prreviewbuddy 0.80.3 → 0.82.1

package/dist/{delete_review-CYiIfV5A.js → delete_review-BED4mPxB.js}

@@ -1274,22 +1274,115 @@ var AGENTS = {
 	[GEMINI_AGENT_ID]: geminiAgent,
 	[CODEX_AGENT_ID]: codexAgent
 };
+/**
+* Adapters this build ships and will not run, each with the sentence a person is shown instead.
+*
+* A parked id is still known: reviews it made keep their name and their history, telemetry still
+* recognises it, and a job queued under it is refused by name rather than treated as an agent this
+* build has never heard of. What it loses is everything that would start it. `agentById` throws
+* before an adapter is handed out, so no run site can reach one, and every list a person chooses
+* from is built from `AGENT_IDS`, which leaves it out.
+*
+* Gemini CLI, since 0.81.0. Its read-only boundary is not applied on current releases (the system
+* settings file that carried it is skipped unless root owns it), and Google has ended Gemini CLI
+* for individual accounts. `index.test.ts` holds a tripwire against unparking it before the adapter
+* enforces its boundary again.
+*/
+var PARKED = { [GEMINI_AGENT_ID]: "Gemini CLI is turned off in this version of PR Review Buddy. Google has ended Gemini CLI access for individual accounts, and its read-only mode can't be guaranteed on current versions." };
 var DEFAULT_AGENT_ID = CLAUDE_AGENT_ID;
 /**
 * Every agent this build can run, for a surface that has to say which ones those are.
 *
 * Derived from the registry rather than written out, so a second adapter appears in the sentence a
-* user reads by being registered, and nobody has to remember a list in another package.
+* user reads by being registered, and nobody has to remember a list in another package. Parked
+* adapters are left out, which is how they leave every picker, listing and help sentence at once.
+*/
+var AGENT_IDS = Object.keys(AGENTS).filter((id) => !(id in PARKED));
+/**
+* Whether a string names an agent this build ships, answered by the registry rather than a list.
+*
+* True for a parked agent too. This answers "do we know this id", which is what a stored review, a
+* job record and telemetry need; "can it run" is `AGENT_IDS` and `agentById`.
 */
-var AGENT_IDS = Object.keys(AGENTS);
-/** Whether a string names an agent this build ships, answered by the registry rather than a list. */
 function isAgentId(value) {
 	return value !== void 0 && value in AGENTS;
 }
+/**
+* Why this agent will not run in this build, or undefined when nothing stops it here.
+*
+* For a surface that has to tell a person something more useful than "unknown agent" when they
+* name one that is parked.
+*/
+function parkedReason(id) {
+	if (id === void 0 || !Object.hasOwn(PARKED, id)) return void 0;
+	return `${PARKED[id]} Use ${runnableAgents().names} instead.`;
+}
+/**
+* The agents that can run, as a person reads them ("Claude Code or Codex") and as `--agent` takes
+* them ("`--agent claude` or `--agent codex`"), for a refusal that has to say what to do instead.
+*
+* Built from `AGENT_IDS` so no module outside this folder spells an agent out, and so the advice
+* stays true when an adapter is parked or added.
+*/
+function runnableAgents() {
+	const ids = [...AGENT_IDS].sort();
+	return {
+		names: orList(ids.map((id) => AGENTS[id].displayName)),
+		flags: orList(ids.map((id) => `\`--agent ${id}\``))
+	};
+}
+function orList(items) {
+	if (items.length <= 1) return items[0] ?? "";
+	return `${items.slice(0, -1).join(", ")} or ${items[items.length - 1]}`;
+}
+/**
+* A run was asked of a parked agent. An `AgentUnavailableError`, so every caller that already
+* answers "you have not got this agent" answers this with the parked sentence instead.
+*/
+var AgentParkedError = class extends AgentUnavailableError {
+	agentId;
+	constructor(agentId, reason) {
+		super(reason);
+		this.agentId = agentId;
+	}
+};
+/**
+* Who an agent is, without the means to run it. For a parked agent, which `agentById` refuses, when
+* a surface has to name it: a refusal that says "Gemini CLI" rather than "gemini".
+*/
+function agentIdentityOf(id) {
+	const { displayName, provider, modelSelectionHelp, setupNotes } = AGENTS[id];
+	return {
+		id,
+		displayName,
+		provider,
+		...modelSelectionHelp ? { modelSelectionHelp } : {},
+		...setupNotes ? { setupNotes } : {}
+	};
+}
+/**
+* The environment a review made by this agent is pinned to, captured now.
+*
+* Works for a parked agent, because capturing starts nothing: it reads variables. A review made by
+* one still has a forge to watch and a conversation to re-read, under the account that made it, and
+* an agent run started from what this returns is refused at `agentFor` like any other.
+*/
+function captureEnvFor(id, source) {
+	return AGENTS[id].captureEnv(source);
+}
 function defaultAgent() {
 	return agentById(DEFAULT_AGENT_ID);
 }
+/**
+* The adapter for this id, and the one way any run reaches one.
+*
+* A parked id throws here rather than handing out something that refuses later. Several callers
+* write before they run (a new job, a retired analysis, a KISS run), so a refusal at `run()` would
+* already have replaced what the reviewer was reading with a failure.
+*/
 function agentById(id) {
+	const reason = parkedReason(id);
+	if (reason) throw new AgentParkedError(id, reason);
 	const agent = AGENTS[id];
 	if (!agent) throw new AgentUnavailableError(`This review was made with an agent called "${id}", which this version does not know how to run.`);
 	return agent;
@@ -1346,7 +1439,7 @@ function captureEnv(source) {
 * against fakes that fail in ways no installed binary would.
