@dev.fast/whiteboard 0.0.0-stage → 0.2.0

package/dist/process-error-telemetry-v9e5h6D7.js

@@ -0,0 +1,3952 @@
+import { c as jsonString, n as isJsonObject, u as parseJsonText } from "./src-X9phtB2j.js";
+import { a as sharedReviewId, c as verifyShareRepository, d as StreamLimitError, f as readBoundedStream, l as exportShare, m as shareIdSchema, n as ShareClient, p as parseShareLink, r as SharePreflightError, s as readShareRepository, t as ShareAuthError, u as validateShareSources } from "./client-DFoh50W3.js";
+import { d as REVIEW_CLIENT_REMOTE, i as parseReviewVerbRequest, r as parseReviewDesktopVerbResult, u as REVIEW_CLIENT_HEADER } from "./src-DnwdaQ2r.js";
+import { C as TraceStorageDeniedError, G as readStoreAuth, H as DEFAULT_STORE_ORIGIN, U as clearStoreAuth, W as openUrlInBrowser, _ as isTraceStorageConfigured, b as selectTraceStorage, o as listReviewTraceSessions, q as runStoreLogin, s as loadReviewAgentTrace, y as resolveTraceStorage } from "./review-agent-traces-DNJFYzc8.js";
+import { a as inspectSnapshot, c as askAgentIds, d as askQuestionSchema, f as AgentSelectionSchema, i as commandSchema, l as askChoiceKinds, p as selectionMarkdown, r as SCRATCHPAD_ID, s as applyAskChange, u as askPicksSchema } from "./local-data-CxLk75rx.js";
+import { $ as unionIntervals, G as selectionKey, H as comparisonKey, I as fileLineRangeSchema, J as coverageSources, N as lensSelections, Q as subtractIntervals, T as selectionReferences, U as formatAnchor, V as anchorSelection, W as resolveDiffSelection, Y as emptyCoverage, Z as scopedCoverage, h as elements, k as UNCATEGORIZED_LENS_ID, u as anchorPins } from "./stored-document-migration-DHeMpLMb.js";
+import { t as ReviewInputError } from "./input-error-OLgB_h31.js";
+import { A as devReviewHome, h as TraceConfigurationError, i as isS3MockMode } from "./s3-config-CAxhO9u_.js";
+import { t as errorMessage } from "./error-message-OtiDonty.js";
+import { T as traceMachineEnabled } from "./review-home-paths-6zZH-1c9.js";
+import { i as readReviewPackageVersion, n as readBuildCommit } from "./package-paths-B6-zxvIO.js";
+import { a as REVIEW_APP_SESSION_ID_HEADER, c as sanitizeUiTelemetryEvent, i as BUNDLE_FRAME_PATTERN, l as cleanTelemetryText, r as reviewRequestOrigin, s as isReportableCleanedMessage } from "./request-origin-D_4QIdoN.js";
+import { a as scratchpadAvailable, c as readQuerySchemas, i as renderInstructions, o as inspectQuerySchema, r as instructionsQuerySchema, s as queryAnchor, t as authoringTools } from "./authoring-tools-Cr6Kpjsx.js";
+import { t as fuzzyRank } from "./fuzzy-match-BoAmcyak.js";
+import { createRequire } from "node:module";
+import crypto$1, { createHash, randomUUID } from "node:crypto";
+import { z } from "zod";
+import { constants, mkdirSync, writeFileSync } from "node:fs";
+import { access, chmod, mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import path, { posix } from "node:path";
+import { homedir } from "node:os";
+import { execFile, spawn } from "node:child_process";
+import { promisify } from "node:util";
+import { pathToFileURL } from "node:url";
+import { Readable, Writable } from "node:stream";
+import { getRequestListener } from "@hono/node-server";
+import { Hono } from "hono";
+import { PROTOCOL_VERSION, RequestError, client, methods, ndJsonStream } from "@agentclientprotocol/sdk";
+import { streamSSE } from "hono/streaming";
+//#region src/server/global-verb-relay.ts
+const DEFAULT_VERB_TIMEOUT_MS = 45e3;
+const DEFAULT_MAX_CLIENTS = 16;
+const NOT_ATTACHED = "No Whiteboard Desktop is attached.";
+/**
+* Sends each verb to every attached client, each with its own frame id, and
+* resolves with the first success, or with the last failure once no client
+* is left to answer.
+*/
+var GlobalReviewDesktopVerbRelay = class {
+	clients = /* @__PURE__ */ new Map();
+	/** Each verb in flight, under every frame id it was sent with. */
+	pending = /* @__PURE__ */ new Map();
+	timeoutMs;
+	maxClients;
+	constructor(options = {}) {
+		this.timeoutMs = options.timeoutMs ?? DEFAULT_VERB_TIMEOUT_MS;
+		this.maxClients = options.maxClients ?? DEFAULT_MAX_CLIENTS;
+	}
+	get attached() {
+		return this.clients.size > 0;
+	}
+	attach(writer) {
+		if (this.clients.size >= this.maxClients || this.clients.has(writer) || writer.signal.aborted) return false;
+		const detach = () => this.detach(writer);
+		this.clients.set(writer, detach);
+		writer.signal.addEventListener("abort", detach, { once: true });
+		return true;
+	}
+	dispatch(value) {
+		const request = parseReviewVerbRequest(value);
+		if (this.clients.size === 0) return Promise.resolve({
+			ok: false,
+			error: NOT_ATTACHED
+		});
+		return new Promise((resolve) => {
+			const verb = {
+				resolve,
+				waiting: new Map([...this.clients.keys()].map((client) => [crypto$1.randomUUID(), client])),
+				timer: setTimeout(() => this.settle(verb, verb.lastFailure ?? {
+					ok: false,
+					error: "Whiteboard Desktop verb timed out."
+				}), this.timeoutMs)
+			};
+			verb.timer.unref?.();
+			for (const id of verb.waiting.keys()) this.pending.set(id, verb);
+			for (const [id, client] of [...verb.waiting]) {
+				const frame = `data: ${JSON.stringify({
+					event: "desktop-verb",
+					id,
+					request
+				})}\n\n`;
+				try {
+					Promise.resolve(client.write(frame)).catch(() => {
+						this.detach(client);
+					});
+				} catch {
+					this.detach(client);
+				}
+			}
+		});
+	}
+	acceptResult(value) {
+		const result = parseReviewDesktopVerbResult(value);
+		const verb = this.pending.get(result.id);
+		if (!verb) return false;
+		if (result.response.ok) this.settle(verb, result.response);
+		else {
+			verb.lastFailure = result.response;
+			this.stopWaiting(verb, result.id);
+		}
+		return true;
+	}
+	close() {
+		for (const verb of new Set(this.pending.values())) this.settle(verb, {
+			ok: false,
+			error: "Whiteboard Desktop relay closed."
+		});
+		for (const client of [...this.clients.keys()]) {
+			this.detach(client);
+			try {
+				Promise.resolve(client.close()).catch(() => void 0);
+			} catch {}
+		}
+	}
+	detach(writer) {
+		const listener = this.clients.get(writer);
+		if (!listener) return;
+		writer.signal.removeEventListener("abort", listener);
+		this.clients.delete(writer);
+		for (const [id, verb] of [...this.pending]) if (verb.waiting.get(id) === writer) this.stopWaiting(verb, id);
+	}
+	/** Drops one client's id; with nobody left to answer, the verb fails. */
+	stopWaiting(verb, id) {
+		verb.waiting.delete(id);
+		this.pending.delete(id);
+		if (verb.waiting.size === 0) this.settle(verb, verb.lastFailure ?? {
+			ok: false,
+			error: NOT_ATTACHED
+		});
+	}
+	settle(verb, response) {
+		for (const id of verb.waiting.keys()) this.pending.delete(id);
+		verb.waiting.clear();
+		clearTimeout(verb.timer);
+		verb.resolve(response);
+	}
+};
+//#endregion
+//#region src/server/http-json.ts
+const DEFAULT_MAX_REQUEST_BYTES = 1048576;
+var HttpJsonError = class extends Error {
+	statusCode;
+	constructor(message, statusCode) {
+		super(message);
+		this.statusCode = statusCode;
+		this.name = "HttpJsonError";
+	}
+};
+/** An error whose status and machine code the JSON routes hand straight back. */
+var ReviewServerError = class extends Error {
+	statusCode;
+	code;
+	name = "ReviewServerError";
+	constructor(message, statusCode, code) {
+		super(message);
+		this.statusCode = statusCode;
+		this.code = code;
+	}
+};
+//#endregion
+//#region src/server/hono-http.ts
+function createNodeRequestListener(app) {
+	return getRequestListener(app.fetch);
+}
+function jsonResponse(body, status, options = {}) {
+	const headers = new Headers({ "content-type": options.contentType ?? "application/json; charset=utf-8" });
+	if (options.cacheControl) headers.set("cache-control", options.cacheControl);
+	const serialized = JSON.stringify(body);
+	return new Response(options.newline === false ? serialized : `${serialized}\n`, {
+		status,
+		headers
+	});
+}
+function applyCorsHeaders(request, response) {
+	const origin = request.headers.get("origin");
+	if (origin) {
+		response.headers.set("access-control-allow-origin", origin);
+		const vary = response.headers.get("vary");
+		const varyFields = vary?.split(",").map((field) => field.trim().toLowerCase());
+		if (!varyFields?.includes("*") && !varyFields?.includes("origin")) response.headers.set("vary", vary ? `${vary}, Origin` : "Origin");
+	}
+	response.headers.set("access-control-allow-headers", `content-type, x-review-token, ${REVIEW_APP_SESSION_ID_HEADER}`);
+	response.headers.set("access-control-allow-methods", "GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS");
+	response.headers.set("access-control-allow-private-network", "true");
+	return response;
+}
+function corsPreflightResponse(request) {
+	return applyCorsHeaders(request, new Response(null, { status: 204 }));
+}
+function isAuthorizedRequest(request, expectedToken) {
+	const supplied = request.headers.get("x-review-token") ?? new URL(request.url).searchParams.get("token");
+	if (!supplied) return false;
+	const expected = Buffer.from(expectedToken);
+	const actual = Buffer.from(supplied);
+	return expected.length === actual.length && crypto$1.timingSafeEqual(expected, actual);
+}
+async function readBoundedRequestJson(request, maxBytes = DEFAULT_MAX_REQUEST_BYTES, emptyValue, options = {}) {
+	assertJsonContentType(request, options);
+	const contentLength = Number(request.headers.get("content-length"));
+	if (Number.isFinite(contentLength) && contentLength > maxBytes) throw requestTooLarge(maxBytes);
+	let body;
+	try {
+		body = request.body ? (await readBoundedStream(request.body, maxBytes)).toString("utf8") : "";
+	} catch (error) {
+		if (error instanceof StreamLimitError) throw requestTooLarge(maxBytes);
+		throw error;
+	}
+	if (!body && emptyValue !== void 0) return emptyValue;
+	try {
+		return parseJsonText(body);
+	} catch {
+		throw new HttpJsonError("Invalid JSON body.", 400);
+	}
+}
+function assertJsonContentType(request, options) {
+	const mediaType = request.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+	if (mediaType !== "application/json" && !mediaType?.endsWith("+json") && !(options.allowTextPlain && mediaType === "text/plain")) throw new HttpJsonError("Content-Type must be application/json.", 415);
+}
+function requestTooLarge(maxBytes) {
+	return new HttpJsonError(`Request body exceeds ${maxBytes === 1048576 ? "1 MiB" : `${maxBytes} bytes`}.`, 413);
+}
+//#endregion
+//#region src/error-telemetry.ts
+/**
+* Errors whose message quotes the document being checked. A review tool runs
+* authored prose through schemas, so these carry review content by design —
+* unlike an editor, which mostly reports on files. Keep the class, the digest
+* and the frames; drop the message. VS Code drops file-operation errors and
+* errors carrying a system code for the same reason.
+*/
+const SCHEMA_ERROR_NAMES = /* @__PURE__ */ new Set(["ZodError", "ValidationError"]);
+const MESSAGE_HASH_LENGTH = 16;
+const MAX_FRAMES = 10;
+const MAX_STACK_LENGTH = 16384;
+const MAX_ERROR_NAME_LENGTH = 40;
+const ERROR_NAME_PATTERN = /^[A-Za-z0-9_$-]+$/;
+/**
+* Path segments that exist only inside the shipped bundle. A frame keeps the
+* text that follows the LAST occurrence of one of these and discards everything
+* before it, which is what removes the absolute prefix. A frame with no such
+* segment is not ours, so it is dropped.
+*/
+const BUNDLE_ANCHORS = [
+	"/out/",
+	"/assets/",
+	"/review-runtime/"
+];
+/** `at fn (url:line:col)`, `at url:line:col`, and the bare `url:line:col`. */
+const STACK_FRAME_PATTERN = /(?:\(|\bat\s+|^\s*)([^()\s]+?):(\d+):(\d+)\)?\s*$/;
+/**
+* `cause` is the raw error envelope a client attached beside its event
+* properties: `{ name, message, stack }` as JSON, or anything else a hostile
+* client sent, which derives nothing.
+*/
+function deriveErrorTelemetryProperties(cause) {
+	const derived = {};
+	try {
+		if (!isJsonObject(cause)) return derived;
+		const name = jsonString(cause.name);
+		if (name !== void 0 && name.length > 0 && name.length <= MAX_ERROR_NAME_LENGTH && ERROR_NAME_PATTERN.test(name)) derived.error_name = name;
+		const message = jsonString(cause.message);
+		if (message !== void 0 && message.length > 0) {
+			derived.message_hash = hashErrorMessage(message);
+			if (!SCHEMA_ERROR_NAMES.has(derived.error_name ?? "")) {
+				const cleaned = cleanTelemetryText(message, NO_DELETED_DIRECTORIES);
+				if (isReportableCleanedMessage(cleaned)) derived.message = cleaned;
+			}
+		}
+		const frames = packBundleFrames(cause.stack);
+		if (frames) derived.frames = frames;
+	} catch {}
+	return derived;
+}
+/**
+* Properties only this module may produce, because each is a claim about work
+* the server did that the allowlist cannot check for itself: whether a message
+* was cleaned, and whether a digest or a frame list really came from this
+* error. A client that sent one directly would reach the allowlist with no
+* cleaning behind it.
+*
+* `error_name` is deliberately absent. The allowlist caps it at 40 identifier
+* characters, which makes it safe whoever sends it, and `bug_report_send_failed`
+* sends it with no error envelope.
+*/
+const SERVER_DERIVED_PROPERTIES = [
+	"message",
+	"message_hash",
+	"frames"
+];
+/**
+* Merge a client's event properties with the ones derived from its raw error.
+* This is the only supported way to build an error-bearing telemetry payload:
+* it removes any server-derived property the client tried to assert before
+* adding the real ones.
+*/
+function mergeErrorTelemetryProperties(clientProperties, cause) {
+	const merged = { ...clientProperties };
+	for (const key of SERVER_DERIVED_PROPERTIES) delete merged[key];
+	if (cause) Object.assign(merged, deriveErrorTelemetryProperties(cause));
+	return merged;
+}
+/**
+* Review deliberately gives the cleaner NO directories to delete, which is the
+* one place its configuration differs from VS Code's.
+*
+* VS Code passes five — its app root, extensions path, user data path, home
+* directory and temporary directory — and deletes each prefix outright so the
+* remainder reads as a relative path. That is right for a stack trace, where
+* the remainder is VS Code's own file. It is wrong here: a path under the home
+* directory then keeps everything after it, so
+* `/Users/you/work/acme-repo/plan.md` would be sent as
+* `/work/acme-repo/plan.md` — the repository name intact. A review tool cannot
+* disclose that.
+*
+* With no directories to delete, the cleaner's overlap check never fires and
+* the whole path is replaced by a marker instead, which is what we want. Frames
+* are unaffected: they are anchored on the bundle directory separately.
+*/
+const NO_DELETED_DIRECTORIES = [];
+/**
+* A stable fingerprint of the message. Two reports with the same digest had the
+* same cause; the digest itself reveals nothing, because it is one-way and the
+* message is never sent alongside it.
+*/
+function hashErrorMessage(message) {
+	return createHash("sha256").update(message, "utf8").digest("hex").slice(0, MESSAGE_HASH_LENGTH);
+}
+/**
+* Rewrite a stack into bundle-relative `file:line:col` frames joined by "|".
+* Returns undefined when no frame resolves inside the bundle.
+*/
+function packBundleFrames(stack) {
+	const text = Array.isArray(stack) ? stack.join("\n") : jsonString(stack);
+	if (!text) return void 0;
+	const frames = [];
+	for (const line of text.slice(0, MAX_STACK_LENGTH).split("\n")) {
+		const match = STACK_FRAME_PATTERN.exec(line);
+		if (!match) continue;
+		const file = bundleRelativePath(match[1]);
+		if (!file) continue;
+		const frame = `${file}:${match[2]}:${match[3]}`;
+		if (!BUNDLE_FRAME_PATTERN.test(frame)) continue;
+		frames.push(frame);
+		if (frames.length >= MAX_FRAMES) break;
+	}
+	return frames.length > 0 ? frames.join("|") : void 0;
+}
+function bundleRelativePath(location) {
+	const clean = location.split(/[?#]/, 1)[0];
+	let cut = -1;
+	let anchorLength = 0;
+	for (const anchor of BUNDLE_ANCHORS) {
+		const index = clean.lastIndexOf(anchor);
+		if (index > cut) {
+			cut = index;
+			anchorLength = anchor.length;
+		}
+	}
+	if (cut < 0) return void 0;
+	const relative = clean.slice(cut + anchorLength);
+	const prefix = clean.slice(cut + 1, cut + anchorLength);
+	const path = prefix === "out/" ? relative : `${prefix}${relative}`;
+	return path.length > 0 ? path : void 0;
+}
+const BURST_EVERY = 100;
+const DEFAULT_MAX_KEYS = 1e3;
+var ClientErrorBudget = class {
+	maxKeys;
+	counts = /* @__PURE__ */ new Map();
+	constructor(maxKeys = DEFAULT_MAX_KEYS) {
+		this.maxKeys = maxKeys;
+	}
+	admit(sessionId, messageHash) {
+		const key = `${sessionId}\n${messageHash}`;
+		const count = (this.counts.get(key) ?? 0) + 1;
+		this.counts.delete(key);
+		this.counts.set(key, count);
+		while (this.counts.size > this.maxKeys) {
+			const oldest = this.counts.keys().next().value;
+			if (oldest === void 0) break;
+			this.counts.delete(oldest);
+		}
+		const suppressed = Math.max(0, count - 5);
+		if (suppressed === 0) return {
+			verdict: "send",
+			suppressed
+		};
+		return {
+			verdict: suppressed === 1 || suppressed % BURST_EVERY === 0 ? "burst" : "drop",
+			suppressed
+		};
+	}
+};
+//#endregion
+//#region src/server/ui-telemetry.ts
+const contextSchema = z.object({
+	reviewUuid: z.string().min(1).max(128).optional(),
+	presentationSessionId: z.string().min(1).max(128).optional()
+});
+const clientErrorBudget = new ClientErrorBudget();
+/**
+* Applies the per-session, per-digest error budget to a sanitized event, and
+* returns what to send in its place: the event itself, one
+* review_error_burst that says how many were withheld, or nothing. Every path
+* that reports review_client_error goes through here. Other events, and errors
+* without a session or a digest, pass unchanged.
