engineering-memory 1.11.28 → 1.11.29

package/runtime/dist/src/runtime/bridge-service.js

@@ -24,7 +24,8 @@ import { catalogueLanguages, copies, fetchLanguage, format } from './texts.js';
 import * as z from 'zod/v4';
 import { BridgeRecoveryError } from './recovery-error.js';
 import { gitLabRemote } from '../providers/gitlab.js';
-import { awaitsReviewRequest, reviewDeliveries, } from './merge-request-sync.js';
+import { awaitsReviewRequest, concludedReview, opensAsDraft, reviewDeliveries, reviewDeliverySchema, waitingReview, } from './merge-request-sync.js';
+import { maskFinding } from './review-masking.js';
 export const validationIds = [
     'format',
     'static_analysis',
@@ -453,6 +454,7 @@ export class BridgeService {
                 taskKind: input.taskKind,
                 workItemKey: input.workItemKey,
                 workItemId: input.workItemId,
+                reviewFixOf: input.reviewFixOf,
                 mode: input.mode,
                 knownRevisions: input.knownRevisions,
             }, repository.repoRoot);
@@ -513,6 +515,9 @@ export class BridgeService {
                 this.poolAllocations.set(repository.repoRoot, poolAllocation);
             }
             const checkpointId = deterministicUuid('session.bootstrap', projectId, repository.repoFingerprint, input.externalTaskId);
+            const reviewed = persistedBootstrap.reviewFixOf
+                ? (await this.review(projectId, persistedBootstrap.reviewFixOf)).delivery
+                : null;
             const response = await this.requestWithNewerFields(endpoints.sessionBootstrap, ['checkoutFingerprints'], {
                 method: 'POST',
                 idempotencyKey: checkpointId,
@@ -523,7 +528,8 @@ export class BridgeService {
                     objective: persistedBootstrap.objective,
                     taskKind: persistedBootstrap.taskKind,
                     workItemKey: persistedBootstrap.workItemKey,
-                    workItemId: persistedBootstrap.workItemId,
+                    workItemId: persistedBootstrap.workItemId ?? reviewed?.workItemId ?? undefined,
+                    reviewFixOfTaskId: persistedBootstrap.reviewFixOf,
                     mode: persistedBootstrap.mode ?? 'write',
                     repoFingerprint: repository.repoFingerprint,
                     checkoutFingerprints: await this.dependencies.repositories.checkoutFingerprints(repository.repoRoot),
@@ -2608,6 +2614,14 @@ export class BridgeService {
                 if (unusable)
                     throw refuse(unusable, 'task.branch');
             }
+            const reviewed = input.reviewFixOf
+                ? (await this.review(repository.projectId, input.reviewFixOf)).delivery
+                : null;
+            if (reviewed &&
+                (!waitingReview.includes(reviewed.reviewState ?? '') ||
+                    !reviewed.pushed ||
+                    !reviewed.branch))
+                throw refuse(`The review of ${reviewed.externalTaskId} is not waiting for a fix (${reviewed.reviewState ?? 'no review'}${reviewed.pushed ? '' : ', not pushed'}), so there is no pull request branch to fix. Read it with review.get.`, 'review.get');
             const [preferences, currentBranch, folder, suggestedName] = await Promise.all([
                 this.dependencies.client.request(endpoints.projectGitPreferences(repository.projectId)),
                 this.dependencies.repositories.git.currentBranch(repository.repoRoot),
@@ -2621,6 +2635,9 @@ export class BridgeService {
                 currentCommit: repository.git.head,
                 folder,
                 suggestedName,
+                reviewFix: reviewed
+                    ? { branch: reviewed.branch, externalTaskId: reviewed.externalTaskId }
+                    : null,
                 ...(input.workItemId
                     ? await this.workItemBranches(repository.repoRoot, repository.projectId, input.workItemProjectId ?? repository.projectId, input.workItemId, preferences.data)
                     : { planBranch: null, continueBranches: [] }),
@@ -4169,7 +4186,7 @@ export class BridgeService {
             const livePointers = authenticated && state === 'bound'
                 ? this.dependencies.activeContexts.list(repository.repoFingerprint)
                 : Promise.resolve([]);
-            const [client, liveTasksRaw, workItems, gitPreferences, worktrees, pendingQuestionnaires, moved, deliveries, reviews,] = await Promise.all([
+            const [client, liveTasksRaw, workItems, gitPreferences, worktrees, pendingQuestionnaires, moved, deliveries, reviews, codeReviews,] = await Promise.all([