 */
 async function detectAgents() {
-	return detectAgents$1(Object.values(AGENTS));
+	return detectAgents$1(AGENT_IDS.map((id) => AGENTS[id]));
 }
 //#endregion
 //#region ../../packages/review-harness/src/workspace/store_root.ts
@@ -1724,7 +1817,7 @@ function countDiscussion(context) {
 async function resolveAgent(request) {
 	if (request.flag) return named(request.flag, "flag");
 	const fromReview = request.review ? agentIdOf(request.review.session) : null;
-	if (fromReview && AGENT_IDS.includes(fromReview)) return named(fromReview, "review");
+	if (fromReview && isAgentId(fromReview)) return named(fromReview, "review");
 	const preferred = readAgentPreference();
 	if (preferred) return named(preferred, "preference");
 	const installed = (await detectAgents()).filter((agent) => agent.state === "installed");
@@ -1736,6 +1829,13 @@ async function resolveAgent(request) {
 	};
 }
 async function named(id, because) {
+	const parked = parkedReason(id);
+	if (parked && isAgentId(id)) return {
+		kind: "unavailable",
+		agent: agentIdentityOf(id),
+		reason: parked,
+		parked: true
+	};
 	if (!AGENT_IDS.includes(id)) return {
 		kind: "unknown-id",
 		id
@@ -5359,7 +5459,7 @@ var QUEUE_LOCK = "queue";
 * `version` is not branched on today. It exists so that a later shape change is a decision rather
 * than a guess about what an old file meant.
 */
-var VERSION$1 = 1;
+var VERSION$2 = 1;
 /**
 * What is queued, in order.
 *
@@ -5373,7 +5473,7 @@ function readQueue() {
 		const parsed = JSON.parse(readFileSync(QUEUE_PATH, "utf8"));
 		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return [];
 		const ids = parsed.ids;
-		return Array.isArray(ids) ? normalise(ids) : [];
+		return Array.isArray(ids) ? normalise$1(ids) : [];
 	} catch {
 		return [];
 	}
@@ -5419,10 +5519,10 @@ function updateQueue(change) {
 * processes never share one, although under the lock they never write at once anyway.
 */
 function writeQueueUnlocked(ids) {
-	const next = normalise(ids);
+	const next = normalise$1(ids);
 	mkdirSync(STORE_ROOT, { recursive: true });
 	const stored = {
-		version: VERSION$1,
+		version: VERSION$2,
 		ids: next
 	};
 	const temporary = `${QUEUE_PATH}.${process.pid}.tmp`;
@@ -5487,7 +5587,7 @@ function queueStamp() {
 	}
 }
 /** Strings only, first position wins, and never more than the cap. */
-function normalise(ids) {
+function normalise$1(ids) {
 	const seen = [];
 	for (const id of ids) {
 		if (typeof id !== "string" || id === "" || seen.includes(id)) continue;
@@ -5497,6 +5597,268 @@ function normalise(ids) {
 	return seen;
 }
 //#endregion
+//#region ../../packages/review-harness/src/workspace/collections.ts
+/**
+* Collections: the reviewer's own groups of reviews, such as everything in one refactor.
+*
+* A collection says what belongs together and nothing else. Whether a member still needs attention
+* is its lifecycle, which this file never reads or writes: assigning, removing, renaming and
+* deleting all leave every review's state exactly where it was.
+*
+* **Members are lineage keys, not review ids.** A card is a branch, and analysing the branch again
+* makes a new record with a new id. The queue stores ids and has to forward them (`forwardQueue`);
+* a lineage key is already what the card stands for, so membership survives updates, re-analysis
+* and restarts with nothing to keep in step.
+*
+* **Its own file**, for the reasons `queue.ts` gives: a record is rewritten whole by whoever loaded
+* it last and carries its diff inline, and `ui.json` is best-effort. And because a write here never
+* touches a record, it never moves the record's mtime, which is the clock retention runs on.
+* Organising a review is not opening or marking it.
+*
+* `STORE_ROOT` from `store_root.ts` rather than `store.ts`, for the import cycle `queue.ts` explains:
+* the prune in `store.ts` reads this file.
+*/
+var COLLECTIONS_PATH = join(STORE_ROOT, "collections.json");
+/** The lock's name. Reviews are locked under UUIDs in the same directory, so a word cannot collide. */
+var COLLECTIONS_LOCK = "collections";
+var VERSION$1 = 1;
+var ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+/** Whether a value is shaped like a collection's id, which is what a fold key and a route accept. */
+function isCollectionId(value) {
+	return typeof value === "string" && ID_PATTERN.test(value);
+}
+/**
+* Every collection, in the order they were created.
+*
+* Best-effort like `readQueue`: missing, unreadable and corrupt all mean "no collections". An entry
+* this code did not write is dropped rather than guessed at, and so is a second entry claiming an id
+* or a name already taken, so the rules `createCollection` keeps hold for a hand-edited file too.
+*/
+function readCollections() {
+	try {
+		const parsed = JSON.parse(readFileSync(COLLECTIONS_PATH, "utf8"));
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return [];
+		const collections = parsed.collections;
+		return Array.isArray(collections) ? normalise(collections) : [];
+	} catch {
+		return [];
+	}
+}
+function normalise(raw) {
+	const kept = [];
+	for (const entry of raw) {
+		if (kept.length >= 100) break;
+		if (!entry || typeof entry !== "object") continue;
+		const { id, name, colour, createdAt, members } = entry;
+		const clean = typeof name === "string" ? cleanName(name) : "";
+		if (!isCollectionId(id) || clean === "" || clean.length > 60) continue;
+		if (typeof createdAt !== "number" || !Number.isFinite(createdAt)) continue;
+		if (kept.some((other) => other.id === id || sameName(other.name, clean))) continue;
+		const keys = Array.isArray(members) ? members.filter((key) => typeof key === "string" && key !== "") : [];
+		kept.push({
+			id,
+			name: clean,
+			...typeof colour === "string" && colour !== "" ? { colour } : {},
+			createdAt,
+			members: [...new Set(keys)].slice(0, 500)
+		});
+	}
+	return kept;
+}
+/** Spaces trimmed and runs of them collapsed, so "  Release   0.82 " is "Release 0.82". */
+function cleanName(name) {
+	return name.trim().replace(/\s+/g, " ");
+}
+/** Two names are one collection's name regardless of case: "refactor" is not a second Refactor. */
+function sameName(a, b) {
+	return a.localeCompare(b, void 0, { sensitivity: "base" }) === 0;
+}
+function nameProblem(name, collections, except) {
+	const clean = cleanName(name);
+	if (clean === "") return "empty";
+	if (clean.length > 60) return "too-long";
+	if (collections.some((collection) => collection.id !== except && sameName(collection.name, clean))) return "duplicate";
+}
+/** What a refused change says, in the words the page shows. */
+function nameProblemText(problem) {
+	if (problem === "empty") return "Give the collection a name.";
+	if (problem === "too-long") return `Keep the name under 61 characters.`;
+	return "A collection with that name already exists.";
+}
+/**
+* Change the collections as they are on disk now, under the lock: the only way they are written.
