terminalhire 0.42.41 → 0.42.43

package/dist/bin/jpi-bounties.js

@@ -12500,6 +12500,12 @@ function linkTitle(title, url) {
 
 // bin/jpi-bounties.js
 init_api_base();
+
+// bin/review-mode-copy.js
+var POSTER_REVIEWED = "poster";
+var CLAIMANT_NOTICE = "The poster reviews this work by hand. We don't run tests on it.";
+
+// bin/jpi-bounties.js
 init_founder_pin();
 var TERMINALHIRE_DIR7 = process.env.TERMINALHIRE_DIR || join13(homedir10(), ".terminalhire");
 var INDEX_CACHE_FILE2 = join13(TERMINALHIRE_DIR7, "index-cache.json");
@@ -12614,6 +12620,9 @@ ${i + 1}. ${linkTitle(job.title, job.url)} [${ref}]`);
   );
   const marker = projectMarkerLine(b);
   if (marker) console.log(`   ${marker}`);
+  if (b.bountySource === "founder" && b.reviewMode === POSTER_REVIEWED) {
+    console.log(`   ${CLAIMANT_NOTICE}`);
+  }
   if (reason) console.log(`   ${reason}`);
   if (continuityNote) console.log(`   ${continuityNote}`);
   if (b.publicSummary) {

package/dist/bin/jpi-claim.js

@@ -31049,7 +31049,8 @@ var init_result = __esm({
       "leakState",
       "venue",
       "refusalOrigin",
-      "stoppedAt"
+      "stoppedAt",
+      "installFrozen"
     ];
     RENDER_NONE = null;
     FIELD_VIEWS = {
@@ -31114,7 +31115,10 @@ var init_result = __esm({
       // side refused in words a developer reads.
       refusalOrigin: RENDER_NONE,
       // Only when the run did not pass: on a green run "the last step" is just the last step.
-      stoppedAt: (r) => r.stoppedAt === null || r.outcome === "completed" ? null : `last step    ${r.stoppedAt} (the last package script named in the output)`
+      stoppedAt: (r) => r.stoppedAt === null || r.outcome === "completed" ? null : `last step    ${r.stoppedAt} (the last package script named in the output)`,
+      // The run already prints the unfrozen note while it runs (`installUnfrozenNote`); this is
+      // the record of it for the worker and the intake.
+      installFrozen: RENDER_NONE
     };
   }
 });
@@ -35152,6 +35156,10 @@ function nodeInstallCommand(repo) {
   return null;
 }
 function lockfileGaps(repo) {
+  const read = readLockfileGaps(repo);
+  return read === null || read.missing.length === 0 ? null : { lockfile: read.lockfile, missing: read.missing };
+}
+function readLockfileGaps(repo) {
   const pkg = readJsonObject(repo, "package.json");
   if (pkg === null)
     return null;
@@ -35178,7 +35186,7 @@ function lockfileGaps(repo) {
         missing.push(`${n}@${r} (${dir})`);
     }
   }
-  return missing.length === 0 ? null : { lockfile, missing };
+  return { lockfile, missing, rootRead: rootListing !== null };
 }
 function wantedDependencies(pkg) {
   const wanted = [];
@@ -37679,7 +37687,9 @@ function refusedRun(fields) {
     venue: null,
     refusalOrigin: fields.origin,
     // No test step ran, so there is no output to read a step from.
-    stoppedAt: null
+    stoppedAt: null,
+    // Refused before any install step ran.
+    installFrozen: null
   };
 }
 function refusalOriginOf(refusal2) {
@@ -37763,7 +37773,29 @@ function installUnfrozenNote(spec) {
   const u = spec.installUnfrozen;
   if (u === void 0)
     return null;
-  return `${u.lockfile} does not list ${u.missing.join(", ")}, so the install ran as \`${String(spec.installCommand)}\` without its frozen-lockfile check. Regenerate ${u.lockfile} before merging.`;
+  return `${u.lockfile} does not list ${u.missing.join(", ")}, so the install ran as \`${String(spec.installCommand)}\` without its frozen-lockfile check. Include the updated ${u.lockfile} in the patch, or regenerate it before merging.`;
+}
+function isFrozenInstallCommand(command) {
+  const lead = /^(?:(?:sudo|time)\s+|env(?:\s+[A-Za-z_]\w*=\S*)*\s+)*/.exec(command)?.[0] ?? "";
+  const install = command.slice(lead.length).split(/;|&&|\|\|/)[0]?.trim() ?? "";
+  if (/^npm ci(\s|$)/.test(install))
+    return true;
+  if (/^(yarn|pnpm|bun)\b/.test(install) && /\s--frozen-lockfile(?=\s|$)/.test(install)) {
+    return true;
+  }
+  return /^yarn\b/.test(install) && /\s--immutable(?=\s|$)/.test(install);
+}
+function installFrozenFor(spec, install) {
+  if (install === null)
+    return null;
+  const launched = install.exitCode !== INSTALL_NEVER_STARTED && (install.exitCode !== null || install.timedOut);
+  if (!launched)
+    return null;
+  if (spec.runtime !== "node")
+    return null;
+  if (spec.installUnfrozen !== void 0)
+    return false;
+  return isFrozenInstallCommand(install.command);
 }
 async function verifyWorkingDiff(req) {
   const ctx = {
@@ -38132,7 +38164,8 @@ async function runVerification(req, ctx) {
       // A run that reached a verdict was not refused, so neither side refused it.
       refusalOrigin: null,
       // Read from the full test output, not `outputTail`, which is an excerpt.
-      stoppedAt: readStoppedAt(verdict.test?.stdout ?? "", verdict.test?.stderr ?? "")
+      stoppedAt: readStoppedAt(verdict.test?.stdout ?? "", verdict.test?.stderr ?? ""),
+      installFrozen: installFrozenFor(spec, verdict.install)
     };
     let later = null;
     if (req.screenshots !== void 0) {
@@ -38331,7 +38364,7 @@ async function prepareBaseTree(o) {
     throw err;
   }
 }
-var ThRunError, OUTPUT_TAIL_BYTES, LOCKFILE_READ_CAP, FULL_COMMIT_ID, ALLOWED_URL_SCHEMES, SCP_STYLE, URL_SCHEME, WINDOWS_ABSOLUTE, UNC_PATH, TRANSPORT_REASON, SHA_REASON, FULL_SHA, MIN_GIT_VERSION_FOR_END_OF_OPTIONS, CloneUnavailableError, GIT_ENV_ALLOWLIST, credentialFreeHomeDir, SSH_ISOLATION_ARGS, WITHHELD_SEGMENT, UNPARSEABLE_TARGET, DEFERRED_GATE_TIMEOUT_MS, FAILURE_LINE, REDACTED_TARGET_REPO, REDACTED_TARGET_SHA;
+var ThRunError, OUTPUT_TAIL_BYTES, LOCKFILE_READ_CAP, FULL_COMMIT_ID, ALLOWED_URL_SCHEMES, SCP_STYLE, URL_SCHEME, WINDOWS_ABSOLUTE, UNC_PATH, TRANSPORT_REASON, SHA_REASON, FULL_SHA, MIN_GIT_VERSION_FOR_END_OF_OPTIONS, CloneUnavailableError, GIT_ENV_ALLOWLIST, credentialFreeHomeDir, SSH_ISOLATION_ARGS, WITHHELD_SEGMENT, UNPARSEABLE_TARGET, DEFERRED_GATE_TIMEOUT_MS, FAILURE_LINE, REDACTED_TARGET_REPO, REDACTED_TARGET_SHA, INSTALL_NEVER_STARTED;
 var init_thrun = __esm({
   "../../packages/envrun/dist/thrun.js"() {
     "use strict";
@@ -38420,6 +38453,7 @@ var init_thrun = __esm({
     FAILURE_LINE = /^(?:[ \t]*(?:not ok |FAILED |FAIL )|E {3}|# fail [1-9])/m;
     REDACTED_TARGET_REPO = "(refused before the target was accepted)";
     REDACTED_TARGET_SHA = "(refused)";
+    INSTALL_NEVER_STARTED = 125;
   }
 });
 
@@ -39321,6 +39355,7 @@ __export(dist_exports, {
   imageRepo: () => imageRepo,
   imageVariantFor: () => imageVariantFor,
   installCommandFor: () => installCommandFor,
+  installFrozenFor: () => installFrozenFor,
   installLocalMigrationTooling: () => installLocalMigrationTooling,
   installUnfrozenNote: () => installUnfrozenNote,
   isBookkeepingTable: () => isBookkeepingTable,
@@ -40162,6 +40197,13 @@ async function syncFounderVerdicts({
 
