prreviewbuddy 0.79.0 → 0.80.3

package/dist/{delete_review-DwF1NMJ4.js → delete_review-CYiIfV5A.js}

@@ -1,6 +1,6 @@
 import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { execFile, execFileSync, spawn } from "node:child_process";
-import { accessSync, appendFileSync, closeSync, constants, existsSync, linkSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
+import { accessSync, appendFileSync, closeSync, constants, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { homedir, hostname, tmpdir } from "node:os";
 import { promisify } from "node:util";
@@ -3910,7 +3910,7 @@ function* jsonCandidates(text) {
 	for (const match of text.matchAll(/```(?:json)?\s*([\s\S]*?)```/gi)) {
 		const inner = match[1].trim();
 		if (!inner.startsWith("{") && !inner.startsWith("[")) continue;
-		const value = parsed(inner);
+		const value = parsed$1(inner);
 		if (value.ok) yield {
 			text: inner,
 			value: value.value
@@ -3922,7 +3922,7 @@ function* jsonCandidates(text) {
 		const end = closingIndex(text, start, opener);
 		if (end === -1) continue;
 		const candidate = text.slice(start, end + 1);
-		const value = parsed(candidate);
+		const value = parsed$1(candidate);
 		if (!value.ok) continue;
 		yield {
 			text: candidate,
@@ -3931,7 +3931,7 @@ function* jsonCandidates(text) {
 		start = end;
 	}
 }
-function parsed(candidate) {
+function parsed$1(candidate) {
 	try {
 		return {
 			ok: true,
@@ -6217,6 +6217,11 @@ function summarise(workspace) {
 		questions: questions.length,
 		unansweredQuestions: questionsOutstanding(questions, answered).open,
 		messages: workspace.transcript.length,
+		...workspace.jobId && result ? { analysisJobId: workspace.jobId } : {},
+		...(() => {
+			const kiss = presentedKissRunOf(workspace);
+			return kiss ? { presentedKissJobId: kiss.jobId } : {};
+		})(),
 		lastViewedAt: workspace.lastViewedAt,
 		completedAt: workspace.completedAt,
 		pinned: workspace.pinned === true,
@@ -6477,6 +6482,17 @@ function workspaceIdFrom(entry) {
 * the other's file by accident.
 */
 var CLAIMS_DIR = join(STORE_ROOT, "claims");
+/**
+* How long a claim stands without being renewed.
+*
+* Deliberately short, and it can be short because renewal is on a timer rather than tied to the
+* work. The job record's own `updatedAt` moves only when a phase changes or the agent streams a
+* line, which is why the sweep has to allow it thirty minutes of silence; a heartbeat keeps ticking
+* through a twenty minute analysis that says nothing at all. Three minutes leaves room for several
+* missed renewals on an event loop busy parsing a large diff, and still frees a crashed holder long
+* before anyone would think to ask why Retry does nothing.
+*/
+var CLAIM_LEASE_MS = 18e4;
 /** Comfortably inside the lease, so one slow tick is never enough to lose a claim that is held. */
 var CLAIM_RENEW_MS = 3e4;
 function claimPath(key) {
@@ -6882,6 +6898,128 @@ var JOBS_DIR = join(STORE_ROOT, "jobs");
 function reusesImportedConversation(job) {
 	return job.reviewType === "kiss";
 }
+/**
+* What survives of a finished run when the reviewer deletes its review.
+*
+* Runs is a history of executions, not of reviews, so "the review you deleted was analysed twice
+* yesterday and the first attempt failed" stays true after the deletion. What the reviewer deleted
+* must not: everything a run produced or was given goes, and so does every sentence that might
+* quote it. Kept are identity and times, the outcome as a kind rather than a message, which client
+* asked and which agent ran, and the change's own name (repository, branch, pull request), which
+* is what makes the entry recognisable at all.
+*
+* An allow-list, built field by field, so a field added to the job later is dropped here until
+* somebody decides it should not be.
+*/
+function strippedForDeletedReview(job) {
+	const request = job.target.pullRequest;
+	const attemptFailure = (failure) => failure ? { failure: {
+		message: "",
+		...failure.kind ? { kind: failure.kind } : {},
+		...failure.stopped ? { stopped: true } : {}
+	} } : {};
+	return {
+		id: job.id,
+		workspaceId: job.workspaceId,
+		target: {
+			originRepoPath: job.target.originRepoPath,
+			branch: job.target.branch,
+			sha: job.target.sha,
+			...request ? { pullRequest: {
+				reference: request.url ?? "",
+				headRef: request.headRef,
+				headSha: request.headSha,
+				...request.number !== void 0 ? { number: request.number } : {},
+				...request.url ? { url: request.url } : {},
+				...request.source ? { source: request.source } : {}
+			} } : {}
+		},
+		...job.purpose ? { purpose: job.purpose } : {},
+		...job.reanalysis ? { reanalysis: true } : {},
+		...job.reviewType ? { reviewType: job.reviewType } : {},
+		phase: job.phase,
+		startedAt: job.startedAt,
+		updatedAt: job.updatedAt,
+		...job.finishedAt !== void 0 ? { finishedAt: job.finishedAt } : {},
+		completed: [],
+		...job.failure ? { failure: {
+			phase: job.failure.phase,
+			message: "",
+			...job.failure.kind ? { kind: job.failure.kind } : {},
+			...job.failure.stopped ? { stopped: true } : {}
+		} } : {},
+		env: job.env.agentId ? { agentId: job.env.agentId } : {},
+		attemptId: attemptIdOf(job),
+		...job.source ? { source: job.source } : {},
+		...job.previousAttempts ? { previousAttempts: job.previousAttempts.map((attempt) => ({
+			attemptId: attempt.attemptId,
+			startedAt: attempt.startedAt,
+			finishedAt: attempt.finishedAt,
+			phase: attempt.phase,
+			...attemptFailure(attempt.failure),
+			...attempt.source ? { source: attempt.source } : {},
+			...attempt.agentId ? { agentId: attempt.agentId } : {}
+		})) } : {},
+		...job.removedFromRuns ? { removedFromRuns: job.removedFromRuns } : {},
+		reviewDeleted: true
+	};
+}
+/**
+* How long a finished run is listed, and kept: measured from when it ended, per attempt.