+* Same contract as `updateQueue`: `change` returns what to store or null for nothing, and null from
+* here means the write failed.
+*/
+function updateCollections(change) {
+	try {
+		return withWriteLock(COLLECTIONS_LOCK, () => {
+			const current = readCollections();
+			const next = change(current);
+			return next === null ? current : writeUnlocked(next);
+		});
+	} catch {
+		return null;
+	}
+}
+/** To a temporary file and renamed into place, for the reason `writeQueueUnlocked` gives. */
+function writeUnlocked(collections) {
+	const next = normalise(collections);
+	mkdirSync(STORE_ROOT, { recursive: true });
+	const stored = {
+		version: VERSION$1,
+		collections: next
+	};
+	const temporary = `${COLLECTIONS_PATH}.${process.pid}.tmp`;
+	try {
+		writeFileSync(temporary, `${JSON.stringify(stored, null, 2)}\n`);
+		renameSync(temporary, COLLECTIONS_PATH);
+	} catch (error) {
+		try {
+			unlinkSync(temporary);
+		} catch {}
+		throw error;
+	}
+	return next;
+}
+function run$1(change) {
+	const outcome = {};
+	const stored = updateCollections((current) => {
+		const result = change(current);
+		if ("refused" in result) {
+			outcome.refused = result.refused;
+			return null;
+		}
+		outcome.id = result.id;
+		return result.next;
+	});
+	if (outcome.refused !== void 0) return {
+		ok: false,
+		reason: outcome.refused
+	};
+	if (stored === null) return {
+		ok: false,
+		reason: "unsaved"
+	};
+	return {
+		ok: true,
+		collections: stored,
+		...outcome.id === void 0 ? {} : { id: outcome.id }
+	};
+}
+function createCollection(name, now = Date.now()) {
+	return run$1((current) => {
+		const problem = nameProblem(name, current);
+		if (problem) return { refused: problem };
+		if (current.length >= 100) return { refused: "full" };
+		const id = randomUUID();
+		return {
+			next: [...current, {
+				id,
+				name: cleanName(name),
+				createdAt: now,
+				members: []
+			}],
+			id
+		};
+	});
+}
+/**
+* A new collection holding these lineages from the start: one transaction, so it is made with all of
+* them or not at all. "Create Refactor and add these three" never leaves an empty Refactor behind a
+* failure, and a retry never meets a duplicate name of its own making.
+*/
+function createWithMembers(name, keys, now = Date.now()) {
+	const members = [...new Set(keys.filter((key) => key !== ""))];
+	return run$1((current) => {
+		const problem = nameProblem(name, current);
+		if (problem) return { refused: problem };
+		if (current.length >= 100 || members.length > 500) return { refused: "full" };
+		const id = randomUUID();
+		return {
+			next: [...current, {
+				id,
+				name: cleanName(name),
+				createdAt: now,
+				members
+			}],
+			id
+		};
+	});
+}
+/** A new name on the same collection: its id, its members and every fold kept against the id stay. */
+function renameCollection(id, name) {
+	return run$1((current) => {
+		if (!current.some((collection) => collection.id === id)) return { refused: "missing" };
+		const problem = nameProblem(name, current, id);
+		if (problem) return { refused: problem };
+		return {
+			next: current.map((collection) => collection.id === id ? {
+				...collection,
+				name: cleanName(name)
+			} : collection),
+			id
+		};
+	});
+}
+/** The collection and its memberships go. No review is touched: they were never inside it. */
+function deleteCollection(id) {
+	return run$1((current) => {
+		if (!current.some((collection) => collection.id === id)) return { refused: "missing" };
+		return { next: current.filter((collection) => collection.id !== id) };
+	});
+}
+/**
+* Add the given lineages to one collection, or take them out of it.
+*
+* **Only the named collection is touched.** Assigning a selection to Refactor leaves every other
+* membership those reviews have exactly as it was, which is what makes a bulk assignment additive.
+* Adding a member already there and removing one that is not are both nothing, not errors: a mixed
+* selection is the ordinary case.
+*/
+function setMembership(keys, id, action) {
+	return run$1((current) => {
+		const target = current.find((collection) => collection.id === id);
+		if (!target) return { refused: "missing" };
+		const members = action === "add" ? [...target.members, ...keys.filter((key, at) => key !== "" && !target.members.includes(key) && keys.indexOf(key) === at)] : target.members.filter((key) => !keys.includes(key));
+		if (members.length === target.members.length && members.every((key, at) => key === target.members[at])) return {
+			next: null,
+			id
+		};
+		if (members.length > 500) return { refused: "full" };
+		return {
+			next: current.map((collection) => collection.id === id ? {
+				...collection,
+				members
+			} : collection),
+			id
+		};
+	});
+}
+/**
+* Take lineages out of every collection, because their reviews are gone. Stores nothing when none
+* of them was a member, so a deletion of an uncollected review never writes this file.