 // bin/jpi-claim.js
 init_founder_note_sync();
+
+// bin/review-mode-copy.js
+var POSTER_REVIEWED = "poster";
+var CLAIMANT_NOTICE = "The poster reviews this work by hand. We don't run tests on it.";
+var HISTORY_LINE = "Submitted for the poster's review.";
+
+// bin/jpi-claim.js
 var TERMINALHIRE_DIR11 = process.env.TERMINALHIRE_DIR || join31(homedir14(), ".terminalhire");
 var INDEX_CACHE_FILE2 = join31(TERMINALHIRE_DIR11, "index-cache.json");
 var CLAIM_PUSH_MARKER = join31(TERMINALHIRE_DIR11, "claim-push.json");
@@ -40631,9 +40673,15 @@ function extractClaimableFields(job) {
     // poster saw. Null when the index carries none.
     runRequirements: b.runRequirements && typeof b.runRequirements === "object" ? b.runRequirements : null,
     // TERM-1308. Present only when the index row carries them; no key otherwise.
-    ...b.bountySource === "founder" ? baselineFields(b) : {}
+    ...b.bountySource === "founder" ? baselineFields(b) : {},
+    // TERM-1344. The index carries `reviewMode` only for a poster-reviewed posting; any
+    // other value is dropped rather than carried, the same as a malformed baseline field.
+    ...b.bountySource === "founder" && b.reviewMode === POSTER_REVIEWED ? { reviewMode: POSTER_REVIEWED } : {}
   };
 }
+function reviewModeLine(b) {
+  return b?.reviewMode === POSTER_REVIEWED ? CLAIMANT_NOTICE : null;
+}
 function parseGitHubUrl(url) {
   const m = String(url ?? "").match(/github\.com\/([^/]+)\/([^/]+)\/(?:issues|pull)\/(\d+)/);
   if (!m) return null;
@@ -41250,7 +41298,7 @@ async function resolveBounty(arg) {
     if (freshPool) job = findByShortRefInPool(freshPool, arg);
   }
   if (job) {
-    let testBudgetMinutes, baselineStatus, baselineSha;
+    let testBudgetMinutes, baselineStatus, baselineSha, reviewMode;
     ({
       bountyId,
       title,
@@ -41264,12 +41312,15 @@ async function resolveBounty(arg) {
       runRequirements,
       testBudgetMinutes,
       baselineStatus,
-      baselineSha
+      baselineSha,
+      reviewMode
     } = extractClaimableFields(job));
     baseline = {
       ...testBudgetMinutes === void 0 ? {} : { testBudgetMinutes },
       ...baselineStatus === void 0 ? {} : { baselineStatus },
-      ...baselineSha === void 0 ? {} : { baselineSha }
+      ...baselineSha === void 0 ? {} : { baselineSha },
+      // TERM-1344. Rides with the baseline fields: index-only, and no key when absent.
+      ...reviewMode === void 0 ? {} : { reviewMode }
     };
     indexNativeId = bountyId;
   } else {
@@ -42054,6 +42105,8 @@ async function cmdPreview(arg, { json } = {}) {
         contested: isContested(b),
         // TERM-1308. The posting's test budget and baseline, only when the index carried them.
         ...baselineFields(b),
+        // TERM-1344. Only for a poster-reviewed posting; absent means tests.
+        ...b.reviewMode === POSTER_REVIEWED ? { reviewMode: POSTER_REVIEWED } : {},
         // Absent on a founder posting — see the scan above. A consumer must read
         // "no policy key" as "no policy step exists here", never as "clean".
         ...policy ? {
@@ -42084,8 +42137,8 @@ async function cmdPreview(arg, { json } = {}) {
   console.log(fmtOpenPRsLine(b));
   const previewContested = fmtContestedWarning(b);
   if (previewContested) console.log(previewContested);
-  const previewBaseline = baselineLine(b);
-  if (previewBaseline) console.log(`  tests:  ${previewBaseline}`);
+  const previewTests = reviewModeLine(b) ?? baselineLine(b);
+  if (previewTests) console.log(`  tests:  ${previewTests}`);
   if (policy) printPolicySection(policy);
   if (process.stdout.isTTY) {
     try {
@@ -43358,7 +43411,8 @@ function renderRunView(run2, message2, extra = {}) {
   const rateLimitCap = extra.rateLimitCap ?? run2.rateLimitCap ?? 5;
   const rateLimitCount = extra.rateLimitCount ?? run2.rateLimitCount;
   if (claimState) {
-    lines.push(`  state:      ${terminalSafeInline(claimState)}`);
+    const stateText = claimState === "poster-review" ? HISTORY_LINE : terminalSafeInline(claimState);
+    lines.push(`  state:      ${stateText}`);
   }
   if (unverifiedCause) {
     lines.push(`  cause:      ${terminalSafeInline(unverifiedCause)}`);
@@ -43417,7 +43471,8 @@ function renderClaimHistory(attempts, timeline) {
   for (const a of runs) {
     const sha = a.commitSha ? String(a.commitSha).slice(0, 10) : "";
     const jobs = Array.isArray(a.failingJobs) && a.failingJobs.length > 0 ? ` \u2014 ${a.failingJobs.map(terminalSafeInline).join(", ")}` : "";
-    const outcome = a.conclusion ? `checks ${terminalSafeInline(a.conclusion)}${jobs}` : a.status === "no-ci" ? "no checks ran" : "checks running";
+    const note = typeof a.note === "string" ? terminalSafeInline(a.note).trim() : "";
+    const outcome = a.conclusion ? `checks ${terminalSafeInline(a.conclusion)}${jobs}` : note !== "" ? note : a.status === "no-ci" ? "no checks ran" : "checks running";
     lines.push(`  attempt ${a.attemptNumber}  ${sha}  ${outcome}  ${shortWhen(a.at)}`);
   }
   for (const e of told) {
@@ -44169,6 +44224,67 @@ async function uploadClaimScreenshots(intake, uploads) {
     );
   }
 }
+var DEPENDENCY_SECTIONS2 = [
+  "dependencies",
+  "devDependencies",
+  "optionalDependencies",
+  "peerDependencies"
+];
+var SENDABLE_LOCKFILES = [
+  ["package-lock.json", "npm install"],
+  ["yarn.lock", "yarn install"]
+];
+async function packageJsonAt(wt, rev, path5) {
+  let text;
+  try {
+    ({ stdout: text } = await pExecFile("git", ["-C", wt, "show", `${rev}:${path5}`], {
+      shell: false,
+      maxBuffer: 16 * 1024 * 1024
+    }));
+  } catch {
+    return {};
+  }
+  try {
+    const parsed = JSON.parse(String(text));
+    return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function sectionKey(pkg, section) {
+  const value = pkg[section];
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return JSON.stringify(value ?? null);
+  }
+  return JSON.stringify(Object.keys(value).sort().map((k) => [k, value[k]]));
+}
+async function patchChangesDependencies(wt, base, touched) {
+  for (const path5 of touched) {
+    if (path5.split("/").pop() !== "package.json") continue;
+    const before = await packageJsonAt(wt, base, path5);
+    const after = await packageJsonAt(wt, "HEAD", path5);
+    if (before === null || after === null) continue;
+    if (DEPENDENCY_SECTIONS2.some((s) => sectionKey(before, s) !== sectionKey(after, s))) return true;
+  }
+  return false;
+}
+async function dependencyLockfileWarnings(wt, base, touched) {
+  if (!await patchChangesDependencies(wt, base, touched)) return [];
+  const warnings = [];
+  for (const [lockfile, cmd] of SENDABLE_LOCKFILES) {
+    let present;
+    try {
+      present = (await sh("git", ["-C", wt, "ls-tree", "--name-only", base, "--", lockfile])).trim() === lockfile;
+    } catch {
+      present = false;
+    }
+    if (!present || touched.includes(lockfile)) continue;
+    warnings.push(
+      `  \u26A0 package.json changes dependencies, but ${lockfile} is not in this patch. The run will install without its frozen-lockfile check. Run \`${cmd}\` and commit ${lockfile} to keep it frozen.`
+    );
+  }
+  return warnings;
+}
 async function submitFounderPatch({ claims, claim, id, wt, flags }) {
   let roots;
   try {
@@ -44219,6 +44335,9 @@ async function submitFounderPatch({ claims, claim, id, wt, flags }) {
     );
     process.exit(1);
   }
+  const lockfileWarnings = await dependencyLockfileWarnings(wt, base, touched);
+  if (lockfileWarnings.length > 0) console.log(`
+${lockfileWarnings.join("\n")}`);
   const authorName = await sh("git", ["-C", wt, "log", "-1", "--format=%an"]);
   const authorEmail = await sh("git", ["-C", wt, "log", "-1", "--format=%ae"]);
   const shots = flags.screenshots === void 0 ? null : loadClaimScreenshots(flags.screenshots);
@@ -45845,6 +45964,7 @@ export {
   resolveBounty,
   resolveDeliveryDir,
   resolveSubmitWorktree,
+  reviewModeLine,
   reviseRecoveryCommand,
   revokeFailureAction,
   run,

package/dist/bin/jpi-dispatch.js

@@ -15565,6 +15565,17 @@ var init_payout_split = __esm({
   }
 });
 
