, reviewerModel);
     const agentName = shim.name;
+    const isHttp = (0, index_js_2.isHttpDispatchedShim)(shim);
     // Pre-spawn precheck — same gate as runDoer. A reviewer that fails
     // precheck returns null, which the phase loop already handles by
     // counting it toward the all-reviewers-failed threshold and continuing
     // with the remaining reviewers. HTTP-dispatched shims (openrouter)
     // skip this — auth is the secrets table, checked inside the shim.
-    if (!(0, index_js_2.isHttpDispatchedShim)(shim)) {
+    if (!isHttp) {
         const preRev = await (0, cli_precheck_js_1.precheckLineage)(candidate.lineage);
         if (!preRev.ok) {
             onEvent({
@@ -187,6 +192,34 @@ async function runReviewer(chatDir, chatId, phase, phaseIdx, round, reviewerIdx,
             return null;
         }
     }
+    // Acquire the daemon-wide CLI slot (global + per-lineage). Local CLI
+    // only — HTTP-dispatched shims aren't a memory pressure source and
+    // bypass the semaphore. The slot is held for the reviewer's entire
+    // lifetime, including any per-slot fallback chain — this is
+    // conservative when a fallback swaps to a different lineage (we keep
+    // the original slot rather than swap), but worst case is over-
+    // counting the original lineage's quota during the swap window. The
+    // global cap still holds.
+    //
+    // The abortSignal is passed so a chat cancelled while this reviewer
+    // is queued behind the cap doesn't leave a stale waiter blocking the
+    // semaphore head forever. On abort, acquire rejects → we return null
+    // (treated as a failed reviewer by the phase loop) without spawning.
+    //
+    // `releaseSlot` is null for HTTP shims and the precheck-failed early-
+    // return; the finally block below is robust to that.
+    let releaseSlot = null;
+    if (!isHttp && isCappedLineage(agentName)) {
+        try {
+            releaseSlot = await (0, cli_semaphore_js_1.acquire)(agentName, abortSignal);
+        }
+        catch {
+            // Aborted while waiting for slot — don't proceed. The phase loop
+            // counts this reviewer as failed which preserves "all-failed"
+            // semantics for the chat-level verdict.
+            return null;
+        }
+    }
     const roundDir = path_1.default.join(chatDir, `round-${round}`);
     const reviewerDir = path_1.default.join(roundDir, `reviewer-${agentName}-${reviewerIdx}`);
     if (!fs_1.default.existsSync(reviewerDir)) {
@@ -194,16 +227,41 @@ async function runReviewer(chatDir, chatId, phase, phaseIdx, round, reviewerIdx,
     }
     const askFile = path_1.default.join(reviewerDir, 'ask.md');
     const answerFile = path_1.default.join(reviewerDir, 'answer.md');
-    // Resolve reviewer persona — same fallback + warning pattern as runDoer.
-    let reviewerPersonaPrompt;
-    if (candidate.persona) {
-        const personaId = candidate.persona;
-        try {
-            const row = await index_js_1.personas.getById(personaId);
-            if (row) {
-                reviewerPersonaPrompt = row.system_prompt;
+    // Outer try/finally — guarantees the cli-semaphore slot is returned
+    // on every path: headless's nested try/finally for participantAborts,
+    // tmux's nested try/finally for the poll interval, AND any thrown
+    // error in persona resolution or ask building. `releaseSlot` is null
+    // for HTTP shims (acquire was skipped) — the optional-call is the
+    // guard.
+    try {
+        // Resolve reviewer persona — same fallback + warning pattern as runDoer.
