prreviewbuddy 0.12.1 → 0.12.16

package/dist/{log-PmeEgome.js → log-CFa7EzgZ.js}

@@ -10,6 +10,13 @@ import { platform } from "node:process";
 //#region ../../packages/review-harness/src/agents/agent.ts
 /** The agent could not be run at all, as distinct from running and failing. */
 var AgentUnavailableError = class extends Error {};
+/**
+* The caller stopped waiting, so the run was stopped.
+*
+* Its own class rather than a message, because every caller has to tell it from a failure: a run
+* the reviewer cancelled is not an error to report to them, and it is not a turn to store.
+*/
+var AgentCancelledError = class extends Error {};
 /** The run was refused before it started, because it would have breached isolation. */
 var PromptIsolationError = class extends Error {};
 /**
@@ -81,6 +88,10 @@ var CLAUDE_AGENT_ID = "claude";
 * about sign-in to errors that have nothing to do with it, which is worse than staying quiet.
 */
 var AUTHENTICATION = /\b(?:auth(?:enticat\w*)?|oauth|credential|session expired|not logged in|log ?in)\b/i;
+/** Said to the caller that asked for the stop, and never shown to the reviewer who pressed it. */
+var STOPPED = "The agent was stopped.";
+/** How long a stopped agent gets to end on its own terms before it is ended for it. */
+var SIGKILL_GRACE_MS = 2e3;
 /** The two variables that decide which Claude answers, and nothing else. */
 var CARRIED = ["CLAUDE_CONFIG_DIR", "PATH"];
 /**
@@ -302,6 +313,7 @@ var claudeAgent = {
 	},
 	async run(input) {
 		guardPrompt(input);
+		if (input.signal?.aborted) throw new AgentCancelledError(STOPPED);
 		const reader = createStreamReader(input.onProgress ?? (() => {}));
 		return new Promise((resolvePromise, reject) => {
 			const child = spawn("claude", claudeArgs(input.capability), {
@@ -318,6 +330,14 @@ var claudeAgent = {
 				child.kill("SIGKILL");
 				reject(/* @__PURE__ */ new Error("The agent did not finish in time and was stopped."));
 			}, input.timeoutMs ?? DEFAULT_TIMEOUT_MS[input.capability]);
+			const stop = () => {
+				clearTimeout(timer);
+				child.kill("SIGTERM");
+				setTimeout(() => child.kill("SIGKILL"), SIGKILL_GRACE_MS).unref();
+				reject(new AgentCancelledError(STOPPED));
+			};
+			input.signal?.addEventListener("abort", stop, { once: true });
+			const release = () => input.signal?.removeEventListener("abort", stop);
 			child.stdout.setEncoding("utf8");
 			child.stdout.on("data", (chunk) => reader.push(chunk));
 			child.stderr.setEncoding("utf8");
@@ -326,11 +346,13 @@ var claudeAgent = {
 			});
 			child.on("error", (error) => {
 				clearTimeout(timer);
+				release();
 				if (error.code === "ENOENT") return reject(new ClaudeUnavailableError("The `claude` command is not on PATH, so this cannot be run from here. Install Claude Code, or start the workspace from a shell where `claude` runs."));
 				reject(error);
 			});
 			child.on("close", () => {
 				clearTimeout(timer);
+				release();
 				reader.end();
 				if (reader.overflowed()) return reject(/* @__PURE__ */ new Error("The agent produced more output than could be read, so it was stopped."));
 				const failure = reader.failed();
@@ -1193,6 +1215,73 @@ function inferLanguage(files) {
 	}[topExt] ?? topExt;
 }
 //#endregion
+//#region ../../packages/review-harness/src/domain/ai_review/outstanding.ts
+function reviewerDispositions(session) {
+	const byId = new Map((session.dismissedIssues ?? []).map((entry) => [entry.id, entry]));
+	return {
+		isDismissed: (issue) => byId.has(issue.id),
+		isStale: (issue) => issue.reconciliationStatus === "affected" && (byId.get(issue.id)?.sessionId ?? session.id) !== session.id
+	};
+}
+/**
+* An issue is done when the commits fixed it, or when the reviewer dismissed it and that decision
+* still stands.
+*
+* `still-open` and `new` are outstanding unless dismissed. `affected` is the one worth stating: the
+* code under it moved without settling it, so it needs the reviewer's eyes *more* than an untouched
+* finding does — and that outranks a dismissal made before the code moved. The finding comes back
+* into the count **carrying its dismissal**, which the card shows: the reviewer's decision is not
+* deleted, its applicability has expired, and re-affirming it closes the finding again.
+*/
+function isIssueOutstanding(issue, dispositions) {
+	if (issue.reconciliationStatus === "resolved") return false;
+	if (dispositions.isDismissed(issue)) return dispositions.isStale(issue);
+	return true;
+}
+/**
+* A question is done when the reviewer has ticked it, or when the new commits answered it.
+*
+* Either alone is enough. The reviewer's tick is the older of the two and the only one the first
+* analysis can produce; `reconciliationStatus === 'answered'` arrives with an update and carries
+* `reconciliationAnswer` beside it, which is the answer itself. Requiring the tick as well would
+* make the reviewer hand-close seven questions the page had already answered in front of them.
