prreviewbuddy 0.25.8 → 0.27.2

package/dist/server.js

@@ -1,7 +1,7 @@
-import { $ as allJobs, A as agentEnvOf, At as processDiscussion, B as BUILD_VERSION, Bt as STORE_ROOT, C as statedWorkspacePort, Ct as touchWorkspace, D as refreshPrContext, Dt as issuesOutstanding, E as updateReview, Et as isQuestionOutstanding, H as feedbackUrl, I as readEvents, It as clearAgentPreference, J as MANAGED_ROOT, K as fillFileUrlTemplate, Kt as AgentCancelledError, L as record, Lt as readAgentPreference, M as startKissJob, O as isUnchanged, Ot as questionsOutstanding, P as runJob, Pt as git, Q as checkFreshness, R as recordTelemetryUploadConsent, Rt as writeAgentPreference, S as resolveWorkspacePort, T as RefreshUnavailableError, Tt as isIssueOutstanding, U as withUsageRecorded, Vt as AGENT_IDS, W as EXPLAIN_SIMPLY_PROMPT, Wt as agentFor, X as removeWorktree, Y as readMarker, Z as checkCodeFreshness, _ as writeServerRecord, _t as recentReviewGroups, a as liveJobsFor, at as progressSteps, b as MIN_WORKSPACE_PORT, c as discardJob, ct as followedRefName, d as clearServerRecord, et as fail, ft as lineagePosition, gt as previousKissResult, i as lineageIds, it as PHASES, jt as describeAuthorship, k as askCheckout, kt as reviewerDispositions, l as readIndexToken, n as deleteLineage, nt as loadJob, o as wasBlocked, p as readServerRecord, pt as loadWorkspace, q as ReviewBeingDeletedError, qt as AgentUnavailableError, r as deleteReview, rt as saveJob, st as isClaimed, t as relativeTime$1, tt as isTerminal, ut as latestKissRun, v as DEFAULT_WORKSPACE_PORT, w as writePortPreference, wt as doneVerb, x as parseWorkspacePort, xt as saveWorkspace, y as MAX_WORKSPACE_PORT, yt as reviewedCommit, z as telemetryUploadConsent } from "./relative_time-D760FOL9.js";
+import { $ as fillFileUrlTemplate, $t as agentFor, A as removeWorktree, At as workspaceRevision, C as recordTelemetryUploadConsent, Ct as recentReviewGroups, D as ReviewBeingDeletedError, Dt as saveWorkspace, E as EXPLAIN_SIMPLY_PROMPT, F as clearServerRecord, Ft as issuesOutstanding, G as DEFAULT_WORKSPACE_PORT, Gt as clearAgentPreference, H as BUILD_VERSION, Ht as git, It as questionsOutstanding, J as parseWorkspacePort, K as MAX_WORKSPACE_PORT, Kt as readAgentPreference, L as readServerRecord, Lt as reviewerDispositions, M as relativeTime$1, Mt as doneVerb, N as readIndexToken, Nt as isIssueOutstanding, O as MANAGED_ROOT, Pt as isQuestionOutstanding, Rt as processDiscussion, S as record, St as previousKissResult, T as withUsageRecorded, Tt as reviewedCommit, V as writeServerRecord, W as feedbackUrl, Wt as resolveModel, X as statedWorkspacePort, Xt as AGENT_IDS, Y as resolveWorkspacePort, Yt as STORE_ROOT, Z as writePortPreference, _ as startKissJob, a as wasBlocked, at as isTerminal, c as updateReview, d as askCheckout, dt as purposeOf, et as checkCodeFreshness, f as UpdateAlreadyRunningError, gt as latestKissRun, h as agentEnvOf, i as liveJobsFor, it as fail, jt as workspaceStamps, k as readMarker, kt as touchWorkspace, l as refreshPrContext, lt as phasesFor, mt as followedRefName, n as deleteReview, nn as AgentUnavailableError, nt as allJobs, o as discardJob, ot as loadJob, p as liveUpdateFor, pt as isClaimed, q as MIN_WORKSPACE_PORT, qt as writeAgentPreference, r as lineageIds, rt as endedAt, s as RefreshUnavailableError, st as saveJob, t as deleteLineage, tn as AgentCancelledError, tt as checkFreshness, u as isUnchanged, ut as progressSteps, vt as lineagePosition, w as telemetryUploadConsent, x as readEvents, y as runJob, yt as loadWorkspace, zt as describeAuthorship } from "./delete_review-B3xciJ03.js";
 import { isAbsolute, join, relative, resolve } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
-import { timingSafeEqual } from "node:crypto";
+import { createHash, timingSafeEqual } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import { createServer } from "node:http";
 //#region ../../packages/review-harness/src/domain/ai_review/review_composition.ts
@@ -571,6 +571,119 @@ function humanizeModelId(id) {
 	return display;
 }
 //#endregion
+//#region ../../packages/review-harness/src/domain/utils/agent_label.ts
+/**
+* What a person is shown when a review names the tool that produced it.
+*
+* Here in the domain rather than read off `AgentIdentity.displayName`, because this runs in the
+* extension bundle and the adapter registry reaches `node:child_process`. Deriving the label from
+* the stored `agentId` keeps the client free of node builtins and adds no stored field.
+*
+* A closed set of this product's own adapter ids, which is not the kind of table that goes stale
+* invisibly: adding an adapter is our own act, and anything unrecognised still renders through
+* `humanizeModelId` rather than disappearing. That is why this is not folded into
+* `humanizeModelId` itself, whose value is knowing nothing about which names exist.
+*/
+var AGENT_DISPLAY_NAMES = {
+	claude: "Claude Code",
+	codex: "Codex",
+	gemini: "Gemini CLI"
+};
+/**
+* Absent reads as Claude, matching `agentIdOf` and `agentName`: a session written before agents
+* were selectable ran under Claude, and showing it as unknown would invent a gap in the oldest
+* reviews on disk.
+*/
+var DEFAULT_AGENT_DISPLAY_NAME = AGENT_DISPLAY_NAMES.claude;
+function agentDisplayName(agentId) {
+	if (!agentId) return DEFAULT_AGENT_DISPLAY_NAME;
+	return AGENT_DISPLAY_NAMES[agentId] ?? humanizeModelId(agentId);
+}
+//#endregion
+//#region ../../packages/review-harness/src/domain/ai_review/model_provenance.ts
+/**
+* Values `model` carried when it meant "which agent", before the field was frozen.
+*
+* A closed set of three of our own historical strings, not a catalogue of vendor models, so it
+* never grows and never goes stale. It lives here rather than in `humanizeModelId` on purpose:
+* the corruption belongs to how sessions were once written, and that label function's whole value
+* is knowing nothing about which models exist.
+*/
+var LEGACY_AGENT_IDS = /* @__PURE__ */ new Set([
+	"codex",
+	"claude-code",
+	"gemini-cli"
+]);
+var present = (value) => typeof value === "string" && value !== "" ? value : null;
+function modelProvenanceOf(session) {
+	return {
+		requestedModel: present(session.requestedModel) ?? legacyModel(session.model),
+		observedModel: present(session.observedModel),
+		agentVersion: present(session.agentVersion)
+	};
+}
+/**
+* A legacy `model`, read as a request or discarded.
+*
+* The extension put the model it was about to call into this field, so for its sessions the value
+* really is what was requested. The CLI put an agent id there, which is not a model at all and is
+* dropped rather than displayed: showing "Reviewed with Codex, model Codex" would be the record
+* inventing provenance out of its own filing.
+*/
+function legacyModel(model) {
+	const value = present(model);
+	if (value === null || LEGACY_AGENT_IDS.has(value)) return null;
+	return value;
+}
+/**
+* Whether a coding agent made this, as opposed to the extension calling a provider API.
+*
+* The awkward case is a session with no `agentId` at all, because two different producers leave it
+* empty. A CLI review from before agents were selectable means Claude, which is why
+* `agentDisplayName` defaults that way. An extension review means no agent ran at all, and naming
+* one would credit Claude Code for somebody's OpenAI review.
