prreviewbuddy 0.78.1 → 0.80.2

package/CHANGELOG.md

@@ -1,5 +1,103 @@
 # Changelog
 
+## 0.80.2
+
+**A review opens the way you left the last one.** Hiding or showing Buddy AI, expanding a pane or
+Buddy AI, and folding parts of the rail are remembered across reviews until you change them. An
+expanded pane carries over as "the document expanded", so the next review opens with whichever pane
+it lands on expanded. Reloading a review, or going Back or Forward to it, keeps that page's own
+layout and changes nothing about how the next review opens. On a narrow window, where Buddy AI would
+cover the review, it stays closed and unexpanded until you open it.
+
+**Activity, Settings and Help match the other pages.** Activity's list keeps the same width as the
+Reviews and Runs pages instead of filling the window. Settings and Help sit in the same light,
+rounded border as Activity's list.
+
+## 0.80.1
+
+**Runs filters say what they filter.** Status and Operation are now Run status and Run type, so
+neither reads as the review's own state, and their first options say All statuses and All types. A
+first analysis is called Initial review, in the filter and on each run, to set it apart from Update
+and Re-run. A click anywhere on a Runs filter opens its menu, as it does on the Reviews page, rather
+than only a click on its value.
+
+**Runs sections fold, and stay folded.** In progress and Recent runs fold from their headings, or
+with ⌘K L then I or R, as the Reviews page's sections do, and stay as you left them through the
+page's live reloads and the next visit. The Runs page keeps its own folds: folding In progress here
+leaves it open on Reviews. Fixed: Show older runs no longer appears when every run is already shown.
+
+**A finished run's card opens its review.** Click anywhere on it, or move to it with J and K and
+press Enter, as on Reviews. The Open review link is gone. Remove now sits in the card's … menu, as
+Remove from Runs, which Space opens from the keyboard. A run whose review was deleted still says so
+and opens nothing.
+
+**Old run records are deleted even when their checkout is already gone.** A record past retention
+whose checkout had been removed some other way was refused on every cleanup and kept for good, since
+the removal guard found no marker in a directory that was not there. The Runs page's cleanup note was
+the first place this showed. They now go on the next pass. A checkout that cannot be looked at, as
+opposed to one that is gone, still keeps its record.
+
+## 0.80.0
+
+**Runs: what is running, what is waiting, and a week of what ran.** A new Runs page, beside Reviews
+in the sidebar and on ⌘K E from anywhere, lists every analysis, Update review, re-run and KISS
+review as its own entry, whether it was started here or from a terminal. Running work shows the step
+it is on; the pull requests you added from the workspace that are waiting for a slot show as Queued.
+Below that, every run of the last seven days says how it ended (Completed, Failed or Cancelled), when,
+how long it took, who asked for it (Workspace or CLI) and which agent ran it, with the reason when it
+failed. A review analysed, then updated, then re-run is three entries, and a Retry is a new entry
+rather than a rewrite of the attempt it retried.
+
+Three counts sit above the lists: Running, Queued, and Failed over the last seven days. Search,
+Status and Operation filters search the whole week, not only the runs on screen, and stay set while
+the page refreshes itself as runs start and end. Open review opens the review as it is now; when the
+review presents a later re-run's analysis instead of a run's own, that run says so. A re-run still going, or one that failed or was stopped, replaces nothing, and
+neither does an update, which changes an analysis in place. Remove takes an ended run off the
+page and changes nothing about its review; it is not offered on a run whose job is running again.
+
+A run whose driver has gone, such as a terminal that was closed mid-review, is shown as Not
+responding rather than as running, and reads Failed once the existing half-hour check gives up on it.
+
+**What is kept.** Finished runs are now kept for seven days; their isolated checkouts are still
+removed after six hours, and Retry on an older failure makes a new checkout. A review that failed
+therefore keeps saying "Analysis failed" for up to seven days rather than six hours. Deleting a review
+keeps a record that its runs happened, with none of their output, the conversation or the agent's
+words, until the seven days are up; the entry reads "Review deleted" and links nowhere. Nothing older
+than seven days is ever shown. Old records and checkouts are deleted by the workspace server, once
+when it starts and every ten minutes while it runs, so a server left stopped deletes nothing until
+it next starts. If a cleanup cannot remove something, the Runs page says what and why, an open
+page included, and the next pass tries again.
+
+Queued work is this server's own: pull requests waiting in a terminal's `--pr` batch appear once
+they start, as on the Reviews page.
+
+## 0.79.0
+
+**In progress: everything being analysed, in one place.** Reviews now opens with an In progress
+section whenever work is going on. It lists every review being analysed on this machine, whether you
+started it here or from a terminal, every Update review and re-run, and the pull requests you added
+from the workspace that are waiting for their turn, each with the step it is on and when it started.
+Pull requests waiting in a terminal's `--pr` batch appear once they start. Queued entries hold
+still; running ones pulse. Click an entry to open the review, where its progress, Cancel and Retry
+already are. A pull request still waiting has no review yet, so its entry is not a link.
+
+A review you are updating stays in Active with its current findings while the update runs, and also
+appears under In progress, because one is the review and the other is the work being done to it. A
+review being analysed for the first time has nothing to show yet, so it is listed only under In
+progress, and moves to Active when its analysis finishes. If the analysis fails or is stopped, it
+returns to Active saying so, as before.