+*
+* A strict limit on what the page shows, not only on what the sweep deletes. The sweep runs inside
+* the workspace server, so while the server is stopped nothing is deleted, and a record can outlive
+* its week on disk until the next start; the page never shows it past the week regardless.
+*/
+var RUN_RECORD_RETENTION_MS = 6048e5;
+/** The current attempt's id. See `ReviewJob.attemptId`. */
+function attemptIdOf(job) {
+	return job.attemptId ?? job.id;
+}
+/**
+* The record a driver should save as it picks this job up, before it does any work.
+*
+* A job that had ended is starting a new attempt: the ended one is archived, a new attempt id is
+* minted and the record leaves its terminal phase, all in the one value returned, so the caller
+* makes a single write. That is what makes the archive happen exactly once. A crash after the write
+* leaves a working job nobody drives, which the sweep in time records as stopped, and never a
+* terminal one that the next pickup would archive a second time; the id check covers a record that
+* was archived and then, somehow, written back terminal.
+*
+* A job that had not ended is the same attempt resuming (a restarted daemon, a driver whose claim
+* lapsed): only `startedAt` moves, because the page times "Running for" from it.
+*/
+function beginAttempt(job, next) {
+	if (!isTerminal(job)) return {
+		...job,
+		startedAt: next.startedAt
+	};
+	const ended = attemptIdOf(job);
+	const earlier = job.previousAttempts ?? [];
+	const current = earlier.filter((attempt) => next.startedAt - attempt.finishedAt < RUN_RECORD_RETENTION_MS);
+	const archived = earlier.some((attempt) => attempt.attemptId === ended) ? current : [...current, {
+		attemptId: ended,
+		startedAt: job.startedAt,
+		finishedAt: endedAt(job),
+		phase: job.phase,
+		...job.failure ? { failure: {
+			message: job.failure.message,
+			...job.failure.kind ? { kind: job.failure.kind } : {},
+			...job.failure.stopped ? { stopped: true } : {}
+		} } : {},
+		...job.source ? { source: job.source } : {},
+		...job.env.agentId ? { agentId: job.env.agentId } : {}
+	}];
+	const { failure: _failure, finishedAt: _finishedAt, progress: _progress, ...rest } = job;
+	return {
+		...rest,
+		phase: next.phase,
+		startedAt: next.startedAt,
+		attemptId: randomUUID(),
+		previousAttempts: archived,
+		...next.source ? { source: next.source } : {}
+	};
+}
 function jobPath(id) {
 	return join(JOBS_DIR, `${id}.json`);
 }
@@ -6889,6 +7027,7 @@ function createJob(input) {
 	const now = Date.now();
 	return {
 		id: randomUUID(),
+		attemptId: randomUUID(),
 		phase: "preparing",
 		startedAt: now,
 		updatedAt: now,
@@ -6896,9 +7035,30 @@ function createJob(input) {
 		...input
 	};
 }
+/**
+* Replace the record whole, so a reader sees the old one or the new one and never a prefix.
+*
+* `writeFileSync` truncates on open, and a crash between that and the end of the write left a record
+* that does not parse, which `loadJob` reads as no job at all: the review's analysis, its attempts
+* and its checkout's only pointer gone at once. Renamed into place instead, from a name unique to
+* this write, because more than one process writes job records. Serialised first, so a throw in
+* `JSON.stringify` cannot leave anything behind. Unlike `writeJsonAtomically`, a failure throws:
+* every caller of this already handles a write that fails.
+*/
 function saveJob(job) {
+	const document = JSON.stringify(job);
 	mkdirSync(JOBS_DIR, { recursive: true });
-	writeFileSync(jobPath(job.id), JSON.stringify(job), { mode: 384 });
+	const path = jobPath(job.id);
+	const temp = `${path}.${process.pid}.${randomUUID()}.tmp`;
+	try {
+		writeFileSync(temp, document, { mode: 384 });
+		renameSync(temp, path);
+	} catch (error) {
+		try {
+			unlinkSync(temp);
+		} catch {}
+		throw error;
+	}
 }
 function loadJob(id) {
 	try {
@@ -6925,21 +7085,81 @@ function migrate(job) {
 		}
 	};
 }
+/**
+* Every record parsed so far, by file, with the identity of the file it was parsed from.
+*
+* Since the Runs page, the directory holds a week of records rather than six hours of them, and the
+* Reviews and Runs pages each read all of it on every poll. Read and parsed whole, 500 records cost
+* about 100 ms a time, synchronously, inside the server; asking the filesystem whether each file is
+* still the one already parsed costs about 1 ms. `saveJob` renames a fresh file into place, so a
+* record that was written in any way has a new inode, and inode, mtime and size together are a
+* change no write can slip past.