+*
+* No `affected` expiry here, unlike an issue's dismissal. An issue is a claim about the code and a
+* dismissal is a bet on that code; a question the reviewer has answered was answered out of their
+* own head, and a commit somewhere near it does not un-know what they now know.
+*/
+function isQuestionOutstanding(question, answered) {
+	return !answered.has(question.id) && question.reconciliationStatus !== "answered";
+}
+function tally(items, outstanding, byReviewer) {
+	let open = 0;
+	let reviewerClosed = 0;
+	for (const item of items) if (outstanding(item)) open += 1;
+	else if (byReviewer(item)) reviewerClosed += 1;
+	return {
+		total: items.length,
+		open,
+		done: items.length - open,
+		reviewerClosed
+	};
+}
+function issuesOutstanding(issues, dispositions) {
+	return tally(issues, (issue) => isIssueOutstanding(issue, dispositions), (issue) => issue.reconciliationStatus !== "resolved" && dispositions.isDismissed(issue));
+}
+function questionsOutstanding(questions, answered) {
+	return tally(questions, (question) => isQuestionOutstanding(question, answered), (question) => question.reconciliationStatus !== "answered" && answered.has(question.id));
+}
+/**
+* What to call the pile of findings nobody has to act on any more.
+*
+* "Resolved" is a claim about the code and is only true while the commits did all the closing. One
+* dismissal in there and the honest word is the vaguer one, because the reviewer deciding a finding
+* is acceptable did not resolve anything.
+*/
+function doneVerb(counts) {
+	return counts.reviewerClosed > 0 ? "dealt with" : "resolved";
+}
+//#endregion
 //#region ../../packages/review-harness/src/workspace/store.ts
 var STORE_ROOT = join(homedir(), ".prreviewbuddy");
 var WORKSPACES_DIR = join(STORE_ROOT, "workspaces");
@@ -1335,8 +1424,9 @@ function summarise(workspace) {
 		summary: result?.summary ?? "",
 		overallRisk: result?.overallRisk ?? "unknown",
 		issues: result?.issues.length ?? 0,
+		openIssues: issuesOutstanding(result?.issues ?? [], reviewerDispositions(workspace.session)).open,
 		questions: questions.length,
-		unansweredQuestions: questions.filter((question) => !answered.has(question.id)).length,
+		unansweredQuestions: questionsOutstanding(questions, answered).open,
 		messages: workspace.transcript.length,
 		lastViewedAt: workspace.lastViewedAt,
 		completedAt: workspace.completedAt,
@@ -1348,6 +1438,16 @@ function summarise(workspace) {
 	};
 }
 /**
+* The commit a review was made from, however the record spells it. Null when it recorded none.
+*
+* Lives here rather than beside one of its callers because it is a reading of the record, and the
+* two things that need it are unrelated: pinning a checkout to answer questions against, and
+* reading a single file the reviewer's own checkout does not have.
+*/
+function reviewedCommit(workspace) {
+	return workspace.session.metadata?.commitSha || workspace.changeSet.data.pullRequest.head.sha || null;
+}
+/**
 * Record that a workspace was opened.
 *
 * Best-effort and deliberately silent: a review that cannot record having been looked at is still
@@ -1456,6 +1556,7 @@ async function buildChangeSet(options) {
 		},
 		repoPath,
 		baseRef: displayRef(baseRef),
+		baseResolvedRef: baseRef,
 		headRef,
 		mergeBase,
 		includesUncommitted: false,
@@ -1849,6 +1950,90 @@ function resumeFrom(job) {
 	return WORK_PHASES.find((phase) => !job.completed.includes(phase)) ?? "analysing";
 }
 //#endregion
+//#region ../../packages/review-harness/src/workspace/request_branch.ts
+/**
+* Where the change under review is now.
+*
+* One question, asked by two things that must never answer it differently. `review_update.ts` asks
+* it to know what to reconcile against; `freshness.ts` asks it to know whether the findings still
+* describe the change. When those two disagree the product contradicts itself on one screen: the
+* strip says the code was rewritten and the button says the review is already current, and the
+* reviewer has no way to tell which of them is lying.
+*
+* The refs are tried in the order that best answers it, and the first that resolves wins:
+*
+* 1. `refs/remotes/origin/<the request's branch>` — the pull request's own branch, as the forge
+*    named it. A plain `git fetch` writes this for every branch on origin, and the review path
+*    already ran one to get the head commit here at all.
+* 2. `refs/remotes/<the request's branch>` — the same thing on a remote that is not called origin.
+* 3. `<the review's branch>@{upstream}` — whatever the local branch tracks, resolved without
+*    reading HEAD, which matters because nothing here is entitled to care what is checked out.
+*
+* Nothing is guessed past that. A pull request from a fork has its branch on a remote this
+* repository does not have, and the honest answer there is that we cannot see where the change is,
+* not a comparison against some other branch that happens to be at hand.
+*
+* Read-only, and it has to stay that way: `freshness.ts` may reach nothing that writes or fetches,
+* and `freshness_read_only.test.ts` scans this file for the same reason it scans that one.