+
+The section follows the open page without a refresh: work appears as it starts, moves from Queued to
+running, and leaves when it ends. Search and the Author, Review state and PR filters apply to it just
+as they do to the reviews, its count is of the work it is showing, and its heading folds like the
+others, from the keyboard too with ⌘K L I.
+
+## 0.78.2
+
+**A long prompt wraps instead of scrolling sideways.** In a finding's Ask Buddy menu and in the menu
+over selected text, a saved prompt longer than the menu's width now continues onto further lines,
+so all of it can be read before choosing. The menu over selected text stays at most 320px wide.
+
 ## 0.78.1
 
 **A filtered list says it is filtered.** While the search or a filter is narrowing Reviews, the count

package/dist/{delete_review-BHOzMQ0_.js → delete_review-BXfGCvQ1.js}

@@ -1,6 +1,6 @@
 import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { execFile, execFileSync, spawn } from "node:child_process";
-import { accessSync, appendFileSync, closeSync, constants, existsSync, linkSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
+import { accessSync, appendFileSync, closeSync, constants, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { homedir, hostname, tmpdir } from "node:os";
 import { promisify } from "node:util";
@@ -3910,7 +3910,7 @@ function* jsonCandidates(text) {
 	for (const match of text.matchAll(/```(?:json)?\s*([\s\S]*?)```/gi)) {
 		const inner = match[1].trim();
 		if (!inner.startsWith("{") && !inner.startsWith("[")) continue;
-		const value = parsed(inner);
+		const value = parsed$1(inner);
 		if (value.ok) yield {
 			text: inner,
 			value: value.value
@@ -3922,7 +3922,7 @@ function* jsonCandidates(text) {
 		const end = closingIndex(text, start, opener);
 		if (end === -1) continue;
 		const candidate = text.slice(start, end + 1);
-		const value = parsed(candidate);
+		const value = parsed$1(candidate);
 		if (!value.ok) continue;
 		yield {
 			text: candidate,
@@ -3931,7 +3931,7 @@ function* jsonCandidates(text) {
 		start = end;
 	}
 }
-function parsed(candidate) {
+function parsed$1(candidate) {
 	try {
 		return {
 			ok: true,
@@ -6217,6 +6217,11 @@ function summarise(workspace) {
 		questions: questions.length,
 		unansweredQuestions: questionsOutstanding(questions, answered).open,
 		messages: workspace.transcript.length,
+		...workspace.jobId && result ? { analysisJobId: workspace.jobId } : {},
+		...(() => {
+			const kiss = presentedKissRunOf(workspace);
+			return kiss ? { presentedKissJobId: kiss.jobId } : {};
+		})(),
 		lastViewedAt: workspace.lastViewedAt,
 		completedAt: workspace.completedAt,
 		pinned: workspace.pinned === true,
@@ -6477,6 +6482,17 @@ function workspaceIdFrom(entry) {
 * the other's file by accident.
 */
 var CLAIMS_DIR = join(STORE_ROOT, "claims");
+/**
+* How long a claim stands without being renewed.
+*
+* Deliberately short, and it can be short because renewal is on a timer rather than tied to the
+* work. The job record's own `updatedAt` moves only when a phase changes or the agent streams a
+* line, which is why the sweep has to allow it thirty minutes of silence; a heartbeat keeps ticking
+* through a twenty minute analysis that says nothing at all. Three minutes leaves room for several
+* missed renewals on an event loop busy parsing a large diff, and still frees a crashed holder long
+* before anyone would think to ask why Retry does nothing.
+*/
+var CLAIM_LEASE_MS = 18e4;
 /** Comfortably inside the lease, so one slow tick is never enough to lose a claim that is held. */
 var CLAIM_RENEW_MS = 3e4;
 function claimPath(key) {
@@ -6882,6 +6898,128 @@ var JOBS_DIR = join(STORE_ROOT, "jobs");
 function reusesImportedConversation(job) {
 	return job.reviewType === "kiss";
 }
+/**
+* What survives of a finished run when the reviewer deletes its review.
+*
+* Runs is a history of executions, not of reviews, so "the review you deleted was analysed twice
+* yesterday and the first attempt failed" stays true after the deletion. What the reviewer deleted
+* must not: everything a run produced or was given goes, and so does every sentence that might
+* quote it. Kept are identity and times, the outcome as a kind rather than a message, which client
+* asked and which agent ran, and the change's own name (repository, branch, pull request), which
+* is what makes the entry recognisable at all.
+*
+* An allow-list, built field by field, so a field added to the job later is dropped here until
+* somebody decides it should not be.