+*
+* Frozen, because every caller now shares one copy: a caller that edited a record in place would
+* be editing it for everyone, and strict mode turns that into an error where it happens.
+*/
+var parsed = /* @__PURE__ */ new Map();
 function allJobs() {
 	let names;
 	try {
 		names = readdirSync(JOBS_DIR);
 	} catch {
+		parsed.clear();
 		return [];
 	}
 	const jobs = [];
+	const present = /* @__PURE__ */ new Set();
 	for (const name of names) {
 		if (!name.endsWith(".json")) continue;
+		present.add(name);
+		let identity;
+		try {
+			const stat = statSync(join(JOBS_DIR, name));
+			identity = `${stat.ino}:${stat.mtimeMs}:${stat.size}`;
+		} catch {
+			continue;
+		}
+		const cached = parsed.get(name);
+		if (cached?.identity === identity) {
+			jobs.push(cached.job);
+			continue;
+		}
 		const job = loadJob(name.slice(0, -5));
-		if (job) jobs.push(job);
+		if (!job) {
+			parsed.delete(name);
+			continue;
+		}
+		Object.freeze(job);
+		parsed.set(name, {
+			identity,
+			job
+		});
+		jobs.push(job);
 	}
+	for (const name of parsed.keys()) if (!present.has(name)) parsed.delete(name);
 	return jobs;
 }
+/**
+* Temporary files a `saveJob` left behind when its process died between the write and the rename.
+*
+* Invisible to every reader, which lists `.json` only, so they cost nothing but disk. A write lasts
+* milliseconds, so one older than `olderThanMs` is residue rather than a write in flight.
+*/
+function pruneJobResidue(now, olderThanMs) {
+	let names;
+	try {
+		names = readdirSync(JOBS_DIR);
+	} catch {
+		return;
+	}
+	for (const name of names) {
+		if (!name.endsWith(".tmp")) continue;
+		const path = join(JOBS_DIR, name);
+		try {
+			if (now - statSync(path).mtimeMs >= olderThanMs) unlinkSync(path);
+		} catch {}
+	}
+}
 function deleteJob(id) {
 	try {
 		unlinkSync(jobPath(id));
@@ -15315,7 +15535,17 @@ function aboutMinutes(ms) {
 }
 //#endregion
 //#region ../../packages/review-harness/src/runtime/store.ts
-var VERSION = 1;
+var VERSION = 2;
+/**
+* Version 1 is the same shape with one field that cannot be trusted. Every update row it holds
+* names the default agent, Claude, whichever agent ran it: the update's job was stamped with the
+* daemon's default rather than the review's own, and the row was copied from the job. So that
+* field is a constant on every such row, and reading it as a fact would credit Codex's updates to
+* Claude for as long as the rows are kept, which is indefinitely. It is dropped rather than
+* rewritten, because which agent did run is not recorded anywhere this file can see. The duration
+* was always right and stays, and so does every other operation's agent.
+*/
+var VERSION_WITH_UNKNOWN_UPDATE_AGENTS = 1;
 /** Kept in all, so a machine with years of reviews holds a bounded file. */
 var ROWS_KEPT = 1e3;
 var LOCK = "runtimes";
@@ -15367,12 +15597,19 @@ function keyOf$1(row) {
 function readRows() {
 	try {
 		const parsed = JSON.parse(readFileSync(runtimesPath(), "utf8"));
-		if (parsed?.version !== VERSION || !Array.isArray(parsed.runs)) return [];
-		return parsed.runs.filter(isRow);
+		if (!Array.isArray(parsed?.runs)) return [];
+		if (parsed.version === VERSION) return parsed.runs.filter(isRow);
+		if (parsed.version === VERSION_WITH_UNKNOWN_UPDATE_AGENTS) return parsed.runs.filter(isRow).map(withoutUpdateAgent);
+		return [];
 	} catch {
 		return [];
 	}
 }
+function withoutUpdateAgent(row) {
+	if (row.operation !== "update") return row;
+	const { agent: _unknown, ...rest } = row;
+	return rest;
+}
 function isRow(value) {
 	const row = value;
 	return typeof row?.operation === "string" && typeof row.repository === "string" && typeof row.subject === "string" && typeof row.durationMs === "number" && Number.isFinite(row.durationMs) && row.durationMs >= 0 && typeof row.completedAt === "number";
@@ -15938,6 +16175,7 @@ async function startJob(input) {
 			target,
 			env: agent.captureEnv(),
 			purpose: "review",
+			...input.source ? { source: input.source } : {},
 			...input.requestedModel ? { requestedModel: input.requestedModel } : {},
 			...review.type === "kiss" ? {
 				reviewType: "kiss",
@@ -15971,7 +16209,7 @@ async function startJob(input) {
 * The previous result is snapshotted before the session is replaced, so the review keeps saying who
 * made the analysis it is retiring as well as who made the one it now shows.
