Multi-AI: vendor/route split, blind rounds, Antigravity, and a review panel that found its own bugs

[Unconfirmed2]

Brings the Multi-AI tab's local branch up to date. 67 commits ahead of main; the last 19 are from one working session and are what this description covers. Full suite green: 799 tests, 0 failures.

The roster answers two questions instead of one

"Claude" and "Claude Code" sat side by side in the Provider menu as rival vendors while the Route cell beside them was greyed out — the provider id had already decided the route, so the row stated the same fact twice, and the choice that mattered (subscription or API key) hid inside a menu entry called auto whose label read auto → tab next to a separate browser tab entry.

Provider is the vendor now; Route is the surface — browser tab, that vendor's local CLI, or its API key. Internally the route is still half of the provider id, because that is what the main process, the REST port and every saved chat speak, so nothing downstream changed and no chat needed migrating.

The API route is offered only where Settings can honour it. It used to be permanent, and choosing it with API mode off changed nothing at all — resolveRoute() sends api and auto down the same branch — so the menu advertised a choice the app ignored.

The model picker was an <input list=…>, and Chromium filters a datalist by whatever is already in the box: a seat set to sonnet was only ever offered the four sonnet ids and the other fourteen looked as though they had failed to load. It is a grouped <select> now, labelled by where each entry came from, with custom… for the ids no list enumerates.

Every round runs blind

Turn-taking makes a round asymmetric — the first seat answers you, the last answers five peers — and later seats converge on whoever spoke first. independentRounds (off | first | all) defaults to all: each round is one parallel batch, blind to itself and shown every completed round.

The blind filter was also too narrow to carry that default. It hid role: 'assistant' for the whole cycle, which would have blinded round 2 to round 1, and it leaked a peer's PASS and its workspace diff into a supposedly blind round.

Verified live before merging: three CLI seats over two rounds, each asked to report only what it could see. Every seat in round 1 answered SEEN-NOW: NONE / SEEN-BEFORE: NONE; every seat in round 2 answered SEEN-NOW: NONE / SEEN-BEFORE: <all three>.

Antigravity, and Gemini CLI

Google retired Gemini CLI for individual plans on 2026-06-18. Verified rather than assumed — the installed CLI answers IneligibleTierError — so every Gemini CLI seat was failing outright. Antigravity (agy) is added as a vendor of its own rather than Gemini's CLI route, because agy models also lists Claude Sonnet 4.6, Claude Opus 4.6 and GPT-OSS 120B.

Its ids encode effort (gemini-3.8-flash-high) and it takes --effort, and passing both is a hard error — so discovery folds the ids into families and the Effort column drives --effort, as it does for every other CLI.

Two bugs surfaced underneath: whichAsync skipped preferExecutable, took where's first line (gemini.ps1) and wrote it into the cache which() reads — so every Gemini turn died at spawn … ENOENT while discovery still reported a version. And nothing passed --skip-trust, which a headless turn cannot answer interactively.

Read-only runs stopped hijacking your checkout

prepareWorkspace fired for any tools level, and read is one. Attaching a folder to a review panel checked your working copy out onto multiai/… as a side effect of reading files, and refused to start over uncommitted work — which is the normal state of a folder you want reviewed. A read-only run commits nothing, so it needs no branch and no git repository.

Documentation, a tour, and a review panel

Help moves beside Settings, opens at 90% with a section rail, and the text caught up with the app — four features had never been documented at all.

electron/multiai-tour.js is nine steps over the real screen, answering "a video for each part of the tab": a recorded video of a UI is wrong the first time a label moves and says nothing about it, and this week the Provider column changed meaning twice. tests/electron/multiai-tour.test.js reads every id, selector and column index out of the step definitions and asserts they exist, so the tour breaks loudly rather than quietly pointing at the wrong cell.

scripts/review-panel.mjs hands a diff to every installed CLI at once, blind, then lets round two read the others' findings. Run against this branch, it found seven real bugs in it — including a runner that recorded a failed process's stdout as a seat's reply, a CLI seat that could never reach its vendor's API key, and a temp directory leaked on every turn. All fixed here.

Testing

754 → 799 tests. The agent roster had none; the flakiest assertions were wall clocks ("all three start within 30ms"), replaced by an ordering check that serial dispatch cannot satisfy.

[Unconfirmed2]

Closing — keeping this work local for now.

[qodo-code-review]

PR Summary by Qodo

Add native Multi-AI chat, blind rounds, CLI variants, and workspaces

✨ Enhancement 🐞 Bug fix 🧪 Tests 📝 Documentation ⚙️ Configuration changes 🕐 40+ Minutes

AI Description

• Adds multi-provider discussions, blind rounds, pipelines, workspaces, and review tooling.
• Exposes chats and local CLI variants through REST, WebSocket, and MCP.
• Hardens routing, process cancellation, persistence, command execution, and workspace isolation.