+*
+* The legacy sentinel tells them apart, which is the last job that field has: only the CLI ever
+* wrote one, so a record with no agent id and no sentinel came from the extension.
+*/
+function producedByAgent(session) {
+	if (session.agentId) return true;
+	const legacy = present(session.model);
+	return legacy !== null && LEGACY_AGENT_IDS.has(legacy);
+}
+/**
+* The full provenance, for the disclosure rather than the page.
+*
+* Opens with "Reviewed with X" rather than "Agent: X", keeping the sentence that was already here:
+* a review is not owned by an agent, it holds analyses, and this names the one being shown.
+*
+* The line that earns this list its place is the last one: a pinned model that nobody confirmed.
+* `--model X` states what we asked for, and on an agent that reports nothing back there is no way
+* to know it was honoured, so the pin is shown alongside the fact that it is unverified. Without
+* that line a reader would take a requested model for a measured one, which is the overstatement
+* this whole split exists to prevent.
+*
+* Said only when something was pinned. On an unpinned run there is no claim outstanding, and a
+* standing "not reported" would be noise on every review anybody ever runs.
+*
+* Both sentences that name an agent are withheld from a review no agent produced, through the same
+* `producedByAgent` distinction `attributionLabel` makes. An extension review has no agent id, and
+* naming one anyway credited Claude Code for somebody's OpenAI review and then reported that Claude
+* Code had not confirmed a model nobody had asked it for. What remains for such a review is the
+* model it requested and the model that answered, which is the whole of what is known about it.
+*/
+function provenanceDetailLines(session) {
+	const agent = producedByAgent(session) ? agentDisplayName(session.agentId) : null;
+	const { requestedModel, observedModel, agentVersion } = modelProvenanceOf(session);
+	return [
+		...agent ? [`Reviewed with ${agent}`] : [],
+		...agentVersion ? [`Agent version ${agentVersion}`] : [],
+		...requestedModel ? [`Requested model ${humanizeModelId(requestedModel)}`] : [],
+		...observedModel ? [`Reported model ${humanizeModelId(observedModel)}`] : [],
+		...agent && requestedModel && !observedModel ? [`Reported model not reported by ${agent}`] : []
+	];
+}
+//#endregion
 //#region ../../packages/review-harness/src/domain/ui/components/pill_tooltips.ts
 /**
 * What every pill in the sidebar actually means, in one place.
@@ -881,7 +994,8 @@ var CANCEL_BUTTON = `<button type="button" class="pr-helper-cancel-button">Cance
 function renderGeneratingOverview(session, iconUrl) {
 	const activeIndex = session.progress.findIndex((step) => !step.done);
 	const brandMark = iconUrl ? `<img src="${escapeHtml$1(iconUrl)}" class="pr-helper-brand-mark" alt="" />` : "";
-	const poweredByName = session.provider === "openai_compatible" ? humanizeModelId(session.model) : PROVIDER_DISPLAY_NAME[session.provider];
+	const pickedModel = modelProvenanceOf(session).requestedModel;
+	const poweredByName = session.provider === "openai_compatible" && pickedModel ? humanizeModelId(pickedModel) : PROVIDER_DISPLAY_NAME[session.provider];
 	const isThinking = activeIndex === 2;
 	return `
     <div class="pr-helper-generating pr-helper-generating-focused">
@@ -991,8 +1105,7 @@ function coverageDetails(session) {
 * agent: it holds analyses, and this names the one it is currently showing.
 */
 function agentDetails(session) {
-	const name = humanizeModelId(session.model);
-	return name ? [`Reviewed with ${name}`] : [];
+	return provenanceDetailLines(session);
 }
 /**
 * Everything the Analysis details disclosure says, as facts rather than as markup.
@@ -2144,9 +2257,9 @@ function verdictLabel(verdict) {
 */
 var PHASE_CAVEAT = { preparing: "This can take a minute on a large repository." };
 /** The shared phase name as a sentence, with whatever this surface adds to it. */
-function phaseCopy(phase) {
-	const caveat = PHASE_CAVEAT[phase];
-	return `${PHASES[phase].doing}.${caveat ? ` ${caveat}` : ""}`;
+function phaseCopy(phase, job) {
+	const caveat = purposeOf(job) === "review" ? PHASE_CAVEAT[phase] : void 0;
+	return `${phasesFor(job)[phase].doing}.${caveat ? ` ${caveat}` : ""}`;
 }
 /**
 * The same phases, as a noun, for the retry sentence.
@@ -2204,7 +2317,7 @@ function conversationNote$1(outcome) {
 * than a gap where a sentence should be.
 */
 function phaseSentence(job) {
-	return job && isWorkPhase(job.phase) ? phaseCopy(job.phase) : "";
+	return job && isWorkPhase(job.phase) ? phaseCopy(job.phase, job) : "";
 }
 /**
 * A stopped run: what happened, and what would change it.
@@ -2220,6 +2333,9 @@ function phaseSentence(job) {
 function renderFailureBody(job, options = {}) {
 	if (!job.failure) return "";
 	const noun = isWorkPhase(job.failure.phase) ? PHASE_NOUN[job.failure.phase] : job.failure.phase;
+	if (job.failure.stopped) return `<p>${options.lead === false ? "" : "<strong>Review stopped.</strong> "}Nothing went wrong, and what it had finished is kept.</p>
+  <button type="button" class="prb-job-retry" data-job-retry>Carry on</button>
+  <p class="prb-job-note">It picks up from the ${escapeHtml$1(noun)}, not from the start.</p>`;
 	const next = job.failure.kind === "agent_authentication_failed" ? `<p class="prb-job-note">Signing that agent in is what changes this. Once it is signed in, update the review.</p>` : `<button type="button" class="prb-job-retry" data-job-retry>Retry</button>
   <p class="prb-job-note">Retry picks up from the ${escapeHtml$1(noun)}, not from the start.</p>`;
 	return `<p>${options.lead === false ? "" : "<strong>Review paused.</strong> "}${escapeHtml$1(job.failure.message)}</p>
@@ -2248,7 +2364,7 @@ function renderJobState(job) {
   <p>${escapeHtml$1(note)}</p>
 </div>`;
 	}
-	const copy = isWorkPhase(job.phase) ? phaseCopy(job.phase) : "";
+	const copy = isWorkPhase(job.phase) ? phaseCopy(job.phase, job) : "";
 	const progress = job.progress ? ` <span class="prb-job-progress">${escapeHtml$1(job.progress)}</span>` : "";
 	return `<div class="prb-job" data-job-phase="${escapeHtml$1(job.phase)}" role="status" aria-live="polite">
   <p><span class="prb-spinner" aria-hidden="true"></span> ${escapeHtml$1(copy)}${progress}</p>
@@ -2261,7 +2377,7 @@ function jobStatus(job) {
 		progress: "",
 		failed: false
 	};
-	const progress = job.phase === "failed" ? job.failure?.message ?? "" : job.progress ?? (isWorkPhase(job.phase) ? phaseCopy(job.phase) : "");
+	const progress = job.phase === "failed" ? job.failure?.message ?? "" : job.progress ?? (isWorkPhase(job.phase) ? phaseCopy(job.phase, job) : "");
 	return {
 		phase: job.phase,
 		progress,
@@ -2584,7 +2700,7 @@ function provenanceFacts(run) {
 		run.completedAt ? `Completed ${relativeTime$1(run.completedAt)}` : "",
 		`Commit ${run.reviewedSha.slice(0, 7)}`,
 		audienceSentence(run.audience),
-		run.agentId ? `Analysed by ${run.agentId}${run.model ? ` (${run.model})` : ""}` : "",
+		run.agentId ? `Analysed by ${agentDisplayName(run.agentId)}${modelSuffix(run)}` : "",
 		`Rubric version ${run.promptVersion}`
 	].filter((fact) => fact !== "");
 }
@@ -2725,6 +2841,22 @@ function renderLocationList(locations) {
     </button></li>`;
 	}).join("")}</ul>`;
 }
+/**
+* The model this run ran under, as far as it is known.
