@deepseek-ai/dsh-experimental-client-ui-forge 0.0.0-stage → 0.2.2-alpha.2

package/lib/index.js

@@ -0,0 +1,3131 @@
+import { Service } from "@deepseek-ai/cordis";
+import z from "@deepseek-ai/schemastery";
+import { changeRequestKey } from "@deepseek-ai/dsh-experimental-forge";
+import { appendPluginRecord, pluginRecordOf } from "@deepseek-ai/dsh-session";
+import { MAX_TIMER_DELAY_MS, deadline } from "@deepseek-ai/dsh-timeout";
+import { Remote, RemoteError, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
+import { parsePatch } from "diff";
+import { FsError } from "@deepseek-ai/dsh-fs";
+import { assertNever } from "@deepseek-ai/dsh-util-values";
+import { isAbsolute, relative, sep } from "node:path";
+import { generatedWorktreeName } from "@deepseek-ai/dsh-experimental-worktree";
+import { z as z$1 } from "zod";
+import { Buffer } from "node:buffer";
+import { createHash } from "node:crypto";
+import { defineDomain } from "@deepseek-ai/dsh-storage-domain";
+//#region lib/types/parse.js
+/** Parsers for the porcelain output of the read-only Git commands the panel runs. */
+/**
+* Read the first line that `git rev-parse` prints for a directory query such as `--show-toplevel`.
+* @param output - stdout of the command.
+* @returns the directory.
+* @throws when the output is empty.
+*/
+function parseTopLevel(output) {
+	const [root = ""] = output.split(/\r?\n/);
+	if (root.length === 0) throw new Error("git rev-parse printed no directory");
+	return root;
+}
+/**
+* Read the first line of a one-name output such as `git symbolic-ref --short HEAD`.
+* @param output - stdout of the command.
+* @returns the name, or null when the command printed none.
+*/
+function parseName(output) {
+	const [name = ""] = output.split(/\r?\n/);
+	return name.length === 0 ? null : name;
+}
+/**
+* Order worktree base branches: the checked-out branch first, then the other
+* listed branches in listed order.
+* @param current - checked-out branch, or null when HEAD is detached.
+* @param output - stdout of `git for-each-ref --format=%(refname:lstrip=2) refs/heads/`.
+* @param limit - most names to return.
+* @returns distinct branch names, at most `limit`.
+*/
+function baseBranches(current, output, limit) {
+	const listed = output.split(/\r?\n/).filter((name) => name.length > 0 && name !== current);
+	return (current === null ? listed : [current, ...listed]).slice(0, limit);
+}
+/**
+* Group the lines of `git remote -v` by remote.
+* @param output - stdout of the command.
+* @returns remotes in first-listed order.
+*/
+function parseRemotes(output) {
+	const remotes = /* @__PURE__ */ new Map();
+	for (const line of output.split(/\r?\n/)) {
+		const [, name = "", url = "", direction = ""] = /^(\S+)\t(.+) \((fetch|push)\)$/.exec(line) ?? [];
+		if (name.length === 0) continue;
+		let urls = remotes.get(name);
+		if (urls === void 0) {
+			urls = [];
+			remotes.set(name, urls);
+		}
+		if (urls.includes(url)) continue;
+		if (direction === "fetch") urls.unshift(url);
+		else urls.push(url);
+	}
+	return [...remotes].map(([name, urls]) => ({
+		name,
+		urls
+	}));
+}
+/**
+* Split an upstream branch such as `origin/feature/x` into its remote and the
+* branch on that remote. The remote is the longest remote name followed by `/`
+* at the start of the upstream branch.
+* @param upstream - upstream branch such as `origin/main`, or null.
+* @param remotes - remotes in listed order.
+* @returns the remote and branch, or undefined without an upstream or a remote it starts with.
+*/
+function upstreamBranch(upstream, remotes) {
+	if (upstream === null) return void 0;
+	const remote = remotes.filter((candidate) => upstream.startsWith(`${candidate.name}/`)).reduce((longest, candidate) => longest === void 0 || candidate.name.length > longest.name.length ? candidate : longest, void 0);
+	return remote === void 0 ? void 0 : {
+		remote,
+		branch: upstream.slice(remote.name.length + 1)
+	};
+}
+/**
+* Order remotes for code host recognition: the upstream's remote first, then
+* `origin`, then the rest in listed order.
+* @param upstream - upstream branch such as `origin/main`, or null.
+* @param remotes - remotes in listed order.
+* @returns the same remotes in recognition order.
+*/
+function remoteOrder(upstream, remotes) {
+	const tracked = upstreamBranch(upstream, remotes)?.remote;
+	const rank = (remote) => remote === tracked ? 0 : remote.name === "origin" ? 1 : 2;
+	return [...remotes].sort((left, right) => rank(left) - rank(right));
+}
+//#endregion
+//#region lib/types/git.js
+/** Read-only Git inspection of a Session's current directory in the Session's execution world. */
+var __addDisposableResource$1 = function(env, value, async) {
+	if (value !== null && value !== void 0) {
+		if (typeof value !== "object" && typeof value !== "function") throw new TypeError("Object expected.");
+		var dispose, inner;
+		if (async) {
+			if (!Symbol.asyncDispose) throw new TypeError("Symbol.asyncDispose is not defined.");
+			dispose = value[Symbol.asyncDispose];
+		}
+		if (dispose === void 0) {
+			if (!Symbol.dispose) throw new TypeError("Symbol.dispose is not defined.");
+			dispose = value[Symbol.dispose];
+			if (async) inner = dispose;
+		}
+		if (typeof dispose !== "function") throw new TypeError("Object not disposable.");
+		if (inner) dispose = function() {
+			try {
+				inner.call(this);
+			} catch (e) {
+				return Promise.reject(e);
+			}
+		};
+		env.stack.push({
+			value,
+			dispose,
+			async
+		});
+	} else if (async) env.stack.push({ async: true });
+	return value;
+};
+var __disposeResources$1 = (function(SuppressedError) {
+	return function(env) {
+		function fail(e) {
+			env.error = env.hasError ? new SuppressedError(e, env.error, "An error was suppressed during disposal.") : e;
+			env.hasError = true;
+		}
+		var r, s = 0;
+		function next() {
+			while (r = env.stack.pop()) try {
+				if (!r.async && s === 1) return s = 0, env.stack.push(r), Promise.resolve().then(next);
+				if (r.dispose) {
+					var result = r.dispose.call(r.value);
+					if (r.async) return s |= 2, Promise.resolve(result).then(next, function(e) {
+						fail(e);
+						return next();
+					});
+				} else s |= 1;
+			} catch (e) {
+				fail(e);
+			}
+			if (s === 1) return env.hasError ? Promise.reject(env.error) : Promise.resolve();
+			if (env.hasError) throw env.error;
+		}
+		return next();
+	};
+})(typeof SuppressedError === "function" ? SuppressedError : function(error, suppressed, message) {
+	var e = new Error(message);
+	return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+});
+/** Thrown when a Git command prints more than `maxOutputBytes` on standard output. */
+var GitOutputTooLarge = class extends Error {
+	name = "GitOutputTooLarge";
+};
+/**
+* Clear inherited repository, configuration, and replacement-ref selectors;
+* disable prompts, optional index writes, and lazy fetches of missing objects.
+* Git older than 2.45 ignores `GIT_NO_LAZY_FETCH`.
+*/
+const GIT_ENV = {
+	...Object.fromEntries([
+		"GIT_DIR",
+		"GIT_WORK_TREE",
+		"GIT_COMMON_DIR",
+		"GIT_INDEX_FILE",
+		"GIT_OBJECT_DIRECTORY",
+		"GIT_ALTERNATE_OBJECT_DIRECTORIES",
+		"GIT_CONFIG",
+		"GIT_CONFIG_PARAMETERS",
+		"GIT_CONFIG_COUNT",
+		"GIT_CEILING_DIRECTORIES",
+		"GIT_PREFIX",
+		"GIT_SHALLOW_FILE",
+		"GIT_GRAFT_FILE",
+		"GIT_REPLACE_REF_BASE",
+		"GIT_ATTR_SOURCE"
+	].map((key) => [key, void 0])),
+	GIT_TERMINAL_PROMPT: "0",
+	GIT_OPTIONAL_LOCKS: "0",
+	GIT_NO_LAZY_FETCH: "1",
+	LC_ALL: "C"
+};
+/** Arguments before every subcommand: no index refresh writes, hooks, or filesystem monitor. */
+const GIT_PREFIX = [
+	"--no-optional-locks",
+	"-c",
+	"core.hooksPath=/dev/null",
+	"-c",
+	"core.fsmonitor=false"
+];
+const NOT_A_CHECKOUT = /not a git repository|must be run in a work tree/i;
+/**
+* Inspect the checkout containing `directory`. Every command runs through the
+* mounted subprocess provider under a read-only confinement of the Session's
+* sandbox policy and reads refs and configuration only, never the working
+* tree. The top-level and shared Git directories Git prints are resolved
+* through `ctx.fs` into canonical process paths, the form the
+* working-directory service records.
+* @param ctx - context that provides `fs`, `subprocess`, `sandbox`, and `sandboxPolicy`.
+* @param config - executable and process limits.
+* @param session - Session whose sandbox policy and execution world apply.
+* @param directory - absolute directory to inspect.
+* @param signal - cancellation of every command.
+* @returns the checkout facts, shared Git directory, upstream, and remotes, or undefined when `directory` is not inside a checkout.
+* @throws when Git cannot run, fails, times out, or prints more than `maxOutputBytes`.
+*/
+async function inspectCheckout(ctx, config, session, directory, signal) {
+	const top = await gitIn(ctx, config, session, directory, signal)("rev-parse", ["rev-parse", "--show-toplevel"], [0, 128]);
+	if (top.exitCode !== 0) {
+		if (NOT_A_CHECKOUT.test(top.stderr)) return void 0;
+		throw new Error(`git rev-parse failed: ${firstLine(top.stderr)}`);
+	}
+	const [root, commonDir, gitDir, branch, commit, upstream, remotes] = await together(signal, (signal) => {
+		const git = gitIn(ctx, config, session, directory, signal);
+		const canonical = async (path) => ctx.fs.processPath(await ctx.fs.resolve(path, {
+			cwd: directory,
+			signal
+		}));
+		return [
+			canonical(parseTopLevel(top.stdout)),
+			git("common-dir", [
+				"rev-parse",
+				"--path-format=absolute",
+				"--git-common-dir"
+			]).then((output) => canonical(parseTopLevel(output.stdout))),
+			git("git-dir", [
+				"rev-parse",
+				"--path-format=absolute",
+				"--git-dir"
+			]).then((output) => canonical(parseTopLevel(output.stdout))),
+			currentBranch(git),
+			headCommit(git),
+			git("upstream", [
+				"rev-parse",
+				"--abbrev-ref",
+				"--symbolic-full-name",
+				"@{upstream}"
+			], [0, 128]),
+			git("remote", ["remote", "-v"])
+		];
+	});
+	return {
+		checkout: {
+			root,
+			branch,
+			linked: gitDir !== commonDir,
+			commit
+		},
+		commonDir,
+		upstream: upstream.exitCode === 0 ? parseName(upstream.stdout) : null,
+		remotes: parseRemotes(remotes.stdout)
+	};
+}
+/**
+* List the local branches that can start a worktree of the checkout containing
+* `directory`, under the same confinement as {@link inspectCheckout}.
+* @param ctx - context that provides `subprocess`, `sandbox`, and `sandboxPolicy`.
+* @param config - executable and process limits.
+* @param session - Session whose sandbox policy and execution world apply.
+* @param directory - absolute directory inside the checkout.
+* @param limit - most branch names to return.
+* @param signal - cancellation of every command.
+* @returns the checked-out branch and local branches, the checked-out one first and then most recently committed first.
+* @throws when `directory` is not inside a checkout, or Git cannot run, fails, times out, or prints more than `maxOutputBytes`.
+*/
+async function listBranches(ctx, config, session, directory, limit, signal) {
+	const [current, refs] = await together(signal, (signal) => {
+		const git = gitIn(ctx, config, session, directory, signal);
+		return [currentBranch(git), git("for-each-ref", [
+			"for-each-ref",
+			"--sort=-committerdate",
+			`--count=${limit}`,
+			"--format=%(refname:lstrip=2)",
+			"refs/heads/"
+		])];
+	});
+	return {
+		current,
+		branches: baseBranches(current, refs.stdout, limit)
+	};
+}
+/** A failed read cancels its siblings and returns only after every read has finished cleanup. */
+async function together(signal, start) {
+	const stop = new AbortController();
+	const tasks = start(AbortSignal.any([signal, stop.signal]));
+	try {
+		return await Promise.all(tasks);
+	} catch (error) {
+		stop.abort(error);
+		await Promise.allSettled(tasks);
+		throw error;
+	}
+}
+/**
+* Report whether a local branch exists, under the same confinement as {@link inspectCheckout}.
+* @param ctx - context that provides `subprocess`, `sandbox`, and `sandboxPolicy`.
+* @param config - executable and process limits.
+* @param session - Session whose sandbox policy and execution world apply.
+* @param repositoryRoot - absolute root of a checkout of the repository.
+* @param branch - local branch name.
+* @param signal - cancellation of the command.
+* @returns whether `refs/heads/<branch>` exists.
+* @throws when Git cannot run, fails, times out, or prints more than `maxOutputBytes`.
+*/
+async function hasBranch(ctx, config, session, repositoryRoot, branch, signal) {
+	return (await gitIn(ctx, config, session, repositoryRoot, signal)("show-ref", [
+		"show-ref",
+		"--verify",
+		"--quiet",
+		`refs/heads/${branch}`
+	], [0, 1])).exitCode === 0;
+}
+/**
+* Bind the confined Git runner to one Session and directory: every command
+* runs under a read-only confinement of the Session's sandbox policy with the
+* scrubbed environment, the fixed command prefix, and `config`'s limits.
+* @param ctx - context that provides `subprocess`, `sandbox`, and `sandboxPolicy`.
+* @param config - executable and process limits.
+* @param session - Session whose sandbox policy and execution world apply.
+* @param directory - working directory of every command.
+* @param signal - cancellation of every command.
+* @returns the runner.