 */
-async function reanalyseReview(workspaceId, agentId, onStarted, requestedModel) {
+async function reanalyseReview(workspaceId, agentId, onStarted, requestedModel, source) {
 	const workspace = loadWorkspace(workspaceId);
 	if (!workspace) throw new Error("No such review.");
 	const sha = workspace.session.metadata?.commitSha;
@@ -16003,6 +16241,7 @@ async function reanalyseReview(workspaceId, agentId, onStarted, requestedModel)
 				env: agent.captureEnv(),
 				purpose: "review",
 				reanalysis: true,
+				...source ? { source } : {},
 				...model ? { requestedModel: model } : {}
 			});
 			saveJob(job);
@@ -16062,7 +16301,7 @@ async function runJob(workspaceId, runners = {}, reviewType = "standard", option
 	outer?.addEventListener("abort", () => controller.abort(), { once: true });
 	const unwatch = watchForStop(started.jobId, controller);
 	try {
-		return await drive(started.jobId, workspaceId, runners, started.claim.claim.holder, controller.signal);
+		return await drive(started.jobId, workspaceId, runners, started.claim.claim.holder, controller.signal, options.source);
 	} finally {
 		unwatch();
 		clearJobEnding(started.jobId);
@@ -16117,16 +16356,18 @@ function runOfJob(workspace, jobId) {
 	if (!run) throw new Error("This KISS job has no run to write its answer to.");
 	return run;
 }
-async function drive(jobId, workspaceId, runners, driver, signal) {
+async function drive(jobId, workspaceId, runners, driver, signal, source) {
 	let job = loadJob(jobId);
 	if (!job) throw new Error("No such job.");
 	const now = runners.now ?? Date.now;
 	const startedAt = now();
-	const from = resumeFrom(job);
-	job = {
-		...job,
-		startedAt
-	};
+	const from = checkoutGone$1(job) ? "preparing" : resumeFrom(job);
+	job = beginAttempt(job, {
+		startedAt,
+		phase: from,
+		...source ? { source } : {}
+	});
+	saveJob(job);
 	try {
 		signal?.throwIfAborted();
 		if (needs(from, "preparing")) {
@@ -16356,6 +16597,18 @@ function explain(job, detail) {
 	}
 }
 /** True when this phase is at or after the point the job resumes from. */
+/**
+* The record says work was done in a checkout that is no longer there.
+*
+* The sweep removes a finished job's checkout after six hours and keeps its record for seven days,
+* so a Retry of an older failure finds `preparing` complete and nothing on disk. Starting from
+* `preparing` makes the checkout again at the job's commit, and everything after it with it, because
+* every later phase reads files from it.
+*/
+function checkoutGone$1(job) {
+	if (!job.completed.includes("preparing")) return false;
+	return !job.worktreePath || !existsSync(join(job.worktreePath, ".prreviewbuddy-worktree.json"));
+}
 function needs(from, phase) {
 	return WORK_PHASES.indexOf(phase) >= WORK_PHASES.indexOf(from);
 }
@@ -16642,7 +16895,7 @@ function failureOf(workspaceId) {
 * "whatever the default is", so a configured default of Codex announced Codex and then analysed
 * with Claude, and nothing said so until the failure named the wrong tool.
 */
-async function prepareReview(target, agentId, fresh, requestedModel) {
+async function prepareReview(target, agentId, fresh, requestedModel, source) {
 	if (!fresh) {
 		const existing = await findExistingReview(target);
 		if (existing) {
@@ -16662,7 +16915,8 @@ async function prepareReview(target, agentId, fresh, requestedModel) {
 		workspaceId: await startJob({
 			target,
 			agentId,
-			...requestedModel ? { requestedModel } : {}
+			...requestedModel ? { requestedModel } : {},
+			...source ? { source } : {}
 		})
 	};
 }
@@ -16679,10 +16933,13 @@ async function prepareReview(target, agentId, fresh, requestedModel) {
 * that reads as a clean bill of health, which is the opposite of what happened. A KISS run's
 * answer is checked by `drive`, which knows which run it is.
 */
-async function settleReview(workspaceId, reviewType = "standard", signal) {
+async function settleReview(workspaceId, reviewType = "standard", signal, source) {
 	let job;
 	try {
-		job = await runJob(workspaceId, {}, reviewType, signal ? { signal } : {});
+		job = await runJob(workspaceId, {}, reviewType, {
+			...signal ? { signal } : {},
+			...source ? { source } : {}
+		});
 	} catch (error) {
 		return {
 			ok: false,
@@ -17645,6 +17902,7 @@ async function recordKissRun(input) {
 			purpose: "review",
 			reviewType: "kiss",
 			audience: input.audience,
+			...input.source ? { source: input.source } : {},
 			...requestedModel ? { requestedModel } : {}
 		});
 		saveJob(job);
@@ -18440,7 +18698,7 @@ async function claimCheckoutJob(workspace, sha, fields) {
 		const job = createJob({
 			workspaceId: workspace.id,
 			target,
-			env: captureEnv(),
+			env: agentEnvOf(workspace),
 			...fields
 		});
 		saveJob(job);
@@ -18608,6 +18866,7 @@ async function updateReview(workspace, runners = {}) {
 	if (workspace.changeSet.targetType === "commit") return refuse(reviewedSha, false, COMMIT_REVIEW_CANNOT_UPDATE);
 	const held = await claimCheckoutJob(workspace, reviewedSha ?? "", {
 		purpose: "update",
+		...runners.source ? { source: runners.source } : {},
 		...workspace.prContext ? { conversation: {
 			kind: "attached",
 			context: workspace.prContext
@@ -18673,7 +18932,7 @@ function cancelled(held, reviewedSha) {
 	};
 }
 async function bringForward(workspace, runners, reviewedSha, held, step, signal, clock) {
-	const remote = await remoteHead(workspace, signal, runners);
+	const remote = await remoteHead(workspace, held.job.env, signal, runners);