+*
+* Observed over requested, which is the precedence `attributionLabel` applies to a standard
+* review's line and the reason this reads `modelProvenanceOf` rather than a field: what the agent
+* said answered outranks what it was asked for, and only one of the two is ever a claim about what
+* actually happened. Neither known leaves the agent to stand alone rather than inventing a pin.
+*
+* `modelProvenanceOf` is also what keeps the frozen `model` out of here, which on a KISS run only
+* ever held an agent id: "Analysed by Codex (Codex)" was the shape that produced.
+*/
+function modelSuffix(run) {
+	const { requestedModel, observedModel } = modelProvenanceOf(run);
+	const model = observedModel ?? requestedModel;
+	return model ? ` (${humanizeModelId(model)})` : "";
+}
 //#endregion
 //#region ../../packages/review-harness/src/workspace/update_view.ts
 /**
@@ -3121,9 +3253,10 @@ function changeIsRead(job) {
 * second renderer, and the two would disagree the first time either changed.
 */
 function renderSteps(job) {
+	const names = phasesFor(job);
 	return `<ol class="prb-progress-steps">${progressSteps(job).map((step) => {
 		const note = step.note ? `<p class="prb-progress-note" data-step-note>${escapeHtml$1(step.note)}</p>` : "";
-		return `<li class="prb-progress-step" data-phase="${escapeHtml$1(step.phase)}" data-state="${escapeHtml$1(step.state)}" data-label-doing="${escapeHtml$1(PHASES[step.phase].doing)}" data-label-done="${escapeHtml$1(PHASES[step.phase].done)}">
+		return `<li class="prb-progress-step" data-phase="${escapeHtml$1(step.phase)}" data-state="${escapeHtml$1(step.state)}" data-label-doing="${escapeHtml$1(names[step.phase].doing)}" data-label-done="${escapeHtml$1(names[step.phase].done)}">
       <span class="prb-progress-mark" aria-hidden="true"></span>
       <span class="prb-progress-label">${escapeHtml$1(step.label)}</span>
       ${note}
@@ -3165,6 +3298,25 @@ function renderProgressView(job, fileCount) {
     ${renderAvailable(job, fileCount)}
     <p class="prb-progress-elapsed" data-started-at="${job.startedAt}">Running for ${escapeHtml$1(elapsedWords(job.startedAt))}.</p>`;
 }
+/**
+* An update running over the review it is updating.
+*
+* A strip above the review rather than the progress pane, because nothing here is missing. The
+* review below is still the current one until the update applies in a single write, so it stays
+* readable and in place; taking the page over would hide the one thing worth reading while waiting.
+*
+* Nothing once the job has ended. The reload that follows an update is what reports it, through the
+* outcome notice, and a strip still standing after that would be describing work that is over.
+*/
+function renderUpdateProgress(job) {
+	if (!job || job.phase === "done" || job.phase === "failed") return "";
+	return `<div class="prb-update-progress" data-update-phase="${escapeHtml$1(job.phase)}" role="status" aria-live="polite">
+  <p class="prb-update-progress-title"><span class="prb-spinner" aria-hidden="true"></span>Updating this review</p>
+  <p class="prb-update-progress-lead">The review below stays as it is until the update finishes.</p>
+  ${renderSteps(job)}
+  <p class="prb-progress-elapsed" data-started-at="${job.startedAt}">Running for ${escapeHtml$1(elapsedWords(job.startedAt))}.</p>
+</div>`;
+}
 //#endregion
 //#region ../../packages/review-harness/src/workspace/page.ts
 function renderWorkspace(view) {
@@ -3194,13 +3346,14 @@ function renderWorkspace(view) {
 <link rel="stylesheet" href="/assets/sidebar.css">
 <link rel="stylesheet" href="/assets/shell.css">
 </head>
-<body data-api-base="${escapeHtml$1(view.apiBase)}"${view.token ? ` data-token="${escapeHtml$1(view.token)}"` : ""}${view.editor ? ` data-editor-label="${escapeHtml$1(view.editor.label)}" data-editor-template="${escapeHtml$1(view.editor.template)}"` : ""}${view.repoPath ? ` data-repo-path="${escapeHtml$1(view.repoPath)}"` : ""} data-session-id="${escapeHtml$1(view.session.id)}" data-explain-prompt="${escapeHtml$1(EXPLAIN_SIMPLY_PROMPT)}" data-way-back="${escapeHtml$1(wayBackSentence())}" data-default-view="${session.result ? "overview" : showsProgress(view) ? "progress" : "kiss"}">
+<body data-api-base="${escapeHtml$1(view.apiBase)}"${view.token ? ` data-token="${escapeHtml$1(view.token)}"` : ""}${view.editor ? ` data-editor-label="${escapeHtml$1(view.editor.label)}" data-editor-template="${escapeHtml$1(view.editor.template)}"` : ""}${view.repoPath ? ` data-repo-path="${escapeHtml$1(view.repoPath)}"` : ""}${view.revision === void 0 ? "" : ` data-workspace-revision="${escapeHtml$1(String(view.revision))}"`} data-session-id="${escapeHtml$1(view.session.id)}" data-explain-prompt="${escapeHtml$1(EXPLAIN_SIMPLY_PROMPT)}" data-way-back="${escapeHtml$1(wayBackSentence())}" data-default-view="${session.result ? "overview" : showsProgress(view) ? "progress" : "kiss"}">
 ${renderHeader(view, freshness)}
 ${showsProgress(view) ? "" : renderJobState(view.job ?? null)}
 <div class="prb-fresh-region" data-fresh-region${freshness ? ` data-report="${escapeHtml$1(JSON.stringify(freshness))}"` : ""}${view.dismissedFreshnessSha ? ` data-dismissed-sha="${escapeHtml$1(view.dismissedFreshnessSha)}"` : ""}>${renderFreshness(freshness ?? null, {
 		dismissedSha: view.dismissedFreshnessSha,
 		actions: view.token !== void 0
 	})}</div>
+${renderUpdateProgress(view.updateJob)}
 ${renderUpdateOutcome(view.lastUpdate)}
 ${renderLineageNotice(view)}
 ${renderReviewBody(view, sections)}
@@ -3331,7 +3484,7 @@ function renderStandardViews(view, sections) {
 		detailsInHeader: true
 	})}</section>
       <section class="prb-view" data-view="guide" hidden>${renderGuideTab(session, null, null, { diagrams: true })}</section>
-      <section class="prb-view" data-view="diagram" hidden data-diagram-pane>
+      <section class="prb-view" data-view="diagram" hidden data-diagram-pane${view.pendingDiagram ? ` data-diagram-running="${escapeHtml$1(view.pendingDiagram.sectionId ?? "")}"` : ""}>
         <h3 class="prb-doc-title">Diagrams</h3>
         ${renderDiagrams(view.diagrams ?? [], sections, view.reviewedSha ?? null)}
       </section>
@@ -4037,6 +4190,9 @@ function renderShutdownDialog() {
 function renderAsk(view, sections) {
 	const suggestions = buildSuggestions(view, sections);
 	const transcript = view.transcript ?? [];
+	const pending = view.pendingAsk ?? null;
+	const pendingTurn = pending ? `<div class="prb-msg prb-msg-user">${escapeHtml$1(pending.question ?? "")}</div>
+      <div class="prb-thinking" data-ask-pending><i></i><i></i><i></i><span>Reading the change…</span></div>` : "";
 	return `<aside class="prb-ask" aria-label="Ask Buddy AI">
   <div
     class="prb-ask-resize"
@@ -4052,8 +4208,8 @@ function renderAsk(view, sections) {
   </div>
   ${renderPromptBank(view.prompts ?? [])}
   <div class="prb-ask-log" data-ask-log>
-    ${transcript.length > 0 ? transcript.map((exchange) => `<div class="prb-msg prb-msg-user">${escapeHtml$1(exchange.question)}</div>
-      <div class="prb-msg prb-msg-assistant prb-md">${renderMarkdown(exchange.answer)}${renderMessageCopySource(exchange.answer)}</div>`).join("") : `<div class="prb-ask-empty">
+    ${transcript.length > 0 || pending ? transcript.map((exchange) => `<div class="prb-msg prb-msg-user">${escapeHtml$1(exchange.question)}</div>
+      <div class="prb-msg prb-msg-assistant prb-md">${renderMarkdown(exchange.answer)}${renderMessageCopySource(exchange.answer)}</div>`).join("") + pendingTurn : `<div class="prb-ask-empty">
       <p>Ask about this change. Answers come from the review, the diff and the repository on disk — not from anywhere else.</p>
       ${suggestions.map((text) => `<button type="button" class="prb-suggestion" data-suggestion>${escapeHtml$1(text)}</button>`).join("")}
     </div>`}
@@ -4131,6 +4287,21 @@ function statusLabel(status) {
 	if (status === "complete") return "Reviewed";
 	return status === "in-progress" ? "In progress" : "New";
 }
+/**
+* Whether any of that is work still going on, which is what sets the polling cadence.
