prreviewbuddy 0.87.2 → 0.90.0

package/dist/server.js

@@ -1,9 +1,9 @@
-import { $ as MAX_WORKSPACE_PORT, $i as resolveBase, $n as fillFileUrlTemplate, $r as createWithMembers, $t as markAllRead, A as relativeTime$1, Ai as currentGradeIn, An as CODE_COPY_CLASS, Ar as mutateWorkspace, At as checkArchitecture, B as readIndexToken, Bi as statusLookup, Bn as isWorktreeHeld, Br as workspaceStamps, Bt as REPOSITORY_SCOPE, C as RUN_KINDS, Ci as isExplanationAction, Cn as chatConversationSection, Cr as kissDecisionRefusal, Ct as waitingHistory, D as heldRuns, Di as analysisRefOf, Dn as GITHUB_MARKDOWN, Dr as lineagePosition, Dt as describeRuntimes, E as endRun, Ei as NO_STATUS, En as hasAuthorContent, Er as lineageKey, Et as RUNTIME_WORDS, F as runBatch, Fi as isGradeFor, Fn as isBusy, Fr as reviewedCommit, Ft as storeArchitecture, Gi as objectWithAnyOf, Gr as lifecycleChip, Gt as branchOf, H as clearServerRecordOwnedBy, Hi as followUpFindingId, Hn as removeWorktree, Hr as activityAttributes, Ht as isArchitectureId, I as activateQueued, Ii as isOffered, In as withReviewLock, It as storedScopes, J as stopChild, Ji as kissOutcome, Jn as checkReview, Jr as offersLifecycle, Jt as createArchitectureNotification, K as serverEntryExists, Ki as describeAuthorship, Kn as findExistingReview, Kr as lifecycleItemLabel, Kt as subjectOf, L as compactQueue, Li as promptGrade, Ln as MANAGED_ROOT, Lr as summarise, Lt as trackedFiles, M as extractPullRequestLinks, Mi as findingIn, Mn as renderInlineText, Mr as presentedKissRunOf, Mt as partFiles, N as parsePullRequestLink, Ni as findingStatus, Nr as previousKissResult, Nt as readArchitecture, O as reportRun, Oi as assessmentLookup, On as renderMarkdown, Or as loadWorkspace, Ot as formatDuration, P as unsupportedReason, Pi as gradeScale, Pn as ReviewBeingDeletedError, Pr as recentWorkspaces, Pt as repositoryKey, Q as DEFAULT_WORKSPACE_PORT, Qi as isCommitReview, Qn as forgeResolver, Qr as createCollection, Qt as listNotifications, Ri as reassessIn, Rn as createWorktree, Rr as touchWorkspace, Rt as ownersOf, S as track, Sa as AgentUnavailableError, Si as explanationOf, Sn as EXPLAIN_SIMPLY_PROMPT, Sr as indexReviewGroups, St as feedbackUrl, T as completeRun, Ti as ANALYSIS_ONLY, Tn as authorPreview, Tr as latestKissRun, Tt as recordRuntimeBestEffort, Ui as asString, Un as requestJobStop, Ur as activityLabel, Ut as writeJsonAtomically, Vi as wasReassessed, Vn as readMarker, Vr as LIFECYCLES, Vt as ancestorsOf, W as readServerRecord, Wi as extractJsonText, Wr as isLifecycle, Wt as announceJob, Xi as originRemote, Xn as reviewedShaOf, Xr as sectionOf, Xt as createPrUpdate, Yi as resolveTarget, Yn as followedBranch, Yr as parseLifecycle, Yt as createPrState, Z as writeServerRecord, Zi as DetachedHeadError, Zn as fetchHead, Zr as collectionsStamp, Zt as eventName, _ as runningJobs, _a as detectAgents, _i as reviewerDispositions, _n as storedConversation, _t as recordTelemetryUploadConsent, a as wasBlocked, aa as resolveAgent, ai as updateCollections, an as readStateOf, ar as isTerminal, at as failureOf$1, b as startKissJob, ba as runnableAgents, bi as recommendationsOf, bn as isUnchanged, br as groupByLineage, bt as BUILD_VERSION, c as RefreshUnavailableError, ca as clearAgentPreference, ci as queueRemove, cn as toneOf, cr as saveJob, ct as settleReview, d as mergeUpdateInto, di as doneVerb, dn as withUsageRecorded, dr as isTerminalJobPhase, ea as AmbiguousRefError, ei as deleteCollection, en as markRead, er as RUN_RECORD_RETENTION_MS, et as MIN_WORKSPACE_PORT, fa as STORE_ROOT, fi as isIssueOutstanding, fn as existingPaths, fr as phasesFor, g as liveUpdateFor, ga as agentIdentityOf, gi as resolvedByConversation, gn as saveRefresh, gr as isClaimed, h as UpdateAlreadyRunningError, ha as agentFor$1, hi as questionsOutstanding, hn as prepareConversationWithin, i as liveJobsFor, ia as refExists, ii as setMembership, in as readNotification, ir as fail$1, it as writePortPreference, j as batchIdentity, ji as findingAssessment, jn as escapeHtml$1, jt as loadArchitecture, k as stopRun, ki as closesFinding, kn as CODE_BLOCK_CLASS, kt as ARCHITECTURE_DIR, l as cancelUpdate, la as readAgentPreference, li as queueStamp, ln as unreadAround, lt as reanalyseReview, m as askCheckout, ma as agentById, mi as issuesOutstanding, mn as adoptLegacyBaseline, mr as purposeOf, mt as record, n as deleteReview, na as shorthandOf, ni as readCollections, nn as moveIds, nr as attemptIdOf, nt as resolveWorkspacePort, o as discardJob, oa as resolveModel, oi as queueAdd, on as removeNotification, or as loadJob, ot as observeReview, p as updateReview, pa as AGENT_IDS, pi as isQuestionOutstanding, pn as ASK_REREAD_CEILING_MS, pr as progressSteps, pt as readEvents, q as spawnServer, qi as WITHHELD_REASON, qn as checkCodeFreshness, qr as lifecyclePill, qt as categoryOf, r as lineageIds, ra as git, ri as renameCollection, rn as pruneNotifications, rr as endedAt, rt as statedWorkspacePort, s as FETCH_TIMEOUT_MS, sa as agentIdOf, si as queueAddMany, sn as retireNotification, sr as pruneJobResidue, st as prepareReview, t as deleteLineage, ta as shortNameOf, ti as nameProblemText, tn as markReadForReview, tr as allJobs, tt as parseWorkspacePort, u as cancellableHere, ua as writeAgentPreference, ui as readQueue, un as unreadCount$1, ur as isLiveJob, ut as runJob, v as kissAgentId, va as isAgentId, vi as verdictClosure, vn as unforeseenFailure, vr as decideKissRecommendation, vt as telemetryUploadConsent, w as beginRun, wi as withExplanation, wn as UNESTABLISHED_MOTIVATION, wr as kissDecisionsOf, wt as mapRuntimes, x as isDriving, xa as AgentCancelledError, xi as explanationActionOf, xn as agentEnvOf, xr as indexKeptIds, ya as parkedReason, yi as processDiscussion, yn as refreshPrContext, yr as followedRefName, z as settleQueue, zi as sourcePhrase, zn as holdWorktree, zr as workspaceRevision, zt as QUOTE_LIMITS } from "./delete_review-D7TXn5ck.js";
-import { basename, isAbsolute, join, relative, resolve } from "node:path";
-import { execFile } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
+import { $a as versionFrom, $i as explanationOf, $n as authorPreview, $r as kissDecisionsOf, $t as recordRuntimeBestEffort, A as settleQueue, Aa as isCommitReview, Ai as createWithMembers, An as moveIds, Ar as attemptIdOf, At as UpdateAlreadyRunningError, B as humanizeModelId, Ba as clearAgentPreference, Bi as queueStamp, Bn as existingPaths, Br as phasesFor, C as parsePullRequestLink, Ca as describeAuthorship, Ci as lifecyclePillAction, Cn as createPrState, Cr as followedBranch, Ct as RefreshUnavailableError, D as activateQueued, Da as originRemote, Di as sectionOf, Dn as markAllRead, Dr as fillFileUrlTemplate, E as relativeTime$1, Ea as resolveTarget, Ei as parseLifecycle, En as listNotifications, Er as forgeResolver, Et as mergeUpdateInto, Fa as git, Fi as setMembership, Fn as retireNotification, Fr as pruneJobResidue, Ft as prepareReview, G as reviewTag, Ga as AGENT_IDS, Gi as issuesOutstanding, Gn as storedConversation, Gr as isClaimed, Gt as recordTelemetryUploadConsent, H as findingRef, Ha as writeAgentPreference, Hi as doneVerb, Hn as adoptLegacyBaseline, Hr as purposeOf, Ht as record, Ia as refExists, Ii as updateCollections, In as toneOf, Ir as saveJob, It as settleReview, Ja as agentIdentityOf, Ji as reviewerDispositions, Jn as isUnchanged, Jr as followedRefName, Jt as BUILD_VERSION, K as reviewTagsIn, Ka as agentById, Ki as questionsOutstanding, Kn as unforeseenFailure, Kt as telemetryUploadConsent, L as modelProvenanceOf, La as resolveAgent, Li as queueAdd, Ln as unreadAround, Lt as reanalyseReview, Ma as AmbiguousRefError, Mi as nameProblemText, Mn as readNotification, Mr as fail$1, Mt as runningJobs, N as cliEntry, Na as shortNameOf, Ni as readCollections, Nn as readStateOf, Nr as isTerminal, Nt as failureOf$1, O as compactQueue, Oa as DetachedHeadError, Oi as collectionsStamp, On as markRead, Or as RUN_RECORD_RETENTION_MS, Ot as updateReview, Pa as shorthandOf, Pi as renameCollection, Pn as removeNotification, Pr as loadJob, Pt as observeReview, Q as markAskRunning, Qa as runnableAgents, Qi as explanationActionOf, Qn as UNESTABLISHED_MOTIVATION, Qr as kissDecisionRefusal, Qt as mapRuntimes, R as provenanceDetailLines, Ra as resolveModel, Ri as queueAddMany, Rn as unreadCount$1, Rr as isLiveJob, Rt as runJob, S as extractPullRequestLinks, Sa as objectWithAnyOf, Si as lifecycleName$1, Sn as createArchitectureNotification, Sr as checkReview, St as FETCH_TIMEOUT_MS, T as runBatch, Ta as kissOutcome, Ti as offersLifecycle, Tn as eventName, Tr as fetchHead, Tt as cancellableHere, U as findingRefs, Ui as isIssueOutstanding, Un as prepareConversationWithin, V as findingAtRef, Va as readAgentPreference, Vi as readQueue, Vn as ASK_REREAD_CEILING_MS, Vr as progressSteps, Vt as readEvents, W as refOf, Wa as STORE_ROOT, Wi as isQuestionOutstanding, Wn as saveRefresh, X as isRequestId, Xa as isAgentId, Xi as processDiscussion, Xn as EXPLAIN_SIMPLY_PROMPT, Xr as indexKeptIds, Xt as feedbackUrl, Ya as detectAgents, Yi as verdictClosure, Yn as agentEnvOf, Yr as groupByLineage, Za as parkedReason, Zi as recommendationsOf, Zn as chatConversationSection, Zr as indexReviewGroups, Zt as waitingHistory, _ as endRun, _a as statusLookup, _i as activityAttributes, _n as writeJsonAtomically, _r as requestJobStop, _t as parseWorkspacePort, a as lineageIds, aa as assessmentLookup, ai as mutateWorkspace, an as loadArchitecture, ar as escapeHtml$1, b as stopRun, ba as asString, bi as lifecycleChip, bn as subjectOf, br as findExistingReview, bt as writePortPreference, c as discardJob, ca as findingAssessment, ci as previousKissResult, cn as repositoryKey, cr as ReviewBeingDeletedError, ct as serverEntryExists, d as startKissJob, da as gradeScale, dn as trackedFiles, dr as MANAGED_ROOT, ea as isExplanationAction, ei as latestKissRun, en as RUNTIME_WORDS, er as hasAuthorContent, f as isDriving, fa as isGradeFor, fi as summarise, fn as ownersOf, fr as createWorktree, g as completeRun, ga as sourcePhrase, gi as LIFECYCLES, gn as isArchitectureId, gr as removeWorktree, gt as MIN_WORKSPACE_PORT, h as beginRun, ha as reassessIn, hi as workspaceStamps, hn as ancestorsOf, hr as readMarker, ht as MAX_WORKSPACE_PORT, i as deleteReview, ia as analysisRefOf, in as checkArchitecture, ir as CODE_COPY_CLASS, ja as resolveBase, ji as deleteCollection, jn as pruneNotifications, jr as endedAt, jt as liveUpdateFor, ki as createCollection, kn as markReadForReview, kr as allJobs, kt as askCheckout, l as kissAgentId, la as findingIn, li as recentWorkspaces, ln