 	signal.throwIfAborted();
 	if (!remote.sha) return refuse(reviewedSha, remote.fetchFailed, remote.refusal ?? noRemoteHeadMessage(workspace));
 	adoptLegacyBaseline(workspace);
@@ -18696,9 +18955,10 @@ async function bringForward(workspace, runners, reviewedSha, held, step, signal,
 		return settled(reviewedSha, remote.sha, remote.fetchFailed, conversationOk, "analysis-failed", "A checkout of the latest commit could not be prepared, so nothing was reassessed.");
 	}
 	signal.throwIfAborted();
-	return reconcile(workspace, runners, reviewedSha, remote, conversationOk, worktreePath, step, held.job.id, signal, clock, prepared, discussionMoved);
+	return reconcile(workspace, runners, reviewedSha, remote, conversationOk, worktreePath, step, held.job, signal, clock, prepared, discussionMoved);
 }
-async function reconcile(workspace, runners, reviewedSha, remote, conversationOk, worktreePath, step, jobId, signal, clock, prepared, discussionMoved) {
+async function reconcile(workspace, runners, reviewedSha, remote, conversationOk, worktreePath, step, job, signal, clock, prepared, discussionMoved) {
+	const { id: jobId, env } = job;
 	const newHead = remote.sha;
 	let delta = null;
 	if (reviewedSha !== newHead) try {
@@ -18733,9 +18993,9 @@ async function reconcile(workspace, runners, reviewedSha, remote, conversationOk
 	let raw;
 	try {
 		const prompt = buildUpdatePrompt(workspace, delta, prepared, reviewedSha, newHead, worktreePath);
-		raw = runners.run ? await runners.run(prompt, worktreePath, agentEnvOf(workspace), onProgress, onObservedModel, signal) : await runUpdate(workspace.id, prompt, worktreePath, workspace.repoPath, agentEnvOf(workspace), onProgress, requestedModel, onObservedModel, signal);
+		raw = runners.run ? await runners.run(prompt, worktreePath, env, onProgress, onObservedModel, signal) : await runUpdate(workspace.id, prompt, worktreePath, workspace.repoPath, env, onProgress, requestedModel, onObservedModel, signal);
 	} catch (error) {
-		return settled(reviewedSha, newHead, remote.fetchFailed, conversationOk, "analysis-failed", explainUpdateFailure(error, agentEnvOf(workspace), requestedModel));
+		return settled(reviewedSha, newHead, remote.fetchFailed, conversationOk, "analysis-failed", explainUpdateFailure(error, env, requestedModel));
 	}
 	const parsed = parseReconciliationResult(raw, previous.issues.length, { priorQuestionCount: previous.questions.length });
 	if (!parsed) return settled(reviewedSha, newHead, remote.fetchFailed, conversationOk, "analysis-failed", "The reassessment came back in a form this could not read, so nothing was changed.");
@@ -18753,7 +19013,7 @@ async function reconcile(workspace, runners, reviewedSha, remote, conversationOk
 	const gradeChanges = await applyUpdate(workspace, result, previous, newHead, worktreePath, {
 		...requestedModel ? { requestedModel } : {},
 		...observedModel ? { observedModel } : {},
-		...await (runners.agentVersion ?? installedAgentVersion)(agentEnvOf(workspace))
+		...await (runners.agentVersion ?? installedAgentVersion)(env)
 	}, clock, remote.base, suggestions, conversationTakenIntoAccount(prepared, analysedBaselineOf(workspace)));
 	const counts = {
 		...countUpdateChanges(previous, result),
@@ -18787,9 +19047,9 @@ var BASELINE_GONE_MESSAGE = "The commit this review was made from is no longer i
 * is allowed to reach the network and that panel is not, so it looks at a newer copy of the same
 * refs.
 */
-async function remoteHead(workspace, signal, runners) {
+async function remoteHead(workspace, env, signal, runners) {
 	const source = await storedRequestSource(workspace);
-	if (source) return requestHead(workspace, source, signal, runners);
+	if (source) return requestHead(workspace, env, source, signal, runners);
 	const fetchFailed = !await fetchOrigin(workspace.repoPath, signal);
 	return {
 		sha: (await followedBranch(workspace))?.sha ?? null,
@@ -18814,8 +19074,8 @@ async function remoteHead(workspace, signal, runners) {
 *    rather than a guess. If even that fetch fails, the last head this repository saw is used and
 *    the update says the fetch failed, as it always has.
 */
-async function requestHead(workspace, source, signal, runners) {
-	const outcome = await (runners.headOf ?? ((cwd, asked) => fetchHeadFor(cwd, asked, agentEnvOf(workspace))))(workspace.repoPath, source);
+async function requestHead(workspace, env, source, signal, runners) {
+	const outcome = await (runners.headOf ?? ((cwd, asked) => fetchHeadFor(cwd, asked, env)))(workspace.repoPath, source);
 	signal.throwIfAborted();
 	const baseBranch = workspace.changeSet.baseRef || void 0;
 	if (outcome.kind === "head") {
@@ -19298,7 +19558,7 @@ async function runUpdate(workspaceId, prompt, cwd, originRepoPath, env, onProgre
 * nothing is running has answered the same question better, and passes 0.
 */
 async function discardJob(job, options = {}) {
-	if (job.worktreePath) {
+	if (job.worktreePath && !checkoutGone(job.worktreePath)) {
 		const outcome = await removeWorktree({
 			originRepoPath: job.target.originRepoPath,
 			worktreePath: job.worktreePath,
@@ -19313,6 +19573,18 @@ async function discardJob(job, options = {}) {
 	clearClaim(job.id);
 	return { removed: true };
 }
+/**
+* Only when the filesystem says there is nothing there. Any other failure to look, a permission
+* error say, is not proof of absence, and the record is the only thing that names the directory.