+*
+* Here rather than beside `analysisStates` because this module is the DOM-free, filesystem-free
+* arithmetic both halves of the index share, and the renderer needs this one answer without
+* needing an import that reads the jobs directory to get it.
+*
+* A stopped analysis is a state, not an activity. Counting it as live would leave the index asking
+* once a second about a review that finished failing an hour ago, for as long as the tab stayed
+* open.
+*/
+function anythingRunning(states) {
+	for (const state of states.values()) if (state.phase !== "failed") return true;
+	return false;
+}
 //#endregion
 //#region ../../packages/review-harness/src/workspace/reviews_page.ts
 function renderReviewsPage(view) {
@@ -4147,7 +4318,7 @@ function renderReviewsPage(view) {
 <link rel="stylesheet" href="/assets/sidebar.css">
 <link rel="stylesheet" href="/assets/shell.css">
 </head>
-<body class="prb-index-body">
+<body class="prb-index-body"${view.revision === void 0 ? "" : ` data-index-revision="${escapeHtml$1(view.revision)}"`} data-live="${anythingRunning(view.analyses ?? /* @__PURE__ */ new Map())}">
 <header class="prb-header">
   <span class="prb-wordmark"><b>pr</b>review<b>buddy</b></span>
   <span class="prb-change-ref">Reviews</span>
@@ -4164,7 +4335,7 @@ function renderReviewsPage(view) {
     <button type="button" class="prb-index-select" data-select-mode aria-pressed="false">Select</button>
   </div>`}
   <div class="prb-cards" data-cards>
-    ${ordered.map((group) => renderCard(group, now)).join("")}
+    ${ordered.map((group) => renderCard(group, now, view.analyses?.get(group.latest.id))).join("")}
   </div>
   ${ordered.length === 0 ? `<p class="prb-index-empty">No reviews stored yet. Ask Claude Code to review a change and one will appear here.</p>` : `<p class="prb-index-none" data-no-matches hidden>Nothing matches that.</p>`}
   ${ordered.length > 15 ? renderPager() : ""}
@@ -4265,7 +4436,7 @@ function renderBulkBar() {
 * card and is shown only in selection mode, so entering that mode is a stylesheet change rather
 * than a rebuild of the list.
 */
-function renderCard(group, now) {
+function renderCard(group, now, analysis) {
 	const review = group.latest;
 	const status = statusOf(review);
 	const href = `/r/${encodeURIComponent(review.id)}?t=${encodeURIComponent(review.token)}`;
@@ -4291,7 +4462,8 @@ function renderCard(group, now) {
         ${renderRisk(review.overallRisk)}
         <span>${review.changedFiles} file${review.changedFiles === 1 ? "" : "s"}</span>
         <span class="prb-card-diffstat"><span class="prb-add">+${review.additions}</span> <span class="prb-del">&minus;${review.deletions}</span></span>
-        <span class="prb-card-left">${escapeHtml$1(whatIsLeft(review))}</span>
+        ${analysis !== void 0 && !review.hasStandardReview ? "" : `<span class="prb-card-left">${escapeHtml$1(whatIsLeft(review))}</span>`}
+        ${renderAnalysisState(analysis)}
         <span class="prb-card-when"><time datetime="${new Date(touchedAt(review)).toISOString()}" title="${escapeHtml$1(new Date(touchedAt(review)).toLocaleString())}">${escapeHtml$1(whenLabel(review, now))}</time></span>
       </p>
     </a>
@@ -4426,6 +4598,28 @@ function renderHistoryRow(review, number, latest, now) {
   </li>`;
 }
 /**
+* What is being done to this review right now, when anything is.
+*
+* The words come from `PHASES` in `job_progress.ts` and are not written again here. That table is
+* already what the terminal prints and what the review page's checklist shows, and the last time a
+* surface kept its own copy the two drifted until a stopped run read "Analysed the change" -- a
+* tick beside a verb saying the work had happened. One table, three surfaces.
+*
+* A failed analysis says so rather than saying nothing. Before this, a review being analysed, one
+* whose analysis had failed and one never analysed were the same card: all three said "No standard
+* review yet", which is true of all three and useful about none of them.
+*
+* Nothing at all for a job that is neither live nor failed. That is the non-terminal job with no
+* driver behind it -- killed terminal, crashed process -- which sits in a working phase for up to
+* half an hour before the sweep calls it stopped. Narrating it as running would be a lie, and
+* calling it stopped here would be this renderer pre-empting a decision the sweep makes.
+*/
+function renderAnalysisState(analysis) {
+	if (analysis === void 0) return "";
+	if (analysis.phase === "failed") return analysis.stopped ? "<span class=\"prb-card-analysis\" data-analysis=\"stopped\">Analysis stopped</span>" : "<span class=\"prb-card-analysis\" data-analysis=\"failed\">Analysis failed</span>";
+	return `<span class="prb-card-analysis" data-analysis="running"><i></i>${escapeHtml$1(phasesFor({ purpose: analysis.purpose })[analysis.phase].doing)}</span>`;
+}
+/**
 * What this review still has open.
 *
 * Unresolved counts, not totals: "1 unanswered question" says where the review stands, where
@@ -4758,6 +4952,132 @@ function renderPrivacySection(settings) {
   </section>`;
 }
 //#endregion
+//#region ../../packages/review-harness/src/workspace/reviews_revision.ts
+/**
+* Whether anything the reviews index draws has changed, as one token.
+*
+* The index reacts to a change by reloading, which is what makes an aggregate the right shape: it
+* never needs to know *which* review changed, so it asks one question whose cost is the same for
+* five reviews and five hundred. Per-card revisions would be more information than the page has any
+* use for, and a request per card to carry it.
+*
+* Opaque and **equality only**, the same contract as `workspaceRevision` in `store.ts`: compare two
+* tokens for equality, never order them, never parse one. The implementation below is a hash of
+* facts the page happens to draw today, and the whole point of saying so here is that it can be
+* replaced by a counter, a watch, or anything else without a page having to be told.
+*
+* ## What is in it, and what is deliberately not
+*
+* In: every review's id and file revision, and the phase of every analysis running right now.
+* Between them those cover everything a card shows — the summary, the risk badge, the counts, the
+* pin, the reviewed mark, the running line — because every one of those reaches disk through
+* `writeWorkspace`, and the set of ids covers a review appearing or being deleted.
+*
+* Not in: **`job.updatedAt` and `job.progress`.** This is the load-bearing omission. An agent
+* streams its progress into the job record every few seconds, so a token derived from job file
+* mtimes would differ on nearly every poll, and a page that reloads whenever the token differs
+* would then reload every few seconds for the whole length of an analysis — a page thrashing
+* itself, with the reviewer's scroll position going with it. Phase only, which changes four times
+* in a run.