Diagram

graph TD
  UI["Multi-AI UI"] --> IPC["Run Orchestrator"] --> ROUTES["Route Adapters"] --> BROWSER["Browser Tabs"]
  IPC --> STORE["Chat Store"]
  ROUTES --> API["BYOK APIs"]
  ROUTES --> CLI["Local CLIs"] --> WORKSPACE["Git Workspace"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Standalone Multi-AI service

• ➕ Isolates orchestration and CLI processes from Electron
• ➕ Allows independent deployment and non-Electron clients
• ➖ Duplicates browser-session authentication and provider routing
• ➖ Complicates local state, cancellation, and UI synchronization

2. Provider plugin architecture

• ➕ Reduces provider conditionals as additional CLIs are added
• ➕ Creates clearer capability and permission contracts
• ➖ Requires a larger foundational refactor before delivering the feature
• ➖ Adds abstraction around a small initial provider set

3. Ship surfaces incrementally

• ➕ Creates smaller review units for UI, workspaces, and external APIs
• ➕ Reduces regression scope per release
• ➖ Creates temporarily incomplete contracts between dependent surfaces
• ➖ Delays end-to-end testing of shared routing and persistence

Recommendation: Keep the integrated approach for this release: sharing existing BrowserViews, BYOK settings, IPC, and the REST gateway avoids duplicate authentication and state. The separation into pure core logic, route adapters, CLI variants, and workspace modules is appropriate; a capability-based provider plugin layer is the best follow-up if more vendors are added.

Files changed (56) +14995 / -196

Enhancement (23) +8841 / -86

multiai-icon.svgAdd the Multi-AI tab icon +13/-0

Add the Multi-AI tab icon

• Introduces a gradient network icon for the new application tab.

assets/multiai-icon.svg

_http.cjsSupport plain HTTP custom model endpoints +7/-3

Support plain HTTP custom model endpoints

• Selects HTTP or HTTPS transport from the endpoint protocol, enabling local model servers.

electron/api/byok/providers/_http.cjs

anthropic.cjsMap agent effort to Anthropic extended thinking +10/-1

Map agent effort to Anthropic extended thinking

• Supports caller-defined token limits and converts effort levels into safe thinking budgets.

electron/api/byok/providers/anthropic.cjs

openai.cjsForward reasoning effort to OpenAI models +11/-1

Forward reasoning effort to OpenAI models

• Maps Multi-AI effort levels to OpenAI reasoning effort and expands default completion budgets when needed.

electron/api/byok/providers/openai.cjs

rest-api.cjsAdd extensible routes and resilient responses +34/-5

Add extensible routes and resilient responses

• Registers feature-owned API routes, includes extra CLI models, reads the package version, and handles disconnected clients.

electron/api/rest-api.cjs

routes.cjsExpose local CLI seats through the models endpoint +4/-0

Expose local CLI seats through the models endpoint

• Appends Multi-AI variant models to the OpenAI-compatible model list.

electron/api/routes.cjs

ws-server.cjsAdd WebSocket actions for local CLI variants +35/-0

Add WebSocket actions for local CLI variants

• Supports variant discovery, single requests, and completion-ordered fan-out for up to eight seats.

electron/api/ws-server.cjs

index-v2.htmlAdd the Multi-AI application surface and settings +560/-58

Add the Multi-AI application surface and settings

• Introduces the tab, roster, transcript, ledger, options, workspace, help, custom endpoint, and MCP configuration UI.

electron/index-v2.html

multiai-core.cjsImplement pure Multi-AI state and prompt logic +781/-0

Implement pure Multi-AI state and prompt logic

• Adds atomic storage, agent normalization, bounded context, blind filtering, convergence, mentions, handoffs, and parsers.

electron/ipc/multiai-core.cjs

multiai.cjsImplement Multi-AI orchestration and external APIs +1623/-0

Implement Multi-AI orchestration and external APIs

• Coordinates browser, API, and CLI runs with cancellation, workspace locking, REST integration, and transcript persistence.

electron/ipc/multiai.cjs

settings.cjsPersist custom BYOK endpoint metadata +3/-2

Persist custom BYOK endpoint metadata

• Allows API key entries to include an endpoint URL and display name for custom providers.

electron/ipc/settings.cjs

main-v2.cjsWire Multi-AI into the Electron main process +92/-11

Wire Multi-AI into the Electron main process

• Registers Multi-AI IPC and MCP actions, separates development profiles, enforces single instances, and terminates CLI children.

electron/main-v2.cjs

multiai-renderer.jsImplement the Multi-AI renderer and roster +3399/-0

Implement the Multi-AI renderer and roster

• Adds chat management, vendor/route selection, model pickers, setups, transcripts, workspaces, exports, pipelines, and safety confirmations.

electron/multiai-renderer.js

preload.cjsExpose Multi-AI IPC methods to the renderer +31/-2

Expose Multi-AI IPC methods to the renderer

• Adds preload bridges for chats, runs, routes, workspaces, exports, model tests, and live events.

electron/preload.cjs

catalog.cjsAdd a cached public model catalogue +133/-0

Add a cached public model catalogue

• Loads and filters models.dev data as a non-authoritative fallback for CLI model and effort discovery.

electron/providers/catalog.cjs

cli.cjsAdd secure local CLI provider execution +1076/-0

Add secure local CLI provider execution

• Implements discovery, concurrency, cancellation, scratch isolation, secure spawning, and four local CLI runners.