+*/
+function dropMembers(keys) {
+	const gone = new Set(keys);
+	return updateCollections((current) => current.some((collection) => collection.members.some((key) => gone.has(key))) ? current.map((collection) => ({
+		...collection,
+		members: collection.members.filter((key) => !gone.has(key))
+	})) : null);
+}
+/** Every lineage in at least one collection. What retention asks: collected is kept. */
+function collectedKeys(collections = readCollections()) {
+	return new Set(collections.flatMap((collection) => collection.members));
+}
+/** A token for the index's revision, as `queueStamp` is: it changes only when a person changes it. */
+function collectionsStamp() {
+	try {
+		return String(statSync(COLLECTIONS_PATH).mtimeMs);
+	} catch {
+		return "";
+	}
+}
+//#endregion
 //#region ../../packages/review-harness/src/workspace/lifecycle.ts
 /**
 * What happens next with a change, as the reviewer says it: still in play, parked until something
@@ -6034,18 +6396,23 @@ function followedRefName(branch, followedRef) {
 * Queue exist to defeat recency: a review saved three weeks ago has to be reachable from the list
 * or the pill that claims to show it is simply broken.
 *
-* **Two windows, and the page shows their sum.** Drawing both from one limit would mean saving
+* **Three windows, and the page shows their sum.** Drawing them from one limit would mean saving
 * eleven reviews pushed eleven recent ones off the page -- the working set eating the list it was
-* added to. So `limit` bounds recency, `keptLimit` bounds what was kept, and the most cards this
-* can return is the two added together. Neither constant says that on its own, which is why it is
-* said here.
+* added to. So `limit` bounds recency, `keptLimit` bounds what was kept, `collected.limit` bounds
+* what is in a collection, and the most cards this can return is the three added together. No
+* constant says that on its own, which is why it is said here.
 */
-function indexReviewGroups(limit, keptLimit, keptIds, rank, groups = groupByLineage(recentWorkspaces(Number.MAX_SAFE_INTEGER))) {
-	return selectIndexGroups(groups, limit, keptLimit, keptIds, rank);
+function indexReviewGroups(limit, keptLimit, keptIds, rank, groups = groupByLineage(recentWorkspaces(Number.MAX_SAFE_INTEGER)), collected = NO_COLLECTED) {
+	return selectIndexGroups(groups, limit, keptLimit, keptIds, rank, collected);
 }
+var NO_COLLECTED = {
+	keys: /* @__PURE__ */ new Set(),
+	limit: 0
+};
 /**
 * What the reviewer explicitly kept, which is what stops the recency window hiding it: the queue,
-* Saved, and anything marked Waiting or Done.
+* Saved, and anything marked Waiting or Done. Collections have a window of their own
+* (`CollectedWindow`).
 *
 * Done is the reviewer's archive, and an archive the recency window can empty is not one. Waiting
 * is work they expect back, and a push to it must have a card to come back on.
@@ -6071,12 +6438,19 @@ function indexKeptIds(reviews, queue) {
 * window rather than cut before its activity is ever looked at. Absent, it is when the newest
 * review was made, which is what every other caller has always meant by recent.
 */
-function selectIndexGroups(groups, limit, keptLimit, keptIds, rank = (group) => group.latest.createdAt) {
+function selectIndexGroups(groups, limit, keptLimit, keptIds, rank = (group) => group.latest.createdAt, collected = NO_COLLECTED) {
+	const inCollection = [];
 	const kept = [];
 	const rest = [];
-	for (const group of groups) (group.history.some((review) => keptIds.has(review.id)) ? kept : rest).push(group);
+	for (const group of groups) if (collected.keys.has(group.key)) inCollection.push(group);
+	else if (group.history.some((review) => keptIds.has(review.id))) kept.push(group);
+	else rest.push(group);
 	const byRank = (a, b) => rank(b) - rank(a);
-	return [...rest.sort(byRank).slice(0, limit), ...kept.sort(byRank).slice(0, keptLimit)].sort(byRank);
+	return [
+		...rest.sort(byRank).slice(0, limit),
+		...kept.sort(byRank).slice(0, keptLimit),
+		...inCollection.sort(byRank).slice(0, collected.limit)
+	].sort(byRank);
 }
 /**
 * The grouping itself, with the disk left out.
@@ -6428,11 +6802,12 @@ function touchWorkspace(workspace) {
 function pruneOldWorkspaces() {
 	try {
 		const queued = new Set(readQueue());
+		const collected = collectedKeys();
 		for (const entry of readdirSync(WORKSPACES_DIR)) {
 			const path = join(WORKSPACES_DIR, entry);
 			const age = Date.now() - statSync(path).mtimeMs;
 			if (age <= 2592e6) continue;
-			if (age <= 7776e6 && isKept(entry, queued)) continue;
+			if (age <= 7776e6 && isKept(entry, queued, collected)) continue;
 			unlinkSync(path);
 		}
 	} catch {}
@@ -6444,12 +6819,22 @@ function pruneOldWorkspaces() {
 * is the safe direction: the alternative keeps unreadable files for three months on the strength of
 * a question nobody could answer.
 */
-function isKept(entry, queued) {
+function isKept(entry, queued, collected) {
 	const id = workspaceIdFrom(entry);
 	if (id === null) return false;
 	if (queued.has(id)) return true;
 	const workspace = loadWorkspace(id);
-	return workspace?.pinned === true || parseLifecycle(workspace?.lifecycle)?.state === "done";
+	if (!workspace) return false;
+	if (workspace.pinned === true || parseLifecycle(workspace.lifecycle)?.state === "done") return true;
+	return collected.size > 0 && isCollected(workspace, collected);
+}
+/** A record that cannot be summarised cannot claim a lineage, so it falls to the ordinary window. */
+function isCollected(workspace, collected) {
+	try {
+		return collected.has(lineageKey(summarise(workspace)));
+	} catch {
+		return false;
+	}
 }
 /** The review an entry belongs to, whether it is the record or the usage sidecar beside it. */
 function workspaceIdFrom(entry) {
@@ -7177,7 +7562,7 @@ function advance(job, phase, progress) {
 		...phase === "done" ? { finishedAt: Date.now() } : {}
 	};
 }
-function fail(job, message, kind, detail) {
+function fail(job, message, kind, detail, parked) {
 	return {
 		...job,
 		phase: "failed",
@@ -7185,7 +7570,8 @@ function fail(job, message, kind, detail) {
 			phase: job.phase,
 			message,
 			...detail && detail !== message ? { detail } : {},
-			...kind ? { kind } : {}
+			...kind ? { kind } : {},
+			...parked ? { parked } : {}
 		},
 		updatedAt: Date.now(),
 		finishedAt: Date.now()
@@ -7212,11 +7598,11 @@ function fail(job, message, kind, detail) {
 * last thing the agent said survives being failed. Only a driver whose own claim has gone is
 * refused, so a job nobody holds -- a crashed driver's, a resumed run's -- is still failable.