+        let reviewerPersonaPrompt;
+        if (candidate.persona) {
+            const personaId = candidate.persona;
+            try {
+                const row = await index_js_1.personas.getById(personaId);
+                if (row) {
+                    reviewerPersonaPrompt = row.system_prompt;
+                }
+                else {
+                    onEvent({
+                        chatId,
+                        type: 'cli_warning',
+                        payload: {
+                            phaseId: phase.id,
+                            phaseIdx,
+                            round,
+                            role: 'reviewer',
+                            agent: `${agentName}-${reviewerIdx}`,
+                            kind: 'persona_missing',
+                            message: `Reviewer persona "${personaId}" not found in personas table — running with generic prompt. Check the template's reviewer candidate persona field.`,
+                        },
+                        ts: Date.now(),
+                    });
+                }
             }
-            else {
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
                 onEvent({
                     chatId,
                     type: 'cli_warning',
@@ -213,184 +271,75 @@ async function runReviewer(chatDir, chatId, phase, phaseIdx, round, reviewerIdx,
                         round,
                         role: 'reviewer',
                         agent: `${agentName}-${reviewerIdx}`,
-                        kind: 'persona_missing',
-                        message: `Reviewer persona "${personaId}" not found in personas table — running with generic prompt. Check the template's reviewer candidate persona field.`,
+                        kind: 'persona_lookup_failed',
+                        message: `Reviewer persona lookup for "${personaId}" failed: ${message} — running with generic prompt.`,
                     },
                     ts: Date.now(),
                 });
             }
         }
-        catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            onEvent({
-                chatId,
-                type: 'cli_warning',
-                payload: {
-                    phaseId: phase.id,
-                    phaseIdx,
-                    round,
-                    role: 'reviewer',
-                    agent: `${agentName}-${reviewerIdx}`,
-                    kind: 'persona_lookup_failed',
-                    message: `Reviewer persona lookup for "${personaId}" failed: ${message} — running with generic prompt.`,
-                },
-                ts: Date.now(),
-            });
-        }
-    }
-    const ask = (0, prompt_builder_js_1.buildReviewerAsk)(phase, phaseIdx, round, work, doerOutput, filesBlock, reviewerPersonaPrompt);
-    fs_1.default.writeFileSync(askFile, ask);
-    // Per-slot model fallback: when candidate.models lists multiple models
-    // we try them in order, falling through on `null` (no answer produced).
-    // The boolean verdict `false` (disagreement) is a real result and stops
-    // the chain — runWithModelFallback only re-tries on literal null.
-    const transport = await (0, transport_js_1.getTransport)();
-    if (transport === 'headless' && shim.runHeadless) {
-        const handle = participantAborts.register(chatId, participantAborts.participantKey('reviewer', agentName, reviewerIdx), abortSignal);
-        try {
-            // Compose: this slot's per-slot chain + template-level
-            // fallback.reviewer (same lineage, dedup'd against this slot AND
-            // every other reviewer slot in the phase so we don't spawn a
-            // duplicate voice).
-            const allReviewerSlots = (phase.reviewer?.candidates ?? []).map((c) => ({
-                lineage: c.lineage,
-                models: c.models ?? [],
-            }));
-            const thisSlot = {
-                lineage: candidate.lineage,
-                models: candidate.models ?? [],
-            };
-            const chain = (0, template_fallback_js_1.buildSlotFallbackChain)(thisSlot, allReviewerSlots, templateFallbackReviewer);
-            return await (0, run_with_fallback_js_1.runWithChainFallback)(chain, async (entry) => {
-                // Cross-lineage swap: when the entry's lineage differs from the
-                // slot's primary, re-resolve the shim. The slot's identity
-                // (agentName, reviewerDir, participant key) stays bound to the
-                // primary lineage so the cockpit card doesn't re-key mid-run —
-                // the cli_warning below tells the UI a swap happened.