as storeArchitecture, lr as isBusy, lt as spawnServer, m as RUN_KINDS, ma as promptGrade, mi as workspaceRevision, mn as REPOSITORY_SCOPE, mr as isWorktreeHeld, mt as DEFAULT_WORKSPACE_PORT, n as MCP_TOOL_NAMES, na as ANALYSIS_ONLY, ni as lineagePosition, nn as formatDuration, no as AgentUnavailableError, nr as renderMarkdown, o as liveJobsFor, oa as closesFinding, on as partFiles, or as renderInlineText, ot as readServerRecord, p as track, pa as isOffered, pi as touchWorkspace, pn as QUOTE_LIMITS, pr as holdWorktree, pt as writeServerRecord, q as endAskRequest, qa as agentFor$1, qi as resolvedByConversation, qn as refreshPrContext, qr as decideKissRecommendation, r as deleteLineage, ra as NO_STATUS, ri as loadWorkspace, rn as ARCHITECTURE_DIR, rr as CODE_BLOCK_CLASS, rt as clearServerRecordOwnedBy, s as wasBlocked, sa as currentGradeIn, si as presentedKissRunOf, sn as readArchitecture, ta as withExplanation, ti as lineageKey, tn as describeRuntimes, to as AgentCancelledError, tr as GITHUB_MARKDOWN, tt as readIndexToken, ua as findingStatus, ui as reviewedCommit, un as storedScopes, ur as withReviewLock, ut as stopChild, v as heldRuns, va as wasReassessed, vi as activityLabel, vn as announceJob, vt as resolveWorkspacePort, w as unsupportedReason, wa as WITHHELD_REASON, wi as lifecyclePillLabel, wn as createPrUpdate, wr as reviewedShaOf, wt as cancelUpdate, x as batchIdentity, xa as extractJsonText, xi as lifecycleItemLabel, xn as categoryOf, xr as checkCodeFreshness, y as reportRun, ya as followUpFindingId, yi as isLifecycle, yn as branchOf, yt as statedWorkspacePort, z as agentDisplayName, za as agentIdOf, zi as queueRemove, zn as withUsageRecorded, zr as isTerminalJobPhase } from "./mcp_tools-CSj5vcSE.js";
+import { basename, delimiter, isAbsolute, join, relative, resolve } from "node:path";
+import { execFile, spawn } from "node:child_process";
+import { accessSync, constants, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
+import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import { createServer } from "node:http";
 //#region ../../packages/review-harness/src/domain/ai_review/review_composition.ts
@@ -228,6 +228,254 @@ function readingThemeLine(sections, sectionId) {
 	return section ? `The reviewer is currently reading the "${section.title}" theme. Answer with that in view, but do not ignore the rest of the change if it bears on the question.` : null;
 }
 //#endregion
+//#region ../../packages/review-harness/src/integrations/executable.ts
+/**
+* Which command an agent's config should start PR Review Buddy with.
+*
+* A stable command on PATH, never the package's own `main.js` and never node itself. The file a
+* command resolves to moves with every install method's upgrades; the command does not. The one
+* chosen is the first on PATH that resolves to *this* install, not merely the first: a machine can
+* have several copies, and an older one earlier on PATH is exactly what breaks a registration that
+* names the bare word (a 0.36 copy has no `mcp serve` at all).
+*/
+var CLI_COMMAND = "prreviewbuddy";
+/** What the MCP server is started with, after the command. */
+var SERVE_ARGS = ["mcp", "serve"];
+function realpathOrNull(path) {
+	try {
+		return realpathSync(path);
+	} catch {
+		return null;
+	}
+}
+/** Every executable `name` on `pathValue`, in PATH order, each directory once. */
+function everyOnPath(name, pathValue) {
+	const seen = /* @__PURE__ */ new Set();
+	const found = [];
+	for (const dir of (pathValue ?? "").split(delimiter)) {
+		if (!dir || seen.has(dir)) continue;
+		seen.add(dir);
+		const candidate = join(dir, name);
+		try {
+			accessSync(candidate, constants.X_OK);
+			found.push(candidate);
+		} catch {}
+	}
+	return found;
+}
+function chooseExecutable(entry, pathValue) {
+	const ours = realpathOrNull(entry) ?? entry;
+	const shadowedBy = [];
+	for (const candidate of everyOnPath(CLI_COMMAND, pathValue)) {
+		if (realpathOrNull(candidate) === ours) return {
+			command: candidate,
+			entry: ours,
+			shadowedBy
+		};
+		shadowedBy.push(candidate);
+	}
+	return {
+		command: null,
+		entry: ours,
+		shadowedBy
+	};
+}
+/**
+* Whether a registered command starts this install. An absolute command by its real path; a bare
+* word the way the agent will find it, as the first on PATH.
+*/
+function startsThisInstall(command, entry, pathValue) {
+	if (!command) return false;
+	const ours = realpathOrNull(entry) ?? entry;
+	const path = isAbsolute(command) ? command : command.includes("/") ? null : everyOnPath(command, pathValue)[0];
+	return path ? realpathOrNull(path) === ours : false;
+}
+//#endregion
+//#region ../../packages/review-harness/src/workspace/integrations_view.ts
+/**
+* Settings → AI integrations: one row per coding agent that can start PR Review Buddy's MCP server,
+* with what its config holds now and what can be done about it.
+*
+* Rendered by the server like the rest of Settings, with its real state in it. After an action the
+* client fetches this page again and swaps in the row it changed (`client/integrations.ts`), so a
+* row is only ever drawn here.
+*
+* Nothing in this file names an agent or its command. The rows, the config files, the commands a
+* person may run by hand and the variable that selects a profile all arrive in the report, from
+* each adapter's own `mcpRegistration`.
+*/
+var INTEGRATIONS_ANCHOR = "ai-integrations";
+var STATE_LABEL = {
+	"not-installed": "Not installed",
+	"not-connected": "Not connected",
+	connected: "Connected",
+	"connected-elsewhere": "Uses another copy",
+	disabled: "Turned off",
+	unknown: "Could not check"
+};
+/** A path as a person would type it, with their home as `~`. */
+function homeRelative(path, home) {
+	return home && (path === home || path.startsWith(`${home}/`)) ? `~${path.slice(home.length)}` : path;
+}
+function renderIntegrationsSection(report, home) {
+	return `<div class="prb-page-panel" id="${INTEGRATIONS_ANCHOR}"><section class="prb-settings-section prb-integrations" data-integrations>
+    <h2>AI integrations</h2>
+    <p class="prb-settings-help">Use PR Review Buddy from your coding agent. Once connected, ${agentNames(report)}
+    can start reviews, read their issues and questions, request updates and ask Buddy AI about a
+    change, without opening the browser. These buttons act at once; Save changes is not needed.</p>
+    ${report ? renderBody$1(report, home) : `<p class="prb-settings-help" role="alert">The coding agents on this machine could not be checked just now. Reload this page to try again.</p>`}
+    <details class="prb-integrations-scope">
+      <summary>What can my coding agent do?</summary>
+      <p class="prb-settings-help">Start a review of a branch, a pull request or a commit; read a
+      review's issues and questions; request an update after new commits; and ask Buddy AI about the
+      change. It cannot delete reviews, dismiss or resolve findings, approve or comment on a pull
+      request, or change these settings. A review PR Review Buddy itself runs can read reviews but
+      never start one, so an agent cannot set off a chain of reviews.</p>
+      <p class="prb-settings-help"><a href="/help#coding-agents">How AI integrations work</a></p>
+    </details>
+  </section></div>
+${renderIntegrationDialog()}`;
+}
+/** "Claude Code or Codex", from the rows themselves. */
+function agentNames(report) {
+	const names = (report?.integrations ?? []).map((status) => escapeHtml$1(status.displayName));
+	if (names.length === 0) return "your coding agent";
+	return names.length === 1 ? names[0] : `${names.slice(0, -1).join(", ")} or ${names[names.length - 1]}`;
+}
+function renderBody$1(report, home) {
+	const { executable } = report;
+	const notes = [];
+	if (!executable.command) notes.push(`<p class="prb-settings-help" role="alert">No <code>${CLI_COMMAND}</code> command on your PATH starts this copy of PR Review Buddy
+      (<code>${escapeHtml$1(homeRelative(executable.entry, home))}</code>), so it cannot be connected from here. Install it with
+      <code>npm install -g ${CLI_COMMAND}</code>, then reload this page. The command to connect by hand names this copy's own
+      file, which moves when it is upgraded.</p>`);
+	else if (executable.shadowedBy.length > 0) notes.push(`<p class="prb-settings-help">A plain <code>${CLI_COMMAND}</code> in your shell starts a different copy
+      (<code>${escapeHtml$1(homeRelative(executable.shadowedBy[0], home))}</code>). AI integrations use
+      <code>${escapeHtml$1(homeRelative(executable.command, home))}</code>, which is this one.</p>`);
+	const rows = report.integrations.map((status) => renderIntegrationRow(status, report, home)).join("\n");
+	return `${notes.join("\n")}
+    <ul class="prb-integrations-list">
+${rows}
+    </ul>
+    <p class="prb-settings-help">A change reaches new agent sessions only. Sessions already open keep the tools they started with.</p>`;
+}
+function renderIntegrationRow(status, report, home) {
+	const name = escapeHtml$1(status.displayName);
+	const stable = report.executable.command !== null;
+	const config = escapeHtml$1(homeRelative(status.configPath, home));
+	const button = (action, label, primary = false) => `<button type="button" class="${primary ? "prb-integration-primary" : "prb-integration-button"}" data-integration-action="${action}">${label}</button>`;
+	const copy = `<button type="button" class="prb-integration-button" data-integration-copy>Copy command</button>`;
+	const actions = [];
+	let detail = "";
+	switch (status.state) {
+		case "not-installed":
+			detail = `${name} is not installed on this machine. Install it, then reload this page to connect it.`;
+			actions.push(copy);
+			break;
+		case "not-connected":
+			if (stable) actions.push(button("connect", `Connect to ${name}`, true));
+			actions.push(copy);
+			break;
+		case "connected":
+			actions.push(button("verify", "Verify connection", true), button("disconnect", "Disconnect"));
+			break;
+		case "connected-elsewhere":
+			detail = `${name} starts <code>${escapeHtml$1(homeRelative(status.registered?.command ?? "", home))}${status.registered?.args.length ? ` ${escapeHtml$1(status.registered.args.join(" "))}` : ""}</code>, which is not this copy of PR Review Buddy.`;
+			if (stable) actions.push(button("replace", "Replace…", true));
+			actions.push(button("verify", "Verify connection"), button("disconnect", "Disconnect"));
+			break;
+		case "disabled":
+			detail = `PR Review Buddy is registered but turned off in <code>${config}</code>, so ${name} does not start it.