+*/
+function admitUiTelemetryEvent(event) {
+	if (event.event !== "review_client_error") return event;
+	const sessionId = jsonString(event.properties.app_session_id);
+	const messageHash = jsonString(event.properties.message_hash);
+	if (sessionId === void 0 || messageHash === void 0) return event;
+	const admission = clientErrorBudget.admit(sessionId, messageHash);
+	if (admission.verdict === "send") return event;
+	if (admission.verdict === "drop") return void 0;
+	return sanitizeUiTelemetryEvent({
+		name: "error_burst",
+		properties: {
+			message_hash: messageHash,
+			suppressed: admission.suppressed,
+			app_session_id: sessionId
+		}
+	}) ?? void 0;
+}
+const MAX_CLIENT_ERROR_SESSIONS = 100;
+const MAX_CLIENT_ERRORS_PER_SESSION = 20;
+const clientErrorsBySession = /* @__PURE__ */ new Map();
+function recordClientError(event) {
+	if (event?.event !== "review_client_error") return;
+	const sessionId = jsonString(event.properties.app_session_id);
+	const errorName = jsonString(event.properties.error_name);
+	if (sessionId === void 0 || errorName === void 0) return;
+	const names = clientErrorsBySession.get(sessionId) ?? [];
+	names.push(errorName);
+	if (names.length > MAX_CLIENT_ERRORS_PER_SESSION) names.shift();
+	clientErrorsBySession.delete(sessionId);
+	clientErrorsBySession.set(sessionId, names);
+	while (clientErrorsBySession.size > MAX_CLIENT_ERROR_SESSIONS) {
+		const oldest = clientErrorsBySession.keys().next().value;
+		if (oldest === void 0) break;
+		clientErrorsBySession.delete(oldest);
+	}
+}
+function clientErrorsForSession(sessionId) {
+	const names = clientErrorsBySession.get(sessionId) ?? [];
+	if (names.length > 0) {
+		clientErrorsBySession.delete(sessionId);
+		clientErrorsBySession.set(sessionId, names);
+	}
+	return [...names];
+}
+/** How far back a client may date its own event. */
+const MAX_CLIENT_EVENT_AGE_MS = 3e5;
+/**
+* The client's occurrence time, clamped to the recent past: parallel requests
+* can arrive out of order, but a client can never date an event ahead of now
+* or far behind it.
+*/
+function clientOccurredAt(raw, now) {
+	const parsed = z.number().safeParse(raw);
+	if (!parsed.success) return now;
+	return Math.min(now, Math.max(now - MAX_CLIENT_EVENT_AGE_MS, parsed.data));
+}
+async function captureSanitizedUiTelemetry(telemetry, request, name, properties, onSanitized, rawError, rawContext, rawOccurredAt) {
+	const occurredAt = clientOccurredAt(rawOccurredAt, Date.now());
+	const appSessionId = request.headers.get("x-review-app-session-id") ?? void 0;
+	const mergedProperties = mergeErrorTelemetryProperties(isJsonObject(properties) ? properties : {}, rawError);
+	if (appSessionId) mergedProperties.app_session_id = appSessionId;
+	const sanitized = sanitizeUiTelemetryEvent({
+		name,
+		properties: mergedProperties
+	});
+	if (!sanitized) return;
+	const admitted = admitUiTelemetryEvent(sanitized);
+	if (!admitted) return;
+	const parsedContext = contextSchema.safeParse(rawContext);
+	const context = parsedContext.success ? parsedContext.data : void 0;
+	onSanitized?.(admitted, context);
+	try {
+		await telemetry.captureUiEvent?.(admitted.event, admitted.properties, context, occurredAt);
+	} catch (error) {
+		console.error(error);
+	}
+}
+//#endregion
+//#region src/ask/pi-mcp.ts
+/**
+* pi-acp keeps the MCP servers a session is given without passing them to
+* Pi. Pi 0.99.0 and later take them from an extension, so Ask starts Pi
+* through a wrapper that loads one, registering the servers for that session
+* only. Older Pi, and Windows, which would need a different wrapper, answer
+* without them.
+*/
+/** The first Pi with `pi.registerMcpServer()`. */
+const PI_MCP_VERSION = [
+	0,
+	99,
+	0
+];
+/** How long a version read is trusted: a session's first prompt and its
+* launch ask moments apart, and an update during a review is seen soon. */
+const VERSION_TTL_MS = 3e4;
+const SERVERS_ENV = "WHITEBOARD_ASK_MCP";
+const PI_ENV = "WHITEBOARD_ASK_PI";
+const EXTENSION_ENV = "WHITEBOARD_ASK_PI_EXTENSION";
+const EXTENSION = `// Managed by Whiteboard: gives a Pi session that Ask starts the MCP servers
+// Whiteboard hands it. Do not edit.
+export default function (pi: {
+  registerMcpServer(name: string, config: object): void;
+}) {
+  const servers = JSON.parse(process.env.${SERVERS_ENV} ?? "{}");
+
+  for (const [name, config] of Object.entries(servers))
+    pi.registerMcpServer(name, config as object);
+}
+`;
+const WRAPPER = `#!/bin/sh
+# Managed by Whiteboard: starts Pi for Ask with Whiteboard's extension.
+exec "$${PI_ENV}" -e "$${EXTENSION_ENV}" "$@"
+`;
+const versions = /* @__PURE__ */ new Map();
+function piVersion(executable) {
+	const cached = versions.get(executable);
+	if (cached && Date.now() - cached.read < VERSION_TTL_MS) return cached.version;
+	const version = promisify(execFile)(executable, ["--version"], { timeout: 5e3 }).then(({ stdout }) => /(\d+)\.(\d+)\.(\d+)/u.exec(stdout)?.slice(1).map(Number)).catch(() => void 0);
+	versions.set(executable, {
+		read: Date.now(),
+		version
+	});
+	return version;
+}
+/** Whether this Pi can be given MCP servers. */
+async function piTakesMcp(executable) {
+	if (process.platform === "win32") return false;
+	const version = await piVersion(executable);
+	if (!version) return false;
+	for (const [index, least] of PI_MCP_VERSION.entries()) {
+		const part = version[index] ?? 0;
+		if (part !== least) return part > least;
+	}
+	return true;
+}
+/** Writes a file only when it changed, replacing it whole, since another
+* Ask session may be running it. */
+async function keep(file, content, mode) {
+	if (await readFile(file, "utf8").catch(() => void 0) === content) return;
+	const staged = `${file}.${process.pid}.tmp`;
+	await writeFile(staged, content, { mode });
+	await chmod(staged, mode);
+	await rename(staged, file);
+}
+function piServers(servers) {
+	const piServers = {};
+	const record = (pairs) => Object.fromEntries(pairs.map(({ name, value }) => [name, value]));
+	for (const server of servers) if ("command" in server) piServers[server.name] = {
+		command: server.command,
+		args: server.args,
+		env: record(server.env),
+		exposure: "direct"
+	};
+	else if (server.type === "http") piServers[server.name] = {
+		url: server.url,
+		headers: record(server.headers),
+		exposure: "direct"
+	};
+	return piServers;
+}
+/** The command pi-acp runs in place of Pi: Pi with the extension that
+* registers `servers`, which go to it in `env`. */
+async function piWithMcp(executable, servers, env) {
+	const directory = path.join(devReviewHome(), "ask", "pi");
+	const extension = path.join(directory, "whiteboard-mcp.ts");
+	const wrapper = path.join(directory, "pi");
+	await mkdir(directory, { recursive: true });
+	await keep(extension, EXTENSION, 420);
+	await keep(wrapper, WRAPPER, 493);
+	env[PI_ENV] = executable;
+	env[EXTENSION_ENV] = extension;
+	env[SERVERS_ENV] = JSON.stringify(piServers(servers));
+	return wrapper;
+}
+//#endregion
+//#region src/ask/agents.ts
+const askAgents = {
+	claude: {
+		name: "Claude Code",
+		commands: ["claude"],
+		launch: {
+			adapter: "@agentclientprotocol/claude-agent-acp/dist/index.js",
+			executableEnv: "CLAUDE_CODE_EXECUTABLE"
+		},
+		signIn: "claude auth login",
+		readOnlyMode: "default",
+		sessionMeta: { claudeCode: { options: {
+			disallowedTools: [
+				"Edit",
+				"MultiEdit",
+				"Write",
+				"NotebookEdit",
+				"EnterPlanMode",
+				"ExitPlanMode"
+			],
+			allowDangerouslySkipPermissions: false
+		} } },
+		bypass: {
+			mode: "bypassPermissions",
+			sessionMeta: { claudeCode: { options: { disallowedTools: ["EnterPlanMode", "ExitPlanMode"] } } }
+		}
+	},
+	codex: {
+		name: "Codex",
+		commands: ["codex"],
+		launch: {
+			adapter: "@agentclientprotocol/codex-acp/dist/index.js",
+			executableEnv: "CODEX_PATH"
+		},
+		signIn: "codex login",
+		readOnlyMode: "read-only",
+		bypass: { mode: "agent-full-access" }
+	},
+	cursor: {
+		name: "Cursor",
+		commands: ["cursor-agent"],
+		installDirs: [".local/bin"],
+		launch: { args: ["acp"] },
+		signIn: "cursor-agent login",
+		readOnlyMode: "ask",
+		bypass: { mode: "agent" }
+	},
+	opencode: {
+		name: "OpenCode",
+		commands: ["opencode"],
+		installDirs: [".opencode/bin"],
+		launch: { args: ["acp"] },
+		signIn: "opencode auth login",
+		readOnlyMode: "build",
+		env: { OPENCODE_CONFIG_CONTENT: JSON.stringify({ permission: {
+			edit: "deny",
+			bash: "ask",
+			webfetch: "ask"
+		} }) },
+		bypass: {
+			mode: "build",
+			env: { OPENCODE_CONFIG_CONTENT: JSON.stringify({ permission: {
+				edit: "allow",
+				bash: "allow",
+				webfetch: "allow"
+			} }) }
+		}
+	},
+	pi: {
+		name: "Pi",
+		commands: ["pi"],
+		launch: {
+			adapter: "pi-acp/dist/index.js",
+			executableEnv: "PI_ACP_PI_COMMAND"
+		},
+		signIn: "pi",
+		mcp: {
+			supported: piTakesMcp,
+			launch: piWithMcp
+		}
+	}
+};
+/** Desktop inherits the login shell's PATH, so this sees what a terminal sees.
+* Package-manager bin directories are skipped: the adapters' own dependencies
+* put `codex` there, and that is not the user's install. */
+async function findExecutable(command, env = process.env) {
+	for (const directory of (env.PATH ?? "").split(path.delimiter)) {
+		if (!directory || directory.split(path.sep).includes("node_modules")) continue;
+		const candidate = path.join(directory, command);
+		try {
+			if (!(await stat(candidate)).isFile()) continue;
+			await access(candidate, constants.X_OK);
+			return candidate;
+		} catch {}
+	}
+}
+/** The user's install of an agent's CLI: on PATH, else where its installer
+* puts it. */
+async function findAgent(spec, env = process.env) {
+	const installed = (spec.installDirs ?? []).map((directory) => path.join(homedir(), directory));
+	for (const command of spec.commands) {
+		const found = await findExecutable(command, env) ?? await findExecutable(command, { PATH: installed.join(path.delimiter) });
+		if (found) return found;
+	}
+}
+/** Whether the agent's model gets the MCP servers its sessions are given. */
+async function askAgentTakesMcp(agent) {
+	const spec = askAgents[agent];
+	if (!spec.mcp) return true;
+	const executable = await findAgent(spec);
+	return executable !== void 0 && spec.mcp.supported(executable);
+}
+async function detectAskAgents(env = process.env) {
+	return Promise.all(askAgentIds.map(async (id) => ({
+		id,
+		name: askAgents[id].name,
+		available: await findAgent(askAgents[id], env) !== void 0,
+		readOnly: askAgents[id].readOnlyMode !== void 0,
+		bypass: askAgents[id].bypass !== void 0
+	})));
+}
+/** Runs an adapter with this server's runtime, Desktop's being Electron, or
+* the user's CLI itself. */
+const launchAskAgent = async (agent, cwd, { bypass = false, mcpServers = [] } = {}) => {
+	const spec = askAgents[agent];
+	const executable = await findAgent(spec);
+	if (!executable) throw new Error(`${spec.name} is not installed.`);
+	const env = {
+		...process.env,
+		...bypass && spec.bypass?.env || spec.env
+	};
+	delete env.CLAUDECODE;
+	delete env.CLAUDE_CODE_ENTRYPOINT;
+	const { launch } = spec;
+	let command = executable;
+	let args;
+	if ("adapter" in launch) {
+		env[launch.executableEnv] = spec.mcp && mcpServers.length && await spec.mcp.supported(executable) ? await spec.mcp.launch(executable, mcpServers, env) : executable;
+		if (process.versions.electron) env.ELECTRON_RUN_AS_NODE = "1";
+		command = process.execPath;
+		args = [createRequire(import.meta.url).resolve(launch.adapter)];
+	} else args = launch.args;
+	const child = spawn(command, args, {
+		cwd,
+		env,
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		]
+	});
+	let stderr = "";
+	child.stderr.setEncoding("utf8");
+	child.stderr.on("data", (chunk) => {
+		stderr = (stderr + chunk).slice(-8e3);
+	});
+	await new Promise((resolve, reject) => {
+		child.once("spawn", resolve);
+		child.once("error", reject);
+	});
+	const stream = ndJsonStream(Writable.toWeb(child.stdin), Readable.toWeb(child.stdout));
+	return {
+		connect: (client) => {
+			const connection = client.connect(stream);
+			child.once("exit", () => connection.close());
+			return connection;
+		},
+		diagnostics: () => stderr,
+		stop: () => {
+			if (child.exitCode === null) child.kill();
+		}
+	};
+};
+//#endregion
+//#region src/ask/protocol.ts
+/** Claude's adapter names the MCP server behind an `mcp__*` permission here. */
+const claudeMcpMetaSchema = z.object({ claudeCode: z.object({ mcpServer: z.object({ name: z.string() }) }) });
+/** Codex's adapter puts the server in an MCP tool call's input. */
+const mcpInputSchema = z.union([z.object({ server: z.string() }), z.object({ serverName: z.string() })]);
+/** The MCP server a tool call runs on, if the adapter says. */
+function mcpServerOf(toolCall) {
+	const claude = claudeMcpMetaSchema.safeParse(toolCall._meta).data;
+	if (claude) return claude.claudeCode.mcpServer.name;
+	const input = mcpInputSchema.safeParse(toolCall.rawInput).data;
+	return input && ("server" in input ? input.server : input.serverName);
+}
+/** Wraps the selection context in the first prompt, so a replayed
+* conversation can show the question without it. */
+const CONTEXT_OPEN = "<whiteboard-context>";
+const CONTEXT_CLOSE = "</whiteboard-context>";
+/** A conversation closed mid-turn, as it should look when reopened: the
+* agent stopped, so nothing is still running or waiting on the reviewer. */
+function settled(entries) {
+	return entries.map((entry) => {
+		if (entry.kind === "permission" && entry.outcome === void 0) return {
+			...entry,
+			outcome: "cancelled"
+		};
+		if (entry.kind === "tool" && (entry.status === "pending" || entry.status === "in_progress")) return {
+			...entry,
+			status: "failed"
+		};
+		return entry;
+	});
+}
+/** Enough of a tool's output to see what came back. */
+const OUTPUT_LIMIT = 4e3;
+const selectOptionSchema = z.object({
+	value: z.string(),
+	name: z.string(),
+	description: z.string().nullish()
+});
+/** A select's choices, flat or in groups. */
+const selectOptionsSchema = z.array(z.union([selectOptionSchema, z.object({
+	group: z.string(),
+	options: z.array(selectOptionSchema)
+})]));
+/** The ACP config option category each choice comes from. */
+const choiceCategories = /* @__PURE__ */ new Map([["model", "model"], ["effort", "thought_level"]]);
+const effortNames = /* @__PURE__ */ new Map([["xhigh", "Extra high"]]);
+/** What the agent offers of each choice, from its session config options,
+* with the config option that sets it. */
+function choicesOf(options) {
+	const found = /* @__PURE__ */ new Map();
+	for (const kind of askChoiceKinds) {
+		const option = options?.find((candidate) => candidate.type === "select" && (candidate.category === choiceCategories.get(kind) || candidate.id === kind));
+		if (option?.type !== "select") continue;
+		const choices = selectOptionsSchema.safeParse(option.options).data;
+		if (!choices) continue;
+		found.set(kind, {
+			configId: option.id,
+			select: {
+				current: option.currentValue,
+				options: choices.flatMap((choice) => "group" in choice ? choice.options : [choice]).map(({ value, name: offered, description }) => {
+					const name = kind === "effort" && effortNames.get(value) || offered;
+					return description ? {
+						value,
+						name,
+						description
+					} : {
+						value,
+						name
+					};
+				})
+			}
+		});
+	}
+	return found;
+}
+/** A slash command as the panel offers it. */
+function commandOf({ name, description, input }) {
+	return input?.hint ? {
+		name,
+		description,
+		hint: input.hint
+	} : {
+		name,
+		description
+	};
+}
+/** What a question carries, as its entry shows it. */
+function attachmentsOf({ mentions = [], images = [] }) {
+	return [...mentions.map((mention) => ({
+		kind: "file",
+		path: mention
+	})), ...images.map(({ name }) => ({
+		kind: "image",
+		name
+	}))];
+}
+const toolInputSchema = z.object({
+	command: z.union([z.string(), z.array(z.string())]).optional(),
+	description: z.string().optional(),
+	file_path: z.string().optional(),
+	path: z.string().optional(),
+	query: z.string().optional(),
+	pattern: z.string().optional(),
+	patterns: z.array(z.string()).optional()
+});
+/** What a tool call ran or opened, and why, from what the adapter sent. */
+function toolDetails(update) {
+	const input = toolInputSchema.safeParse(update.rawInput).data;
+	const command = input?.command;
+	const target = (Array.isArray(command) ? command.join(" ") : command) ?? input?.file_path ?? input?.path ?? input?.query ?? input?.pattern ?? input?.patterns?.join(" | ") ?? update.locations?.[0]?.path;
+	const details = {};
+	if (target) details.input = target;
+	if (input?.description) details.summary = input.description;
+	return details;
+}
+/** A finished tool's text output. Claude fences a command's output. */
+function toolOutput(update) {
+	const text = (update.content ?? []).flatMap((item) => item.type === "content" && item.content.type === "text" ? [item.content.text] : []).join("\n").replace(/^\s*```[^\n]*\n([\s\S]*?)\n?```\s*$/u, "$1").trimEnd();
+	if (!text) return void 0;
+	return text.length > OUTPUT_LIMIT ? `${text.slice(0, OUTPUT_LIMIT)}\n…` : text;
+}
+/** A first question, after the selection it is about. */
+function withContext(context, question) {
+	return [{
+		type: "text",
+		text: `${CONTEXT_OPEN}\n${context}\n${CONTEXT_CLOSE}`
+	}, {
+		type: "text",
+		text: question
+	}];
+}
+/** A replayed first message, as the reviewer typed it. */
+function withoutContext(text) {
+	const start = text.indexOf(CONTEXT_OPEN);
+	if (start === -1) return text.trim();
+	const end = text.indexOf(CONTEXT_CLOSE, start);
+	return (text.slice(0, start) + (end === -1 ? "" : text.slice(end + 21))).trim();
+}
+/** ACP's "authentication required": the agent's login lapsed or never was.