+// bin/review-mode-copy.js
+var POSTER_REVIEWED, CLAIMANT_NOTICE, HISTORY_LINE;
+var init_review_mode_copy = __esm({
+  "bin/review-mode-copy.js"() {
+    "use strict";
+    POSTER_REVIEWED = "poster";
+    CLAIMANT_NOTICE = "The poster reviews this work by hand. We don't run tests on it.";
+    HISTORY_LINE = "Submitted for the poster's review.";
+  }
+});
+
 // src/repo-experience.ts
 var repo_experience_exports = {};
 __export(repo_experience_exports, {
@@ -16451,6 +16462,9 @@ ${i + 1}. ${linkTitle(job.title, job.url)} [${ref}]`);
   );
   const marker = projectMarkerLine(b);
   if (marker) console.log(`   ${marker}`);
+  if (b.bountySource === "founder" && b.reviewMode === POSTER_REVIEWED) {
+    console.log(`   ${CLAIMANT_NOTICE}`);
+  }
   if (reason) console.log(`   ${reason}`);
   if (continuityNote) console.log(`   ${continuityNote}`);
   if (b.publicSummary) {
@@ -16706,6 +16720,7 @@ var init_jpi_bounties = __esm({
     init_index_revalidate();
     init_sanitize();
     init_api_base();
+    init_review_mode_copy();
     init_founder_pin();
     TERMINALHIRE_DIR12 = process.env.TERMINALHIRE_DIR || join26(homedir20(), ".terminalhire");
     INDEX_CACHE_FILE3 = join26(TERMINALHIRE_DIR12, "index-cache.json");
@@ -36824,7 +36839,8 @@ var init_result = __esm({
       "leakState",
       "venue",
       "refusalOrigin",
-      "stoppedAt"
+      "stoppedAt",
+      "installFrozen"
     ];
     RENDER_NONE = null;
     FIELD_VIEWS = {
@@ -36889,7 +36905,10 @@ var init_result = __esm({
       // side refused in words a developer reads.
       refusalOrigin: RENDER_NONE,
       // Only when the run did not pass: on a green run "the last step" is just the last step.
-      stoppedAt: (r) => r.stoppedAt === null || r.outcome === "completed" ? null : `last step    ${r.stoppedAt} (the last package script named in the output)`
+      stoppedAt: (r) => r.stoppedAt === null || r.outcome === "completed" ? null : `last step    ${r.stoppedAt} (the last package script named in the output)`,
+      // The run already prints the unfrozen note while it runs (`installUnfrozenNote`); this is
+      // the record of it for the worker and the intake.
+      installFrozen: RENDER_NONE
     };
   }
 });
@@ -40927,6 +40946,10 @@ function nodeInstallCommand(repo) {
   return null;
 }
 function lockfileGaps(repo) {
+  const read = readLockfileGaps(repo);
+  return read === null || read.missing.length === 0 ? null : { lockfile: read.lockfile, missing: read.missing };
+}
+function readLockfileGaps(repo) {
   const pkg = readJsonObject(repo, "package.json");
   if (pkg === null)
     return null;
@@ -40953,7 +40976,7 @@ function lockfileGaps(repo) {
         missing.push(`${n}@${r} (${dir})`);
     }
   }
-  return missing.length === 0 ? null : { lockfile, missing };
+  return { lockfile, missing, rootRead: rootListing !== null };
 }
 function wantedDependencies(pkg) {
   const wanted = [];
@@ -43454,7 +43477,9 @@ function refusedRun(fields) {
     venue: null,
     refusalOrigin: fields.origin,
     // No test step ran, so there is no output to read a step from.
-    stoppedAt: null
+    stoppedAt: null,
+    // Refused before any install step ran.
+    installFrozen: null
   };
 }
 function refusalOriginOf(refusal2) {
@@ -43538,7 +43563,29 @@ function installUnfrozenNote(spec) {
   const u = spec.installUnfrozen;
   if (u === void 0)
     return null;
-  return `${u.lockfile} does not list ${u.missing.join(", ")}, so the install ran as \`${String(spec.installCommand)}\` without its frozen-lockfile check. Regenerate ${u.lockfile} before merging.`;
+  return `${u.lockfile} does not list ${u.missing.join(", ")}, so the install ran as \`${String(spec.installCommand)}\` without its frozen-lockfile check. Include the updated ${u.lockfile} in the patch, or regenerate it before merging.`;
+}
+function isFrozenInstallCommand(command) {
+  const lead = /^(?:(?:sudo|time)\s+|env(?:\s+[A-Za-z_]\w*=\S*)*\s+)*/.exec(command)?.[0] ?? "";
+  const install = command.slice(lead.length).split(/;|&&|\|\|/)[0]?.trim() ?? "";
+  if (/^npm ci(\s|$)/.test(install))
+    return true;
+  if (/^(yarn|pnpm|bun)\b/.test(install) && /\s--frozen-lockfile(?=\s|$)/.test(install)) {
+    return true;
+  }
+  return /^yarn\b/.test(install) && /\s--immutable(?=\s|$)/.test(install);
+}
+function installFrozenFor(spec, install) {
+  if (install === null)
+    return null;
+  const launched = install.exitCode !== INSTALL_NEVER_STARTED && (install.exitCode !== null || install.timedOut);
+  if (!launched)
+    return null;
+  if (spec.runtime !== "node")
+    return null;
+  if (spec.installUnfrozen !== void 0)
+    return false;
+  return isFrozenInstallCommand(install.command);
 }
 async function verifyWorkingDiff(req) {
   const ctx = {
@@ -43907,7 +43954,8 @@ async function runVerification(req, ctx) {
       // A run that reached a verdict was not refused, so neither side refused it.
       refusalOrigin: null,
       // Read from the full test output, not `outputTail`, which is an excerpt.
-      stoppedAt: readStoppedAt(verdict.test?.stdout ?? "", verdict.test?.stderr ?? "")
+      stoppedAt: readStoppedAt(verdict.test?.stdout ?? "", verdict.test?.stderr ?? ""),
+      installFrozen: installFrozenFor(spec, verdict.install)
     };
     let later = null;
     if (req.screenshots !== void 0) {
@@ -44106,7 +44154,7 @@ async function prepareBaseTree(o) {
     throw err;
   }
 }
-var ThRunError, OUTPUT_TAIL_BYTES, LOCKFILE_READ_CAP, FULL_COMMIT_ID, ALLOWED_URL_SCHEMES, SCP_STYLE, URL_SCHEME, WINDOWS_ABSOLUTE, UNC_PATH, TRANSPORT_REASON, SHA_REASON, FULL_SHA, MIN_GIT_VERSION_FOR_END_OF_OPTIONS, CloneUnavailableError, GIT_ENV_ALLOWLIST, credentialFreeHomeDir, SSH_ISOLATION_ARGS, WITHHELD_SEGMENT, UNPARSEABLE_TARGET, DEFERRED_GATE_TIMEOUT_MS, FAILURE_LINE, REDACTED_TARGET_REPO, REDACTED_TARGET_SHA;
+var ThRunError, OUTPUT_TAIL_BYTES, LOCKFILE_READ_CAP, FULL_COMMIT_ID, ALLOWED_URL_SCHEMES, SCP_STYLE, URL_SCHEME, WINDOWS_ABSOLUTE, UNC_PATH, TRANSPORT_REASON, SHA_REASON, FULL_SHA, MIN_GIT_VERSION_FOR_END_OF_OPTIONS, CloneUnavailableError, GIT_ENV_ALLOWLIST, credentialFreeHomeDir, SSH_ISOLATION_ARGS, WITHHELD_SEGMENT, UNPARSEABLE_TARGET, DEFERRED_GATE_TIMEOUT_MS, FAILURE_LINE, REDACTED_TARGET_REPO, REDACTED_TARGET_SHA, INSTALL_NEVER_STARTED;
 var init_thrun = __esm({
   "../../packages/envrun/dist/thrun.js"() {
     "use strict";
@@ -44195,6 +44243,7 @@ var init_thrun = __esm({
     FAILURE_LINE = /^(?:[ \t]*(?:not ok |FAILED |FAIL )|E {3}|# fail [1-9])/m;
     REDACTED_TARGET_REPO = "(refused before the target was accepted)";
     REDACTED_TARGET_SHA = "(refused)";
+    INSTALL_NEVER_STARTED = 125;
   }
 });
 