-                const entryShim = entry.lineage === candidate.lineage
-                    ? shim
-                    : (0, index_js_2.pickShimForVoice)(entry.lineage, entry.model);
-                return (0, reviewer_js_1.runReviewerHeadless)({
-                    shim: entryShim,
-                    chatId,
-                    phase,
-                    round,
-                    reviewerIdx,
-                    candidateLineage: entry.lineage,
-                    candidateModel: entry.model,
-                    agentName,
-                    askContent: ask,
-                    answerFile,
-                    reviewerDir,
-                    abortSignal: handle.signal,
-                    onEvent,
-                });
-            }, (from, to, fromIdx) => {
-                const sameLineage = from.lineage === to.lineage;
-                const reason = sameLineage ? 'model_fallback' : 'lineage_fallback';
-                const message = sameLineage
-                    ? `Reviewer model "${from.model ?? '(default)'}" produced no answer; retrying with "${to.model ?? '(default)'}".`
-                    : `Reviewer ${from.lineage}/${from.model ?? '(default)'} failed; switching to ${to.lineage}/${to.model ?? '(default)'} (cross-lineage fallback).`;
-                // Structured daemon-log line. Pairs with the [reviewer] attempt-
-                // failed line that was just emitted by reviewer.ts: tail the log
-                // and you see "attempt failed" → "fallback fired" → next
-                // "attempt failed" or success in order, per slot.
-                console.warn(`[reviewer] fallback fired chat=${chatId} round=${round} ` +
-                    `slot=${agentName}-${reviewerIdx} reason=${reason} ` +
-                    `from=${from.lineage}/${from.model ?? '(default)'} ` +
-                    `to=${to.lineage}/${to.model ?? '(default)'} ` +
-                    `chain_idx=${fromIdx}`);
-                onEvent({
-                    chatId,
-                    type: 'cli_warning',
-                    payload: {
-                        phaseId: phase.id,
+        const ask = (0, prompt_builder_js_1.buildReviewerAsk)(phase, phaseIdx, round, work, doerOutput, filesBlock, reviewerPersonaPrompt);
+        fs_1.default.writeFileSync(askFile, ask);
+        // Per-slot model fallback: when candidate.models lists multiple models
+        // we try them in order, falling through on `null` (no answer produced).
+        // The boolean verdict `false` (disagreement) is a real result and stops
+        // the chain — runWithModelFallback only re-tries on literal null.
+        const transport = await (0, transport_js_1.getTransport)();
+        if (transport === 'headless' && shim.runHeadless) {
+            const handle = participantAborts.register(chatId, participantAborts.participantKey('reviewer', agentName, reviewerIdx), abortSignal);
+            try {
+                // Compose: this slot's per-slot chain + template-level
+                // fallback.reviewer (same lineage, dedup'd against this slot AND
+                // every other reviewer slot in the phase so we don't spawn a
+                // duplicate voice).
+                const allReviewerSlots = (phase.reviewer?.candidates ?? []).map((c) => ({
+                    lineage: c.lineage,
+                    models: c.models ?? [],
+                }));
+                const thisSlot = {
+                    lineage: candidate.lineage,
+                    models: candidate.models ?? [],
+                };
+                const chain = (0, template_fallback_js_1.buildSlotFallbackChain)(thisSlot, allReviewerSlots, templateFallbackReviewer);
+                return await (0, run_with_fallback_js_1.runWithChainFallback)(chain, async (entry) => {
+                    // Cross-lineage swap: when the entry's lineage differs from the
+                    // slot's primary, re-resolve the shim. The slot's identity
+                    // (agentName, reviewerDir, participant key) stays bound to the
+                    // primary lineage so the cockpit card doesn't re-key mid-run —
+                    // the cli_warning below tells the UI a swap happened.
+                    const entryShim = entry.lineage === candidate.lineage
+                        ? shim
+                        : (0, index_js_2.pickShimForVoice)(entry.lineage, entry.model);
+                    return (0, reviewer_js_1.runReviewerHeadless)({
+                        shim: entryShim,
+                        chatId,
+                        phase,
                         round,
-                        role: 'reviewer',
-                        agent: `${agentName}-${reviewerIdx}`,
-                        reason,
-                        fromLineage: from.lineage,
-                        toLineage: to.lineage,
-                        fromModel: from.model ?? '(default)',
-                        toModel: to.model ?? '(default)',
-                        fallbackIdx: fromIdx,
-                        message,
-                    },
-                    ts: Date.now(),
-                });
-                // Persist a sidecar so swap cards survive page reloads — the
-                // SSE stream shuts off for terminal chats, and phase_events
-                // packs warnings as opaque text. Mirrors the _stats.json /
-                // _meta.json pattern: append-only JSON array, read by the
-                // run-artifacts route at the next refresh tick.