electron/providers/cli.cjs

variants.cjsImplement shared local CLI variant resolution +213/-0

Implement shared local CLI variant resolution

• Resolves variants, validates CLI arguments, protects no-tools prompts, bounds queues, and formats OpenAI completions.

electron/providers/variants.cjs

workspace.cjsAdd guarded git workspaces for CLI seats +174/-0

Add guarded git workspaces for CLI seats

• Creates per-chat branches, protects uncommitted work, attributes interrupted turns, and produces bounded diff cards.

electron/providers/workspace.cjs

review-panel.mjsAdd a blind local-AI code review panel +262/-0

Add a blind local-AI code review panel

• Builds a bounded diff brief, discovers CLI seats, creates a read-only review chat, polls results, and exports findings.

scripts/review-panel.mjs

index.jsRegister Multi-AI and CLI variant MCP tools +10/-3

Register Multi-AI and CLI variant MCP tools

• Loads the package version dynamically and expands the primary MCP server with ten new tools.

src/mcp/index.js

tools-cli.jsAdd MCP tools for local CLI variants +107/-0

Add MCP tools for local CLI variants

• Provides discovery, single-seat requests, and bounded multi-seat fan-out through IPC or an in-process backend.

src/mcp/tools-cli.js

tools-multiai.jsAdd MCP tools for Multi-AI chat lifecycle +181/-0

Add MCP tools for Multi-AI chat lifecycle

• Allows MCP clients to create, read, append, run, wait for, and stop Multi-AI chats.

src/mcp/tools-multiai.js

variants-server.jsAdd a standalone CLI variants MCP server +82/-0

Add a standalone CLI variants MCP server

• Runs shared CLI variant tools without Electron and reads the agent library from user data.

src/mcp/variants-server.js

Bug fix (6) +246 / -11

api.cjsAllow active browser requests to be cancelled +23/-0

Allow active browser requests to be cancelled

• Adds a provider-engine abort bridge used by the Multi-AI Stop action.

electron/providers/api.cjs

chatgpt-engine.jsMake ChatGPT browser sends cancellable +31/-1

Make ChatGPT browser sends cancellable

• Tracks active request controllers and exposes user-initiated abort without triggering retries.

electron/providers/engines/chatgpt-engine.js

claude-engine.jsMake Claude browser sends cancellable +31/-1

Make Claude browser sends cancellable

• Tracks active request controllers and converts explicit aborts into terminal cancellation errors.

electron/providers/engines/claude-engine.js

gemini-engine.jsMake Gemini sends cancellable and improve diagnostics +53/-5

Make Gemini sends cancellable and improve diagnostics

• Adds cancellation, prevents retry after abort, and records frame diagnostics for stitched responses.

electron/providers/engines/gemini-engine.js

perplexity-engine.jsMake Perplexity browser sends cancellable +30/-1

Make Perplexity browser sends cancellable

• Exposes active-request cancellation and prevents deliberate stops from entering retry behavior.

electron/providers/engines/perplexity-engine.js

sender.cjsAdd queued-send cancellation and model reporting +78/-3

Add queued-send cancellation and model reporting

• Skips cancelled queued requests, aborts matching active conversations, and reads provider-tab model labels.

electron/providers/sender.cjs

Tests (16) +3313 / -0

http.test.jsTest local plain-HTTP BYOK endpoints +11/-0

Test local plain-HTTP BYOK endpoints

• Verifies POST and GET requests use HTTP successfully for local model servers.

tests/byok/http.test.js

providers.test.jsTest provider reasoning effort mappings +24/-0

Test provider reasoning effort mappings

• Covers OpenAI reasoning effort and Anthropic extended-thinking budgets and response extraction.

tests/byok/providers.test.js

routes.test.jsTest CLI models in the OpenAI model list +8/-0

Test CLI models in the OpenAI model list

• Verifies extra local CLI seats are included before the automatic model entry.

tests/electron/api/routes.test.js

ws-variants.test.jsTest WebSocket variant discovery and fan-out +77/-0

Test WebSocket variant discovery and fan-out

• Covers status, results, per-seat failures, ordering metadata, and completion messages.

tests/electron/api/ws-variants.test.js

multiai-core.test.jsTest Multi-AI storage, context, and round logic +352/-0

Test Multi-AI storage, context, and round logic

• Covers persistence, prompt compaction, blind filtering, convergence, agents, mentions, handoffs, and legacy defaults.

tests/electron/ipc/multiai-core.test.js

multiai-handlers.test.jsExercise Multi-AI orchestration end to end +1161/-0

Exercise Multi-AI orchestration end to end

• Tests routes, sessions, cancellation, external runs, blind rounds, variants, workspaces, locks, and pipelines.

tests/electron/ipc/multiai-handlers.test.js

multiai-roster.test.jsTest roster vendor, route, model, and setup behavior +605/-0

Test roster vendor, route, model, and setup behavior

• Covers route translation, API availability, model selection, custom models, libraries, setups, and Antigravity.

tests/electron/multiai-roster.test.js

multiai-tour.test.jsValidate guided-tour targets against the UI +108/-0

Validate guided-tour targets against the UI

• Ensures every step, selector, options tab, and roster column remains aligned with the markup.