                 this.clientUpdate(authenticated),
                 livePointers,
                 authenticated && state === 'bound' && projectId
@@ -4196,6 +4213,9 @@ export class BridgeService {
                 authenticated && state === 'bound' && projectId
                     ? this.reviewCandidates(projectId)
                     : Promise.resolve(null),
+                authenticated && state === 'bound' && projectId
+                    ? this.awaitingReviews(projectId)
+                    : Promise.resolve(null),
             ]);
             timer.mark('independent_lookups');
             if (projectId && reviews)
@@ -4257,12 +4277,13 @@ export class BridgeService {
                                 workItemKey: delivery.workItemKey ?? null,
                                 branch: delivery.branch ?? null,
                                 targetBranch: delivery.baseBranch ?? null,
-                                draft: delivery.choice === 'commit_push_draft_pr',
+                                draft: opensAsDraft(delivery),
                             })),
-                            nextAction: 'These delivered tasks chose a pull request, but none is recorded for them yet. Mention them to the user in one line. On a GitLab remote, task.open_review_request opens one from this computer when the user asks; a pull request opened anywhere else is recorded with task.review_request. A merge request someone opened by hand on a GitLab this computer follows is found by itself.',
+                            nextAction: 'These delivered tasks chose a pull request, but none is recorded for them yet. Mention them to the user in one line. On a GitLab remote, task.open_review_request opens one from this computer when the user asks; a pull request opened anywhere else is recorded with task.review_request, as a draft where draft is true. A merge request someone opened by hand on a GitLab this computer follows is found by itself.',
                         },
                     }
                     : {}),
+                ...(codeReviews ? { awaitingReviews: codeReviews } : {}),
                 client,
                 ...moved,
                 ...(incomplete && state === 'bound'
@@ -4382,6 +4403,42 @@ export class BridgeService {
             return null;
         }
     }
+    async awaitingReviews(projectId) {
+        try {
+            const response = await this.dependencies.client.request(`${endpoints.reviewQueue(projectId)}?offset=0&limit=5`);
+            const page = z
+                .object({
+                total: z.number().int(),
+                items: z.array(reviewDeliverySchema.extend({
+                    openRound: z.object({ number: z.number().int(), createdAt: z.string() }).nullish(),
+                    openFindings: z.number().int(),
+                })),
+            })
+                .parse(response.data);
+            if (!page.total)
+                return null;
+            return asJsonValue({
+                total: page.total,
+                items: page.items.map((item) => ({
+                    taskId: item.taskId,
+                    externalTaskId: item.externalTaskId ?? null,
+                    workItemKey: item.workItemKey ?? null,
+                    reviewState: item.reviewState ?? null,
+                    pullRequest: item.reviewRequest
+                        ? { url: item.reviewRequest.url, state: item.reviewRequest.state }
+                        : null,
+                    openRound: item.openRound
+                        ? { number: item.openRound.number, since: item.openRound.createdAt }
+                        : null,
+                    openFindings: item.openFindings,
+                })),
+                nextAction: 'These deliveries wait for code review. Mention them to the user in one line and start nothing on your own. When the user asks, review.get reads one and review.start runs its next round from a clone of this project; a review that ended while its PR/MR is still a draft waits for review.make_ready.',
+            });
+        }
+        catch {
+            return null;
+        }
+    }
     async actionableWorkItems(projectId) {
         try {
             const response = await this.dependencies.client.request(`${endpoints.workItemList(projectId)}?limit=100&actionable=true`);
@@ -4692,6 +4749,7 @@ export class BridgeService {
             expectedVersion: input.expectedVersion,
             choice: input.choice,
             baseBranch: input.baseBranch,
+            expectedReviewPolicy: input.expectedReviewPolicy,
             answerSource: input.answerSource,
         })));
     }