+*/
+function requestBranchRefs(branch, remoteHeadRef) {
+	return remoteHeadRef ? [
+		`refs/remotes/origin/${remoteHeadRef}`,
+		`refs/remotes/${remoteHeadRef}`,
+		`${branch}@{upstream}`
+	] : [`${branch}@{upstream}`];
+}
+async function resolveRequestBranch(repoPath, branch, remoteHeadRef) {
+	for (const ref of requestBranchRefs(branch, remoteHeadRef)) {
+		const sha = await refSha(repoPath, ref);
+		if (sha) return {
+			sha,
+			ref: await shortName(repoPath, ref) ?? ref,
+			remote: true
+		};
+	}
+	return null;
+}
+/**
+* The name to show for a ref that has already resolved.
+*
+* Asked of git rather than trimmed off the string, because the two candidate forms need opposite
+* treatments and only git knows the answer to the second: `refs/remotes/origin/x` is `origin/x` by
+* removing a prefix, and `x@{upstream}` is also `origin/x`, which no amount of trimming produces.
+*/
+async function shortName(repoPath, ref) {
+	try {
+		return (await git(repoPath, [
+			"rev-parse",
+			"--abbrev-ref",
+			ref
+		])).trim() || null;
+	} catch {
+		return null;
+	}
+}
+/** A local branch by its full path, so a ref that is really a sha cannot be mistaken for one. */
+async function localBranch(repoPath, branch) {
+	const sha = await refSha(repoPath, `refs/heads/${branch}`);
+	return sha ? {
+		sha,
+		ref: branch,
+		remote: false
+	} : null;
+}
+async function refSha(repoPath, ref) {
+	try {
+		return (await git(repoPath, [
+			"rev-parse",
+			"--verify",
+			"--quiet",
+			`${ref}^{commit}`
+		])).trim() || null;
+	} catch {
+		return null;
+	}
+}
+//#endregion
 //#region ../../packages/review-harness/src/workspace/freshness.ts
 /**
 * Is this review still describing the code in front of you?
@@ -1862,6 +2047,10 @@ function resumeFrom(job) {
 * come from three different places:
 *
 *   1. **Has the code moved?**  Local git against the commit the review was made from. Free.
+*      What it is compared *to* is the branch this review is of, never whatever happens to be
+*      checked out. A pull request is reviewed in a checkout of its own and the reviewer never
+*      stands on its branch, so HEAD is a different change entirely: measuring against it announced
+*      "Code rewritten, 343 files differ" about a review that was perfectly current.
 *   2. **Is the checkout what the pull request had?**  The stored head sha against local HEAD.
 *      Answerable offline precisely because the sha was written down at import time.
 *   3. **Has anyone commented since?**  Not answerable here at all. The daemon reaches no forge,
@@ -1891,7 +2080,7 @@ async function checkFreshness(workspace) {
 	} catch {}
 	return {
 		checkedAt: Date.now(),
-		code: await codeFreshness(workspace, reviewedSha, headSha),
+		code: await codeFreshness(workspace, reviewedSha, headSha, await latest(workspace)),
 		checkout: await checkoutFreshness(workspace, headSha),
 		conversation: workspace.prContext ? {
 			attached: true,
@@ -1900,17 +2089,45 @@ async function checkFreshness(workspace) {
 		} : { attached: false }
 	};
 }
-async function codeFreshness(workspace, reviewedSha, headSha) {
+/**
+* The branch this review is of, and where it currently is.
+*
+* The comparison the whole panel rests on, and the one that used to read `git rev-parse HEAD`. That
+* was right while every review was of the checkout you were standing in. It stopped being right the
+* day pull requests were reviewed in a worktree of their own: the reviewer never checks that branch
+* out, so HEAD is some unrelated branch and the distance to it is not a fact about this review.
+*
+* A pull request is measured against its own branch as this repository last saw it. A branch review
+* is measured against that branch by name, `refs/heads/<name>` rather than HEAD, so switching
+* branches to look at something else does not make the review look rewritten. Neither reads HEAD,
+* and that is deliberate: what is checked out is a fact about the reviewer, not about the change.
+*
+* Null when the branch is not in this repository at all, which is a real answer with two ordinary
+* causes: a pull request from a fork, whose branch lives on a remote this clone does not have, and
+* a branch deleted after it merged. Neither is a licence to compare against something else.