+* Some adapters send the same code for other failures, so its message has
+* to say so too. */
+function signedOut(error) {
+	return error instanceof RequestError && error.code === RequestError.authRequired().code && /auth/i.test(error.message);
+}
+//#endregion
+//#region src/ask/thread.ts
+/** Refused without asking: changes to files, and leaving the read-only
+* mode (Claude asks to exit plan mode with its plan). */
+const REFUSED_KINDS = /* @__PURE__ */ new Set([
+	"edit",
+	"delete",
+	"move",
+	"switch_mode"
+]);
+const piGreetingSchema = z.object({ piAcp: z.object({ startupInfo: z.string() }) });
+const cursorTodosSchema = z.object({ todos: z.unknown() }).loose();
+/** MCP servers the reviewer's own agent may bring whose tools only read,
+* so their calls run without asking, like the agent reading files. */
+const READ_ONLY_MCP_SERVERS = /* @__PURE__ */ new Set(["fff"]);
+const askThreadLimits = {
+	startMs: 6e4,
+	stopGraceMs: 15e3
+};
+/** One Ask conversation: an agent process and one ACP session in the review's checkout. */
+var AskThread = class {
+	launch;
+	start;
+	limits;
+	id;
+	state;
+	/** The number of changes so far; a snapshot carries the one it includes. */
+	seq = 0;
+	listeners = /* @__PURE__ */ new Set();
+	closers = /* @__PURE__ */ new Set();
+	decisions = /* @__PURE__ */ new Map();
+	process;
+	connection;
+	/** Counts connections, so a start that was given up on cannot take over. */
+	generation = 0;
+	/** What the last agent process said on stderr, once it is gone. */
+	stderr = "";
+	sessionId;
+	closed = false;
+	/** The MCP server behind each tool call an adapter reported one for. */
+	mcpCalls = /* @__PURE__ */ new Map();
+	mcpServers;
+	/** Loading an earlier conversation: the agent replays it as updates. */
+	replaying = false;
+	/** Replayed user messages as sent, context included. */
+	replayedUser = /* @__PURE__ */ new Map();
+	/** The panel already shows the conversation, so a load's replay is not
+	* needed: a saved copy, or the thread itself when it tries again. */
+	shown;
+	/** The config option that sets each choice the agent offers. */
+	configIds = /* @__PURE__ */ new Map();
+	/** The agent's other settings as last seen, to say when it changes one
+	* itself, as Codex's /plan does. */
+	settings = /* @__PURE__ */ new Map();
+	/** The model and effort in use, which a new agent process starts with. */
+	picks;
+	/** The question being answered, until its turn ends; after a failure,
+	* the one trying again asks. */
+	asking;
+	/** The session has not had the selection yet: a new conversation, or a
+	* new session for one the agent could not reopen. */
+	needsContext;
+	/** The reviewer changed what the agent may do since it was last told. */
+	permitted = false;
+	/** The agent could not reopen the session, for a reason signing in would
+	* not fix, so trying again starts a new one. */
+	unloadable = false;
+	/** Stop ended the agent itself: a start, or a turn that would not stop. */
+	halted = false;
+	stopTimer;
+	/** What Pi greets a new session with, its version and skills, which is no
+	* part of the answer. */
+	greeting;
+	constructor(launch, start, mcpServers = () => [], limits = askThreadLimits) {
+		this.launch = launch;
+		this.start = start;
+		this.limits = limits;
+		this.id = start.id ?? randomUUID();
+		this.mcpServers = mcpServers();
+		this.picks = { ...start.picks };
+		this.state = {
+			id: this.id,
+			agent: start.agent,
+			agentName: askAgents[start.agent].name,
+			status: "starting",
+			readOnly: false,
+			bypass: start.bypass ?? false,
+			head: start.head,
+			cwd: start.cwd,
+			selection: start.selection,
+			entries: "resume" in start && start.resume.entries || []
+		};
+		if ("resume" in start) this.sessionId = start.resume.sessionId;
+		this.shown = "resume" in start && Boolean(start.resume.entries);
+		this.needsContext = !("resume" in start);
+	}
+	get reviewId() {
+		return this.start.reviewId;
+	}
+	read() {
+		return this.state;
+	}
+	snapshot() {
+		return {
+			seq: this.seq,
+			snapshot: this.state
+		};
+	}
+	/** Every change after the current `seq`, in order. */
+	subscribe(listener) {
+		this.listeners.add(listener);
+		return () => this.listeners.delete(listener);
+	}
+	/** Starts the agent and asks the first question, or loads an earlier
+	* conversation; failures land in the state. */
+	async open() {
+		const start = this.start;
+		if ("resume" in start) {
+			await this.attempt(async () => {
+				await this.connect();
+				this.emit({
+					type: "set",
+					status: "idle"
+				});
+			});
+			return;
+		}
+		this.asking = {
+			id: this.addUser(start.question),
+			question: start.question
+		};
+		await this.attempt(async () => {
+			await this.connect();
+			await this.prompt(start.question);
+		});
+	}
+	/** Why a question cannot be asked now, if it cannot. */
+	askRefusal() {
+		switch (this.state.status) {
+			case "idle": return;
+			case "failed": return `${this.state.agentName} stopped. Try again first.`;
+			default: return "The agent is still answering.";
+		}
+	}
+	/** Asks a follow-up, starting the agent again if it has stopped since. */
+	async ask(question) {
+		const refusal = this.askRefusal();
+		if (refusal) throw new Error(refusal);
+		this.asking = {
+			id: this.addUser(question),
+			question
+		};
+		await this.attempt(async () => {
+			await this.reconnect();
+			await this.prompt(question);
+		});
+	}
+	/** Starts the agent again after it failed, as when its login lapsed, and
+	* asks again the question it did not answer, if one failed. */
+	async retry() {
+		if (this.state.status !== "failed") throw new Error("Only a conversation that failed can try again.");
+		this.disconnect();
+		const asked = this.state.entries.findIndex((entry) => entry.kind === "user" && entry.id === this.asking?.id);
+		const question = asked === -1 ? void 0 : this.asking?.question;
+		const partial = asked === -1 ? [] : this.state.entries.slice(asked + 1);
+		if (partial.length) this.emit({
+			type: "remove",
+			ids: partial.map((entry) => entry.id)
+		});
+		if (this.unloadable) {
+			this.unloadable = false;
+			this.sessionId = void 0;
+			this.needsContext = true;
+		}
+		this.emit({
+			type: "set",
+			status: "starting",
+			error: null,
+			signIn: null
+		});
+		await this.attempt(async () => {
+			await this.connect();
+			if (question) await this.prompt(question);
+			else this.emit({
+				type: "set",
+				status: "idle"
+			});
+		});
+	}
+	decide(permissionId, optionId) {
+		const resolve = this.decisions.get(permissionId);
+		if (!resolve) return false;
+		resolve({ outcome: {
+			outcome: "selected",
+			optionId
+		} });
+		return true;
+	}
+	/** Stops the turn, or the start, in progress. A turn the agent does not
+	* end soon after is ended by stopping the agent. */
+	async cancel() {
+		for (const resolve of this.decisions.values()) resolve({ outcome: { outcome: "cancelled" } });
+		const { status } = this.state;
+		if (status === "starting") {
+			this.halt();
+			return;
+		}
+		const { connection, sessionId } = this;
+		if (status !== "running" && status !== "waiting" || !connection) return;
+		clearTimeout(this.stopTimer);
+		this.stopTimer = setTimeout(() => {
+			if (this.connection === connection) this.halt();
+		}, this.limits.stopGraceMs);
+		if (sessionId) await connection.agent.notify(methods.agent.session.cancel, { sessionId }).catch(() => {});
+	}
+	close() {
+		if (this.closed) return;
+		this.closed = true;
+		if (this.sessionId && this.state.status !== "starting" && this.state.status !== "failed") this.start.onSave?.(settled(this.state.entries));
+		for (const resolve of this.decisions.values()) resolve({ outcome: { outcome: "cancelled" } });
+		if (this.connection && this.sessionId) this.connection.agent.notify(methods.agent.session.cancel, { sessionId: this.sessionId }).catch(() => {});
+		this.disconnect();
+		this.listeners.clear();
+		for (const closed of this.closers) closed();
+		this.closers.clear();
+	}
+	/** Runs when the thread closes, at once if it already has. */
+	onClose(closed) {
+		if (this.closed) {
+			closed();
+			return () => {};
+		}
+		this.closers.add(closed);
+		return () => this.closers.delete(closed);
+	}
+	/** Runs a step that talks to the agent; failures land in the state. */
+	async attempt(step) {
+		this.halted = false;
+		try {
+			await step();
+		} catch (error) {
+			if (this.closed) return;
+			if (this.halted) this.stopped();
+			else this.fail(error);
+		}
+	}
+	/** Stop ended the agent before a turn could: nothing is running now, and
+	* the next question starts the agent again. */
+	stopped() {
+		this.halted = false;
+		if (this.asking) this.push({
+			kind: "notice",
+			id: randomUUID(),
+			severity: "info",
+			title: "Stopped here."
+		});
+		this.asking = void 0;
+		this.emit({
+			type: "set",
+			status: "idle",
+			error: null
+		});
+	}
+	/** Ends the agent process, failing whatever was waiting on it. */
+	halt() {
+		this.halted = true;
+		this.disconnect();
+	}
+	disconnect() {
+		this.generation += 1;
+		clearTimeout(this.stopTimer);
+		if (this.process) this.stderr = this.process.diagnostics();
+		this.connection?.close();
+		this.process?.stop();
+		this.connection = void 0;
+		this.process = void 0;
+	}
+	/** Starts the agent again if it stopped since the last turn. */
+	async reconnect() {
+		if (this.connection && !this.connection.signal.aborted) return;
+		this.disconnect();
+		this.emit({
+			type: "set",
+			status: "starting"
+		});
+		await this.connect();
+	}
+	/** Starts the agent and opens the session, or gives up after a while. */
+	async connect() {
+		let timer;
+		const expired = new Promise((_resolve, reject) => {
+			timer = setTimeout(() => reject(/* @__PURE__ */ new Error(`${this.state.agentName} did not start within ${Math.round(this.limits.startMs / 1e3)} seconds.`)), this.limits.startMs);
+		});
+		const starting = this.startAgent();
+		starting.catch(() => {});
+		try {
+			await Promise.race([starting, expired]);
+		} catch (error) {
+			this.disconnect();
+			throw error;
+		} finally {
+			clearTimeout(timer);
+		}
+	}
+	async startAgent() {
+		const generation = ++this.generation;
+		const launched = await this.launch(this.start.agent, this.start.cwd, {
+			bypass: this.state.bypass,
+			mcpServers: this.mcpServers
+		});
+		if (this.closed || this.halted || generation !== this.generation) {
+			launched.stop();
+			throw new Error(`${this.state.agentName} was stopped while it started.`);
+		}
+		this.process = launched;
+		const connection = launched.connect(client({ name: "whiteboard" }).onRequest(methods.client.session.requestPermission, ({ params, signal }) => this.requestPermission(params, signal)).onNotification(methods.client.session.update, ({ params }) => this.update(params)).onRequest("cursor/update_todos", cursorTodosSchema, ({ params }) => ({ outcome: {
+			outcome: "accepted",
+			todos: params.todos
+		} })));
+		this.connection = connection;
+		const agent = connection.agent;
+		const initialized = await agent.request(methods.agent.initialize, {
+			protocolVersion: PROTOCOL_VERSION,
+			clientCapabilities: {
+				session: { notices: {} },
+				_meta: { parameterizedModelPicker: true }
+			},
+			clientInfo: {
+				name: "whiteboard",
+				title: "Whiteboard",
+				version: "1"
+			}
+		});
+		this.emit({
+			type: "set",
+			accepts: { image: initialized.agentCapabilities?.promptCapabilities?.image === true }
+		});
+		const session = await this.session(connection, generation, initialized.agentCapabilities?.loadSession === true);
+		const { bypass } = this.state;
+		const spec = askAgents[this.start.agent];
+		const mode = bypass ? spec.bypass?.mode : spec.readOnlyMode;
+		const configurable = mode !== void 0 && session.response.configOptions?.some((option) => option.id === "mode" && option.type === "select" && selectOptionsSchema.safeParse(option.options).data?.flatMap((choice) => "group" in choice ? choice.options : [choice]).some((choice) => choice.value === mode));
+		const selectable = mode !== void 0 && session.response.modes?.availableModes.some((available) => available.id === mode);
+		let config = session.response.configOptions;
+		if (configurable) config = (await agent.request(methods.agent.session.setConfigOption, {
+			sessionId: session.sessionId,
+			configId: "mode",
+			value: mode
+		})).configOptions ?? config;
+		else if (selectable) await agent.request(methods.agent.session.setMode, {
+			sessionId: session.sessionId,
+			modeId: mode
+		});
+		this.emit({
+			type: "set",
+			readOnly: !bypass && Boolean(configurable || selectable)
+		});
+		this.useConfig(config);
+		for (const kind of askChoiceKinds) {
+			const picked = this.picks[kind];
+			const select = this.state.choices?.[kind];
+			if (picked && picked !== select?.current && select?.options.some((option) => option.value === picked)) await this.change(kind, picked);
+		}
+	}
+	/** Answers the next question with another model or effort, starting the
+	* agent again if it has stopped since. */
+	async choose(kind, value) {
+		if (this.state.status !== "idle") throw new Error("Settings can change between answers.");
+		if (!this.connection || this.connection.signal.aborted) {
+			await this.attempt(async () => {
+				await this.reconnect();
+				this.emit({
+					type: "set",
+					status: "idle"
+				});
+			});
+			if (this.state.status !== "idle") return;
+		}
+		await this.change(kind, value);
+	}
+	async change(kind, value) {
+		const configId = this.configIds.get(kind);
+		if (!this.connection || !this.sessionId || !configId) throw new Error(`${this.state.agentName} offers no such choice.`);
+		const response = await this.connection.agent.request(methods.agent.session.setConfigOption, {
+			sessionId: this.sessionId,
+			configId,
+			value
+		});
+		this.picks[kind] = value;
+		this.useConfig(response.configOptions);
+	}
+	useConfig(options) {
+		const found = choicesOf(options);
+		this.noteSettings(options, found);
+		if (!found.size) return;
+		const choices = {};
+		for (const [kind, { configId, select }] of found) {
+			this.configIds.set(kind, configId);
+			choices[kind] = select;
+		}
+		this.emit({
+			type: "set",
+			choices
+		});
+		this.announce();
+	}
+	/** Says when a setting the panel does not show changes, which can be
+	* all a command does. */
+	noteSettings(options, choices) {
+		const shown = new Set([...choices.values()].map(({ configId }) => configId));
+		for (const option of options ?? []) {
+			if (option.type !== "select" || shown.has(option.id)) continue;
+			const before = this.settings.get(option.id);
+			this.settings.set(option.id, option.currentValue);
+			if (before === void 0 || before === option.currentValue) continue;
+			const value = selectOptionsSchema.safeParse(option.options).data?.flatMap((choice) => "group" in choice ? choice.options : [choice]).find((choice) => choice.value === option.currentValue)?.name ?? option.currentValue;
+			this.push({
+				kind: "notice",
+				id: randomUUID(),
+				severity: "info",
+				title: `${this.state.agentName} set ${option.name.toLowerCase()} to ${value}.`
+			});
+		}
+	}
+	/** Tells the host what the agent offers now, once its settings are
+	* known: a reopening agent lists its commands first, and what it says
+	* then must not stand as an offer of no model. */
+	announce() {
+		const { choices, commands, accepts } = this.state;
+		if (!choices) return;
+		const offer = { choices };
+		if (commands) offer.commands = commands;
+		if (accepts) offer.accepts = accepts;
+		this.start.onOffer?.(offer);
+	}
+	/** Edits and runs commands without asking from the next answer, or stops:
+	* the agent starts again in that mode and reopens the conversation. */
+	async permit(bypass) {
+		if (this.state.status !== "idle") throw new Error("Settings can change between answers.");
+		if (bypass === this.state.bypass) return;
+		if (bypass && !askAgents[this.start.agent].bypass) throw new Error(`${this.state.agentName} cannot bypass permissions.`);
+		this.emit({
+			type: "set",
+			bypass
+		});
+		this.permitted = true;
+		this.start.onBypass?.(bypass);
+		this.disconnect();
+		this.settings.clear();
+		this.emit({
+			type: "set",
+			status: "starting"
+		});
+		await this.attempt(async () => {
+			await this.connect();
+			this.emit({
+				type: "set",
+				status: "idle"
+			});
+		});
+	}
+	/** What the session starts with: read-only, or bypassing permissions. */
+	sessionMeta() {
+		const spec = askAgents[this.start.agent];
+		return this.state.bypass && spec.bypass?.sessionMeta || spec.sessionMeta;
+	}
+	/** The agent says which mode it is in now; only its read-only one keeps
+	* the checkout as it is. */
+	useMode(mode) {
+		const readOnly = !this.state.bypass && mode === askAgents[this.start.agent].readOnlyMode;
+		if (readOnly !== this.state.readOnly) this.emit({
+			type: "set",
+			readOnly
+		});
+	}
+	/** A new session, or the earlier one loaded with its history replayed. */
+	async session(connection, generation, canLoad) {
+		const agent = connection.agent;
+		const start = this.start;
+		const name = this.state.agentName;
+		const earlier = this.sessionId;
+		if (!earlier) {
+			const response = await agent.request(methods.agent.session.new, {
+				cwd: start.cwd,
+				mcpServers: this.mcpServers,
+				_meta: this.sessionMeta()
+			});
+			this.sessionId = response.sessionId;
+			start.onSession?.(response.sessionId);
+			this.greeting = piGreetingSchema.safeParse(response._meta).data?.piAcp.startupInfo;
+			return {
+				sessionId: response.sessionId,
+				response
+			};
+		}
+		const unloadable = (reason, cause) => {
+			this.unloadable = true;
+			return new Error(`${name} could not reopen this conversation. ${reason} Try again to continue it in a new session, which starts without what was said before.`, { cause });
+		};
+		if (!canLoad) throw unloadable(`${name} cannot reopen past conversations.`);
+		this.shown ||= this.state.entries.length > 0;
+		this.replaying = true;
+		try {
+			return {
+				sessionId: earlier,
+				response: await agent.request(methods.agent.session.load, {
+					sessionId: earlier,
+					cwd: start.cwd,
+					mcpServers: this.mcpServers,
+					_meta: this.sessionMeta()
+				})
+			};
+		} catch (error) {
+			if (signedOut(error) || this.closed || this.halted || generation !== this.generation) throw error;
+			throw unloadable(errorMessage(error), error);
+		} finally {
+			this.replaying = false;
+		}
+	}
+	/** Asks a question in the session, with the selection first if the
+	* session has not had it. */
+	async prompt(question) {
+		const { connection, sessionId } = this;
+		if (!connection || !sessionId) throw new Error(`${this.state.agentName} is not running.`);
+		const command = question.text.startsWith("/");
+		const withSelection = this.needsContext && !command;
+		const withPermission = (withSelection || this.permitted) && !command;
+		const context = [...withSelection ? [this.start.context] : [], ...withPermission ? [this.state.bypass ? "The reviewer lets you change files in the checkout and run commands without asking." : "Do not change files in the checkout."] : []].join("\n");
+		this.emit({
+			type: "set",
+			status: "running",
+			error: null
+		});
+		const prompt = [...context ? withContext(context, question.text) : [{
+			type: "text",
+			text: question.text
+		}], ...this.attachments(question)];
+		let stopReason;
+		try {
+			({stopReason} = await connection.agent.request(methods.agent.session.prompt, {
+				sessionId,
+				prompt
+			}));
+		} catch (error) {
+			if (!this.halted) throw error;
+			stopReason = "cancelled";
+			this.halted = false;
+		} finally {
+			clearTimeout(this.stopTimer);
+		}
+		if (withSelection) this.needsContext = false;
+		if (withPermission) this.permitted = false;
+		this.asking = void 0;
+		const asked = this.state.entries.findLastIndex((entry) => entry.kind === "user");
+		if (stopReason === "cancelled") this.push({
+			kind: "notice",
+			id: randomUUID(),
+			severity: "info",
+			title: "Stopped here."