+*/
+function gitIn(ctx, config, session, directory, signal) {
+	const policy = {
+		...ctx.sandboxPolicy.resolve({
+			session,
+			mode: "read-only"
+		}),
+		mode: "read-only"
+	};
+	return (name, args, allowedExitCodes = [0]) => runGit(ctx, config, policy, directory, name, args, signal, allowedExitCodes);
+}
+/** Read the checked-out branch, including an unborn one; null when HEAD is detached. */
+async function currentBranch(git) {
+	const head = await git("symbolic-ref", [
+		"symbolic-ref",
+		"--quiet",
+		"--short",
+		"HEAD"
+	], [0, 1]);
+	return head.exitCode === 0 ? parseName(head.stdout) : null;
+}
+/** Read the abbreviated commit HEAD names; null while the checked-out branch has no commit. */
+async function headCommit(git) {
+	const head = await git("head", [
+		"rev-parse",
+		"--short",
+		"HEAD"
+	], [0, 128]);
+	return head.exitCode === 0 ? parseName(head.stdout) : null;
+}
+async function runGit(ctx, config, policy, cwd, name, args, signal, allowedExitCodes) {
+	const env_1 = {
+		stack: [],
+		error: void 0,
+		hasError: false
+	};
+	try {
+		const timeout = __addDisposableResource$1(env_1, deadline(signal, config.gitTimeoutMs, "FORGE_PANEL_GIT_TIMEOUT"), false);
+		const program = await ctx.subprocess.resolveExecutable(config.gitCommand, void 0, timeout.signal);
+		const confined = await ctx.sandbox.confine([
+			program,
+			...GIT_PREFIX,
+			...args
+		], policy, timeout.signal);
+		timeout.signal.throwIfAborted();
+		const child = ctx.subprocess.spawn({
+			argv: confined.argv,
+			cwd,
+			env: GIT_ENV,
+			signal: timeout.signal,
+			graceMs: config.graceMs,
+			stdio: {
+				stdin: "ignore",
+				stdout: { maxBytes: config.maxOutputBytes },
+				stderr: { maxBytes: config.maxOutputBytes }
+			}
+		});
+		try {
+			const outcome = await child.done;
+			timeout.signal.throwIfAborted();
+			const captured = child.collected;
+			const stdout = captured.stdout.readFrom(0);
+			const stderr = captured.stderr.readFrom(0);
+			if (outcome.exitCode === null || !allowedExitCodes.includes(outcome.exitCode)) throw new Error(`git ${name} failed (${outcome.signal ?? outcome.exitCode}): ${firstLine(stderr.text)}`);
+			if (stdout.lossy) throw new GitOutputTooLarge(`git ${name} output exceeds maxOutputBytes`);
+			return {
+				stdout: stdout.text,
+				stderr: stderr.text,
+				exitCode: outcome.exitCode
+			};
+		} finally {
+			child.terminate();
+			await child.waitForExit();
+		}
+	} catch (e_1) {
+		env_1.error = e_1;
+		env_1.hasError = true;
+	} finally {
+		__disposeResources$1(env_1);
+	}
+}
+function firstLine(text) {
+	return text.split(/\r?\n/).map((line) => line.trim()).find((line) => line.length > 0) ?? "no diagnostic";
+}
+//#endregion
+//#region lib/types/diff.js
+/** Unified patch parsing into the panel's browser-safe diff model, and the diff and size of an untracked file. */
+/** Git's name for the missing side of an added or deleted file. */
+const NULL_PATH = "/dev/null";
+/** Bytes Git inspects for a NUL byte before it calls content binary. */
+const BINARY_PROBE_BYTES = 8e3;
+/**
+* Parse a Git-style unified patch, as `git diff` or a code host prints it,
+* with `a/` and `b/` path prefixes. Hunk ranges follow jsdiff: a range that
+* covers no line starts at the line it comes before.
+* @param patch - the patch text.
+* @returns one file per patch section in patch order.
+*/
+function parseDiff(patch) {
+	return parsePatch(patch).flatMap((section) => {
+		const before = pathOf(section.oldFileName, "a/");
+		const after = pathOf(section.newFileName, "b/");
+		const path = after ?? before;
+		if (path === null) return [];
+		const status = section.isCreate === true || before === null ? "added" : section.isDelete === true || after === null ? "deleted" : section.isRename === true ? "renamed" : "modified";
+		let additions = 0;
+		let deletions = 0;
+		for (const hunk of section.hunks) for (const line of hunk.lines) if (line.startsWith("+")) additions++;
+		else if (line.startsWith("-")) deletions++;
+		return [{
+			path,
+			previousPath: status === "renamed" ? before : null,
+			status,
+			binary: section.isBinary === true,
+			oversized: false,
+			untracked: false,
+			additions,
+			deletions,
+			hunks: section.hunks.map(({ oldStart, oldLines, newStart, newLines, lines }) => ({
+				oldStart,
+				oldLines,
+				newStart,
+				newLines,
+				lines
+			}))
+		}];
+	});
+}
+/**
+* Describe an untracked file as added in full.
+* @param path - path relative to the repository root.
+* @param content - the file's bytes.
+* @returns the file with one hunk of added lines, none when it is empty, or none and `binary` when its content is not text.
+*/
+function untrackedFile(path, content) {
+	const file = {
+		path,
+		previousPath: null,
+		status: "added",
+		binary: false,
+		oversized: false,
+		untracked: true,
+		additions: 0,
+		deletions: 0,
+		hunks: []
+	};
+	const text = decodeText(content);
+	if (text === void 0) return {
+		...file,
+		binary: true
+	};
+	if (text.length === 0) return file;
+	const lines = text.split("\n");
+	const ended = lines.at(-1) === "";
+	if (ended) lines.pop();
+	return {
+		...file,
+		additions: lines.length,
+		hunks: [{
+			oldStart: 1,
+			oldLines: 0,
+			newStart: 1,
+			newLines: lines.length,
+			lines: [...lines.map((line) => `+${line}`), ...ended ? [] : ["\"]]
+		}]
+	};
+}
+/**
+* Decode file content as text the way Git decides it is not binary: no NUL
+* byte among the first 8000 bytes, and, here, valid UTF-8 throughout.
+* @param content - the bytes.
+* @returns the text, or undefined for binary content.
+*/
+function decodeText(content) {
+	if (content.subarray(0, BINARY_PROBE_BYTES).includes(0)) return void 0;
+	try {
+		return new TextDecoder("utf-8", { fatal: true }).decode(content);
+	} catch (error) {
+		return;
+	}
+}
+/**
+* Parse `git diff --numstat -z` output, in which a rename prints its counts,
+* an empty path, and then the old and new paths as separate fields.
+* @param output - the command's standard output.
+* @returns one file per record, named by its new path; a binary file counts no lines.
+*/
+function parseNumstat(output) {
+	const fields = output.split("\0");
+	const files = [];
+	let skip = 0;
+	for (const [index, record] of fields.entries()) {
+		if (skip > 0) {
+			skip--;
+			continue;
+		}
+		if (record.length === 0) continue;
+		const [added = "", deleted = ""] = record.split("	", 2);
+		let path = record.slice(added.length + deleted.length + 2);
+		if (path.length === 0) {
+			const renamed = fields[index + 2];
+			if (renamed === void 0) break;
+			path = renamed;
+			skip = 2;
+		}
+		const binary = added === "-";
+		files.push({
+			path,
+			additions: binary ? 0 : Number(added),
+			deletions: binary ? 0 : Number(deleted),
+			binary
+		});
+	}
+	return files;
+}
+function pathOf(name, prefix) {
+	if (name === void 0 || name === NULL_PATH) return null;
+	return name.startsWith(prefix) ? name.slice(prefix.length) : name;
+}
+//#endregion
+//#region lib/types/local-diff.js
+/**
+* Local changes of a Session's checkout: where the `branch` scope forks, the
+* patch of one scope with its untracked files, the new-side text of one file,
+* and the size of the `branch` scope for the panel's card. Git runs through
+* the confined runner; untracked and working-tree files are read through
+* `ctx.fs`, both within `maxDiffBytes`.
+*/
+/** Thrown when a patch, a file list, or a file exceeds `maxDiffBytes`. */
+var DiffTooLarge = class extends Error {
+	name = "DiffTooLarge";
+};
+/** Thrown for the `branch` scope of a checkout without a fork point. */
+var NoForkPoint = class extends Error {
+	name = "NoForkPoint";
+};
+/** Literal paths, no external diff driver or text conversion, rename detection, and fixed `a/` and `b/` prefixes. */
+const DIFF = [
+	"-c",
+	"core.quotePath=false",
+	"diff",
+	"--no-ext-diff",
+	"--no-textconv",
+	"--no-color",
+	"-M",
+	"--src-prefix=a/",
+	"--dst-prefix=b/"
+];
+/** Characters Git inspects for a NUL character before it calls content binary. */
+const BINARY_PROBE = 8e3;
+/**
+* Find where the `branch` scope forks: the base commit of the worktree the
+* Session created while the checkout is that worktree, else the merge base of
+* HEAD with the default branch of the first remote that names one, in the
+* order the panel recognizes code hosts.
+* @param git - runner bound to the checkout.
+* @param inspection - the checkout and its remotes.
+* @param created - worktree the Session created, or null.
+* @returns the fork point, or null when no remote names a default branch or HEAD shares no history with it.
+*/
+async function forkPoint(git, inspection, created) {
+	if (created !== null && created.path === inspection.checkout.root) return {
+		commit: created.baseCommit,
+		label: created.from ?? created.baseCommit.slice(0, 7)
+	};
+	for (const remote of remoteOrder(inspection.upstream, inspection.remotes)) {
+		const head = await git("remote-head", [
+			"symbolic-ref",
+			"--quiet",
+			"--short",
+			`refs/remotes/${remote.name}/HEAD`
+		], [
+			0,
+			1,
+			128
+		]);
+		const base = head.exitCode === 0 ? parseName(head.stdout) : null;
+		if (base === null) continue;
+		const merge = await git("merge-base", [
+			"merge-base",
+			"HEAD",
+			base
+		], [
+			0,
+			1,
+			128
+		]);
+		const commit = merge.exitCode === 0 ? parseName(merge.stdout) : null;
+		return commit === null ? null : {
+			commit,
+			label: base
+		};
+	}
+	return null;
+}
+/**
+* Read the changes one scope covers in the checkout at `root`.
+* @param ctx - context that provides `fs`, `subprocess`, `sandbox`, and `sandboxPolicy`.
+* @param config - Git and size limits.
+* @param session - Session whose sandbox policy and execution world apply.
+* @param root - top-level directory of the checkout.
+* @param fork - fork point of the `branch` scope, or null without one.
+* @param scope - which changes to read.
+* @param signal - cancellation of every command and read.
+* @returns tracked files in Git's order, then untracked files unless the scope is `staged`.
+* @throws NoForkPoint for the `branch` scope without `fork`; DiffTooLarge over `maxDiffBytes`; an Error when Git fails.
+*/
+async function localDiff(ctx, config, session, root, fork, scope, signal) {
+	const git = gitIn(ctx, {
+		...config,
+		maxOutputBytes: config.maxDiffBytes
+	}, session, root, signal);
+	let range;
+	switch (scope.kind) {
+		case "branch":
+			if (fork === null) throw new NoForkPoint("The checkout has no fork point to compare its branch with");
+			range = [fork.commit];
+			break;
+		case "uncommitted":
+			range = [await headOrEmptyTree(git)];
+			break;
+		case "unstaged":
+			range = [];
+			break;
+		case "staged":
+			range = ["--cached", await headOrEmptyTree(git)];
+			break;
+		/* v8 ignore next -- closed ForgeLocalScope union exhaustiveness guard */
+		default: return assertNever(scope, "ForgeLocalScope.kind");
+	}
+	const tracked = parseDiff((await bounded(git("diff", [
+		...DIFF,
+		...range,
+		"--"
+	]))).stdout);
+	if (scope.kind === "staged") return {
+		base: null,
+		files: tracked,
+		omitted: 0
+	};
+	const untracked = await untrackedFiles(ctx, config, git, root, signal);
+	return {
+		base: fork === null || scope.kind !== "branch" ? null : fork.label,
+		files: [...tracked, ...untracked.files],
+		omitted: untracked.omitted
+	};
+}
+/**
+* Read the new side of one file in a scope, which supplies the unchanged
+* lines between hunks: the index for `staged`, else the working tree.
+* @param ctx - context that provides `fs`, `subprocess`, `sandbox`, and `sandboxPolicy`.
+* @param config - Git and size limits.
+* @param session - Session whose sandbox policy and execution world apply.
+* @param root - top-level directory of the checkout.
+* @param scope - the scope whose new side to read.
+* @param path - path relative to `root`, as the diff names it.
+* @param signal - cancellation.
+* @returns the text.
+* @throws DiffTooLarge over `maxDiffBytes`; an Error for a path outside the checkout, binary content, or a failed read.
+*/
+async function localText(ctx, config, session, root, scope, path, signal) {
+	if (!insideCheckout(path)) throw new Error(`forge-panel: ${JSON.stringify(path)} is not a path inside the checkout`);
+	let text;
+	if (scope.kind === "staged") {
+		const shown = (await bounded(gitIn(ctx, {
+			...config,
+			maxOutputBytes: config.maxDiffBytes
+		}, session, root, signal)("show", ["show", `:${path}`]))).stdout;
+		text = shown.slice(0, BINARY_PROBE).includes("\0") ? void 0 : shown;
+	} else text = decodeText(await readFile(ctx, config, root, path, signal));
+	if (text === void 0) throw new Error(`forge-panel: ${path} is binary`);
+	return text;
+}
+/**
+* Measure the `branch` scope for the panel's card.
+* @param ctx - context that provides `fs`, `subprocess`, `sandbox`, and `sandboxPolicy`.
+* @param config - Git and size limits.
+* @param session - Session whose sandbox policy and execution world apply.
+* @param inspection - the checkout and its remotes.
+* @param created - worktree the Session created, or null.
+* @param signal - cancellation of every command and read.
+* @returns the base and the changed files, or null without a fork point.
+* @throws DiffTooLarge when the untracked file list exceeds `maxDiffBytes`; an Error when Git fails.