@@ -45096,6 +45145,7 @@ __export(dist_exports, {
   imageRepo: () => imageRepo,
   imageVariantFor: () => imageVariantFor,
   installCommandFor: () => installCommandFor,
+  installFrozenFor: () => installFrozenFor,
   installLocalMigrationTooling: () => installLocalMigrationTooling,
   installUnfrozenNote: () => installUnfrozenNote,
   isBookkeepingTable: () => isBookkeepingTable,
@@ -45492,6 +45542,7 @@ __export(jpi_claim_exports, {
   resolveBounty: () => resolveBounty,
   resolveDeliveryDir: () => resolveDeliveryDir,
   resolveSubmitWorktree: () => resolveSubmitWorktree,
+  reviewModeLine: () => reviewModeLine,
   reviseRecoveryCommand: () => reviseRecoveryCommand,
   revokeFailureAction: () => revokeFailureAction,
   run: () => run7,
@@ -45959,9 +46010,15 @@ function extractClaimableFields(job) {
     // poster saw. Null when the index carries none.
     runRequirements: b.runRequirements && typeof b.runRequirements === "object" ? b.runRequirements : null,
     // TERM-1308. Present only when the index row carries them; no key otherwise.
-    ...b.bountySource === "founder" ? baselineFields(b) : {}
+    ...b.bountySource === "founder" ? baselineFields(b) : {},
+    // TERM-1344. The index carries `reviewMode` only for a poster-reviewed posting; any
+    // other value is dropped rather than carried, the same as a malformed baseline field.
+    ...b.bountySource === "founder" && b.reviewMode === POSTER_REVIEWED ? { reviewMode: POSTER_REVIEWED } : {}
   };
 }
+function reviewModeLine(b) {
+  return b?.reviewMode === POSTER_REVIEWED ? CLAIMANT_NOTICE : null;
+}
 function parseGitHubUrl(url) {
   const m = String(url ?? "").match(/github\.com\/([^/]+)\/([^/]+)\/(?:issues|pull)\/(\d+)/);
   if (!m) return null;
@@ -46567,7 +46624,7 @@ async function resolveBounty(arg) {
     if (freshPool) job = findByShortRefInPool(freshPool, arg);
   }
   if (job) {
-    let testBudgetMinutes, baselineStatus, baselineSha;
+    let testBudgetMinutes, baselineStatus, baselineSha, reviewMode;
     ({
       bountyId,
       title,
@@ -46581,12 +46638,15 @@ async function resolveBounty(arg) {
       runRequirements,
       testBudgetMinutes,
       baselineStatus,
-      baselineSha
+      baselineSha,
+      reviewMode
     } = extractClaimableFields(job));
     baseline = {
       ...testBudgetMinutes === void 0 ? {} : { testBudgetMinutes },
       ...baselineStatus === void 0 ? {} : { baselineStatus },
-      ...baselineSha === void 0 ? {} : { baselineSha }
+      ...baselineSha === void 0 ? {} : { baselineSha },
+      // TERM-1344. Rides with the baseline fields: index-only, and no key when absent.
+      ...reviewMode === void 0 ? {} : { reviewMode }
     };
     indexNativeId = bountyId;
   } else {
@@ -47346,6 +47406,8 @@ async function cmdPreview(arg, { json } = {}) {
         contested: isContested(b),
         // TERM-1308. The posting's test budget and baseline, only when the index carried them.
         ...baselineFields(b),
+        // TERM-1344. Only for a poster-reviewed posting; absent means tests.
+        ...b.reviewMode === POSTER_REVIEWED ? { reviewMode: POSTER_REVIEWED } : {},
         // Absent on a founder posting — see the scan above. A consumer must read
         // "no policy key" as "no policy step exists here", never as "clean".
         ...policy ? {
@@ -47376,8 +47438,8 @@ async function cmdPreview(arg, { json } = {}) {
   console.log(fmtOpenPRsLine(b));
   const previewContested = fmtContestedWarning(b);
   if (previewContested) console.log(previewContested);
-  const previewBaseline = baselineLine(b);
-  if (previewBaseline) console.log(`  tests:  ${previewBaseline}`);
+  const previewTests = reviewModeLine(b) ?? baselineLine(b);
+  if (previewTests) console.log(`  tests:  ${previewTests}`);
   if (policy) printPolicySection(policy);
   if (process.stdout.isTTY) {
     try {
@@ -48633,7 +48695,8 @@ function renderRunView(run32, message2, extra = {}) {
   const rateLimitCap = extra.rateLimitCap ?? run32.rateLimitCap ?? 5;
   const rateLimitCount = extra.rateLimitCount ?? run32.rateLimitCount;
   if (claimState) {
-    lines.push(`  state:      ${terminalSafeInline(claimState)}`);
+    const stateText = claimState === "poster-review" ? HISTORY_LINE : terminalSafeInline(claimState);
+    lines.push(`  state:      ${stateText}`);
   }
   if (unverifiedCause) {
     lines.push(`  cause:      ${terminalSafeInline(unverifiedCause)}`);
@@ -48679,7 +48742,8 @@ function renderClaimHistory(attempts, timeline) {
   for (const a of runs) {
     const sha = a.commitSha ? String(a.commitSha).slice(0, 10) : "";
     const jobs = Array.isArray(a.failingJobs) && a.failingJobs.length > 0 ? ` \u2014 ${a.failingJobs.map(terminalSafeInline).join(", ")}` : "";
-    const outcome = a.conclusion ? `checks ${terminalSafeInline(a.conclusion)}${jobs}` : a.status === "no-ci" ? "no checks ran" : "checks running";
+    const note = typeof a.note === "string" ? terminalSafeInline(a.note).trim() : "";
+    const outcome = a.conclusion ? `checks ${terminalSafeInline(a.conclusion)}${jobs}` : note !== "" ? note : a.status === "no-ci" ? "no checks ran" : "checks running";
     lines.push(`  attempt ${a.attemptNumber}  ${sha}  ${outcome}  ${shortWhen(a.at)}`);
   }
   for (const e of told) {
@@ -49429,6 +49493,57 @@ async function uploadClaimScreenshots(intake, uploads) {
     );
   }
 }
+async function packageJsonAt(wt, rev, path6) {
+  let text;
+  try {
+    ({ stdout: text } = await pExecFile("git", ["-C", wt, "show", `${rev}:${path6}`], {
+      shell: false,
+      maxBuffer: 16 * 1024 * 1024
+    }));
+  } catch {
+    return {};
+  }
+  try {
+    const parsed = JSON.parse(String(text));
+    return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function sectionKey(pkg, section2) {
+  const value = pkg[section2];
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return JSON.stringify(value ?? null);
+  }
+  return JSON.stringify(Object.keys(value).sort().map((k) => [k, value[k]]));
+}
+async function patchChangesDependencies(wt, base, touched) {
+  for (const path6 of touched) {
+    if (path6.split("/").pop() !== "package.json") continue;
+    const before = await packageJsonAt(wt, base, path6);
+    const after = await packageJsonAt(wt, "HEAD", path6);
+    if (before === null || after === null) continue;
+    if (DEPENDENCY_SECTIONS2.some((s) => sectionKey(before, s) !== sectionKey(after, s))) return true;
+  }
+  return false;
+}
+async function dependencyLockfileWarnings(wt, base, touched) {
+  if (!await patchChangesDependencies(wt, base, touched)) return [];
+  const warnings = [];
+  for (const [lockfile, cmd] of SENDABLE_LOCKFILES) {
+    let present;
+    try {
+      present = (await sh("git", ["-C", wt, "ls-tree", "--name-only", base, "--", lockfile])).trim() === lockfile;
+    } catch {
+      present = false;
+    }
+    if (!present || touched.includes(lockfile)) continue;
+    warnings.push(
+      `  \u26A0 package.json changes dependencies, but ${lockfile} is not in this patch. The run will install without its frozen-lockfile check. Run \`${cmd}\` and commit ${lockfile} to keep it frozen.`
+    );
+  }
+  return warnings;
+}
 async function submitFounderPatch({ claims, claim, id, wt, flags }) {
   let roots;
   try {
@@ -49479,6 +49594,9 @@ async function submitFounderPatch({ claims, claim, id, wt, flags }) {
     );
     process.exit(1);
   }
+  const lockfileWarnings = await dependencyLockfileWarnings(wt, base, touched);
+  if (lockfileWarnings.length > 0) console.log(`
+${lockfileWarnings.join("\n")}`);
   const authorName = await sh("git", ["-C", wt, "log", "-1", "--format=%an"]);
   const authorEmail = await sh("git", ["-C", wt, "log", "-1", "--format=%ae"]);
   const shots = flags.screenshots === void 0 ? null : loadClaimScreenshots(flags.screenshots);
@@ -50988,7 +51106,7 @@ async function run7() {
     process.exit(1);
   }
 }
-var TERMINALHIRE_DIR17, INDEX_CACHE_FILE5, CLAIM_PUSH_MARKER, REPO_CONTINUITY_NUDGE_MARKER, API_URL6, CLAIM_SYNC_BASE4, CLAIM_CONSENT_VERSION, CLAIM_POLL_INTERVAL_MS, CLAIM_POLL_TIMEOUT_MS, CLAIM_SYNC_WRITE_TIMEOUT_MS, GH_API3, GH_HEADERS2, CONTENTION_HINT, AI_DISCLOSURE_NOTE, pExecFile, VALUE_FLAGS, BASELINE_STATUSES, MIN_TEST_BUDGET_MINUTES, MAX_TEST_BUDGET_MINUTES, ASSIGNMENT_MARKER, STAKE_MARKER, STANDDOWN_MARKER, OUR_MARKERS, STAKE_POST_TIMEOUT_MS, STAKE_POSTING_GRACE_MS, TAKE_BOT_REPOS, SUBMIT_ACCEPTS, REVISE_RECOVERY_STATES, CLOSED_STATES, GH_SESSION_COOKIE4, PUSH_TOKEN_REFUSAL, SYNC_BACKGROUND_PUSH_ACTIVE_FIELD, ISSUE_OUTCOME_TERMINAL, RUNS_POLL_INTERVAL_MS, RUNS_POLL_ATTEMPTS, OPENABLE_AGENTS, BRIEF_DIR, BRIEF_REL_PATH, VERIFY_REL_PATH, AGENTS_REL_PATH, BRIEF_EXCLUDE_LINE, PACK_SAFE_ID, CLAIM_EVENT_LABEL, LINE_BREAKS, CONTROL_CHARS3, FOUNDER_POSTING_ID, CLAIM_SCREENSHOT_PUT_TIMEOUT_MS, CLAIM_RESOLUTION_REASONS, SETUP_FAILED_REQUIREMENTS, POSTING_LEVEL_RESOLUTION_REASONS, RESOLUTION_REASON_BLURB;
+var TERMINALHIRE_DIR17, INDEX_CACHE_FILE5, CLAIM_PUSH_MARKER, REPO_CONTINUITY_NUDGE_MARKER, API_URL6, CLAIM_SYNC_BASE4, CLAIM_CONSENT_VERSION, CLAIM_POLL_INTERVAL_MS, CLAIM_POLL_TIMEOUT_MS, CLAIM_SYNC_WRITE_TIMEOUT_MS, GH_API3, GH_HEADERS2, CONTENTION_HINT, AI_DISCLOSURE_NOTE, pExecFile, VALUE_FLAGS, BASELINE_STATUSES, MIN_TEST_BUDGET_MINUTES, MAX_TEST_BUDGET_MINUTES, ASSIGNMENT_MARKER, STAKE_MARKER, STANDDOWN_MARKER, OUR_MARKERS, STAKE_POST_TIMEOUT_MS, STAKE_POSTING_GRACE_MS, TAKE_BOT_REPOS, SUBMIT_ACCEPTS, REVISE_RECOVERY_STATES, CLOSED_STATES, GH_SESSION_COOKIE4, PUSH_TOKEN_REFUSAL, SYNC_BACKGROUND_PUSH_ACTIVE_FIELD, ISSUE_OUTCOME_TERMINAL, RUNS_POLL_INTERVAL_MS, RUNS_POLL_ATTEMPTS, OPENABLE_AGENTS, BRIEF_DIR, BRIEF_REL_PATH, VERIFY_REL_PATH, AGENTS_REL_PATH, BRIEF_EXCLUDE_LINE, PACK_SAFE_ID, CLAIM_EVENT_LABEL, LINE_BREAKS, CONTROL_CHARS3, FOUNDER_POSTING_ID, CLAIM_SCREENSHOT_PUT_TIMEOUT_MS, DEPENDENCY_SECTIONS2, SENDABLE_LOCKFILES, CLAIM_RESOLUTION_REASONS, SETUP_FAILED_REQUIREMENTS, POSTING_LEVEL_RESOLUTION_REASONS, RESOLUTION_REASON_BLURB;
 var init_jpi_claim = __esm({
   "bin/jpi-claim.js"() {
     "use strict";
@@ -51004,6 +51122,7 @@ var init_jpi_claim = __esm({
     init_claim_push_bg();
     init_founder_verdict_sync();
     init_founder_note_sync();
+    init_review_mode_copy();
     TERMINALHIRE_DIR17 = process.env.TERMINALHIRE_DIR || join46(homedir26(), ".terminalhire");
     INDEX_CACHE_FILE5 = join46(TERMINALHIRE_DIR17, "index-cache.json");
     CLAIM_PUSH_MARKER = join46(TERMINALHIRE_DIR17, "claim-push.json");
@@ -51121,6 +51240,16 @@ var init_jpi_claim = __esm({
     CONTROL_CHARS3 = /[\u0000-\u001F\u007F-\u009F]/g;
     FOUNDER_POSTING_ID = /^fb_[A-Za-z0-9_-]{1,80}$/;
     CLAIM_SCREENSHOT_PUT_TIMEOUT_MS = 2e4;
+    DEPENDENCY_SECTIONS2 = [
+      "dependencies",
+      "devDependencies",
+      "optionalDependencies",
+      "peerDependencies"
+    ];
+    SENDABLE_LOCKFILES = [
+      ["package-lock.json", "npm install"],
+      ["yarn.lock", "yarn install"]
+    ];
     CLAIM_RESOLUTION_REASONS = [
       "not-my-stack",
       "out-of-time",

package/dist/bin/jpi-mcp.js

@@ -12169,6 +12169,17 @@ var init_founder_note_sync = __esm({
   }
 });
 