+*/
+function strippedForDeletedReview(job) {
+	const request = job.target.pullRequest;
+	const attemptFailure = (failure) => failure ? { failure: {
+		message: "",
+		...failure.kind ? { kind: failure.kind } : {},
+		...failure.stopped ? { stopped: true } : {}
+	} } : {};
+	return {
+		id: job.id,
+		workspaceId: job.workspaceId,
+		target: {
+			originRepoPath: job.target.originRepoPath,
+			branch: job.target.branch,
+			sha: job.target.sha,
+			...request ? { pullRequest: {
+				reference: request.url ?? "",
+				headRef: request.headRef,
+				headSha: request.headSha,
+				...request.number !== void 0 ? { number: request.number } : {},
+				...request.url ? { url: request.url } : {},
+				...request.source ? { source: request.source } : {}
+			} } : {}
+		},
+		...job.purpose ? { purpose: job.purpose } : {},
+		...job.reanalysis ? { reanalysis: true } : {},
+		...job.reviewType ? { reviewType: job.reviewType } : {},
+		phase: job.phase,
+		startedAt: job.startedAt,
+		updatedAt: job.updatedAt,
+		...job.finishedAt !== void 0 ? { finishedAt: job.finishedAt } : {},
+		completed: [],
+		...job.failure ? { failure: {
+			phase: job.failure.phase,
+			message: "",
+			...job.failure.kind ? { kind: job.failure.kind } : {},
+			...job.failure.stopped ? { stopped: true } : {}
+		} } : {},
+		env: job.env.agentId ? { agentId: job.env.agentId } : {},
+		attemptId: attemptIdOf(job),
+		...job.source ? { source: job.source } : {},
+		...job.previousAttempts ? { previousAttempts: job.previousAttempts.map((attempt) => ({
+			attemptId: attempt.attemptId,
+			startedAt: attempt.startedAt,
+			finishedAt: attempt.finishedAt,
+			phase: attempt.phase,
+			...attemptFailure(attempt.failure),
+			...attempt.source ? { source: attempt.source } : {},
+			...attempt.agentId ? { agentId: attempt.agentId } : {}
+		})) } : {},
+		...job.removedFromRuns ? { removedFromRuns: job.removedFromRuns } : {},
+		reviewDeleted: true
+	};
+}
+/**
+* How long a finished run is listed, and kept: measured from when it ended, per attempt.
+*
+* A strict limit on what the page shows, not only on what the sweep deletes. The sweep runs inside
+* the workspace server, so while the server is stopped nothing is deleted, and a record can outlive
+* its week on disk until the next start; the page never shows it past the week regardless.
+*/
+var RUN_RECORD_RETENTION_MS = 6048e5;
+/** The current attempt's id. See `ReviewJob.attemptId`. */
+function attemptIdOf(job) {
+	return job.attemptId ?? job.id;
+}
+/**
+* The record a driver should save as it picks this job up, before it does any work.
+*
+* A job that had ended is starting a new attempt: the ended one is archived, a new attempt id is
+* minted and the record leaves its terminal phase, all in the one value returned, so the caller
+* makes a single write. That is what makes the archive happen exactly once. A crash after the write
+* leaves a working job nobody drives, which the sweep in time records as stopped, and never a
+* terminal one that the next pickup would archive a second time; the id check covers a record that
+* was archived and then, somehow, written back terminal.
+*
+* A job that had not ended is the same attempt resuming (a restarted daemon, a driver whose claim
+* lapsed): only `startedAt` moves, because the page times "Running for" from it.
+*/
+function beginAttempt(job, next) {
+	if (!isTerminal(job)) return {
+		...job,
+		startedAt: next.startedAt
+	};
+	const ended = attemptIdOf(job);
+	const earlier = job.previousAttempts ?? [];
+	const current = earlier.filter((attempt) => next.startedAt - attempt.finishedAt < RUN_RECORD_RETENTION_MS);
+	const archived = earlier.some((attempt) => attempt.attemptId === ended) ? current : [...current, {
+		attemptId: ended,
+		startedAt: job.startedAt,
+		finishedAt: endedAt(job),
+		phase: job.phase,
+		...job.failure ? { failure: {
+			message: job.failure.message,
+			...job.failure.kind ? { kind: job.failure.kind } : {},
+			...job.failure.stopped ? { stopped: true } : {}
+		} } : {},
+		...job.source ? { source: job.source } : {},
+		...job.env.agentId ? { agentId: job.env.agentId } : {}
+	}];
+	const { failure: _failure, finishedAt: _finishedAt, progress: _progress, ...rest } = job;
+	return {
+		...rest,
+		phase: next.phase,
+		startedAt: next.startedAt,
+		attemptId: randomUUID(),
+		previousAttempts: archived,
+		...next.source ? { source: next.source } : {}
+	};
+}
 function jobPath(id) {
 	return join(JOBS_DIR, `${id}.json`);
 }
@@ -6889,6 +7027,7 @@ function createJob(input) {
 	const now = Date.now();
 	return {
 		id: randomUUID(),
+		attemptId: randomUUID(),
 		phase: "preparing",
 		startedAt: now,
 		updatedAt: now,
@@ -6896,9 +7035,30 @@ function createJob(input) {
 		...input
 	};
 }
+/**
+* Replace the record whole, so a reader sees the old one or the new one and never a prefix.
+*
+* `writeFileSync` truncates on open, and a crash between that and the end of the write left a record
+* that does not parse, which `loadJob` reads as no job at all: the review's analysis, its attempts
+* and its checkout's only pointer gone at once. Renamed into place instead, from a name unique to
+* this write, because more than one process writes job records. Serialised first, so a throw in
+* `JSON.stringify` cannot leave anything behind. Unlike `writeJsonAtomically`, a failure throws:
+* every caller of this already handles a write that fails.