+      Turn it on in that file, or disconnect it and connect again.`;
+			actions.push(button("verify", "Verify connection"), button("disconnect", "Disconnect"));
+			break;
+		case "unknown":
+			detail = escapeHtml$1(status.reason ?? "Its config could not be read.");
+			actions.push(copy);
+	}
+	const registered = status.registered ? `${status.registered.command} ${status.registered.args.join(" ")}`.trim() : "";
+	return `      <li class="prb-integration" data-integration="${escapeHtml$1(status.agent)}" data-state="${status.state}"
+        data-name="${name}" data-config="${config}" data-add-command="${escapeHtml$1(status.addCommand)}"
+        data-remove-command="${escapeHtml$1(status.removeCommand)}" data-registered="${escapeHtml$1(registered)}">
+        <div class="prb-integration-head">
+          <span class="prb-integration-name">${name}</span>
+          <span class="prb-integration-state" data-state="${status.state}">${STATE_LABEL[status.state]}</span>
+        </div>
+        <p class="prb-settings-help">${status.profileVariable ? `Default ${name} config, ` : `${name} config, `}<code>${config}</code></p>
+        ${detail ? `<p class="prb-settings-help">${detail}</p>` : ""}
+        <div class="prb-integration-actions">${actions.join("")}</div>
+        <p class="prb-integration-result" data-integration-result role="status" aria-live="polite"></p>
+        <details class="prb-integration-manual">
+          <summary>Connect by hand</summary>
+          <pre><code>${escapeHtml$1(status.addCommand)}</code></pre>
+          <p class="prb-settings-help">To disconnect: <code>${escapeHtml$1(status.removeCommand)}</code></p>
+        </details>
+        ${status.profileVariable ? renderProfile(status) : ""}
+      </li>`;
+}
+/**
+* For an agent with profiles. The row above manages the default one only, by decision: guessing at
+* which directories are profiles would be inventing a convention some people do not follow.
+*/
+function renderProfile(status) {
+	const variable = escapeHtml$1(status.profileVariable ?? "");
+	const name = escapeHtml$1(status.displayName);
+	return `<details class="prb-integration-manual" data-integration-profile data-profile-variable="${variable}"
+          data-profile-add-command="${escapeHtml$1(status.profileAddCommand ?? "")}">
+          <summary>Using a different ${name} profile?</summary>
+          <p class="prb-settings-help">The status above is for the default config only. A profile kept in its
+          own directory (selected with <code>${variable}</code>) has its own list of servers. Enter that directory
+          to get the command that connects it.</p>
+          <label class="prb-field prb-settings-field">
+            <span>Profile directory</span>
+            <input type="text" data-profile-dir autocomplete="off" spellcheck="false">
+          </label>
+          <pre hidden data-profile-output><code data-profile-command></code></pre>
+          <button type="button" class="prb-integration-button" data-profile-copy hidden>Copy command</button>
+        </details>`;
+}
+/** One confirmation for every action that changes an agent's config, filled in by the client. */
+function renderIntegrationDialog() {
+	return `<dialog class="prb-dialog prb-integration-dialog" data-integration-dialog aria-labelledby="prb-integration-dialog-title">
+  <h2 id="prb-integration-dialog-title" data-integration-dialog-title></h2>
+  <p data-integration-dialog-body></p>
+  <pre><code data-integration-dialog-command></code></pre>
+  <p class="prb-dialog-reassure" data-integration-dialog-note></p>
+  <div class="prb-dialog-actions">
+    <button type="button" data-integration-cancel>Cancel</button>
+    <button type="button" class="prb-dialog-primary" data-integration-confirm></button>
+  </div>
+</dialog>`;
+}
+/** The key "Not now" stores in `dismissedNotices`. One notice, ever: it names no fact that can change. */
+var INTEGRATIONS_NOTICE_KEY = "integrations:offer";
+/**
+* Whether a review page should mention AI integrations, and which agents to name if so.
+*
+* Only once the guided tour has been answered, so it never competes with the tour; it reaches
+* somebody who answered the tour long ago just the same. Only on a finished review, where reading
+* it from an agent is something they could do next. Only when every agent's state is known, at
+* least one is installed and none is registered at all: an integration nobody here can use is not
+* worth interrupting a review for, and one already set up needs no advert. Returns null for no.
+*/
+function integrationsNoticeFor(input) {
+	if (!input.live || !input.hasResult || !input.tourAnswered) return null;
+	if (input.dismissed?.includes("integrations:offer")) return null;
+	const rows = input.report?.integrations ?? [];
+	if (rows.length === 0 || rows.some((row) => row.state === "unknown")) return null;
+	if (rows.some((row) => row.state === "connected" || row.state === "connected-elsewhere" || row.state === "disabled")) return null;
+	const installed = rows.filter((row) => row.state === "not-connected");
+	return installed.length > 0 ? installed.map((row) => row.displayName) : null;
+}
+function renderIntegrationsNotice(names) {
+	return `<div class="prb-job prb-integrations-notice" role="status" data-notice>
+  <p><strong>Use PR Review Buddy from ${names.map(escapeHtml$1).join(" or ")}.</strong> Your coding agent can read this review and
+  investigate its findings without opening the browser.</p>
+  <a class="prb-integrations-notice-link" href="/settings#${INTEGRATIONS_ANCHOR}" data-notice-dismiss="${INTEGRATIONS_NOTICE_KEY}">Set up integration</a>
+  <button type="button" class="prb-fresh-dismiss" data-notice-dismiss="${INTEGRATIONS_NOTICE_KEY}">Not now</button>
+</div>`;
+}
+//#endregion
 //#region ../../packages/review-harness/src/workspace/reviews_index.ts
 /**
 * The sections of the list, top to bottom.
@@ -395,16 +643,6 @@ function ordersExplicitly(filter) {
 	return filter === "queue";
 }
 /**
-* The lifecycle chip on a card, or absent.
-*
-* In a lifecycle section the heading already names the lifecycle, so the chip only says what moved
-* (`lifecycleChip`). In Pinned nothing names it, so the chip does, in the words the review page's
-* pill uses: the list and the page give one answer about the same review.
-*/
-function cardLifecycleChip(pinned, lifecycle, activity) {
-	return pinned ? lifecyclePill(lifecycle, activity)?.text : lifecycleChip(lifecycle, activity);
-}
-/**
 * "45 reviews · 13 branches", and "13 reviews" when those are the same thirteen things.
 *
 * The two numbers are different questions and only both worth asking once they differ. A page of
@@ -497,6 +735,13 @@ function statusLabel(status) {
 	return status === "in-progress" ? "Not reviewed" : "New";
 }
 /**
+* The status pill's accessible name: where the reviewer is, then what pressing it does. The visible
+* words are the state, so a screen reader hears both rather than only a state it cannot act on.
+*/
+function statusPillLabel(status) {
+	return `${statusLabel(status)}. Mark as ${status === "complete" ? "not reviewed" : "reviewed"}`;
+}
+/**
 * The bulk bar's way to tick everything the filters show, across pages.
 *
 * Counted ("Select all 7") only while the headline is not already saying "of 7", so the number is
@@ -758,6 +1003,47 @@ function renderFeedbackDraftBody() {
   </div>`;
 }
 //#endregion
+//#region ../../packages/review-harness/src/workspace/state_pills.ts
+/**
+* The two pills that say where a review stands, and change it: status (what the reviewer has done)
+* and lifecycle (what happens next). Drawn on every Reviews card and in the review page's header,
+* from this one module, so the two places cannot disagree in words, shape or behaviour.
+*
+* Pure, with no node builtins: the server renders the markup and both pages' scripts repaint it
+* from an answer, through `paintStatusPill` and `paintLifecyclePill`.
+*
+* The pills are shortcuts for the `…` menu's items, never a second set of rules. The status pill is
+* the menu's Mark reviewed / Mark not reviewed. The lifecycle pill is Mark done on Active and Move
+* to active on Done. On Waiting it opens the lifecycle items the menu would offer (`offersLifecycle`),
+* because Waiting has more than one way out and a toggle would have to guess which.
+*
+* Every lifecycle draws a pill, Active included. The pill names the stored state only; why a parked
+* card is back in Active is the change chip's job (`lifecycleChip`), a separate fact.
+*/
+/** The status pill as a button. `attributes` carries whatever the page needs to find it by. */
+function statusPillHtml(status, attributes = "") {
+	return `<button type="button" class="prb-card-status prb-state-pill" data-status="${status}"${attributes} aria-label="${escapeHtml$1(statusPillLabel(status))}">${statusLabel(status)}</button>`;
+}
+/**
+* The lifecycle pill. Interactive, it is a button inside a `[data-menu]`, which the shared menus
+* open only while the pill is a trigger (Waiting); otherwise the page acts on the press directly.
+* The panel ships with all three items so a repaint never builds markup. Not interactive (an older
+* review in a lineage, where lifecycle is not offered), it is a span that only says.