+*/
+function checkoutGone(path) {
+	try {
+		lstatSync(path);
+		return false;
+	} catch (error) {
+		return error.code === "ENOENT";
+	}
+}
 //#endregion
 //#region ../../packages/review-harness/src/workspace/delete_review.ts
 /**
@@ -19396,13 +19668,33 @@ async function deleteReview(id) {
 *
 * The record is unlinked **whether or not** a checkout was refused, and that is deliberate. The
 * review is what was asked for; a directory the guard declined keeps its job record, so the sweep
-* comes back to it in six hours with the origin repository still recorded, and the refusal is
+* comes back to it once the checkout is past retention, with the origin repository still recorded, and the refusal is
 * reported so nobody has to discover it later.
 */
 async function deleteLocked(id) {
 	const report = emptyReport();
 	if (!loadWorkspace(id)) return report;
 	for (const job of allJobs().filter((job) => job.workspaceId === id)) {
+		if (isTerminal(job) && purposeOf(job) !== "ask") {
+			if (job.worktreePath && existsSync(job.worktreePath)) {
+				const outcome = await removeWorktree({
+					originRepoPath: job.target.originRepoPath,
+					worktreePath: job.worktreePath,
+					minAgeMs: 0
+				});
+				if (!outcome.removed) {
+					report.refusals.push(outcome.message);
+					saveJob({
+						...strippedForDeletedReview(job),
+						worktreePath: job.worktreePath
+					});
+					continue;
+				}
+				report.worktreesRemoved += 1;
+			}
+			saveJob(strippedForDeletedReview(job));
+			continue;
+		}
 		const outcome = await discardJob(job, { minAgeMs: 0 });
 		if (outcome.refusal) {
 			report.refusals.push(outcome.refusal);
@@ -19461,4 +19753,4 @@ function lineageIds(id) {
 	return [.../* @__PURE__ */ new Set([id, ...lineage.map((review) => review.id)])];
 }
 //#endregion
-export { resolveWorkspacePort as $, saveJob as $n, recommendationsOf as $r, pruneNotifications as $t, parsePullRequestLink as A, shorthandOf as Ai, ReviewBeingDeletedError as An, LIFECYCLES as Ar, repositoryKey as At, ensureServer as B, AGENT_IDS as Bi, findExistingReview as Bn, queueAdd as Br, announceJob as Bt, completeRun as C, resolveTarget as Ci, GITHUB_MARKDOWN as Cn, recentWorkspaces as Cr, RUNTIME_WORDS as Ct, relativeTime as D, resolveBase as Di, escapeHtml as Dn, touchWorkspace as Dr, loadArchitecture as Dt, stopRun as E, isCommitReview as Ei, CODE_COPY_CLASS as En, summarise as Er, checkArchitecture as Et, queueForReview as F, clearAgentPreference as Fi, readMarker as Fn, lifecycleItemLabel as Fr, QUOTE_LIMITS as Ft, stopChild as G, AgentUnavailableError as Gi, fetchHead as Gn, doneVerb as Gr, createPrState as Gt, reviewsUrl as H, agentFor as Hi, checkReview as Hn, queueRemove as Hr, subjectOf as Ht, settleQueue as I, readAgentPreference as Ii, removeWorktree as In, lifecyclePill as Ir, REPOSITORY_SCOPE as It, writeServerRecord as J, allJobs as Jn, issuesOutstanding as Jr, listNotifications as Jt, stopServer as K, forgeResolver as Kn, isIssueOutstanding as Kr, createPrUpdate as Kt, readIndexToken as L, writeAgentPreference as Li, requestJobStop as Ln, offersLifecycle as Lr, ancestorsOf as Lt, runBatch as M, refExists as Mi, createWorktree as Mn, activityLabel as Mr, storedScopes as Mt, activateQueued as N, resolveAgent as Ni, holdWorktree as Nn, isLifecycle as Nr, trackedFiles as Nt, batchIdentity as O, AmbiguousRefError as Oi, renderInlineText as On, workspaceRevision as Or, partFiles as Ot, compactQueue as P, resolveModel as Pi, isWorktreeHeld as Pn, lifecycleChip as Pr, ownersOf as Pt, parseWorkspacePort as Q, loadJob as Qn, processDiscussion as Qr, moveIds as Qt, bootstrapUrl as R, CONFIG_PATH as Ri, describeMovement as Rn, parseLifecycle as Rr, isArchitectureId as Rt, beginRun as S, kissOutcome as Si, hasAuthorContent as Sn, previousKissResult as Sr, recordRuntimeBestEffort as St, reportRun as T, DetachedHeadError as Ti, CODE_BLOCK_CLASS as Tn, reviewedRepositories as Tr, ARCHITECTURE_DIR as Tt, serverEntryExists as U, detectAgents as Ui, followedBranch as Un, queueStamp as Ur, categoryOf as Ut, readServerRecord as V, agentById as Vi, checkCodeFreshness as Vn, queueAddMany as Vr, branchOf as Vt, spawnServer as W, AgentCancelledError as Wi, reviewedShaOf as Wn, readQueue as Wr, createArchitectureNotification as Wt, MAX_WORKSPACE_PORT as X, fail as Xn, resolvedByConversation as Xr, markRead as Xt, DEFAULT_WORKSPACE_PORT as Y, endedAt as Yn, questionsOutstanding