tests/electron/multiai-tour.test.js

antigravity.test.jsTest Antigravity model discovery +58/-0

Test Antigravity model discovery

• Verifies effort-suffixed model IDs are folded into families and recognized as CLI seats.

tests/electron/providers/antigravity.test.js

cli.test.jsTest CLI discovery, permissions, spawning, and queues +318/-0

Test CLI discovery, permissions, spawning, and queues

• Covers parsers, permission flags, Codex selection, Windows quoting, effort clamping, and queue deadlines.

tests/electron/providers/cli.test.js

sender.test.jsTest browser send cancellation behavior +35/-0

Test browser send cancellation behavior

• Verifies queued calls are skipped, active conversations are matched, and cancellation is not retried.

tests/electron/providers/sender.test.js

variants.test.jsTest shared CLI variant contracts +136/-0

Test shared CLI variant contracts

• Covers resolution, injection rejection, fan-out limits, prompt protection, model publication, and OpenAI conversion.

tests/electron/providers/variants.test.js

workspace.test.jsTest git workspace safety and attribution +194/-0

Test git workspace safety and attribution

• Uses temporary repositories to validate branching, dirty-tree guards, commits, diffs, and fresh chat bases.

tests/electron/providers/workspace.test.js

tools-cli.test.jsTest local CLI variant MCP tools +79/-0

Test local CLI variant MCP tools

• Verifies IPC translation, formatted output, fan-out failures, and Zod input constraints.

tests/mcp/tools-cli.test.js

tools-multiai.test.jsTest Multi-AI chat MCP tools +98/-0

Test Multi-AI chat MCP tools

• Covers registration, IPC actions, transcript rendering, attribution, chat creation, runs, waits, and errors.

tests/mcp/tools-multiai.test.js

variants-server.test.jsTest standalone variant MCP operation +49/-0

Test standalone variant MCP operation

• Verifies library loading and in-process discovery and requests without Electron IPC.

tests/mcp/variants-server.test.js

Documentation (8) +2569 / -92

CHANGELOG.mdDocument the 5.1.0 Multi-AI release +25/-0

Document the 5.1.0 Multi-AI release

• Adds release notes for Multi-AI chats, CLI variants, workspaces, security hardening, and routing fixes.

CHANGELOG.md

README.mdIntroduce Multi-AI Chat in the project overview +22/-0

Introduce Multi-AI Chat in the project overview

• Adds a feature overview covering seats, workspaces, and external REST-compatible access.

README.md

MULTIAI-REVIEW.mdRecord the multi-review security and UX findings +750/-0

Record the multi-review security and UX findings

• Documents the adversarial review process, confirmed defects, resolutions, implementation status, and rejected alternatives.

docs/MULTIAI-REVIEW.md

MULTIAI.mdAdd the complete Multi-AI feature reference +440/-0

Add the complete Multi-AI feature reference

• Documents agents, routes, blind rounds, context modes, workspaces, Antigravity, review tooling, and external interfaces.

docs/MULTIAI.md

openapi.jsonPublish Multi-AI and CLI variant API contracts +848/-92

Publish Multi-AI and CLI variant API contracts

• Adds chat lifecycle and variant endpoints, CLI model support, pseudo-streaming behavior, schemas, and responses.

docs/openapi.json

session-review.mdPreserve the review panel's generated findings +129/-0

Preserve the review panel's generated findings

• Captures model-by-model findings from the review session, including Antigravity, migration, and review-script defects.

docs/review/session-review.md

multiai-tour.jsAdd an interactive Multi-AI guided tour +223/-0

Add an interactive Multi-AI guided tour

• Provides nine live UI walkthrough steps with keyboard navigation, spotlight positioning, and automatic advancement.

electron/multiai-tour.js

record-tour.mjsAdd automated guided-tour GIF recording +132/-0

Add automated guided-tour GIF recording

• Finds ffmpeg, captures the live application window, and creates a palette-optimized GIF.

scripts/record-tour.mjs

Other (3) +26 / -7

core.cjsExpose standalone variant MCP configuration +9/-1

Expose standalone variant MCP configuration

• Builds a separate MCP server command for local CLI variants that can run without Electron.

electron/ipc/core.cjs

package.jsonBump the Electron package to 5.1.0 +2/-2

Bump the Electron package to 5.1.0

• Updates the Electron package version for the Multi-AI release.

electron/package.json

package.jsonPackage and publish Multi-AI tooling as version 5.1.0 +15/-4

Package and publish Multi-AI tooling as version 5.1.0

• Adds variant MCP, review-panel, and tour scripts; unpacks shared modules; and marks the build as a fork.

package.json

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (6) 📘 Rule violations (0) 📜 Skill insights (0)

1. Symlinks escape workspace boundary 🐞 Bug ⛨ Security

Description

resolveInRoot() checks only the lexical path, while subsequent filesystem operations follow
symlinks under the selected root. An agent can therefore read, overwrite, create, or delete files
outside the user-approved folder through an in-root symlink.