+// bin/review-mode-copy.js
+var POSTER_REVIEWED, CLAIMANT_NOTICE, HISTORY_LINE;
+var init_review_mode_copy = __esm({
+  "bin/review-mode-copy.js"() {
+    "use strict";
+    POSTER_REVIEWED = "poster";
+    CLAIMANT_NOTICE = "The poster reviews this work by hand. We don't run tests on it.";
+    HISTORY_LINE = "Submitted for the poster's review.";
+  }
+});
+
 // ../../packages/core/src/policy-audit.ts
 function fence(nonce, body) {
   return `<<<UNTRUSTED-${nonce}
@@ -31590,7 +31601,8 @@ var init_result = __esm({
       "leakState",
       "venue",
       "refusalOrigin",
-      "stoppedAt"
+      "stoppedAt",
+      "installFrozen"
     ];
     RENDER_NONE = null;
     FIELD_VIEWS = {
@@ -31655,7 +31667,10 @@ var init_result = __esm({
       // side refused in words a developer reads.
       refusalOrigin: RENDER_NONE,
       // Only when the run did not pass: on a green run "the last step" is just the last step.
-      stoppedAt: (r) => r.stoppedAt === null || r.outcome === "completed" ? null : `last step    ${r.stoppedAt} (the last package script named in the output)`
+      stoppedAt: (r) => r.stoppedAt === null || r.outcome === "completed" ? null : `last step    ${r.stoppedAt} (the last package script named in the output)`,
+      // The run already prints the unfrozen note while it runs (`installUnfrozenNote`); this is
+      // the record of it for the worker and the intake.
+      installFrozen: RENDER_NONE
     };
   }
 });
@@ -35693,6 +35708,10 @@ function nodeInstallCommand(repo) {
   return null;
 }
 function lockfileGaps(repo) {
+  const read = readLockfileGaps(repo);
+  return read === null || read.missing.length === 0 ? null : { lockfile: read.lockfile, missing: read.missing };
+}
+function readLockfileGaps(repo) {
   const pkg = readJsonObject(repo, "package.json");
   if (pkg === null)
     return null;
@@ -35719,7 +35738,7 @@ function lockfileGaps(repo) {
         missing.push(`${n}@${r} (${dir})`);
     }
   }
-  return missing.length === 0 ? null : { lockfile, missing };
+  return { lockfile, missing, rootRead: rootListing !== null };
 }
 function wantedDependencies(pkg) {
   const wanted = [];
@@ -38220,7 +38239,9 @@ function refusedRun(fields) {
     venue: null,
     refusalOrigin: fields.origin,
     // No test step ran, so there is no output to read a step from.
-    stoppedAt: null
+    stoppedAt: null,
+    // Refused before any install step ran.
+    installFrozen: null
   };
 }
 function refusalOriginOf(refusal2) {
@@ -38304,7 +38325,29 @@ function installUnfrozenNote(spec) {
   const u = spec.installUnfrozen;
   if (u === void 0)
     return null;
-  return `${u.lockfile} does not list ${u.missing.join(", ")}, so the install ran as \`${String(spec.installCommand)}\` without its frozen-lockfile check. Regenerate ${u.lockfile} before merging.`;
+  return `${u.lockfile} does not list ${u.missing.join(", ")}, so the install ran as \`${String(spec.installCommand)}\` without its frozen-lockfile check. Include the updated ${u.lockfile} in the patch, or regenerate it before merging.`;
+}
+function isFrozenInstallCommand(command) {
+  const lead = /^(?:(?:sudo|time)\s+|env(?:\s+[A-Za-z_]\w*=\S*)*\s+)*/.exec(command)?.[0] ?? "";
+  const install = command.slice(lead.length).split(/;|&&|\|\|/)[0]?.trim() ?? "";
+  if (/^npm ci(\s|$)/.test(install))
+    return true;
+  if (/^(yarn|pnpm|bun)\b/.test(install) && /\s--frozen-lockfile(?=\s|$)/.test(install)) {
+    return true;
+  }
+  return /^yarn\b/.test(install) && /\s--immutable(?=\s|$)/.test(install);
+}
+function installFrozenFor(spec, install) {
+  if (install === null)
+    return null;
+  const launched = install.exitCode !== INSTALL_NEVER_STARTED && (install.exitCode !== null || install.timedOut);
+  if (!launched)
+    return null;
+  if (spec.runtime !== "node")
+    return null;
+  if (spec.installUnfrozen !== void 0)
+    return false;
+  return isFrozenInstallCommand(install.command);
 }
 async function verifyWorkingDiff(req) {
   const ctx = {
@@ -38673,7 +38716,8 @@ async function runVerification(req, ctx) {
       // A run that reached a verdict was not refused, so neither side refused it.
       refusalOrigin: null,
       // Read from the full test output, not `outputTail`, which is an excerpt.
-      stoppedAt: readStoppedAt(verdict.test?.stdout ?? "", verdict.test?.stderr ?? "")
+      stoppedAt: readStoppedAt(verdict.test?.stdout ?? "", verdict.test?.stderr ?? ""),
+      installFrozen: installFrozenFor(spec, verdict.install)
     };
     let later = null;
     if (req.screenshots !== void 0) {
@@ -38872,7 +38916,7 @@ async function prepareBaseTree(o) {
     throw err;
   }
 }
-var ThRunError, OUTPUT_TAIL_BYTES, LOCKFILE_READ_CAP, FULL_COMMIT_ID, ALLOWED_URL_SCHEMES, SCP_STYLE, URL_SCHEME, WINDOWS_ABSOLUTE, UNC_PATH, TRANSPORT_REASON, SHA_REASON, FULL_SHA, MIN_GIT_VERSION_FOR_END_OF_OPTIONS, CloneUnavailableError, GIT_ENV_ALLOWLIST, credentialFreeHomeDir, SSH_ISOLATION_ARGS, WITHHELD_SEGMENT, UNPARSEABLE_TARGET, DEFERRED_GATE_TIMEOUT_MS, FAILURE_LINE, REDACTED_TARGET_REPO, REDACTED_TARGET_SHA;
+var ThRunError, OUTPUT_TAIL_BYTES, LOCKFILE_READ_CAP, FULL_COMMIT_ID, ALLOWED_URL_SCHEMES, SCP_STYLE, URL_SCHEME, WINDOWS_ABSOLUTE, UNC_PATH, TRANSPORT_REASON, SHA_REASON, FULL_SHA, MIN_GIT_VERSION_FOR_END_OF_OPTIONS, CloneUnavailableError, GIT_ENV_ALLOWLIST, credentialFreeHomeDir, SSH_ISOLATION_ARGS, WITHHELD_SEGMENT, UNPARSEABLE_TARGET, DEFERRED_GATE_TIMEOUT_MS, FAILURE_LINE, REDACTED_TARGET_REPO, REDACTED_TARGET_SHA, INSTALL_NEVER_STARTED;
 var init_thrun = __esm({
   "../../packages/envrun/dist/thrun.js"() {
     "use strict";
@@ -38961,6 +39005,7 @@ var init_thrun = __esm({
     FAILURE_LINE = /^(?:[ \t]*(?:not ok |FAILED |FAIL )|E {3}|# fail [1-9])/m;
     REDACTED_TARGET_REPO = "(refused before the target was accepted)";
     REDACTED_TARGET_SHA = "(refused)";
+    INSTALL_NEVER_STARTED = 125;
   }
 });
 