as Yr, markAllRead as Yt, MIN_WORKSPACE_PORT as Z, isTerminal as Zn, reviewerDispositions as Zr, markReadForReview as Zt, recordKissRun as _, asString$1 as _i, agentEnvOf as _n, loadWorkspace as _r, BUILD_VERSION as _t, wasBlocked as a, analysisRefOf as ai, unreadAround as an, purposeOf as ar, settleReview as at, track as b, describeAuthorship as bi, UNESTABLISHED_MOTIVATION as bn, positionInLineage as br, waitingHistory as bt, RefreshUnavailableError as c, findingAssessment as ci, existingPaths as cn, decideKissRecommendation as cr, startJob as ct, mergeUpdateInto as d, isGradeFor as di, prepareConversationWithin as dn, indexKeptIds as dr, record as dt, explanationActionOf as ei, readNotification as en, PHASES as er, statedWorkspacePort as et, updateReview as f, promptGrade as fi, saveRefresh as fn, indexReviewGroups as fr, stamp as ft, runningJobs as g, followUpFindingId as gi, isUnchanged as gn, lineagePosition as gr, telemetryUploadEnabled as gt, liveUpdateFor as h, wasReassessed as hi, refreshPrContext as hn, latestKissRun as hr, telemetryUploadConsent as ht, liveJobsFor as i, ANALYSIS_ONLY as ii, toneOf as in, progressSteps as ir, prepareReview as it, unsupportedReason as j, git as ji, MANAGED_ROOT as jn, activityAttributes as jr, storeArchitecture as jt, extractPullRequestLinks as k, shortNameOf as ki, modelHelpLines as kn, workspaceStamps as kr, readArchitecture as kt, cancelUpdate as l, findingIn as li, ASK_REREAD_CEILING_MS as ln, followedRefName as lr, append as lt, UpdateAlreadyRunningError as m, sourcePhrase as mi, unforeseenFailure as mn, kissDecisionsOf as mr, recordTelemetryUploadConsent as mt, deleteReview as n, isExplanationAction as ni, removeNotification as nn, isTerminalJobPhase as nr, failureOf as nt, discardJob as o, assessmentLookup as oi, unreadCount as on, clearClaim as or, reanalyseReview as ot, askCheckout as p, reassessIn as pi, storedConversation as pn, kissDecisionRefusal as pr, deliver as pt, workspaceUrl as q, fillFileUrlTemplate as qn, isQuestionOutstanding as qr, eventName as qt, lineageIds as r, withExplanation as ri, retireNotification as rn, phasesFor as rr, observeReview as rt, FETCH_TIMEOUT_MS as s, currentGradeIn as si, withUsageRecorded as sn, isClaimed as sr, runJob as st, deleteLineage as t, explanationOf as ti, readStateOf as tn, isLiveJob as tr, writePortPreference as tt, cancellableHere as u, gradeScale as ui, adoptLegacyBaseline as un, groupByLineage as ur, readEvents as ut, startKissJob as v, extractJsonText as vi, EXPLAIN_SIMPLY_PROMPT as vn, matchingWorkspaceIds as vr, PACKAGE_NAME as vt, endRun as w, originRemote as wi, renderMarkdown as wn, reviewedCommit as wr, describeRuntimes as wt, RUN_KINDS as x, WITHHELD_REASON as xi, authorPreview as xn, presentedKissRunOf as xr, mapRuntimes as xt, isDriving as y, objectWithAnyOf as yi, chatConversationSection as yn, mutateWorkspace as yr, feedbackUrl as yt, clearServerRecordOwnedBy as z, STORE_ROOT as zi, describeSubject as zn, sectionOf as zr, writeJsonAtomically as zt };
+export { resolveWorkspacePort as $, AgentUnavailableError as $i, attemptIdOf as $n, isIssueOutstanding as $r, moveIds as $t, parsePullRequestLink as A, resolveTarget as Ai, modelHelpLines as An, recentWorkspaces as Ar, readArchitecture as At, ensureServer as B, resolveAgent as Bi, requestJobStop as Bn, isLifecycle as Br, writeJsonAtomically as Bt, completeRun as C, followUpFindingId as Ci, hasAuthorContent as Cn, lineagePosition as Cr, RUNTIME_WORDS as Ct, relativeTime as D, describeAuthorship as Di, CODE_COPY_CLASS as Dn, positionInLineage as Dr, checkArchitecture as Dt, stopRun as E, objectWithAnyOf as Ei, CODE_BLOCK_CLASS as En, mutateWorkspace as Er, ARCHITECTURE_DIR as Et, queueForReview as F, AmbiguousRefError as Fi, createWorktree as Fn, workspaceRevision as Fr, ownersOf as Ft, stopChild as G, CONFIG_PATH as Gi, checkReview as Gn, parseLifecycle as Gr, createArchitectureNotification as Gt, reviewsUrl as H, clearAgentPreference as Hi, describeSubject as Hn, lifecycleItemLabel as Hr, branchOf as Ht, settleQueue as I, shortNameOf as Ii, holdWorktree as In, workspaceStamps as Ir, QUOTE_LIMITS as It, writeServerRecord as J, agentById as Ji, fetchHead as Jn, queueAddMany as Jr, eventName as Jt, stopServer as K, STORE_ROOT as Ki, followedBranch as Kn, sectionOf as Kr, createPrState as Kt, readIndexToken as L, shorthandOf as Li, isWorktreeHeld as Ln, LIFECYCLES as