Code

electron/ipc/multiai.cjs[R1240-1243]

+        const normalizedRoot = path.resolve(root);
+        const target = path.resolve(normalizedRoot, relPath || '.');
+        if (target !== normalizedRoot && !target.startsWith(normalizedRoot + path.sep)) {
+            throw new Error('That path is outside the working folder — refused.');

Evidence

The containment check never resolves filesystem links, then readFileSync, writeFileSync,
appendFileSync, and rmSync operate on the unchecked target. The UI explicitly promises that this
folder is the safety boundary.

electron/ipc/multiai.cjs[1239-1249]
electron/ipc/multiai.cjs[1251-1279]
electron/ipc/multiai.cjs[1321-1337]
electron/multiai-renderer.js[3147-3162]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The orchestrated file tools validate paths using only `path.resolve()` and a string prefix. Filesystem operations follow symlinks, allowing a path that appears inside the workspace to resolve outside it.

## Issue Context
Resolve the real workspace root and verify every existing path component remains beneath it. For create/write operations, validate the real parent directory and reject symlink components; avoid validation/use races where practical.

## Fix Focus Areas
- electron/ipc/multiai.cjs[1239-1280]
- electron/multiai-renderer.js[3147-3162]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Stop misses automatic summaries 🐞 Bug ☼ Reliability

Description

If Stop is pressed while maybeAutoSummary awaits sendAux, the summary request is neither raced
against the run signal nor tracked for abort, so the run remains blocked until it completes and then
records a summary after being stopped. Automatic summaries can therefore keep a cancelled browser
request active and append unexpected output to the transcript.

Code

electron/ipc/multiai.cjs[R825-826]

+            const result = await sendAux(chat, judge, core.buildSummaryPrompt({ topic: brief, messages: chat.messages }));
+            record(chatId, { who: `State summary · ${judge.name} (auto)`, text: result.response, provider: judge.provider, agentId: judge.id, role: 'summary', cycle: chat.cycle || 1, round: 0 });

Evidence

The automatic-summary path directly awaits sendAux and records its result. The browser auxiliary
implementation bypasses raceProvider and trackInFlight, whereas stopChat only resolves the
signal and aborts entries found in inFlight; the run loop awaits the summary before it can reach
its cancellation handling.

electron/ipc/multiai.cjs[109-123]
electron/ipc/multiai.cjs[485-515]
electron/ipc/multiai.cjs[814-829]
electron/ipc/multiai.cjs[966-979]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Automatic summaries await `sendAux` directly. Unlike normal turns, this path is not raced with the chat cancellation signal and is not added to `inFlight`, so `multiai-stop-run` cannot promptly end or abort it.

## Issue Context
`runClassic` calls `maybeAutoSummary` between rounds. `stopChat` only aborts tracked entries, while the browser implementation of `sendAux` directly awaits `sender.sendMessageToProvider` and then `maybeAutoSummary` records its result without checking cancellation.

## Fix Focus Areas
- electron/ipc/multiai.cjs[109-123]
- electron/ipc/multiai.cjs[485-515]
- electron/ipc/multiai.cjs[814-829]
- electron/ipc/multiai.cjs[966-979]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

3. Failures permit false convergence 🐞 Bug ≡ Correctness

Description

roundOutcome() evaluates only assistant and PASS messages, excluding errors and participants that
never replied. If one seat fails while the remaining seats pass or emit the stop token, the run
incorrectly announces that every participant converged and ends early.

Code

electron/ipc/multiai-core.cjs[R731-734]

+function roundOutcome(roundMessages, token) {
+    const replies = roundMessages.filter(m => m.role === 'assistant' || m.role === 'pass');
+    if (!replies.length) return { converged: false, allPassed: false };
+    const tokenCount = replies.filter(m => m.role === 'assistant' && startsWithToken(m.text, token)).length;

Evidence

Error turns are recorded with a role excluded by roundOutcome(), and benched seats take no later
turns. Nevertheless, runClassic() interprets the reduced result as applying to every participant.

electron/ipc/multiai-core.cjs[729-738]
electron/ipc/multiai.cjs[704-707]
electron/ipc/multiai.cjs[889-901]
electron/ipc/multiai.cjs[966-974]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Round convergence is calculated over received assistant/PASS messages rather than the complete expected participant set. Failed, absent, or benched seats can therefore be ignored when deciding that everyone converged.

## Issue Context
Pass the expected active participant identities or count into the outcome calculation. Do not report convergence or all-passed unless every expected seat produced a qualifying response for that round.

## Fix Focus Areas
- electron/ipc/multiai-core.cjs[729-738]
- electron/ipc/multiai.cjs[889-901]
- electron/ipc/multiai.cjs[966-974]
- tests/electron/ipc/multiai-core.test.js[170-184]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

4. Disabled browser agents restored 🐞 Bug ☼ Reliability

Description

When every configured seat resolves to a disabled browser provider, runClassic() undoes the
filtering by restoring the original un-runnable roster and dispatches requests to tabs the user
explicitly disabled. Those sends then wait up to 30 seconds for unavailable BrowserViews before
failing, rather than rejecting the run immediately.