@@ -4778,6 +4836,201 @@ export class BridgeService {
             });
         });
     }
+    async projectReviewPolicy(input) {
+        return this.execute(async () => {
+            const projects = await this.dependencies.client.request(endpoints.projectList);
+            const project = z
+                .array(z.object({
+                id: z.string(),
+                name: z.string(),
+                lockVersion: z.number().int(),
+                role: z.string().optional(),
+                reviewPolicy: reviewPolicySchema.optional(),
+                reviewPolicyChangedAt: z.string().nullish(),
+            }))
+                .parse(projects.data)
+                .find((candidate) => candidate.id === input.projectId);
+            if (!project)
+                throw refuse('This project is not among the projects you can open.', 'project.list');
+            if (!project.reviewPolicy)
+                throw refuse('This Engineering Memory server has no code review setting yet.', 'session.entry');
+            return asJsonValue(project);
+        });
+    }
+    async reviewQueue(input) {
+        return this.execute(async () => {
+            const query = new URLSearchParams({
+                offset: String(input.offset ?? 0),
+                limit: String(input.limit ?? 20),
+            });
+            return asJsonValue((await this.dependencies.client.request(`${endpoints.reviewQueue(input.projectId)}?${query}`)).data);
+        });
+    }
+    async reviewGet(input) {
+        return this.execute(async () => asJsonValue((await this.dependencies.client.request(endpoints.review(input.projectId, input.taskId))).data));
+    }
+    async reviewStart(input) {
+        return this.execute(async () => {
+            const repository = await this.dependencies.repositories.resolveIdentity(input.repoRoot ?? process.cwd());
+            if (repository.projectId !== input.projectId)
+                throw refuse("Call this in a clone of the reviewed task's project repository: this folder belongs to another project, or to none.", 'session.entry');
+            const { delivery } = await this.review(input.projectId, input.taskId);
+            const task = delivery.externalTaskId;
+            if (!waitingReview.includes(delivery.reviewState ?? ''))
+                throw refuse(delivery.reviewState && concludedReview.includes(delivery.reviewState)
+                    ? `The review of ${task} already ended (${delivery.reviewState}), so there is nothing to review. review.make_ready makes its PR/MR ready.`
+                    : `No code review was asked for ${task}. A review starts when its delivery chooses a reviewed PR/MR, or, where review is required, when its PR/MR is recorded.`, 'review.get');
+            if (delivery.state !== 'delivered' || !delivery.pushed || !delivery.branch)
+                throw refuse(`${task} is not pushed yet, and a review reads the pushed branch. Push it and record the delivery (worktree.release with deliveryOutcome delivered), then call review.start again.`, 'review.get');
+            const target = input.targetBranch ?? delivery.baseBranch;
+            if (!target)
+                throw refuse(`The delivery of ${task} names no target branch. Call review.start again with targetBranch: the branch its PR/MR goes into.`, 'review.start');
+            const git = this.dependencies.repositories.git;
+            const fetched = (branch) => git.fetchBranchCommit(repository.repoRoot, 'origin', branch).catch(() => null);
+            const head = await fetched(delivery.branch);
+            if (!head)
+                throw refuse(`This review reads ${delivery.branch} from origin, and this clone could not fetch it: either its origin remote is not the project's repository, or this computer cannot reach the Git server. If the server is reachable only from the company network, connect (for example through the VPN) and call review.start again; any member's computer that reaches it can run the review.`, 'review.start');
+            const tip = await fetched(target);
+            if (!tip)
+                throw refuse(`The target branch ${target} could not be fetched from origin. If the PR/MR goes into another branch, call review.start again with targetBranch.`, 'review.start');
+            const base = await git.mergeBase(repository.repoRoot, head.sourceCommit, tip.sourceCommit);
+            const started = reviewSchema.parse((await this.dependencies.client.request(endpoints.reviewRounds(input.projectId, input.taskId), {
+                method: 'POST',
+                body: cleanJson({ commit: head.sourceCommit, baseCommit: base ?? undefined }),