+*/
+async function latest(workspace) {
+	const branch = workspace.changeSet.headRef;
+	const requestRef = workspace.prContext?.pullRequest.headRef;
+	if (requestRef) return resolveRequestBranch(workspace.repoPath, branch, requestRef);
+	return await localBranch(workspace.repoPath, branch) ?? resolveRequestBranch(workspace.repoPath, branch);
+}
+async function codeFreshness(workspace, reviewedSha, readable, latest) {
+	const latestSha = latest?.sha ?? null;
 	const base = {
 		state: "unknown",
 		reviewedSha,
-		headSha,
+		latestSha,
+		comparison: latest ? {
+			ref: latest.ref,
+			remote: latest.remote
+		} : null,
 		newCommits: null,
 		changedFiles: null,
 		rewritten: false,
 		reason: null
 	};
-	if (!headSha || !reviewedSha) return {
+	if (!readable || !reviewedSha) return {
 		...base,
 		reason: "git-failed"
 	};
@@ -1919,14 +2136,18 @@ async function codeFreshness(workspace, reviewedSha, headSha) {
 		...base,
 		reason: "missing-commit"
 	};
-	if (headSha !== reviewedSha) {
-		const rewritten = !await isAncestor(repoPath, reviewedSha, headSha);
+	if (!latestSha) return {
+		...base,
+		reason: "no-branch"
+	};
+	if (latestSha !== reviewedSha) {
+		const rewritten = !await isAncestor(repoPath, reviewedSha, latestSha);
 		return {
 			...base,
 			state: "changed",
 			rewritten,
-			newCommits: rewritten ? null : await countCommits(repoPath, reviewedSha, headSha),
-			changedFiles: await countChangedFiles(repoPath, reviewedSha, headSha)
+			newCommits: rewritten ? null : await countCommits(repoPath, reviewedSha, latestSha),
+			changedFiles: await countChangedFiles(repoPath, reviewedSha, latestSha)
 		};
 	}
 	if (workspace.changeSet.includesUncommitted) return {
@@ -5154,113 +5375,6 @@ async function applyGuide(workspaceId, payload) {
 	});
 }
 //#endregion
-//#region ../../packages/review-harness/src/workspace/landing.ts
-/**
-* Long enough for a loopback round trip many times over. Short because nothing rests on it: when
-* it expires the reader gets a link rather than a verdict.
-*/
-var PROBE_TIMEOUT_MS = 1500;
-/**
-* The landing page, as a string.
-*
-* Pure, and separated from writing it for the usual reason: what this page says when the server is
-* down is the half that is hard to look at by hand, because reproducing it means killing a daemon.
-*/
-/**
-* A record with no token renders as stopped, and that is not a lie anyone can be told: nothing
-* writes such a record. `cli/server.ts` mints a token before it listens, and `healthyPort` stops a
-* server whose version does not match this build, which is the only way one could ever be seen.
-* The case is here because the field is optional in the type, not because it is a state.
-*/
-function renderLanding(record) {
-	const url = record?.token ? indexUrl(record) : null;
-	return url ? running(record, url) : stopped();
-}
-function indexUrl(record) {
-	return `http://127.0.0.1:${record.port}/?t=${encodeURIComponent(record.token ?? "")}`;
-}
-function running(record, url) {
-	return page("Opening your reviews", `<h1>Opening your reviews</h1>
-    <p class="prb-quiet" id="waiting">Looking for the workspace server on port ${record.port}.</p>
-    <div id="gone" hidden>
-      <p><a class="prb-go" href="${escapeHtml(url)}">Open your reviews on port ${record.port}</a></p>
-      <p>This page could not confirm the server was answering, so it has not sent you there on its
-      own. Follow the link and see.</p>
-      <p>If it does not open, the server has stopped since this page was written. Nothing is lost:
-      every review is on disk in <code>~/.prreviewbuddy/workspaces</code>. Run
-      <code>/prreviewbuddy:start-server</code> in Claude Code, and this page will point at the new
-      server by the time you reload it.</p>
-    </div>
-    <script>
-      // An image, not a fetch: a file:// page cannot read a cross-origin response, but it can be
-      // told whether one arrived. /assets is the only route that answers without a credential.
-      var settled = false;
-      var probe = new Image();
-      var give_up = setTimeout(function () { fail(); }, ${PROBE_TIMEOUT_MS});
-      function fail() {
-        if (settled) return;
-        settled = true;
-        clearTimeout(give_up);
-        document.getElementById('waiting').hidden = true;
-        document.getElementById('gone').hidden = false;
-      }
-      probe.onload = function () {
-        if (settled) return;
-        settled = true;
-        clearTimeout(give_up);
-        // replace, not assign: going back should leave the reviews, not bounce through here again.
-        window.location.replace(${JSON.stringify(url)});
-      };
-      probe.onerror = fail;
-      probe.src = ${JSON.stringify(`http://127.0.0.1:${record.port}/assets/icon128.png?probe=`)} + Date.now();
-    <\/script>`);
-}
-function stopped() {
-	return page("Your reviews", `<h1>The workspace server is not running</h1>
-    <p>Every review is still on disk in <code>~/.prreviewbuddy/workspaces</code>, with its guide,
-    its diff and its conversation.</p>
-    <p>Run <code>/prreviewbuddy:start-server</code> in Claude Code to serve them again. This page
-    is rewritten when it starts, so keep the bookmark and reload it then.</p>`);
-}
-function page(title, body) {
-	return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>${escapeHtml(title)} · PR Review Buddy</title>
-<style>
-  :root { color-scheme: light dark; --prb-ink: #1b1b1f; --prb-paper: #fbfbfd; --prb-quiet: #5c5c66; }
-  @media (prefers-color-scheme: dark) {
-    :root { --prb-ink: #e8e8ec; --prb-paper: #17171b; --prb-quiet: #9a9aa4; }
-  }
-  body {
-    margin: 0; min-height: 100vh; display: grid; place-items: center;
-    background: var(--prb-paper); color: var(--prb-ink);
-    font: 15px/1.6 -apple-system, BlinkMacSystemFont, "Segoe UI", system-ui, sans-serif;
-  }
-  main { max-width: 34rem; padding: 2rem; }
-  h1 { font-size: 1.25rem; margin: 0 0 0.75rem; }
-  p { margin: 0 0 0.75rem; }
-  code { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 0.9em; }
-  .prb-quiet { color: var(--prb-quiet); }
-  .prb-go { font-weight: 600; }
-  [hidden] { display: none; }
-</style>
-</head>
-<body><main>${body}</main></body>
-</html>
-`;
-}
-/**
-* The token is minted from `base64url` and cannot contain any of these, and it is escaped anyway.