+		});
+		else if (stopReason === "end_turn" && asked === this.state.entries.length - 1) this.push({
+			kind: "notice",
+			id: randomUUID(),
+			severity: "info",
+			title: `${this.state.agentName} finished without replying.`
+		});
+		this.emit({
+			type: "set",
+			status: "idle",
+			error: stopReason === "refusal" ? `${this.state.agentName} declined to answer.` : stopReason === "max_tokens" || stopReason === "max_turn_requests" ? `${this.state.agentName} stopped before finishing.` : null
+		});
+		this.start.onTurn?.();
+		this.start.onSave?.(this.state.entries);
+	}
+	async requestPermission(request, signal) {
+		const id = request.toolCall.toolCallId;
+		const toolKind = request.toolCall.kind ?? "other";
+		const server = mcpServerOf(request.toolCall) ?? this.mcpCalls.get(id);
+		const allowOnce = request.options.find((option) => option.kind === "allow_once");
+		if (allowOnce && (this.state.bypass || server && (READ_ONLY_MCP_SERVERS.has(server) || this.mcpServers.some((provided) => provided.name === server)))) return { outcome: {
+			outcome: "selected",
+			optionId: allowOnce.optionId
+		} };
+		const input = toolDetails(request.toolCall).input ?? this.state.entries.find((entry) => entry.kind === "tool" && entry.id === id)?.input;
+		const entry = {
+			kind: "permission",
+			id,
+			title: request.toolCall.title ?? "Run a tool",
+			toolKind,
+			options: request.options
+		};
+		if (input) entry.input = input;
+		if (REFUSED_KINDS.has(toolKind)) {
+			const reject = request.options.find((option) => option.kind === "reject_once");
+			this.push({
+				...entry,
+				outcome: reject?.optionId ?? "cancelled",
+				automatic: true
+			});
+			return reject ? { outcome: {
+				outcome: "selected",
+				optionId: reject.optionId
+			} } : { outcome: { outcome: "cancelled" } };
+		}
+		this.push(entry);
+		this.emit({
+			type: "set",
+			status: "waiting"
+		});
+		const response = await new Promise((resolve) => {
+			this.decisions.set(id, resolve);
+			const withdrawn = () => resolve({ outcome: { outcome: "cancelled" } });
+			if (signal.aborted) withdrawn();
+			else signal.addEventListener("abort", withdrawn, { once: true });
+		});
+		this.decisions.delete(id);
+		this.replace(id, "permission", (current) => ({
+			...current,
+			outcome: response.outcome.outcome === "selected" ? response.outcome.optionId : "cancelled"
+		}));
+		if (this.state.status === "waiting" && !this.decisions.size) this.emit({
+			type: "set",
+			status: "running"
+		});
+		return response;
+	}
+	update({ sessionId, update }) {
+		if (sessionId !== this.sessionId) return;
+		this.apply(update);
+	}
+	apply(update) {
+		if (this.useSessionState(update)) return;
+		if (this.replaying && this.shown) return;
+		switch (update.sessionUpdate) {
+			case "user_message_chunk":
+				if (this.replaying && update.content.type === "text") this.replayUser(update.content.text, update.messageId ?? void 0);
+				return;
+			case "agent_message_chunk": {
+				if (update.content.type !== "text") return;
+				const { text } = update.content;
+				if (text === this.greeting) {
+					this.greeting = void 0;
+					return;
+				}
+				const last = this.state.entries.at(-1);
+				const id = update.messageId ?? void 0;
+				if (last?.kind === "agent" && (!id || last.id === id)) {
+					this.emit({
+						type: "append",
+						id: last.id,
+						text
+					});
+					return;
+				}
+				this.push({
+					kind: "agent",
+					id: id ?? randomUUID(),
+					text
+				});
+				return;
+			}
+			case "config_option_update": {
+				this.useConfig(update.configOptions);
+				const mode = update.configOptions.find((option) => option.id === "mode" && option.type === "select");
+				if (mode?.type === "select") this.useMode(mode.currentValue);
+				return;
+			}
+			case "current_mode_update":
+				this.useMode(update.currentModeId);
+				return;
+			case "notice": {
+				if (this.state.entries.some((entry) => entry.kind === "notice" && entry.title === update.title && entry.description === (update.description ?? void 0))) return;
+				const notice = {
+					kind: "notice",
+					id: randomUUID(),
+					severity: update.severity,
+					title: update.title
+				};
+				if (update.description) notice.description = update.description;
+				this.push(notice);
+				return;
+			}
+			case "tool_call":
+				this.noteMcpServer(update);
+				this.push({
+					kind: "tool",
+					id: update.toolCallId,
+					title: update.title,
+					toolKind: update.kind ?? "other",
+					status: update.status ?? "pending",
+					...toolDetails(update)
+				});
+				this.showPlan(update);
+				return;
+			case "tool_call_update":
+				this.noteMcpServer(update);
+				if (!this.state.entries.some((entry) => entry.kind === "tool" && entry.id === update.toolCallId)) {
+					this.push({
+						kind: "tool",
+						id: update.toolCallId,
+						title: update.title ?? "Tool call",
+						toolKind: update.kind ?? "other",
+						status: update.status ?? "pending",
+						...toolDetails(update)
+					});
+					this.showPlan(update);
+					return;
+				}
+				this.replace(update.toolCallId, "tool", (current) => {
+					const status = update.status ?? current.status;
+					const output = status === "completed" || status === "failed" ? toolOutput(update) : void 0;
+					const next = {
+						...current,
+						title: update.title ?? current.title,
+						toolKind: update.kind ?? current.toolKind,
+						status,
+						...toolDetails(update)
+					};
+					if (output) next.output = output;
+					return next;
+				});
+				this.showPlan(update);
+				return;
+		}
+	}
+	/** What the session says about itself rather than the turn: its
+	* commands, how full it is, and its name. A reload's replay keeps them. */
+	useSessionState(update) {
+		switch (update.sessionUpdate) {
+			case "available_commands_update":
+				this.emit({
+					type: "set",
+					commands: update.availableCommands.map(commandOf)
+				});
+				this.announce();
+				return true;
+			case "usage_update": {
+				const { used, size, cost } = update;
+				this.emit({
+					type: "set",
+					usage: cost ? {
+						used,
+						size,
+						cost: {
+							amount: cost.amount,
+							currency: cost.currency
+						}
+					} : {
+						used,
+						size
+					}
+				});
+				return true;
+			}
+			case "session_info_update": {
+				const title = update.title?.trim();
+				if (title && title !== this.state.title) {
+					this.emit({
+						type: "set",
+						title
+					});
+					this.start.onTitle?.(title);
+				}
+				return true;
+			}
+			default: return false;
+		}
+	}
+	noteMcpServer(update) {
+		const server = mcpServerOf(update);
+		if (server) this.mcpCalls.set(update.toolCallId, server);
+	}
+	/**
+	* In its read-only mode Claude answers by writing a plan and asking to
+	* leave the mode with it. That request is refused, so the plan is shown
+	* as the answer; the refusal's own text, once it comes, is not.
+	*/
+	showPlan(update) {
+		const call = this.state.entries.find((entry) => entry.kind === "tool" && entry.id === update.toolCallId);
+		if (call?.kind !== "tool" || call.toolKind !== "switch_mode" || call.status === "completed" || call.status === "failed") return;
+		const plan = (update.content ?? []).flatMap((item) => item.type === "content" && item.content.type === "text" ? [item.content.text] : []).join("\n\n").trim();
+		if (!plan) return;
+		const id = `plan:${update.toolCallId}`;
+		if (this.state.entries.some((entry) => entry.id === id)) this.replace(id, "agent", (current) => ({
+			...current,
+			text: plan
+		}));
+		else this.push({
+			kind: "agent",
+			id,
+			text: plan
+		});
+	}
+	/** Chunks of one replayed message join, like an answer's. */
+	replayUser(text, messageId) {
+		const last = this.state.entries.at(-1);
+		if (last?.kind === "user" && this.replayedUser.has(last.id) && (!messageId || last.id === messageId)) {
+			const sent = this.replayedUser.get(last.id) + text;
+			this.replayedUser.set(last.id, sent);
+			this.emit({
+				type: "entry",
+				entry: {
+					...last,
+					text: withoutContext(sent)
+				}
+			});
+			return;
+		}
+		const id = messageId ?? randomUUID();
+		this.replayedUser.set(id, text);
+		this.push({
+			kind: "user",
+			id,
+			text: withoutContext(text)
+		});
+	}
+	addUser(question) {
+		const id = randomUUID();
+		const attachments = attachmentsOf(question);
+		const entry = {
+			kind: "user",
+			id,
+			text: question.text,
+			at: Date.now()
+		};
+		if (attachments.length) entry.attachments = attachments;
+		this.push(entry);
+		return id;
+	}
+	/** A question's files, as links into the checkout, and its images, for
+	* an agent that reads them. */
+	attachments(question) {
+		const root = path.resolve(this.start.cwd);
+		const blocks = [];
+		for (const mention of question.mentions ?? []) {
+			const file = path.resolve(root, mention);
+			if (!file.startsWith(root + path.sep)) continue;
+			blocks.push({
+				type: "resource_link",
+				uri: pathToFileURL(file).href,
+				name: path.basename(file),
+				title: mention
+			});
+		}
+		const images = question.images ?? [];
+		if (!images.length) return blocks;
+		if (!this.state.accepts?.image) {
+			this.push({
+				kind: "notice",
+				id: randomUUID(),
+				severity: "warning",
+				title: `${this.state.agentName} does not read images, so they were left out.`
+			});
+			return blocks;
+		}
+		for (const { mimeType, data } of images) blocks.push({
+			type: "image",
+			mimeType,
+			data
+		});
+		return blocks;
+	}
+	fail(cause) {
+		if (this.closed) return;
+		if (signedOut(cause)) {
+			const { name, signIn } = askAgents[this.start.agent];
+			this.emit({
+				type: "set",
+				status: "failed",
+				error: `${name} is signed out.`,
+				signIn
+			});
+			return;
+		}
+		const diagnostics = (this.process?.diagnostics() ?? this.stderr).trim();
+		this.emit({
+			type: "set",
+			status: "failed",
+			error: [errorMessage(cause), diagnostics?.split("\n").at(-1)].filter(Boolean).join("\n")
+		});
+	}
+	push(entry) {
+		this.emit({
+			type: "add",
+			entry
+		});
+	}
+	replace(id, kind, change) {
+		const current = this.state.entries.find((entry) => entry.id === id && entry.kind === kind);
+		if (current) this.emit({
+			type: "entry",
+			entry: change(current)
+		});
+	}
+	/** The one way the state changes, so watchers can follow it change by change. */
+	emit(change) {
+		if (this.closed) return;
+		this.state = applyAskChange(this.state, change);
+		this.seq += 1;
+		const update = {
+			seq: this.seq,
+			change
+		};
+		for (const listener of this.listeners) listener(update);
+	}
+};
+//#endregion
+//#region src/ask/threads.ts
+/** How long an agent may take to say what it offers. */
+const OFFER_TIMEOUT_MS = 3e4;
+/** How long after its session opens an agent may take to list its
+* commands, which it sends on its own rather than in the response. */
+const COMMANDS_WAIT_MS = 2e3;
+/** What an agent offers, from a session it starts and leaves without
+* asking anything: with the model given, where it offers that model, since
+* the efforts on offer depend on it. */
+async function offeredBy(launch, agent, cwd, model) {
+	const process = await launch(agent, cwd);
+	const timer = setTimeout(() => process.stop(), OFFER_TIMEOUT_MS);
+	let listed = () => {};
+	const commands = new Promise((resolve) => {
+		listed = resolve;
+	});
+	try {
+		const connection = process.connect(client({ name: "whiteboard" }).onNotification(methods.client.session.update, ({ params: { update } }) => {
+			if (update.sessionUpdate === "available_commands_update") listed(update.availableCommands.map(commandOf));
+		}));
+		const initialized = await connection.agent.request(methods.agent.initialize, {
+			protocolVersion: PROTOCOL_VERSION,
+			clientCapabilities: { _meta: { parameterizedModelPicker: true } },
+			clientInfo: {
+				name: "whiteboard",
+				title: "Whiteboard",
+				version: "1"
+			}
+		});
+		const session = await connection.agent.request(methods.agent.session.new, {
+			cwd,
+			mcpServers: [],
+			_meta: askAgents[agent].sessionMeta
+		});
+		const offer = {
+			choices: {},
+			accepts: { image: initialized.agentCapabilities?.promptCapabilities?.image === true }
+		};
+		let found = choicesOf(session.configOptions);
+		const models = found.get("model");
+		if (model && models && model !== models.select.current && models.select.options.some((option) => option.value === model)) found = choicesOf((await connection.agent.request(methods.agent.session.setConfigOption, {
+			sessionId: session.sessionId,
+			configId: models.configId,
+			value: model
+		})).configOptions);
+		for (const [kind, { select }] of found) offer.choices[kind] = select;
+		let wait;
+		const offered = await Promise.race([commands, new Promise((resolve) => {
+			wait = setTimeout(() => resolve(void 0), COMMANDS_WAIT_MS);
+		})]).finally(() => clearTimeout(wait));
+		if (offered) offer.commands = offered;
+		return offer;
+	} catch (error) {
+		const diagnostics = process.diagnostics().trim();
+		throw new Error(`${askAgents[agent].name} did not say what it offers. ${errorMessage(error)}${diagnostics ? `\n${diagnostics}` : ""}`, { cause: error });
+	} finally {
+		clearTimeout(timer);
+		process.stop();
+	}
+}
+/** The live Ask threads of one server; they end with it. */
+var AskThreads = class {
+	launch;
+	tools;
+	limits;
+	threads = /* @__PURE__ */ new Map();
+	/** One question to each agent at a time about what it offers with a
+	* model. */
+	offers = /* @__PURE__ */ new Map();
+	mcpServers;
+	constructor(launch, tools = {}, limits = askThreadLimits) {
+		this.launch = launch;
+		this.tools = tools;
+		this.limits = limits;
+		this.mcpServers = tools.mcpServers ?? (() => []);
+	}
+	/** How the agent's sessions reach Whiteboard's tools: the MCP tools they
+	* are given where its model gets them, else the CLI from its shell. */
+	async reach(agent) {
+		if (this.mcpServers().length && await (this.tools.takesMcp ?? askAgentTakesMcp)(agent)) return { kind: "mcp" };
+		const command = this.tools.cli?.();
+		return command ? {
+			kind: "cli",
+			command
+		} : void 0;
+	}
+	open(start) {
+		const thread = new AskThread(this.launch, start, this.mcpServers, this.limits);
+		this.threads.set(thread.id, thread);
+		thread.open();
+		return thread;
+	}
+	get(id) {
+		return this.threads.get(id);
+	}
+	/** What the agent offers to choose before anything is asked of it, with
+	* its own model or the one given. */
+	offered(agent, cwd, model) {
+		const key = JSON.stringify([agent, model]);
+		let offer = this.offers.get(key);
+		if (!offer) {
+			offer = offeredBy(this.launch, agent, cwd, model).finally(() => this.offers.delete(key));
+			this.offers.set(key, offer);
+		}
+		return offer;
+	}
+	close(id) {
+		this.threads.get(id)?.close();
+		this.threads.delete(id);
+	}
+	closeAll() {
+		for (const id of [...this.threads.keys()]) this.close(id);
+	}
+};
+//#endregion
+//#region src/ask/checkout-files.ts
+const execFileAsync$1 = promisify(execFile);
+/** The checkout's files relative to its root: tracked ones, and new ones git
+* does not ignore. None where git cannot list them. */
+async function checkoutFiles(root) {
+	try {
+		const { stdout } = await execFileAsync$1("git", [
+			"-C",
+			root,
+			"ls-files",
+			"-z",
+			"--cached",
+			"--others",
+			"--exclude-standard"
+		], { maxBuffer: 67108864 });
+		return [...new Set(stdout.split("\0").filter(Boolean))];
+	} catch {
+		return [];
+	}
+}
+/** How long a listing serves mentions before git is asked again. */
+const LISTING_MS = 1e4;
+const listings = /* @__PURE__ */ new Map();
+/** The checkout's files for a mention picker, which asks on each keystroke:
+* listed again only once the last listing is a few seconds old. */
+function mentionableFiles(root) {
+	const now = Date.now();
+	const listed = listings.get(root);
+	if (listed && now - listed.at < LISTING_MS) return listed.files;
+	const files = checkoutFiles(root);
+	listings.set(root, {
+		at: now,
+		files
+	});
+	return files;
+}
+//#endregion
+//#region src/ask/file-refs.ts
+/** `:42`, `:42:7`, `:42-50`, `#L42`, `#L42C7`, `#L42-L50`. */
+const lineSuffix = /(?::(\d+)(?::\d+)?(?:-\d+)?|#L(\d+)(?:C\d+)?(?:-L?\d+)?)$/;
+/** A scheme, as in `https://`; a Windows drive letter is not one. */
+const urlScheme = /^[a-z][a-z\d+.-]+:/i;
+/** What a piece of inline code or a link target names, if it could be a
+* file: a path with a directory or an extension, and no spaces. Whether the
+* file exists is the checkout's to say. */
+function parseFileRef(text) {
+	let value = text.trim();
+	if (value.startsWith("file://")) try {
+		value = decodeURIComponent(value.slice(7));
+	} catch {
+		return;
+	}
+	if (!value || value.length > 400 || /[\s`'"<>|*?{}$]/.test(value) || urlScheme.test(value) || value.startsWith("-")) return void 0;
+	const match = lineSuffix.exec(value);
+	const path = (match ? value.slice(0, match.index) : value).replace(/^\.\//, "");
+	const name = path.split("/").at(-1) ?? "";
+	if (!name || !(path.includes("/") || /\.[a-z][a-z\d]*$/i.test(name))) return void 0;
+	const line = Number(match?.[1] ?? match?.[2]);
+	return line > 0 ? {
+		path,
+		line
+	} : { path };
+}
+/** Resolves the paths an answer names to files in the checkout, relative to
+* its root. Agents write paths from the checkout root, as absolute paths, or
+* relative to the package they are in; a path that could be several files
+* resolves to the one the agent's tools touched, else to none. */
+function resolveFileRefs(root, files, paths, touched = []) {
+	const known = new Set(files);
+	const inRoot = (path) => path.startsWith(`${root}/`) ? path.slice(root.length + 1) : path;
+	const named = (path) => known.has(path) ? [path] : files.filter((file) => file.endsWith(`/${path}`));
+	const touchedFiles = new Set(touched.flatMap((path) => {
+		const relative = inRoot(path);
+		return relative.startsWith("/") ? [] : named(relative);
+	}));
+	const resolved = /* @__PURE__ */ new Map();
+	for (const asked of paths) {
+		const path = inRoot(asked);
+		if (path.startsWith("/")) continue;
+		for (const candidate of [path, path.replace(/^[ab]\//, "")]) {
+			const matches = named(candidate);
+			const touchedMatches = matches.filter((file) => touchedFiles.has(file));
+			const match = matches.length === 1 ? matches[0] : touchedMatches.length === 1 ? touchedMatches[0] : void 0;
+			if (match) {
+				resolved.set(asked, match);
+				break;
+			}
+		}
+	}
+	return resolved;
+}
+/**
+* NDJSON of a thread: a snapshot, then each change in `seq` order. Answer
+* tokens arrive as appends, so a reply costs about what the agent sent.