+*/
+async function localChanges(ctx, config, session, inspection, created, signal) {
+	const root = inspection.checkout.root;
+	const git = gitIn(ctx, config, session, root, signal);
+	const fork = await forkPoint(git, inspection, created);
+	if (fork === null) return null;
+	const numstat = await git("numstat", [
+		"-c",
+		"core.quotePath=false",
+		"diff",
+		"--no-ext-diff",
+		"--no-textconv",
+		"--numstat",
+		"-z",
+		"-M",
+		fork.commit,
+		"--"
+	]);
+	const untracked = await untrackedFiles(ctx, config, gitIn(ctx, {
+		...config,
+		maxOutputBytes: config.maxDiffBytes
+	}, session, root, signal), root, signal);
+	return {
+		base: fork.label,
+		files: [...parseNumstat(numstat.stdout), ...untracked.files.map((file) => ({
+			path: file.path,
+			additions: file.additions,
+			deletions: 0,
+			binary: file.binary
+		}))]
+	};
+}
+/**
+* Count the commits the checkout has beyond a change request's head, which a
+* change request diff does not show yet.
+* @param git - runner bound to the Session's directory.
+* @param branch - the change request's head branch.
+* @param commit - the change request's head commit.
+* @returns the count, or null on another branch, outside a checkout, or without the commit locally.
+*/
+async function aheadOf(git, branch, commit) {
+	const head = await git("symbolic-ref", [
+		"symbolic-ref",
+		"--quiet",
+		"--short",
+		"HEAD"
+	], [
+		0,
+		1,
+		128
+	]);
+	if (head.exitCode !== 0 || parseName(head.stdout) !== branch) return null;
+	if ((await git("cat-file", [
+		"cat-file",
+		"-e",
+		`${commit}^{commit}`
+	], [
+		0,
+		1,
+		128
+	])).exitCode !== 0) return null;
+	return Number((await git("rev-list", [
+		"rev-list",
+		"--count",
+		`${commit}..HEAD`
+	])).stdout.trim());
+}
+/** HEAD, or the empty tree while the checked-out branch has no commit. */
+async function headOrEmptyTree(git) {
+	if ((await git("head", [
+		"rev-parse",
+		"--verify",
+		"--quiet",
+		"HEAD"
+	], [0, 1])).exitCode === 0) return "HEAD";
+	return (await git("empty-tree", [
+		"hash-object",
+		"-t",
+		"tree",
+		"--stdin"
+	])).stdout.trim();
+}
+/** Untracked files Git does not ignore, at most `maxUntrackedFiles`; a nested repository and a file gone since the listing are left out. */
+async function untrackedFiles(ctx, config, git, root, signal) {
+	const paths = (await bounded(git("untracked", [
+		"ls-files",
+		"--others",
+		"--exclude-standard",
+		"-z"
+	]))).stdout.split("\0").filter((path) => path.length > 0 && !path.endsWith("/"));
+	const files = [];
+	for (const path of paths.slice(0, config.maxUntrackedFiles)) {
+		let content;
+		try {
+			content = await readFile(ctx, config, root, path, signal);
+		} catch (error) {
+			if (error instanceof DiffTooLarge) {
+				files.push({
+					...untrackedFile(path, new Uint8Array()),
+					oversized: true
+				});
+				continue;
+			}
+			if (error instanceof FsError) continue;
+			throw error;
+		}
+		files.push(untrackedFile(path, content));
+	}
+	return {
+		files,
+		omitted: Math.max(0, paths.length - config.maxUntrackedFiles)
+	};
+}
+/** Read one file of the checkout through `ctx.fs`, at most `maxDiffBytes`. */
+async function readFile(ctx, config, root, path, signal) {
+	const target = await ctx.fs.resolve(path, {
+		cwd: root,
+		signal
+	});
+	try {
+		return await ctx.fs.readBytes(target, signal, config.maxDiffBytes);
+	} catch (error) {
+		if (error instanceof FsError && error.code === "FS_TOO_LARGE") throw new DiffTooLarge(`${path} exceeds maxDiffBytes`, { cause: error });
+		throw error;
+	}
+}
+/** Translate the runner's output limit into DiffTooLarge. */
+async function bounded(output) {
+	try {
+		return await output;
+	} catch (error) {
+		if (error instanceof GitOutputTooLarge) throw new DiffTooLarge(error.message, { cause: error });
+		throw error;
+	}
+}
+/** Whether a diff path stays inside the checkout: relative, without NUL, and without a `..` segment. */
+function insideCheckout(path) {
+	if (path.length === 0 || path.includes("\0") || path.startsWith("/") || /^[A-Za-z]:/.test(path)) return false;
+	return path.split(/[/\\]/).every((segment) => segment !== "..");
+}
+//#endregion
+//#region lib/types/worktree.js
+/** The worktree a Session requests before it starts: its record, its projection, and its creation. */
+/** Plugin record type of worktree requests, withdrawals, and creations. */
+const WORKTREE_RECORD = "plugin:client-ui-forge/worktree";
+const EMPTY = {
+	request: null,
+	created: null,
+	locked: false,
+	stepped: false,
+	restoring: false
+};
+const worktreeSchema = z$1.object({
+	path: z$1.string().min(1),
+	branch: z$1.string().min(1),
+	from: z$1.string().min(1).nullable(),
+	baseCommit: z$1.string().min(1),
+	repositoryRoot: z$1.string().min(1)
+}).strict();
+const recordSchema = z$1.discriminatedUnion("action", [
+	z$1.object({
+		action: z$1.literal("request"),
+		from: z$1.string().min(1).nullable()
+	}).strict(),
+	z$1.object({ action: z$1.literal("cancel") }).strict(),
+	z$1.object({
+		action: z$1.literal("created"),
+		worktree: worktreeSchema
+	}).strict(),
+	z$1.object({ action: z$1.literal("restoring") }).strict(),
+	z$1.object({ action: z$1.literal("restored") }).strict()
+]);
+/**
+* The `forgeWorktree` unit. `request` and `cancel` records change the request
+* until the first `turn/start` or creation; the first `created` record of an
+* open request applies until the first `step/start`. Records outside those
+* periods leave the state unchanged. The unit also follows the Session's
+* working directory, so clients, including the Session summary, see the
+* created worktree only while that directory is the worktree or lies below it.
+* Restoration records retain incomplete checkout recovery across reloads.
+*/
+const forgeWorktreeProjection = {
+	key: "forgeWorktree",
+	stateVersion: 4,
+	stateSchema: z$1.object({
+		request: z$1.object({ from: z$1.string().min(1).nullable() }).strict().nullable(),
+		created: worktreeSchema.nullable(),
+		locked: z$1.boolean(),
+		stepped: z$1.boolean(),
+		restoring: z$1.boolean(),
+		cwd: z$1.string().min(1).nullable()
+	}).strict(),
+	init: (header) => ({
+		...EMPTY,
+		cwd: header.cwd ?? null
+	}),
+	apply,
+	wire: {
+		viewSchema: worktreeSchema.nullable(),
+		view: (state) => state.created !== null && state.cwd !== null && within(state.created.path, state.cwd) ? state.created : null
+	}
+};
+/**
+* Whether `path` is `root` or lies below it.
+* @param root - absolute directory.
+* @param path - absolute path.
+* @returns whether `root` contains `path`.
+*/
+function within(root, path) {
+	const rest = relative(root, path);
+	return rest === "" || rest !== ".." && !rest.startsWith(`..${sep}`) && !isAbsolute(rest);
+}
+/**
+* The text of a failure: an Error's message, or else the thrown value as a string.
+* @param error - what was thrown.
+* @returns the text.
+*/
+function messageOf(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function apply(state, event) {
+	switch (event.type) {
+		case "turn/start": return state.locked ? state : {
+			...state,
+			locked: true
+		};
+		case "step/start": return state.stepped ? state : {
+			...state,
+			stepped: true
+		};
+		case "working-directory/change": return state.cwd === event.data.cwd ? state : {
+			...state,
+			cwd: event.data.cwd
+		};
+		default: return applyRecord(state, event);
+	}
+}
+function applyRecord(state, event) {
+	const record = pluginRecordOf(event);
+	if (record?.type !== "plugin:client-ui-forge/worktree") return state;
+	const parsed = recordSchema.safeParse(record.data);
+	if (!parsed.success) return state;
+	const data = parsed.data;
+	const settled = state.created !== null;
+	switch (data.action) {
+		case "request": return state.locked || settled ? state : {
+			...state,
+			request: { from: data.from }
+		};
+		case "cancel": return state.locked || settled || state.request === null ? state : {
+			...state,
+			request: null
+		};
+		case "created": return settled || state.stepped || state.request === null ? state : {
+			...state,
+			created: data.worktree
+		};
+		case "restoring": return !settled || state.restoring ? state : {
+			...state,
+			restoring: true
+		};
+		case "restored": return !state.restoring ? state : {
+			...state,
+			restoring: false
+		};
+		/* v8 ignore next -- closed WorktreeRecord action union exhaustiveness guard */
+		default: return assertNever(data, "WorktreeRecord.action");
+	}
+}
+/** A failed attempt to create a requested worktree; `cause` holds the worktree service's error. */
+var CreationFailure = class extends Error {
+	branch;
+	phase;
+	reason;
+	/**
+	* @param branch - branch the attempt created.
+	* @param phase - step that failed.
+	* @param reason - the worktree service's failure text.
+	* @param cause - the worktree service's error.
+	*/
+	constructor(branch, phase, reason, cause) {
+		super(`The requested worktree ${branch} could not be created`, { cause });
+		this.branch = branch;
+		this.phase = phase;
+		this.reason = reason;
+		this.name = "CreationFailure";
+	}
+};
+/**
+* The failure a waiting message shows for an attempt.
+* @param error - what the attempt threw.
+* @param from - base branch of the attempt, or null for HEAD.
+* @returns the failure.
+*/
+function failureOf(error, from) {
+	return error instanceof CreationFailure ? {
+		branch: error.branch,
+		from,
+		phase: error.phase,
+		message: error.reason
+	} : {
+		branch: null,
+		from,
+		phase: "prepare",
+		message: messageOf(error)
+	};
+}
+/**
+* Creates requested worktrees, one attempt with a new branch name per call,
+* and holds the turn of a message while the Session's worktree is not ready.
+* A hold is maintenance of the Session's Agent that starts while the message
+* enters the inbox, before the delivery wakes the Agent, so the Agent starts
+* the message's turn once the hold ends. A creation hold makes an attempt
+* and, after a failed or stopped one, waits for another attempt or for the
+* request to be withdrawn; a restoration hold checks the worktree the Session
+* works in and, when it is gone, waits until it is restored or left. The
+* Agent's cancellation and the panel's stop end a hold. The first step
+* proposal of a Session whose request is still open also creates the
+* worktree, which covers a message no hold took. The worktree service enters
+* the created checkout and queues its directory notice; at a step proposal
+* the notice joins the proposed messages so the first request already names
+* the new directory, a proposal without messages leaves it queued, and a
+* failure ends the turn with the request still open. A failed attempt may
+* leave its branch or checkout behind.
+*/
+var WorktreeCreations = class {
+	ctx;
+	states;
+	prefix;
+	changed;
+	live = /* @__PURE__ */ new Map();
+	restorations = /* @__PURE__ */ new Map();
+	failures = /* @__PURE__ */ new Map();
+	holds = /* @__PURE__ */ new Map();
+	lifetime = new AbortController();
+	pending = /* @__PURE__ */ new Set();
+	/** Stop admission, cancel operations, and wait for their final callbacks. */
+	dispose;
+	/**
+	* @param ctx - context that optionally provides `worktrees`.
+	* @param states - reads the `forgeWorktree` projection of a Session.
+	* @param prefix - branch name prefix that `generatedWorktreeName` combines with the Session id and random digits.
+	* @param changed - called after the creation or restoration of a Session starts, changes phase, or ends, after its
+	* failure changes, and after a wait starts or ends.
+	*/
+	constructor(ctx, states, prefix, changed) {
+		this.ctx = ctx;
+		this.states = states;
+		this.prefix = prefix;
+		this.changed = changed;
+		ctx.on("agent/pre-step", async ({ agent, step, signal }, next) => await this.preStep(agent, step, signal, next));
+		this.dispose = ctx.effect(() => async () => {
+			this.lifetime.abort(/* @__PURE__ */ new Error("The forge panel stopped"));
+			await Promise.allSettled(this.pending);
+		}, "forge-panel: stop worktree operations");
+	}
+	/**
+	* Read the running creation of a Session.
+	* @param session - Session to read.
+	* @returns the running creation, or null.
+	*/
+	of(session) {
+		return this.live.get(session) ?? null;
+	}
+	/**
+	* Read the running restoration of a Session.
+	* @param session - Session to read.
+	* @returns the running restoration, or null.
+	*/
+	restorationOf(session) {
+		return this.restorations.get(session) ?? null;
+	}
+	/**
+	* Read the failed attempt that a waiting message saw last.
+	* @param session - Session to read.
+	* @returns the failure, or null.
+	*/
+	failureOf(session) {
+		return this.failures.get(session) ?? null;
+	}
+	/**
+	* Read what a message of a Session waits for before its turn starts.
+	* @param session - Session to read.
+	* @returns the creation or restoration the message waits for, or null while none waits.
+	*/
+	waitingOf(session) {
+		const hold = this.holds.get(session);
+		if (hold === void 0 || hold.kind === "restoration" && !hold.waiting) return null;
+		return hold.kind;
+	}
+	/**
+	* Forget the failure of a Session whose request changes or is withdrawn; the record of that change republishes the panel.
+	* @param session - Session whose failure no longer applies.
+	*/
+	forget(session) {
+		this.failures.delete(session);
+	}
+	/**
+	* Hold the turn of a message entering the inbox of a Session whose
+	* requested worktree does not exist yet, and create the worktree. Call it
+	* while the message enters, before the delivery wakes the Agent. A Session
+	* already held, or an Agent with other work, gets no new hold.
+	* @param agent - Agent of the Session.
+	*/
+	holdCreation(agent) {
+		this.hold(agent, {
+			kind: "creation",
+			stop: void 0,
+			next: void 0
+		}, (hold, signal) => this.runCreation(agent, hold, signal));
+	}
+	/**
+	* Hold the turn of a message entering the inbox of a Session that works in
+	* its created worktree while `check` decides whether that worktree is gone,
+	* and until it is restored or left when it is. Call it while the message
+	* enters, before the delivery wakes the Agent. A Session already held, or an
+	* Agent with other work, gets no new hold.
+	* @param agent - Agent of the Session.
+	* @param check - answers whether the worktree is gone; a rejection lets the message go on.
+	*/
+	holdRestoration(agent, check) {
+		this.hold(agent, {
+			kind: "restoration",
+			waiting: false,
+			next: void 0
+		}, (hold, signal) => this.runRestoration(agent, hold, check, signal));
+	}
+	/**
+	* Make another attempt for the message that waits after a failed or stopped one.