+            })).data);
+            const round = started.rounds.find((candidate) => candidate.state === 'open');
+            if (!round)
+                throw refuse(`The review of ${task} has no open round. Read it with review.get.`, 'review.get');
+            const files = base
+                ? await git.changedFiles(repository.repoRoot, base, head.sourceCommit)
+                : [];
+            const records = await this.dependencies.client.request(`${endpoints.reviewRoundRules(input.projectId, round.id)}?offset=0&limit=5`);
+            const range = base ? `${base} ${head.sourceCommit}` : head.sourceCommit;
+            return asJsonValue({
+                review: {
+                    projectId: input.projectId,
+                    taskId: input.taskId,
+                    externalTaskId: task,
+                    workItemKey: delivery.workItemKey ?? null,
+                    reviewPolicy: delivery.reviewPolicy ?? null,
+                    branch: delivery.branch,
+                    targetBranch: target,
+                    pullRequest: delivery.reviewRequest?.url ?? null,
+                },
+                round: {
+                    id: round.id,
+                    number: round.number,
+                    headCommit: head.sourceCommit,
+                    baseCommit: base,
+                },
+                changedFiles: files.slice(0, 300),
+                changedFileCount: files.length,
+                earlierFindings: round.number > 1 ? started.findings : [],
+                records: records.data,
+                commands: base
+                    ? [
+                        `git diff --stat ${range}`,
+                        `git diff ${range} -- <path>`,
+                        `git show ${head.sourceCommit}:<path>`,
+                        `git grep -n <pattern> ${head.sourceCommit} -- <path>`,
+                        `git log --oneline ${base}..${head.sourceCommit}`,
+                    ]
+                    : [
+                        `git show --stat ${head.sourceCommit}`,
+                        `git show ${head.sourceCommit}:<path>`,
+                        `git grep -n <pattern> ${head.sourceCommit} -- <path>`,
+                    ],
+                nextAction: `Give this packet to a fresh subagent that did not write the change; if your host cannot start one, review it yourself under the same rules. The reviewer reads the change from baseCommit to headCommit only through the listed read-only Git commands: it never checks out, switches branches, edits, commits or pushes, and changes no file. It judges the change against the records (more with review.rules for this round from offset 5 while more are listed) and says whether each earlier finding still holds. Each finding names the file path, the line in headCommit when there is one, the ruleKey of the record it breaks when one applies, and a plain description of what is wrong and why. Then call review.submit with this projectId, roundId and the findings, an empty list when there are none.`,
+            });
+        });
+    }
+    async reviewRules(input) {
+        return this.execute(async () => {
+            const query = new URLSearchParams({
+                offset: String(input.offset ?? 0),
+                limit: String(input.limit ?? 5),
+            });
+            return asJsonValue((await this.dependencies.client.request(`${endpoints.reviewRoundRules(input.projectId, input.roundId)}?${query}`)).data);
+        });
+    }
+    async reviewSubmit(input) {
+        return this.execute(async () => {
+            const absolute = input.findings.findIndex(({ path }) => /^(?:[A-Za-z]:|~)?[\\/]/.test(path));
+            if (absolute >= 0)
+                throw refuse(`Finding ${absolute + 1} names its file by an absolute path. Name it by its path in the repository, as git diff shows it (for example src/app.ts), and call review.submit again.`, 'review.submit');
+            const checked = input.findings.map((finding) => ({
+                finding,
+                mask: maskFinding(finding.description),
+            }));
+            const unsafe = checked.findIndex(({ mask }) => mask.left);
+            if (unsafe >= 0)
+                throw refuse(`The description of finding ${unsafe + 1} still looks like it holds private data (${checked[unsafe].mask.left}) after e-mail addresses, IP addresses and user folders were masked. Describe the problem without the value itself, for example "a secret is committed in this file", and call review.submit again.`, 'review.submit');
+            const findings = checked.map(({ finding, mask }) => ({