-                (0, swap_sidecar_js_1.appendSwapSidecar)(reviewerDir, {
-                    round,
-                    phaseId: phase.id,
-                    role: 'reviewer',
-                    agent: `${agentName}-${reviewerIdx}`,
-                    reason,
-                    fromLineage: from.lineage,
-                    toLineage: to.lineage,
-                    fromModel: from.model ?? '(default)',
-                    toModel: to.model ?? '(default)',
-                    fallbackIdx: fromIdx,
-                    ts: Date.now(),
-                });
-            });
-        }
-        finally {
-            handle.release();
-        }
-    }
-    // Reviewers don't share sessions across rounds — each round wants a
-    // fresh perspective on the new doer output. Across-phase reuse never
-    // makes sense.
-    const perms = await (0, permissions_js_1.getPermissions)();
-    const sessionName = (0, sanitize_name_js_1.sanitizeName)(`chorus-${chatId}-${phase.id}-reviewer-${agentName}-${reviewerIdx}`);
-    const session = await tmuxMgr.acquire({
-        chatId,
-        phaseId: phase.id,
-        role: 'reviewer',
-        round,
-        shareSessionAcrossRounds: false,
-        shareSessionAcrossPhases: false,
-        shim,
-        spawnOpts: {
-            sessionName,
-            cwd: reviewerDir,
-            model: candidate.models?.[0],
-            sandbox: perms.sandboxProfile,
-            autoApprove: perms.autoApprovePrompts,
-            networkAccess: perms.networkAccess,
-        },
-        agentName: `${agentName}-${reviewerIdx}`,
-    });
-    if (shim.clearKeys && shim.clearKeys.length > 0) {
-        tmuxMgr.sendKeys(session.name, [...shim.clearKeys]);
-    }
-    if (shim.preNudge)
-        shim.preNudge(session.name);
-    const prompt = shim.formatPrompt({
-        promptFile: askFile,
-        answerFile,
-        task: `Review: ${phase.title}`,
-        expectDoneSentinel: true,
-    });
-    // Wait for the CLI's TUI to finish cold-start before pasting (6s
-    // covers Codex's slow cold-start). See doer-driver for rationale.
-    await new Promise((r) => setTimeout(r, 6000));
-    tmuxMgr.pasteBuffer(session.name, prompt);
-    await new Promise((r) => setTimeout(r, 500));
-    tmuxMgr.sendKeys(session.name, ['Enter']);
-    // Failure-mode polling — same pattern as the doer.
-    const pollHandle = setInterval(() => {
-        try {
-            const pane = tmuxMgr.capturePane(session.name);
-            const err = errorDetector.inspect(session.name, candidate.lineage, pane);
-            if (err) {
-                const recoveryKeys = err.kind === 'permission_prompt' ? shim.recoverKeys?.permission_prompt : undefined;
-                if (recoveryKeys && recoveryKeys.length > 0) {
-                    tmuxMgr.sendKeys(session.name, [...recoveryKeys]);
+                        reviewerIdx,
+                        candidateLineage: entry.lineage,
+                        candidateModel: entry.model,
+                        agentName,
+                        askContent: ask,
+                        answerFile,
+                        reviewerDir,
+                        abortSignal: handle.signal,
+                        onEvent,
+                    });
+                }, (from, to, fromIdx) => {
+                    const sameLineage = from.lineage === to.lineage;
+                    const reason = sameLineage ? 'model_fallback' : 'lineage_fallback';
+                    const message = sameLineage
+                        ? `Reviewer model "${from.model ?? '(default)'}" produced no answer; retrying with "${to.model ?? '(default)'}".`
+                        : `Reviewer ${from.lineage}/${from.model ?? '(default)'} failed; switching to ${to.lineage}/${to.model ?? '(default)'} (cross-lineage fallback).`;
+                    // Structured daemon-log line. Pairs with the [reviewer] attempt-
+                    // failed line that was just emitted by reviewer.ts: tail the log
+                    // and you see "attempt failed" → "fallback fired" → next
+                    // "attempt failed" or success in order, per slot.