+	* @param session - Session whose message waits.
+	* @returns whether a waiting message without a running attempt took the decision.
+	*/
+	retry(session) {
+		const hold = this.holds.get(session);
+		if (hold?.kind !== "creation" || hold.next === void 0) return false;
+		hold.next.resolve("retry");
+		return true;
+	}
+	/**
+	* Read the request again after it changed; a withdrawn request lets the waiting message go on.
+	* @param session - Session whose request changed.
+	*/
+	recheck(session) {
+		const hold = this.holds.get(session);
+		if (hold?.kind === "creation") hold.next?.resolve("recheck");
+	}
+	/**
+	* Run work on the removed worktree a message waits for, inside the wait; its success lets the message go on.
+	* @param session - Session whose message waits.
+	* @param work - restores or leaves the worktree.
+	* @returns the work's outcome, or undefined when no message waits for the removed worktree.
+	*/
+	within(session, work) {
+		const hold = this.holds.get(session);
+		if (hold?.kind !== "restoration" || hold.next === void 0) return void 0;
+		const done = Promise.withResolvers();
+		hold.next.resolve({
+			work,
+			done
+		});
+		return done.promise;
+	}
+	/**
+	* Stop the running attempt a message waits for; the message keeps waiting
+	* with the request still open. Without such an attempt the Session is unchanged.
+	* @param session - Session whose attempt stops.
+	*/
+	stop(session) {
+		const hold = this.holds.get(session);
+		if (hold?.kind === "creation") hold.stop?.abort(/* @__PURE__ */ new Error("The worktree creation was stopped"));
+	}
+	/**
+	* Check the removed worktree of a Session out again through the worktree
+	* service; the running restoration is readable through
+	* {@link WorktreeCreations.restorationOf} until it ends.
+	* @param agent - Agent of the Session.
+	* @param worktrees - the worktree service.
+	* @param created - the worktree the Session created.
+	* @param signal - cancellation of the restoration.
+	* @param restored - runs once the checkout is back, before the restoration ends, so both changes publish together.
+	* @param available - checks whether the recorded checkout is already usable, within this operation's lifetime.
+	* @throws the worktree service's error when the restoration fails; the cancellation reason once `signal` aborts.
+	*/
+	async restore(agent, worktrees, created, signal, restored, available) {
+		await this.run(signal, async (operation) => {
+			const usable = await available(operation);
+			operation.throwIfAborted();
+			if (!usable) await this.restoreCheckout(agent, worktrees, created, operation, restored);
+		});
+	}
+	async restoreCheckout(agent, worktrees, created, signal, restored) {
+		const session = agent.session;
+		appendPluginRecord(session, WORKTREE_RECORD, { action: "restoring" });
+		try {
+			await worktrees.restore(agent, created, signal, (phase) => {
+				this.restorations.set(session, { phase });
+				this.changed(session);
+			});
+			signal.throwIfAborted();
+			appendPluginRecord(session, WORKTREE_RECORD, { action: "restored" });
+			restored();
+		} finally {
+			this.restorations.delete(session);
+			this.changed(session);
+		}
+	}
+	/**
+	* Create a Session's requested worktree with a new branch name, enter it, and
+	* record it on the Session. The running creation is readable through
+	* {@link WorktreeCreations.of} until the record exists or the attempt fails.
+	* @param agent - Agent of the Session.
+	* @param from - base branch, or null for HEAD of the current checkout.
+	* @param signal - cancellation of the attempt.
+	* @param held - whether a message waits for the creation before its turn starts.
+	* @returns the created worktree.
+	* @throws {@link CreationFailure} when the attempt fails; the cancellation reason once `signal` aborts.
+	*/
+	async create(agent, from, signal, held) {
+		return await this.run(signal, (operation) => this.createCheckout(agent, from, operation, held));
+	}
+	async createCheckout(agent, from, signal, held) {
+		const worktrees = this.ctx.get("worktrees");
+		if (worktrees === void 0) throw new Error("No worktree service is mounted");
+		const session = agent.session;
+		let status = {
+			phase: "prepare",
+			branch: generatedWorktreeName(this.prefix, session.id),
+			from,
+			held
+		};
+		this.failures.delete(session);
+		this.live.set(session, status);
+		this.changed(session);
+		try {
+			let created;
+			try {
+				created = await worktrees.create(agent, {
+					name: status.branch,
+					...from === null ? {} : { from }
+				}, signal, (phase) => {
+					status = {
+						...status,
+						phase
+					};
+					this.live.set(session, status);
+					this.changed(session);
+				});
+			} catch (error) {
+				signal.throwIfAborted();
+				throw new CreationFailure(status.branch, status.phase, messageOf(error), error);
+			}
+			signal.throwIfAborted();
+			appendPluginRecord(session, WORKTREE_RECORD, {
+				action: "created",
+				worktree: {
+					path: created.path,
+					branch: created.branch,
+					from,
+					baseCommit: created.baseCommit,
+					repositoryRoot: created.repositoryRoot
+				}
+			});
+			return created;
+		} finally {
+			this.live.delete(session);
+			this.changed(session);
+		}
+	}
+	/**
+	* Run a hold as maintenance of the Agent, which latches the delivery's wake until the hold ends.
+	* @param agent - Agent of the Session.
+	* @param hold - the hold's state.
+	* @param body - waits for the worktree; settles once the message may go on.
+	*/
+	hold(agent, hold, body) {
+		if (this.lifetime.signal.aborted) return;
+		const session = agent.session;
+		if (this.holds.has(session)) return;
+		let task;
+		try {
+			task = agent.runMaintenance(async (maintenance) => {
+				await Promise.resolve();
+				try {
+					await body(hold, AbortSignal.any([maintenance, this.lifetime.signal]));
+				} catch (error) {} finally {
+					this.holds.delete(session);
+					this.failures.delete(session);
+					this.changed(session);
+				}
+			});
+		} catch (error) {
+			return;
+		}
+		this.holds.set(session, hold);
+		this.join(task);
+	}
+	async run(signal, body) {
+		const operation = AbortSignal.any([signal, this.lifetime.signal]);
+		operation.throwIfAborted();
+		return await this.join(body(operation));
+	}
+	async join(task) {
+		this.pending.add(task);
+		try {
+			return await task;
+		} finally {
+			this.pending.delete(task);
+		}
+	}
+	/**
+	* Make attempts until one creates the worktree or the request no longer asks
+	* for one, waiting for a decision after each failed or stopped attempt.
+	*/
+	async runCreation(agent, hold, signal) {
+		const session = agent.session;
+		for (;;) {
+			const state = this.states.stateOf(session);
+			if (state.request === null || state.created !== null || state.locked) return;
+			const stop = new AbortController();
+			hold.stop = stop;
+			try {
+				await this.create(agent, state.request.from, AbortSignal.any([signal, stop.signal]), true);
+				return;
+			} catch (error) {
+				signal.throwIfAborted();
+				if (stop.signal.aborted) this.failures.delete(session);
+				else this.failures.set(session, failureOf(error, state.request.from));
+				this.changed(session);
+			} finally {
+				hold.stop = void 0;
+			}
+			while (await this.wait(hold, signal) !== "retry") {
+				const current = this.states.stateOf(session);
+				if (current.request === null || current.created !== null || current.locked) return;
+			}
+		}
+	}
+	/** Check the worktree the Session works in and, when it is gone, run the work that restores or leaves it until one succeeds. */
+	async runRestoration(agent, hold, check, signal) {
+		let missing;
+		try {
+			missing = await check(signal);
+		} catch (error) {
+			signal.throwIfAborted();
+			return;
+		}
+		if (missing === null) return;
+		hold.waiting = true;
+		this.changed(agent.session);
+		for (;;) {
+			const { work, done } = await this.wait(hold, signal);
+			try {
+				await work(agent, signal);
+			} catch (error) {
+				done.reject(error);
+				signal.throwIfAborted();
+				continue;
+			}
+			done.resolve();
+			return;
+		}
+	}
+	/** Wait for the next decision on a hold; rejects with the abort reason once `signal` aborts. */
+	async wait(hold, signal) {
+		signal.throwIfAborted();
+		const next = Promise.withResolvers();
+		hold.next = next;
+		const abort = () => {
+			next.reject(signal.reason);
+		};
+		signal.addEventListener("abort", abort, { once: true });
+		try {
+			return await next.promise;
+		} finally {
+			signal.removeEventListener("abort", abort);
+			hold.next = void 0;
+		}
+	}
+	async preStep(agent, step, signal, next) {
+		const state = this.states.stateOf(agent.session);
+		if (step !== 1 || state.request === null || state.created !== null || state.stepped) return await next();
+		await this.create(agent, state.request.from, signal, false);
+		const decision = await next();
+		if (decision.kind === "reject" || decision.messages.length === 0) return decision;
+		const notices = agent.inbox.nextStep.filter((message) => message.source.kind === "working-directory");
+		for (const notice of notices) agent.inbox.remove(notice.id);
+		return notices.length === 0 ? decision : {
+			...decision,
+			messages: [...decision.messages, ...notices]
+		};
+	}
+};
+//#endregion
+//#region lib/types/panel.js
+/** Live panel state of one followed Session, shared by all of its followers. */
+var __addDisposableResource = function(env, value, async) {
+	if (value !== null && value !== void 0) {
+		if (typeof value !== "object" && typeof value !== "function") throw new TypeError("Object expected.");
+		var dispose, inner;
+		if (async) {
+			if (!Symbol.asyncDispose) throw new TypeError("Symbol.asyncDispose is not defined.");
+			dispose = value[Symbol.asyncDispose];
+		}
+		if (dispose === void 0) {
+			if (!Symbol.dispose) throw new TypeError("Symbol.dispose is not defined.");
+			dispose = value[Symbol.dispose];
+			if (async) inner = dispose;
+		}
+		if (typeof dispose !== "function") throw new TypeError("Object not disposable.");
+		if (inner) dispose = function() {
+			try {
+				inner.call(this);
+			} catch (e) {
+				return Promise.reject(e);
+			}
+		};
+		env.stack.push({
+			value,
+			dispose,
+			async
+		});
+	} else if (async) env.stack.push({ async: true });
+	return value;
+};
+var __disposeResources = (function(SuppressedError) {
+	return function(env) {
+		function fail(e) {
+			env.error = env.hasError ? new SuppressedError(e, env.error, "An error was suppressed during disposal.") : e;
+			env.hasError = true;
+		}
+		var r, s = 0;
+		function next() {
+			while (r = env.stack.pop()) try {
+				if (!r.async && s === 1) return s = 0, env.stack.push(r), Promise.resolve().then(next);
+				if (r.dispose) {
+					var result = r.dispose.call(r.value);
+					if (r.async) return s |= 2, Promise.resolve(result).then(next, function(e) {
+						fail(e);
+						return next();
+					});
+				} else s |= 1;
+			} catch (e) {
+				fail(e);
+			}
+			if (s === 1) return env.hasError ? Promise.reject(env.error) : Promise.resolve();
+			if (env.hasError) throw env.error;
+		}
+		return next();
+	};
+})(typeof SuppressedError === "function" ? SuppressedError : function(error, suppressed, message) {
+	var e = new Error(message);
+	return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+});
+/**
+* Panel state of one Session. Construction starts the first checkout
+* inspection and watches the Session's change requests. Inspections run one at
+* a time; a request that arrives during one runs once more after it, and a
+* result for a directory the Session has since left is dropped. A sign-in
+* probe runs when an inspection recognizes a new code host and on `refresh`;
+* a probe result for a host the panel no longer shows is dropped. Each change
+* request keeps the latest snapshot a poll returned while later polls fail.
+* When an inspection finds an upstream branch on a remote a provider
+* recognizes, the open change requests of that branch are bound as discovered,
+* once per remote and branch until a refresh. The
+* worktree facts follow the `forgeWorktree` projection, the live creation, and the last failed one;
+* each inspection also decides whether the Session's sandbox can write the
+* checkout and its shared Git directory, which a new worktree needs, whether
+* the worktree the Session created and works in is gone, and how many lines
+* the `branch` scope changes; a measurement that fails leaves that null.
+*/
+var SessionPanel = class {
+	ctx;
+	config;
+	session;
+	worktreeStates;
+	creations;
+	onIdle;
+	current;
+	followers = /* @__PURE__ */ new Set();
+	lifetime = new AbortController();
+	tasks = /* @__PURE__ */ new Set();
+	stopWatching;
+	snapshots = /* @__PURE__ */ new Map();
+	blocker = null;
+	missing = null;
+	inspection = null;
+	rerun = null;
+	/** Remote URL and branch of the upstream that the last branch lookup covered, until a refresh. */
+	discovered = null;
+	/**
+	* @param ctx - service context that provides the forge, Session, directory, and process services.
+	* @param config - Git limits and the sign-in probe deadline.
+	* @param session - Session the panel describes.
+	* @param worktreeStates - reads the `forgeWorktree` projection of the Session.
+	* @param creations - reads the running creation and restoration, the last failed creation, and what a message of the
+	* Session waits for.
+	* @param onIdle - called when the last follower leaves.
+	*/
+	constructor(ctx, config, session, worktreeStates, creations, onIdle) {
+		this.ctx = ctx;
+		this.config = config;
+		this.session = session;
+		this.worktreeStates = worktreeStates;
+		this.creations = creations;
+		this.onIdle = onIdle;
+		this.current = {
+			directory: ctx.workingDirectory.get(session),
+			checkout: { state: "pending" },
+			repository: null,
+			readiness: null,
+			changeRequests: this.entries(ctx.forgeSession.changeRequests(session)),
+			worktree: this.worktree(),
+			local: null
+		};
+		this.stopWatching = ctx.forgeSession.watch(session, (changeRequests) => {
+			this.publish({
+				...this.current,
+				changeRequests: this.entries(changeRequests)
+			});
+		});
+		this.inspect();
+	}
+	/**
+	* Yield the current state, then each later state, until `signal` aborts or the panel stops.
+	* @param signal - ends this follower.
+	* @returns the states in publication order; intermediate states may be skipped.