Code

electron/ipc/multiai.cjs[R857-860]

+            if (!agents.length) {
+                if (all.length) note(chatId, 'No provider tabs are enabled in Settings, so every seat is running on its own route.');
+                agents = all.slice();
+            }

Evidence

The new logic establishes that browser agents require enabled provider tabs and filters out agents
absent from enabledProviders, but then explicitly replaces an empty filtered result with the
complete roster. Each restored agent is passed to takeTurn; the browser route calls sendBrowser,
whose sender waits up to 30 seconds for a missing BrowserView before throwing.

electron/ipc/multiai.cjs[845-860]
electron/ipc/multiai.cjs[214-219]
electron/providers/sender.cjs[54-67]
electron/ipc/multiai.cjs[616-625]
electron/ipc/multiai.cjs[940-951]
electron/ipc/multiai.cjs[473-477]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description

`runClassic` filters out browser-route agents whose provider tabs are disabled, but restores the full roster when the filtered result is empty. This defeats the Settings provider-disable switch, schedules sends for unavailable BrowserViews, and produces delayed failures instead of rejecting the run immediately.

## Issue Context

Keep the filtered roster authoritative. API and CLI seats are independent of the browser-provider toggle, but if filtering leaves no runnable agent, record or report a clear explanation and terminate before starting provider sends rather than treating disabled browser seats as runnable.

## Fix Focus Areas

- electron/ipc/multiai.cjs[845-861]
- electron/providers/sender.cjs[54-67]
- tests/electron/ipc/multiai-handlers.test.js[544-552]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

5. Disconnected fan-out keeps running 🐞 Bug ☼ Reliability

Description

The ask-many REST route does not attach disconnect cancellation, unlike the single-variant route.
Up to eight abandoned CLI calls can continue for as long as 20 minutes and occupy the two shared
per-provider slots, blocking chat and variant work.

Code

electron/ipc/multiai.cjs[1574]

+                if (method === 'POST' && p === '/v1/multiai/variants/ask-many') { sendJSON(res, 200, await askVariants(body)); return true; }

Evidence

The single-call route wraps its body with abortOnDisconnect, but ask-many passes the body
directly. Its fan-out also omits onStart, so no caller obtains the handles needed to invoke the
implemented abort mechanism.

electron/ipc/multiai.cjs[1550-1574]
electron/providers/variants.cjs[142-173]
electron/providers/cli.cjs[618-649]
electron/providers/cli.cjs[801-809]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`POST /v1/multiai/variants/ask-many` starts multiple CLI operations without retaining their handles or aborting them when the HTTP client disconnects. Abandoned calls continue consuming shared CLI concurrency slots.

## Issue Context
Allow `askVariants()` to expose every started handle, register one disconnect listener for the request, and abort all active or queued handles. Preserve per-variant result behavior for connected clients.

## Fix Focus Areas
- electron/ipc/multiai.cjs[1550-1574]
- electron/providers/variants.cjs[142-173]
- electron/providers/cli.cjs[618-649]
- electron/providers/cli.cjs[801-809]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

View review recommended (1)

6. Oversized prompts leak scratch 🐞 Bug ☼ Reliability

Description

runAntigravity() creates its per-run scratch directory before validating prompt length, then
returns early without cleanup when the prompt is oversized. Every such rejected request permanently
leaves a multiai-cli/run-* directory and mcp_empty.json behind.

Code

electron/providers/cli.cjs[R979-982]

+    const dir = scratchDir(cwd);
+    const level = workspace && workspace.root && workspace.tools && workspace.tools !== 'none' ? workspace.tools : 'none';
+    const full = `${systemPrompt || (level !== 'none' ? workspaceSystemPrompt(workspace) : DISCUSSION_SYSTEM_PROMPT)}\n\n${prompt}`;
+    if (full.length > AGY_PROMPT_MAX) {

Evidence

scratchDir() creates a unique directory and configuration file, while cleanup is installed only
after the early size rejection. The oversized branch therefore has no cleanup path.

electron/providers/cli.cjs[664-681]
electron/providers/cli.cjs[978-987]
electron/providers/cli.cjs[1013-1016]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Antigravity creates a scratch directory before its prompt-size check. The oversized-prompt return bypasses the cleanup registered later on the normal execution path.

## Issue Context
Validate the assembled prompt before creating scratch state, or explicitly remove the directory before returning the rejected handle. Add a regression test confirming no run directory remains.

## Fix Focus Areas
- electron/providers/cli.cjs[978-1016]
- tests/electron/providers/antigravity.test.js[1-58]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

Review mode: 🧠 Deep: This is a broad, high-density change spanning UI, IPC, provider/CLI integrations, REST/WebSocket APIs, MCP tooling, persistence-compatible routing, and blind-round logic, creating many independent paths where subtle defects could be missed in one pass.

Tip of the day

💡 Did you know, you can show, collapse, or hide each part of a finding: code, evidence, and all

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-code-review]

1. Symlinks escape workspace boundary 🐞 Bug ⛨ Security

resolveInRoot() checks only the lexical path, while subsequent filesystem operations follow
symlinks under the selected root. An agent can therefore read, overwrite, create, or delete files
outside the user-approved folder through an in-root symlink.

Agent Prompt

## Issue description
The orchestrated file tools validate paths using only `path.resolve()` and a string prefix. Filesystem operations follow symlinks, allowing a path that appears inside the workspace to resolve outside it.

## Issue Context
Resolve the real workspace root and verify every existing path component remains beneath it. For create/write operations, validate the real parent directory and reject symlink components; avoid validation/use races where practical.