+                    console.warn(`[reviewer] fallback fired chat=${chatId} round=${round} ` +
+                        `slot=${agentName}-${reviewerIdx} reason=${reason} ` +
+                        `from=${from.lineage}/${from.model ?? '(default)'} ` +
+                        `to=${to.lineage}/${to.model ?? '(default)'} ` +
+                        `chain_idx=${fromIdx}`);
                     onEvent({
                         chatId,
                         type: 'cli_warning',
@@ -399,59 +348,154 @@ async function runReviewer(chatDir, chatId, phase, phaseIdx, round, reviewerIdx,
                             round,
                             role: 'reviewer',
                             agent: `${agentName}-${reviewerIdx}`,
-                            recovered: err.kind,
-                            keys: [...recoveryKeys],
-                            detail: err.detail,
+                            reason,
+                            fromLineage: from.lineage,
+                            toLineage: to.lineage,
+                            fromModel: from.model ?? '(default)',
+                            toModel: to.model ?? '(default)',
+                            fallbackIdx: fromIdx,
+                            message,
                         },
                         ts: Date.now(),
                     });
-                }
-                else {
-                    // Fire-and-forget — see doer-driver for rationale.
-                    (0, cli_health_js_1.recordHealth)({
-                        lineage: candidate.lineage,
-                        status: (0, cli_health_js_1.kindToStatus)(err.kind),
-                        message: err.message,
-                        resetAt: err.resetAt,
-                    }).catch((healthErr) => {
-                        console.error(`[chorus] recordHealth failed for ${candidate.lineage}:`, healthErr);
-                    });
-                    onEvent({
-                        chatId,
-                        type: 'cli_error',
-                        payload: {
-                            phaseId: phase.id,
-                            round,
-                            role: 'reviewer',
-                            agent: `${agentName}-${reviewerIdx}`,
-                            error: err,
-                        },
+                    // Persist a sidecar so swap cards survive page reloads — the
+                    // SSE stream shuts off for terminal chats, and phase_events
+                    // packs warnings as opaque text. Mirrors the _stats.json /
+                    // _meta.json pattern: append-only JSON array, read by the
+                    // run-artifacts route at the next refresh tick.
+                    (0, swap_sidecar_js_1.appendSwapSidecar)(reviewerDir, {
+                        round,
+                        phaseId: phase.id,
+                        role: 'reviewer',
+                        agent: `${agentName}-${reviewerIdx}`,
+                        reason,
+                        fromLineage: from.lineage,
+                        toLineage: to.lineage,
+                        fromModel: from.model ?? '(default)',
+                        toModel: to.model ?? '(default)',
+                        fallbackIdx: fromIdx,
                         ts: Date.now(),
                     });
-                }
+                });
+            }
+            finally {
+                handle.release();
             }
         }
-        catch {
-            // ignore
+        // Reviewers don't share sessions across rounds — each round wants a
+        // fresh perspective on the new doer output. Across-phase reuse never
+        // makes sense.
+        const perms = await (0, permissions_js_1.getPermissions)();
+        const sessionName = (0, sanitize_name_js_1.sanitizeName)(`chorus-${chatId}-${phase.id}-reviewer-${agentName}-${reviewerIdx}`);
+        const session = await tmuxMgr.acquire({
+            chatId,
+            phaseId: phase.id,
+            role: 'reviewer',
+            round,
+            shareSessionAcrossRounds: false,
+            shareSessionAcrossPhases: false,
+            shim,
+            spawnOpts: {
+                sessionName,
+                cwd: reviewerDir,
+                model: candidate.models?.[0],
+                sandbox: perms.sandboxProfile,
+                autoApprove: perms.autoApprovePrompts,
+                networkAccess: perms.networkAccess,
+            },
+            agentName: `${agentName}-${reviewerIdx}`,
+        });
+        if (shim.clearKeys && shim.clearKeys.length > 0) {
+            tmuxMgr.sendKeys(session.name, [...shim.clearKeys]);
         }
-    }, 2000);
-    try {
-        const result = await (0, output_watcher_js_1.waitForAnswer)(answerFile, {
-            timeoutMs: phase.timeoutMs ?? template_schema_js_1.DEFAULT_TMUX_PHASE_TIMEOUT_MS,
-            doneSentinel: '## DONE',
+        if (shim.preNudge)
+            shim.preNudge(session.name);
+        const prompt = shim.formatPrompt({
+            promptFile: askFile,
+            answerFile,
+            task: `Review: ${phase.title}`,
+            expectDoneSentinel: true,
         });
-        if (!result.full || result.content.trim().length === 0) {
-            // Watcher resolved on timeout/silence with no real answer.