+*/
+/**
+* What is being done to each review, or was last done and stopped.
+*
+* Keyed by review, valued by the phase the card should name. Two states reach it and a third
+* deliberately does not:
+*
+* - **Running.** A job that is not terminal *and* whose driver holds a live claim. The claim is the
+*   load-bearing half: a job whose driver was killed sits in a working phase for up to half an hour
+*   before the sweep calls it stopped, and narrating one of those as "Analysing the change" would
+*   be the index confidently reporting work that nothing is doing.
+* - **`failed`.** Reported whether or not anything still holds the claim, which is the whole reason
+*   this function is not simply `runningJobs`. It was: `runningJobs` drops terminal jobs, and
+*   `isTerminal` counts `failed` as terminal, so a failed analysis could never reach the renderer
+*   and the card's "Analysis stopped" branch was unreachable in production while passing a unit
+*   test that handed it a state the product could not produce. A review whose analysis failed went
+*   back to reading "No standard review yet" the moment its driver let go.
+* - **`done`, and an unclaimed job still in a working phase.** Nothing. A finished job has its
+*   result on the card already, and an abandoned one is the sweep's to judge rather than this
+*   renderer's to pre-empt.
+*
+* **Every job a review has, not the latest one.** A review accumulates them -- a standard analysis,
+* a KISS run, a retry -- and two of them genuinely run at once: `handleKiss` refuses only a second
+* KISS run, and the review page's poll is built around one finishing while the other goes on. An
+* earlier cut picked the single newest job and then asked what it was, so a KISS run that ended
+* first spoke for a standard analysis that was still working, and the card fell silent on work that
+* was happening in front of the reviewer.
+*
+* So the precedence is running, then the most recent ending, and it is stated in that order because
+* that is the property: **nothing that has ended can hide something that has not.**
+*
+* `jobs` is injected only so a test can hand the same set in two different orders and prove the
+* answer does not move. Production always reads the directory.
+*
+* A failure is visible for as long as the job record survives, which is the sweep's retention. Once
+* that passes the card quietly returns to saying nothing, which is the same silence every review
+* had before this existed.
+*/
+function analysisStates(now = Date.now(), jobs = allJobs()) {
+	const byReview = /* @__PURE__ */ new Map();
+	for (const job of jobs) {
+		if (purposeOf(job) === "ask") continue;
+		const held = byReview.get(job.workspaceId);
+		if (held) held.push(job);
+		else byReview.set(job.workspaceId, [job]);
+	}
+	/**
+	* Both comparators are **total**, and that is a requirement rather than tidiness.
+	*
+	* `allJobs` reads a directory, so a tie leaves the winner to whatever order the filesystem
+	* happened to return. This function's output is hashed into the index token, and the page reloads
+	* whenever that token changes -- so an arbitrary winner is not a cosmetic wobble, it is the page
+	* reloading itself for as long as the tie exists, with no cause a reviewer could ever see. The
+	* same hazard the sorting rule was written for, one level further down.
+	*
+	* Ties are real. Two jobs can carry the same timestamp to the millisecond, and a record written
+	* before `finishedAt` existed falls back to `updatedAt`, which two records can share. The id is
+	* the last resort because it is the only field guaranteed to differ.
+	*/
+	const byId = (a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0;
+	const startedLast = (a, b) => b.startedAt - a.startedAt || byId(a, b);
+	const endedLast = (a, b) => endedAt(b) - endedAt(a) || b.startedAt - a.startedAt || byId(a, b);
+	const states = /* @__PURE__ */ new Map();
+	for (const [reviewId, jobs] of byReview) {
+		const running = jobs.filter((job) => !isTerminal(job) && isClaimed(job.id, now)).sort(startedLast);
+		if (running.length > 0) {
+			states.set(reviewId, {
+				phase: running[0].phase,
+				purpose: purposeOf(running[0])
+			});
+			continue;
+		}
+		const ended = jobs.filter((job) => isTerminal(job) && purposeOf(job) === "review").sort(endedLast);
+		if (ended[0]?.phase === "failed") states.set(reviewId, {
+			phase: "failed",
+			purpose: "review",
+			...ended[0].failure?.stopped ? { stopped: true } : {}
+		});
+	}
+	return states;
+}
+/**
+* The token.
+*
+* Takes the live analyses rather than reading them, so that one request answers with a token and a
+* running state that describe the same instant. Computing them separately would let a phase change
+* land between the two, and the page would then be told "nothing has changed" alongside a state it
+* had not seen.
+*/
+function reviewsRevision(live = analysisStates()) {
+	const hash = createHash("sha1");
+	for (const [id, revision] of workspaceStamps()) hash.update(`${id}:${revision}\n`);
+	for (const id of [...live.keys()].sort()) {
+		const state = live.get(id);
+		hash.update(`${id}@${state.purpose}:${state.phase}${state.stopped ? ":stopped" : ""}\n`);
+	}
+	return hash.digest("base64url");
+}
+//#endregion
 //#region ../../packages/review-harness/src/workspace/ask.ts
 /** Long enough for a real look at the repository; short enough that a hang is not forever. */
 var ASK_TIMEOUT_MS = 18e4;
@@ -4796,6 +5116,7 @@ var AskFailedError = class extends Error {};
 async function askAboutChange(workspace, question, sectionId, signal) {
 	const cwd = await askCheckout(workspace);
 	const env = agentEnvOf(workspace);
+	const requestedModel = resolveModel({ review: { session: workspace.session } }) ?? void 0;
 	try {
 		return extractAnswer(await withUsageRecorded(workspace.id, "ask", env, (onUsage) => agentFor(env).run({
 			capability: "read-code",
@@ -4803,10 +5124,11 @@ async function askAboutChange(workspace, question, sectionId, signal) {
 			cwd,
 			originRepoPath: workspace.repoPath,
 			env,
+			...requestedModel ? { requestedModel } : {},
 			timeoutMs: ASK_TIMEOUT_MS,
 			signal,
 			onUsage
-		})));
+		}), void 0, requestedModel));
 	} catch (error) {
 		if (error instanceof AgentUnavailableError) throw new AskUnavailableError(`${error.message} It is what this review was made with, so the assistant cannot answer.`);
 		throw explained(error, env);
@@ -4881,6 +5203,86 @@ function buildPrompt$1(workspace, question, sectionId, cwd) {
 	].join("\n");
 }
 //#endregion
+//#region ../../packages/review-harness/src/workspace/assistant_runs.ts
+var RUN_KINDS = ["ask", "diagram"];
+var runs = /* @__PURE__ */ new Map();
+function keyOf(workspaceId, kind) {
+	return `${workspaceId}:${kind}`;
+}
+/**
+* Start a run, or learn that one is already going.
+*
+* One call rather than a check followed by a start, so there is no gap between them for a second
+* request to fall through. The existing run comes back rather than a bare refusal because the
+* caller's next move is to show it, not to report an error.
+*
+* A stopped run gives up its place at once, though its handler may still be unwinding. Stop is
+* over for the reviewer when it answers, and the page reopens Ask then. A stopped run can keep
+* nothing, and `endRun` leaves a newer run alone, so the two cannot collide. An answered run still
+* holds its place until it is saved, or the next question would be asked without it.
+*/
+function beginRun(workspaceId, kind, detail, now = Date.now()) {
+	const key = keyOf(workspaceId, kind);
+	const existing = runs.get(key);
+	if (existing && existing.state !== "stopped") return { alreadyRunning: existing };
+	const controller = new AbortController();
+	const run = {
+		workspaceId,
+		kind,
+		question: detail.question ?? null,
+		sectionId: detail.sectionId,
+		startedAt: now,
+		signal: controller.signal,
+		state: "running",
+		controller
+	};
+	runs.set(key, run);
+	return { run };
+}
+/** Null for a stopped run as well: it is over for the page, whatever its handler is still doing. */
+function reportRun(workspaceId, kind) {
+	const run = runs.get(keyOf(workspaceId, kind));
+	if (!run || run.state === "stopped") return null;
+	return {
+		question: run.question,
+		sectionId: run.sectionId,
+		startedAt: run.startedAt
+	};
+}
+/**
+* The reviewer pressed Stop.