-* A credential is the last value in this product to be interpolated on the strength of what it is
-* currently generated from.
-*/
-function escapeHtml(value) {
-	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
-}
-//#endregion
 //#region ../../packages/review-harness/src/domain/feedback/feedback_url.ts
 /** How each client names itself in the prefilled message, which is the half a screenshot carries. */
 var CLIENT_LABELS = {
@@ -5400,16 +5514,188 @@ function feedbackUrl() {
 	});
 }
 //#endregion
+//#region ../../packages/review-harness/src/workspace/way_back.ts
+/**
+* How a reviewer gets back to the list of their reviews.
+*
+* Three places have to answer this, and until now all three answered it for the plugin: the
+* refusal at `/`, and both states of the bookmark page. A reviewer who installed the CLI was told
+* to run `/prreviewbuddy:start-server`, which is a Claude Code slash command they do not have,
+* from a product that has never mentioned Claude Code to them. Every one of those readers is
+* already stuck, which is the worst moment to be handed a command that does not exist.
+*
+* The build knows which product it is. `SURFACE.client` is read from the `package.json` beside the
+* running code, and each app bundles its own copy of the workspace server, so the server that
+* refuses the request is the CLI's server or the plugin's server and can say so. A build that
+* cannot name itself names both, which is never wrong and is only slightly longer.
+*
+* The bookmark is here too, because it is the other half of the same answer and the durable half:
+* the command is what unsticks this browser now, and the bookmark is what stops the question being
+* asked again after the next restart.
+*/
+/**
+* The one address in this product that never changes.
+*
+* Rewritten by `daemon.ts` at both moments the truth changes. It lives here rather than there
+* because the pages that tell a reviewer about it must not have to import the daemon to do it.
+*/
+var LANDING_PAGE = join(STORE_ROOT, "reviews.html");
+var CLI = {
+	command: "prreviewbuddy open",
+	where: "your terminal"
+};
+var PLUGIN = {
+	command: "/prreviewbuddy:start-server",
+	where: "Claude Code"
+};
+function wayBack() {
+	return {
+		commands: SURFACE.client === "cli" ? [CLI] : SURFACE.client === "plugin" ? [PLUGIN] : [CLI, PLUGIN],
+		bookmark: LANDING_PAGE
+	};
+}
+/** The commands as one sentence, for somewhere with no room to make a list of them. */
+function wayBackSentence(way = wayBack()) {
+	return way.commands.map(({ command, where }) => `${command} in ${where}`).join(", or ");
+}
+//#endregion
+//#region ../../packages/review-harness/src/workspace/landing.ts
+/**
+* Long enough for a loopback round trip many times over. Short because nothing rests on it: when
+* it expires the reader gets a link rather than a verdict.
+*/
+var PROBE_TIMEOUT_MS = 1500;
+/**
+* The landing page, as a string.
+*
+* Pure, and separated from writing it for the usual reason: what this page says when the server is
+* down is the half that is hard to look at by hand, because reproducing it means killing a daemon.
+*/
+/**
+* A record with no token renders as stopped, and that is not a lie anyone can be told: nothing
+* writes such a record. `cli/server.ts` mints a token before it listens, and `healthyPort` stops a
+* server whose version does not match this build, which is the only way one could ever be seen.
+* The case is here because the field is optional in the type, not because it is a state.
+*/
+function renderLanding(record) {
+	const url = record?.token ? indexUrl(record) : null;
+	return url ? running(record, url) : stopped();
+}
+function indexUrl(record) {
+	return `http://127.0.0.1:${record.port}/?t=${encodeURIComponent(record.token ?? "")}`;
+}
+function running(record, url) {
+	return page("Opening your reviews", `<h1>Opening your reviews</h1>
+    <p class="prb-quiet" id="waiting">Looking for the workspace server on port ${record.port}.</p>
+    <div id="gone" hidden>
+      <p><a class="prb-go" href="${escapeHtml(url)}">Open your reviews on port ${record.port}</a></p>
+      <p>This page could not confirm the server was answering, so it has not sent you there on its
+      own. Follow the link and see.</p>
+      <p>If it does not open, the server has stopped since this page was written. Nothing is lost:
+      every review is on disk in <code>~/.prreviewbuddy/workspaces</code>. Start it again and this
+      page will point at the new server by the time you reload it.</p>
+      ${commandList(wayBack())}
+    </div>
+    <script>
+      // An image, not a fetch: a file:// page cannot read a cross-origin response, but it can be
+      // told whether one arrived. /assets is the only route that answers without a credential.