 */
-function recordFailure(job, message, driver, kind, detail) {
+function recordFailure(job, message, driver, kind, detail, parked) {
 	const current = loadJob(job.id) ?? job;
 	const claim = liveClaim(job.id);
 	if (claim && claim.holder !== driver) return current;
-	const failed = fail(current, message, kind, detail);
+	const failed = fail(current, message, kind, detail, parked);
 	saveJob(failed);
 	return failed;
 }
@@ -12970,7 +13356,7 @@ function agentEnvOf(workspace) {
 	const job = workspace.jobId ? loadJob(workspace.jobId) : null;
 	if (job?.env) return job.env;
 	const id = agentIdOf(workspace.session);
-	return (AGENT_IDS.includes(id) ? agentById(id) : defaultAgent()).captureEnv();
+	return isAgentId(id) ? captureEnvFor(id) : defaultAgent().captureEnv();
 }
 //#endregion
 //#region ../../packages/review-harness/src/domain/discussion/discussion_attribution.ts
@@ -16370,6 +16756,8 @@ async function drive(jobId, workspaceId, runners, driver, signal, source) {
 	saveJob(job);
 	try {
 		signal?.throwIfAborted();
+		const parked = parkedReason(job.env.agentId);
+		if (parked) throw new AgentParkedError(job.env.agentId, parked);
 		if (needs(from, "preparing")) {
 			job = update(job, "preparing", "Preparing an isolated checkout");
 			const path = await createWorktree({
@@ -16494,7 +16882,7 @@ async function drive(jobId, workspaceId, runners, driver, signal, source) {
 		}
 		const kind = error instanceof GuideRejected || error instanceof KissRejected ? "agent_output_invalid" : error instanceof AgentRunError ? error.kind : void 0;
 		const raw = message(error);
-		job = recordFailure(job, explain(job, raw), driver, kind, raw);
+		job = recordFailure(job, explain(job, raw), driver, kind, raw, error instanceof AgentParkedError ? true : void 0);
 		if (job.reviewType === "kiss") failCurrentKissRun(workspaceId, job, job.failure?.message ?? raw, kind, error instanceof KissRejected ? error.answer : void 0);
 		finished(job, workspaceId, startedAt, false, now);
 		announceJob(job);
@@ -17885,7 +18273,7 @@ async function recordKissRun(input) {
 	if (!workspace) throw new Error("No such review.");
 	const sha = reviewedCommit(workspace);
 	if (!sha) throw new Error("This review does not record which commit it describes, so KISS cannot run on it.");
-	const agent = input.agentId ? agentById(input.agentId) : workspace.jobId ? agentById(agentIdOf(workspace.session)) : defaultAgent();
+	const agent = agentById(kissAgentId(workspace, input.agentId));
 	const sameAgent = !workspace.jobId || agent.id === agentIdOf(workspace.session);
 	const requestedModel = input.requestedModel ?? (sameAgent ? resolveModel({ review: workspace }) : null);
 	const started = await withReviewLock(workspace.id, () => {
@@ -17937,6 +18325,16 @@ async function recordKissRun(input) {
 function startKissJob(input, runners = {}) {
 	return track(recordKissRun(input).then((job) => runJob(job.workspaceId, runners, "kiss")));
 }
+/**
+* Which agent a KISS run of this review runs with: the one named, else the standard review's own,
+* else the default when there has been no standard review.
+*
+* Its own function so the page can refuse a run before answering. The route starts the run and
+* replies without waiting for it, so a refusal thrown inside the run never reached the page.
+*/
+function kissAgentId(workspace, agentId) {
+	return agentId ?? (workspace.jobId ? agentIdOf(workspace.session) : DEFAULT_AGENT_ID);
+}
 //#endregion
 //#region ../../packages/review-harness/src/domain/ai_review/reconciliation.ts
 /**
@@ -18829,6 +19227,17 @@ var RefreshUnavailableError = class extends Error {};
 var FETCH_TIMEOUT_MS = 6e4;
 /** Said wherever an update is asked of a commit review. One sentence, so both surfaces agree. */
 var COMMIT_REVIEW_CANNOT_UPDATE = "This review is of one commit, and a commit cannot move, so there is nothing to bring it up to date with. To analyse the same commit again, reanalyse it instead.";
+/**
+* Why this review cannot be updated in this build, when the agent it would continue with is parked.
+*
+* Read from `agentEnvOf`, which is what the update's job would be pinned to, so this refuses
+* exactly the updates that would otherwise be refused at the run.
+*/
+function parkedUpdateRefusal(workspace) {
+	const reason = parkedReason(agentEnvOf(workspace).agentId);
+	if (!reason) return null;
+	return `${reason} An update continues with the agent that made this review, so this one can't be brought up to date. To carry on with another agent, analyse it again with ${runnableAgents().names}.`;
+}
 /** The installed agent's own answer, through the `agentFor` this module imports. */
 var installedAgentVersion = (env) => agentVersionOf(agentFor(env), env);
 /** What the notice says after a cancel, and what the terminal would print if it could cancel. */
@@ -18864,6 +19273,8 @@ async function updateReview(workspace, runners = {}) {
 	const startedAt = now();
 	const reviewedSha = workspace.session.metadata?.commitSha || null;
 	if (workspace.changeSet.targetType === "commit") return refuse(reviewedSha, false, COMMIT_REVIEW_CANNOT_UPDATE);
+	const parked = parkedUpdateRefusal(workspace);
+	if (parked) return refuse(reviewedSha, false, parked);
 	const held = await claimCheckoutJob(workspace, reviewedSha ?? "", {
 		purpose: "update",
 		...runners.source ? { source: runners.source } : {},
@@ -19647,6 +20058,7 @@ function liveJobsFor(reviewId, now = Date.now()) {
 * a fact: no job for this review can be created or claimed without the lock this call is holding.