+*/
+function watchAskThread(thread, backlog = 256) {
+	const encoder = new TextEncoder();
+	let pending = [thread.snapshot()];
+	let stop = () => {};
+	/** The thread closed; the stream ends once `pending` is sent. */
+	let ended = false;
+	/** The stream ended, so nothing more may be enqueued. */
+	let finished = false;
+	const flush = (controller) => {
+		while (pending.length && (controller.desiredSize ?? 0) > 0) controller.enqueue(encoder.encode(`${JSON.stringify(pending.shift())}\n`));
+		if (ended && !pending.length && !finished) {
+			finished = true;
+			controller.close();
+		}
+	};
+	const body = new ReadableStream({
+		start(controller) {
+			const unsubscribe = thread.subscribe((update) => {
+				pending.push(update);
+				if (pending.length > backlog) pending = [thread.snapshot()];
+				flush(controller);
+			});
+			const unclose = thread.onClose(() => {
+				ended = true;
+				unsubscribe();
+				flush(controller);
+			});
+			stop = () => {
+				unsubscribe();
+				unclose();
+			};
+			flush(controller);
+		},
+		pull: flush,
+		cancel() {
+			stop();
+		}
+	});
+	return new Response(body, { headers: {
+		"content-type": "application/x-ndjson",
+		"cache-control": "no-store"
+	} });
+}
+//#endregion
+//#region src/review-stack.ts
+const execFileAsync = promisify(execFile);
+const GitHubStacksSchema = z.array(z.object({ pull_requests: z.array(z.object({
+	number: z.number().int().positive(),
+	head: z.object({ ref: z.string().min(1) })
+})) }));
+async function resolveReviewStackLayers(subject, reviews, runGitHubApi = defaultRunGitHubApi) {
+	const binding = subject.origin?.pullRequestUrl?.match(/^https:\/\/([a-z0-9.-]+)\/([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)\/pull\/([1-9]\d*)$/);
+	if (!binding) return [];
+	const [, host, owner, repository, number] = binding;
+	const pullRequestNumber = Number(number);
+	const repoKey = `https://${host}/${owner}/${repository}`;
+	let stacks;
+	try {
+		stacks = GitHubStacksSchema.parse(JSON.parse(await runGitHubApi(host, `repos/${owner}/${repository}/stacks?pull_request=${number}`)));
+	} catch {
+		return [];
+	}
+	const stack = stacks.find((candidate) => candidate.pull_requests.some((pr) => pr.number === pullRequestNumber));
+	if (!stack) return [];
+	const currentIndex = stack.pull_requests.findIndex((pr) => pr.number === pullRequestNumber);
+	return stack.pull_requests.map((pr, index) => {
+		const review = reviews.find((candidate) => {
+			return (candidate.origin?.pullRequestUrl?.replace(/\/pull\/\d+.*$/, "") ?? candidate.pins?.repositoryId) === repoKey && candidate.origin?.pullRequestNumber === pr.number;
+		});
+		return {
+			branch: pr.head.ref,
+			pullRequestNumber: pr.number,
+			pullRequestUrl: `${repoKey}/pull/${pr.number}`,
+			reviewUuid: review?.reviewId ?? null,
+			reviewTitle: review?.title ?? null,
+			relation: index < currentIndex ? "earlier" : index === currentIndex ? "current" : "later"
+		};
+	});
+}
+async function defaultRunGitHubApi(host, endpoint) {
+	const { stdout } = await execFileAsync("gh", [
+		"api",
+		"--hostname",
+		host,
+		endpoint
+	], {
+		env: {
+			...process.env,
+			GH_PROMPT_DISABLED: "1"
+		},
+		encoding: "utf8",
+		timeout: 1e4,
+		maxBuffer: 2097152
+	});
+	return stdout;
+}
+//#endregion
+//#region src/sharing/auth.ts
+/** CI credentials stay in the server environment and are never persisted to a profile. */
+async function readSharingAuth(env = process.env) {
+	if (env.DEV_REVIEW_SHARE_TOKEN === void 0) {
+		if (env.DEV_REVIEW_SHARE_ORIGIN !== void 0) throw new ReviewInputError("DEV_REVIEW_SHARE_ORIGIN requires DEV_REVIEW_SHARE_TOKEN.");
+		return readStoreAuth(env);
+	}
+	const token = env.DEV_REVIEW_SHARE_TOKEN.trim();
+	if (!token) throw new ReviewInputError("DEV_REVIEW_SHARE_TOKEN is empty.");
+	let url;
+	try {
+		url = new URL(env.DEV_REVIEW_SHARE_ORIGIN ?? DEFAULT_STORE_ORIGIN);
+	} catch {
+		throw new ReviewInputError("DEV_REVIEW_SHARE_ORIGIN must be a bare HTTPS origin.");
+	}
+	if (url.protocol !== "https:" || url.username || url.password || url.pathname !== "/" || url.search || url.hash) throw new ReviewInputError("DEV_REVIEW_SHARE_ORIGIN must be a bare HTTPS origin.");
+	return {
+		origin: url.origin,
+		token
+	};
+}
+//#endregion
+//#region src/sharing/host.ts
+const publishSchema = z.strictObject({
+	reviewId: z.string().min(1),
+	version: z.number().int().nonnegative().optional(),
+	requestId: z.uuid().optional()
+});
+/** Mounted behind local host authentication. Account credentials never enter the renderer. */
+function mountSharingHost(app, store, data, shared, options = {}) {
+	const startLogin = options.login ?? runStoreLogin;
+	const openUrl = options.openUrl ?? openUrlInBrowser;
+	let login = { pending: false };
+	app.get("/sharing/account", async (context) => {
+		const account = await readStoreAuth();
+		return context.json({
+			account: account ? {
+				login: account.login,
+				origin: account.origin
+			} : null,
+			...login
+		});
+	});
+	app.post("/sharing/login", async (context) => {
+		if (!login.pending) {
+			login = { pending: true };
+			options.onLogin?.("started");
+			const discard = new Writable({ write(_chunk, _encoding, done) {
+				done();
+			} });
+			startLogin({
+				traces: false,
+				stdout: discard,
+				stderr: discard,
+				openUrl: async (url) => {
+					login.url = url;
+					await openUrl(url);
+				}
+			}).then((code) => {
+				login = { pending: false };
+				if (code) login.error = "Sign-in did not finish. Try again.";
+				options.onLogin?.(code ? "failed" : "succeeded", code ? "did_not_finish" : void 0);
+			}).catch(() => {
+				login = {
+					pending: false,
+					error: "Sign-in failed. Try again."
+				};
+				options.onLogin?.("failed", "error");
+			});
+		}
+		return context.json(login);
+	});
+	mountSharingPublisher(app, store, data, options);
+	const imports = /* @__PURE__ */ new Map();
+	app.get("/sharing/import/:id", (context) => {
+		const id = context.req.param("id");
+		const status = shared.status(id);
+		const result = {
+			reviewId: id,
+			...status
+		};
+		if (status.stage === "ready") return context.json({
+			...result,
+			title: shared.get(id).snapshot.title
+		});
+		return context.json(result);
+	});
+	app.post("/sharing/import", async (context) => {
+		const { url } = z.strictObject({ url: z.string().max(2048) }).parse(await readBoundedRequestJson(context.req.raw));
+		const parsed = parseShareLink(url);
+		const account = await readStoreAuth();
+		if (parsed.origin !== DEFAULT_STORE_ORIGIN && parsed.origin !== account?.origin) throw new ReviewInputError("This share uses an untrusted service. Sign in to that service before opening its links.", 400);
+		const id = sharedReviewId(parsed.origin, parsed.shareId);
+		if (!imports.has(id)) {
+			shared.setStatus(id, "downloading");
+			const job = (async () => {
+				if (shared.has(id)) {
+					await shared.prepare(id);
+					return;
+				}
+				const bundle = await new ShareClient(parsed.origin).download(parsed.shareId, parsed.capability);
+				await shared.import(parsed.origin, parsed.shareId, bundle);
+			})().catch((error) => {
+				shared.setStatus(id, "error", error instanceof ReviewInputError ? error.message : "This share is unavailable, revoked, or needs a newer Whiteboard version.");
+			}).finally(() => imports.delete(id));
+			imports.set(id, job);
+			shared.trackImport(job);
+		}
+		return context.json({
+			reviewId: id,
+			...shared.status(id)
+		}, 202);
+	});
+}
+/** Publishing needs only an authored store, never Desktop or recipient workspaces. */
+function mountSharingPublisher(app, store, data, options = {}) {
+	const verifyRepository = options.verifyRepository ?? verifyShareRepository;
+	app.post("/sharing/publish", async (context) => {
+		const input = publishSchema.parse(await readBoundedRequestJson(context.req.raw));
+		if (input.reviewId.startsWith("shared-")) throw new ReviewInputError("Only the authoring review can be shared.", 409);
+		const snapshot = store.read(input.reviewId, input.version);
+		if (snapshot.target?.kind === "worktree") throw new ReviewInputError("Pin this review to commits before sharing it.");
+		validateShareSources(snapshot);
+		const account = await readSharingAuth();
+		if (!account) throw new ReviewInputError("Set DEV_REVIEW_SHARE_TOKEN for CI, or run whiteboard login before sharing.", 409);
+		const root = snapshot.pins ? store.repositoryPath(snapshot.pins.repositoryId) : void 0;
+		const repository = root ? await (options.readRepository ?? readShareRepository)(root) : void 0;
+		const bundle = await exportShare({
+			store,
+			data,
+			reviewId: input.reviewId,
+			version: snapshot.version,
+			repository
+		});
+		const verification = root && snapshot.pins && repository ? verifyRepository(root, snapshot.pins, repository).then(() => ({ ok: true }), (error) => ({
+			ok: false,
+			error
+		})) : Promise.resolve({ ok: true });
+		try {
+			const result = await new ShareClient(account.origin, account.token, options.fetch).create(bundle, input.requestId ?? randomUUID(), async () => {
+				const result = await verification;
+				if (!result.ok) throw result.error;
+			});
+			const url = new URL(result.url);
+			if (process.env.DEV_FAST_REVIEW_APP_URL_PROTOCOL === "dev-fast-review-preview") url.searchParams.set("app", "preview");
+			options.onPublished?.({
+				reviewId: input.reviewId,
+				version: snapshot.version
+			});
+			return context.json({
+				...result,
+				url: url.href,
+				version: snapshot.version
+			});
+		} catch (error) {
+			if (error instanceof SharePreflightError) return context.json({ error: error.message }, 422);
+			if (error instanceof ShareAuthError) {
+				if (process.env.DEV_REVIEW_SHARE_TOKEN === void 0) await clearStoreAuth();
+				throw new ReviewInputError("Your sign-in has expired. Sign in again to share.", 401);
+			}
+			throw new ReviewInputError("Sharing failed. Check your connection and login, then retry.", 409);
+		}
+	});
+	app.post("/sharing/revoke", async (context) => {
+		const { shareId } = z.strictObject({ shareId: shareIdSchema }).parse(await readBoundedRequestJson(context.req.raw));
+		const account = await readSharingAuth();
+		if (!account) throw new ReviewInputError("Set DEV_REVIEW_SHARE_TOKEN for CI, or run whiteboard login first.", 409);
+		await new ShareClient(account.origin, account.token).revoke(shareId);
+		options.onRevoked?.({ shareId });
+		return context.json({
+			shareId,
+			revoked: true
+		});
+	});
+}
+//#endregion
+//#region src/sharing/routes.ts
+/** Snapshot-backed reads used by the same HTTP routes as local reviews. */
+var SharedReviewData = class {
+	store;
+	constructor(store) {
+		this.store = store;
+	}
+	map(id, resourceId) {
+		const map = this.store.get(id).presentation.maps[resourceId];
+		if (!map) throw new ReviewInputError("Map is not included in this share.", 404);
+		return map;
+	}
+	async resource(id, resourceId) {
+		const resource = this.store.get(id).manifest.resources.find((item) => item.id === resourceId);
+		if (!resource) throw new ReviewInputError("Resource is not included in this share.", 404);
+		return {
+			data: await this.store.readObject(id, resource.object),
+			mimeType: resource.mimeType
+		};
+	}
+};
+//#endregion
+//#region src/review-api/anchor-quotes.ts
+const QUOTE_LIMIT = 20;
+const clip = (line) => line.trim() === "" ? "(blank line)" : line.length > 120 ? `${line.slice(0, 119)}…` : line;
+/**
+* The first and last line of each anchor an edit added or changed, so its
+* author can see a range is the one meant without reading the file again.
+* A range that can't be read was already rejected, so it is skipped here.
+* `unquoted` counts the anchors past the limit, so a short list isn't
+* mistaken for a complete one.
+*/
+async function anchorQuotes(before, after, read) {
+	const key = (id, source) => `${id}\0${selectionKey(source)}`;
+	const known = new Set(before ? selectionReferences(before.document, { tolerant: true }).map(({ id, source }) => key(id, source)) : []);
+	const added = selectionReferences(after.document, { tolerant: true }).filter(({ id, source }) => !known.has(key(id, source)));
+	return {
+		quotes: (await Promise.all(added.slice(0, QUOTE_LIMIT).map(async ({ source }) => {
+			try {
+				const pins = anchorPins(source, after.pins);
+				const line = async (endpoint) => (await read(pins, endpoint.side, source.file)).split("\n")[endpoint.line - 1] ?? "";
+				const first = clip(await line(source.start));
+				return source.start.side === source.end.side && source.start.line === source.end.line ? {
+					anchor: formatAnchor(source),
+					first
+				} : {
+					anchor: formatAnchor(source),
+					first,
+					last: clip(await line(source.end))
+				};
+			} catch {
+				return;
+			}
+		}))).filter((quote) => quote !== void 0),
+		unquoted: Math.max(0, added.length - QUOTE_LIMIT)
+	};
+}
+//#endregion
+//#region src/review-api/document-text.ts
+/** A reading view of saved content, not another document format to maintain. */
+function documentText(snapshot, targetId, full = false) {
+	const target = targetId === void 0 ? void 0 : elements(snapshot.document).find((item) => item.id === targetId);
+	if (targetId !== void 0 && !target) throw new ReviewInputError("Target not found in this version.", 404);
+	const detailed = full || target !== void 0;
+	const lines = [
+		`# ${snapshot.title}`,
+		`Session ${snapshot.reviewId} · version ${snapshot.version}`,
+		""
+	];
+	const write = (depth, text) => {
+		for (const line of text.split("\n")) lines.push("  ".repeat(depth) + line);
+	};
+	const code = (depth, value) => {
+		write(depth, `Code (${value.language}):`);
+		write(depth + 1, value.text);
+	};
+	const render = (element, depth) => {
+		const title = "title" in element ? element.title : void 0;
+		write(depth, `[${element.id}] ${element.type}${title ? `: ${title}` : ""}`);
+		const detail = (text) => write(depth + 1, text);
+		switch (element.type) {
+			case "section":
+			case "callout":
+				if (element.type === "callout") detail(`Tone: ${element.tone}`);
+				if (element.type === "section" && element.defaultCollapsed) detail("Initially collapsed");
+				element.children.forEach((child) => render(child, depth + 1));
+				break;
+			case "markdown":
+				detail(detailed ? element.markdown : element.markdown.split("\n")[0] + (element.markdown.includes("\n") ? " …" : ""));
+				break;
+			case "code":
+				if (element.caption) detail(element.caption);
+				if (detailed) code(depth + 1, element);
+				else detail(`${element.language}, ${element.text.split("\n").length} lines`);
+				break;
+			case "divider": break;
+			case "code_peek":
+				detail(element.source);
+				if (element.caption) detail(element.caption);
+				break;
+			case "sequence":
+				for (const [key, label] of Object.entries(element.actors)) detail(`Actor ${key}: ${label}`);
+				element.steps.forEach((step) => render(step, depth + 1));
+				break;
+			case "step":
+				detail(`${element.from} → ${element.to}: ${element.label} (${element.style})`);
+				if (element.source) detail(element.source);
+				if (detailed && element.explanation) detail(element.explanation);
+				if (detailed && element.code) code(depth + 1, element.code);
+				break;
+			case "call_stack_diff":
+				for (const side of ["base", "head"]) {
+					detail(`${side}:`);
+					element[side].forEach((frame) => {
+						write(depth + 2, `${frame.label ?? frame.key ?? "Frame"}: ${frame.source}`);
+						if (detailed && frame.via) write(depth + 3, `${frame.via.kind}: ${frame.via.reason}`);
+					});
+				}
+				break;
+			case "database_lens":
+				for (const [key, label] of Object.entries(element.actors)) detail(`Actor ${key}: ${label}`);
+				for (const [key, store] of Object.entries(element.stores)) {
+					detail(`Store ${key}: ${store.label} (${store.storage})`);
+					for (const [key, collection] of Object.entries(store.collections)) {
+						write(depth + 2, `Collection ${key}: ${collection.label}`);
+						if (detailed) for (const [key, field] of Object.entries(collection.fields)) write(depth + 3, `${key}: ${field.label}, ${field.dataType}${field.primaryKey ? ", primary key" : ""}${field.nullable ? ", nullable" : ""}${field.references ? ` → ${field.references.store}.${field.references.collection}.${field.references.field}` : ""}`);
+					}
+				}
+				for (const useCase of element.useCases) {
+					detail(`Use case: ${useCase.label}`);
+					if (detailed && useCase.summary) write(depth + 2, useCase.summary);
+					for (const operation of useCase.operations) write(depth + 2, `${operation.actor}: ${operation.kind} ${operation.store}.${operation.collection}${operation.field ? `.${operation.field}` : ""} — ${operation.label} (${operation.source})`);
+				}
+				break;
+			case "image":
+				detail(`${element.alt} (asset: ${element.assetId})`);
+				if (element.caption) detail(element.caption);
+				break;
+			case "trace_quote":
+				detail(`${element.traceId}, event ${element.eventId}`);
+				detail(element.text);
+				break;
+			case "flow_diagram":
+				if (element.description) detail(element.description);
+				for (const node of element.nodes) {
+					detail(`[${node.id}] ${node.key}: ${node.label}`);
+					if (detailed && node.description) write(depth + 2, node.description);
+					for (const attachment of node.attachments) write(depth + 2, `${attachment.label}: ${attachment.sources.join(", ")}`);
+				}
+				for (const edge of element.edges) detail(`[${edge.id}] ${edge.from} → ${edge.to}${edge.label ? `: ${edge.label}` : ""}`);
+				break;
+			case "software_map": detail(`Map: ${element.mapVersionId}${element.focusElementId ? `, focus: ${element.focusElementId}` : ""}`);
+		}
+	};
+	(target ? [target] : snapshot.document).forEach((element) => render(element, 0));
+	if (!snapshot.document.length) lines.push("(Empty review)");
+	if (!target && snapshot.lenses?.length) {
+		lines.push("", "Lenses (edit with session_lens_edit):");
+		for (const lens of snapshot.lenses) {
+			write(0, `[${lens.id}] ${lens.title}`);
+			for (const item of lens.targets) if (item.kind === "files") write(1, `Files: ${item.patterns.join(", ")}`);
+			else for (const source of item.sources) write(1, `Range: ${source}`);
+		}
+	}
+	if (!detailed && snapshot.document.length) lines.push("", "Use targetId for one component's complete content, or full:true for the whole review.");
+	return lines.join("\n");
+}
+//#endregion
+//#region src/review-api/file-lenses.ts
+/** Subtract authored coverage, independently of viewed state. */
+function uncategorizedSources(files, sources) {
+	return files.flatMap((file) => {
+		const covered = scopedCoverage(file, sources);
+		return coverageSources(file, {
+			base: subtractIntervals(file.changed.base, covered.base),
+			head: subtractIntervals(file.changed.head, covered.head)
+		});
+	});
+}
+/** Resolve all targets into one union; a whole-file range subsumes narrower ranges. */
+function resolveFileLens(lens, files, fileSources, resolve) {
+	const targets = lens.targets;
+	const selected = targets.flatMap((target) => target.kind === "ranges" ? target.sources.flatMap((source) => resolve(anchorSelection(source))) : files.filter((file) => matchesFileLens(target.patterns, file)).flatMap((file) => fileSources.get(file.path) ?? []));
+	const groups = /* @__PURE__ */ new Map();
+	for (const source of selected) {
+		const key = JSON.stringify([source.side, source.file]);
+		const group = groups.get(key) ?? [];
+		group.push(source);
+		groups.set(key, group);
+	}
+	const sources = [...groups.values()].flatMap((group) => unionIntervals(group.map((source) => [source.fromLine - 1, source.toLine])).map(([start, end]) => ({
+		...group[0],
+		fromLine: start + 1,
+		toLine: end
+	})));
+	return {
+		sources,
+		fileCount: new Set(sources.map((source) => files.find((file) => source.file === (source.side === "base" ? file.previousPath ?? file.path : file.path))?.path ?? source.file)).size,
+		wholeFiles: targets.every((target) => target.kind === "files")
+	};
+}
+/** Evaluate authored patterns against the changed-file list, never the filesystem. */
+function matchesFileLens(patterns, file) {
+	return patterns.some((pattern) => {
+		const normalized = pattern.startsWith("./") ? pattern.slice(2) : pattern;
+		return [file.path, file.previousPath].some((path) => path !== void 0 && (path === normalized || posix.matchesGlob(path, normalized)));
+	});
+}
+//#endregion
+//#region src/review-api/review-progress.ts
+const coverageModeSchema = z.enum(["structural", "textual"]).default("structural");
+const progressUpdateSchema = z.strictObject({
+	mode: coverageModeSchema,
+	version: z.number().int().nonnegative(),
+	files: z.array(z.strictObject({
+		path: z.string(),
+		fingerprint: z.string().min(1),
+		sources: z.array(fileLineRangeSchema)
+	})).max(1e4),
+	viewed: z.boolean()
+});