Lr, REPOSITORY_SCOPE as Lt, runBatch as M, DetachedHeadError as Mi, isBusy as Mn, reviewedRepositories as Mr, storeArchitecture as Mt, activateQueued as N, isCommitReview as Ni, withReviewLock as Nn, summarise as Nr, storedScopes as Nt, batchIdentity as O, WITHHELD_REASON as Oi, escapeHtml as On, presentedKissRunOf as Or, loadArchitecture as Ot, compactQueue as P, resolveBase as Pi, MANAGED_ROOT as Pn, touchWorkspace as Pr, trackedFiles as Pt, parseWorkspacePort as Q, AgentCancelledError as Qi, allJobs as Qn, doneVerb as Qr, markReadForReview as Qt, bootstrapUrl as R, git as Ri, readMarker as Rn, activityAttributes as Rr, ancestorsOf as Rt, beginRun as S, wasReassessed as Si, authorPreview as Sn, latestKissRun as Sr, recordRuntimeBestEffort as St, reportRun as T, extractJsonText as Ti, renderMarkdown as Tn, matchingWorkspaceIds as Tr, formatDuration as Tt, serverEntryExists as U, readAgentPreference as Ui, findExistingReview as Un, lifecyclePill as Ur, subjectOf as Ut, readServerRecord as V, resolveModel as Vi, describeMovement as Vn, lifecycleChip as Vr, announceJob as Vt, spawnServer as W, writeAgentPreference as Wi, checkCodeFreshness as Wn, offersLifecycle as Wr, categoryOf as Wt, MAX_WORKSPACE_PORT as X, detectAgents as Xi, fillFileUrlTemplate as Xn, queueStamp as Xr, markAllRead as Xt, DEFAULT_WORKSPACE_PORT as Y, agentFor as Yi, forgeResolver as Yn, queueRemove as Yr, listNotifications as Yt, MIN_WORKSPACE_PORT as Z, isAgentId as Zi, RUN_RECORD_RETENTION_MS as Zn, readQueue as Zr, markRead as Zt, recordKissRun as _, gradeScale as _i, isUnchanged as _n, groupByLineage as _r, BUILD_VERSION as _t, wasBlocked as a, processDiscussion as ai, toneOf as an, saveJob as ar, settleReview as at, track as b, reassessIn as bi, chatConversationSection as bn, kissDecisionRefusal as br, waitingHistory as bt, RefreshUnavailableError as c, explanationOf as ci, withUsageRecorded as cn, isTerminalJobPhase as cr, startJob as ct, mergeUpdateInto as d, ANALYSIS_ONLY as di, adoptLegacyBaseline as dn, purposeOf as dr, record as dt, isQuestionOutstanding as ei, pruneNotifications as en, endedAt as er, statedWorkspacePort as et, updateReview as f, analysisRefOf as fi, prepareConversationWithin as fn, clearClaim as fr, stamp as ft, runningJobs as g, findingIn as gi, refreshPrContext as gn, followedRefName as gr, telemetryUploadEnabled as gt, liveUpdateFor as h, findingAssessment as hi, unforeseenFailure as hn, decideKissRecommendation as hr, telemetryUploadConsent as ht, liveJobsFor as i, reviewerDispositions as ii, retireNotification as in, pruneJobResidue as ir, prepareReview as it, unsupportedReason as j, originRemote as ji, ReviewBeingDeletedError as jn, reviewedCommit as jr, repositoryKey as jt, extractPullRequestLinks as k, kissOutcome as ki, renderInlineText as kn, previousKissResult as kr, partFiles as kt, cancelUpdate as l, isExplanationAction as li, existingPaths as ln, phasesFor as lr, append as lt, UpdateAlreadyRunningError as m, currentGradeIn as mi, storedConversation as mn, CLAIM_LEASE_MS as mr, recordTelemetryUploadConsent as mt, deleteReview as n, questionsOutstanding as ni, readStateOf as nn, isTerminal as nr, failureOf as nt, discardJob as o, recommendationsOf as oi, unreadAround as on, PHASES as or, reanalyseReview as ot, askCheckout as p, assessmentLookup as pi, saveRefresh as pn, isClaimed as pr, deliver as pt, workspaceUrl as q, AGENT_IDS as qi, reviewedShaOf as qn, queueAdd as qr, createPrUpdate as qt, lineageIds as r, resolvedByConversation as ri, removeNotification as rn, loadJob as rr, observeReview as rt, FETCH_TIMEOUT_MS as s, explanationActionOf as si, unreadCount as sn, isLiveJob as sr, runJob as st, deleteLineage as t, issuesOutstanding as ti, readNotification as tn, fail as tr, writePortPreference as tt, cancellableHere as u, withExplanation as ui, ASK_REREAD_CEILING_MS as un, progressSteps as ur, readEvents as ut, startKissJob as v, isGradeFor as vi, agentEnvOf as vn, indexKeptIds as vr, PACKAGE_NAME as vt, endRun as w, asString$1 as wi, GITHUB_MARKDOWN as wn, loadWorkspace as wr, describeRuntimes as wt, RUN_KINDS as x, sourcePhrase as xi, UNESTABLISHED_MOTIVATION as xn, kissDecisionsOf as xr, mapRuntimes as xt, isDriving as y, promptGrade as yi, EXPLAIN_SIMPLY_PROMPT as yn, indexReviewGroups as yr, feedbackUrl as yt, clearServerRecordOwnedBy as z, refExists as zi, removeWorktree as zn, activityLabel as zr, isArchitectureId as zt };