+*/
 function saveJob(job) {
+	const document = JSON.stringify(job);
 	mkdirSync(JOBS_DIR, { recursive: true });
-	writeFileSync(jobPath(job.id), JSON.stringify(job), { mode: 384 });
+	const path = jobPath(job.id);
+	const temp = `${path}.${process.pid}.${randomUUID()}.tmp`;
+	try {
+		writeFileSync(temp, document, { mode: 384 });
+		renameSync(temp, path);
+	} catch (error) {
+		try {
+			unlinkSync(temp);
+		} catch {}
+		throw error;
+	}
 }
 function loadJob(id) {
 	try {
@@ -6925,21 +7085,81 @@ function migrate(job) {
 		}
 	};
 }
+/**
+* Every record parsed so far, by file, with the identity of the file it was parsed from.
+*
+* Since the Runs page, the directory holds a week of records rather than six hours of them, and the
+* Reviews and Runs pages each read all of it on every poll. Read and parsed whole, 500 records cost
+* about 100 ms a time, synchronously, inside the server; asking the filesystem whether each file is
+* still the one already parsed costs about 1 ms. `saveJob` renames a fresh file into place, so a
+* record that was written in any way has a new inode, and inode, mtime and size together are a
+* change no write can slip past.
+*
+* Frozen, because every caller now shares one copy: a caller that edited a record in place would
+* be editing it for everyone, and strict mode turns that into an error where it happens.
+*/
+var parsed = /* @__PURE__ */ new Map();
 function allJobs() {
 	let names;
 	try {
 		names = readdirSync(JOBS_DIR);
 	} catch {
+		parsed.clear();
 		return [];
 	}
 	const jobs = [];
+	const present = /* @__PURE__ */ new Set();
 	for (const name of names) {
 		if (!name.endsWith(".json")) continue;
+		present.add(name);
+		let identity;
+		try {
+			const stat = statSync(join(JOBS_DIR, name));
+			identity = `${stat.ino}:${stat.mtimeMs}:${stat.size}`;
+		} catch {
+			continue;
+		}
+		const cached = parsed.get(name);
+		if (cached?.identity === identity) {
+			jobs.push(cached.job);
+			continue;
+		}
 		const job = loadJob(name.slice(0, -5));
-		if (job) jobs.push(job);
+		if (!job) {
+			parsed.delete(name);
+			continue;
+		}
+		Object.freeze(job);
+		parsed.set(name, {
+			identity,
+			job
+		});
+		jobs.push(job);
 	}
+	for (const name of parsed.keys()) if (!present.has(name)) parsed.delete(name);
 	return jobs;
 }
+/**
+* Temporary files a `saveJob` left behind when its process died between the write and the rename.
+*
+* Invisible to every reader, which lists `.json` only, so they cost nothing but disk. A write lasts
+* milliseconds, so one older than `olderThanMs` is residue rather than a write in flight.
+*/
+function pruneJobResidue(now, olderThanMs) {
+	let names;
+	try {
+		names = readdirSync(JOBS_DIR);
+	} catch {
+		return;
+	}
+	for (const name of names) {
+		if (!name.endsWith(".tmp")) continue;
+		const path = join(JOBS_DIR, name);
+		try {
+			if (now - statSync(path).mtimeMs >= olderThanMs) unlinkSync(path);
+		} catch {}
+	}
+}
 function deleteJob(id) {
 	try {
 		unlinkSync(jobPath(id));
@@ -15938,6 +16158,7 @@ async function startJob(input) {
 			target,
 			env: agent.captureEnv(),
 			purpose: "review",
+			...input.source ? { source: input.source } : {},
 			...input.requestedModel ? { requestedModel: input.requestedModel } : {},
 			...review.type === "kiss" ? {
 				reviewType: "kiss",
@@ -15971,7 +16192,7 @@ async function startJob(input) {
 * The previous result is snapshotted before the session is replaced, so the review keeps saying who
 * made the analysis it is retiring as well as who made the one it now shows.
 */
-async function reanalyseReview(workspaceId, agentId, onStarted, requestedModel) {
+async function reanalyseReview(workspaceId, agentId, onStarted, requestedModel, source) {
 	const workspace = loadWorkspace(workspaceId);
 	if (!workspace) throw new Error("No such review.");
 	const sha = workspace.session.metadata?.commitSha;
@@ -16003,6 +16224,7 @@ async function reanalyseReview(workspaceId, agentId, onStarted, requestedModel)
 				env: agent.captureEnv(),
 				purpose: "review",
 				reanalysis: true,
+				...source ? { source } : {},
 				...model ? { requestedModel: model } : {}
 			});
 			saveJob(job);
@@ -16062,7 +16284,7 @@ async function runJob(workspaceId, runners = {}, reviewType = "standard", option
 	outer?.addEventListener("abort", () => controller.abort(), { once: true });
 	const unwatch = watchForStop(started.jobId, controller);
 	try {
-		return await drive(started.jobId, workspaceId, runners, started.claim.claim.holder, controller.signal);
+		return await drive(started.jobId, workspaceId, runners, started.claim.claim.holder, controller.signal, options.source);
 	} finally {
 		unwatch();
 		clearJobEnding(started.jobId);
@@ -16117,16 +16339,18 @@ function runOfJob(workspace, jobId) {
 	if (!run) throw new Error("This KISS job has no run to write its answer to.");
 	return run;
 }
-async function drive(jobId, workspaceId, runners, driver, signal) {
+async function drive(jobId, workspaceId, runners, driver, signal, source) {
 	let job = loadJob(jobId);
 	if (!job) throw new Error("No such job.");
 	const now = runners.now ?? Date.now;
 	const startedAt = now();
-	const from = resumeFrom(job);
-	job = {
-		...job,
-		startedAt
-	};
+	const from = checkoutGone$1(job) ? "preparing" : resumeFrom(job);
+	job = beginAttempt(job, {
+		startedAt,
+		phase: from,
+		...source ? { source } : {}
+	});
+	saveJob(job);
 	try {
 		signal?.throwIfAborted();
 		if (needs(from, "preparing")) {
@@ -16356,6 +16580,18 @@ function explain(job, detail) {
 	}
 }
 /** True when this phase is at or after the point the job resumes from. */
+/**
+* The record says work was done in a checkout that is no longer there.