+*
+* Idempotent: a second press, a press after the answer landed, and a press with nothing running are
+* all harmless and all answer false. True only when this call is the one that stopped the run.
+*/
+function stopRun(workspaceId, kind) {
+	const run = runs.get(keyOf(workspaceId, kind));
+	if (!run || run.state !== "running") return false;
+	run.state = "stopped";
+	run.controller.abort();
+	return true;
+}
+/**
+* The agent answered. Call this in the same continuation that received the answer, before anything
+* else is awaited, so a Stop handled in between cannot slip ahead of an answer that had already won.
+*
+* False when Stop got there first, and then the answer must not be kept however complete it is.
+*/
+function completeRun(run) {
+	const held = run;
+	if (held.state !== "running") return false;
+	held.state = "completed";
+	return true;
+}
+/**
+* The run is over, whichever way. Removes this run and only this one: by the time a slow handler
+* gets here a newer run of the same kind may have begun, and it is not this handler's to end.
+*/
+function endRun(run) {
+	const key = keyOf(run.workspaceId, run.kind);
+	if (runs.get(key) === run) runs.delete(key);
+}
+//#endregion
 //#region ../../packages/review-harness/src/workspace/diagram.ts
 /** The same budget a question gets. Drawing is reading, and reading is what takes the time. */
 var DIAGRAM_TIMEOUT_MS = 18e4;
@@ -4937,6 +5339,7 @@ flowchart LR
 async function drawDiagram(workspace, sectionId, signal) {
 	const cwd = await askCheckout(workspace);
 	const env = agentEnvOf(workspace);
+	const requestedModel = resolveModel({ review: { session: workspace.session } }) ?? void 0;
 	let raw;
 	try {
 		raw = await withUsageRecorded(workspace.id, "diagram", env, (onUsage) => agentFor(env).run({
@@ -4945,10 +5348,11 @@ async function drawDiagram(workspace, sectionId, signal) {
 			cwd,
 			originRepoPath: workspace.repoPath,
 			env,
+			...requestedModel ? { requestedModel } : {},
 			timeoutMs: DIAGRAM_TIMEOUT_MS,
 			signal,
 			onUsage
-		}));
+		}), void 0, requestedModel);
 	} catch (error) {
 		if (error instanceof AgentUnavailableError) throw new DiagramUnavailableError(`${error.message} It is what this review was made with, so nothing can be drawn.`);
 		throw error;
@@ -5420,6 +5824,64 @@ var CONTENT_TYPES = {
 	".woff2": "font/woff2",
 	".png": "image/png"
 };
+/**
+* The freshness policy, in three classes and one place.
+*
+* Every response this server sends falls into exactly one of them, and which one is decided by the
+* helper that writes it rather than by the route that produced it. That is the whole shape of this:
+* a route may not have an opinion about caching, because the bug this replaced was four HTML
+* responses that each said nothing and were each individually reasonable.
+*
+*     mutable workspace state  ->  no-store    never stored, so never reused
+*     fingerprinted asset      ->  immutable   reused indefinitely; the hash is the identity
+*     other static asset       ->  no-cache    may be stored, must revalidate before reuse
+*
+* `no-cache` is a rule about reuse and not a ban on storage, which is the thing about these two
+* names that is worth saying out loud once: the assets already carried it while the pages, which
+* are the things that actually change, carried nothing at all. A reviewer marked a review reviewed,
+* pressed Back, and was shown the list as it had been — and the server had been right the whole
+* time, because it was never asked.
+*
+* The browser half of the same policy is `reloadOnRestore` in `client/page_restore.ts`. Nothing
+* here reaches the back/forward cache reliably: a restored page is a frozen document being thawed
+* rather than a stored response being reused, and browsers disagree about whether `no-store` should
+* keep a document out of that cache. Only the page itself can refuse its own restoration.
+*/
+var NO_STORE = "no-store";
+var REVALIDATE = "no-cache";
+var IMMUTABLE = "public, max-age=31536000, immutable";
+/**
+* Whether this asset's name encodes its content, which is the only thing that makes `immutable`
+* safe to say about it.
+*
+* The names come from `vite.client.ts`, which emits `chunk-[hash].js` for everything the bundler
+* split out and a bare `[name].js` for the three page entries. So the chunks may be kept forever —
+* a new build produces new names and the old ones are simply never asked for again — while
+* `workspace.js`, the stylesheets, the font and the icon are all names that survive an upgrade
+* with different content behind them, and must be revalidated every time they are reused.
+*
+* `freshness_policy.test.ts` holds this to the vite option it is derived from. The two halves are
+* in different packages' build config and source, and a change to the emitted name would otherwise
+* turn "cache forever" from safe into a stale asset nobody can clear.
+*/
+function isFingerprinted(name) {
+	return /^chunk-/.test(name);
+}
+/**
+* An HTML document, which is always a view of mutable workspace state.
+*
+* Every HTML response goes through here. There is no second way to write one, and
+* `freshness_policy.test.ts` is what keeps it that way: the cost of this bug was not that somebody
+* chose wrong, it was that four routes each got to choose.
+*/
+function sendHtml(res, status, html, cookie) {
+	res.writeHead(status, {
+		"content-type": "text/html; charset=utf-8",
+		"cache-control": NO_STORE,
+		...cookie ? { "set-cookie": cookie } : {}
+	});
+	res.end(html);
+}
 function createWorkspaceServer(options = {}) {
 	return createServer((req, res) => {
 		handle(req, res, options).catch((error) => {
@@ -5443,6 +5905,7 @@ async function handle(req, res, options) {
 	if (url.pathname === "/pin") return handlePin(req, res, options.indexToken);
 	if (url.pathname === "/delete") return handleDelete(req, res, options.indexToken);
 	if (url.pathname === "/status") return handleStatus(req, res, options.indexToken);
+	if (url.pathname === "/revision") return handleRevision(req, res, options.indexToken);
 	const match = /^\/(?:r|api)\/([0-9a-f-]{36})(\/[a-z]+)?$/.exec(url.pathname);
 	if (!match) return send(res, 404, { error: "Not found" });
 	const [, id, action] = match;
@@ -5451,7 +5914,7 @@ async function handle(req, res, options) {
 	if (!tokenMatches(workspace, url.searchParams.get("t"))) return send(res, 403, { error: "This link is missing its access token." });
 	if (url.pathname.startsWith("/r/")) {
 		touchWorkspace(workspace);
-		return sendHtml(res, workspace);
+		return sendWorkspacePage(res, workspace);
 	}
 	if (action === "/job") return send(res, 200, jobReport(workspace));
 	if (action === "/retry") return handleRetry(res, workspace);
@@ -5462,6 +5925,7 @@ async function handle(req, res, options) {
 	if (action === "/file") return void sendFile(res, workspace, url.searchParams);
 	if (action === "/ask") return handleAsk(req, res, workspace);
 	if (action === "/diagram") return handleDiagram(req, res, workspace);
+	if (action === "/stop") return handleStop(req, res, workspace);
 	if (action === "/kiss") return handleKiss(req, res, workspace);
 	if (action === "/state") return handleState(req, res, workspace);
 	if (action === "/event") return handleEvent(req, res, workspace);
@@ -5525,12 +5989,12 @@ function handleIndex(req, res, params, indexToken) {
 	}
 	const cookie = indexCookieHeader(indexToken);
 	if (onward) return redirect(res, onward, cookie);
-	const html = renderReviewsPage({ groups: recentReviewGroups(MAX_LISTED_BRANCHES) });
-	res.writeHead(200, {
-		"content-type": "text/html; charset=utf-8",
-		"set-cookie": cookie
-	});
-	res.end(html);
+	const states = analysisStates();
+	sendHtml(res, 200, renderReviewsPage({
+		groups: recentReviewGroups(MAX_LISTED_BRANCHES),
+		analyses: states,
+		revision: reviewsRevision(states)
+	}), cookie);
 }
 /**
 * Where `?go=` is allowed to send someone, which is one shape and no other.