+                ...finding,
+                description: mask.text,
+            }));
+            const idempotencyKey = deterministicUuid('review.submit', input.roundId, stableStringify(findings));
+            const response = await this.dependencies.client.request(endpoints.reviewRoundResult(input.projectId, input.roundId), { method: 'POST', body: cleanJson({ idempotencyKey, findings }) });
+            return asJsonValue({
+                review: response.data,
+                masked: [...new Set(checked.flatMap(({ mask }) => mask.masked))],
+            });
+        });
+    }
+    async reviewRejectFinding(input) {
+        return this.execute(async () => asJsonValue((await this.dependencies.client.request(endpoints.reviewFindingRejection(input.projectId, input.findingId), { method: 'POST', body: { reason: input.reason } })).data));
+    }
+    async reviewConclude(input) {
+        return this.execute(async () => {
+            const path = input.outcome === 'passed'
+                ? endpoints.reviewPass(input.projectId, input.taskId)
+                : input.outcome === 'skipped'
+                    ? endpoints.reviewSkip(input.projectId, input.taskId)
+                    : endpoints.reviewExemption(input.projectId, input.taskId);
+            return asJsonValue((await this.dependencies.client.request(path, {
+                method: 'POST',
+                ...(input.outcome === 'exempted' ? { body: { reason: input.reason ?? '' } } : {}),
+            })).data);
+        });
+    }
+    async reviewMakeReady(input) {
+        return this.execute(async () => {
+            const { delivery } = await this.review(input.projectId, input.taskId);
+            const task = delivery.externalTaskId;
+            const request = delivery.reviewRequest;
+            if (waitingReview.includes(delivery.reviewState ?? ''))
+                throw refuse(`The review of ${task} has not ended (${delivery.reviewState}), so its PR/MR stays a draft until it does.`, 'review.get');
+            if (!request)
+                return asJsonValue({
+                    ready: false,
+                    nextAction: `No PR/MR is recorded for ${task}. Open it now as ready: on GitLab task.open_review_request with draft false; elsewhere with your own tools, then record it with task.review_request.`,
+                });
+            if (request.state !== 'draft')
+                return asJsonValue({
+                    ready: request.state === 'ready',
+                    pullRequest: { url: request.url, state: request.state },
+                    nextAction: `${request.url} is ${request.state} already; nothing was changed.`,
+                });
+            if (request.provider !== 'gitlab' || !this.dependencies.gitlab)
+                return asJsonValue({
+                    ready: false,
+                    pullRequest: { url: request.url, state: request.state },
+                    nextAction: `Mark ${request.url} ready for review with your own tools (on GitHub, gh pr ready or the "Ready for review" button), or ask the user to, then record it with task.review_request state ready.`,
+                });
+            const readied = await this.dependencies.gitlab.requests.markReady(request);
+            if (readied.state !== 'ready')
+                return asJsonValue({
+                    ready: false,
+                    pullRequest: readied,
+                    nextAction: `GitLab still shows ${readied.url} as ${readied.state}. Ask the user to mark it ready in GitLab ("Mark as ready"); Engineering Memory follows it.`,
+                });
+            const report = await this.mutateWithOutbox('task.review_request', endpoints.taskReviewRequest(input.projectId, input.taskId), { url: readied.url, state: 'ready', source: 'machine' });
+            return asJsonValue({ ready: true, pullRequest: readied, report });
+        });
+    }
+    async review(projectId, taskId) {
+        return reviewSchema.parse((await this.dependencies.client.request(endpoints.review(projectId, taskId))).data);
+    }
     async reportDeliveryOutcome(report) {
         const path = report.outcome === 'delivered'
             ? endpoints.taskDeliveryDeliver(report.projectId, report.taskId)
@@ -5954,6 +6207,21 @@ function slugify(value) {
         .replace(/[^a-z0-9]+/g, '-')
         .replace(/^-|-$/g, '');
 }
+const reviewPolicySchema = z.enum(['none', 'optional', 'required']);
+const reviewSchema = z.object({
+    delivery: reviewDeliverySchema.extend({
+        externalTaskId: z.string(),
+        workItemId: z.string().nullish(),
+        reviewPolicy: reviewPolicySchema.optional(),
+    }),