+        // Wait for the CLI's TUI to finish cold-start before pasting (6s
+        // covers Codex's slow cold-start). See doer-driver for rationale.
+        await new Promise((r) => setTimeout(r, 6000));
+        tmuxMgr.pasteBuffer(session.name, prompt);
+        await new Promise((r) => setTimeout(r, 500));
+        tmuxMgr.sendKeys(session.name, ['Enter']);
+        // Failure-mode polling — same pattern as the doer.
+        const pollHandle = setInterval(() => {
+            try {
+                const pane = tmuxMgr.capturePane(session.name);
+                const err = errorDetector.inspect(session.name, candidate.lineage, pane);
+                if (err) {
+                    const recoveryKeys = err.kind === 'permission_prompt' ? shim.recoverKeys?.permission_prompt : undefined;
+                    if (recoveryKeys && recoveryKeys.length > 0) {
+                        tmuxMgr.sendKeys(session.name, [...recoveryKeys]);
+                        onEvent({
+                            chatId,
+                            type: 'cli_warning',
+                            payload: {
+                                phaseId: phase.id,
+                                round,
+                                role: 'reviewer',
+                                agent: `${agentName}-${reviewerIdx}`,
+                                recovered: err.kind,
+                                keys: [...recoveryKeys],
+                                detail: err.detail,
+                            },
+                            ts: Date.now(),
+                        });
+                    }
+                    else {
+                        // Fire-and-forget — see doer-driver for rationale.
+                        (0, cli_health_js_1.recordHealth)({
+                            lineage: candidate.lineage,
+                            status: (0, cli_health_js_1.kindToStatus)(err.kind),
+                            message: err.message,
+                            resetAt: err.resetAt,
+                        }).catch((healthErr) => {
+                            console.error(`[chorus] recordHealth failed for ${candidate.lineage}:`, healthErr);
+                        });
+                        onEvent({
+                            chatId,
+                            type: 'cli_error',
+                            payload: {
+                                phaseId: phase.id,
+                                round,
+                                role: 'reviewer',
+                                agent: `${agentName}-${reviewerIdx}`,
+                                error: err,
+                            },
+                            ts: Date.now(),
+                        });
+                    }
+                }
+            }
+            catch {
+                // ignore
+            }
+        }, 2000);
+        try {
+            const result = await (0, output_watcher_js_1.waitForAnswer)(answerFile, {
+                timeoutMs: phase.timeoutMs ?? template_schema_js_1.DEFAULT_TMUX_PHASE_TIMEOUT_MS,
+                doneSentinel: '## DONE',
+            });
+            if (!result.full || result.content.trim().length === 0) {
+                // Watcher resolved on timeout/silence with no real answer.
+                return null;
+            }
+            return (0, verdict_js_1.verdictFromReviewerText)(result.content);
+        }
+        catch {
+            // Timed out or watcher errored — no valid answer produced.
             return null;
         }
-        return (0, verdict_js_1.verdictFromReviewerText)(result.content);
-    }
-    catch {
-        // Timed out or watcher errored — no valid answer produced.
-        return null;
+        finally {
+            clearInterval(pollHandle);
+        }
     }
     finally {
-        clearInterval(pollHandle);
+        releaseSlot?.();
     }
 }
 //# sourceMappingURL=reviewer-driver.js.map