## Fix Focus Areas
- electron/ipc/multiai.cjs[1239-1280]
- electron/multiai-renderer.js[3147-3162]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[qodo-code-review]

2. Failures permit false convergence 🐞 Bug ≡ Correctness

roundOutcome() evaluates only assistant and PASS messages, excluding errors and participants that
never replied. If one seat fails while the remaining seats pass or emit the stop token, the run
incorrectly announces that every participant converged and ends early.

Agent Prompt

## Issue description
Round convergence is calculated over received assistant/PASS messages rather than the complete expected participant set. Failed, absent, or benched seats can therefore be ignored when deciding that everyone converged.

## Issue Context
Pass the expected active participant identities or count into the outcome calculation. Do not report convergence or all-passed unless every expected seat produced a qualifying response for that round.

## Fix Focus Areas
- electron/ipc/multiai-core.cjs[729-738]
- electron/ipc/multiai.cjs[889-901]
- electron/ipc/multiai.cjs[966-974]
- tests/electron/ipc/multiai-core.test.js[170-184]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[qodo-code-review]

3. Disabled browser agents restored 🐞 Bug ☼ Reliability

When every configured seat resolves to a disabled browser provider, runClassic() undoes the
filtering by restoring the original un-runnable roster and dispatches requests to tabs the user
explicitly disabled. Those sends then wait up to 30 seconds for unavailable BrowserViews before
failing, rather than rejecting the run immediately.

Agent Prompt

## Issue description

`runClassic` filters out browser-route agents whose provider tabs are disabled, but restores the full roster when the filtered result is empty. This defeats the Settings provider-disable switch, schedules sends for unavailable BrowserViews, and produces delayed failures instead of rejecting the run immediately.

## Issue Context

Keep the filtered roster authoritative. API and CLI seats are independent of the browser-provider toggle, but if filtering leaves no runnable agent, record or report a clear explanation and terminate before starting provider sends rather than treating disabled browser seats as runnable.

## Fix Focus Areas

- electron/ipc/multiai.cjs[845-861]
- electron/providers/sender.cjs[54-67]
- tests/electron/ipc/multiai-handlers.test.js[544-552]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[qodo-code-review]

4. Disconnected fan-out keeps running 🐞 Bug ☼ Reliability

The ask-many REST route does not attach disconnect cancellation, unlike the single-variant route.
Up to eight abandoned CLI calls can continue for as long as 20 minutes and occupy the two shared
per-provider slots, blocking chat and variant work.

Agent Prompt

## Issue description
`POST /v1/multiai/variants/ask-many` starts multiple CLI operations without retaining their handles or aborting them when the HTTP client disconnects. Abandoned calls continue consuming shared CLI concurrency slots.

## Issue Context
Allow `askVariants()` to expose every started handle, register one disconnect listener for the request, and abort all active or queued handles. Preserve per-variant result behavior for connected clients.

## Fix Focus Areas
- electron/ipc/multiai.cjs[1550-1574]
- electron/providers/variants.cjs[142-173]
- electron/providers/cli.cjs[618-649]
- electron/providers/cli.cjs[801-809]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[qodo-code-review]

5. Oversized prompts leak scratch 🐞 Bug ☼ Reliability

runAntigravity() creates its per-run scratch directory before validating prompt length, then
returns early without cleanup when the prompt is oversized. Every such rejected request permanently
leaves a multiai-cli/run-* directory and mcp_empty.json behind.

Agent Prompt

## Issue description
Antigravity creates a scratch directory before its prompt-size check. The oversized-prompt return bypasses the cleanup registered later on the normal execution path.

## Issue Context
Validate the assembled prompt before creating scratch state, or explicitly remove the directory before returning the rejected handle. Add a regression test confirming no run directory remains.

## Fix Focus Areas
- electron/providers/cli.cjs[978-1016]
- tests/electron/providers/antigravity.test.js[1-58]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[qodo-code-review]

6. Stop misses automatic summaries 🐞 Bug ☼ Reliability

If Stop is pressed while maybeAutoSummary awaits sendAux, the summary request is neither raced
against the run signal nor tracked for abort, so the run remains blocked until it completes and then
records a summary after being stopped. Automatic summaries can therefore keep a cancelled browser
request active and append unexpected output to the transcript.

Agent Prompt

## Issue description
Automatic summaries await `sendAux` directly. Unlike normal turns, this path is not raced with the chat cancellation signal and is not added to `inFlight`, so `multiai-stop-run` cannot promptly end or abort it.

## Issue Context
`runClassic` calls `maybeAutoSummary` between rounds. `stopChat` only aborts tracked entries, while the browser implementation of `sendAux` directly awaits `sender.sendMessageToProvider` and then `maybeAutoSummary` records its result without checking cancellation.

## Fix Focus Areas
- electron/ipc/multiai.cjs[109-123]
- electron/ipc/multiai.cjs[485-515]
- electron/ipc/multiai.cjs[814-829]
- electron/ipc/multiai.cjs[966-979]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[Copilot]

🟡 Changes recommended

A confirmed availability-key mismatch breaks Antigravity variant execution, and the review-panel script has validated argument/cleanup issues that can lead to incorrect or messy runs.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR brings the Multi-AI feature branch up to date by expanding Multi-AI Chat’s local-CLI “variants” support (including a standalone MCP server), improving workspace safety/behavior, adding review/tour tooling, and significantly increasing automated coverage around these flows.