+*
+* The sweep removes a finished job's checkout after six hours and keeps its record for seven days,
+* so a Retry of an older failure finds `preparing` complete and nothing on disk. Starting from
+* `preparing` makes the checkout again at the job's commit, and everything after it with it, because
+* every later phase reads files from it.
+*/
+function checkoutGone$1(job) {
+	if (!job.completed.includes("preparing")) return false;
+	return !job.worktreePath || !existsSync(join(job.worktreePath, ".prreviewbuddy-worktree.json"));
+}
 function needs(from, phase) {
 	return WORK_PHASES.indexOf(phase) >= WORK_PHASES.indexOf(from);
 }
@@ -16642,7 +16878,7 @@ function failureOf(workspaceId) {
 * "whatever the default is", so a configured default of Codex announced Codex and then analysed
 * with Claude, and nothing said so until the failure named the wrong tool.
 */
-async function prepareReview(target, agentId, fresh, requestedModel) {
+async function prepareReview(target, agentId, fresh, requestedModel, source) {
 	if (!fresh) {
 		const existing = await findExistingReview(target);
 		if (existing) {
@@ -16662,7 +16898,8 @@ async function prepareReview(target, agentId, fresh, requestedModel) {
 		workspaceId: await startJob({
 			target,
 			agentId,
-			...requestedModel ? { requestedModel } : {}
+			...requestedModel ? { requestedModel } : {},
+			...source ? { source } : {}
 		})
 	};
 }
@@ -16679,10 +16916,13 @@ async function prepareReview(target, agentId, fresh, requestedModel) {
 * that reads as a clean bill of health, which is the opposite of what happened. A KISS run's
 * answer is checked by `drive`, which knows which run it is.
 */
-async function settleReview(workspaceId, reviewType = "standard", signal) {
+async function settleReview(workspaceId, reviewType = "standard", signal, source) {
 	let job;
 	try {
-		job = await runJob(workspaceId, {}, reviewType, signal ? { signal } : {});
+		job = await runJob(workspaceId, {}, reviewType, {
+			...signal ? { signal } : {},
+			...source ? { source } : {}
+		});
 	} catch (error) {
 		return {
 			ok: false,
@@ -17645,6 +17885,7 @@ async function recordKissRun(input) {
 			purpose: "review",
 			reviewType: "kiss",
 			audience: input.audience,
+			...input.source ? { source: input.source } : {},
 			...requestedModel ? { requestedModel } : {}
 		});
 		saveJob(job);
@@ -18608,6 +18849,7 @@ async function updateReview(workspace, runners = {}) {
 	if (workspace.changeSet.targetType === "commit") return refuse(reviewedSha, false, COMMIT_REVIEW_CANNOT_UPDATE);
 	const held = await claimCheckoutJob(workspace, reviewedSha ?? "", {
 		purpose: "update",
+		...runners.source ? { source: runners.source } : {},
 		...workspace.prContext ? { conversation: {
 			kind: "attached",
 			context: workspace.prContext
@@ -19298,7 +19540,7 @@ async function runUpdate(workspaceId, prompt, cwd, originRepoPath, env, onProgre
 * nothing is running has answered the same question better, and passes 0.
 */
 async function discardJob(job, options = {}) {
-	if (job.worktreePath) {
+	if (job.worktreePath && !checkoutGone(job.worktreePath)) {
 		const outcome = await removeWorktree({
 			originRepoPath: job.target.originRepoPath,
 			worktreePath: job.worktreePath,
@@ -19313,6 +19555,18 @@ async function discardJob(job, options = {}) {
 	clearClaim(job.id);
 	return { removed: true };
 }
+/**
+* Only when the filesystem says there is nothing there. Any other failure to look, a permission
+* error say, is not proof of absence, and the record is the only thing that names the directory.
+*/
+function checkoutGone(path) {
+	try {
+		lstatSync(path);
+		return false;
+	} catch (error) {
+		return error.code === "ENOENT";
+	}
+}
 //#endregion
 //#region ../../packages/review-harness/src/workspace/delete_review.ts
 /**
@@ -19396,13 +19650,33 @@ async function deleteReview(id) {
 *
 * The record is unlinked **whether or not** a checkout was refused, and that is deliberate. The
 * review is what was asked for; a directory the guard declined keeps its job record, so the sweep
-* comes back to it in six hours with the origin repository still recorded, and the refusal is
+* comes back to it once the checkout is past retention, with the origin repository still recorded, and the refusal is
 * reported so nobody has to discover it later.