 */
 async function deleteReview(id) {
+	const key = lineageKeyOf(id);
 	const outcome = await withReviewLock(id, async () => {
 		const live = liveJobsFor(id);
 		if (live.length > 0) return {
@@ -19655,10 +20067,31 @@ async function deleteReview(id) {
 		};
 		return deleteLocked(id);
 	});
-	return isBusy(outcome) ? {
+	if (isBusy(outcome)) return {
 		...emptyReport(),
 		busy: true
-	} : outcome;
+	};
+	forgetIfEmpty(key, outcome);
+	return outcome;
+}
+/** The lineage a review belongs to, read before it is deleted, or absent when there is no review. */
+function lineageKeyOf(id) {
+	const workspace = loadWorkspace(id);
+	if (!workspace) return void 0;
+	try {
+		return lineageKey(summarise(workspace));
+	} catch {
+		return;
+	}
+}
+/**
+* A lineage with no review left leaves every collection, so a branch reviewed again later starts
+* uncollected rather than reappearing in a group from before it was deleted. A lineage that still
+* has reviews keeps its memberships: deleting one analysis from a card is not deleting the card.
+*/
+function forgetIfEmpty(key, report) {
+	if (key === void 0 || report.deleted.length === 0) return;
+	if (!recentWorkspaces(Number.MAX_SAFE_INTEGER).some((review) => lineageKey(review) === key)) dropMembers([key]);
 }
 /**
 * The removal itself, with the lock already held and the check already made.
@@ -19715,6 +20148,7 @@ async function deleteLocked(id) {
 * quietly delete a review made after it was rendered.
 */
 async function deleteLineage(id) {
+	const key = lineageKeyOf(id);
 	const ids = lineageIds(id);
 	const outcome = await withReviewLocks(ids, async () => {
 		const live = ids.flatMap((each) => liveJobsFor(each));
@@ -19732,10 +20166,12 @@ async function deleteLineage(id) {
 		}
 		return report;
 	});
-	return isBusy(outcome) ? {
+	if (isBusy(outcome)) return {
 		...emptyReport(),
 		busy: true
-	} : outcome;
+	};
+	forgetIfEmpty(key, outcome);
+	return outcome;
 }
 /**
 * The ids on one card, so a caller can check every one of them for running work before it commits
@@ -19753,4 +20189,4 @@ function lineageIds(id) {
 	return [.../* @__PURE__ */ new Set([id, ...lineage.map((review) => review.id)])];
 }
 //#endregion
-export { resolveWorkspacePort as $, AgentUnavailableError as $i, attemptIdOf as $n, isIssueOutstanding as $r, moveIds as $t, parsePullRequestLink as A, resolveTarget as Ai, modelHelpLines as An, recentWorkspaces as Ar, readArchitecture as At, ensureServer as B, resolveAgent as Bi, requestJobStop as Bn, isLifecycle as Br, writeJsonAtomically as Bt, completeRun as C, followUpFindingId as Ci, hasAuthorContent as Cn, lineagePosition as Cr, RUNTIME_WORDS as Ct, relativeTime as D, describeAuthorship as Di, CODE_COPY_CLASS as Dn, positionInLineage as Dr, checkArchitecture as Dt, stopRun as E, objectWithAnyOf as Ei, CODE_BLOCK_CLASS as En, mutateWorkspace as Er, ARCHITECTURE_DIR as Et, queueForReview as F, AmbiguousRefError as Fi, createWorktree as Fn, workspaceRevision as Fr, ownersOf as Ft, stopChild as G, CONFIG_PATH as Gi, checkReview as Gn, parseLifecycle as Gr, createArchitectureNotification as Gt, reviewsUrl as H, clearAgentPreference as Hi, describeSubject as Hn, lifecycleItemLabel as Hr, branchOf as Ht, settleQueue as I, shortNameOf as Ii, holdWorktree as In, workspaceStamps as Ir, QUOTE_LIMITS as It, writeServerRecord as J, agentById as Ji, fetchHead as Jn, queueAddMany as Jr, eventName as Jt, stopServer as K, STORE_ROOT as Ki, followedBranch as Kn, sectionOf as Kr, createPrState as Kt, readIndexToken as L, shorthandOf as Li, isWorktreeHeld as Ln, LIFECYCLES as Lr, REPOSITORY_SCOPE as Lt, runBatch as M, DetachedHeadError as Mi, isBusy as Mn, reviewedRepositories as Mr, storeArchitecture as Mt, activateQueued as N, isCommitReview as Ni, withReviewLock as Nn, summarise as Nr, storedScopes as Nt, batchIdentity as O, WITHHELD_REASON as Oi, escapeHtml as On, presentedKissRunOf as Or, loadArchitecture as Ot, compactQueue as P, resolveBase as Pi, MANAGED_ROOT as Pn, touchWorkspace as Pr, trackedFiles as Pt, parseWorkspacePort as Q, AgentCancelledError as Qi, allJobs as Qn, doneVerb as Qr, markReadForReview as Qt, bootstrapUrl as R, git as Ri, readMarker as Rn, activityAttributes as Rr, ancestorsOf as Rt, beginRun as S, wasReassessed as Si, authorPreview as Sn, latestKissRun as Sr, recordRuntimeBestEffort as St, reportRun as T, extractJsonText as Ti, renderMarkdown as Tn, matchingWorkspaceIds as Tr, formatDuration as Tt, serverEntryExists as U, readAgentPreference as Ui, findExistingReview as Un, lifecyclePill as Ur, subjectOf as Ut, readServerRecord as V, resolveModel as Vi, describeMovement as Vn, lifecycleChip as Vr, announceJob as Vt, spawnServer as W, writeAgentPreference as