+    rounds: z.array(z.object({
+        id: z.string(),
+        number: z.number().int(),
+        state: z.string(),
+        headCommit: z.string(),
+    })),
+    findings: z.array(z.unknown()),
+});
 function deterministicUuid(...parts) {
     const value = sha256(parts.join('\n')).slice(0, 32).split('');
     value[12] = '5';

package/runtime/dist/src/runtime/merge-request-sync.js

@@ -13,6 +13,7 @@ export const reviewDeliverySchema = z.object({
     pushed: z.boolean().nullish(),
     branch: z.string().nullish(),
     workItemKey: z.string().nullish(),
+    reviewState: z.string().nullish(),
     reviewRequest: z
         .object({
         provider: z.string(),
@@ -26,6 +27,14 @@ export const reviewDeliverySchema = z.object({
         .nullish(),
 });
 const pullRequestChoices = ['commit_push_draft_pr', 'commit_push_pr'];
+export const waitingReview = ['pending', 'in_review', 'findings_open'];
+export const concludedReview = ['passed', 'skipped', 'exempted'];
+const draftPrefix = /^\s*(?:(?:\[draft\]|\(draft\)|draft:|\[wip\]|wip:)\s*)+/i;
+export function opensAsDraft(delivery) {
+    const review = delivery.reviewState ?? '';
+    return (waitingReview.includes(review) ||
+        (delivery.choice === 'commit_push_draft_pr' && !concludedReview.includes(review)));
+}
 export function awaitsReviewRequest(delivery) {
     return (!delivery.reviewRequest &&
         delivery.state === 'delivered' &&
@@ -67,7 +76,7 @@ export class MergeRequests {
         const target = input.targetBranch ?? (chosen ? delivery.baseBranch : null);
         if (!target)
             throw new BridgeRecoveryError('The delivery answer did not choose a pull request, so it names no target branch. If the user wants a merge request, call again with the targetBranch they name.', 'task.open_review_request');
-        const draft = input.draft ?? delivery.choice === 'commit_push_draft_pr';
+        const draft = input.draft ?? opensAsDraft(delivery);
         const pushUrl = await this.git.branchPushUrl(input.repoRoot, branch);
         if (!pushUrl)
             throw new BridgeRecoveryError(`This clone has no remote that ${branch} is pushed to. ${manualWay}`, 'task.review_request');
@@ -125,6 +134,38 @@ export class MergeRequests {
             throw error;
         }
     }
+    async markReady(request) {
+        const link = await this.tokens.forLink(request.host, request.repository);
+        const token = link ? await this.tokens.token(link.address) : null;
+        if (!link || !token)
+            throw new BridgeRecoveryError(`No GitLab token is saved on this computer for ${request.host}. Ask the user to mark ${request.url} ready in GitLab ("Mark as ready"); Engineering Memory follows it. Or call gitlab.token so they save their own token here, then call review.make_ready again.`, 'gitlab.token');
+        try {
+            const current = await this.gitlab.mergeRequest(link.address, token, link.project, request.number);
+            if (reviewState(current) !== 'draft')
+                return { url: current.web_url, state: reviewState(current) };
+            if (current.title === undefined)
+                throw new GitLabError('unexpected_answer', link.address, null, null);
+            const after = await this.gitlab.retitleMergeRequest(link.address, token, link.project, request.number, current.title.replace(draftPrefix, '') || defaultTitle(current.source_branch, null));
+            return { url: after.web_url, state: reviewState(after) };
+        }
+        catch (error) {
+            if (!(error instanceof GitLabError))
+                throw error;
+            const at = error.address;
+            const reason = error.failure === 'token_rejected'
+                ? `GitLab at ${at} no longer accepts the saved token (expired or revoked); gitlab.token saves a new one.`
+                : error.failure === 'not_allowed'
+                    ? `GitLab at ${at} refused this with the saved token: changing a merge request needs the api scope and Developer or higher.`
+                    : error.failure === 'unreachable'
+                        ? `This computer cannot reach ${at}; if GitLab is reachable only from the company network, connect and call review.make_ready again.`
+                        : error.failure === 'unknown_outcome'
+                            ? `The answer of GitLab at ${at} was lost after the change was sent, so it may already be ready; calling review.make_ready again is safe and reads where it stands.`
+                            : `GitLab at ${at} answered ${error.failure.replace(/_/g, ' ')}${error.status ? ` (${error.status})` : ''}.`;
