Ship a built-in generic review persona and a launch focus note

[selfcontained]

Problem

Persona review required repo setup before it did anything. A repo with no .dispatch/personas/ directory got a disabled Review button ("No persona files in this workspace"), and dispatch_launch_persona had no slug to resolve. There was also no way for the author to say what they wanted looked at when launching a review — the parent agent wrote the entire briefing from its own read of the work.

What changed

1. A built-in generic reviewer. Dispatch now ships one persona of its own: General Code Review (slug code-review), a repo-agnostic generalist covering correctness, fit with local patterns, clarity, change safety, and tests.

It is appended to every listing after the repo's own personas, so it does two things at once:

• review works in a repo with zero config, and
• it stays pickable next to configured personas as the "just review this generally" option.

A .dispatch/personas/code-review.md file replaces it entirely, which is how a project specializes the generic reviewer without changing the slug agents and the UI already know. Precedence is worktree → repo → built-in.

2. An optional focus note on launch. The Launch Review dialog takes free text ("focus on the auth changes in session.ts"), which Dispatch folds into the context briefing every selected reviewer receives.

The note applies to all selected personas rather than only the generic one — a field that appears and disappears based on selection would be odd UX, and it is the same plumbing either way.

Security

The note is author-typed free text that ends up inside a double-quoted span of a single-line prompt typed into the parent's tmux session. A newline would submit the prompt early and a bare quote would let the note read as instructions to the parent, so sanitizeLaunchReviewNote collapses whitespace to one line, folds quote characters to ', escapes --- DISPATCH: markers, and caps at 2000 characters. The route rejects non-strings and over-length notes before that; the textarea caps at the same length.

Files

File	Change
apps/server/src/personas/built-in.ts	new — the persona, its summary projection, slug lookup, and the append helper
apps/server/src/personas/loader.ts	loadPersonasFromRoots appends built-ins (HTTP list path)
apps/server/src/shared/mcp/persona-interaction-tools.ts	resolvePersonaList appends built-in summaries; list_personas / dispatch_launch_persona descriptions mention the built-in
apps/server/src/server/mcp-review-handlers.ts	launchPersona falls back to the built-in after both root lookups miss
apps/server/src/reviews/injection-prompts.ts	sanitizeLaunchReviewNote + note sentence in buildLaunchReviewPrompt
apps/server/src/routes/personas.ts	note validation and pass-through
apps/web/src/components/app/persona-launcher.tsx	note textarea; the empty-list branch now means "request failed", not "unconfigured repo"
apps/web/src/components/app/docs-sections/personas.tsx	documents the built-in and the focus note

Bodies are never exposed through list endpoints — BUILT_IN_PERSONA_SUMMARIES is a separate {slug, name, description} projection, asserted by a test.

Verification

• pnpm run check — clean
• pnpm run test — 3336 unit tests pass. Two existing files (persona-list-merge, persona-interaction-tools) asserted exact listing output and needed updating for the appended built-in; new coverage added for override precedence, the summary projection, note sanitization (including a hostile note with newlines and a forged DISPATCH marker), and route validation.
• pnpm run test:e2e — 178 pass
• pnpm run finalize:web — builds

Live Playwright validation: on a demo agent whose cwd is not a real repo, the Review button is now enabled and the dialog offers the built-in as its only persona. Filling the note and launching sent {"personas":["code-review"],"agentType":"claude","model":null,"note":"focus on the auth changes in session.ts — I'm unsure about the token refresh path"}. The API also returns the built-in appended last in this repo (7 entries) and alone in a bare git repo.

🤖 Generated with Claude Code