+*/
+function lifecycleControlHtml(lifecycle, activity, options) {
+	const state = lifecycle?.state ?? "active";
+	const name = escapeHtml$1(lifecycleName$1(lifecycle));
+	const attributes = options.attributes ?? "";
+	if (!options.interactive) return `<span class="prb-state-pill prb-lifecycle-pill" data-lifecycle-pill="${state}"${attributes}>${name}</span>`;
+	const action = lifecyclePillAction(lifecycle);
+	const trigger = action === "menu" ? " data-menu-trigger aria-haspopup=\"true\" aria-expanded=\"false\"" : "";
+	const items = LIFECYCLES.map(({ id }) => `<button type="button" class="prb-menu-item" data-lifecycle-set="${id}"${offersLifecycle(id, lifecycle, activity) ? "" : " hidden"}>${escapeHtml$1(lifecycleItemLabel(id, lifecycle, activity))}</button>`).join("");
+	return `<div class="prb-menu prb-pill-menu" data-menu data-lifecycle-control>
+      <button type="button" class="prb-state-pill prb-lifecycle-pill" data-lifecycle-pill="${state}" data-lifecycle-press="${action}"${attributes}${trigger} aria-label="${escapeHtml$1(lifecyclePillLabel(lifecycle))}">${name}</button>
+      <div class="prb-menu-panel" data-menu-panel hidden>${items}</div>
+    </div>`;
+}
+//#endregion
 //#region ../../packages/review-harness/src/workspace/way_back.ts
 var CLI = {
 	command: "prreviewbuddy open",
@@ -1352,63 +1638,6 @@ function renderFindingExplanation(explanation, options = {}) {
       </details>`;
 }
 //#endregion
-//#region ../../packages/review-harness/src/domain/ai_review/finding_ref.ts
-var PREFIX = {
-	issue: "I",
-	question: "Q"
-};
-function findingRef(kind, index) {
-	return `${PREFIX[kind]}${index + 1}`;
-}
-/** Every finding's reference by its id, for a renderer that meets the findings out of order. */
-function findingRefs(result) {
-	const refs = /* @__PURE__ */ new Map();
-	result.issues.forEach((issue, index) => refs.set(`issue:${issue.id}`, findingRef("issue", index)));
-	result.questions.forEach((question, index) => refs.set(`question:${question.id}`, findingRef("question", index)));
-	return refs;
-}
-/** The reference of one finding, or undefined when the analysis does not hold it. */
-function refOf(refs, kind, id) {
-	return refs.get(`${kind}:${id}`);
-}
-/**
-* The finding a reference names, or null. Only the exact form (`I3`, `q2` is accepted as `Q2`):
-* a reference out of range names nothing rather than the nearest finding.
-*/
-function findingAtRef(result, ref) {
-	const match = /^([IQ])([1-9]\d*)$/i.exec(ref.trim());
-	if (!match) return null;
-	const index = Number(match[2]) - 1;
-	if (match[1].toUpperCase() === "I") {
-		const finding = result.issues[index];
-		return finding === void 0 ? null : {
-			kind: "issue",
-			index,
-			finding
-		};
-	}
-	const finding = result.questions[index];
-	return finding === void 0 ? null : {
-		kind: "question",
-		index,
-		finding
-	};
-}
-/**
-* The review a set of references belongs to: `PRB-` and the first eight characters of the analysis's
-* session id. An update keeps the session, and so its references; a fresh analysis or a reanalysis
-* starts a new session and numbers its findings again, so its tag differs. A feedback draft carries
-* it, and Reconcile reads it back, so a reply to an older draft is never read against findings that
-* a later analysis happens to number the same way.
-*/
-function reviewTag(sessionId) {
-	return `PRB-${sessionId.replace(/[^a-z0-9]/gi, "").slice(0, 8).toLowerCase()}`;
-}
-/** Every review tag in a text, as `reviewTag` writes them. */
-function reviewTagsIn(text) {
-	return [...new Set([...text.matchAll(/\bPRB-([a-z0-9]{8})\b/gi)].map((match) => `PRB-${match[1].toLowerCase()}`))];
-}
-//#endregion
 //#region ../../packages/review-harness/src/domain/ui/components/pill_tooltips.ts
 /**
 * What every pill in the sidebar actually means, in one place.
@@ -1879,158 +2108,6 @@ var AUTHOR_CONTEXT_PREVIEW_ID = "pr-helper-author-context-preview";
 var SHOW_FULL_DESCRIPTION = "View full PR description";
 var AUTHOR_CONTEXT_SECTION_ID = "pr-helper-author-context";
 //#endregion
-//#region ../../packages/review-harness/src/domain/utils/model_label.ts
-var KNOWN_BRANDS = {
-	gpt: "GPT",
-	claude: "Claude"
-};
-var isNumericToken = (token) => /^\d+(\.\d+)?$/.test(token);
-/**
-* Tokens that are initialisms rather than words, so title case is wrong for them.
-*
-* Needed once agent ids reached this function: `gemini-cli` came out as "Gemini Cli", which is a
-* misspelling of the product's name on a line that exists to say which product made the review.
-* Kept to genuine initialisms, because this transform's whole value is that it knows nothing about
-* which models exist and so never goes stale.
-*/
-var INITIALISMS = /* @__PURE__ */ new Set([
-	"cli",
-	"api",
-	"sdk"
-]);
-function titleCase$1(token) {
-	if (INITIALISMS.has(token.toLowerCase())) return token.toUpperCase();
-	return token.charAt(0).toUpperCase() + token.slice(1);
-}
-function humanizeModelId(id) {
-	const tokens = id.split("-").filter(Boolean);
-	if (tokens.length === 0) return id;
-	const [brandToken, ...rest] = tokens;
-	let display = KNOWN_BRANDS[brandToken.toLowerCase()] ?? titleCase$1(brandToken);
-	let prevWasNumeric = false;
-	rest.forEach((token, index) => {
-		const numeric = isNumericToken(token);
-		if (numeric && prevWasNumeric) display += `.${token}`;
-		else if (numeric && index === 0) display += `-${token}`;
-		else display += ` ${numeric ? token : titleCase$1(token)}`;
-		prevWasNumeric = numeric;
-	});
-	return display;
-}
-//#endregion
-//#region ../../packages/review-harness/src/domain/utils/agent_label.ts
-/**
-* What a person is shown when a review names the tool that produced it.
-*
-* Here in the domain rather than read off `AgentIdentity.displayName`, because this runs in the
-* extension bundle and the adapter registry reaches `node:child_process`. Deriving the label from
-* the stored `agentId` keeps the client free of node builtins and adds no stored field.
-*
-* A closed set of this product's own adapter ids, which is not the kind of table that goes stale
-* invisibly: adding an adapter is our own act, and anything unrecognised still renders through
-* `humanizeModelId` rather than disappearing. That is why this is not folded into
-* `humanizeModelId` itself, whose value is knowing nothing about which names exist.
-*/
-var AGENT_DISPLAY_NAMES = {
-	claude: "Claude Code",
-	codex: "Codex",
-	gemini: "Gemini CLI"
-};
-/**
-* Absent reads as Claude, matching `agentIdOf` and `agentName`: a session written before agents
-* were selectable ran under Claude, and showing it as unknown would invent a gap in the oldest
-* reviews on disk.
-*/
-var DEFAULT_AGENT_DISPLAY_NAME = AGENT_DISPLAY_NAMES.claude;
-function agentDisplayName(agentId) {
-	if (!agentId) return DEFAULT_AGENT_DISPLAY_NAME;
-	return AGENT_DISPLAY_NAMES[agentId] ?? humanizeModelId(agentId);
-}
-//#endregion
-//#region ../../packages/review-harness/src/domain/ai_review/model_provenance.ts
-/**
-* Values `model` carried when it meant "which agent", before the field was frozen.
-*
-* A closed set of three of our own historical strings, not a catalogue of vendor models, so it
-* never grows and never goes stale. It lives here rather than in `humanizeModelId` on purpose:
-* the corruption belongs to how sessions were once written, and that label function's whole value
-* is knowing nothing about which models exist.
-*/
-var LEGACY_AGENT_IDS = /* @__PURE__ */ new Set([
-	"codex",
-	"claude-code",
-	"gemini-cli"
-]);
-var present = (value) => typeof value === "string" && value !== "" ? value : null;
-function modelProvenanceOf(session) {
-	return {
-		requestedModel: present(session.requestedModel) ?? legacyModel(session.model),
-		observedModel: present(session.observedModel),
-		agentVersion: present(session.agentVersion)
-	};
-}
-/**
-* A legacy `model`, read as a request or discarded.
-*
-* The extension put the model it was about to call into this field, so for its sessions the value
-* really is what was requested. The CLI put an agent id there, which is not a model at all and is
-* dropped rather than displayed: showing "Reviewed with Codex, model Codex" would be the record
-* inventing provenance out of its own filing.
-*/
-function legacyModel(model) {
-	const value = present(model);
-	if (value === null || LEGACY_AGENT_IDS.has(value)) return null;
-	return value;
-}
-/**
-* Whether a coding agent made this, as opposed to the extension calling a provider API.
-*
-* The awkward case is a session with no `agentId` at all, because two different producers leave it
-* empty. A CLI review from before agents were selectable means Claude, which is why
-* `agentDisplayName` defaults that way. An extension review means no agent ran at all, and naming
-* one would credit Claude Code for somebody's OpenAI review.
-*
-* The legacy sentinel tells them apart, which is the last job that field has: only the CLI ever
-* wrote one, so a record with no agent id and no sentinel came from the extension.
-*/
-function producedByAgent(session) {
-	if (session.agentId) return true;
-	const legacy = present(session.model);
-	return legacy !== null && LEGACY_AGENT_IDS.has(legacy);
-}
-/**
-* The full provenance, for the disclosure rather than the page.
-*
-* Opens with "Reviewed with X" rather than "Agent: X", keeping the sentence that was already here:
-* a review is not owned by an agent, it holds analyses, and this names the one being shown.
-*
-* The line that earns this list its place is the last one: a pinned model that nobody confirmed.
-* `--model X` states what we asked for, and on an agent that reports nothing back there is no way
-* to know it was honoured, so the pin is shown alongside the fact that it is unverified. Without
-* that line a reader would take a requested model for a measured one, which is the overstatement
-* this whole split exists to prevent.
-*
-* Said only when something was pinned. On an unpinned run there is no claim outstanding, and a
-* standing "not reported" would be noise on every review anybody ever runs.
-*
-* Both sentences that name an agent are withheld from a review no agent produced, through the same
-* `producedByAgent` distinction `attributionLabel` makes. An extension review has no agent id, and
-* naming one anyway credited Claude Code for somebody's OpenAI review and then reported that Claude
-* Code had not confirmed a model nobody had asked it for. What remains for such a review is the
-* model it requested and the model that answered, which is the whole of what is known about it.
-*/
-function provenanceDetailLines(session) {
-	const agent = producedByAgent(session) ? agentDisplayName(session.agentId) : null;
-	const { requestedModel, observedModel, agentVersion } = modelProvenanceOf(session);
-	return [
-		...agent ? [`Reviewed with ${agent}`] : [],
-		...agentVersion ? [`Agent version ${agentVersion}`] : [],
-		...requestedModel ? [`Requested model ${humanizeModelId(requestedModel)}`] : [],
-		...observedModel ? [`Reported model ${humanizeModelId(observedModel)}`] : [],
-		...agent && requestedModel && !observedModel ? [`Reported model not reported by ${agent}`] : []
-	];
-}
-//#endregion
 //#region ../../packages/review-harness/src/domain/ai_review/investigation_record.ts
 /**
 * The records for one finding, oldest first. Records accumulate: every "Investigate Again" appends.
@@ -6465,7 +6542,7 @@ ${renderReviewBar(view, freshness)}
 ${showsProgress(view) || updating(view) ? "" : renderJobState(view.job ?? null, {
 		dismissed: view.dismissedNotices,
 		canDismiss: view.token !== void 0
-	})}
+	})}${view.integrationsNotice?.length ? `\n${renderIntegrationsNotice(view.integrationsNotice)}` : ""}
 <div class="prb-fresh-region" data-fresh-region${freshness ? ` data-report="${escapeHtml$1(JSON.stringify(freshness))}"` : ""}${view.availability ? ` data-availability="${escapeHtml$1(JSON.stringify(view.availability))}"` : ""}${view.remote ? ` data-remote="${escapeHtml$1(JSON.stringify(view.remote))}"` : ""}${view.dismissedFreshnessSha ? ` data-dismissed-sha="${escapeHtml$1(view.dismissedFreshnessSha)}"` : ""}>${renderFreshness(freshness ?? null, {
 		dismissedSha: view.dismissedFreshnessSha,
 		actions: view.token !== void 0 && !updating(view),
@@ -6942,20 +7019,30 @@ function renderReviewBar(view, freshness) {
 </div>`;
 }
 /**
-* Where this review stands, as pills that say and never do.