@@ -39862,6 +39907,7 @@ __export(dist_exports, {
   imageRepo: () => imageRepo,
   imageVariantFor: () => imageVariantFor,
   installCommandFor: () => installCommandFor,
+  installFrozenFor: () => installFrozenFor,
   installLocalMigrationTooling: () => installLocalMigrationTooling,
   installUnfrozenNote: () => installUnfrozenNote,
   isBookkeepingTable: () => isBookkeepingTable,
@@ -40258,6 +40304,7 @@ __export(jpi_claim_exports, {
   resolveBounty: () => resolveBounty,
   resolveDeliveryDir: () => resolveDeliveryDir,
   resolveSubmitWorktree: () => resolveSubmitWorktree,
+  reviewModeLine: () => reviewModeLine,
   reviseRecoveryCommand: () => reviseRecoveryCommand,
   revokeFailureAction: () => revokeFailureAction,
   run: () => run,
@@ -40725,9 +40772,15 @@ function extractClaimableFields(job) {
     // poster saw. Null when the index carries none.
     runRequirements: b.runRequirements && typeof b.runRequirements === "object" ? b.runRequirements : null,
     // TERM-1308. Present only when the index row carries them; no key otherwise.
-    ...b.bountySource === "founder" ? baselineFields(b) : {}
+    ...b.bountySource === "founder" ? baselineFields(b) : {},
+    // TERM-1344. The index carries `reviewMode` only for a poster-reviewed posting; any
+    // other value is dropped rather than carried, the same as a malformed baseline field.
+    ...b.bountySource === "founder" && b.reviewMode === POSTER_REVIEWED ? { reviewMode: POSTER_REVIEWED } : {}
   };
 }
+function reviewModeLine(b) {
+  return b?.reviewMode === POSTER_REVIEWED ? CLAIMANT_NOTICE : null;
+}
 function parseGitHubUrl(url) {
   const m = String(url ?? "").match(/github\.com\/([^/]+)\/([^/]+)\/(?:issues|pull)\/(\d+)/);
   if (!m) return null;
@@ -41333,7 +41386,7 @@ async function resolveBounty(arg) {
     if (freshPool) job = findByShortRefInPool(freshPool, arg);
   }
   if (job) {
-    let testBudgetMinutes, baselineStatus, baselineSha;
+    let testBudgetMinutes, baselineStatus, baselineSha, reviewMode;
     ({
       bountyId,
       title,
@@ -41347,12 +41400,15 @@ async function resolveBounty(arg) {
       runRequirements,
       testBudgetMinutes,
       baselineStatus,
-      baselineSha
+      baselineSha,
+      reviewMode
     } = extractClaimableFields(job));
     baseline = {
       ...testBudgetMinutes === void 0 ? {} : { testBudgetMinutes },
       ...baselineStatus === void 0 ? {} : { baselineStatus },
-      ...baselineSha === void 0 ? {} : { baselineSha }
+      ...baselineSha === void 0 ? {} : { baselineSha },
+      // TERM-1344. Rides with the baseline fields: index-only, and no key when absent.
+      ...reviewMode === void 0 ? {} : { reviewMode }
     };
     indexNativeId = bountyId;
   } else {
@@ -42112,6 +42168,8 @@ async function cmdPreview(arg, { json } = {}) {
         contested: isContested(b),
         // TERM-1308. The posting's test budget and baseline, only when the index carried them.
         ...baselineFields(b),
+        // TERM-1344. Only for a poster-reviewed posting; absent means tests.
+        ...b.reviewMode === POSTER_REVIEWED ? { reviewMode: POSTER_REVIEWED } : {},
         // Absent on a founder posting — see the scan above. A consumer must read
         // "no policy key" as "no policy step exists here", never as "clean".
         ...policy ? {
@@ -42142,8 +42200,8 @@ async function cmdPreview(arg, { json } = {}) {
   console.log(fmtOpenPRsLine(b));
   const previewContested = fmtContestedWarning(b);
   if (previewContested) console.log(previewContested);
-  const previewBaseline = baselineLine(b);
-  if (previewBaseline) console.log(`  tests:  ${previewBaseline}`);
+  const previewTests = reviewModeLine(b) ?? baselineLine(b);
+  if (previewTests) console.log(`  tests:  ${previewTests}`);
   if (policy) printPolicySection(policy);
   if (process.stdout.isTTY) {
     try {
@@ -43399,7 +43457,8 @@ function renderRunView(run3, message2, extra = {}) {
   const rateLimitCap = extra.rateLimitCap ?? run3.rateLimitCap ?? 5;
   const rateLimitCount = extra.rateLimitCount ?? run3.rateLimitCount;
   if (claimState) {
-    lines.push(`  state:      ${terminalSafeInline(claimState)}`);
+    const stateText = claimState === "poster-review" ? HISTORY_LINE : terminalSafeInline(claimState);
+    lines.push(`  state:      ${stateText}`);
   }
   if (unverifiedCause) {
     lines.push(`  cause:      ${terminalSafeInline(unverifiedCause)}`);
@@ -43445,7 +43504,8 @@ function renderClaimHistory(attempts, timeline) {
   for (const a of runs) {
     const sha = a.commitSha ? String(a.commitSha).slice(0, 10) : "";
     const jobs = Array.isArray(a.failingJobs) && a.failingJobs.length > 0 ? ` \u2014 ${a.failingJobs.map(terminalSafeInline).join(", ")}` : "";
-    const outcome = a.conclusion ? `checks ${terminalSafeInline(a.conclusion)}${jobs}` : a.status === "no-ci" ? "no checks ran" : "checks running";
+    const note = typeof a.note === "string" ? terminalSafeInline(a.note).trim() : "";
+    const outcome = a.conclusion ? `checks ${terminalSafeInline(a.conclusion)}${jobs}` : note !== "" ? note : a.status === "no-ci" ? "no checks ran" : "checks running";
     lines.push(`  attempt ${a.attemptNumber}  ${sha}  ${outcome}  ${shortWhen(a.at)}`);
   }
   for (const e of told) {
@@ -44195,6 +44255,57 @@ async function uploadClaimScreenshots(intake, uploads) {
     );
   }
 }
+async function packageJsonAt(wt, rev, path5) {
+  let text;
+  try {
+    ({ stdout: text } = await pExecFile("git", ["-C", wt, "show", `${rev}:${path5}`], {
+      shell: false,
+      maxBuffer: 16 * 1024 * 1024
+    }));
+  } catch {
+    return {};
+  }
+  try {
+    const parsed = JSON.parse(String(text));
+    return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function sectionKey(pkg, section) {
+  const value = pkg[section];
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return JSON.stringify(value ?? null);
+  }
+  return JSON.stringify(Object.keys(value).sort().map((k) => [k, value[k]]));
+}
+async function patchChangesDependencies(wt, base, touched) {
+  for (const path5 of touched) {
+    if (path5.split("/").pop() !== "package.json") continue;
+    const before = await packageJsonAt(wt, base, path5);
+    const after = await packageJsonAt(wt, "HEAD", path5);
+    if (before === null || after === null) continue;
+    if (DEPENDENCY_SECTIONS2.some((s) => sectionKey(before, s) !== sectionKey(after, s))) return true;
+  }
+  return false;
+}
+async function dependencyLockfileWarnings(wt, base, touched) {
+  if (!await patchChangesDependencies(wt, base, touched)) return [];
+  const warnings = [];
+  for (const [lockfile, cmd] of SENDABLE_LOCKFILES) {
+    let present;
+    try {
+      present = (await sh("git", ["-C", wt, "ls-tree", "--name-only", base, "--", lockfile])).trim() === lockfile;
+    } catch {
+      present = false;
+    }
+    if (!present || touched.includes(lockfile)) continue;
+    warnings.push(
+      `  \u26A0 package.json changes dependencies, but ${lockfile} is not in this patch. The run will install without its frozen-lockfile check. Run \`${cmd}\` and commit ${lockfile} to keep it frozen.`
+    );
+  }
+  return warnings;
+}
 async function submitFounderPatch({ claims, claim, id, wt, flags }) {
   let roots;
   try {
@@ -44245,6 +44356,9 @@ async function submitFounderPatch({ claims, claim, id, wt, flags }) {
     );
     process.exit(1);
   }
+  const lockfileWarnings = await dependencyLockfileWarnings(wt, base, touched);
+  if (lockfileWarnings.length > 0) console.log(`
+${lockfileWarnings.join("\n")}`);
   const authorName = await sh("git", ["-C", wt, "log", "-1", "--format=%an"]);
   const authorEmail = await sh("git", ["-C", wt, "log", "-1", "--format=%ae"]);
   const shots = flags.screenshots === void 0 ? null : loadClaimScreenshots(flags.screenshots);
@@ -45754,7 +45868,7 @@ async function run() {
     process.exit(1);
   }
 }
-var TERMINALHIRE_DIR11, INDEX_CACHE_FILE2, CLAIM_PUSH_MARKER, REPO_CONTINUITY_NUDGE_MARKER, API_URL, CLAIM_SYNC_BASE4, CLAIM_CONSENT_VERSION, CLAIM_POLL_INTERVAL_MS, CLAIM_POLL_TIMEOUT_MS, CLAIM_SYNC_WRITE_TIMEOUT_MS, GH_API2, GH_HEADERS2, CONTENTION_HINT, AI_DISCLOSURE_NOTE, pExecFile, VALUE_FLAGS, BASELINE_STATUSES, MIN_TEST_BUDGET_MINUTES, MAX_TEST_BUDGET_MINUTES, ASSIGNMENT_MARKER, STAKE_MARKER, STANDDOWN_MARKER, OUR_MARKERS, STAKE_POST_TIMEOUT_MS, STAKE_POSTING_GRACE_MS, TAKE_BOT_REPOS, SUBMIT_ACCEPTS, REVISE_RECOVERY_STATES, CLOSED_STATES, GH_SESSION_COOKIE, PUSH_TOKEN_REFUSAL, SYNC_BACKGROUND_PUSH_ACTIVE_FIELD, ISSUE_OUTCOME_TERMINAL, RUNS_POLL_INTERVAL_MS, RUNS_POLL_ATTEMPTS, OPENABLE_AGENTS, BRIEF_DIR, BRIEF_REL_PATH, VERIFY_REL_PATH, AGENTS_REL_PATH, BRIEF_EXCLUDE_LINE, PACK_SAFE_ID, CLAIM_EVENT_LABEL, LINE_BREAKS, CONTROL_CHARS3, FOUNDER_POSTING_ID, CLAIM_SCREENSHOT_PUT_TIMEOUT_MS, CLAIM_RESOLUTION_REASONS, SETUP_FAILED_REQUIREMENTS, POSTING_LEVEL_RESOLUTION_REASONS, RESOLUTION_REASON_BLURB;
+var TERMINALHIRE_DIR11, INDEX_CACHE_FILE2, CLAIM_PUSH_MARKER, REPO_CONTINUITY_NUDGE_MARKER, API_URL, CLAIM_SYNC_BASE4, CLAIM_CONSENT_VERSION, CLAIM_POLL_INTERVAL_MS, CLAIM_POLL_TIMEOUT_MS, CLAIM_SYNC_WRITE_TIMEOUT_MS, GH_API2, GH_HEADERS2, CONTENTION_HINT, AI_DISCLOSURE_NOTE, pExecFile, VALUE_FLAGS, BASELINE_STATUSES, MIN_TEST_BUDGET_MINUTES, MAX_TEST_BUDGET_MINUTES, ASSIGNMENT_MARKER, STAKE_MARKER, STANDDOWN_MARKER, OUR_MARKERS, STAKE_POST_TIMEOUT_MS, STAKE_POSTING_GRACE_MS, TAKE_BOT_REPOS, SUBMIT_ACCEPTS, REVISE_RECOVERY_STATES, CLOSED_STATES, GH_SESSION_COOKIE, PUSH_TOKEN_REFUSAL, SYNC_BACKGROUND_PUSH_ACTIVE_FIELD, ISSUE_OUTCOME_TERMINAL, RUNS_POLL_INTERVAL_MS, RUNS_POLL_ATTEMPTS, OPENABLE_AGENTS, BRIEF_DIR, BRIEF_REL_PATH, VERIFY_REL_PATH, AGENTS_REL_PATH, BRIEF_EXCLUDE_LINE, PACK_SAFE_ID, CLAIM_EVENT_LABEL, LINE_BREAKS, CONTROL_CHARS3, FOUNDER_POSTING_ID, CLAIM_SCREENSHOT_PUT_TIMEOUT_MS, DEPENDENCY_SECTIONS2, SENDABLE_LOCKFILES, CLAIM_RESOLUTION_REASONS, SETUP_FAILED_REQUIREMENTS, POSTING_LEVEL_RESOLUTION_REASONS, RESOLUTION_REASON_BLURB;
 var init_jpi_claim = __esm({
   "bin/jpi-claim.js"() {
     "use strict";
@@ -45770,6 +45884,7 @@ var init_jpi_claim = __esm({
     init_claim_push_bg();
     init_founder_verdict_sync();
     init_founder_note_sync();
+    init_review_mode_copy();
     TERMINALHIRE_DIR11 = process.env.TERMINALHIRE_DIR || join32(homedir15(), ".terminalhire");
     INDEX_CACHE_FILE2 = join32(TERMINALHIRE_DIR11, "index-cache.json");
     CLAIM_PUSH_MARKER = join32(TERMINALHIRE_DIR11, "claim-push.json");
@@ -45887,6 +46002,16 @@ var init_jpi_claim = __esm({
     CONTROL_CHARS3 = /[\u0000-\u001F\u007F-\u009F]/g;
     FOUNDER_POSTING_ID = /^fb_[A-Za-z0-9_-]{1,80}$/;
     CLAIM_SCREENSHOT_PUT_TIMEOUT_MS = 2e4;
+    DEPENDENCY_SECTIONS2 = [
+      "dependencies",
+      "devDependencies",
+      "optionalDependencies",
+      "peerDependencies"
+    ];
+    SENDABLE_LOCKFILES = [
+      ["package-lock.json", "npm install"],
+      ["yarn.lock", "yarn install"]
+    ];
     CLAIM_RESOLUTION_REASONS = [
       "not-my-stack",
       "out-of-time",