+      var settled = false;
+      var probe = new Image();
+      var give_up = setTimeout(function () { fail(); }, ${PROBE_TIMEOUT_MS});
+      function fail() {
+        if (settled) return;
+        settled = true;
+        clearTimeout(give_up);
+        document.getElementById('waiting').hidden = true;
+        document.getElementById('gone').hidden = false;
+      }
+      probe.onload = function () {
+        if (settled) return;
+        settled = true;
+        clearTimeout(give_up);
+        // replace, not assign: going back should leave the reviews, not bounce through here again.
+        window.location.replace(${JSON.stringify(url)});
+      };
+      probe.onerror = fail;
+      probe.src = ${JSON.stringify(`http://127.0.0.1:${record.port}/assets/icon128.png?probe=`)} + Date.now();
+    <\/script>`);
+}
+function stopped() {
+	return page("Your reviews", `<h1>The workspace server is not running</h1>
+    <p>Every review is still on disk in <code>~/.prreviewbuddy/workspaces</code>, with its guide,
+    its diff and its conversation.</p>
+    <p>Serve them again with:</p>
+    ${commandList(wayBack())}
+    <p>This page is rewritten when the server starts, so keep the bookmark and reload it then.</p>`);
+}
+/**
+* The commands that start a server, named for the product the reader actually installed.
+*
+* A list rather than a sentence because a build that cannot name itself offers both, and two
+* commands run together in prose read as one command with a typo in it.
+*/
+function commandList(way) {
+	return `<ul class="prb-commands">${way.commands.map(({ command, where }) => `<li><code>${escapeHtml(command)}</code> in ${escapeHtml(where)}</li>`).join("")}</ul>`;
+}
+/**
+* The shell both of this file's states use, and the refusal at `/` uses too.
+*
+* Exported so that the three pages a stuck reviewer can land on look like one product rather than
+* like three accidents. It carries no script and no asset request, which is what lets it render
+* identically from `file://` and from the server.
+*/
+function page(title, body) {
+	return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escapeHtml(title)} · PR Review Buddy</title>
+<style>
+  :root { color-scheme: light dark; --prb-ink: #1b1b1f; --prb-paper: #fbfbfd; --prb-quiet: #5c5c66; }
+  @media (prefers-color-scheme: dark) {
+    :root { --prb-ink: #e8e8ec; --prb-paper: #17171b; --prb-quiet: #9a9aa4; }
+  }
+  body {
+    margin: 0; min-height: 100vh; display: grid; place-items: center;
+    background: var(--prb-paper); color: var(--prb-ink);
+    font: 15px/1.6 -apple-system, BlinkMacSystemFont, "Segoe UI", system-ui, sans-serif;
+  }
+  main { max-width: 34rem; padding: 2rem; }
+  h1 { font-size: 1.25rem; margin: 0 0 0.75rem; }
+  p { margin: 0 0 0.75rem; }
+  code { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 0.9em; }
+  .prb-quiet { color: var(--prb-quiet); }
+  .prb-go { font-weight: 600; }
+  .prb-commands { margin: 0 0 0.75rem; padding-left: 1.25rem; }
+  .prb-commands li { margin: 0 0 0.25rem; }
+  [hidden] { display: none; }
+</style>
+</head>
+<body><main>${body}</main></body>
+</html>
+`;
+}
+/**
+* The token is minted from `base64url` and cannot contain any of these, and it is escaped anyway.
+* A credential is the last value in this product to be interpolated on the strength of what it is
+* currently generated from.
+*/
+function escapeHtml(value) {
+	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+//#endregion
 //#region ../../packages/review-harness/src/workspace/daemon.ts
-var SERVER_RECORD = join(STORE_ROOT, "server.json");
-var SPAWN_LOCK = join(STORE_ROOT, "server.lock");
 /**
 * The one address in this product that never changes.
 *
-* Rewritten at both moments the truth changes, which is why it is here rather than anywhere that
+* Declared in `way_back.ts` with the rest of the answer to "how do I get back to my reviews", and
+* re-exported here because this is where callers already look for it. Rewritten by this file at
+* both moments the truth changes, which is why the writing is here rather than anywhere that
 * merely knows the port: this file is where a server starts existing and stops existing.
 */
-var LANDING_PAGE = join(STORE_ROOT, "reviews.html");
+var SERVER_RECORD = join(STORE_ROOT, "server.json");
+var SPAWN_LOCK = join(STORE_ROOT, "server.lock");
 var SERVER_ENTRY = process.env.PRB_SERVER_ENTRY ?? fileURLToPath(new URL("./server.js", import.meta.url));
 var STARTUP_TIMEOUT_MS = 15e3;
 var POLL_INTERVAL_MS = 100;
@@ -5613,6 +5899,29 @@ async function waitForHealthyServer() {
 function workspaceUrl(port, id, token) {
 	return `http://127.0.0.1:${port}/r/${id}?t=${token}`;
 }
+/**
+* A workspace link that also teaches the browser its way back to the list.