@@ -5547,6 +6011,7 @@ function safeDestination(value) {
 function redirect(res, location, cookie) {
 	res.writeHead(302, {
 		location,
+		"cache-control": NO_STORE,
 		...cookie ? { "set-cookie": cookie } : {}
 	});
 	res.end();
@@ -5569,8 +6034,7 @@ function redirect(res, location, cookie) {
 function refuseIndex(req, res) {
 	const way = wayBack();
 	if (!wantsHtml(req)) return send(res, 403, { error: `This link is missing its access token. Run ${wayBackSentence(way)} to get the current one.` });
-	res.writeHead(403, { "content-type": "text/html; charset=utf-8" });
-	res.end(page("Your reviews", `<h1>This browser has not been shown your reviews yet</h1>
+	sendHtml(res, 403, page("Your reviews", `<h1>This browser has not been shown your reviews yet</h1>
       <p>Nothing is lost. Every review is still here, and the link you came from still works. The
       list has its own credential, separate from the one that opens a single review, so a review
       page is not able to hand it over.</p>
@@ -5614,12 +6078,7 @@ async function handleSettings(req, res, params, indexToken) {
 			error
 		});
 	}
-	const html = renderSettingsPage({ settings: readSettings() });
-	res.writeHead(200, {
-		"content-type": "text/html; charset=utf-8",
-		"set-cookie": indexCookieHeader(indexToken)
-	});
-	res.end(html);
+	sendHtml(res, 200, renderSettingsPage({ settings: readSettings() }), indexCookieHeader(indexToken));
 }
 /**
 * Whether the caller is a browser navigating, rather than something reading the API.
@@ -5693,6 +6152,34 @@ async function handleStatus(req, res, indexToken) {
 	});
 }
 /**
+* Has anything the reviews index draws changed, and is anything still being made.
+*
+* The whole of the index's liveness, in one request that costs the same whether the machine holds
+* five reviews or five hundred. The page reloads when `revision` differs from the one it was
+* rendered with; it never needs to know which review changed, because its answer to any change is
+* the same answer.
+*
+* Both fields describe one instant, which is why `liveAnalyses` is read once and passed in rather
+* than read twice. Computed separately, a phase could change between them and the page would be
+* told nothing had changed alongside a running state it had not seen.
+*
+* `live` sets the **cadence**, never whether to poll. A page that renders with nothing running
+* still has to learn that a review was started from a terminal somewhere, and a page whose work has
+* finished has to slow down without needing a reload to be told. See `client/reviews.ts`.
+*
+* Authorised by the index credential like `/pin`, `/delete` and `/status`, because this is the list
+* asking about itself. Flat rather than under `/api/`, which is the per-review namespace and whose
+* route requires a review id this question does not have.
+*/
+function handleRevision(req, res, indexToken) {
+	if (!indexToken || !secretMatches(indexToken, indexCookie(req))) return send(res, 403, { error: "Not authorised." });
+	const states = analysisStates();
+	send(res, 200, {
+		revision: reviewsRevision(states),
+		live: anythingRunning(states)
+	});
+}
+/**
 * Pin or unpin a review.
 *
 * Authorised by the index credential rather than the review's own, because pinning is a fact about
@@ -5876,7 +6363,7 @@ function recordWorkspaceOpened(workspace) {
 	const event = workspaceOpenedEvent(workspace);
 	if (event) record(event);
 }
-async function sendHtml(res, workspace) {
+async function sendWorkspacePage(res, workspace) {
 	const freshness = await freshnessOrNull(workspace);
 	const kissFreshness = await kissFreshnessOrNull(workspace);
 	const kissRun = latestKissRun(workspace);
@@ -5897,6 +6384,8 @@ async function sendHtml(res, workspace) {
 		repoPath: workspace.repoPath,
 		askWidth: readPreferences().askWidth,
 		transcript: workspace.transcript,
+		pendingAsk: reportRun(workspace.id, "ask"),
+		pendingDiagram: reportRun(workspace.id, "diagram"),
 		prompts: readPromptBank(),
 		complete: workspace.completedAt !== void 0,
 		prContext: workspace.prContext ? {
@@ -5909,8 +6398,10 @@ async function sendHtml(res, workspace) {
 		lastUpdate: notice,
 		diagrams: workspace.diagrams,
 		reviewedSha: reviewedCommit(workspace),
+		revision: workspaceRevision(workspace),
 		lineage: lineagePosition(workspace),
 		job: workspace.jobId ? loadJob(workspace.jobId) : void 0,
+		updateJob: liveUpdateFor(workspace.id),
 		kissRun,
 		kissJob: kissRun ? loadJob(kissRun.jobId) : void 0,
 		kissFreshness,
@@ -5925,8 +6416,7 @@ async function sendHtml(res, workspace) {
 		code: freshness.code.state,
 		checkout: freshness.checkout.state
 	});
-	res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
-	res.end(html);
+	sendHtml(res, 200, html);
 }
 function sendAsset(res, pathname) {
 	const name = pathname.slice(8);
@@ -5936,7 +6426,7 @@ function sendAsset(res, pathname) {
 	const ext = name.slice(name.lastIndexOf("."));
 	res.writeHead(200, {
 		"content-type": CONTENT_TYPES[ext] ?? "application/octet-stream",
-		"cache-control": "no-cache"
+		"cache-control": isFingerprinted(name) ? IMMUTABLE : REVALIDATE
 	});
 	res.end(body);
 }
@@ -5998,7 +6488,10 @@ function jobReport(workspace) {
 	const kissRun = latestKissRun(workspace);
 	return {
 		...jobStatus(workspace.jobId ? loadJob(workspace.jobId) : null),
-		kiss: jobStatus(kissRun ? loadJob(kissRun.jobId) : null)
+		kiss: jobStatus(kissRun ? loadJob(kissRun.jobId) : null),
+		update: jobStatus(liveUpdateFor(workspace.id)),
+		ask: reportRun(workspace.id, "ask"),
+		diagram: reportRun(workspace.id, "diagram")
 	};
 }
 /**
@@ -6011,10 +6504,12 @@ function jobReport(workspace) {
 async function handleFreshness(res, workspace) {
 	const kiss = await kissFreshnessOrNull(workspace);
 	const report = await freshnessOrNull(workspace);
+	const revision = workspaceRevision(workspace) ?? null;
 	if (!report) return send(res, 200, {
 		report: null,
 		kiss,
-		kissDismissedSha: workspace.dismissedKissFreshnessSha ?? null
+		kissDismissedSha: workspace.dismissedKissFreshnessSha ?? null,
+		revision
 	});
 	record({
 		event: "freshness_checked",
@@ -6027,7 +6522,8 @@ async function handleFreshness(res, workspace) {
 		report,
 		dismissedSha: workspace.dismissedFreshnessSha ?? null,
 		kiss,
-		kissDismissedSha: workspace.dismissedKissFreshnessSha ?? null
+		kissDismissedSha: workspace.dismissedKissFreshnessSha ?? null,
+		revision
 	});
 }
 /**
@@ -6095,6 +6591,7 @@ async function handleUpdate(res, workspace) {
 	try {
 		outcome = await updateReview(workspace);
 	} catch (error) {
+		if (error instanceof UpdateAlreadyRunningError) return send(res, 409, { error: error.message });
 		outcome = {
 			at: Date.now(),
 			ok: false,
@@ -6203,6 +6700,15 @@ async function handleAsk(req, res, workspace) {
 	const question = typeof body?.question === "string" ? body.question.trim() : "";
 	if (!question) return send(res, 400, { error: "No question given." });
 	const sectionId = typeof body?.sectionId === "string" ? body.sectionId : null;