+            throw new BridgeRecoveryError(`${reason} ${request.url} may still be a draft: the user can mark it ready in GitLab ("Mark as ready"); Engineering Memory follows it.`, error.failure === 'token_rejected' || error.failure === 'not_allowed'
+                ? 'gitlab.token'
+                : 'review.make_ready', { address: at, failure: error.failure, status: error.status });
+        }
+    }
     schedule(projectId, repoRoot, deliveries) {
         const now = Date.now();
         const last = this.passes.get(projectId);

package/runtime/dist/src/runtime/review-masking.js

@@ -0,0 +1,31 @@
+import { restrictedValueKind } from './privacy-detector.js';
+const masks = [
+    [/[\p{L}\p{N}._%+-]{1,64}@[\p{L}\p{N}.-]+\.\p{L}{2,63}/gu, 'e-mail address', () => '[e-mail]'],
+    [
+        /(?<![\d.])(?:\d{1,3}\.){3}\d{1,3}(?![\d.])/g,
+        'IP address',
+        (match) => (match.split('.').every((part) => Number(part) <= 255) ? '[IP]' : match),
+    ],
+    [
+        /[A-Z]:[\\/](?:Users|Documents and Settings)[\\/][^\\/\s"'<>:|?*]+|\\\\[^\\\s]+\\Users\\[^\\/\s"'<>*]+|(?:\/mnt\/[a-z]|\/cygdrive\/[a-z]|\/System\/Volumes\/Data|\/Volumes\/[^/\s]+|\/export)\/(?:Users|home)\/[^\\/\s"'<>*]+/gi,
+        'user folder',
+        () => '~',
+    ],
+    [
+        /(^|[\s"'(<=])\/(?:[a-z]\/)?(?:Users|home)\/[^\\/\s"'<>*]+/gi,
+        'user folder',
+        (_, before) => before + '~',
+    ],
+];
+export function maskFinding(description) {
+    const masked = new Set();
+    let text = description;
+    for (const [pattern, kind, replace] of masks) {
+        const next = text.replace(pattern, replace);
+        if (next !== text)
+            masked.add(kind);
+        text = next;
+    }
+    return { text, masked: [...masked], left: restrictedValueKind(text, 'description') };
+}
+//# sourceMappingURL=review-masking.js.map

package/runtime/dist/src/runtime/task-start.js

@@ -51,6 +51,7 @@ const startWording = z.strictObject({
     newBranch: text,
     newBranchOrContinue: text,
     continuePlan: text,
+    continueReview: text,
     example: text,
     stay: text,
     base: z.strictObject({
@@ -199,11 +200,16 @@ export function taskStartDefinition(facts) {
         message: copy.message,
         context: keepOnly
             ? copy.keepContext
-            : binding.base?.kind === 'existing'
-                ? format(copy.continuePlan, language, { branch: binding.base.branch })
-                : format(Object.values(binding.bases ?? {}).some((base) => base.kind === 'existing')
-                    ? copy.newBranchOrContinue
-                    : copy.newBranch, language, { name: binding.name }) + (binding.base ? ' · ' + sourceLabel(binding.base, facts.currentBranch) : ''),
+            : binding.base?.kind === 'existing' && facts.reviewedTask
+                ? format(copy.continueReview, language, {
+                    branch: binding.base.branch,
+                    task: facts.reviewedTask,
+                })
+                : binding.base?.kind === 'existing'
+                    ? format(copy.continuePlan, language, { branch: binding.base.branch })
+                    : format(Object.values(binding.bases ?? {}).some((base) => base.kind === 'existing')
+                        ? copy.newBranchOrContinue
+                        : copy.newBranch, language, { name: binding.name }) + (binding.base ? ' · ' + sourceLabel(binding.base, facts.currentBranch) : ''),
         example: keepOnly ? format(copy.stay, language, { source: current }) : copy.example,
         questions,
         binding: JSON.parse(JSON.stringify(binding)),
@@ -216,7 +222,7 @@ function legacyTaskStartDefinition(facts) {
     const folder = facts.folder;
     const keepOnly = facts.keepCurrent === true || !facts.currentCommit;
     const here = !keepOnly && !folder.managed && !folder.heldBy && folder.clean;
-    const keep = keepOnly || (!folder.managed && !folder.heldBy && !folder.holder);
+    const keep = !facts.reviewedTask && (keepOnly || (!folder.managed && !folder.heldBy && !folder.holder));
     const holder = here && folder.holder ? holderIdentity(folder.holder) : null;
     const currentLabel = sourceLabel({ kind: 'current', ...(facts.currentCommit ? { commit: facts.currentCommit } : {}) }, facts.currentBranch);
     const binding = {

package/skill/references/lifecycle.md

@@ -300,6 +300,16 @@ When the delivery chose a pull request and the branch is pushed to a GitLab, ope
 