+* Where this review stands, as two pills that say it and change it.
 *
 * Two, because they answer two questions. Reviewed or Not reviewed is what the reviewer has done;
-* Waiting or Done is what happens next with the branch. A review can be Reviewed and Waiting, so a
-* single pill would have to drop one of them. Active draws nothing, as an open pull request does
-* not: it is where every review starts, and a pill that never varies teaches nothing.
+* Active, Waiting or Done is what happens next with the branch. A review can be Reviewed and
+* Waiting, so a single pill would have to drop one of them. Each is a shortcut for its `…` items
+* (see `state_pills.ts`); the lifecycle pill acts only where those items are offered, on the newest
+* review of the branch, and on an older one only says.
+*
+* Why a parked review has moved is its own chip beside them, the card's chip, never the pill's text.
 *
 * Never "New" here, because being on this page is what ends it.
 */
 function renderStatePills(view) {
 	const status = view.complete ? "complete" : "in-progress";
-	const pill = lifecyclePill(view.lifecycle, view.activity);
-	return `<span class="prb-card-status" data-status="${status}" data-page-status>${statusLabel(status)}</span>
-    <span class="prb-card-status prb-page-lifecycle" data-page-lifecycle${pill?.changed ? " data-changed" : ""}${pill ? "" : " hidden"}>${escapeHtml$1(pill?.text ?? "")}</span>`;
+	const latest = !view.lineage || view.lineage.position >= view.lineage.total;
+	const chip = lifecycleChip(view.lifecycle, view.activity);
+	return `<span class="prb-state-pills">
+    ${statusPillHtml(status, " data-page-status")}
+    ${lifecycleControlHtml(view.lifecycle, view.activity, {
+		interactive: latest,
+		attributes: " data-page-lifecycle"
+	})}
+    <span class="prb-card-lifecycle" data-page-lifecycle-chip${chip === void 0 ? " hidden" : ""}>${escapeHtml$1(chip ?? "")}</span>
+  </span>`;
 }
 /**
 * Everything that can be done to this review, from the page you are reading it on.
@@ -10438,7 +10525,7 @@ function renderOperation(operation, review, positions, prStates, now, collection
 	const branch = review ? followedRefName(review.branch, review.headResolvedRef) ?? review.branch : row?.branch;
 	const prState = prNumber !== void 0 && repoPath ? prStates?.get(requestKey(repoPath, prNumber)) : void 0;
 	const queued = own ? positions.get(own.id) : void 0;
-	const status = own ? statusOf(own) : "new";
+	const status = own ? statusOf$1(own) : "new";
 	const search = [
 		review ? searchText(review) : "",
 		row?.label ?? "",
@@ -10535,7 +10622,10 @@ function renderBulkBar() {
 * this branch as far as the product knows; the earlier ones are history and are folded away until
 * asked for.
 *
-* The checkbox sits outside the link, like the pin and the menu and for the same reason: it is a
+* The two pills, the menu and the pin are one row of controls over the card's top-right corner,
+* outside its link and after it, so a reader meets the title first and then what can be done to it:
+* where the reviewer is, what happens next, then the menu and the star. Outside because a button inside a link is not a thing HTML has, and a press on any of
+* them must never open the review. The checkbox sits outside the link for the same reason: it is a
 * control on the row rather than a way into the review. It is named by its branch, because fifteen
 * boxes announcing themselves as "Select" are fifteen identical announcements. It ships on every
 * card and is shown only in selection mode, so entering that mode is a stylesheet change rather
@@ -10551,18 +10641,15 @@ function renderCard(group, now, activity, rank, analysis, queued, moved, prState
 	const placement = instance.placement === "home" ? "home" : `collection:${instance.placement.collection}`;
 	const line = collectionsLine(instance.memberOf, instance.refs, instance.placement === "home" ? void 0 : instance.placement.collection);
 	const hidden = inProgressOnly || instance.hidden;
-	const status = statusOf(review);
-	const chip = cardLifecycleChip(review.pinned === true, review.lifecycle, activity);
+	const status = statusOf$1(review);
+	const chip = lifecycleChip(review.lifecycle, activity);
 	const href = `/r/${encodeURIComponent(review.id)}?t=${encodeURIComponent(review.token)}`;
 	const followed = review.targetType === "commit" ? `commit ${(review.commitSha ?? review.branch).slice(0, 7)}` : followedRefName(review.branch, review.headResolvedRef) ?? review.branch;
 	return `<article class="prb-card" data-card data-id="${escapeHtml$1(review.id)}" data-status="${status}" data-pinned="${review.pinned}"${queued === void 0 ? "" : ` data-queue="${queued}"`}${prState === void 0 ? "" : ` data-pr-state="${prState}"`}${review.authorHandle ? ` data-author="${escapeHtml$1(review.authorHandle)}"` : ""} data-lifecycle="${review.lifecycle?.state ?? "active"}"${review.lifecycle ? ` data-lifecycle-at="${review.lifecycle.at}"` : ""}${activityAttributes(activity)} data-rank="${rank}" data-reviews="${group.history.length}" data-lineage="${escapeHtml$1(group.history.map((entry) => entry.id).join(" "))}" data-search-text="${escapeHtml$1(groupSearchText(group))}" data-placement="${escapeHtml$1(placement)}" data-collections="${escapeHtml$1(instance.memberOf.join(" "))}"${inProgressOnly ? " data-in-progress-only" : ""}${hidden ? " hidden" : ""}>
     <input type="checkbox" class="prb-card-select" data-select="${escapeHtml$1(review.id)}" aria-label="Select ${escapeHtml$1(followed)}">
-    <button type="button" class="prb-card-pin" data-pin="${escapeHtml$1(review.id)}" aria-pressed="${review.pinned}" aria-label="${review.pinned ? "Unpin" : "Pin"} this review">${review.pinned ? "&#9733;" : "&#9734;"}</button>
-    ${renderCardMenu(group, followed, queued !== void 0, status, activity)}
     <a class="prb-card-link" href="${escapeHtml$1(href)}">
       <div class="prb-card-head">
         <h2>${escapeHtml$1(review.title)}</h2>
-        ${renderStatus(status)}
         ${renderPrState(prState)}
         ${`<span class="prb-card-lifecycle" data-lifecycle-chip${chip === void 0 ? " hidden" : ""}>${escapeHtml$1(chip ?? "")}</span>`}
       </div>
@@ -10579,12 +10666,18 @@ function renderCard(group, now, activity, rank, analysis, queued, moved, prState
         ${moved ? `<span class="prb-card-moved">${moved === "branch" ? "Branch updated" : "PR updated"}</span>` : ""}
         <span>${review.changedFiles} file${review.changedFiles === 1 ? "" : "s"}</span>
         <span class="prb-card-diffstat"><span class="prb-add">+${review.additions}</span> <span class="prb-del">&minus;${review.deletions}</span></span>
-        ${analysis !== void 0 && !review.hasStandardReview ? "" : `<span class="prb-card-left">${escapeHtml$1(whatIsLeft(review))}</span>`}
+        ${analysis !== void 0 && !review.hasStandardReview ? "" : `<span class="prb-card-left">${renderLeft(whatIsLeft(review))}</span>`}
         ${renderAnalysisState(analysis)}
         <span class="prb-card-collections" data-collections-line${line === void 0 ? " hidden" : ""}>${escapeHtml$1(line ?? "")}</span>
         <span class="prb-card-when"><time datetime="${new Date(activity.at).toISOString()}" title="${escapeHtml$1(new Date(activity.at).toLocaleString())}">${escapeHtml$1(`${activityLabel(activity.kind)} ${relativeTime(activity.at, now)}`)}</time></span>
       </p>
     </a>
+    <div class="prb-card-controls">
+      ${statusPillHtml(status)}
+      ${lifecycleControlHtml(review.lifecycle, activity, { interactive: true })}
+      ${renderCardMenu(group, followed, queued !== void 0, status, activity)}
+      <button type="button" class="prb-card-pin" data-pin="${escapeHtml$1(review.id)}" aria-pressed="${review.pinned}" aria-label="${review.pinned ? "Unpin" : "Pin"} this review">${review.pinned ? "&#9733;" : "&#9734;"}</button>
+    </div>
     ${renderHistory(group, now)}
   </article>`;
 }
@@ -10735,7 +10828,7 @@ function renderHistoryRow(review, number, latest, now) {
       <span class="prb-card-history-name">Review ${number} ${latest ? "<span class=\"prb-card-history-latest\">Latest</span>" : "<span class=\"prb-card-history-previous\">Previous</span>"}</span>
       ${review.commitSha ? `<code class="prb-card-history-sha" title="${escapeHtml$1(review.commitSha)}">${escapeHtml$1(review.commitSha.slice(0, 7))}</code>` : ""}
       <span class="prb-card-history-when">${escapeHtml$1(relativeTime(review.createdAt, now))}</span>
-      ${latest ? renderStatus(statusOf(review)) : ""}
+      ${latest ? renderStatus(statusOf$1(review)) : ""}
     </a>
   </li>`;
 }
@@ -10770,14 +10863,30 @@ function renderAnalysisState(analysis) {
 * product does not track file-by-file review, so the card does not pretend it does.
 */
 function whatIsLeft(review) {
-	if (!review.hasStandardReview) return "No standard review yet";
+	if (!review.hasStandardReview) return [{ text: "No standard review yet" }];
 	const parts = [];
-	if (review.openIssues > 0) parts.push(`${review.openIssues} issue${review.openIssues === 1 ? "" : "s"}`);
-	else if (review.issues > 0) parts.push("all issues resolved");
-	if (review.unansweredQuestions > 0) parts.push(`${review.unansweredQuestions} unanswered question${review.unansweredQuestions === 1 ? "" : "s"}`);
-	else if (review.questions > 0) parts.push("all questions answered");
-	if (review.messages > 0) parts.push(`${review.messages} Buddy AI message${review.messages === 1 ? "" : "s"}`);
-	return parts.length > 0 ? parts.join(" · ") : "Nothing flagged";
+	if (review.openIssues > 0) parts.push({
+		text: `${review.openIssues} issue${review.openIssues === 1 ? "" : "s"}`,
+		tone: "attention"
+	});
+	else if (review.issues > 0) parts.push({
+		text: "Issues resolved",
+		tone: "success"
+	});
+	if (review.unansweredQuestions > 0) parts.push({
+		text: `${review.unansweredQuestions} unanswered question${review.unansweredQuestions === 1 ? "" : "s"}`,
+		tone: "attention"
+	});
+	else if (review.questions > 0) parts.push({
+		text: "Questions answered",
+		tone: "success"
+	});
+	if (review.messages > 0) parts.push({ text: `${review.messages} Buddy AI message${review.messages === 1 ? "" : "s"}` });
+	return parts.length > 0 ? parts : [{ text: "Nothing flagged" }];
+}
+/** The parts as the meta line draws them: a badge where there is a tone, plain words otherwise. */
+function renderLeft(parts) {
+	return parts.map((part) => part.tone === void 0 ? `<span>${escapeHtml$1(part.text)}</span>` : `<span class="prb-card-badge" data-tone="${part.tone}">${part.tone === "success" ? "<span aria-hidden=\"true\">✓</span> " : ""}${escapeHtml$1(part.text)}</span>`).join("");
 }
 /**
 * Three states, and only one of them is inferred from anything.