+	const started = beginRun(workspace.id, "ask", {
+		question,
+		sectionId
+	});
+	if ("alreadyRunning" in started) return send(res, 409, {
+		error: "Buddy AI is still answering the last question on this review.",
+		running: true
+	});
+	const run = started.run;
 	record({
 		event: "assistant_question_asked",
 		reviewId: workspace.id,
@@ -6210,40 +6716,64 @@ async function handleAsk(req, res, workspace) {
 		scoped: sectionId !== null,
 		turn: workspace.transcript.length + 1
 	});
-	const cancel = new AbortController();
-	res.on("close", () => {
-		if (!res.writableEnded) cancel.abort();
-	});
 	const startedAt = Date.now();
-	let answer;
+	const failed = () => record({
+		event: "assistant_answered",
+		reviewId: workspace.id,
+		durationMs: Date.now() - startedAt,
+		ok: false,
+		...run.state === "stopped" ? { cancelled: true } : {}
+	});
 	try {
-		answer = await askAboutChange(workspace, question, sectionId, cancel.signal);
-	} catch (error) {
-		const cancelled = error instanceof AgentCancelledError;
+		let answer;
+		try {
+			answer = await askAboutChange(workspace, question, sectionId, run.signal);
+		} catch (error) {
+			failed();
+			if (run.state === "stopped") return sendIfOpen(res, 200, { stopped: true });
+			throw error;
+		}
+		if (!completeRun(run)) {
+			failed();
+			return sendIfOpen(res, 200, { stopped: true });
+		}
 		record({
 			event: "assistant_answered",
 			reviewId: workspace.id,
 			durationMs: Date.now() - startedAt,
-			ok: false,
-			...cancelled ? { cancelled: true } : {}
+			ok: true
 		});
-		if (cancelled) return;
-		throw error;
+		const fresh = loadWorkspace(workspace.id);
+		if (fresh) {
+			fresh.transcript.push({
+				question,
+				answer,
+				sectionId,
+				askedAt: Date.now()
+			});
+			saveWorkspace(fresh);
+		}
+		sendIfOpen(res, 200, { answer });
+	} finally {
+		endRun(run);
 	}
-	record({
-		event: "assistant_answered",
-		reviewId: workspace.id,
-		durationMs: Date.now() - startedAt,
-		ok: true
-	});
-	workspace.transcript.push({
-		question,
-		answer,
-		sectionId,
-		askedAt: Date.now()
-	});
-	saveWorkspace(workspace);
-	send(res, 200, { answer });
+}
+/** Only while somebody is listening. A page that left took its socket with it. */
+function sendIfOpen(res, status, body) {
+	if (res.writableEnded || res.destroyed) return;
+	send(res, status, body);
+}
+/**
+* The reviewer pressed Stop, on this page or on another one showing the same review.
+*
+* The only way a question or a drawing ends early. Idempotent, so a double press and a press that
+* lands as the answer does are both harmless: the run decides once which of the two won.
+*/
+async function handleStop(req, res, workspace) {
+	const body = await readJson(req);
+	const kind = RUN_KINDS.find((candidate) => candidate === body?.kind);
+	if (!kind) return send(res, 400, { error: "Say what to stop: the question or the drawing." });
+	send(res, 200, { stopped: stopRun(workspace.id, kind) });
 }
 /**
 * Draw the change, or one theme of it, and keep the drawing.
@@ -6257,46 +6787,60 @@ async function handleDiagram(req, res, workspace) {
 	const body = await readJson(req);
 	const sectionId = typeof body?.sectionId === "string" ? body.sectionId : null;
 	const scope = sectionId ?? "change";
-	const existing = (workspace.diagrams ?? []).findIndex((diagram) => diagram.scope === scope);
+	const redraw = (workspace.diagrams ?? []).some((diagram) => diagram.scope === scope);
+	const started = beginRun(workspace.id, "diagram", { sectionId });
+	if ("alreadyRunning" in started) return send(res, 409, {
+		error: "A diagram of this review is already being drawn.",
+		running: true
+	});
+	const run = started.run;
 	record({
 		event: "diagram_requested",
 		reviewId: workspace.id,
 		scoped: sectionId !== null,
-		redraw: existing !== -1
-	});
-	const cancel = new AbortController();
-	res.on("close", () => {
-		if (!res.writableEnded) cancel.abort();
+		redraw
 	});
 	const startedAt = Date.now();
-	let diagram;
+	const failed = () => record({
+		event: "diagram_drawn",
+		reviewId: workspace.id,
+		durationMs: Date.now() - startedAt,
+		ok: false,
+		...run.state === "stopped" ? { cancelled: true } : {}
+	});
 	try {
-		diagram = await drawDiagram(workspace, sectionId, cancel.signal);
-	} catch (error) {
-		const cancelled = error instanceof AgentCancelledError;
+		let diagram;
+		try {
+			diagram = await drawDiagram(workspace, sectionId, run.signal);
+		} catch (error) {
+			failed();
+			if (run.state === "stopped") return sendIfOpen(res, 200, { stopped: true });
+			if (error instanceof DiagramUnavailableError || error instanceof DiagramMalformedError) return sendIfOpen(res, 502, { error: error.message });
+			throw error;
+		}
+		if (!completeRun(run)) {
+			failed();
+			return sendIfOpen(res, 200, { stopped: true });
+		}
 		record({
 			event: "diagram_drawn",
 			reviewId: workspace.id,
 			durationMs: Date.now() - startedAt,
-			ok: false,
-			...cancelled ? { cancelled: true } : {}
+			ok: true
 		});
-		if (cancelled) return;
-		if (error instanceof DiagramUnavailableError || error instanceof DiagramMalformedError) return send(res, 502, { error: error.message });
-		throw error;
+		const fresh = loadWorkspace(workspace.id);
+		if (fresh) {
+			const diagrams = [...fresh.diagrams ?? []];
+			const existing = diagrams.findIndex((one) => one.scope === scope);
+			if (existing === -1) diagrams.push(diagram);
+			else diagrams[existing] = diagram;
+			fresh.diagrams = diagrams;
+			saveWorkspace(fresh);
+		}
+		sendIfOpen(res, 200, { diagram });
+	} finally {
+		endRun(run);
 	}
-	record({
-		event: "diagram_drawn",
-		reviewId: workspace.id,
-		durationMs: Date.now() - startedAt,
-		ok: true
-	});
-	const diagrams = [...workspace.diagrams ?? []];
-	if (existing === -1) diagrams.push(diagram);
-	else diagrams[existing] = diagram;
-	workspace.diagrams = diagrams;
-	saveWorkspace(workspace);
-	send(res, 200, { diagram });
 }
 /**
 * Stop serving, at the request of a workspace.
@@ -6385,7 +6929,10 @@ async function readJson(req) {
 	}
 }
 function send(res, status, payload) {
-	res.writeHead(status, { "content-type": "application/json; charset=utf-8" });
+	res.writeHead(status, {
+		"content-type": "application/json; charset=utf-8",
+		"cache-control": NO_STORE
+	});
 	res.end(JSON.stringify(payload));
 }
 var ASK_SOURCES = [
@@ -6506,16 +7053,12 @@ async function sweep(now = Date.now()) {
 			if (markAbandoned(job, now)) report.abandoned += 1;
 			continue;
 		}
-		if (now - finishedAt(job) < 216e5) continue;
+		if (now - endedAt(job) < 216e5) continue;
 		if (await retire(job, report)) report.retired += 1;
 	}
 	await removeOrphans(jobs, report);
 	return report;
 }
-/** When this job stopped doing work. `finishedAt` predates nothing, but a record can be old. */
-function finishedAt(job) {
-	return job.finishedAt ?? job.updatedAt;
-}
 /**
 * Record that a job stopped, unless it has moved since this pass read it.
 *