Changes:

• Add MCP tooling for Multi-AI Chat transcripts (multiai_*) and local CLI variants (cli_variants / ask_variant / ask_variants), plus a standalone variants MCP server.
• Introduce/expand core modules for CLI variants, workspace git-branch management, and provider cancellation behavior, with extensive new tests.
• Add scripts and documentation for a guided tour and a local-CLI “review panel” workflow; bump versioning to 5.1.0.

File summaries

File	Description
tests/mcp/variants-server.test.js	Tests standalone variants MCP server behavior (no IPC).
tests/mcp/tools-multiai.test.js	Tests MCP multiai_* tools’ IPC translation and rendering.
tests/mcp/tools-cli.test.js	Tests MCP cli_* tools output formatting and zod constraints.
tests/electron/providers/workspace.test.js	Tests git workspace branch/prepare/commit behaviors.
tests/electron/providers/variants.test.js	Tests CLI variant resolution, validation, and OpenAI surface.
tests/electron/providers/sender.test.js	Tests queued-send cancellation and abortActive behavior.
tests/electron/providers/cli.test.js	Tests CLI discovery/parsing/quoting/concurrency behaviors.
tests/electron/providers/antigravity.test.js	Tests Antigravity model parsing and core integration.
tests/electron/multiai-tour.test.js	Validates guided tour selectors/columns against markup.
tests/electron/ipc/multiai-core.test.js	Expands Multi-AI core tests (store, prompts, agents, blind rounds).
tests/electron/api/ws-variants.test.js	Tests WebSocket variants actions (variants/ask_variant/ask_variants).
tests/electron/api/routes.test.js	Tests /v1/models ordering including extra cli: models.
tests/byok/providers.test.js	Tests reasoningEffort mapping for OpenAI/Anthropic providers.
tests/byok/http.test.js	Tests plain http:// support for local OpenAI-compatible endpoints.
src/mcp/variants-server.js	Standalone MCP server for local CLI variants (no app needed).
src/mcp/tools-multiai.js	MCP tools for Multi-AI Chat transcripts/actions via IPC.
src/mcp/tools-cli.js	MCP tools for local CLI variants via IPC or direct backend.
src/mcp/index.js	Registers new MCP tool modules; uses package.json version.
scripts/review-panel.mjs	Script to run a “panel” review via Proxima REST + local CLIs.
scripts/record-tour.mjs	Script to record the guided tour into a GIF via ffmpeg.
README.md	Adds top-level Multi-AI Chat overview and docs pointer.
package.json	Version bump; adds variants MCP bin/script; build unpack additions.
electron/providers/workspace.cjs	Workspace git-ops module (branching/commit/diff description).
electron/providers/variants.cjs	CLI variants resolution, validation, ask, and model listing.
electron/providers/sender.cjs	Adds active-send tracking, abortActive, and best-effort tab model label.
electron/providers/engines/perplexity-engine.js	Adds user abort support for in-flight requests.
electron/providers/engines/gemini-engine.js	Adds user abort support + frame diagnostics in extraction.
electron/providers/engines/claude-engine.js	Adds user abort support for in-flight requests.
electron/providers/engines/chatgpt-engine.js	Adds user abort support for in-flight requests.
electron/providers/catalog.cjs	Adds cached, shaped models.dev catalog support.
electron/providers/api.cjs	Adds abortActive() to abort in-flight provider sends.
electron/preload.cjs	Exposes Multi-AI IPC APIs to renderer; extends byokSaveKey args.
electron/package.json	Version bump for electron package metadata.
electron/multiai-tour.js	Implements the Multi-AI guided tour overlay.
electron/main-v2.cjs	Instance hygiene, single-instance lock, REST extra models, Multi-AI IPC plumbing, fork updater guard, CLI cleanup on quit.
electron/ipc/settings.cjs	Extends byok-save-key IPC to accept endpoint/displayName options.
electron/ipc/core.cjs	Adds variants-server config path to MCP config output.
electron/api/ws-server.cjs	Adds WS actions for variants/ask_variant/ask_variants.
electron/api/routes.cjs	Adds extra models injection into /v1/models response.
electron/api/rest-api.cjs	Reads version from package.json; safe sendJSON; route extensions; broader body parsing methods; listening callback guard.
electron/api/byok/providers/openai.cjs	Adds reasoning_effort mapping + completion budget widening.
electron/api/byok/providers/anthropic.cjs	Adds extended-thinking budget mapping from reasoningEffort.
electron/api/byok/providers/_http.cjs	Adds http:// transport support for local endpoints.
docs/review/session-review.md	Captured review output session notes for the branch.
docs/MULTIAI.md	Full reference documentation for Multi-AI Chat, variants, tools, and APIs.
CHANGELOG.md	Adds 5.1.0 fork release notes.
assets/multiai-icon.svg	Adds Multi-AI icon asset.

Review details

• Files reviewed: 54/56 changed files
• Comments generated: 4
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.