@@ -10786,7 +10895,7 @@ function whatIsLeft(review) {
 * like completion — questions ticked, issues read — means the checklist is empty, which is not
 * the same as being done; a reviewer can still be reading code with nothing left to tick.
 */
-function statusOf(review) {
+function statusOf$1(review) {
 	if (review.completedAt) return "complete";
 	return review.lastViewedAt ? "in-progress" : "new";
 }
@@ -11366,6 +11475,8 @@ ${renderWorkspaceRail({
   Run <code>prreviewbuddy config path</code> to be told where that file is. Appearance is kept with
   the workspace's other display choices in <code>~/.prreviewbuddy/ui.json</code>.</p>
 
+  ${view.integrations === void 0 ? "" : renderIntegrationsSection(view.integrations, view.home)}
+
   ${renderServerSection()}
 </main>
 </div>
@@ -11479,6 +11590,486 @@ function renderPrivacySection(settings) {
   </section>`;
 }
 //#endregion
+//#region ../../packages/review-harness/src/integrations/handshake.ts
+/**
+* Asking a registered PR Review Buddy command to answer, before it is registered and when a person
+* asks whether a registration works.
+*
+* The one place outside the four spawners that starts a process, and it only ever starts PR Review
+* Buddy itself: the command an agent's config names, or the one about to be written there. Never a
+* shell, and never anything the browser named: every command reaching here was read from an
+* agent's config or chosen by `chooseExecutable`.
+*/
+var VERSION_TIMEOUT_MS = 1e4;
+var HANDSHAKE_TIMEOUT_MS = 1e4;
+/** The version `command --version` prints, or null when it does not answer with one. */
+function commandVersion(command, env) {
+	return new Promise((resolvePromise) => {
+		execFile(command, ["--version"], {
+			env,
+			encoding: "utf8",
+			timeout: VERSION_TIMEOUT_MS
+		}, (error, stdout) => {
+			resolvePromise(error ? null : versionFrom(stdout) ?? null);
+		});
+	});
+}
+/** The protocol revision asked for. A server that speaks another one says so in its answer. */
+var PROTOCOL_VERSION = "2025-06-18";
+/**
+* Start the server the way an agent would, say `initialize` and list its tools, then close its
+* stdin, which is how every MCP client ends a stdio session. Proves the command answers as an MCP
+* server; it cannot prove an agent has loaded it, which only a new agent session does.
+*/
+function mcpHandshake(command, args, env, timeoutMs = HANDSHAKE_TIMEOUT_MS) {
+	return new Promise((resolvePromise) => {
+		let settled = false;
+		let buffered = "";
+		let stderr = "";
+		let server = null;
+		const child = spawn(command, [...args], {
+			env,
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			]
+		});
+		const finish = (result) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			child.stdin.end();
+			setTimeout(() => {
+				if (child.exitCode === null && child.signalCode === null) child.kill("SIGKILL");
+			}, 2e3).unref();
+			resolvePromise(result);
+		};
+		const timer = setTimeout(() => finish({
+			ok: false,
+			reason: `It started but did not answer as an MCP server within ${Math.round(timeoutMs / 1e3)} seconds.`
+		}), timeoutMs);
+		child.on("error", (error) => {
+			const missing = error.code === "ENOENT";
+			finish({
+				ok: false,
+				reason: missing ? `\`${command}\` does not exist.` : `\`${command}\` could not be started: ${error.message}`
+			});
+		});
+		child.stderr.on("data", (chunk) => {
+			stderr += String(chunk);
+		});
+		child.on("close", (code) => {
+			const said = stderr.trim().split("\n").filter(Boolean).pop();
+			finish({
+				ok: false,
+				reason: `It exited with code ${code ?? "none"} before answering${said ? `: ${said}` : "."}`
+			});
+		});
+		child.stdout.on("data", (chunk) => {
+			buffered += String(chunk);
+			let newline;
+			while ((newline = buffered.indexOf("\n")) >= 0) {
+				const line = buffered.slice(0, newline).trim();
+				buffered = buffered.slice(newline + 1);
+				if (!line) continue;
+				let message;
+				try {
+					message = JSON.parse(line);
+				} catch {
+					return finish({
+						ok: false,
+						reason: "It wrote something other than MCP messages to its output."
+					});
+				}
+				if (message.error) return finish({
+					ok: false,
+					reason: `It refused: ${String(message.error.message ?? "no reason given")}`
+				});
+				if (message.id === 1) {
+					const info = message.result?.serverInfo ?? {};
+					server = {
+						name: String(info.name ?? ""),
+						version: String(info.version ?? "")
+					};
+					child.stdin.write(`${JSON.stringify({
+						jsonrpc: "2.0",
+						method: "notifications/initialized"
+					})}\n`);
+					child.stdin.write(`${JSON.stringify({
+						jsonrpc: "2.0",
+						id: 2,
+						method: "tools/list"
+					})}\n`);
+				} else if (message.id === 2 && server) {
+					const tools = Array.isArray(message.result?.tools) ? message.result.tools.map((tool) => String(tool.name ?? "")) : [];
+					return finish({
+						ok: true,
+						name: server.name,
+						version: server.version,
+						tools
+					});
+				}
+			}
+		});
+		child.stdin.on("error", () => {});
+		child.stdin.write(`${JSON.stringify({
+			jsonrpc: "2.0",
+			id: 1,
+			method: "initialize",
+			params: {
+				protocolVersion: PROTOCOL_VERSION,
+				capabilities: {},
+				clientInfo: {
+					name: "prreviewbuddy-settings",
+					version: "1"
+				}
+			}
+		})}\n`);
+	});
+}
+//#endregion
+//#region ../../packages/review-harness/src/integrations/shell_words.ts
+/**
+* argv as one line a person can paste into a POSIX shell. Pure, so the Settings page can build a
+* profile's command in the browser with the same quoting the server uses.
+*/
+var SAFE = /^[A-Za-z0-9_\/.:=@%+,-]+$/;
+function shellQuote(word) {
+	if (word !== "" && SAFE.test(word)) return word;
+	return `'${word.replace(/'/g, `'\\''`)}'`;
+}
+function shellJoin(argv) {
+	return argv.map(shellQuote).join(" ");
+}
+//#endregion
+//#region ../../packages/review-harness/src/integrations/service.ts
+var INTEGRATION_ACTIONS = [
+	"connect",
+	"disconnect",
+	"verify"
+];
+/** One object for the process, so that reads made with the defaults can share one in flight. */
+var defaults = null;
+function defaultIntegrationDeps() {
+	defaults ??= {
+		agents: AGENT_IDS.map(agentById).filter((agent) => agent.mcpRegistration),
+		env: process.env,
+		entry: cliEntry(),
+		version: BUILD_VERSION,
+		commandVersion,
+		handshake: mcpHandshake
+	};
+	return defaults;
+}
+/** The agents that can be integrated, by id. Anything else is not a row and not an action. */
+function integrationAgent(id, deps) {
+	const agent = deps.agents.find((candidate) => candidate.id === id);
+	return agent?.mcpRegistration ? agent : null;
+}
+var SERVE_ENTRY = (command) => ({
+	command,
+	args: [...SERVE_ARGS],
+	env: {}
+});
+function sameArgs(args) {
+	return args.length === SERVE_ARGS.length && args.every((arg, index) => arg === SERVE_ARGS[index]);
+}
+function errorText(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+async function statusOf(agent, executable, deps) {
+	const registration = agent.mcpRegistration;
+	const pin = registration.pinConfig(deps.env);
+	const add = registration.addCommand(SERVE_ENTRY(executable.command ?? executable.entry));
+	const base = {
+		agent: agent.id,
+		displayName: agent.displayName,
+		state: "unknown",
+		configPath: registration.configPath(deps.env),
+		addCommand: shellJoin([...pin, ...add]),
+		removeCommand: shellJoin([...pin, ...registration.removeCommand()]),
+		...registration.profileVariable ? {
+			profileVariable: registration.profileVariable,
+			profileAddCommand: shellJoin(add)
+		} : {}
+	};
+	const availability = await agent.available(agent.captureEnv(deps.env));
+	if (!availability.ok && !availability.found) return {
+		...base,
+		state: "not-installed",
+		reason: availability.reason
+	};
+	let entry;
+	try {
+		entry = await registration.read(deps.env);
+	} catch (error) {
+		return {
+			...base,
+			state: "unknown",
+			reason: `Its config could not be read: ${errorText(error)}`
+		};
+	}
+	if (!entry) return {
+		...base,
+		state: "not-connected"
+	};
+	const registered = {
+		command: entry.command,
+		args: entry.args,
+		env: entry.env
+	};
+	if (entry.disabled) return {
+		...base,
+		state: "disabled",
+		registered
+	};
+	const ours = startsThisInstall(entry.command, deps.entry, deps.env.PATH) && sameArgs(entry.args);
+	return {
+		...base,
+		state: ours ? "connected" : "connected-elsewhere",
+		registered
+	};
+}
+/**
+* Every agent's status, read now. Callers that only want to know share a read already running, so
+* a page loaded twice asks each agent once. `fresh` never shares: after a change, a read that began
+* before it would answer with the config as it was.
+*
+* The cached report is the one that began last, not the one that finished last, so a slow read
+* that started first can never overwrite a newer answer.