+/** Coverage survives new pins only when both complete file contents are unchanged. */
+async function reviewProgress(store, data, snapshot, signal = new AbortController().signal, mode = "structural", partial) {
+	const marks = snapshot.shared ? /* @__PURE__ */ new Map() : store.viewedCoverage(snapshot.reviewId);
+	const pins = snapshot.pins ? (await data.resolveSource(snapshot)).pins : void 0;
+	const comparison = pins ? partial ?? await data.coverage(snapshot.reviewId, pins, mode) : {
+		files: [],
+		fileSources: /* @__PURE__ */ new Map(),
+		alignments: /* @__PURE__ */ new Map()
+	};
+	signal.throwIfAborted();
+	const documentKey = JSON.stringify(pins);
+	const comparisons = /* @__PURE__ */ new Map();
+	/** The comparison a reference's own pins name, shared across references. */
+	const ownComparison = (own) => {
+		const key = JSON.stringify(own);
+		let loading = comparisons.get(key);
+		if (loading) return loading;
+		if (partial) {
+			if (data.coverageSnapshot(snapshot.reviewId, own, mode).pending) return void 0;
+		}
+		loading = data.coverage(snapshot.reviewId, own, mode);
+		comparisons.set(key, loading);
+		return loading;
+	};
+	const withViewed = (file) => ({
+		...file,
+		viewed: marks.get(file.path)?.fingerprint === file.fingerprint ? marks.get(file.path).coverage : emptyCoverage()
+	});
+	const files = comparison.files.map(withViewed);
+	const referenceFiles = {};
+	const fileSources = new Map(comparison.fileSources);
+	const alignments = new Map(comparison.alignments);
+	const resolvedSelections = {};
+	const unavailableSelections = {};
+	const pendingSources = /* @__PURE__ */ new Set();
+	const resolve = async (source) => {
+		const key = selectionKey(source);
+		if (resolvedSelections[key]) return resolvedSelections[key];
+		const sourcePins = anchorPins(source, pins);
+		const own = JSON.stringify(sourcePins) !== documentKey;
+		let ownFiles = files;
+		let ownAlignments = alignments;
+		if (own) {
+			const loading = ownComparison(sourcePins);
+			if (!loading) {
+				pendingSources.add(key);
+				return [];
+			}
+			const loaded = await loading;
+			ownFiles = loaded.files;
+			ownAlignments = loaded.alignments;
+		}
+		const file = ownFiles.find((file) => source.file === file.path || source.file === file.previousPath);
+		if (own) {
+			const group = referenceFiles[comparisonKey(sourcePins)] ??= {};
+			if (file) group[file.path] ??= withViewed(file);
+		}
+		let rows = file && ownAlignments.get(file.path);
+		if (!file && partial && !own) {
+			pendingSources.add(key);
+			return [];
+		}
+		if (!file) {
+			const [base, head] = await Promise.all([data.file(sourcePins, "base", source.file), data.file(sourcePins, "head", source.file)]);
+			if (base.text !== head.text) throw new Error("Changed context file has no alignment.");
+			rows = Array.from({ length: base.text.split("\n").length }, (_, line) => [line, line]);
+		}
+		if (!rows) throw new Error("File has no text alignment.");
+		const result = resolveDiffSelection(source, rows, file ?? { path: source.file });
+		resolvedSelections[key] = result;
+		return result;
+	};
+	const resolveAvailable = async (source) => {
+		try {
+			return await resolve(source);
+		} catch {
+			unavailableSelections[selectionKey(source)] = "Source links need updating at these pins";
+			return [];
+		}
+	};
+	const lenses = await Promise.all((snapshot.lenses ?? []).map(async (authored) => {
+		const lens = {
+			id: authored.id,
+			title: authored.title
+		};
+		try {
+			await Promise.all(lensSelections([authored]).map(({ source }) => resolveAvailable(source)));
+			const resolved = resolveFileLens(authored, files, fileSources, (source) => resolvedSelections[selectionKey(source)] ?? []);
+			return {
+				...lens,
+				...resolved,
+				pending: !!partial,
+				unavailable: partial || resolved.fileCount ? void 0 : "No files match these targets"
+			};
+		} catch {
+			return {
+				...lens,
+				sources: [],
+				unavailable: "Source links need updating at these pins"
+			};
+		}
+	}));
+	await Promise.all(selectionReferences(snapshot.document, { tolerant: true }).map(async ({ source }) => {
+		try {
+			await resolveAvailable(source);
+		} catch {}
+	}));
+	const uncategorized = partial ? [] : uncategorizedSources(files, lenses.filter((lens) => !lens.unavailable).flatMap((lens) => lens.sources));
+	lenses.push({
+		id: UNCATEGORIZED_LENS_ID,
+		title: "Uncategorized changes",
+		sources: uncategorized,
+		wholeFiles: false,
+		fileCount: new Set(uncategorized.map((source) => files.find((file) => source.file === (source.side === "base" ? file.previousPath ?? file.path : file.path))?.path ?? source.file)).size,
+		pending: !!partial,
+		unavailable: partial || uncategorized.length ? void 0 : "All changed lines are covered by lenses"
+	});
+	const progress = {
+		complete: !partial,
+		files,
+		referenceFiles,
+		lenses,
+		resolvedSelections,
+		unavailableSelections
+	};
+	const untrackedFiles = pins ? await data.untrackedFiles(pins) : void 0;
+	if (untrackedFiles) progress.untrackedFiles = untrackedFiles;
+	return progress;
+}
+/** The most files an uncategorized report names; the rest are counted. */
+const REPORT_FILES = 50;
+/** What a lens author still has to place: the changed lines no lens selects,
+* grouped by file. */
+function uncategorizedReport(progress) {
+	const sources = progress.lenses.find((lens) => lens.id === "automatic-uncategorized")?.sources ?? [];
+	const byPath = /* @__PURE__ */ new Map();
+	for (const source of sources) {
+		const path = progress.files.find((file) => source.file === (source.side === "base" ? file.previousPath ?? file.path : file.path))?.path ?? source.file;
+		const entry = byPath.get(path) ?? {
+			path,
+			lines: 0,
+			ranges: []
+		};
+		entry.lines += source.toLine - source.fromLine + 1;
+		entry.ranges.push({
+			side: source.side,
+			fromLine: source.fromLine,
+			toLine: source.toLine
+		});
+		byPath.set(path, entry);
+	}
+	const files = [...byPath.values()];
+	const report = {
+		lines: files.reduce((total, file) => total + file.lines, 0),
+		files: files.slice(0, REPORT_FILES)
+	};
+	if (files.length > REPORT_FILES) report.moreFiles = files.length - REPORT_FILES;
+	return report;
+}
+/** Each lens as authored, with what it resolves to, for a lens author. */
+function lensReport(lenses, progress) {
+	return {
+		lenses: lenses.map((lens) => {
+			const resolved = progress.lenses.find((item) => item.id === lens.id);
+			return {
+				...lens,
+				fileCount: resolved?.fileCount ?? 0,
+				...resolved?.unavailable && { unavailable: resolved.unavailable }
+			};
+		}),
+		uncategorized: uncategorizedReport(progress)
+	};
+}
+//#endregion
+//#region src/review-api/traces.ts
+async function listPinnedTraces(cwd, pins, override) {
+	const selection = selectTraceStorage();
+	const sources = [];
+	if (selection.s3?.credentials || isS3MockMode()) sources.push("s3");
+	if (selection.hosted) sources.push("hosted");
+	const result = {
+		ok: true,
+		configured: isTraceStorageConfigured(),
+		storage: override ?? selection.mode,
+		sources
+	};
+	try {
+		if (selection.error) return {
+			...result,
+			storageError: selection.error,
+			sessions: []
+		};
+		const storage = await resolveTraceStorage({
+			cwd,
+			override
+		});
+		if (!storage && (override ?? selection.mode) === "hosted") return {
+			...result,
+			storageError: "The hosted trace store has no login on this machine. Run `whiteboard login` and open the review again.",
+			sessions: []
+		};
+		return {
+			...result,
+			sessions: await listReviewTraceSessions({
+				rootPath: cwd,
+				baseCommit: pins.base,
+				headCommit: pins.head,
+				storage
+			})
+		};
+	} catch (error) {
+		if (error instanceof TraceStorageDeniedError || error instanceof TraceConfigurationError) return {
+			...result,
+			storageError: error.message,
+			sessions: []
+		};
+		throw error;
+	}
+}
+async function readStoredTrace(cwd, sessionId, trace, override) {
+	try {
+		const storage = await resolveTraceStorage({
+			cwd,
+			override
+		});
+		const loaded = await loadReviewAgentTrace({
+			cwd,
+			sessionId,
+			trace,
+			storage
+		});
+		if (!loaded) return {
+			ok: false,
+			status: 404,
+			error: `Trace not found for session ${sessionId}.`
+		};
+		return {
+			ok: true,
+			parserVersion: loaded.parserVersion,
+			session: loaded.descriptor,
+			trace: loaded.traceName,
+			cacheStatus: loaded.cacheStatus,
+			subagents: loaded.subagents,
+			title: loaded.trace.title,
+			startedAt: loaded.trace.startedAt,
+			endedAt: loaded.trace.endedAt,
+			activeMs: loaded.trace.activeMs,
+			userTurns: loaded.trace.userTurns,
+			toolCalls: loaded.trace.toolCalls,
+			events: loaded.trace.events
+		};
+	} catch (error) {
+		if (error instanceof TraceStorageDeniedError || error instanceof TraceConfigurationError) return {
+			ok: false,
+			status: error instanceof TraceStorageDeniedError ? 403 : 400,
+			error: error.message
+		};
+		throw error;
+	}
+}
+//#endregion
+//#region src/review-api/http.ts
+const askStartSchema = z.strictObject({
+	agent: z.enum(askAgentIds),
+	question: askQuestionSchema,
+	selection: AgentSelectionSchema,
+	picks: askPicksSchema.optional(),
+	bypass: z.boolean().optional()
+});
+const askPermitSchema = z.strictObject({ bypass: z.boolean() });
+const askOpenSchema = z.strictObject({ picks: askPicksSchema.optional() });
+const askChoiceSchema = z.strictObject({
+	kind: z.enum(askChoiceKinds),
+	value: z.string().min(1).max(200)
+});
+const askFilesSchema = z.strictObject({ paths: z.array(z.string().min(1).max(400)).max(100) });
+const askFollowUpSchema = z.strictObject({ question: askQuestionSchema });
+/** A question with its images: four of up to 5 MB each, base64. */
+const ASK_REQUEST_MAX_BYTES = 31457280;
+const askMentionsSchema = z.object({
+	query: z.string().max(400).default(""),
+	/** A conversation's checkout, which can be an earlier version's. */
+	thread: z.string().optional()
+});
+const askOfferQuerySchema = z.object({ 
+/** The model picked for a question not yet asked. */
+model: askPicksSchema.shape.model });
+/** How many files a mention picker shows. */
+const MENTION_LIMIT = 20;
+const askDecisionSchema = z.strictObject({
+	permissionId: z.string().min(1),
+	optionId: z.string().min(1)
+});
+const SCRATCHPAD_DISABLED = "The scratchpad is off. Turn it on in Whiteboard Desktop Settings.";
+/** A gateway forwarding from another machine; it gets no local paths. */
+const remoteCaller = (context) => context.req.header(REVIEW_CLIENT_HEADER) === REVIEW_CLIENT_REMOTE;
+/** Both hosts mount this behind their token authentication. */
+function createReviewApi(store, data, open, shared, capabilities = () => ({
+	desktopAvailable: Boolean(open),
+	softwareMapEnabled: false
+}), scratchpadEnabled = () => false, traceEnabled = async () => false, status = () => ({}), hooks = {}, ask) {
+	const app = new Hono();
+	app.onError((error, context) => {
+		if (error instanceof HttpJsonError) return context.json({ error: error.message }, error.statusCode);
+		if (error instanceof ReviewInputError) return context.json({ error: error.message }, error.status);
+		if (error instanceof z.ZodError) return context.json({
+			error: z.prettifyError(error),
+			issues: error.issues
+		}, 400);
+		console.error(`[Review API] ${context.req.method} ${context.req.path} failed:`, error);
+		return context.json({ error: `Whiteboard operation failed (${failureKind(error)}). The server logged the cause; Whiteboard Desktop writes it to main.log in its logs folder.` }, 500);
+	});
+	if (data) app.use("*", async (context, next) => {
+		if (context.req.method === "GET" && !context.req.query("version")) await store.refreshWorktrees();
+		await next();
+	});
+	const sharedData = shared ? new SharedReviewData(shared) : void 0;
+	const isShared = (id) => id.startsWith("shared-");
+	const sharedCommandSchema = z.object({ operation: z.object({ reviewId: z.string().optional() }) });
+	const ensureScratchpad = async (id) => {
+		if (open && scratchpadEnabled() && (!id || id === SCRATCHPAD_ID)) await store.ensureScratchpad();
+	};
+	const refuseDisabledScratchpad = (id) => {
+		if (id === SCRATCHPAD_ID && !scratchpadEnabled()) throw new ReviewInputError(SCRATCHPAD_DISABLED, 409);
+	};
+	const sharedGuard = async (context, next) => {
+		refuseDisabledScratchpad(context.req.param("id"));
+		await ensureScratchpad(context.req.param("id"));
+		const id = context.req.param("id");
+		if (!id || !isShared(id)) return next();
+		const query = readQuerySchemas.get.parse({ version: context.req.query("version") });
+		readReview(id, query.version);
+		if (context.req.method !== "GET" && !/\/(open|source|copy-context|environment)$/.test(context.req.path) && !/\/workspaces\/[^/]+\/retry$/.test(context.req.path)) throw new ReviewInputError("Shared reviews are read-only.", 409);
+		return next();
+	};
+	app.use("/:id", sharedGuard);
+	app.use("/:id/*", sharedGuard);
+	if (shared && data) {
+		shared.connect(store, data);
+		mountSharingHost(app, store, data, shared, hooks.sharing);
+	}
+	const readReview = (id, version) => {
+		if (!id.startsWith("shared-")) return store.read(id, version);
+		const snapshot = shared?.get(id).snapshot;
+		if (!snapshot || version !== void 0 && version !== snapshot.version) throw new ReviewInputError("Shared review version is unavailable.", 404);
+		return snapshot;
+	};
+	const catalog = (mode = "structural") => {
+		const local = store.list(mode);
+		return [...scratchpadEnabled() ? local : local.filter((summary) => summary.kind !== "scratchpad"), ...shared?.list(mode) ?? []];
+	};
+	app.get("/", async (context) => {
+		await ensureScratchpad();
+		return context.json(catalog(coverageModeSchema.parse(context.req.query("mode"))));
+	});
+	const instructionContext = async () => ({
+		desktopAvailable: Boolean(open),
+		scratchpadEnabled: scratchpadEnabled(),
+		traceEnabled: await traceEnabled()
+	});
+	app.get("/authoring", async (context) => {
+		const instructions = await instructionContext();
+		return context.json(authoringTools(scratchpadAvailable(instructions), instructions.traceEnabled));
+	});
+	app.get("/instructions", async (context) => {
+		const { topic } = instructionsQuerySchema.parse(context.req.query());
+		return context.json(await renderInstructions(topic, await instructionContext()));
+	});
+	app.get("/:id/progress", async (context) => {
+		if (!data) throw new ReviewInputError("Source data is unavailable.", 409);
+		const query = readQuerySchemas.get.pick({ version: true }).extend({
+			mode: coverageModeSchema,
+			wait: z.enum(["false", "true"]).default("true")
+		}).parse(context.req.query());
+		const snapshot = readReview(context.req.param("id"), query.version);
+		const documentPins = query.wait === "false" && snapshot.pins ? (await data.resolveSource(snapshot)).pins : void 0;
+		if (documentPins) {
+			const state = data.coverageSnapshot(snapshot.reviewId, documentPins, query.mode);
+			if (state.pending) return context.json(await reviewProgress(store, data, snapshot, context.req.raw.signal, query.mode, state.comparison), 202);
+		}
+		return context.json(await reviewProgress(store, data, snapshot, context.req.raw.signal, query.mode));
+	});
+	app.post("/:id/progress", async (context) => {
+		if (!data) throw new ReviewInputError("Source data is unavailable.", 409);
+		const input = progressUpdateSchema.parse(await readBoundedRequestJson(context.req.raw));
+		const id = context.req.param("id");
+		const snapshot = store.read(id);
+		const progress = await reviewProgress(store, data, snapshot, context.req.raw.signal, input.mode);
+		const files = input.files.map((update) => {
+			const file = progress.files.find((file) => file.path === update.path);
+			if (!file || file.fingerprint !== update.fingerprint) throw new ReviewInputError("This file changed. Reload before marking it viewed.", 409);
+			return {
+				path: file.path,
+				fingerprint: file.fingerprint,
+				scope: scopedCoverage(file, update.sources)
+			};
+		});
+		if (store.read(id).version !== snapshot.version) throw new ReviewInputError("Review changed during this update. Try again.", 409);
+		store.updateViewedCoverage(id, files, input.viewed);
+		return context.json(await reviewProgress(store, data, store.read(id, input.version), context.req.raw.signal, input.mode));
+	});
+	app.get("/:id/lenses", async (context) => {
+		if (!data) throw new ReviewInputError("Source data is unavailable.", 409);
+		const snapshot = readReview(context.req.param("id"));
+		return context.json({
+			version: snapshot.version,
+			...lensReport(snapshot.lenses ?? [], await reviewProgress(store, data, snapshot, context.req.raw.signal))
+		});
+	});
+	app.get("/status", async (context) => context.json({
+		...status(),
+		desktopAvailable: (await capabilities()).desktopAvailable
+	}));
+	app.get("/capabilities", async (context) => context.json({
+		...await capabilities(),
+		scratchpadEnabled: scratchpadEnabled()
+	}));
+	app.get("/:id/activity", (context) => {
+		const id = context.req.param("id");
+		readReview(id);
+		return context.json(isShared(id) ? {
+			workingCount: 0,
+			expiresAt: null
+		} : store.activity.read(id));
+	});
+	for (const action of [
+		"begin",
+		"update",
+		"end"
+	]) app.post(`/:id/activity/${action}`, async (context) => {
+		const input = await readBoundedRequestJson(context.req.raw);
+		const id = context.req.param("id");
+		store.assertExists(id);
+		return context.json(store.activity.update(id, isJsonObject(input) ? {
+			...input,
+			action
+		} : input));
+	});
+	app.get("/watch", async (context) => {
+		const query = context.req.query("subscriptions");
+		if (query !== void 0) {
+			let input;
+			try {
+				input = JSON.parse(query);
+			} catch {
+				throw new ReviewInputError("Invalid subscriptions.");
+			}
+			const subscriptions = z.array(z.strictObject({
+				reviewId: z.string().min(1).nullable(),
+				mode: coverageModeSchema
+			})).parse(input);
+			const dirty = new Set(subscriptions.keys());
+			const mark = (id) => {
+				let marked = false;
+				subscriptions.forEach((item, index) => {
+					if (item.reviewId === id) {
+						dirty.add(index);
+						marked = true;
+					}
+				});
+				return marked;
+			};
+			return watch$1(() => subscriptions.map(({ reviewId, mode }, index) => {
+				if (!dirty.delete(index)) return null;
+				try {
+					return { value: reviewId === null ? catalog(mode) : {
+						...readReview(reviewId),
+						activity: store.activity.read(reviewId),
+						coverageRevision: data?.coverageRevision ?? 0
+					} };
+				} catch (error) {
+					return { error: error instanceof ReviewInputError ? error.message : "Could not read review." };
+				}
+			}), (notify) => {
+				const stops = [
+					store.watchWorktrees(),
+					data?.subscribeCoverage(() => {
+						subscriptions.forEach((item, index) => {
+							if (item.reviewId !== null) dirty.add(index);
+						});
+						if (dirty.size > 0) notify();
+					}) ?? (() => {}),
+					store.subscribe((result) => {
+						if (mark(result.reviewId)) notify();
+					}),
+					store.activity.subscribe((id) => {
+						if (mark(id)) notify();
+					}),
+					store.activity.subscribeWorking(() => {
+						if (mark(null)) notify();
+					}),
+					shared?.subscribe(() => {
+						if (mark(null)) notify();
+					}) ?? (() => {}),
+					store.subscribeCatalog(() => {
+						if (mark(null)) notify();
+					})
+				];
+				return () => stops.forEach((stop) => stop());
+			}, () => {});
+		}
+		await ensureScratchpad();
+		return watch$1(() => catalog(coverageModeSchema.parse(context.req.query("mode"))), (notify) => {
+			const local = store.subscribeCatalog(notify);
+			const activity = store.activity.subscribeWorking(notify);
+			const imported = shared?.subscribe(notify);
+			return () => {
+				local();
+				activity();
+				imported?.();
+			};
+		});
+	});
+	/** Show a review in Desktop and start preparing its pinned checkouts. */
+	const openReview = async (review) => {
+		if (!open) throw new ReviewInputError("The desktop is not connected.", 409);
+		const settings = await open({
+			reviewId: review.reviewId,
+			title: review.title
+		});
+		let environmentIssues;
+		try {
+			if (review.target?.kind === "commits" && review.pins) data?.workspaces.open(review.reviewId, review.pins).catch(() => {});
+			environmentIssues = data?.currentEnvironmentIssues(review);
+		} catch (error) {
+			environmentIssues = [{ message: `Could not check language checkouts: ${errorMessage(error)}. Recheck with review_environment.` }];
+		}
+		return {
+			...settings,
+			environmentIssues: environmentIssues?.length ? environmentIssues : void 0
+		};
+	};
+	/**
+	* A created or returned review is shown where Desktop can, unless the author asked
+	* not to. The review is already saved, so a failed open is reported, not thrown.