+*
+* The reviews index is opened by a credential no review page is allowed to carry, and the only
+* thing that puts that credential into a browser is arriving at the index with it once. Nothing on
+* the `prreviewbuddy review` path ever sent anyone there, so "All reviews" on the page it printed
+* refused every reviewer who had never separately run `prreviewbuddy open`. The bootstrap belongs
+* here, in the link, rather than as a step for the reviewer to discover after being refused.
+*
+* It goes through the index because that is the route that sets the cookie, and it carries `go` so
+* that the browser does not stop there: cookie set, then straight on to the review, leaving
+* `/r/<id>?t=<reviewToken>` in the address bar. The page still never receives the index credential,
+* which is the boundary that matters. What is in the address bar afterwards is safe to copy.
+*
+* Printing this rather than the plain link costs nothing when the credential is missing or stale:
+* `handleIndex` forwards to `go` either way, and only the cookie depends on the credential being
+* right. The worst case is exactly the link this used to print.
+*/
+function bootstrapUrl(port, id, token, indexToken) {
+	const workspace = `/r/${id}?t=${encodeURIComponent(token)}`;
+	if (!indexToken) return `http://127.0.0.1:${port}${workspace}`;
+	return `http://127.0.0.1:${port}/?t=${encodeURIComponent(indexToken)}&go=${encodeURIComponent(workspace)}`;
+}
 /** The reviews index. Null when the running server predates the index and has no token. */
 function reviewsUrl(port, token) {
 	return token ? `http://127.0.0.1:${port}/?t=${token}` : null;
@@ -5984,10 +6293,6 @@ function countByStatus(issues) {
 * same policy as every other managed directory and a crash between creating one and recording it
 * leaves residue the orphan rule can still reach.
 */
-/** The commit a review was made from, however the record spells it. Null when it recorded none. */
-function reviewedCommit(workspace) {
-	return workspace.session.metadata?.commitSha || workspace.changeSet.data.pullRequest.head.sha || null;
-}
 var NoCheckoutError = class extends Error {};
 /**
 * A worktree detached at `sha`, and the job that owns it.
@@ -6360,31 +6665,21 @@ async function reconcile(workspace, runners, reviewedSha, remote, conversationOk
 }
 var BASELINE_GONE_MESSAGE = "The commit this review was made from is no longer in this repository, so there is nothing to measure the new code against. This one needs starting fresh: run /prreviewbuddy:fresh-review.";
 /**
-* The candidate refs, in the order that best answers "where is this change now".
+* Where the request's branch is, after a fetch.
+*
+* The candidates live in `request_branch.ts` rather than here because the freshness strip has to
+* ask the same question and get the same answer. Two answers means the panel says the code was
+* rewritten while this button says the review is already current, on one screen, with nothing to
+* tell the reviewer which is right.
 *
-* `<branch>@{upstream}` resolves the configured remote-tracking ref regardless of what is
-* currently checked out, which is what makes asking here safe: nothing is checked out to ask, and
-* the reviewer's own HEAD is never consulted.
+* The fetch is the only difference between the two callers, and it is the honest one: this button
+* is allowed to reach the network and that panel is not, so it looks at a newer copy of the same
+* refs.
 */
-function candidateRefs(branch, remoteHeadRef) {
-	return remoteHeadRef ? [
-		`refs/remotes/origin/${remoteHeadRef}`,
-		`refs/remotes/${remoteHeadRef}`,
-		`${branch}@{upstream}`
-	] : [`${branch}@{upstream}`];
-}
 async function remoteHead(workspace) {
 	const fetchFailed = !await fetchOrigin(workspace.repoPath);
-	const refs = candidateRefs(workspace.changeSet.headRef, workspace.prContext?.pullRequest.headRef);
-	for (const ref of refs) {
-		const sha = await refSha(workspace.repoPath, ref);
-		if (sha) return {
-			sha,
-			fetchFailed
-		};
-	}
 	return {
-		sha: null,
+		sha: (await resolveRequestBranch(workspace.repoPath, workspace.changeSet.headRef, workspace.prContext?.pullRequest.headRef))?.sha ?? null,
 		fetchFailed
 	};
 }
@@ -6405,18 +6700,6 @@ async function fetchOrigin(repoPath) {
 		return false;
 	}
 }
-async function refSha(repoPath, ref) {
-	try {
-		return (await git(repoPath, [
-			"rev-parse",
-			"--verify",
-			"--quiet",
-			`${ref}^{commit}`
-		])).trim() || null;
-	} catch {
-		return null;
-	}
-}
 /** Whether the object itself is still in the repository, whatever ref does or does not name it. */
 async function commitPresent(repoPath, sha) {
 	try {
@@ -6465,7 +6748,7 @@ async function applyUpdate(workspace, result, replaced, newHead, worktreePath) {
 	try {
 		const plain = await buildReviewContext({
 			repoPath: worktreePath,
-			base: await resolvableBase(worktreePath, workspace.changeSet.baseRef)
+			base: await resolvableBase(worktreePath, workspace.changeSet)
 		});
 		whole = workspace.prContext ? await withPrContext(plain, workspace.prContext) : plain;
 		workspace.changeSet = whole.changeSet;
@@ -6476,15 +6759,32 @@ async function applyUpdate(workspace, result, replaced, newHead, worktreePath) {
 	delete workspace.dismissedFreshnessSha;
 }
 /**
-* The stored base, turned back into something git will accept.