+	*/
+	async *follow(signal) {
+		let wake;
+		const notify = () => {
+			wake?.();
+		};
+		this.followers.add(notify);
+		signal.addEventListener("abort", notify);
+		this.lifetime.signal.addEventListener("abort", notify);
+		try {
+			let delivered;
+			while (!signal.aborted && !this.lifetime.signal.aborted) {
+				if (this.current !== delivered) {
+					delivered = this.current;
+					yield delivered;
+					continue;
+				}
+				await new Promise((resolve) => {
+					wake = resolve;
+				});
+				wake = void 0;
+			}
+		} finally {
+			this.followers.delete(notify);
+			signal.removeEventListener("abort", notify);
+			this.lifetime.signal.removeEventListener("abort", notify);
+			if (this.followers.size === 0) this.onIdle();
+		}
+	}
+	/**
+	* React to one committed event of the Session: a directory change moves the
+	* panel and reinspects; a tool result reinspects, because the tool may have
+	* changed the checkout; a sandbox mode change reinspects, because it decides
+	* whether a worktree can be created; the first turn, the first step, and
+	* worktree records update the worktree facts.
+	* @param event - committed Session event.
+	*/
+	observe(event) {
+		if (event.type === "working-directory/change") {
+			this.publish({
+				...this.current,
+				directory: event.data.cwd,
+				checkout: { state: "pending" },
+				local: null
+			});
+			this.inspect();
+		} else if (event.type === "tool/result" || event.type === "sandbox/mode") this.inspect();
+		else if (event.type === "turn/start" || event.type === "step/start" || pluginRecordOf(event)?.type === "plugin:client-ui-forge/worktree") this.updateWorktree();
+	}
+	/** Republish the worktree facts when they changed, such as after a creation moved or a worktree service appeared or left. */
+	updateWorktree() {
+		const worktree = this.worktree();
+		if (!sameWorktree(worktree, this.current.worktree)) this.publish({
+			...this.current,
+			worktree
+		});
+	}
+	/** Forget the missing worktree once it was checked out again; the next publication carries it, and a reinspection confirms it. */
+	restored() {
+		this.missing = null;
+	}
+	/** Reinspect the checkout, such as after its directory was created again. */
+	reinspect() {
+		this.inspect();
+	}
+	/**
+	* Check again whether the worktree the Session works in is gone, publishing a change.
+	* @param signal - cancellation of the check.
+	* @returns the unavailable worktree, or null for a valid checkout or a Session working elsewhere.
+	* @throws when the filesystem or Git cannot answer.
+	*/
+	async checkMissing(signal) {
+		const directory = this.current.directory;
+		const state = this.worktreeStates.stateOf(this.session);
+		const missing = await missingWorktree(this.ctx, this.config, this.session, state, directory, AbortSignal.any([signal, this.lifetime.signal]));
+		if (this.current.directory === directory) {
+			this.missing = missing;
+			this.updateWorktree();
+		}
+		return missing;
+	}
+	/**
+	* Reinspect the checkout, probe sign-in again, and poll every bound change request at once.
+	* @returns settles once the inspection and the sign-in probe have ended; each poll publishes its result when it finishes.
+	*/
+	async refresh() {
+		this.discovered = null;
+		const inspection = this.inspect();
+		const probe = this.current.repository === null ? void 0 : this.probe(this.current.repository);
+		for (const entry of this.current.changeRequests) if (entry.ref !== null) this.ctx.forge.refresh(entry.ref);
+		await Promise.all([inspection, probe]);
+	}
+	/**
+	* Stop inspections, probes, and the change request watch, end every follower, and wait for pending work.
+	* @returns settles once pending inspections and probes have ended.
+	*/
+	async dispose() {
+		this.lifetime.abort();
+		this.stopWatching();
+		await Promise.allSettled(this.tasks);
+	}
+	entries(changeRequests) {
+		return changeRequests.map((entry) => {
+			if (entry.update !== null && "snapshot" in entry.update) this.snapshots.set(entry.url, entry.update.snapshot);
+			return {
+				...entry,
+				snapshot: this.snapshots.get(entry.url) ?? null
+			};
+		});
+	}
+	worktree() {
+		const state = this.worktreeStates.stateOf(this.session);
+		return {
+			editable: this.ctx.get("worktrees") !== void 0 && !state.locked && state.created === null,
+			blocker: this.blocker,
+			request: state.request,
+			created: state.created,
+			creation: this.creations.of(this.session),
+			failure: this.creations.failureOf(this.session),
+			missing: this.missing,
+			restoration: this.creations.restorationOf(this.session),
+			waiting: this.creations.waitingOf(this.session)
+		};
+	}
+	publish(next) {
+		this.current = next;
+		for (const notify of [...this.followers]) notify();
+	}
+	/** Track `task` for disposal; the returned promise resolves once it settles, whatever the outcome. */
+	run(task) {
+		this.tasks.add(task);
+		const settle = () => {
+			this.tasks.delete(task);
+		};
+		return task.then(settle, settle);
+	}
+	/**
+	* Inspect the checkout, one inspection at a time; calls during an
+	* inspection share one trailing rerun.
+	* @returns resolves once an inspection that started after the call has ended.
+	*/
+	inspect() {
+		if (this.lifetime.signal.aborted) return Promise.resolve();
+		if (this.inspection === null) {
+			this.inspection = this.run(this.inspectOnce()).then(() => {
+				this.inspection = null;
+			});
+			return this.inspection;
+		}
+		this.rerun ??= this.inspection.then(() => {
+			this.rerun = null;
+			return this.inspect();
+		});
+		return this.rerun;
+	}
+	async inspectOnce() {
+		const directory = this.current.directory;
+		let checkout;
+		let repository = null;
+		let blocker = null;
+		let local = null;
+		let upstream = null;
+		try {
+			const inspection = await inspectCheckout(this.ctx, this.config, this.session, directory, this.lifetime.signal);
+			if (inspection === void 0) {
+				checkout = { state: "none" };
+				blocker = "not-git";
+			} else {
+				checkout = {
+					state: "ready",
+					checkout: inspection.checkout
+				};
+				repository = this.recognize(inspection);
+				upstream = this.upstreamOf(inspection);
+				blocker = await this.blockerOf(inspection);
+				local = await this.localOf(inspection);
+			}
+		} catch (error) {
+			checkout = {
+				state: "failed",
+				message: error instanceof Error ? error.message : String(error)
+			};
+		}
+		let missing = null;
+		try {
+			const state = this.worktreeStates.stateOf(this.session);
+			missing = await missingWorktree(this.ctx, this.config, this.session, state, directory, this.lifetime.signal);
+		} catch (_error) {}
+		if (this.lifetime.signal.aborted || this.current.directory !== directory) return;
+		this.blocker = blocker;
+		this.missing = missing;
+		const sameHost = repository !== null && this.current.repository !== null && hostOf(repository) === hostOf(this.current.repository);
+		const readiness = sameHost ? this.current.readiness : null;
+		this.publish({
+			...this.current,
+			checkout,
+			repository,
+			readiness,
+			worktree: this.worktree(),
+			local
+		});
+		if (repository !== null && !sameHost) this.probe(repository);
+		if (upstream !== null) this.discover(upstream);
+	}
+	/** The upstream branch with the first URL of its remote that a provider recognizes. */
+	upstreamOf(inspection) {
+		const tracked = upstreamBranch(inspection.upstream, inspection.remotes);
+		const remote = tracked?.remote.urls.find((url) => this.ctx.forge.repositoryFromRemote(url) !== void 0);
+		return tracked === void 0 || remote === void 0 ? null : {
+			remote,
+			branch: tracked.branch
+		};
+	}
+	/** Bind the open change requests of the upstream branch, once per remote and branch until a refresh. */
+	discover(upstream) {
+		const key = `${upstream.remote}\n${upstream.branch}`;
+		if (this.discovered === key) return;
+		this.discovered = key;
+		this.run(this.ctx.forgeSession.discoverBranch(this.session, upstream.remote, upstream.branch));
+	}
+	/** Decide whether the Session's sandbox lets the worktree service write the checkout and its shared Git directory. */
+	async blockerOf(inspection) {
+		const policy = this.ctx.sandboxPolicy.resolve({ session: this.session });
+		if (policy.mode === "danger-full-access") return null;
+		if (policy.mode === "read-only") return "read-only";
+		const root = this.ctx.fs.processPath(await this.ctx.fs.resolve(policy.workspaceRoot, { signal: this.lifetime.signal }));
+		return within(root, inspection.checkout.root) && within(root, inspection.commonDir) ? null : "outside-writable-root";
+	}
+	/** Measure the `branch` scope; a failed measurement only hides the local changes card. */
+	async localOf(inspection) {
+		try {
+			return await localChanges(this.ctx, this.config, this.session, inspection, this.worktree().created, this.lifetime.signal);
+		} catch (_error) {
+			return null;
+		}
+	}
+	recognize(inspection) {
+		for (const remote of remoteOrder(inspection.upstream, inspection.remotes)) for (const url of remote.urls) {
+			const repository = this.ctx.forge.repositoryFromRemote(url);
+			if (repository !== void 0) return repository;
+		}
+		return null;
+	}
+	/** Probe sign-in on the repository's host; resolves once the probe has ended. */
+	probe(repository) {
+		const host = hostOf(repository);
+		return this.run((async () => {
+			let readiness;
+			try {
+				const env_1 = {
+					stack: [],
+					error: void 0,
+					hasError: false
+				};
+				try {
+					const timeout = __addDisposableResource(env_1, deadline(this.lifetime.signal, this.config.readinessTimeoutMs, "FORGE_PANEL_READINESS_TIMEOUT"), false);
+					readiness = await this.ctx.forge.readiness(repository, timeout.signal);
+				} catch (e_1) {
+					env_1.error = e_1;
+					env_1.hasError = true;
+				} finally {
+					__disposeResources(env_1);
+				}
+			} catch (error) {
+				readiness = {
+					state: "unavailable",
+					message: error instanceof Error ? error.message : String(error)
+				};
+			}
+			if (this.lifetime.signal.aborted || this.current.repository === null || hostOf(this.current.repository) !== host) return;
+			this.publish({
+				...this.current,
+				readiness
+			});
+		})());
+	}
+};
+function sameWorktree(left, right) {
+	return left.editable === right.editable && left.blocker === right.blocker && left.request === right.request && left.created === right.created && left.creation === right.creation && left.failure === right.failure && left.missing?.branchExists === right.missing?.branchExists && left.restoration === right.restoration && left.waiting === right.waiting;
+}
+/**
+* Decide whether a Session works inside the worktree it created while that
+* worktree's directory is gone, and whether its branch still exists.
+* @param ctx - context that provides `fs` and the process services.
+* @param config - Git limits.
+* @param session - Session to check.
+* @param state - recorded worktree and restoration completion.
+* @param directory - the Session's current directory.
+* @param signal - cancellation of the check.
+* @returns the unavailable worktree, or null for a valid checkout or a Session working elsewhere.
+* @throws when the filesystem or Git cannot answer.
+*/
+async function missingWorktree(ctx, config, session, state, directory, signal) {
+	const created = state.created;
+	if (created === null || !within(created.path, directory)) return null;
+	if (!state.restoring && await ctx.fs.lstat(created.path, void 0, signal) !== void 0) {
+		const git = gitIn(ctx, config, session, created.path, signal);
+		const top = await git("rev-parse", ["rev-parse", "--show-toplevel"], [0, 128]);
+		if (top.exitCode === 0) {
+			const target = await ctx.fs.resolve(created.path, { signal });
+			if ((await ctx.fs.resolve(top.stdout.replace(/\r?\n$/, ""), {
+				cwd: created.path,
+				signal
+			})).targetKey === target.targetKey) {
+				const common = await git("common-dir", [
+					"rev-parse",
+					"--path-format=absolute",
+					"--git-common-dir"
+				]);
+				const source = await gitIn(ctx, config, session, created.repositoryRoot, signal)("common-dir", [
+					"rev-parse",
+					"--path-format=absolute",
+					"--git-common-dir"
+				]);
+				const actual = await ctx.fs.resolve(common.stdout.replace(/\r?\n$/, ""), {
+					cwd: created.path,
+					signal
+				});
+				const expected = await ctx.fs.resolve(source.stdout.replace(/\r?\n$/, ""), {
+					cwd: created.repositoryRoot,
+					signal
+				});
+				if (actual.targetKey === expected.targetKey) return null;
+			}
+		}
+	}
+	try {
+		return { branchExists: await hasBranch(ctx, config, session, created.repositoryRoot, created.branch, signal) };
+	} catch (error) {
+		signal.throwIfAborted();
+		if (!state.restoring) throw error;
+		return { branchExists: null };
+	}
+}
+function hostOf(repository) {
+	return `${repository.forge}:${repository.host}`;
+}
+//#endregion
+//#region lib/types/patch-cache.js
+/**
+* Change request patches kept in memory, so the changes view reads no diff
+* from the code host again while a change request keeps its head commit and base branch.
+*/
+/**
+* One patch per change request, bounded by the total UTF-8 size of the kept
+* patches; the least recently read patch leaves first.
+*/
+var PatchCache = class {
+	maxBytes;
+	entries = /* @__PURE__ */ new Map();
+	bytes = 0;
+	/** @param maxBytes - most UTF-8 bytes kept together; a larger patch is not kept. */
+	constructor(maxBytes) {
+		this.maxBytes = maxBytes;
+	}
+	/**
+	* Read the patch kept for a change request at a version, marking it the most recently read.
+	* @param key - the change request.
+	* @param version - head commit and base branch the reader needs.
+	* @returns the patch, or undefined when none is kept at that version.
+	*/
+	get(key, version) {
+		const entry = this.entries.get(key);
+		if (entry?.version !== version) return void 0;
+		this.entries.delete(key);
+		this.entries.set(key, entry);
+		return entry.patch;
+	}
+	/**
+	* Keep a patch in place of the change request's earlier one, then drop the
+	* least recently read patches until the rest fit within `maxBytes`.
+	* @param key - the change request.
+	* @param version - head commit and base branch the patch was read at.
+	* @param patch - the patch.