+	*/
+	const openCreated = async (reviewId) => {
+		try {
+			if (!open || !(await capabilities()).desktopAvailable) return { opened: false };
+			return {
+				opened: true,
+				...await openReview(store.read(reviewId))
+			};
+		} catch (error) {
+			return {
+				opened: false,
+				openError: `${errorMessage(error)} Retry with review_open.`
+			};
+		}
+	};
+	app.post("/:id/open", async (context) => {
+		const id = context.req.param("id");
+		if (isShared(id)) await shared?.assertReady(id);
+		return context.json({
+			ok: true,
+			...await openReview(readReview(id))
+		});
+	});
+	app.get("/:id/watch", (context) => {
+		const id = context.req.param("id");
+		let document;
+		return watch$1(() => ({
+			...document ??= readReview(id),
+			activity: isShared(id) ? {
+				workingCount: 0,
+				expiresAt: null
+			} : store.activity.read(id)
+		}), (notify) => {
+			const stopRefresh = store.watchWorktrees();
+			const stopDocument = store.subscribe((result) => {
+				if (result.reviewId === id) {
+					document = void 0;
+					notify();
+				}
+			});
+			const stopActivity = store.activity.subscribe((changed) => {
+				if (changed === id) notify();
+			});
+			return () => {
+				stopRefresh();
+				stopDocument();
+				stopActivity();
+			};
+		});
+	});
+	if (data) {
+		const traceQuery = readQuerySchemas.maps.extend({
+			storage: z.enum(["s3", "hosted"]).optional(),
+			trace: z.string().min(1).optional()
+		});
+		const tracePins = (id, version) => {
+			const { pins } = readReview(id, version);
+			if (!pins) throw new ReviewInputError("This document has no source pins of its own.", 409);
+			return pins;
+		};
+		app.get("/:id/agent-traces", async (context) => {
+			const query = traceQuery.parse(context.req.query());
+			const pins = tracePins(context.req.param("id"), query.version);
+			return context.json(await listPinnedTraces(store.repositoryPath(pins.repositoryId), pins, query.storage));
+		});
+		app.get("/:id/agent-traces/:sessionId", async (context) => {
+			const query = traceQuery.parse(context.req.query());
+			const pins = tracePins(context.req.param("id"), query.version);
+			const result = await readStoredTrace(store.repositoryPath(pins.repositoryId), context.req.param("sessionId"), query.trace, query.storage);
+			if (!result.ok) return context.json({
+				ok: false,
+				error: result.error
+			}, result.status);
+			return context.json(result);
+		});
+		app.post("/:id/navigator", async (context) => {
+			if (remoteCaller(context)) throw new ReviewInputError("Source windows are not available for a review on another machine.", 409);
+			const input = readQuerySchemas.file.extend({
+				side: z.enum(["base", "head"]).default("head"),
+				file: z.string().min(1).optional(),
+				empty: z.literal("true").optional()
+			}).parse(context.req.query());
+			return context.json(await data.navigatorWorkspace(readReview(context.req.param("id"), input.version), {
+				...input,
+				empty: input.empty === "true",
+				anchor: queryAnchor(input)
+			}));
+		});
+		app.get("/:id/tree", async (context) => {
+			const input = readQuerySchemas.tree.parse(context.req.query());
+			const { pins } = await data.resolveSource(readReview(context.req.param("id"), input.version), input.commit, queryAnchor(input));
+			return context.json(await data.tree(pins, input.side, input.path));
+		});
+		app.get("/:id/maps/:resourceId", async (context) => {
+			const query = readQuerySchemas.maps.parse(context.req.query());
+			const id = context.req.param("id");
+			if (id && isShared(id)) return context.json(sharedData.map(id, z.string().parse(context.req.param("resourceId"))));
+			return context.json(await data.map(await data.sourcePins(readReview(id, query.version)), z.string().parse(context.req.param("resourceId"))));
+		});
+		app.post("/repositories", async (context) => {
+			const input = z.strictObject({ path: z.string().min(1) }).parse(await readBoundedRequestJson(context.req.raw));
+			return context.json(await data.register(input.path));
+		});
+		app.post("/resources", async (context) => context.json(await data.upload(await readBoundedRequestJson(context.req.raw, 8388608))));
+		app.get("/:id/resources/:resourceId", async (context) => {
+			const id = context.req.param("id");
+			const snapshot = readReview(id);
+			const resource = id && isShared(id) ? {
+				...await sharedData.resource(id, z.string().parse(context.req.param("resourceId"))),
+				repositoryId: snapshot.pins?.repositoryId ?? ""
+			} : store.resource(z.string().parse(context.req.param("resourceId")));
+			if (snapshot.pins && resource.repositoryId !== snapshot.pins.repositoryId) throw new ReviewInputError("Resource is outside this repository.", 404);
+			return new Response(Buffer.from(resource.data), { headers: {
+				"content-type": resource.mimeType,
+				"x-content-type-options": "nosniff"
+			} });
+		});
+		app.get("/:id/language-context", async (context) => {
+			const input = readQuerySchemas.maps.extend({
+				side: z.enum(["base", "head"]).default("head"),
+				commit: z.string().optional(),
+				repositoryId: z.string().optional(),
+				head: z.string().optional(),
+				base: z.string().optional()
+			}).parse(context.req.query());
+			const snapshot = readReview(context.req.param("id"), input.version);
+			const environment = await data.languageEnvironment(snapshot, input.side, input.commit, false, queryAnchor(input));
+			return context.json(remoteCaller(context) ? {
+				identity: createHash("sha256").update(environment.identity).digest("hex"),
+				...environment.issue && { issue: "The checkout for language features is not available on the remote machine." }
+			} : environment);
+		});
+		app.post("/:id/environment", async (context) => {
+			const input = z.strictObject({ retry: z.boolean().optional() }).parse(await readBoundedRequestJson(context.req.raw));
+			return context.json({ issues: await data.environmentIssues(readReview(context.req.param("id")), input.retry) });
+		});
+		app.post("/workspace-cleanup", async (context) => {
+			const input = z.strictObject({ workspaceId: z.string().min(1).optional() }).parse(await readBoundedRequestJson(context.req.raw));
+			if (input.workspaceId) await data.workspaces.retryCleanup(input.workspaceId);
+			return context.json({ failures: data.workspaces.failures() });
+		});
+		app.get("/:id/workspaces", (context) => {
+			readReview(context.req.param("id"));
+			return context.json(data.workspaces.list(context.req.param("id")));
+		});
+		app.post("/:id/workspaces/:workspaceId/retry", async (context) => {
+			return context.json(await data.workspaces.retry(context.req.param("id"), context.req.param("workspaceId")));
+		});
+		app.get("/:id/file", async (context) => {
+			const input = readQuerySchemas.file.extend({ binary: z.literal("describe").optional() }).parse(context.req.query());
+			const id = context.req.param("id");
+			const anchor = queryAnchor(input);
+			const { snapshot, pins } = await data.resolveSource(readReview(id, input.version), input.commit, anchor);
+			const file = await data.file(pins, input.side, input.file, input.binary === "describe");
+			if (file.text.includes("\0")) return context.json({
+				binary: true,
+				file: file.file,
+				side: file.side,
+				commit: file.commit
+			});
+			const local = !remoteCaller(context) && !input.commit && !anchor && input.side === "head" && snapshot.target?.kind === "worktree" ? await data.liveFile(pins.repositoryId, input.file, file.text) : void 0;
+			return context.json({
+				...file,
+				...local
+			});
+		});
+		app.get("/:id/structural-diff", async (context) => {
+			const input = readQuerySchemas.structuralDiff.parse(context.req.query());
+			const id = context.req.param("id");
+			const { pins } = await data.resolveSource(readReview(id, input.version), input.commit, queryAnchor(input));
+			const abort = new AbortController();
+			const encoder = new TextEncoder();
+			const stream = new ReadableStream({
+				async start(controller) {
+					const send = (event) => {
+						if (!abort.signal.aborted) controller.enqueue(encoder.encode(JSON.stringify(event) + "\n"));
+					};
+					try {
+						for await (const event of data.structuralChanges({
+							reviewId: id,
+							pins,
+							signal: AbortSignal.any([context.req.raw.signal, abort.signal]),
+							file: input.file
+						})) send(event);
+					} catch (error) {
+						send({
+							type: "error",
+							message: error instanceof Error ? error.message : String(error)
+						});
+					} finally {
+						if (!abort.signal.aborted) controller.close();
+					}
+				},
+				cancel() {
+					abort.abort();
+				}
+			});
+			return new Response(stream, { headers: {
+				"content-type": "application/x-ndjson",
+				"cache-control": "no-store"
+			} });
+		});
+		app.get("/:id/diff", async (context) => {
+			const input = readQuerySchemas.diff.parse(context.req.query());
+			const { pins } = await data.resolveSource(readReview(context.req.param("id"), input.version), input.commit, queryAnchor(input));
+			return context.json(await data.changes(pins));
+		});
+		app.get("/:id/commits", async (context) => {
+			const input = readQuerySchemas.commits.parse(context.req.query());
+			return context.json(await data.commits((await data.resolveSource(readReview(context.req.param("id"), input.version))).pins));
+		});
+	}
+	app.post("/:id/copy-context", async (context) => {
+		const query = readQuerySchemas.get.pick({ version: true }).extend({ mode: coverageModeSchema }).parse(context.req.query());
+		const selection = AgentSelectionSchema.parse(await readBoundedRequestJson(context.req.raw));
+		return context.json({ text: await selectionContext(context.req.param("id"), selection, query.version) });
+	});
+	/** The Markdown an agent gets for a selection, copied or asked about. */
+	async function selectionContext(reviewId, selection, version) {
+		if (selection.apiSource && selection.apiSource.reviewId !== reviewId) throw new ReviewInputError("Selection belongs to another review.");
+		const snapshot = readReview(reviewId, selection.apiSource?.version ?? version);
+		const target = selection.target;
+		let excerpt = "";
+		if (target.kind === "code" && !selection.selectedDiff) {
+			if (!data) throw new ReviewInputError("Source data is unavailable.", 409);
+			const source = await data.quote((await data.resolveSource(snapshot, selection.apiSource?.commit, selection.apiSource?.pins)).pins, {
+				side: target.side,
+				file: target.path,
+				fromLine: target.startLine,
+				toLine: target.endLine
+			});
+			excerpt = `## ${target.side}: ${target.path}:${target.startLine}-${target.endLine} (${source.commit})\n` + source.text.split("\n").map((line) => `    ${line}`).join("\n");
+		}
+		const diff = selection.selectedDiff;
+		const text = selectionMarkdown(selection, excerpt, diff ? {
+			base: `a/${diff.oldPath}`,
+			head: `b/${diff.newPath}`
+		} : void 0);
+		return [
+			`Selected ${target.kind === "text" ? "text" : "code"} from Whiteboard: ${snapshot.title}`,
+			`Session ID: ${snapshot.reviewId}`,
+			`Version: ${snapshot.version}`,
+			...selection.apiSource?.commit ? [`Selected commit: ${selection.apiSource.commit}`] : [],
+			...selection.apiSource?.pins ? [
+				`Selected repository ID: ${selection.apiSource.pins.repositoryId}`,
+				...selection.apiSource.pins.base ? [`Selected base: ${selection.apiSource.pins.base}`] : [],
+				`Selected head: ${selection.apiSource.pins.head}`
+			] : [],
+			...snapshot.pins ? [
+				`Repository ID: ${snapshot.pins.repositoryId}`,
+				`Session base: ${snapshot.pins.base}`,
+				`Session head: ${snapshot.pins.head}`
+			] : [],
+			`Read this version with session_get({"sessionId":"${snapshot.reviewId}","version":${snapshot.version},"full":true}).`,
+			"",
+			text,
+			"",
+			""
+		].join("\n");
+	}
+	if (ask && data) {
+		const readThread = (reviewId, threadId) => {
+			const thread = ask.threads.get(threadId);
+			if (!thread || thread.reviewId !== reviewId) throw new ReviewInputError("This conversation has ended.", 404);
+			return thread;
+		};
+		/** What an agent reads before a session's first question: the review,
+		* the checkout, and the selection. */
+		const askContext = async (agent, snapshot, checkout, selection, version) => {
+			const reach = await ask.threads.reach(agent);
+			const { reviewId } = snapshot;
+			return [
+				`A reviewer is reading "${snapshot.title}" in Whiteboard and has a question about a selection.`,
+				checkout.live ? "Your working directory is the repository the review describes." : `Your working directory is a checkout of the review's head commit, ${checkout.head}. Answer from this code, not from other branches.`,
+				"Answer the question.",
+				"Name files by their path from the checkout root, with a line where it helps, as in `src/app.ts:42`; the reviewer can open them from your answer.",
+				...reach?.kind === "mcp" ? [`The whiteboard MCP tools read and change this review: its sessionId is "${reviewId}". Read it with session_get. If the reviewer asks you to change the review, edit it with session_edit; do not write files to do it.`] : reach?.kind === "cli" ? [`Whiteboard's CLI reads and changes this review from your shell: its sessionId is "${reviewId}". Read it with \`${reach.command} api session_get '{"sessionId":"${reviewId}"}'\`. If the reviewer asks you to change the review, edit it with \`${reach.command} api session_edit '<json>'\`; do not write files to do it. \`${reach.command} api tools\` lists each tool's input.`] : [],
+				"",
+				await selectionContext(reviewId, selection, version)
+			].join("\n");
+		};
+		app.get("/:id/ask/agents", async (context) => context.json({ agents: await ask.agents() }));
+		app.get("/:id/ask/agents/:agent/offer", async (context) => {
+			const agent = z.enum(askAgentIds).parse(context.req.param("agent"));
+			const { model } = askOfferQuerySchema.parse(context.req.query());
+			const stored = store.askHistory.offer(agent);
+			const last = stored && Object.keys(stored.choices).length ? stored : void 0;
+			const models = last?.choices.model;
+			const another = model !== void 0 && model !== models?.current && (!models || models.options.some((option) => option.value === model));
+			const known = another ? store.askHistory.offer(agent, model) : last;
+			if (known) return context.json({ offer: known });
+			const checkout = await data.agentCheckout(readReview(context.req.param("id")));
+			const offer = await ask.threads.offered(agent, checkout.rootPath, another ? model : void 0);
+			if (last) store.askHistory.saveModelOffer(agent, offer);
+			else store.askHistory.saveOffer(agent, offer);
+			return context.json({ offer });
+		});
+		app.get("/:id/ask/mentions", async (context) => {
+			const reviewId = context.req.param("id");
+			const { query, thread } = askMentionsSchema.parse(context.req.query());
+			const cwd = thread ? readThread(reviewId, thread).read().cwd : (await data.agentCheckout(readReview(reviewId))).rootPath;
+			const files = fuzzyRank(query, await mentionableFiles(cwd), (file) => [file, file.slice(file.lastIndexOf("/") + 1)]);
+			return context.json({ paths: files.slice(0, MENTION_LIMIT) });
+		});
+		app.post("/:id/ask", async (context) => {
+			const reviewId = context.req.param("id");
+			const { version } = readQuerySchemas.get.pick({ version: true }).parse(context.req.query());
+			const input = askStartSchema.parse(await readBoundedRequestJson(context.req.raw, ASK_REQUEST_MAX_BYTES));
+			const snapshot = readReview(reviewId, version);
+			const checkout = await data.agentCheckout(snapshot);
+			const target = input.selection.target;
+			const id = crypto.randomUUID();
+			const createdAt = (/* @__PURE__ */ new Date()).toISOString();
+			const thread = ask.threads.open({
+				id,
+				reviewId,
+				agent: input.agent,
+				onSession: (sessionId) => store.askHistory.get(id) ? store.askHistory.updateSession(id, sessionId) : store.askHistory.save({
+					id,
+					reviewId,
+					agent: input.agent,
+					sessionId,
+					version: snapshot.version,
+					head: checkout.head,
+					cwd: checkout.rootPath,
+					selection: input.selection,
+					title: input.question.text.slice(0, 200),
+					createdAt,
+					updatedAt: createdAt,
+					bypass: input.bypass
+				}),
+				onTurn: () => store.askHistory.touch(id),
+				onSave: (entries) => store.askHistory.saveEntries(id, entries),
+				picks: input.picks,
+				bypass: input.bypass,
+				onBypass: (bypass) => store.askHistory.setBypass(id, bypass),
+				onOffer: (offer) => store.askHistory.saveOffer(input.agent, offer),
+				onTitle: (title) => store.askHistory.rename(id, title),
+				cwd: checkout.rootPath,
+				head: checkout.head,
+				selection: {
+					title: input.selection.title,
+					quote: target.kind === "text" ? target.quote : void 0
+				},
+				context: await askContext(input.agent, snapshot, checkout, input.selection, version),
+				question: input.question
+			});
+			return context.json({ threadId: thread.id });
+		});
+		app.get("/:id/ask/threads", (context) => {
+			const reviewId = context.req.param("id");
+			readReview(reviewId);
+			return context.json({ threads: store.askHistory.list(reviewId) });
+		});
+		app.post("/:id/ask/:threadId/open", async (context) => {
+			const reviewId = context.req.param("id");
+			const threadId = context.req.param("threadId");
+			if (ask.threads.get(threadId)?.reviewId === reviewId) return context.json({ threadId });
+			const record = store.askHistory.get(threadId);
+			const { picks } = askOpenSchema.parse(await readBoundedRequestJson(context.req.raw, void 0, {}));
+			if (record?.reviewId !== reviewId) throw new ReviewInputError("This conversation was not found.", 404);
+			const snapshot = readReview(reviewId, record.version);
+			const checkout = await data.agentCheckout(snapshot);
+			const target = record.selection.target;
+			ask.threads.open({
+				id: record.id,
+				reviewId,
+				agent: record.agent,
+				cwd: checkout.rootPath,
+				head: checkout.head,
+				selection: {
+					title: record.selection.title,
+					quote: target.kind === "text" ? target.quote : void 0
+				},
+				resume: {
+					sessionId: record.sessionId,
+					entries: record.entries
+				},
+				context: await askContext(record.agent, snapshot, checkout, record.selection, record.version),
+				onSession: (sessionId) => store.askHistory.updateSession(record.id, sessionId),
+				onTurn: () => store.askHistory.touch(record.id),
+				onSave: (entries) => store.askHistory.saveEntries(record.id, entries),
+				picks,
+				bypass: record.bypass,
+				onBypass: (bypass) => store.askHistory.setBypass(record.id, bypass),
+				onOffer: (offer) => store.askHistory.saveOffer(record.agent, offer),
+				onTitle: (title) => store.askHistory.rename(record.id, title)
+			});
+			return context.json({ threadId: record.id });
+		});
+		app.get("/:id/ask/:threadId/watch", (context) => {
+			return watchAskThread(readThread(context.req.param("id"), context.req.param("threadId")));
+		});
+		app.post("/:id/ask/:threadId/prompt", async (context) => {
+			const thread = readThread(context.req.param("id"), context.req.param("threadId"));
+			const { question } = askFollowUpSchema.parse(await readBoundedRequestJson(context.req.raw, ASK_REQUEST_MAX_BYTES));
+			const refusal = thread.askRefusal();
+			if (refusal) throw new ReviewInputError(refusal, 409);