 */
 async function deleteLocked(id) {
 	const report = emptyReport();
 	if (!loadWorkspace(id)) return report;
 	for (const job of allJobs().filter((job) => job.workspaceId === id)) {
+		if (isTerminal(job) && purposeOf(job) !== "ask") {
+			if (job.worktreePath && existsSync(job.worktreePath)) {
+				const outcome = await removeWorktree({
+					originRepoPath: job.target.originRepoPath,
+					worktreePath: job.worktreePath,
+					minAgeMs: 0
+				});
+				if (!outcome.removed) {
+					report.refusals.push(outcome.message);
+					saveJob({
+						...strippedForDeletedReview(job),
+						worktreePath: job.worktreePath
+					});
+					continue;
+				}
+				report.worktreesRemoved += 1;
+			}
+			saveJob(strippedForDeletedReview(job));
+			continue;
+		}
 		const outcome = await discardJob(job, { minAgeMs: 0 });
 		if (outcome.refusal) {
 			report.refusals.push(outcome.refusal);
@@ -19461,4 +19735,4 @@ function lineageIds(id) {
 	return [.../* @__PURE__ */ new Set([id, ...lineage.map((review) => review.id)])];
 }
 //#endregion
-export { resolveWorkspacePort as $, saveJob as $n, explanationActionOf as $r, pruneNotifications as $t, parsePullRequestLink as A, git as Ai, ReviewBeingDeletedError as An, activityAttributes as Ar, repositoryKey as At, ensureServer as B, agentById as Bi, findExistingReview as Bn, queueAddMany as Br, announceJob as Bt, completeRun as C, originRemote as Ci, GITHUB_MARKDOWN as Cn, reviewedCommit as Cr, RUNTIME_WORDS as Ct, relativeTime as D, AmbiguousRefError as Di, escapeHtml as Dn, workspaceRevision as Dr, loadArchitecture as Dt, stopRun as E, resolveBase as Ei, CODE_COPY_CLASS as En, touchWorkspace as Er, checkArchitecture as Et, queueForReview as F, readAgentPreference as Fi, readMarker as Fn, lifecyclePill as Fr, QUOTE_LIMITS as Ft, stopChild as G, fetchHead as Gn, isIssueOutstanding as Gr, createPrState as Gt, reviewsUrl as H, detectAgents as Hi, checkReview as Hn, queueStamp as Hr, subjectOf as Ht, settleQueue as I, writeAgentPreference as Ii, removeWorktree as In, offersLifecycle as Ir, REPOSITORY_SCOPE as It, writeServerRecord as J, allJobs as Jn, questionsOutstanding as Jr, listNotifications as Jt, stopServer as K, forgeResolver as Kn, isQuestionOutstanding as Kr, createPrUpdate as Kt, readIndexToken as L, CONFIG_PATH as Li, requestJobStop as Ln, parseLifecycle as Lr, ancestorsOf as Lt, runBatch as M, resolveAgent as Mi, createWorktree as Mn, isLifecycle as Mr, storedScopes as Mt, activateQueued as N, resolveModel as Ni, holdWorktree as Nn, lifecycleChip as Nr, trackedFiles as Nt, batchIdentity as O, shortNameOf as Oi, renderInlineText as On, workspaceStamps as Or, partFiles as Ot, compactQueue as P, clearAgentPreference as Pi, isWorktreeHeld as Pn, lifecycleItemLabel as Pr, ownersOf as Pt, parseWorkspacePort as Q, loadJob as Qn, recommendationsOf as Qr, moveIds as Qt, bootstrapUrl as R, STORE_ROOT as Ri, describeMovement as Rn, sectionOf as Rr, isArchitectureId as Rt, beginRun as S, resolveTarget as Si, hasAuthorContent as Sn, recentWorkspaces as Sr, recordRuntimeBestEffort as St, reportRun as T, isCommitReview as Ti, CODE_BLOCK_CLASS as Tn, summarise as Tr, ARCHITECTURE_DIR as Tt, serverEntryExists as U, AgentCancelledError as Ui, followedBranch as Un, readQueue as Ur, categoryOf as Ut, readServerRecord as V, agentFor as Vi, checkCodeFreshness as Vn, queueRemove as Vr, branchOf as Vt, spawnServer as W, AgentUnavailableError as Wi, reviewedShaOf as Wn, doneVerb as Wr, createArchitectureNotification as Wt, MAX_WORKSPACE_PORT as X, fail as Xn, reviewerDispositions as Xr, markRead as Xt, DEFAULT_WORKSPACE_PORT as Y, endedAt as Yn, resolvedByConversation as Yr, markAllRead as Yt, MIN_WORKSPACE_PORT as Z, isTerminal as Zn, processDiscussion as Zr, markReadForReview as Zt, recordKissRun as _, extractJsonText as _i, agentEnvOf as _n, matchingWorkspaceIds as _r, BUILD_VERSION as _t, wasBlocked as a, assessmentLookup as ai, unreadAround as an, clearClaim as ar, settleReview as at, track as b, WITHHELD_REASON as bi, UNESTABLISHED_MOTIVATION as bn, presentedKissRunOf as br, waitingHistory as bt, RefreshUnavailableError as c, findingIn as ci, existingPaths as