+*/
+function integrationsReport(deps = defaultIntegrationDeps(), options = {}) {
+	const running = inFlight$1.get(deps);
+	if (running && !options.fresh) return running;
+	const started = ++reportsStarted;
+	const report = readReport(deps).then((result) => {
+		if (started > lastStarted) {
+			lastStarted = started;
+			last = result;
+		}
+		return result;
+	});
+	inFlight$1.set(deps, report);
+	const settle = () => {
+		if (inFlight$1.get(deps) === report) inFlight$1.delete(deps);
+	};
+	report.then(settle, settle);
+	return report;
+}
+async function readReport(deps) {
+	const executable = chooseExecutable(deps.entry, deps.env.PATH);
+	const integrations = await Promise.all(deps.agents.flatMap((agent) => {
+		const integrable = integrationAgent(agent.id, deps);
+		return integrable ? [statusOf(integrable, executable, deps)] : [];
+	}));
+	return {
+		version: deps.version,
+		executable,
+		integrations
+	};
+}
+var last = null;
+var reportsStarted = 0;
+var lastStarted = 0;
+var inFlight$1 = /* @__PURE__ */ new WeakMap();
+/** The newest report any caller computed, or null before the first. For a page that must not wait. */
+function lastIntegrationsReport() {
+	return last;
+}
+/** One action per agent at a time: two presses of Connect must not run two `add`s. */
+var busy = /* @__PURE__ */ new Set();
+async function runIntegrationAction(agentId, action, options = {}, deps = defaultIntegrationDeps()) {
+	const agent = integrationAgent(agentId, deps);
+	if (!agent) throw new Error(`${agentId} cannot be connected to PR Review Buddy.`);
+	const executable = chooseExecutable(deps.entry, deps.env.PATH);
+	if (busy.has(agent.id)) return {
+		outcome: "refused",
+		message: `${agent.displayName} is already being changed. Wait for that to finish.`,
+		status: await statusOf(agent, executable, deps)
+	};
+	busy.add(agent.id);
+	try {
+		const status = await statusOf(agent, executable, deps);
+		const result = action === "connect" ? await connect(agent, status, executable, options.replace === true, deps) : action === "disconnect" ? await disconnect(agent, status, executable, deps) : await verify(agent, status, deps);
+		await integrationsReport(deps, { fresh: true }).catch(() => void 0);
+		return result;
+	} finally {
+		busy.delete(agent.id);
+	}
+}
+async function connect(agent, status, executable, replace, deps) {
+	const name = agent.displayName;
+	const registration = agent.mcpRegistration;
+	const refuse = (message) => ({
+		outcome: "refused",
+		message,
+		status
+	});
+	if (status.state === "not-installed") return refuse(`${name} is not installed on this machine, so there is nothing to connect.`);
+	if (status.state === "unknown") return refuse(`Nothing was changed. ${status.reason ?? ""}`.trim());
+	if (status.state === "connected") return {
+		outcome: "already-connected",
+		message: `${name} is already connected to this PR Review Buddy.`,
+		status
+	};
+	if (status.state === "disabled") return refuse(`Nothing was changed. PR Review Buddy is registered in ${status.configPath} but turned off there, so ${name} does not start it. Turn it on in that file, or disconnect it and connect again.`);
+	if (!executable.command) return refuse(`No \`prreviewbuddy\` command on your PATH starts this copy of PR Review Buddy, so there is nothing stable to register. Install it with npm, then try again.`);
+	const answered = await deps.commandVersion(executable.command, deps.env);
+	if (answered !== deps.version) return refuse(`\`${executable.command}\` answered ${answered ? `version ${answered}` : "without a version"}, not ${deps.version}, so it was not registered.`);
+	const wanted = SERVE_ENTRY(executable.command);
+	if (status.state === "not-connected") {
+		try {
+			await registration.add(wanted, deps.env);
+		} catch (error) {
+			return {
+				outcome: "failed",
+				message: `${name} did not add it: ${errorText(error)}`,
+				status: await statusOf(agent, executable, deps)
+			};
+		}
+		const after = await statusOf(agent, executable, deps);
+		return after.state === "connected" ? {
+			outcome: "connected",
+			message: `${name} is connected. Start a new ${name} session to use it; sessions already open keep the tools they started with.`,
+			status: after
+		} : {
+			outcome: "failed",
+			message: `${name} accepted the change, but its config does not show it. Nothing else was changed.`,
+			status: after
+		};
+	}
+	if (!replace) return refuse(`${name} already starts a different PR Review Buddy (\`${status.registered?.command ?? ""}\`). Replace it to use this one.`);
+	let previous;
+	try {
+		previous = await registration.read(deps.env);
+	} catch (error) {
+		return refuse(`Nothing was changed: ${name}'s config could not be read again (${errorText(error)}).`);
+	}
+	if (!previous) return connect(agent, {
+		...status,
+		state: "not-connected"
+	}, executable, false, deps);
+	if (previous.unrecreatable.length > 0) return refuse(`Nothing was changed. The current registration has settings ${name}'s own command cannot put back (${previous.unrecreatable.join(", ")}), so it is not removed on your behalf. Change it by hand instead.`);
+	const previousCommand = shellJoin(registration.addCommand(previous));
+	try {
+		await registration.remove(deps.env);
+	} catch (error) {
+		return {
+			outcome: "failed",
+			message: `Nothing was changed: ${name} did not remove the current registration (${errorText(error)}).`,
+			status: await statusOf(agent, executable, deps)
+		};
+	}
+	let addError = null;
+	try {
+		await registration.add(wanted, deps.env);
+	} catch (error) {
+		addError = error;
+	}
+	if (!addError) {
+		const after = await statusOf(agent, executable, deps);
+		if (after.state === "connected") return {
+			outcome: "replaced",
+			message: `${name} now starts this PR Review Buddy. Start a new ${name} session to use it.`,
+			status: after
+		};
+		addError = /* @__PURE__ */ new Error("its config does not show the new registration");
+	}
+	try {
+		if (await registration.read(deps.env)) await registration.remove(deps.env);
+		await registration.add(previous, deps.env);
+		const restored = await registration.read(deps.env);
+		if (restored && restored.command === previous.command && restored.args.join("\0") === previous.args.join("\0")) return {
+			outcome: "restored",
+			message: `${name} did not take the new registration (${errorText(addError)}). Your previous registration has been put back.`,
+			status: await statusOf(agent, executable, deps)
+		};
+	} catch {}
+	return {
+		outcome: "restore-failed",
+		message: `${name} did not take the new registration (${errorText(addError)}), and the previous one could not be put back. Run the command below to restore it.`,
+		status: await statusOf(agent, executable, deps),
+		previousCommand
+	};
+}
+async function disconnect(agent, status, executable, deps) {
+	const name = agent.displayName;
+	if (status.state === "not-installed" || status.state === "not-connected") return {
+		outcome: "not-registered",
+		message: `${name} has no PR Review Buddy registration to remove.`,
+		status
+	};
+	if (status.state === "unknown") return {
+		outcome: "refused",
+		message: `Nothing was changed. ${status.reason ?? ""}`.trim(),
+		status
+	};
+	try {
+		await agent.mcpRegistration.remove(deps.env);
+	} catch (error) {
+		return {
+			outcome: "failed",
+			message: `${name} did not remove it: ${errorText(error)}`,
+			status: await statusOf(agent, executable, deps)
+		};
+	}
+	const after = await statusOf(agent, executable, deps);
+	return after.state === "not-connected" ? {
+		outcome: "disconnected",
+		message: `${name} no longer starts PR Review Buddy. Sessions already open keep it until they end.`,
+		status: after
+	} : {
+		outcome: "failed",
+		message: `${name} reported success, but its config still has a registration.`,
+		status: after
+	};
+}
+async function verify(agent, status, deps) {
+	const name = agent.displayName;
+	if (!status.registered) return {
+		outcome: "not-registered",
+		message: `${name} has no PR Review Buddy registration to check.`,
+		status
+	};
+	const { command, args, env } = status.registered;
+	const answer = await deps.handshake(command, args, {
+		...deps.env,
+		...env
+	});
+	if (!answer.ok) return {
+		outcome: "not-working",
+		message: `${name}'s registration does not work: ${answer.reason}`,
+		status
+	};
+	if (answer.name !== "prreviewbuddy") return {
+		outcome: "not-working",
+		message: `${name}'s registration starts an MCP server called “${answer.name}”, not PR Review Buddy.`,
+		status
+	};
+	const missing = MCP_TOOL_NAMES.filter((tool) => !answer.tools.includes(tool));
+	if (missing.length > 0) return {
+		outcome: "not-working",
+		message: `${name}'s registration starts PR Review Buddy ${answer.version}, which does not offer ${missing.join(", ")}. Connect this copy (${deps.version}) instead.`,
+		status
+	};
+	if (status.state === "disabled") return {
+		outcome: "not-working",
+		message: `The registration answers as PR Review Buddy ${answer.version}, but it is turned off in ${status.configPath}, so ${name} does not start it.`,
+		status
+	};
+	const elsewhere = status.state === "connected-elsewhere" ? ` It is a different copy from this one (${deps.version}).` : "";
+	return {
+		outcome: "working",
+		message: `Working. ${name}'s registration starts PR Review Buddy ${answer.version} with ${answer.tools.length} tools.${elsewhere} A ${name} session started from now on can use it.`,
+		status,
+		server: {
+			version: answer.version,
+			tools: answer.tools
+		}
+	};
+}
+//#endregion
 //#region ../../packages/review-harness/src/workspace/notification_facts.ts
 /**
 * What a recorded event says beyond its name, in two lengths: the Activity row's full line, and a
@@ -11815,6 +12406,15 @@ var AGENT_PRODUCTS = ((names) => names.length <= 1 ? names[0] ?? "" : `${names.s
 		return [];
 	}
 }));
+/** The agents AI integrations can connect, by their own names, the same way. */
+var INTEGRATED_PRODUCTS = ((names) => names.length <= 1 ? names[0] ?? "your coding agent" : `${names.slice(0, -1).join(", ")} or ${names[names.length - 1]}`)([...AGENT_IDS].sort().flatMap((id) => {
+	try {
+		const agent = agentById(id);
+		return agent?.mcpRegistration ? [agent.displayName] : [];
+	} catch {
+		return [];
+	}
+}));
 /**
 * The concepts behind the CLI's commands live here rather than in `prreviewbuddy --help`, which
 * says what to type and points here for what it means. The diagrams are text on purpose.
@@ -12018,6 +12618,48 @@ feature:                   E</pre>
     else's branch and an author reviews their own pull request. Run one with
     <code>prreviewbuddy review --lens kiss --audience author</code> or
     <code>--audience reviewer</code>.</p>`
+	},
+	{
+		id: "coding-agents",
+		title: "Coding agents",
+		body: `<p>Your coding agent can use PR Review Buddy directly. Connected, ${INTEGRATED_PRODUCTS} can start
+    a review, read its issues and questions, request an update after new commits and ask Buddy AI
+    about the change, all without opening the browser. It talks to PR Review Buddy through MCP, the
+    Model Context Protocol: a standard way for a coding agent to use tools that another program
+    provides, here a small server PR Review Buddy runs on your machine for the agent, and stops when
+    the agent session ends.</p>
+    <h3>Connecting</h3>
+    <p>Open <a href="/settings#ai-integrations">Settings → AI integrations</a> and press Connect beside
+    your agent. You are shown the exact command first, and it is your agent's own command for adding a
+    server, so nothing edits its files behind its back. Then start a new session of the agent:
+    sessions already open keep the tools they started with. <b>Verify connection</b> starts the
+    registered server and lists its tools, which proves it answers; Disconnect removes it again.</p>
+    <p>Prefer to do it yourself? <b>Copy command</b> gives you the same command to run in a terminal.