+			thread.ask(question);
+			return context.json({ ok: true });
+		});
+		app.post("/:id/ask/:threadId/permission", async (context) => {
+			const thread = readThread(context.req.param("id"), context.req.param("threadId"));
+			const decision = askDecisionSchema.parse(await readBoundedRequestJson(context.req.raw));
+			if (!thread.decide(decision.permissionId, decision.optionId)) throw new ReviewInputError("This request was already answered.", 409);
+			return context.json({ ok: true });
+		});
+		app.post("/:id/ask/:threadId/files", async (context) => {
+			const thread = readThread(context.req.param("id"), context.req.param("threadId"));
+			const { paths } = askFilesSchema.parse(await readBoundedRequestJson(context.req.raw));
+			const { cwd, entries } = thread.read();
+			const touched = entries.flatMap((entry) => entry.kind === "tool" ? `${entry.title} ${entry.input ?? ""}`.split(/\s+/).flatMap((token) => parseFileRef(token)?.path ?? []) : []);
+			const files = resolveFileRefs(cwd, await checkoutFiles(cwd), paths, touched);
+			return context.json({ files: [...files].map(([path, file]) => ({
+				path,
+				file
+			})) });
+		});
+		app.post("/:id/ask/:threadId/choice", async (context) => {
+			const thread = readThread(context.req.param("id"), context.req.param("threadId"));
+			const { kind, value } = askChoiceSchema.parse(await readBoundedRequestJson(context.req.raw));
+			if (thread.read().status !== "idle") throw new ReviewInputError("Settings can change once the agent finishes answering.", 409);
+			try {
+				await thread.choose(kind, value);
+			} catch (error) {
+				throw new ReviewInputError(errorMessage(error), 409);
+			}
+			return context.json({ ok: true });
+		});
+		app.post("/:id/ask/:threadId/permissions", async (context) => {
+			const thread = readThread(context.req.param("id"), context.req.param("threadId"));
+			const { bypass } = askPermitSchema.parse(await readBoundedRequestJson(context.req.raw));
+			if (thread.read().status !== "idle") throw new ReviewInputError("Settings can change once the agent finishes answering.", 409);
+			try {
+				await thread.permit(bypass);
+			} catch (error) {
+				throw new ReviewInputError(errorMessage(error), 409);
+			}
+			return context.json({ ok: true });
+		});
+		app.post("/:id/ask/:threadId/retry", (context) => {
+			const thread = readThread(context.req.param("id"), context.req.param("threadId"));
+			if (thread.read().status !== "failed") throw new ReviewInputError("Only a conversation that failed can try again.", 409);
+			thread.retry();
+			return context.json({ ok: true });
+		});
+		app.post("/:id/ask/:threadId/cancel", async (context) => {
+			await readThread(context.req.param("id"), context.req.param("threadId")).cancel();
+			return context.json({ ok: true });
+		});
+		app.post("/:id/ask/:threadId/close", (context) => {
+			readThread(context.req.param("id"), context.req.param("threadId"));
+			ask.threads.close(context.req.param("threadId"));
+			return context.json({ ok: true });
+		});
+		app.delete("/:id/ask/:threadId", (context) => {
+			const reviewId = context.req.param("id");
+			const threadId = context.req.param("threadId");
+			if (store.askHistory.get(threadId)?.reviewId !== reviewId) throw new ReviewInputError("This conversation was not found.", 404);
+			if (ask.threads.get(threadId)?.reviewId === reviewId) ask.threads.close(threadId);
+			store.askHistory.delete(threadId);
+			return context.json({ ok: true });
+		});
+	}
+	app.get("/:id/stack", async (context) => {
+		const query = readQuerySchemas.get.parse(context.req.query());
+		const id = context.req.param("id");
+		const snapshot = readReview(id, query.version);
+		if (isShared(id) || !snapshot.pins) return context.json({ layers: [] });
+		const layers = await resolveReviewStackLayers(snapshot, store.list());
+		return context.json({ layers });
+	});
+	app.get("/:id/history", (context) => {
+		const id = context.req.param("id");
+		if (!isShared(id)) return context.json(store.history(id));
+		const snapshot = readReview(id);
+		return context.json([{
+			version: snapshot.version,
+			title: snapshot.title,
+			createdAt: snapshot.createdAt
+		}]);
+	});
+	app.get("/:id/inspect", (context) => {
+		const query = inspectQuerySchema.parse(context.req.query());
+		const id = context.req.param("id");
+		const snapshot = readReview(id, query.version);
+		return context.json(query.format === "text" ? documentText(snapshot, query.targetId, Boolean(query.full)) : query.targetId !== void 0 ? inspectSnapshot(snapshot, query.targetId) : query.full ? snapshot : inspectSnapshot(snapshot));
+	});
+	app.get("/:id", async (context) => {
+		const query = readQuerySchemas.get.parse(context.req.query());
+		const snapshot = { ...readReview(context.req.param("id"), query.version) };
+		if (data && query.full) try {
+			const pins = await data.sourcePins(snapshot);
+			if (pins) snapshot.pins = pins;
+		} catch (error) {
+			if (!(error instanceof ReviewInputError) || error.status !== 404) throw error;
+			snapshot.sourceUnavailable = true;
+		}
+		return context.json(query.full ? snapshot : inspectSnapshot(snapshot, query.targetId));
+	});
+	/** After a lens write: the changed lines still uncategorized at that
+	* version, so the author can fill the gaps. A comparison that cannot be
+	* read leaves a warning instead of failing the saved write. */
+	const lensGaps = async (reviewId, version, request) => {
+		if (!data) return {};
+		try {
+			return { uncategorized: uncategorizedReport(await reviewProgress(store, data, store.read(reviewId, version), request.signal)) };
+		} catch (error) {
+			return { warnings: [`Uncategorized changes are unavailable: ${errorMessage(error)}`] };
+		}
+	};
+	app.post("/commands", async (context) => {
+		const { command: body, open: requestedOpen } = takeCreateOpen(await readBoundedRequestJson(context.req.raw));
+		const request = await locateRepositories(body, (path) => {
+			if (!data) throw new ReviewInputError("Repositories are unavailable.");
+			return data.register(path);
+		});
+		const input = commandSchema.parse(request);
+		const command = sharedCommandSchema.safeParse(input);
+		if (command.success) {
+			refuseDisabledScratchpad(command.data.operation.reviewId);
+			await ensureScratchpad(command.data.operation.reviewId);
+		}
+		if (input.operation.type === "create" && input.operation.kind === "scratchpad") refuseDisabledScratchpad(SCRATCHPAD_ID);
+		if (command.success && command.data.operation.reviewId?.startsWith("shared-")) {
+			const parsed = commandSchema.parse(input);
+			if (shared && parsed.operation.type === "delete") {
+				await shared.removeLocal(parsed.operation.reviewId);
+				return context.json({
+					reviewId: parsed.operation.reviewId,
+					version: 0,
+					deleted: true
+				});
+			}
+			if (shared && parsed.operation.type === "attention") {
+				await shared.setAttention(parsed.operation.reviewId, parsed.operation.action);
+				return context.json({
+					reviewId: parsed.operation.reviewId,
+					version: shared.get(parsed.operation.reviewId).snapshot.version,
+					attention: true
+				});
+			}
+			throw new ReviewInputError("Shared reviews are read-only.", 409);
+		}
+		const result = await store.execute(input);
+		if (input.operation.type === "edit" && data && !result.deleted) {
+			const { quotes, unquoted } = await anchorQuotes(result.version > 0 ? store.read(result.reviewId, result.version - 1) : void 0, store.read(result.reviewId, result.version), async (pins, side, file) => (await data.file(pins, side, file)).text);
+			return context.json({
+				...result,
+				...quotes.length && { quotes },
+				...unquoted && { unquotedAnchors: unquoted }
+			});
+		}
+		if (input.operation.type === "lens_edit") {
+			const gaps = await lensGaps(result.reviewId, result.version, context.req.raw);
+			return context.json({
+				...result,
+				...gaps,
+				...gaps.warnings && { warnings: [...result.warnings ?? [], ...gaps.warnings] }
+			});
+		}
+		if (input.operation.type !== "create") return context.json(result);
+		if (result.created !== false) hooks.onReviewCreated?.({
+			reviewId: result.reviewId,
+			kind: input.operation.kind === "scratchpad" ? "scratchpad" : "review",
+			blocks: store.read(result.reviewId).document.length,
+			...reviewRequestOrigin(context.req.raw.headers)
+		});
+		return context.json({
+			...result,
+			review: store.summary(result.reviewId),
+			...requestedOpen === false ? { opened: false } : await openCreated(result.reviewId)
+		});
+	});
+	return app;
+}
+const systemErrorSchema = z.object({ code: z.string().regex(/^[A-Z0-9_]+$/) });
+/** A system error code such as EACCES, else the error's class; never its message. */
+function failureKind(error) {
+	const system = systemErrorSchema.safeParse(error);
+	return system.success ? system.data.code : error.name;
+}
+/**
+* `open` steers presentation, not the saved review, so it stays out of the
+* command. Anything else, including `open` off create, is left for
+* commandSchema to reject.
+*/
+function takeCreateOpen(body) {
+	const create = z.looseObject({ operation: z.looseObject({
+		type: z.literal("create"),
+		open: z.boolean().optional()
+	}) }).safeParse(body);
+	if (!create.success) return { command: body };
+	const { open, ...operation } = create.data.operation;
+	return {
+		command: {
+			...create.data,
+			operation
+		},
+		open
+	};
+}
+/**
+* Agents name a checkout by its path (pathTargetSchema, and repositoryPath on
+* a create from a PR); the store keeps the id it registers as. A command that
+* already names ids is left as it is.
+*/
+async function locateRepositories(body, register) {
+	const located = z.looseObject({ operation: z.looseObject({
+		type: z.enum(["create", "set_target"]),
+		target: z.looseObject({ repositoryPath: z.string() }).optional(),
+		repositoryPath: z.string().optional()
+	}) }).safeParse(body);
+	if (!located.success) return body;
+	const { target, repositoryPath, ...operation } = located.data.operation;
+	const byId = async ({ repositoryPath: path, ...rest }) => ({
+		...rest,
+		repositoryId: (await register(path)).id
+	});
+	return {
+		...located.data,
+		operation: {
+			...operation,
+			...target && { target: await byId(target) },
+			...repositoryPath && await byId({ repositoryPath })
+		}
+	};
+}
+/** Send committed state, coalescing updates when the reader falls behind. */
+function watch$1(read, subscribe, probe = read) {
+	probe();
+	let stop = () => {};
+	let dirty = true;
+	const encoder = new TextEncoder();
+	const send = (controller) => {
+		if (!dirty || controller.desiredSize === null || controller.desiredSize <= 0) return;
+		try {
+			const line = JSON.stringify(read()) + "\n";
+			dirty = false;
+			controller.enqueue(encoder.encode(line));
+		} catch (error) {
+			stop();
+			controller.error(error);
+		}
+	};
+	const body = new ReadableStream({
+		start(controller) {
+			stop = subscribe(() => {
+				dirty = true;
+				send(controller);
+			});
+			send(controller);
+		},
+		pull: send,
+		cancel() {
+			stop();
+		}
+	});
+	return new Response(body, { headers: {
+		"content-type": "application/x-ndjson",
+		"cache-control": "no-store"
+	} });
+}
+//#endregion
+//#region src/server/review-server-core.ts
+const version = readReviewPackageVersion(import.meta.url);
+const commit = readBuildCommit(import.meta.url);
+/**
+* What every review server shares: CORS, an open /health, token auth, and
+* the /control relay a Desktop attaches to, with errors answered as JSON.
+* Callers add their routes after.
+*/
+function createReviewServerApp(input) {
+	const app = new Hono();
+	app.use("*", async (context, next) => {
+		await next();
+		applyCorsHeaders(context.req.raw, context.res);
+	});
+	app.options("*", (context) => corsPreflightResponse(context.req.raw));
+	app.get("/health", (context) => {
+		const health = {
+			ok: true,
+			instanceId: input.instanceId,
+			desktopAttached: input.relay.attached,
+			version
+		};
+		return serverJson(200, isAuthorizedRequest(context.req.raw, input.token) ? {
+			...health,
+			serverId: input.serverId,
+			serverPid: process.pid,
+			commit
+		} : health);
+	});
+	app.use("*", async (context, next) => {
+		if (!isAuthorizedRequest(context.req.raw, input.token)) return serverJson(401, {
+			ok: false,
+			error: "Unauthorized"
+		});
+		await next();
+	});
+	app.get("/control", (context) => openControlEvents(context, input.relay));
+	app.post("/control/result", async (context) => {
+		const accepted = input.relay.acceptResult(await readBoundedRequestJson(context.req.raw));
+		return serverJson(accepted ? 200 : 404, { ok: accepted });
+	});
+	app.notFound(() => serverJson(404, {
+		ok: false,
+		error: "Not found."
+	}));
+	app.onError((error) => {
+		const serverError = error instanceof ReviewServerError ? error : void 0;
+		const message = toError$1(error).message;
+		return serverJson(serverError?.statusCode ?? httpJsonStatus(error), serverError?.code ? {
+			ok: false,
+			code: serverError.code,
+			error: message
+		} : {
+			ok: false,
+			error: message
+		});
+	});
+	return app;
+}
+function createWhiteboardCore(input) {
+	const { store, data, shared } = input.profile;
+	const app = createReviewServerApp({
+		token: input.token,
+		instanceId: input.instanceId,
+		serverId: store.serverId(),
+		relay: input.relay
+	});
+	const callbacks = relayReviewCallbacks(input.relay, input.softwareMapEnabled);
+	const askThreads = input.ask && new AskThreads(launchAskAgent, input.ask.tools);
+	const api = createReviewApi(store, data, callbacks.open, shared, callbacks.capabilities, input.scratchpad, () => traceMachineEnabled(), input.status, input.hooks, askThreads && {
+		threads: askThreads,
+		agents: () => detectAskAgents()
+	});
+	if (!shared) mountSharingPublisher(api, store, data);
+	return {
+		app,
+		api,
+		close: () => askThreads?.closeAll()
+	};
+}
+/** The Desktop callbacks `createReviewApi` takes, answered over the relay. */
+function relayReviewCallbacks(relay, softwareMapEnabled = false) {
+	return {
+		async open(review) {
+			const result = await relay.dispatch({
+				name: "openApiReview",
+				args: review
+			});
+			if (!result.ok) throw new ReviewInputError(result.error, 409);
+			return z.object({ softwareMapEnabled: z.boolean() }).parse(result.result);
+		},
+		async capabilities() {
+			if (!relay.attached) return {
+				desktopAvailable: false,
+				softwareMapEnabled
+			};
+			const result = await relay.dispatch({
+				name: "authoringCapabilities",
+				args: {}
+			});
+			if (!result.ok) throw new ReviewInputError(result.error, 409);
+			return {
+				desktopAvailable: true,
+				...z.object({ softwareMapEnabled: z.boolean() }).parse(result.result)
+			};
+		}
+	};
+}
+function openControlEvents(context, relay) {
+	let attached = false;
+	const response = streamSSE(context, async (output) => {
+		let finish;
+		const disconnected = new Promise((resolve) => {
+			finish = resolve;
+		});
+		const abort = new AbortController();
+		let pending = output.write(": attached\n\n").then(() => void 0);
+		const writer = {
+			signal: abort.signal,
+			write(frame) {
+				pending = pending.then(async () => {
+					await output.write(frame);
+				});
+			},
+			close() {
+				finish();
+				output.close();
+			}
+		};
+		output.onAbort(() => {
+			abort.abort();
+			finish();
+		});
+		attached = relay.attach(writer);
+		if (!attached) {
+			finish();
+			return;
+		}
+		try {
+			await disconnected;
+			await pending;
+		} finally {
+			abort.abort();
+		}
+	});
+	if (!attached) {
+		response.body?.cancel();
+		return serverJson(409, {
+			ok: false,
+			error: "This server has no room for another Whiteboard Desktop."
+		});
+	}
+	response.headers.set("connection", "close");
+	response.headers.set("cache-control", "no-cache, no-transform");
+	response.headers.set("content-type", "text/event-stream; charset=utf-8");
+	return response;
+}
+function serverJson(status, body) {
+	return jsonResponse(body, status, { cacheControl: "no-store" });
+}
+function httpJsonStatus(cause) {
+	return cause instanceof HttpJsonError ? cause.statusCode : 400;
+}
+function toError$1(cause) {
+	return cause instanceof Error ? cause : new Error(String(cause));
+}
+//#endregion
+//#region src/server/process-error-telemetry.ts
+function serverCrashReportPath(env = process.env) {
+	return path.join(devReviewHome(env), "telemetry", "server-crash.json");
+}
+function installProcessErrorTelemetry(telemetry, options = {}) {
+	const target = options.process ?? process;
+	const crashReportPath = options.crashReportPath ?? serverCrashReportPath();
+	const onUncaught = (cause) => {
+		const properties = serverErrorProperties(toError(cause), options.appSessionId);
+		if (target.listenerCount("uncaughtException") === 0) writeCrashReport(crashReportPath, properties);
+		else sendServerError(telemetry, properties);
+	};
+	const onRejection = (cause) => {
+		sendServerError(telemetry, serverErrorProperties(toError(cause), options.appSessionId));
+	};
+	const watchRejections = target.listenerCount("unhandledRejection") > 0;
+	target.on("uncaughtExceptionMonitor", onUncaught);
+	if (watchRejections) target.on("unhandledRejection", onRejection);
+	return () => {
+		target.off("uncaughtExceptionMonitor", onUncaught);
+		if (watchRejections) target.off("unhandledRejection", onRejection);
+	};
+}
+/** Sends, once, the fatal error an earlier server process left behind. */
+async function drainServerCrashReport(telemetry, crashReportPath = serverCrashReportPath()) {
+	let properties;
+	try {
+		const text = await readFile(crashReportPath, "utf8");
+		await rm(crashReportPath, { force: true });
+		properties = parseJsonText(text);
+	} catch {
+		return;
+	}
+	await sendServerError(telemetry, properties);
+}
+function toError(cause) {
+	return cause instanceof Error ? cause : new Error(String(cause));
+}
+function serverErrorProperties(error, appSessionId) {
+	const properties = {
+		error_source: "server_unexpected",
+		error_process: "server",
+		error_name: error.name
+	};
+	if (appSessionId) properties.app_session_id = appSessionId;
+	return mergeErrorTelemetryProperties(properties, {
+		name: error.name,
+		message: error.message,
+		stack: error.stack ?? ""
+	});
+}
+function writeCrashReport(crashReportPath, properties) {
+	const sanitized = sanitizeUiTelemetryEvent({
+		name: "client_error",
+		properties
+	});
+	if (!sanitized) return;
+	try {
+		mkdirSync(path.dirname(crashReportPath), { recursive: true });
+		writeFileSync(crashReportPath, JSON.stringify(sanitized.properties), { mode: 384 });
+	} catch {}
+}
+async function sendServerError(telemetry, properties) {
+	const sanitized = sanitizeUiTelemetryEvent({
+		name: "client_error",
+		properties
+	});
+	const admitted = sanitized ? admitUiTelemetryEvent(sanitized) : void 0;
+	if (!admitted) return;
+	try {
+		await telemetry.captureUiEvent?.(admitted.event, admitted.properties);
+	} catch {}
+}
+//#endregion
+export { serverJson as a, recordClientError as c, HttpJsonError as d, ReviewServerError as f, createWhiteboardCore as i, createNodeRequestListener as l, installProcessErrorTelemetry as n, captureSanitizedUiTelemetry as o, GlobalReviewDesktopVerbRelay as p, serverCrashReportPath as r, clientErrorsForSession as s, drainServerCrashReport as t, readBoundedRequestJson as u };