cn, followedRefName as cr, startJob as ct, mergeUpdateInto as d, promptGrade as di, prepareConversationWithin as dn, indexReviewGroups as dr, record as dt, explanationOf as ei, readNotification as en, PHASES as er, statedWorkspacePort as et, updateReview as f, reassessIn as fi, saveRefresh as fn, kissDecisionRefusal as fr, stamp as ft, runningJobs as g, asString$1 as gi, isUnchanged as gn, loadWorkspace as gr, telemetryUploadEnabled as gt, liveUpdateFor as h, followUpFindingId as hi, refreshPrContext as hn, lineagePosition as hr, telemetryUploadConsent as ht, liveJobsFor as i, analysisRefOf as ii, toneOf as in, purposeOf as ir, prepareReview as it, unsupportedReason as j, refExists as ji, MANAGED_ROOT as jn, activityLabel as jr, storeArchitecture as jt, extractPullRequestLinks as k, shorthandOf as ki, modelHelpLines as kn, LIFECYCLES as kr, readArchitecture as kt, cancelUpdate as l, gradeScale as li, ASK_REREAD_CEILING_MS as ln, groupByLineage as lr, append as lt, UpdateAlreadyRunningError as m, wasReassessed as mi, unforeseenFailure as mn, latestKissRun as mr, recordTelemetryUploadConsent as mt, deleteReview as n, withExplanation as ni, removeNotification as nn, phasesFor as nr, failureOf as nt, discardJob as o, currentGradeIn as oi, unreadCount as on, isClaimed as or, reanalyseReview as ot, askCheckout as p, sourcePhrase as pi, storedConversation as pn, kissDecisionsOf as pr, deliver as pt, workspaceUrl as q, fillFileUrlTemplate as qn, issuesOutstanding as qr, eventName as qt, lineageIds as r, ANALYSIS_ONLY as ri, retireNotification as rn, progressSteps as rr, observeReview as rt, FETCH_TIMEOUT_MS as s, findingAssessment as si, withUsageRecorded as sn, decideKissRecommendation as sr, runJob as st, deleteLineage as t, isExplanationAction as ti, readStateOf as tn, isLiveJob as tr, writePortPreference as tt, cancellableHere as u, isGradeFor as ui, adoptLegacyBaseline as un, indexKeptIds as ur, readEvents as ut, startKissJob as v, objectWithAnyOf as vi, EXPLAIN_SIMPLY_PROMPT as vn, mutateWorkspace as vr, PACKAGE_NAME as vt, endRun as w, DetachedHeadError as wi, renderMarkdown as wn, reviewedRepositories as wr, describeRuntimes as wt, RUN_KINDS as x, kissOutcome as xi, authorPreview as xn, previousKissResult as xr, mapRuntimes as xt, isDriving as y, describeAuthorship as yi, chatConversationSection as yn, positionInLineage as yr, feedbackUrl as yt, clearServerRecordOwnedBy as z, AGENT_IDS as zi, describeSubject as zn, queueAdd as zr, writeJsonAtomically as zt };
+export { resolveWorkspacePort as $, AgentUnavailableError as $i, attemptIdOf as $n, isIssueOutstanding as $r, moveIds as $t, parsePullRequestLink as A, resolveTarget as Ai, modelHelpLines as An, recentWorkspaces as Ar, readArchitecture as At, ensureServer as B, resolveAgent as Bi, requestJobStop as Bn, isLifecycle as Br, writeJsonAtomically as Bt, completeRun as C, followUpFindingId as Ci, hasAuthorContent as Cn, lineagePosition as Cr, RUNTIME_WORDS as Ct, relativeTime as D, describeAuthorship as Di, CODE_COPY_CLASS as Dn, positionInLineage as Dr, checkArchitecture as Dt, stopRun as E, objectWithAnyOf as Ei, CODE_BLOCK_CLASS as En, mutateWorkspace as Er, ARCHITECTURE_DIR as Et, queueForReview as F, AmbiguousRefError as Fi, createWorktree as Fn, workspaceRevision as Fr, ownersOf as Ft, stopChild as G, CONFIG_PATH as Gi, checkReview as Gn, parseLifecycle as Gr, createArchitectureNotification as Gt, reviewsUrl as H, clearAgentPreference as Hi, describeSubject as Hn, lifecycleItemLabel as Hr, branchOf as Ht, settleQueue as I, shortNameOf as Ii, holdWorktree as In, workspaceStamps as Ir, QUOTE_LIMITS as It, writeServerRecord as J, agentById as Ji, fetchHead as Jn, queueAddMany as Jr, eventName as Jt, stopServer as K, STORE_ROOT as Ki, followedBranch as Kn, sectionOf as Kr, createPrState as Kt, readIndexToken as L, shorthandOf as Li, isWorktreeHeld as Ln, LIFECYCLES as Lr, REPOSITORY_SCOPE as Lt, runBatch as M, DetachedHeadError as Mi, isBusy as Mn, reviewedRepositories as Mr, storeArchitecture as Mt, activateQueued as N, isCommitReview as Ni, withReviewLock as Nn, summarise as Nr, storedScopes as Nt, batchIdentity as O, WITHHELD_REASON