package/dist/bin/jpi-run.js

@@ -5424,7 +5424,8 @@ var init_result = __esm({
       "leakState",
       "venue",
       "refusalOrigin",
-      "stoppedAt"
+      "stoppedAt",
+      "installFrozen"
     ];
     RENDER_NONE = null;
     FIELD_VIEWS = {
@@ -5489,7 +5490,10 @@ var init_result = __esm({
       // side refused in words a developer reads.
       refusalOrigin: RENDER_NONE,
       // Only when the run did not pass: on a green run "the last step" is just the last step.
-      stoppedAt: (r) => r.stoppedAt === null || r.outcome === "completed" ? null : `last step    ${r.stoppedAt} (the last package script named in the output)`
+      stoppedAt: (r) => r.stoppedAt === null || r.outcome === "completed" ? null : `last step    ${r.stoppedAt} (the last package script named in the output)`,
+      // The run already prints the unfrozen note while it runs (`installUnfrozenNote`); this is
+      // the record of it for the worker and the intake.
+      installFrozen: RENDER_NONE
     };
   }
 });
@@ -9527,6 +9531,10 @@ function nodeInstallCommand(repo) {
   return null;
 }
 function lockfileGaps(repo) {
+  const read = readLockfileGaps(repo);
+  return read === null || read.missing.length === 0 ? null : { lockfile: read.lockfile, missing: read.missing };
+}
+function readLockfileGaps(repo) {
   const pkg = readJsonObject(repo, "package.json");
   if (pkg === null)
     return null;
@@ -9553,7 +9561,7 @@ function lockfileGaps(repo) {
         missing.push(`${n}@${r} (${dir})`);
     }
   }
-  return missing.length === 0 ? null : { lockfile, missing };
+  return { lockfile, missing, rootRead: rootListing !== null };
 }
 function wantedDependencies(pkg) {
   const wanted = [];
@@ -12229,7 +12237,9 @@ function refusedRun(fields) {
     venue: null,
     refusalOrigin: fields.origin,
     // No test step ran, so there is no output to read a step from.
-    stoppedAt: null
+    stoppedAt: null,
+    // Refused before any install step ran.
+    installFrozen: null
   };
 }
 function refusalOriginOf(refusal2) {
@@ -12313,7 +12323,29 @@ function installUnfrozenNote(spec) {
   const u = spec.installUnfrozen;
   if (u === void 0)
     return null;
-  return `${u.lockfile} does not list ${u.missing.join(", ")}, so the install ran as \`${String(spec.installCommand)}\` without its frozen-lockfile check. Regenerate ${u.lockfile} before merging.`;
+  return `${u.lockfile} does not list ${u.missing.join(", ")}, so the install ran as \`${String(spec.installCommand)}\` without its frozen-lockfile check. Include the updated ${u.lockfile} in the patch, or regenerate it before merging.`;
+}
+function isFrozenInstallCommand(command) {
+  const lead = /^(?:(?:sudo|time)\s+|env(?:\s+[A-Za-z_]\w*=\S*)*\s+)*/.exec(command)?.[0] ?? "";
+  const install = command.slice(lead.length).split(/;|&&|\|\|/)[0]?.trim() ?? "";
+  if (/^npm ci(\s|$)/.test(install))
+    return true;
+  if (/^(yarn|pnpm|bun)\b/.test(install) && /\s--frozen-lockfile(?=\s|$)/.test(install)) {
+    return true;
+  }
+  return /^yarn\b/.test(install) && /\s--immutable(?=\s|$)/.test(install);
+}
+function installFrozenFor(spec, install) {
+  if (install === null)
+    return null;
+  const launched = install.exitCode !== INSTALL_NEVER_STARTED && (install.exitCode !== null || install.timedOut);
+  if (!launched)
+    return null;
+  if (spec.runtime !== "node")
+    return null;
+  if (spec.installUnfrozen !== void 0)
+    return false;
+  return isFrozenInstallCommand(install.command);
 }
 async function verifyWorkingDiff(req) {
   const ctx = {
@@ -12682,7 +12714,8 @@ async function runVerification(req, ctx) {
       // A run that reached a verdict was not refused, so neither side refused it.
       refusalOrigin: null,
       // Read from the full test output, not `outputTail`, which is an excerpt.
-      stoppedAt: readStoppedAt(verdict.test?.stdout ?? "", verdict.test?.stderr ?? "")
+      stoppedAt: readStoppedAt(verdict.test?.stdout ?? "", verdict.test?.stderr ?? ""),
+      installFrozen: installFrozenFor(spec, verdict.install)
     };
     let later = null;
     if (req.screenshots !== void 0) {
@@ -12881,7 +12914,7 @@ async function prepareBaseTree(o) {
     throw err;
   }
 }
-var ThRunError, OUTPUT_TAIL_BYTES, LOCKFILE_READ_CAP, FULL_COMMIT_ID, ALLOWED_URL_SCHEMES, SCP_STYLE, URL_SCHEME, WINDOWS_ABSOLUTE, UNC_PATH, TRANSPORT_REASON, SHA_REASON, FULL_SHA, MIN_GIT_VERSION_FOR_END_OF_OPTIONS, CloneUnavailableError, GIT_ENV_ALLOWLIST, credentialFreeHomeDir, SSH_ISOLATION_ARGS, WITHHELD_SEGMENT, UNPARSEABLE_TARGET, DEFERRED_GATE_TIMEOUT_MS, FAILURE_LINE, REDACTED_TARGET_REPO, REDACTED_TARGET_SHA;
+var ThRunError, OUTPUT_TAIL_BYTES, LOCKFILE_READ_CAP, FULL_COMMIT_ID, ALLOWED_URL_SCHEMES, SCP_STYLE, URL_SCHEME, WINDOWS_ABSOLUTE, UNC_PATH, TRANSPORT_REASON, SHA_REASON, FULL_SHA, MIN_GIT_VERSION_FOR_END_OF_OPTIONS, CloneUnavailableError, GIT_ENV_ALLOWLIST, credentialFreeHomeDir, SSH_ISOLATION_ARGS, WITHHELD_SEGMENT, UNPARSEABLE_TARGET, DEFERRED_GATE_TIMEOUT_MS, FAILURE_LINE, REDACTED_TARGET_REPO, REDACTED_TARGET_SHA, INSTALL_NEVER_STARTED;
 var init_thrun = __esm({
   "../../packages/envrun/dist/thrun.js"() {
     "use strict";
@@ -12970,6 +13003,7 @@ var init_thrun = __esm({
     FAILURE_LINE = /^(?:[ \t]*(?:not ok |FAILED |FAIL )|E {3}|# fail [1-9])/m;
     REDACTED_TARGET_REPO = "(refused before the target was accepted)";
     REDACTED_TARGET_SHA = "(refused)";
+    INSTALL_NEVER_STARTED = 125;
   }
 });
 
@@ -13871,6 +13905,7 @@ __export(dist_exports, {
   imageRepo: () => imageRepo,
   imageVariantFor: () => imageVariantFor,
   installCommandFor: () => installCommandFor,
+  installFrozenFor: () => installFrozenFor,
   installLocalMigrationTooling: () => installLocalMigrationTooling,
   installUnfrozenNote: () => installUnfrozenNote,
   isBookkeepingTable: () => isBookkeepingTable,
@@ -25318,6 +25353,17 @@ var init_founder_note_sync = __esm({
   }
 });
 