Wi, checkCodeFreshness as Wn, offersLifecycle as Wr, categoryOf as Wt, MAX_WORKSPACE_PORT as X, detectAgents as Xi, fillFileUrlTemplate as Xn, queueStamp as Xr, markAllRead as Xt, DEFAULT_WORKSPACE_PORT as Y, agentFor as Yi, forgeResolver as Yn, queueRemove as Yr, listNotifications as Yt, MIN_WORKSPACE_PORT as Z, isAgentId as Zi, RUN_RECORD_RETENTION_MS as Zn, readQueue as Zr, markRead as Zt, recordKissRun as _, gradeScale as _i, isUnchanged as _n, groupByLineage as _r, BUILD_VERSION as _t, wasBlocked as a, processDiscussion as ai, toneOf as an, saveJob as ar, settleReview as at, track as b, reassessIn as bi, chatConversationSection as bn, kissDecisionRefusal as br, waitingHistory as bt, RefreshUnavailableError as c, explanationOf as ci, withUsageRecorded as cn, isTerminalJobPhase as cr, startJob as ct, mergeUpdateInto as d, ANALYSIS_ONLY as di, adoptLegacyBaseline as dn, purposeOf as dr, record as dt, isQuestionOutstanding as ei, pruneNotifications as en, endedAt as er, statedWorkspacePort as et, updateReview as f, analysisRefOf as fi, prepareConversationWithin as fn, clearClaim as fr, stamp as ft, runningJobs as g, findingIn as gi, refreshPrContext as gn, followedRefName as gr, telemetryUploadEnabled as gt, liveUpdateFor as h, findingAssessment as hi, unforeseenFailure as hn, decideKissRecommendation as hr, telemetryUploadConsent as ht, liveJobsFor as i, reviewerDispositions as ii, retireNotification as in, pruneJobResidue as ir, prepareReview as it, unsupportedReason as j, originRemote as ji, ReviewBeingDeletedError as jn, reviewedCommit as jr, repositoryKey as jt, extractPullRequestLinks as k, kissOutcome as ki, renderInlineText as kn, previousKissResult as kr, partFiles as kt, cancelUpdate as l, isExplanationAction as li, existingPaths as ln, phasesFor as lr, append as lt, UpdateAlreadyRunningError as m, currentGradeIn as mi, storedConversation as mn, CLAIM_LEASE_MS as mr, recordTelemetryUploadConsent as mt, deleteReview as n, questionsOutstanding as ni, readStateOf as nn, isTerminal as nr, failureOf as nt, discardJob as o, recommendationsOf as oi, unreadAround as on, PHASES as or, reanalyseReview as ot, askCheckout as p, assessmentLookup as pi, saveRefresh as pn, isClaimed as pr, deliver as pt, workspaceUrl as q, AGENT_IDS as qi, reviewedShaOf as qn, queueAdd as qr, createPrUpdate as qt, lineageIds as r, resolvedByConversation as ri, removeNotification as rn, loadJob as rr, observeReview as rt, FETCH_TIMEOUT_MS as s, explanationActionOf as si, unreadCount as sn, isLiveJob as sr, runJob as st, deleteLineage as t, issuesOutstanding as ti, readNotification as tn, fail as tr, writePortPreference as tt, cancellableHere as u, withExplanation as ui, ASK_REREAD_CEILING_MS as un, progressSteps as ur, readEvents as ut, startKissJob as v, isGradeFor as vi, agentEnvOf as vn, indexKeptIds as vr, PACKAGE_NAME as vt, endRun as w, asString$1 as wi, GITHUB_MARKDOWN as wn, loadWorkspace as wr, describeRuntimes as wt, RUN_KINDS as x, sourcePhrase as xi, UNESTABLISHED_MOTIVATION as xn, kissDecisionsOf as xr, mapRuntimes as xt, isDriving as y, promptGrade as yi, EXPLAIN_SIMPLY_PROMPT as yn, indexReviewGroups as yr, feedbackUrl as yt, clearServerRecordOwnedBy as z, refExists as zi, removeWorktree as zn, activityLabel as zr, isArchitectureId as zt };
+export { MIN_WORKSPACE_PORT as $, resolveModel as $i, RUN_RECORD_RETENTION_MS as $n, deleteCollection as $r, markRead as $t, batchIdentity as A, isGradeFor as Ai, escapeHtml as An, positionInLineage as Ar, loadArchitecture as At, bootstrapUrl as B, WITHHELD_REASON as Bi, readMarker as Bn, LIFECYCLES as Br, ancestorsOf as Bt, RUN_KINDS as C, ANALYSIS_ONLY as Ci, UNESTABLISHED_MOTIVATION as Cn, kissDecisionsOf as Cr, mapRuntimes as Ct, reportRun as D, findingAssessment as Di, renderMarkdown as Dn, loadWorkspace as Dr, formatDuration as Dt, endRun as E, currentGradeIn as Ei, GITHUB_MARKDOWN as En, lineagePosition as Er, describeRuntimes as Et, activateQueued as F, followUpFindingId as Fi, withReviewLock as Fn, reviewedRepositories as Fr, storedScopes as Ft, serverEntryExists as G, isCommitReview as Gi, findExistingReview as Gn, lifecycleItemLabel as Gr, subjectOf as Gt, ensureServer as H, resolveTarget as Hi, requestJobStop as Hn, activityLabel as Hr, writeJsonAtomically as Ht, compactQueue as I, asString$1 as Ii, MANAGED_ROOT as In, summarise as Ir, trackedFiles as It, stopServer as J, shortNameOf as Ji, followedBranch as Jn, parseLifecycle as Jr, createPrState as Jt, spawnServer as K, resolveBase as Ki, checkCodeFreshness as Kn, lifecyclePill as Kr, categoryOf as Kt, queueForReview as L, extractJsonText as Li, createWorktree as Ln, touchWorkspace as Lr, ownersOf as Lt, parsePullRequestLink as M, reassessIn as Mi, modelHelpLines