+	*/
+	set(key, version, patch) {
+		this.remove(key);
+		const bytes = Buffer.byteLength(patch);
+		if (bytes > this.maxBytes) return;
+		this.entries.set(key, {
+			version,
+			patch,
+			bytes
+		});
+		this.bytes += bytes;
+		for (const oldest of this.entries.keys()) {
+			if (this.bytes <= this.maxBytes) break;
+			this.remove(oldest);
+		}
+	}
+	remove(key) {
+		const entry = this.entries.get(key);
+		if (entry === void 0) return;
+		this.entries.delete(key);
+		this.bytes -= entry.bytes;
+	}
+};
+/** Stored states keyed by {@link storedKey}; derived data, so a record that fails its schema is set aside. */
+const changeRequestStatesDomain = defineDomain({
+	name: "forge_panel_change_requests",
+	version: 1,
+	layout: "per-record",
+	invalidRecords: "backup-and-skip",
+	tables: { states: { valueSchema: z$1.object({
+		url: z$1.string().min(1),
+		number: z$1.number().int().positive(),
+		title: z$1.string(),
+		state: z$1.enum([
+			"open",
+			"merged",
+			"closed"
+		]),
+		draft: z$1.boolean(),
+		checksRollup: z$1.enum([
+			"none",
+			"pending",
+			"success",
+			"failure"
+		]),
+		reviewDecision: z$1.enum([
+			"none",
+			"review-required",
+			"approved",
+			"changes-requested"
+		]),
+		mergeability: z$1.enum([
+			"mergeable",
+			"conflicting",
+			"unknown"
+		])
+	}).strict() } }
+});
+/**
+* The storage key of a change request's state: a path-safe digest of its URL.
+* @param url - the change request's web URL.
+* @returns the key.
+*/
+function storedKey(url) {
+	return createHash("sha256").update(url).digest("hex");
+}
+function listStateOf(snapshot, url) {
+	return {
+		url,
+		number: snapshot.ref.number,
+		title: snapshot.title,
+		state: snapshot.state,
+		draft: snapshot.draft,
+		checksRollup: snapshot.checksRollup,
+		reviewDecision: snapshot.reviewDecision,
+		mergeability: snapshot.mergeability
+	};
+}
+function sameState(left, right) {
+	return left !== void 0 && left.title === right.title && left.state === right.state && left.draft === right.draft && left.checksRollup === right.checksRollup && left.reviewDecision === right.reviewDecision && left.mergeability === right.mergeability && left.number === right.number;
+}
+/** One stream's pending changes, coalesced by URL until the reader takes them. */
+var Reader = class {
+	allowed;
+	signal;
+	pending = /* @__PURE__ */ new Map();
+	wake;
+	ended = false;
+	completion = Promise.withResolvers();
+	closed = this.completion.promise;
+	abort = () => {
+		this.end();
+	};
+	constructor(allowed, signal) {
+		this.allowed = allowed;
+		this.signal = signal;
+		signal.addEventListener("abort", this.abort, { once: true });
+	}
+	push(state) {
+		if (this.ended) return;
+		this.pending.set(state.url, state);
+		this.wake?.();
+	}
+	end() {
+		this.ended = true;
+		this.pending.clear();
+		this.completion.resolve(void 0);
+		this.wake?.();
+	}
+	dispose() {
+		this.signal.removeEventListener("abort", this.abort);
+		this.end();
+	}
+	async *frames() {
+		while (!this.ended) {
+			if (this.pending.size === 0) {
+				await new Promise((resolve) => {
+					this.wake = resolve;
+				});
+				this.wake = void 0;
+				continue;
+			}
+			const states = [...this.pending.values()];
+			this.pending = /* @__PURE__ */ new Map();
+			yield {
+				type: "changed",
+				states
+			};
+		}
+	}
+};
+/** The state of one run: stored and polled states, who binds what, and the polls. */
+var Run = class {
+	sources;
+	readers;
+	table;
+	states = /* @__PURE__ */ new Map();
+	sessionsOf = /* @__PURE__ */ new Map();
+	urlsOf = /* @__PURE__ */ new Map();
+	polls = /* @__PURE__ */ new Map();
+	stopBindings;
+	startupBindings = /* @__PURE__ */ new Map();
+	starting = true;
+	writes = /* @__PURE__ */ new Set();
+	stopped = false;
+	constructor(sources, readers, table) {
+		this.sources = sources;
+		this.readers = readers;
+		this.table = table;
+		for (const [, state] of table.entries()) this.states.set(state.url, state);
+		this.stopBindings = sources.onBindings((id, urls) => {
+			if (this.starting) this.startupBindings.set(id, urls);
+			else this.bind(id, urls);
+		});
+	}
+	async start(signal) {
+		const listed = await this.sources.sessions(signal);
+		signal.throwIfAborted();
+		const updates = this.startupBindings;
+		for (const session of listed) {
+			const urls = updates.get(session.id) ?? session.urls;
+			if (urls !== void 0) this.bind(session.id, urls);
+		}
+		this.starting = false;
+		for (const [id, urls] of updates) this.bind(id, urls);
+		updates.clear();
+		if (listed.some((session) => session.urls === void 0)) return;
+		for (const [url] of this.states) {
+			if (this.sessionsOf.has(url)) continue;
+			this.states.delete(url);
+			this.write(() => this.table.delete(storedKey(url)));
+		}
+	}
+	/** The known states of every change request that some Session the reader may read binds. */
+	visible(allowed) {
+		const states = [];
+		for (const [url, ids] of this.sessionsOf) {
+			const state = this.states.get(url);
+			if (state !== void 0 && [...ids].some(allowed)) states.push(state);
+		}
+		return states;
+	}
+	async stop() {
+		this.stopped = true;
+		this.stopBindings();
+		for (const stop of this.polls.values()) stop();
+		this.polls.clear();
+		await Promise.all(this.writes);
+	}
+	bind(id, urls) {
+		const next = new Set(urls);
+		const previous = this.urlsOf.get(id) ?? /* @__PURE__ */ new Set();
+		this.urlsOf.set(id, next);
+		for (const url of previous) {
+			if (next.has(url)) continue;
+			const ids = this.sessionsOf.get(url);
+			ids?.delete(id);
+			if (ids !== void 0 && ids.size === 0) {
+				this.sessionsOf.delete(url);
+				this.polls.get(url)?.();
+				this.polls.delete(url);
+			}
+		}
+		for (const url of next) {
+			if (previous.has(url)) continue;
+			const ids = this.sessionsOf.get(url) ?? /* @__PURE__ */ new Set();
+			ids.add(id);
+			this.sessionsOf.set(url, ids);
+			const state = this.states.get(url);
+			if (state !== void 0) {
+				for (const reader of this.readers) if (reader.allowed(id)) reader.push(state);
+			}
+			this.poll(url, ids);
+		}
+	}
+	/** Poll a bound change request; `ids` is the live set of Sessions binding it, which outlives the poll. */
+	poll(url, ids) {
+		if (this.polls.has(url)) return;
+		const ref = this.sources.refOf(url);
+		if (ref === void 0) return;
+		this.polls.set(url, this.sources.watch(ref, (update) => {
+			if ("failure" in update) return;
+			this.settle(url, ids, listStateOf(update.snapshot, url));
+		}));
+	}
+	settle(url, ids, state) {
+		if (this.stopped || sameState(this.states.get(url), state)) return;
+		this.states.set(url, state);
+		this.write(() => this.table.put(storedKey(url), state));
+		for (const reader of this.readers) if ([...ids].some(reader.allowed)) reader.push(state);
+	}
+	write(operation) {
+		const task = operation().then(() => void 0, (error) => {
+			this.sources.report(error);
+		});
+		this.writes.add(task);
+		task.then(() => {
+			this.writes.delete(task);
+		});
+	}
+};
+/** Streams the states of the change requests that listed Sessions bind. */
+var ChangeRequestStates = class {
+	sources;
+	readers = /* @__PURE__ */ new Set();
+	stopping = Promise.resolve();
+	disposed = false;
+	run;
+	/** @param sources - what runs read, follow, and poll. */
+	constructor(sources) {
+		this.sources = sources;
+	}
+	/**
+	* Stream the known states the reader may see first, then each state that
+	* changes or becomes visible to it. The stream ends when `signal` aborts or
+	* the hub is disposed.
+	* @param allowed - whether the reader may read a Session.
+	* @param signal - ends the stream.
+	* @returns frames in publication order.
+	*/
+	async *stream(allowed, signal) {
+		signal.throwIfAborted();
+		if (this.disposed) return;
+		const reader = new Reader(allowed, signal);
+		this.readers.add(reader);
+		try {
+			const run = await Promise.race([this.ensureRun(), reader.closed.then(() => void 0)]);
+			if (run === void 0) return;
+			yield {
+				type: "baseline",
+				states: run.visible(allowed)
+			};
+			yield* reader.frames();
+		} finally {
+			reader.dispose();
+			this.readers.delete(reader);
+			if (this.readers.size === 0) await this.stopRun();
+		}
+	}
+	/**
+	* End every stream, stop polling, and wait for initialization and accepted storage writes.
+	* @returns settles after all owned work stops; subsequent streams end without starting work.
+	*/
+	async dispose() {
+		this.disposed = true;
+		for (const reader of this.readers) reader.end();
+		await this.stopRun();
+	}
+	ensureRun() {
+		if (this.run !== void 0) return this.run.started;
+		const aborter = new AbortController();
+		const preceding = this.stopping;
+		const started = (async () => {
+			await preceding;
+			aborter.signal.throwIfAborted();
+			const table = await this.sources.open();
+			aborter.signal.throwIfAborted();
+			const run = new Run(this.sources, this.readers, table);
+			try {
+				await run.start(aborter.signal);
+				return run;
+			} catch (error) {
+				await run.stop();
+				throw error;
+			}
+		})();
+		this.run = {
+			started,
+			aborter
+		};
+		return started;
+	}
+	stopRun() {
+		const current = this.run;
+		if (current === void 0) return this.stopping;
+		this.run = void 0;
+		current.aborter.abort();
+		this.stopping = current.started.then((run) => run?.stop(), (error) => {});
+		return this.stopping;
+	}
+};
+//#endregion
+//#region lib/types/index.js
+/** Host Remote of the forge panel: checkout, code host, sign-in, change request, and worktree state per Session. */
+var __runInitializers = function(thisArg, initializers, value) {
+	var useValue = arguments.length > 2;
+	for (var i = 0; i < initializers.length; i++) value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+	return useValue ? value : void 0;
+};
+var __esDecorate = function(ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+	function accept(f) {
+		if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected");
+		return f;
+	}
+	var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+	var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+	var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+	var _, done = false;
+	for (var i = decorators.length - 1; i >= 0; i--) {
+		var context = {};
+		for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+		for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+		context.addInitializer = function(f) {
+			if (done) throw new TypeError("Cannot add initializers after decoration has completed");
+			extraInitializers.push(accept(f || null));
+		};
+		var result = (0, decorators[i])(kind === "accessor" ? {
+			get: descriptor.get,
+			set: descriptor.set
+		} : descriptor[key], context);
+		if (kind === "accessor") {
+			if (result === void 0) continue;
+			if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+			if (_ = accept(result.get)) descriptor.get = _;
+			if (_ = accept(result.set)) descriptor.set = _;
+			if (_ = accept(result.init)) initializers.unshift(_);
+		} else if (_ = accept(result)) if (kind === "field") initializers.unshift(_);
+		else descriptor[key] = _;
+	}
+	if (target) Object.defineProperty(target, contextIn.name, descriptor);
+	done = true;
+};
+/**
+* Serves the forge panel. Following a Session inspects the checkout of its
+* current directory read-only in the Session's execution world, recognizes the
+* code host of the upstream remote or `origin`, probes sign-in for that host,
+* and polls the Session's bound change requests through `ctx.forge` until the
+* last follower of that Session leaves. A worktree request makes the panel
+* create a branch and checkout through an optional `ctx.worktrees` and enter
+* it while the Session's first message waits in the inbox, or at the first
+* step proposal of a message no wait took. After a failed or stopped attempt
+* the message keeps waiting for another attempt or for the request to be
+* withdrawn. A message also waits while the worktree the Session works in is
+* gone, until that worktree is checked out again or left for the source
+* checkout. Changes to a Session's checkout run as Agent maintenance, so a
+* message that arrives meanwhile waits for them.