 When the user later says a pull request became ready, was merged or was closed, record that state with `task.review_request` too; it works from any chat, also for a delivery `session.entry` lists. Engineering Memory then moves the task's work item as the project's workflow rules say: to the `pr_opened` target once every pull request of the work item is ready, to the `all_prs_merged` target (READY FOR QA by default) once they are all merged, and to the draft target when one is still a draft and the project names one. It waits while another task of the work item is still open, or closed with a delivery that has no pull request yet. Relay the returned `nextAction` in one line. A record is what was reported, unless a member's computer read it from GitLab: where someone has saved a GitLab token, the bridge reads the project's merge requests in the background when a chat opens or work items are listed, and records a merge, a close or a draft turning ready by itself, also for a merge request someone opened by hand. Never report a merge the user has not confirmed. A merge is final, and a delivery keeps the first pull request recorded for it. GitHub pull request and GitLab merge request links are recorded; for another provider, move the work item with `work_item.update`.
 
+## Code review
+
+A project can review code before a pull request is ready: `project.review_policy` reads its setting — none, optional or required — and, only when the user asks to change it, `change: true` asks them in one native form; only an owner or maintainer can change it. Under optional the delivery question offers a pull request reviewed first, which opens as a draft, and one without review; under required only the reviewed one. A user's own instruction for a ready pull request under required becomes the reviewed one, and the tool says so; relay it. When the tool says the setting changed while the question was open, tell the user and call it again.
+
+After a reviewed pull request is pushed and the worktree released, open it as a draft (`task.open_review_request`, or your own tools and `task.review_request` with `draft`), then call `review.start` in a clone of the project. It fetches the pushed branch without checking anything out and returns the review packet. Give the packet to a fresh subagent that did not write the change; only when your host cannot start one, review it yourself under the same rules. The reviewer reads the change only through the read-only Git commands the packet lists: it never checks out, switches branches, edits, commits, pushes or changes a file. It judges the change against the packet's records (more with `review.rules`) and says whether each earlier finding still holds. Each finding names the file by its path in the repository, the line in the reviewed commit when there is one, the key of the record it breaks when one applies, and what is wrong and why in plain words. Record the result with `review.submit`, an empty list when there are no findings. Describe a problem without the value itself: e-mail addresses, IP addresses and user folders are masked, and a description that still looks like it holds a secret or personal data is refused.
+
+Show the findings to the user and ask whether to fix them. A fix is a write task: `task.branch` with `reviewFixOf` set to the reviewed task's id, then `session.bootstrap` with the same `reviewFixOf`; it continues the pull request's branch, and its delivery offers commit or commit and push onto that branch — never a second pull request. After its push the open findings are marked fixed; ask whether to review again (`review.start`) or end the review (`review.conclude` with passed). A finding the user disagrees with is rejected with `review.reject_finding`, where the user writes the reason in the form; never write it for them. `review.conclude` also skips a review where the setting is not required, and exempts one under required, which only an owner or maintainer can do and only with the reason the user writes. Every one of these asks the user in a native form first.
+
+Once a review has ended, call `review.make_ready`: on GitLab, with the user's own token saved, it removes Draft and records the pull request ready; anywhere else follow its `nextAction` (for example `gh pr ready`) and record the state with `task.review_request`. It also makes ready, when the user asks, a pull request that has no code review. Never mark a draft ready while its review has not ended. `session.entry` lists as `awaitingReviews` the deliveries that wait for code review; mention them in one line and start nothing on your own. When the user asks, `review.queue` and `review.get` read them, and every member except readers can continue any review where it stopped.
+
 ## Code source and memory applicability
 
 The bridge sends the checkout's committed Git commit and tree at bootstrap. Task and session