as Mn, previousKissResult as Mr, readArchitecture as Mt, unsupportedReason as N, sourcePhrase as Ni, ReviewBeingDeletedError as Nn, recentWorkspaces as Nr, repositoryKey as Nt, stopRun as O, findingIn as Oi, CODE_BLOCK_CLASS as On, matchingWorkspaceIds as Or, ARCHITECTURE_DIR as Ot, runBatch as P, wasReassessed as Pi, isBusy as Pn, reviewedCommit as Pr, storeArchitecture as Pt, MAX_WORKSPACE_PORT as Q, resolveAgent as Qi, fillFileUrlTemplate as Qn, createWithMembers as Qr, markAllRead as Qt, settleQueue as R, objectWithAnyOf as Ri, holdWorktree as Rn, workspaceRevision as Rr, QUOTE_LIMITS as Rt, track as S, withExplanation as Si, chatConversationSection as Sn, kissDecisionRefusal as Sr, waitingHistory as St, completeRun as T, assessmentLookup as Ti, hasAuthorContent as Tn, lineageKey as Tr, RUNTIME_WORDS as Tt, readServerRecord as U, originRemote as Ui, describeMovement as Un, isLifecycle as Ur, announceJob as Ut, clearServerRecordOwnedBy as V, kissOutcome as Vi, removeWorktree as Vn, activityAttributes as Vr, isArchitectureId as Vt, reviewsUrl as W, DetachedHeadError as Wi, describeSubject as Wn, lifecycleChip as Wr, branchOf as Wt, writeServerRecord as X, git as Xi, fetchHead as Xn, collectionsStamp as Xr, eventName as Xt, workspaceUrl as Y, shorthandOf as Yi, reviewedShaOf as Yn, sectionOf as Yr, createPrUpdate as Yt, DEFAULT_WORKSPACE_PORT as Z, refExists as Zi, forgeResolver as Zn, createCollection as Zr, listNotifications as Zt, runningJobs as _, processDiscussion as _i, unforeseenFailure as _n, decideKissRecommendation as _r, telemetryUploadConsent as _t, wasBlocked as a, STORE_ROOT as aa, queueAdd as ai, removeNotification as an, loadJob as ar, observeReview as at, startKissJob as b, explanationOf as bi, agentEnvOf as bn, indexKeptIds as br, PACKAGE_NAME as bt, RefreshUnavailableError as c, agentFor as ca, queueStamp as ci, unreadAround as cn, PHASES as cr, reanalyseReview as ct, mergeUpdateInto as d, isAgentId as da, isIssueOutstanding as di, existingPaths as dn, phasesFor as dr, append as dt, agentIdOf as ea, nameProblemText as ei, markReadForReview as en, allJobs as er, parseWorkspacePort as et, parkedUpdateRefusal as f, parkedReason as fa, isQuestionOutstanding as fi, ASK_REREAD_CEILING_MS as fn, progressSteps as fr, readEvents as ft, liveUpdateFor as g, reviewerDispositions as gi, storedConversation as gn, CLAIM_LEASE_MS as gr, recordTelemetryUploadConsent as gt, UpdateAlreadyRunningError as h, AgentUnavailableError as ha, resolvedByConversation as hi, saveRefresh as hn, isClaimed as hr, deliver as ht, liveJobsFor as i, CONFIG_PATH as ia, updateCollections as ii, readStateOf as in, isTerminal as ir, failureOf as it, extractPullRequestLinks as j, promptGrade as ji, renderInlineText as jn, presentedKissRunOf as jr, partFiles as jt, relativeTime as k, gradeScale as ki, CODE_COPY_CLASS as kn, mutateWorkspace as kr, checkArchitecture as kt, cancelUpdate as l, agentIdentityOf as la, readQueue as li, unreadCount as ln, isLiveJob as lr, runJob as lt, askCheckout as m, AgentCancelledError as ma, questionsOutstanding as mi, prepareConversationWithin as mn, clearClaim as mr, stamp as mt, deleteReview as n, readAgentPreference as na, renameCollection as ni, pruneNotifications as nn, endedAt as nr, statedWorkspacePort as nt, discardJob as o, AGENT_IDS as oa, queueAddMany as oi, retireNotification as on, pruneJobResidue as or, prepareReview as ot, updateReview as p, runnableAgents as pa, issuesOutstanding as pi, adoptLegacyBaseline as pn, purposeOf as pr, record as pt, stopChild as q, AmbiguousRefError as qi, checkReview as qn, offersLifecycle as qr, createArchitectureNotification as qt, lineageIds as r, writeAgentPreference as ra, setMembership as ri, readNotification as rn, fail as rr, writePortPreference as rt, FETCH_TIMEOUT_MS as s, agentById as sa, queueRemove as si, toneOf as sn, saveJob as sr, settleReview as st, deleteLineage as t, clearAgentPreference as ta, readCollections as ti, moveIds as tn, attemptIdOf as tr, resolveWorkspacePort as tt, cancellableHere as u, detectAgents as ua, doneVerb as ui, withUsageRecorded as un, isTerminalJobPhase as ur, startJob as ut, kissAgentId as v, recommendationsOf as vi, refreshPrContext as vn, followedRefName as vr, telemetryUploadEnabled as vt, beginRun as w, analysisRefOf as wi, authorPreview as wn, latestKissRun as wr, recordRuntimeBestEffort as wt, isDriving as x, isExplanationAction as xi, EXPLAIN_SIMPLY_PROMPT as xn, indexReviewGroups as xr, feedbackUrl as xt, recordKissRun as y, explanationActionOf as yi, isUnchanged as yn, groupByLineage as yr, BUILD_VERSION as yt, readIndexToken as z, describeAuthorship as zi, isWorktreeHeld as zn, workspaceStamps as zr, REPOSITORY_SCOPE as zt };