as Oi, escapeHtml as On, presentedKissRunOf as Or, loadArchitecture as Ot, compactQueue as P, resolveBase as Pi, MANAGED_ROOT as Pn, touchWorkspace as Pr, trackedFiles as Pt, parseWorkspacePort as Q, AgentCancelledError as Qi, allJobs as Qn, doneVerb as Qr, markReadForReview as Qt, bootstrapUrl as R, git as Ri, readMarker as Rn, activityAttributes as Rr, ancestorsOf as Rt, beginRun as S, wasReassessed as Si, authorPreview as Sn, latestKissRun as Sr, recordRuntimeBestEffort as St, reportRun as T, extractJsonText as Ti, renderMarkdown as Tn, matchingWorkspaceIds as Tr, formatDuration as Tt, serverEntryExists as U, readAgentPreference as Ui, findExistingReview as Un, lifecyclePill as Ur, subjectOf as Ut, readServerRecord as V, resolveModel as Vi, describeMovement as Vn, lifecycleChip as Vr, announceJob as Vt, spawnServer as W, writeAgentPreference as Wi, checkCodeFreshness as Wn, offersLifecycle as Wr, categoryOf as Wt, MAX_WORKSPACE_PORT as X, detectAgents as Xi, fillFileUrlTemplate as Xn, queueStamp as Xr, markAllRead as Xt, DEFAULT_WORKSPACE_PORT as Y, agentFor as Yi, forgeResolver as Yn, queueRemove as Yr, listNotifications as Yt, MIN_WORKSPACE_PORT as Z, isAgentId as Zi, RUN_RECORD_RETENTION_MS as Zn, readQueue as Zr, markRead as Zt, recordKissRun as _, gradeScale as _i, isUnchanged as _n, groupByLineage as _r, BUILD_VERSION as _t, wasBlocked as a, processDiscussion as ai, toneOf as an, saveJob as ar, settleReview as at, track as b, reassessIn as bi, chatConversationSection as bn, kissDecisionRefusal as br, waitingHistory as bt, RefreshUnavailableError as c, explanationOf as ci, withUsageRecorded as cn, isTerminalJobPhase as cr, startJob as ct, mergeUpdateInto as d, ANALYSIS_ONLY as di, adoptLegacyBaseline as dn, purposeOf as dr, record as dt, isQuestionOutstanding as ei, pruneNotifications as en, endedAt as er, statedWorkspacePort as et, updateReview as f, analysisRefOf as fi, prepareConversationWithin as fn, clearClaim as fr, stamp as ft, runningJobs as g, findingIn as gi, refreshPrContext as gn, followedRefName as gr, telemetryUploadEnabled as gt, liveUpdateFor as h, findingAssessment as hi, unforeseenFailure as hn, decideKissRecommendation as hr, telemetryUploadConsent as ht, liveJobsFor as i, reviewerDispositions as ii, retireNotification as in, pruneJobResidue as ir, prepareReview as it, unsupportedReason as j, originRemote as ji, ReviewBeingDeletedError as jn, reviewedCommit as jr, repositoryKey as jt, extractPullRequestLinks as k, kissOutcome as ki, renderInlineText as kn, previousKissResult as kr, partFiles as kt, cancelUpdate as l, isExplanationAction as li, existingPaths as ln, phasesFor as lr, append as lt, UpdateAlreadyRunningError as m, currentGradeIn as mi, storedConversation as mn, CLAIM_LEASE_MS as mr, recordTelemetryUploadConsent as mt, deleteReview as n, questionsOutstanding as ni, readStateOf as nn, isTerminal as nr, failureOf as nt, discardJob as o, recommendationsOf as oi, unreadAround as on, PHASES as or, reanalyseReview as ot, askCheckout as p, assessmentLookup as pi, saveRefresh as pn, isClaimed as pr, deliver as pt, workspaceUrl as q, AGENT_IDS as qi, reviewedShaOf as qn, queueAdd as qr, createPrUpdate as qt, lineageIds as r, resolvedByConversation as ri, removeNotification as rn, loadJob as rr, observeReview as rt, FETCH_TIMEOUT_MS as s, explanationActionOf as si, unreadCount as sn, isLiveJob as sr, runJob as st, deleteLineage as t, issuesOutstanding as ti, readNotification as tn, fail as tr, writePortPreference as tt, cancellableHere as u, withExplanation as ui, ASK_REREAD_CEILING_MS as un, progressSteps as ur, readEvents as ut, startKissJob as v, isGradeFor as vi, agentEnvOf as vn, indexKeptIds as vr, PACKAGE_NAME as vt, endRun as w, asString$1 as wi, GITHUB_MARKDOWN as wn, loadWorkspace as wr, describeRuntimes as wt, RUN_KINDS as x, sourcePhrase as xi, UNESTABLISHED_MOTIVATION as xn, kissDecisionsOf as xr, mapRuntimes as xt, isDriving as y, promptGrade as yi, EXPLAIN_SIMPLY_PROMPT as yn, indexReviewGroups as yr, feedbackUrl as yt, clearServerRecordOwnedBy as z, refExists as zi, removeWorktree as zn, activityLabel as zr, isArchitectureId as zt };