+// bin/review-mode-copy.js
+var POSTER_REVIEWED, CLAIMANT_NOTICE, HISTORY_LINE;
+var init_review_mode_copy = __esm({
+  "bin/review-mode-copy.js"() {
+    "use strict";
+    POSTER_REVIEWED = "poster";
+    CLAIMANT_NOTICE = "The poster reviews this work by hand. We don't run tests on it.";
+    HISTORY_LINE = "Submitted for the poster's review.";
+  }
+});
+
 // ../../packages/core/src/policy-audit.ts
 function fence(nonce, body) {
   return `<<<UNTRUSTED-${nonce}
@@ -40251,6 +40297,7 @@ __export(jpi_claim_exports, {
   resolveBounty: () => resolveBounty,
   resolveDeliveryDir: () => resolveDeliveryDir,
   resolveSubmitWorktree: () => resolveSubmitWorktree,
+  reviewModeLine: () => reviewModeLine,
   reviseRecoveryCommand: () => reviseRecoveryCommand,
   revokeFailureAction: () => revokeFailureAction,
   run: () => run,
@@ -40718,9 +40765,15 @@ function extractClaimableFields(job) {
     // poster saw. Null when the index carries none.
     runRequirements: b.runRequirements && typeof b.runRequirements === "object" ? b.runRequirements : null,
     // TERM-1308. Present only when the index row carries them; no key otherwise.
-    ...b.bountySource === "founder" ? baselineFields(b) : {}
+    ...b.bountySource === "founder" ? baselineFields(b) : {},
+    // TERM-1344. The index carries `reviewMode` only for a poster-reviewed posting; any
+    // other value is dropped rather than carried, the same as a malformed baseline field.
+    ...b.bountySource === "founder" && b.reviewMode === POSTER_REVIEWED ? { reviewMode: POSTER_REVIEWED } : {}
   };
 }
+function reviewModeLine(b) {
+  return b?.reviewMode === POSTER_REVIEWED ? CLAIMANT_NOTICE : null;
+}
 function parseGitHubUrl(url) {
   const m = String(url ?? "").match(/github\.com\/([^/]+)\/([^/]+)\/(?:issues|pull)\/(\d+)/);
   if (!m) return null;
@@ -41326,7 +41379,7 @@ async function resolveBounty(arg) {
     if (freshPool) job = findByShortRefInPool(freshPool, arg);
   }
   if (job) {
-    let testBudgetMinutes, baselineStatus, baselineSha;
+    let testBudgetMinutes, baselineStatus, baselineSha, reviewMode;
     ({
       bountyId,
       title,
@@ -41340,12 +41393,15 @@ async function resolveBounty(arg) {
       runRequirements,
       testBudgetMinutes,
       baselineStatus,
-      baselineSha
+      baselineSha,
+      reviewMode
     } = extractClaimableFields(job));
     baseline = {
       ...testBudgetMinutes === void 0 ? {} : { testBudgetMinutes },
       ...baselineStatus === void 0 ? {} : { baselineStatus },
-      ...baselineSha === void 0 ? {} : { baselineSha }
+      ...baselineSha === void 0 ? {} : { baselineSha },
+      // TERM-1344. Rides with the baseline fields: index-only, and no key when absent.
+      ...reviewMode === void 0 ? {} : { reviewMode }
     };
     indexNativeId = bountyId;
   } else {
@@ -42105,6 +42161,8 @@ async function cmdPreview(arg, { json } = {}) {
         contested: isContested(b),
         // TERM-1308. The posting's test budget and baseline, only when the index carried them.
         ...baselineFields(b),
+        // TERM-1344. Only for a poster-reviewed posting; absent means tests.
+        ...b.reviewMode === POSTER_REVIEWED ? { reviewMode: POSTER_REVIEWED } : {},
         // Absent on a founder posting — see the scan above. A consumer must read
         // "no policy key" as "no policy step exists here", never as "clean".
         ...policy ? {
@@ -42135,8 +42193,8 @@ async function cmdPreview(arg, { json } = {}) {
   console.log(fmtOpenPRsLine(b));
   const previewContested = fmtContestedWarning(b);
   if (previewContested) console.log(previewContested);
-  const previewBaseline = baselineLine(b);
-  if (previewBaseline) console.log(`  tests:  ${previewBaseline}`);
+  const previewTests = reviewModeLine(b) ?? baselineLine(b);
+  if (previewTests) console.log(`  tests:  ${previewTests}`);
   if (policy) printPolicySection(policy);
   if (process.stdout.isTTY) {
     try {
@@ -43392,7 +43450,8 @@ function renderRunView(run3, message2, extra = {}) {
   const rateLimitCap = extra.rateLimitCap ?? run3.rateLimitCap ?? 5;
   const rateLimitCount = extra.rateLimitCount ?? run3.rateLimitCount;
   if (claimState) {
-    lines.push(`  state:      ${terminalSafeInline(claimState)}`);
+    const stateText = claimState === "poster-review" ? HISTORY_LINE : terminalSafeInline(claimState);
+    lines.push(`  state:      ${stateText}`);
   }
   if (unverifiedCause) {
     lines.push(`  cause:      ${terminalSafeInline(unverifiedCause)}`);
@@ -43438,7 +43497,8 @@ function renderClaimHistory(attempts, timeline) {
   for (const a of runs) {
     const sha = a.commitSha ? String(a.commitSha).slice(0, 10) : "";
     const jobs = Array.isArray(a.failingJobs) && a.failingJobs.length > 0 ? ` \u2014 ${a.failingJobs.map(terminalSafeInline).join(", ")}` : "";
-    const outcome = a.conclusion ? `checks ${terminalSafeInline(a.conclusion)}${jobs}` : a.status === "no-ci" ? "no checks ran" : "checks running";
+    const note = typeof a.note === "string" ? terminalSafeInline(a.note).trim() : "";
+    const outcome = a.conclusion ? `checks ${terminalSafeInline(a.conclusion)}${jobs}` : note !== "" ? note : a.status === "no-ci" ? "no checks ran" : "checks running";
     lines.push(`  attempt ${a.attemptNumber}  ${sha}  ${outcome}  ${shortWhen(a.at)}`);
   }
   for (const e of told) {
@@ -44188,6 +44248,57 @@ async function uploadClaimScreenshots(intake, uploads) {
     );
   }
 }
+async function packageJsonAt(wt, rev, path5) {
+  let text;
+  try {
+    ({ stdout: text } = await pExecFile("git", ["-C", wt, "show", `${rev}:${path5}`], {
+      shell: false,
+      maxBuffer: 16 * 1024 * 1024
+    }));
+  } catch {
+    return {};
+  }
+  try {
+    const parsed = JSON.parse(String(text));
+    return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function sectionKey(pkg, section) {
+  const value = pkg[section];
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return JSON.stringify(value ?? null);
+  }
+  return JSON.stringify(Object.keys(value).sort().map((k) => [k, value[k]]));
+}
+async function patchChangesDependencies(wt, base, touched) {
+  for (const path5 of touched) {
+    if (path5.split("/").pop() !== "package.json") continue;
+    const before = await packageJsonAt(wt, base, path5);
+    const after = await packageJsonAt(wt, "HEAD", path5);
+    if (before === null || after === null) continue;
+    if (DEPENDENCY_SECTIONS2.some((s) => sectionKey(before, s) !== sectionKey(after, s))) return true;
+  }
+  return false;
+}
+async function dependencyLockfileWarnings(wt, base, touched) {
+  if (!await patchChangesDependencies(wt, base, touched)) return [];
+  const warnings = [];
+  for (const [lockfile, cmd] of SENDABLE_LOCKFILES) {
+    let present;
+    try {
+      present = (await sh("git", ["-C", wt, "ls-tree", "--name-only", base, "--", lockfile])).trim() === lockfile;
+    } catch {
+      present = false;
+    }
+    if (!present || touched.includes(lockfile)) continue;
+    warnings.push(
+      `  \u26A0 package.json changes dependencies, but ${lockfile} is not in this patch. The run will install without its frozen-lockfile check. Run \`${cmd}\` and commit ${lockfile} to keep it frozen.`
+    );
+  }
+  return warnings;
+}
 async function submitFounderPatch({ claims, claim, id, wt, flags }) {
   let roots;
   try {
@@ -44238,6 +44349,9 @@ async function submitFounderPatch({ claims, claim, id, wt, flags }) {
     );
     process.exit(1);
   }
+  const lockfileWarnings = await dependencyLockfileWarnings(wt, base, touched);
+  if (lockfileWarnings.length > 0) console.log(`
+${lockfileWarnings.join("\n")}`);
   const authorName = await sh("git", ["-C", wt, "log", "-1", "--format=%an"]);
   const authorEmail = await sh("git", ["-C", wt, "log", "-1", "--format=%ae"]);
   const shots = flags.screenshots === void 0 ? null : loadClaimScreenshots(flags.screenshots);
@@ -45747,7 +45861,7 @@ async function run() {
     process.exit(1);
   }
 }
-var TERMINALHIRE_DIR11, INDEX_CACHE_FILE2, CLAIM_PUSH_MARKER, REPO_CONTINUITY_NUDGE_MARKER, API_URL, CLAIM_SYNC_BASE4, CLAIM_CONSENT_VERSION, CLAIM_POLL_INTERVAL_MS, CLAIM_POLL_TIMEOUT_MS, CLAIM_SYNC_WRITE_TIMEOUT_MS, GH_API2, GH_HEADERS2, CONTENTION_HINT, AI_DISCLOSURE_NOTE, pExecFile, VALUE_FLAGS, BASELINE_STATUSES, MIN_TEST_BUDGET_MINUTES, MAX_TEST_BUDGET_MINUTES, ASSIGNMENT_MARKER, STAKE_MARKER, STANDDOWN_MARKER, OUR_MARKERS, STAKE_POST_TIMEOUT_MS, STAKE_POSTING_GRACE_MS, TAKE_BOT_REPOS, SUBMIT_ACCEPTS, REVISE_RECOVERY_STATES, CLOSED_STATES, GH_SESSION_COOKIE, PUSH_TOKEN_REFUSAL, SYNC_BACKGROUND_PUSH_ACTIVE_FIELD, ISSUE_OUTCOME_TERMINAL, RUNS_POLL_INTERVAL_MS, RUNS_POLL_ATTEMPTS, OPENABLE_AGENTS, BRIEF_DIR, BRIEF_REL_PATH, VERIFY_REL_PATH, AGENTS_REL_PATH, BRIEF_EXCLUDE_LINE, PACK_SAFE_ID, CLAIM_EVENT_LABEL, LINE_BREAKS, CONTROL_CHARS3, FOUNDER_POSTING_ID, CLAIM_SCREENSHOT_PUT_TIMEOUT_MS, CLAIM_RESOLUTION_REASONS, SETUP_FAILED_REQUIREMENTS, POSTING_LEVEL_RESOLUTION_REASONS, RESOLUTION_REASON_BLURB;
+var TERMINALHIRE_DIR11, INDEX_CACHE_FILE2, CLAIM_PUSH_MARKER, REPO_CONTINUITY_NUDGE_MARKER, API_URL, CLAIM_SYNC_BASE4, CLAIM_CONSENT_VERSION, CLAIM_POLL_INTERVAL_MS, CLAIM_POLL_TIMEOUT_MS, CLAIM_SYNC_WRITE_TIMEOUT_MS, GH_API2, GH_HEADERS2, CONTENTION_HINT, AI_DISCLOSURE_NOTE, pExecFile, VALUE_FLAGS, BASELINE_STATUSES, MIN_TEST_BUDGET_MINUTES, MAX_TEST_BUDGET_MINUTES, ASSIGNMENT_MARKER, STAKE_MARKER, STANDDOWN_MARKER, OUR_MARKERS, STAKE_POST_TIMEOUT_MS, STAKE_POSTING_GRACE_MS, TAKE_BOT_REPOS, SUBMIT_ACCEPTS, REVISE_RECOVERY_STATES, CLOSED_STATES, GH_SESSION_COOKIE, PUSH_TOKEN_REFUSAL, SYNC_BACKGROUND_PUSH_ACTIVE_FIELD, ISSUE_OUTCOME_TERMINAL, RUNS_POLL_INTERVAL_MS, RUNS_POLL_ATTEMPTS, OPENABLE_AGENTS, BRIEF_DIR, BRIEF_REL_PATH, VERIFY_REL_PATH, AGENTS_REL_PATH, BRIEF_EXCLUDE_LINE, PACK_SAFE_ID, CLAIM_EVENT_LABEL, LINE_BREAKS, CONTROL_CHARS3, FOUNDER_POSTING_ID, CLAIM_SCREENSHOT_PUT_TIMEOUT_MS, DEPENDENCY_SECTIONS2, SENDABLE_LOCKFILES, CLAIM_RESOLUTION_REASONS, SETUP_FAILED_REQUIREMENTS, POSTING_LEVEL_RESOLUTION_REASONS, RESOLUTION_REASON_BLURB;
 var init_jpi_claim = __esm({
   "bin/jpi-claim.js"() {
     "use strict";
@@ -45763,6 +45877,7 @@ var init_jpi_claim = __esm({
     init_claim_push_bg();
     init_founder_verdict_sync();
     init_founder_note_sync();
+    init_review_mode_copy();
     TERMINALHIRE_DIR11 = process.env.TERMINALHIRE_DIR || join33(homedir15(), ".terminalhire");
     INDEX_CACHE_FILE2 = join33(TERMINALHIRE_DIR11, "index-cache.json");
     CLAIM_PUSH_MARKER = join33(TERMINALHIRE_DIR11, "claim-push.json");
@@ -45880,6 +45995,16 @@ var init_jpi_claim = __esm({
     CONTROL_CHARS3 = /[\u0000-\u001F\u007F-\u009F]/g;
     FOUNDER_POSTING_ID = /^fb_[A-Za-z0-9_-]{1,80}$/;
     CLAIM_SCREENSHOT_PUT_TIMEOUT_MS = 2e4;
+    DEPENDENCY_SECTIONS2 = [
+      "dependencies",
+      "devDependencies",
+      "optionalDependencies",
+      "peerDependencies"
+    ];
+    SENDABLE_LOCKFILES = [
+      ["package-lock.json", "npm install"],
+      ["yarn.lock", "yarn install"]
+    ];
     CLAIM_RESOLUTION_REASONS = [
       "not-my-stack",
       "out-of-time",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "terminalhire",
-  "version": "0.42.41",
+  "version": "0.42.43",
   "description": "Developer jobs and paid bounties, matched in the terminal — ambient matches in the Claude Code spinner. Claim a scoped bounty and get paid when the poster accepts it.",
   "repository": {
     "type": "git",