+    It names the full path of the <code>prreviewbuddy</code> that runs this workspace, because an agent
+    started from a desktop app may not see the same <code>PATH</code> as your shell, and could
+    otherwise start an older copy.</p>
+    <p>Connecting manages each agent's default configuration. If you keep several profiles of an
+    agent in their own directories, Connected describes the default one only; the agent's row has a
+    <b>Using a different profile?</b> section with the command that connects another.</p>
+    <h3>What an agent can and cannot do</h3>
+    <p>Seven tools: <code>review_pr</code> starts or returns a review, <code>get_review</code>,
+    <code>list_findings</code> and <code>get_finding</code> read one, <code>get_review_status</code>
+    follows its progress, <code>update_review</code> brings it up to date with new commits, and
+    <code>ask_buddy</code> asks Buddy AI about it. An agent cannot delete a review, dismiss or resolve a
+    finding, approve or comment on a pull request, or change your settings. A review PR Review Buddy
+    runs can read reviews but never start one, so a review can never start another.</p>
+    <h3>When it does not work</h3>
+    <ul>
+      <li><b>Uses another copy</b>: the agent is registered to a different <code>prreviewbuddy</code>,
+      often an older install. Replace points it at this one, and puts the old registration back if the
+      agent does not accept the new one.</li>
+      <li><b>Not installed</b>: the agent's command is not on this machine's <code>PATH</code>.</li>
+      <li><b>Turned off</b>: the agent's config has the registration but switched off, so the agent
+      does not start it. Turn it on there, or Disconnect and Connect again.</li>
+      <li><b>Verify fails</b>: the reason is the server's own. Reinstalling PR Review Buddy with
+      <code>npm install -g prreviewbuddy</code> and reconnecting fixes a command that has moved.</li>
+    </ul>
+    <p><code>prreviewbuddy help mcp</code> covers the same tools from the terminal.</p>`
 	},
 	{
 		id: "workspace-server",
@@ -16193,7 +16835,7 @@ async function handle(req, res, options) {
 	if (url.pathname.startsWith("/assets/")) return sendAsset(res, url.pathname);
 	if (url.pathname === "/") return handleIndex(req, res, url.searchParams, options.indexToken);
 	if (url.pathname === "/open") return handleOpen(req, res, url.searchParams, options.indexToken);
-	if (url.pathname === "/settings") return void handleSettings(req, res, url.searchParams, options.indexToken);
+	if (url.pathname === "/settings") return void handleSettings(req, res, url.searchParams, options.indexToken, options.integrations);
 	if (url.pathname === "/notifications") return void handleNotifications(req, res, url.searchParams, options.indexToken);
 	if (url.pathname === "/runs") return handleRuns(req, res, url.searchParams, options.indexToken);
 	if (url.pathname === "/runs/revision") return handleRunsRevision(req, res, options.indexToken);
@@ -16217,6 +16859,7 @@ async function handle(req, res, options) {
 	if (url.pathname === "/fetch-updates") return handleFetchUpdates(req, res, options.indexToken);
 	if (url.pathname === "/shutdown") return handleIndexShutdown(req, res, options);
 	if (url.pathname === "/restart") return handleIndexRestart(req, res, options);
+	if (url.pathname === "/integrations") return handleIntegrations(req, res, options);
 	if (url.pathname.startsWith("/add-review/")) return handleAddReview(req, res, url.pathname, options);
 	const match = /^\/(?:r|api)\/([0-9a-f-]{36})(\/[a-z]+)?$/.exec(url.pathname);
 	if (!match) return send(res, 404, { error: "Not found" });
@@ -16420,7 +17063,7 @@ function refuseIndex(req, res) {
 * `GET` renders, `POST` saves, on one path. The save answers with what was stored rather than with
 * a status, so the page can render the file rather than its own hopes about it.
 */
-async function handleSettings(req, res, params, indexToken) {
+async function handleSettings(req, res, params, indexToken, integrations) {
 	if (!indexAuthorised(req, params, indexToken)) {
 		if (req.method === "POST") return send(res, 403, { error: "This link is missing its access token." });
 		return refuseIndex(req, res);
@@ -16450,10 +17093,29 @@ async function handleSettings(req, res, params, indexToken) {
 		unreadNotifications: unreadCount$1(),
 		runningRuns: runningNow(),
 		driving: isDriving(),
-		sidebar: readPreferences().sidebar
+		sidebar: readPreferences().sidebar,
+		integrations: await settingsIntegrations(integrations),
+		home: homedir()
 	}), indexCookieHeader(indexToken));
 }
 /**
+* Read fresh for Settings, which is where a person goes to find out, and in parallel the agents
+* answer in about a third of a second. Capped, so an agent whose CLI hangs costs the page the
+* newest report anyone had rather than the page itself.
+*/
+var SETTINGS_INTEGRATIONS_WAIT_MS = 3e3;
+async function settingsIntegrations(deps) {
+	let timer;
+	const fallback = new Promise((resolvePromise) => {
+		timer = setTimeout(() => resolvePromise(lastIntegrationsReport()), SETTINGS_INTEGRATIONS_WAIT_MS);
+	});
+	try {
+		return await Promise.race([integrationsReport(deps ?? defaultIntegrationDeps()).catch(() => lastIntegrationsReport()), fallback]);
+	} finally {
+		clearTimeout(timer);
+	}
+}
+/**
 * Help. Static, but still behind the index's credential like every other workspace place: its
 * rail and strip carry the unread count, which is this machine's state.
 */
@@ -17468,6 +18130,13 @@ async function sendWorkspacePage(res, workspace) {
 		promptsCollapsed: readPreferences().promptsCollapsed === true,
 		reviewLayout: readPreferences().reviewLayout ?? {},
 		guidedTour: readPreferences().guidedTour,
+		integrationsNotice: integrationsNoticeFor({
+			live: true,
+			hasResult: Boolean(workspace.session.result),
+			tourAnswered: readPreferences().guidedTour !== void 0,
+			dismissed: readPreferences().dismissedNotices,
+			report: lastIntegrationsReport()
+		}),
 		tourBusy: busyReviewIds().has(workspace.id),
 		changeMapRegister: readPreferences().changeMapRegister ?? "simple",
 		architecture: await architecturePane(workspace),
@@ -17884,6 +18553,8 @@ async function handleAsk(req, res, workspace) {
 	const body = await readJson(req);
 	const question = typeof body?.question === "string" ? body.question.trim() : "";
 	if (!question) return send(res, 400, { error: "No question given." });
+	if (body?.requestId !== void 0 && !isRequestId(body.requestId)) return send(res, 400, { error: "requestId must be a UUID." });
+	const requestId = body?.requestId;
 	const sectionId = typeof body?.sectionId === "string" ? body.sectionId : null;
 	const explains = explanationRequested(workspace.session, body?.explains);
 	const continuing = explanationContinued(workspace, body?.continuesExplanation);
@@ -17914,7 +18585,8 @@ async function handleAsk(req, res, workspace) {
 	});
 	const started = beginRun(workspace.id, "ask", {
 		question,
-		sectionId
+		sectionId,
+		...requestId ? { requestId } : {}
 	});
 	if ("alreadyRunning" in started) return send(res, 409, {
 		error: "Buddy AI is still answering the last question on this review.",
@@ -17929,6 +18601,13 @@ async function handleAsk(req, res, workspace) {
 		turn: workspace.transcript.length + 1
 	});
 	const startedAt = Date.now();
+	let ended = {
+		state: "failed",
+		message: "Buddy AI could not answer this question."
+	};
+	if (requestId) try {
+		markAskRunning(requestId, workspace.id, question, process.pid);
+	} catch {}
 	const failed = () => record({
 		event: "assistant_answered",
 		reviewId: workspace.id,
@@ -17959,11 +18638,25 @@ async function handleAsk(req, res, workspace) {
 			});
 		} catch (error) {
 			failed();
-			if (run.state === "stopped") return sendIfOpen(res, 200, { stopped: true });
+			if (run.state === "stopped") {
+				ended = {
+					state: "cancelled",
+					message: "The question was stopped before it was answered."
+				};
+				return sendIfOpen(res, 200, { stopped: true });
+			}
+			ended = {
+				state: "failed",
+				message: error instanceof Error ? error.message : String(error)
+			};
 			throw error;
 		}
 		if (!completeRun(run)) {
 			failed();
+			ended = {
+				state: "cancelled",
+				message: "The question was stopped before it was answered."
+			};
 			return sendIfOpen(res, 200, { stopped: true });
 		}
 		record({
@@ -18009,7 +18702,8 @@ async function handleAsk(req, res, workspace) {
 				sectionId,
 				askedAt,
 				...kept ? { explains: kept } : {},
-				...reconciles ? { reconciles } : {}
+				...reconciles ? { reconciles } : {},
+				...requestId ? { requestId } : {}
 			});
 			if (kept) {
 				explanation = {
@@ -18036,6 +18730,13 @@ async function handleAsk(req, res, workspace) {
 			askedAt: keptAt,
 			...reconcileOutcome ? { reconcileTurn: true } : {}
 		} : {};
+		ended = saved ? {
+			state: "completed",
+			askedAt: keptAt
+		} : {
+			state: "failed",
+			message: "The review was deleted before the answer could be kept."
+		};
 		sendIfOpen(res, 200, {
 			answer: shown,
 			...explanation ? { explanation } : {},
@@ -18045,6 +18746,9 @@ async function handleAsk(req, res, workspace) {
 		});
 	} finally {
 		endRun(run);
+		if (requestId) try {
+			endAskRequest(requestId, workspace.id, ended);
+		} catch {}
 	}
 }
 /**
@@ -18428,6 +19132,40 @@ function applyState(workspace, body) {
 }
 /** 1 MB is far more than any question or id list, and far less than a memory problem. */
 var MAX_BODY_BYTES = 1048576;
+/**
+* AI integrations: the status of each coding agent's PR Review Buddy registration, and the three
+* actions on it. The one route that changes another application's config, so it is the narrowest:
+*
+* - the index cookie only, never a token in the URL, like every other index mutation;
+* - JSON only, so a plain HTML form on another site cannot post here at all;
+* - this server's own origin, when the browser says where the request came from;
+* - an agent id from the registry and an action from a fixed list, and nothing else from the body.
+*   Which command is written, and which config, is the service's and the adapter's to decide.
+*/
+async function handleIntegrations(req, res, options) {
+	if (!options.indexToken || !secretMatches(options.indexToken, indexCookie(req))) return send(res, 403, { error: "Not authorised." });
+	if (!sameOriginRequest(req)) return send(res, 403, { error: "Only this workspace can change AI integrations." });
+	const deps = options.integrations ?? defaultIntegrationDeps();
+	if (req.method === "GET") return send(res, 200, await integrationsReport(deps));
+	if (req.method !== "POST") return send(res, 405, { error: "Method not allowed." });
+	if (!/^application\/json\b/i.test(req.headers["content-type"] ?? "")) return send(res, 415, { error: "Send JSON." });
+	const body = await readJson(req);
+	const action = body?.action;
+	if (!INTEGRATION_ACTIONS.includes(action)) return send(res, 400, { error: "Unknown action." });
+	if (!integrationAgent(body?.agent, deps)) return send(res, 400, { error: "That agent cannot be connected to PR Review Buddy." });
+	send(res, 200, await runIntegrationAction(body?.agent, action, { replace: body?.replace === true }, deps));
+}
+/**
+* Whether the browser says this request came from this server's own pages. A request that says
+* nothing (a script, `curl`) is judged by the cookie alone; one that names another origin is refused.
+*/
+function sameOriginRequest(req) {
+	const site = req.headers["sec-fetch-site"];
+	if (typeof site === "string" && site !== "same-origin" && site !== "none") return false;
+	const origin = req.headers.origin;
+	if (typeof origin !== "string") return true;
+	return origin === `http://${req.headers.host ?? ""}`;
+}
 async function readJson(req) {
 	const chunks = [];
 	let size = 0;
@@ -18725,6 +19463,7 @@ server.on("error", () => process.exit(1));
 var stopSweeping = startSweeping();
 var stopWatching = startWatching();
 var stopReconciling = startReconciling();
+integrationsReport().catch(() => void 0);
 for (const signal of ["SIGINT", "SIGTERM"]) process.on(signal, () => {
 	stopSweeping();
 	stopWatching();