+*/
+let ForgePanelController = (() => {
+	let _classSuper = TypertRemoteService;
+	let _instanceExtraInitializers = [];
+	let _follow_decorators;
+	let _changeRequestStates_decorators;
+	let _branches_decorators;
+	let _track_decorators;
+	let _dismiss_decorators;
+	let _refresh_decorators;
+	let _localDiff_decorators;
+	let _localText_decorators;
+	let _changeRequestDiff_decorators;
+	let _changeRequestText_decorators;
+	let _markReady_decorators;
+	let _merge_decorators;
+	let _requestWorktree_decorators;
+	let _cancelWorktree_decorators;
+	let _stopCreation_decorators;
+	let _retryWorktree_decorators;
+	let _restoreWorktree_decorators;
+	let _continueInProject_decorators;
+	return class ForgePanelController extends _classSuper {
+		static {
+			const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+			_follow_decorators = [Remote({ mode: "stream" })];
+			_changeRequestStates_decorators = [Remote({ mode: "stream" })];
+			_branches_decorators = [Remote];
+			_track_decorators = [Remote];
+			_dismiss_decorators = [Remote];
+			_refresh_decorators = [Remote];
+			_localDiff_decorators = [Remote];
+			_localText_decorators = [Remote];
+			_changeRequestDiff_decorators = [Remote];
+			_changeRequestText_decorators = [Remote];
+			_markReady_decorators = [Remote];
+			_merge_decorators = [Remote];
+			_requestWorktree_decorators = [Remote];
+			_cancelWorktree_decorators = [Remote];
+			_stopCreation_decorators = [Remote];
+			_retryWorktree_decorators = [Remote];
+			_restoreWorktree_decorators = [Remote];
+			_continueInProject_decorators = [Remote];
+			__esDecorate(this, null, _follow_decorators, {
+				kind: "method",
+				name: "follow",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "follow" in obj,
+					get: (obj) => obj.follow
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _changeRequestStates_decorators, {
+				kind: "method",
+				name: "changeRequestStates",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "changeRequestStates" in obj,
+					get: (obj) => obj.changeRequestStates
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _branches_decorators, {
+				kind: "method",
+				name: "branches",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "branches" in obj,
+					get: (obj) => obj.branches
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _track_decorators, {
+				kind: "method",
+				name: "track",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "track" in obj,
+					get: (obj) => obj.track
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _dismiss_decorators, {
+				kind: "method",
+				name: "dismiss",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "dismiss" in obj,
+					get: (obj) => obj.dismiss
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _refresh_decorators, {
+				kind: "method",
+				name: "refresh",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "refresh" in obj,
+					get: (obj) => obj.refresh
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _localDiff_decorators, {
+				kind: "method",
+				name: "localDiff",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "localDiff" in obj,
+					get: (obj) => obj.localDiff
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _localText_decorators, {
+				kind: "method",
+				name: "localText",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "localText" in obj,
+					get: (obj) => obj.localText
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _changeRequestDiff_decorators, {
+				kind: "method",
+				name: "changeRequestDiff",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "changeRequestDiff" in obj,
+					get: (obj) => obj.changeRequestDiff
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _changeRequestText_decorators, {
+				kind: "method",
+				name: "changeRequestText",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "changeRequestText" in obj,
+					get: (obj) => obj.changeRequestText
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _markReady_decorators, {
+				kind: "method",
+				name: "markReady",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "markReady" in obj,
+					get: (obj) => obj.markReady
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _merge_decorators, {
+				kind: "method",
+				name: "merge",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "merge" in obj,
+					get: (obj) => obj.merge
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _requestWorktree_decorators, {
+				kind: "method",
+				name: "requestWorktree",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "requestWorktree" in obj,
+					get: (obj) => obj.requestWorktree
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _cancelWorktree_decorators, {
+				kind: "method",
+				name: "cancelWorktree",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "cancelWorktree" in obj,
+					get: (obj) => obj.cancelWorktree
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _stopCreation_decorators, {
+				kind: "method",
+				name: "stopCreation",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "stopCreation" in obj,
+					get: (obj) => obj.stopCreation
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _retryWorktree_decorators, {
+				kind: "method",
+				name: "retryWorktree",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "retryWorktree" in obj,
+					get: (obj) => obj.retryWorktree
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _restoreWorktree_decorators, {
+				kind: "method",
+				name: "restoreWorktree",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "restoreWorktree" in obj,
+					get: (obj) => obj.restoreWorktree
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _continueInProject_decorators, {
+				kind: "method",
+				name: "continueInProject",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "continueInProject" in obj,
+					get: (obj) => obj.continueInProject
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			if (_metadata) Object.defineProperty(this, Symbol.metadata, {
+				enumerable: true,
+				configurable: true,
+				writable: true,
+				value: _metadata
+			});
+		}
+		static inject = [
+			"forge",
+			"forgeSession",
+			"sessionProjections",
+			"workingDirectory",
+			"fs",
+			"subprocess",
+			"sandbox",
+			"sandboxPolicy",
+			"agents"
+		];
+		static Config = z.object({
+			gitCommand: z.string().default("git"),
+			gitTimeoutMs: z.number().default(1e4),
+			graceMs: z.number().default(1e3),
+			maxOutputBytes: z.number().default(1048576),
+			readinessTimeoutMs: z.number().default(15e3),
+			maxBranches: z.number().default(50),
+			worktreePrefix: z.string().default("dsh-"),
+			maxDiffBytes: z.number().default(8388608),
+			maxUntrackedFiles: z.number().default(100),
+			maxCachedDiffBytes: z.number().default(16777216)
+		});
+		home = __runInitializers(this, _instanceExtraInitializers);
+		config;
+		panels = /* @__PURE__ */ new Map();
+		worktreeStates;
+		creations;
+		patches;
+		states;
+		stopPanels;
+		stopStates;
+		constructor(ctx, config) {
+			super(ctx, "forgePanel");
+			const resolved = config;
+			if (resolved.gitCommand.trim().length === 0) throw new Error("forge-panel: gitCommand must not be empty");
+			for (const key of [
+				"gitTimeoutMs",
+				"graceMs",
+				"maxOutputBytes",
+				"readinessTimeoutMs"
+			]) {
+				const value = resolved[key];
+				if (!Number.isSafeInteger(value) || value <= 0 || value > MAX_TIMER_DELAY_MS) throw new Error(`forge-panel: ${key} must be a positive integer no greater than ${MAX_TIMER_DELAY_MS}`);
+			}
+			for (const key of [
+				"maxBranches",
+				"maxDiffBytes",
+				"maxUntrackedFiles",
+				"maxCachedDiffBytes"
+			]) if (!Number.isSafeInteger(resolved[key]) || resolved[key] <= 0) throw new Error(`forge-panel: ${key} must be a positive integer`);
+			if (!branchPrefix(resolved.worktreePrefix)) throw new Error("forge-panel: worktreePrefix must start a valid Git branch name");
+			this.home = ctx;
+			this.config = resolved;
+			this.patches = new PatchCache(resolved.maxCachedDiffBytes);
+			this.stopPanels = ctx.effect(() => async () => {
+				const panels = [...this.panels.values()];
+				this.panels.clear();
+				await Promise.allSettled(panels.map((panel) => panel.dispose()));
+			}, "forge-panel: stop panels");
+			this.stopStates = ctx.effect(() => async () => {
+				await this.states?.dispose();
+			}, "forge-panel: stop change request states");
+		}
+		async [Service.init]() {
+			const ctx = this.home;
+			const stateOwner = ctx.plugin({
+				name: "forge-panel-state",
+				inject: ["sessionProjections"],
+				apply: async (scope) => {
+					this.worktreeStates = await scope.sessionProjections.register(forgeWorktreeProjection);
+				}
+			});
+			await stateOwner;
+			this.creations = new WorktreeCreations(ctx, this.worktreeStates, this.config.worktreePrefix, (session) => {
+				this.panels.get(session)?.updateWorktree();
+			});
+			const inbox = ctx.on("agent/inbox/inserted", ({ agent }) => {
+				this.holdTurn(agent);
+			});
+			const events = ctx.on("session/event", (session, event) => {
+				this.panels.get(session)?.observe(event);
+			});
+			const services = ctx.on("internal/service", (name) => {
+				if (name !== "worktrees") return;
+				for (const panel of this.panels.values()) panel.updateWorktree();
+			});
+			const { creations, stopPanels, stopStates } = this;
+			ctx.effect(function* () {
+				yield stateOwner.dispose;
+				yield inbox;
+				yield events;
+				yield services;
+				yield stopPanels;
+				yield stopStates;
+				yield creations.dispose;
+			}, "forge-panel: drain before releasing state");
+		}
+		/**
+		* Stream the panel state of a Session: the current state first, then each
+		* later state. Intermediate states may be skipped when the reader is slower
+		* than the updates. The stream ends when `signal` aborts or the Remote stops.
+		* @param session - Session to follow.
+		* @param signal - ends the stream.
+		* @returns panel states in publication order.
+		*/
+		async *follow(session, signal) {
+			yield* this.panelOf(session).follow(signal);
+		}
+		/**
+		* Stream the last known state of every change request that a listed
+		* Session the caller may read binds: the stored states first, then each
+		* state a poll changes or a new binding reveals. Listing reads no Session
+		* log: loaded Sessions report their bindings, others the cached Session
+		* summary, and a Session without one shows nothing until it is opened.
+		* Closed requests are polled at the idle cadence so reopening is observed. The
+		* stream ends when `signal` aborts or the Remote stops.
+		* @param signal - ends the stream.
+		* @returns frames in publication order.
+		* @throws when the Host lacks the Session query, projection cache, storage, or Session store service.
+		*/
+		async *changeRequestStates(signal) {
+			const access = this.ctx.get("remoteAccess");
+			yield* this.changeRequestStatesHub().stream((id) => access === void 0 || access.allows({
+				kind: "session",
+				id
+			}), signal);
+		}
+		/**
+		* List the local branches that can start a worktree of the Session's current checkout.
+		* @param session - Session whose current directory is listed.
+		* @param signal - request cancellation.
+		* @returns the checked-out branch and at most `maxBranches` local branches, the checked-out one first.
+		* @throws when the current directory is not inside a checkout or Git fails.
+		*/
+		async branches(session, signal) {
+			return await listBranches(this.home, this.config, session, this.home.workingDirectory.get(session), this.config.maxBranches, signal);
+		}
+		/**
+		* Bind a change request to a Session by URL, or restore a dismissed binding.
+		* @param session - Session that receives the binding.
+		* @param url - web URL of the change request.
+		* @param signal - request cancellation.
+		* @throws `forgePanel/unrecognized-url` when no registered provider serves the URL.
+		*/
+		async track(session, url, signal) {
+			signal.throwIfAborted();
+			if (this.home.forge.changeRequestFromUrl(url) === void 0) throw new RemoteError("forgePanel/unrecognized-url", "No code host provider recognizes the change request URL", {});
+			this.home.forgeSession.track(session, url);
+		}
+		/**
+		* Hide a visible binding of a Session; other URLs leave the Session unchanged.
+		* @param session - Session that owns the binding.
+		* @param url - web URL of the change request.
+		* @param signal - request cancellation.
+		*/
+		async dismiss(session, url, signal) {
+			signal.throwIfAborted();
+			this.home.forgeSession.dismiss(session, url);
+		}
+		/**
+		* Reinspect a followed Session's checkout, probe sign-in again, and poll its
+		* change requests at once; an unfollowed Session is unchanged.
+		* @param session - Session whose panel refreshes.
+		* @param signal - request cancellation.
+		* @returns settles once the inspection and the sign-in probe have ended; poll results reach the panel stream later.
+		*/
+		async refresh(session, signal) {
+			signal.throwIfAborted();
+			await this.panels.get(session)?.refresh();
+		}
+		/**
+		* Read the changes one scope covers in the checkout of the Session's
+		* current directory, with Git confined to the Session's read-only sandbox.
+		* @param session - Session whose checkout is read.
+		* @param scope - which changes to read.
+		* @param signal - request cancellation.
+		* @returns the files, the base of the `branch` scope, and the untracked files left out.
+		* @throws `forgePanel/not-a-checkout` outside a checkout; `forgePanel/no-fork-point` for the `branch`
+		* scope of a checkout without one; `forgePanel/diff-too-large` over `maxDiffBytes`; the Git error when Git fails.
+		*/
+		async localDiff(session, scope, signal) {
+			signal.throwIfAborted();
+			const inspection = await this.checkoutOf(session, signal);
+			const root = inspection.checkout.root;
+			const fork = scope.kind === "branch" ? await forkPoint(gitIn(this.home, this.config, session, root, signal), inspection, this.worktreeState(session).created) : null;
+			return await diffing(localDiff(this.home, this.config, session, root, fork, scope, signal));
+		}
+		/**
+		* Read the new side of one changed file in a scope, which supplies the
+		* unchanged lines between its hunks: the index for `staged`, else the working tree.
+		* @param session - Session whose checkout is read.
+		* @param scope - the scope the diff was read in.
+		* @param path - path relative to the checkout's top-level directory, as the diff names it.
+		* @param signal - request cancellation.
+		* @returns the text.
+		* @throws `forgePanel/not-a-checkout` outside a checkout; `forgePanel/diff-too-large` over `maxDiffBytes`;
+		* an error for a path outside the checkout, binary content, or a failed read.
+		*/
+		async localText(session, scope, path, signal) {
+			signal.throwIfAborted();
+			const inspection = await this.checkoutOf(session, signal);
+			return await diffing(localText(this.home, this.config, session, inspection.checkout.root, scope, path, signal));
+		}
+		/**
+		* Read the changes of a change request of a Session as its code host
+		* computes them, at the head commit of its latest status. A patch already
+		* read at the same head commit and base branch is reused from memory, for
+		* any Session, until `maxCachedDiffBytes` evicts it.
+		* @param session - Session the change request is bound to.
+		* @param url - binding URL of the change request.
+		* @param signal - request cancellation.
+		* @returns the files, the head commit, each file's web page, and the commits the checkout has beyond the head.
+		* @throws `forgePanel/not-bound` unless the URL is a visible binding of the Session that a provider serves;
+		* `forgePanel/diff-too-large` when the host or its provider refuses the diff over a size limit;
+		* `forgePanel/diff-failed` before its status was read and when the host does not provide the diff otherwise.
+		*/
+		async changeRequestDiff(session, url, signal) {
+			signal.throwIfAborted();
+			const { ref, update } = this.bound(session, url);
+			if (update === null || !("snapshot" in update)) throw new RemoteError("forgePanel/diff-failed", "The change request status has not been read yet", {});
+			const { headSha, headBranch, baseBranch } = update.snapshot;
+			const key = changeRequestKey(ref);
+			const version = JSON.stringify([headSha, baseBranch]);
+			let patch = this.patches.get(key, version);
+			if (patch === void 0) {
+				const read = await this.home.forge.diff(ref, signal);
+				if (typeof read !== "string") throw readError(read);
+				this.patches.set(key, version, read);
+				patch = read;
+			}
+			const files = parseDiff(patch);
+			let localAhead = null;
+			try {
+				localAhead = await aheadOf(gitIn(this.home, this.config, session, this.home.workingDirectory.get(session), signal), headBranch, headSha);
+			} catch (_error) {}
+			signal.throwIfAborted();
+			const fileUrls = Object.fromEntries(files.map((file) => [file.path, this.home.forge.fileUrl(ref, headSha, file.path)]));
+			return {
+				headSha,
+				files,
+				localAhead,
+				fileUrls
+			};
+		}
+		/**
+		* Read one file of a change request's repository at a commit, which
+		* supplies the unchanged lines between the hunks of its diff.
+		* @param session - Session the change request is bound to.
+		* @param url - binding URL of the change request.
+		* @param commit - commit object name, the head commit of the diff.
+		* @param path - path relative to the repository root.
+		* @param signal - request cancellation.
+		* @returns the text.
+		* @throws `forgePanel/not-bound` unless the URL is a visible binding of the Session that a provider serves;
+		* `forgePanel/diff-too-large` when the host or its provider refuses the file over a size limit;
+		* `forgePanel/diff-failed` when the host does not provide the file otherwise.
+		*/
+		async changeRequestText(session, url, commit, path, signal) {
+			signal.throwIfAborted();
+			const text = await this.home.forge.fileText(this.bound(session, url).ref, commit, path, signal);
+			if (typeof text !== "string") throw readError(text);
+			return text;
+		}
+		/**
+		* Mark a draft change request of a Session ready for review; the change
+		* request is polled again once the host answers.
+		* @param session - Session the change request is bound to.
+		* @param url - binding URL of the change request.
+		* @param signal - request cancellation.
+		* @throws `forgePanel/not-bound` unless the URL is a visible binding of the Session that a provider serves;
+		* `forgePanel/action-failed` with the host's reason when the host refuses or cannot be reached.
+		*/
+		async markReady(session, url, signal) {
+			signal.throwIfAborted();
+			const failure = await this.home.forge.markReady(this.bound(session, url).ref, signal);
+			if (failure !== void 0) throw actionError(failure);
+		}
+		/**
+		* Merge a change request of a Session while its head is still `headSha`;
+		* the change request is polled again once the host answers.