+* The base this review was made against, turned back into something git will accept.
+*
+* `ChangeSet.baseResolvedRef` is the ref git actually resolved when the review was built, so a
+* review that has one needs no reasoning at all: it is the same comparison or it is nothing.
 *
-* `ChangeSet.baseRef` is a *display* string: `origin/main` is stored as `main`, because that is
-* what a reviewer calls it. In a checkout with no local `main` branch, which is the ordinary shape
-* of a clone made for one branch, handing that back to git resolves to nothing. Undefined is the
-* last resort and means "work it out again", which is what the change set did in the first place.
+* Everything else is a review made before that field existed, and all such a review kept is
+* `baseRef`, which is a *display* string: `origin/main` is stored as `main`, because that is what
+* a reviewer calls it. Both candidates have to be tried, and the order matters more than it looks.
+* A clone made for one branch has no local `main` at all, so the display name resolves to nothing
+* and `origin/main` is the only answer. An ordinary clone has both, `main` sits behind the remote
+* from the first day nobody pulls, and picking it silently widens the review to every upstream
+* commit that has not been fetched into the working branch. So the remote-tracking ref goes first:
+* it is what `resolveBase` itself prefers when nobody names a base, and no `prreviewbuddy review
+* <pr>` ever names one.
+*
+* Undefined is the last resort and means "work it out again", which is what the change set did in
+* the first place.
 */
-async function resolvableBase(repoPath, stored) {
-	for (const candidate of [stored, `origin/${stored}`]) if (candidate && await refExists(repoPath, candidate)) return candidate;
+async function resolvableBase(repoPath, changeSet) {
+	const stored = changeSet.baseRef;
+	const candidates = [
+		changeSet.baseResolvedRef,
+		`origin/${stored}`,
+		stored
+	];
+	for (const candidate of candidates) if (candidate && await refExists(repoPath, candidate)) return candidate;
 }
 /** Null when there is no conversation attached, which is neither success nor failure. */
 async function reReadConversation(workspace, fetch) {
@@ -6664,4 +6964,4 @@ function loadConfig() {
 	return config;
 }
 //#endregion
-export { agentById as $, WORK_PHASES as A, lineagePosition as B, clearClaim as C, removeWorktree as D, readMarker as E, loadJob as F, saveWorkspace as G, positionInLineage as H, saveJob as I, processDiscussion as J, summarise as K, displayRef as L, deleteJob as M, fail as N, relativeTime as O, isTerminal as P, AGENT_IDS as Q, STORE_ROOT as R, fillFileUrlTemplate as S, MANAGED_ROOT as T, recentReviewGroups as U, loadWorkspace as V, recentWorkspaces as W, resolveTarget as X, describeAuthorship as Y, withBase as Z, feedbackUrl as _, refreshPrContext as a, EXPLAIN_SIMPLY_PROMPT as b, agentEnvOf as c, ensureServer as d, agentFor as et, readServerRecord as f, BUILD_VERSION as g, writeServerRecord as h, updateReview as i, allJobs as j, checkFreshness as k, LANDING_PAGE as l, workspaceUrl as m, record as n, AgentUnavailableError as nt, isUnchanged as o, reviewsUrl as p, touchWorkspace as q, RefreshUnavailableError as r, askCheckout as s, readEvents as t, defaultAgent as tt, clearServerRecord as u, runJob as v, isClaimed as w, forgeResolver as x, startJob as y, groupByLineage as z };
+export { touchWorkspace as $, MANAGED_ROOT as A, loadJob as B, runJob as C, fillFileUrlTemplate as D, forgeResolver as E, WORK_PHASES as F, lineagePosition as G, displayRef as H, allJobs as I, recentReviewGroups as J, loadWorkspace as K, deleteJob as L, removeWorktree as M, relativeTime as N, clearClaim as O, checkFreshness as P, summarise as Q, fail as R, feedbackUrl as S, EXPLAIN_SIMPLY_PROMPT as T, STORE_ROOT as U, saveJob as V, groupByLineage as W, reviewedCommit as X, recentWorkspaces as Y, saveWorkspace as Z, page as _, refreshPrContext as a, reviewerDispositions as at, wayBackSentence as b, agentEnvOf as c, resolveTarget as ct, ensureServer as d, AGENT_IDS as dt, doneVerb as et, readServerRecord as f, agentById as ft, commandList as g, AgentUnavailableError as gt, writeServerRecord as h, AgentCancelledError as ht, updateReview as i, questionsOutstanding as it, readMarker as j, isClaimed as k, bootstrapUrl as l, withBase as lt, workspaceUrl as m, defaultAgent as mt, record as n, isQuestionOutstanding as nt, isUnchanged as o, processDiscussion as ot, reviewsUrl as p, agentFor as pt, positionInLineage as q, RefreshUnavailableError as r, issuesOutstanding as rt, askCheckout as s, describeAuthorship as st, readEvents as t, isIssueOutstanding as tt, clearServerRecord as u, git as ut, LANDING_PAGE as v, startJob as w, BUILD_VERSION as x, wayBack as y, isTerminal as z };