+		* @param session - Session the change request is bound to.
+		* @param url - binding URL of the change request.
+		* @param method - how the commits enter the base branch.
+		* @param headSha - head commit the user confirmed.
+		* @param signal - request cancellation.
+		* @throws `forgePanel/not-bound` unless the URL is a visible binding of the Session that a provider serves;
+		* `forgePanel/stale-head` when the head moved past `headSha`; `forgePanel/action-failed` with the host's
+		* reason when the host refuses otherwise or cannot be reached.
+		*/
+		async merge(session, url, method, headSha, signal) {
+			signal.throwIfAborted();
+			const failure = await this.home.forge.merge(this.bound(session, url).ref, {
+				method,
+				headSha
+			}, signal);
+			if (failure !== void 0) throw actionError(failure);
+		}
+		/**
+		* Ask for a new worktree before the Session's first turn, replacing an open
+		* request and forgetting a failed attempt. While the next message waits in
+		* the inbox, or else at the first step proposal, the panel creates a branch
+		* from `from`, or from HEAD of the current checkout when it is null, and
+		* enters its checkout. A message that already waits after a failed or
+		* stopped attempt keeps waiting for {@link ForgePanelController.retryWorktree}.
+		* @param session - Session without a started turn.
+		* @param from - local base branch, or null for HEAD.
+		* @param signal - request cancellation.
+		* @throws `forgePanel/invalid-branch` when `from` is empty; `forgePanel/worktrees-unavailable`
+		* without a worktree service; `forgePanel/session-started` after a turn started or the worktree was
+		* created; `forgePanel/session-busy` while the worktree is being created.
+		*/
+		async requestWorktree(session, from, signal) {
+			signal.throwIfAborted();
+			if (from?.length === 0) throw new RemoteError("forgePanel/invalid-branch", "The base branch name is empty", {});
+			this.editableWorktree(session);
+			this.creations.forget(session);
+			appendPluginRecord(session, WORKTREE_RECORD, {
+				action: "request",
+				from
+			});
+			this.creations.recheck(session);
+		}
+		/**
+		* Withdraw the open worktree request of a Session with its failed attempt,
+		* which lets a waiting message go on in the current checkout; without a
+		* request the Session is unchanged. Withdrawing needs no worktree service.
+		* @param session - Session without a started turn.
+		* @param signal - request cancellation.
+		* @throws `forgePanel/session-started` after a turn started or the worktree was created;
+		* `forgePanel/session-busy` while the worktree is being created.
+		*/
+		async cancelWorktree(session, signal) {
+			signal.throwIfAborted();
+			if (this.changeableWorktree(session).request === null) return;
+			this.creations.forget(session);
+			appendPluginRecord(session, WORKTREE_RECORD, { action: "cancel" });
+			this.creations.recheck(session);
+		}
+		/**
+		* Stop the creation a message of the Session waits for; the message keeps
+		* waiting with the request still open. Without such a creation the Session
+		* is unchanged.
+		* @param session - Session whose creation stops.
+		* @param signal - request cancellation.
+		*/
+		async stopCreation(session, signal) {
+			signal.throwIfAborted();
+			this.creations.stop(session);
+		}
+		/**
+		* Make another attempt, with a new branch name, at the worktree a message
+		* of the Session waits for after a failed or stopped attempt.
+		* @param session - Session whose message waits.
+		* @param signal - request cancellation.
+		* @throws `forgePanel/not-waiting` when no message waits or an attempt is running.
+		*/
+		async retryWorktree(session, signal) {
+			signal.throwIfAborted();
+			if (!this.creations.retry(session)) throw new RemoteError("forgePanel/not-waiting", "No message waits for another attempt at the worktree", {});
+		}
+		/**
+		* Check out the created worktree of a Session again at its recorded
+		* directory when that directory is gone: its branch when the branch still
+		* exists, otherwise a new branch of the same name at the base commit. Changes
+		* that were never committed are not recovered. Runs as Agent maintenance,
+		* inside the wait of a message that waits for the restoration, which then
+		* goes on; without a missing directory the Session is unchanged.
+		* @param session - Session whose worktree directory is gone.
+		* @param signal - request cancellation, which aborts the restoration.
+		* @throws `forgePanel/no-worktree` without a created worktree; `forgePanel/worktrees-unavailable`
+		* without a worktree service; `forgePanel/session-busy` while the Session's Agent is not loaded or
+		* has other work; `forgePanel/restore-failed` when Git fails.
+		*/
+		async restoreWorktree(session, signal) {
+			signal.throwIfAborted();
+			const created = this.createdWorktree(session);
+			const worktrees = this.home.get("worktrees");
+			if (worktrees === void 0) throw new RemoteError("forgePanel/worktrees-unavailable", "No worktree service is mounted", {});
+			await this.maintain(session, async (agent, work) => {
+				const operation = AbortSignal.any([signal, work]);
+				try {
+					await this.creations.restore(agent, worktrees, created, operation, () => {
+						this.panels.get(session)?.restored();
+					}, async (check) => await missingWorktree(this.home, this.config, session, this.worktreeState(session), created.path, check) === null);
+				} catch (error) {
+					operation.throwIfAborted();
+					throw new RemoteError("forgePanel/restore-failed", messageOf(error), {}, { cause: error });
+				}
+			});
+			this.panels.get(session)?.reinspect();
+		}
+		/**
+		* Move a Session from its created worktree to the source checkout the
+		* worktree came from; the Session no longer works in the worktree. Runs as
+		* Agent maintenance, inside the wait of a message that waits for the removed
+		* worktree, which then goes on.
+		* @param session - Session with a created worktree.
+		* @param signal - request cancellation.
+		* @throws `forgePanel/no-worktree` without a created worktree; `forgePanel/session-busy` while the
+		* Session's Agent is not loaded or has other work; the working-directory service's error when the
+		* source checkout no longer exists.
+		*/
+		async continueInProject(session, signal) {
+			signal.throwIfAborted();
+			const created = this.createdWorktree(session);
+			await this.maintain(session, async (agent, work) => {
+				await this.home.workingDirectory.set(agent, created.repositoryRoot, AbortSignal.any([signal, work]));
+			});
+		}
+		/**
+		* Hold the turn of a message entering a Session's inbox while the
+		* Session's requested worktree does not exist yet, or while the worktree
+		* the Session works in is checked and, when gone, until it is restored or
+		* left. The message is entering, so the delivery has not woken the Agent
+		* yet and its wake waits for the hold.
+		* @param agent - Agent whose inbox receives the message.
+		*/
+		holdTurn(agent) {
+			const session = agent.session;
+			const state = this.worktreeState(session);
+			if (state.request !== null && state.created === null && !state.locked) this.creations.holdCreation(agent);
+			else if (state.created !== null && within(state.created.path, this.home.workingDirectory.get(session))) this.creations.holdRestoration(agent, (signal) => this.missingFor(session, signal));
+		}
+		/**
+		* Check whether the worktree the Session works in is gone.
+		* @param session - Session to check.
+		* @param signal - cancellation of the check.
+		* @returns the missing worktree, or null while it exists or once the Session works elsewhere.
+		* @throws when the filesystem or Git cannot answer.
+		*/
+		async missingFor(session, signal) {
+			const directory = this.home.workingDirectory.get(session);
+			const panel = this.panels.get(session);
+			const missing = panel === void 0 ? await missingWorktree(this.home, this.config, session, this.worktreeState(session), directory, signal) : await panel.checkMissing(signal);
+			return this.home.workingDirectory.get(session) === directory ? missing : null;
+		}
+		/** Inspect the checkout of the Session's current directory, which local diffs read. */
+		async checkoutOf(session, signal) {
+			const inspection = await inspectCheckout(this.home, this.config, session, this.home.workingDirectory.get(session), signal);
+			if (inspection === void 0) throw new RemoteError("forgePanel/not-a-checkout", "The Session's directory is not inside a Git checkout", {});
+			return inspection;
+		}
+		/** A visible binding of the Session that a provider serves, which actions and reads are limited to. */
+		bound(session, url) {
+			const entry = this.home.forgeSession.changeRequests(session).find((candidate) => candidate.url === url);
+			if (entry?.ref == null) throw new RemoteError("forgePanel/not-bound", "The change request is not bound to this Session or no provider serves it", {});
+			return {
+				...entry,
+				ref: entry.ref
+			};
+		}
+		worktreeState(session) {
+			return this.worktreeStates.stateOf(session);
+		}
+		editableWorktree(session) {
+			if (this.home.get("worktrees") === void 0) throw new RemoteError("forgePanel/worktrees-unavailable", "No worktree service is mounted", {});
+			return this.changeableWorktree(session);
+		}
+		/** The worktree state of a Session whose request may still change: no turn started, nothing created, and no attempt running. */
+		changeableWorktree(session) {
+			const state = this.worktreeState(session);
+			if (state.locked || state.created !== null) throw new RemoteError("forgePanel/session-started", "The Session has started, so its worktree can no longer change", {});
+			if (this.creations.of(session) !== null) throw new RemoteError("forgePanel/session-busy", "The worktree is being created", {});
+			return state;
+		}
+		createdWorktree(session) {
+			const created = this.worktreeState(session).created;
+			if (created === null) throw new RemoteError("forgePanel/no-worktree", "The Session has no created worktree", {});
+			return created;
+		}
+		/**
+		* Run work as maintenance of the Session's Agent: inside the wait of a
+		* message that waits for the removed worktree, else as a task of its own,
+		* which the Agent refuses while it has other work.
+		*/
+		async maintain(session, work) {
+			const held = this.creations.within(session, work);
+			if (held !== void 0) {
+				await held;
+				return;
+			}
+			const agent = this.home.agents.get(session.id);
+			if (agent === void 0) throw new RemoteError("forgePanel/session-busy", "The Session is not loaded", {});
+			let running;
+			try {
+				running = agent.runMaintenance(async (signal) => {
+					await work(agent, signal);
+				});
+			} catch (error) {
+				throw new RemoteError("forgePanel/session-busy", "The Session is busy", {}, { cause: error });
+			}
+			await running;
+		}
+		/** The shared change request states, created for the first stream from the Host's Session and storage services. */
+		changeRequestStatesHub() {
+			if (this.states !== void 0) return this.states;
+			const ctx = this.home;
+			const query = ctx.get("sessionQuery");
+			const cache = ctx.get("sessionProjectionCache");
+			const storage = ctx.get("storageDomain");
+			const store = ctx.get("sessions");
+			if (query === void 0 || cache === void 0 || storage === void 0 || store === void 0) throw new Error("forge-panel: change request states need the sessionQuery, sessionProjectionCache, storageDomain, and sessions services");
+			const visibleUrls = (session) => ctx.forgeSession.changeRequests(session).map((entry) => entry.url);
+			this.states = new ChangeRequestStates({
+				sessions: async (signal) => (await query.listSessions(signal)).map(({ header }) => {
+					const live = store.get(header.id);
+					if (live !== void 0) return {
+						id: header.id,
+						urls: visibleUrls(live)
+					};
+					const bindings = cache.cachedSnapshot(header, ["forgeChangeRequests"])?.values.forgeChangeRequests;
+					return {
+						id: header.id,
+						urls: bindings?.filter((binding) => !binding.dismissed).map((binding) => binding.url)
+					};
+				}),
+				onBindings: (listener) => ctx.sessionProjections.onChanged((session, key) => {
+					if (key === "forgeChangeRequests") listener(session.id, visibleUrls(session));
+				}),
+				refOf: (url) => ctx.forge.changeRequestFromUrl(url),
+				watch: (ref, listener) => ctx.forge.watch(ref, listener),
+				open: async () => (await storage.open(changeRequestStatesDomain)).table("states"),
+				report: (error) => {
+					ctx.logger.warn(`forge-panel: storing a change request state failed: ${String(error)}`);
+				}
+			});
+			return this.states;
+		}
+		panelOf(session) {
+			let panel = this.panels.get(session);
+			if (panel === void 0) {
+				const created = new SessionPanel(this.home, this.config, session, this.worktreeStates, this.creations, () => {
+					if (this.panels.get(session) !== created) return;
+					this.panels.delete(session);
+					created.dispose();
+				});
+				panel = created;
+				this.panels.set(session, panel);
+			}
+			return panel;
+		}
+	};
+})();
+/**
+* Report why the code host did not provide a diff or file.
+* @param failure - the provider's failure.
+* @returns `forgePanel/diff-too-large` for an answer over a size limit, else `forgePanel/diff-failed`, with the provider's message.
+*/
+function readError(failure) {
+	return new RemoteError(failure.code === "too-large" ? "forgePanel/diff-too-large" : "forgePanel/diff-failed", failure.message, {});
+}
+/**
+* Settle a diff read, reporting its size limit and a missing fork point as Remote errors.
+* @param reading - the read.
+* @returns what the read returned.
+*/
+async function diffing(reading) {
+	try {
+		return await reading;
+	} catch (error) {
+		if (error instanceof DiffTooLarge) throw new RemoteError("forgePanel/diff-too-large", error.message, {}, { cause: error });
+		if (error instanceof NoForkPoint) throw new RemoteError("forgePanel/no-fork-point", error.message, {}, { cause: error });
+		throw error;
+	}
+}
+/**
+* Report a failed change request action, separating a head that moved since the user confirmed it.
+* @param failure - the provider's failure.
+* @returns the Remote error to throw.
+*/
+function actionError(failure) {
+	return new RemoteError(failure.code === "stale" ? "forgePanel/stale-head" : "forgePanel/action-failed", failure.message, {});
+}
+/**
+* Whether `prefix` followed by hexadecimal digits is a branch name that Git
+* accepts: no leading `-` or `/`, no empty component, no component that
+* starts with `.` or ends with `.lock`, and none of `..`, `@{`, whitespace,
+* control characters, `~`, `^`, `:`, `?`, `*`, `[`, or `\`.
+* @param prefix - configured worktree branch prefix.
+* @returns whether every generated name passes `git check-ref-format --branch`.
+*/
+function branchPrefix(prefix) {
+	const name = `${prefix}0`;
+	if (name.startsWith("-") || name.includes("..") || name.includes("@{")) return false;
+	for (const char of name) if (char <= " " || char === "" || "~^:?*[\\".includes(char)) return false;
+	return name.split("/").every((part) => part.length > 0 && !part.startsWith(".") && !part.endsWith(".lock"));
+}
+//#endregion
+export { ForgePanelController, ForgePanelController as default };