@dev.fast/whiteboard 0.2.4 → 0.2.5-preview.20261013.110

package/dist/{mcp-BDy9Aybd.js → mcp-t7VN9R3k.js}

@@ -1,7 +1,7 @@
-import { a as toolResultText, s as ReviewApiError } from "./agent-client-B_b1GtUc.js";
-import { t as ReviewInputError } from "./input-error-OLgB_h31.js";
-import { n as REVIEW_STATUS_TOOL, t as authoringTools } from "./authoring-tools-DvIO906l.js";
-import { i as publicTool, n as RECOVERY, r as callPublicTool, t as toolFailure } from "./tool-failure-DJmTieh5.js";
+import { C as ReviewInputError } from "./src-DiHP11l3.js";
+import { a as toolResultText, s as ReviewApiError } from "./agent-client-P3J4y8Zn.js";
+import { n as REVIEW_STATUS_TOOL, t as authoringTools } from "./authoring-tools-D8WXsm_g.js";
+import { i as publicTool, n as RECOVERY, r as callPublicTool, t as toolFailure } from "./tool-failure-CJHBCHMh.js";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";

package/dist/{package-paths-B6-zxvIO.js → package-paths-B9PDoAl6.js}

@@ -1,5 +1,5 @@
 import { c as jsonString, o as jsonObject, u as parseJsonText } from "./src-X9phtB2j.js";
-import "./review-home-paths-6zZH-1c9.js";
+import "./review-home-paths-Y9mYWkCI.js";
 import { readFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";

package/dist/{process-error-telemetry-Dzh5a3s_.js → process-error-telemetry-C0swByfp.js}

@@ -1,16 +1,15 @@
+import { C as ReviewInputError } from "./src-DiHP11l3.js";
 import { c as jsonString, m as isStringValue, n as isJsonObject, u as parseJsonText } from "./src-X9phtB2j.js";
-import { a as sharedReviewId, c as verifyShareRepository, d as StreamLimitError, f as readBoundedStream, l as exportShare, m as shareIdSchema, n as ShareClient, p as parseShareLink, r as SharePreflightError, s as readShareRepository, t as ShareAuthError, u as validateShareSources } from "./client-BFClfQLO.js";
-import { _ as invalidateStructuralComparisons, a as inspectSnapshot, c as askAgentIds, d as askQuestionSchema, f as AgentSelectionSchema, i as commandSchema, l as askChoiceKinds, p as selectionMarkdown, r as SCRATCHPAD_ID, s as applyAskChange, u as askPicksSchema, v as diffrExecutable, y as diffrMissingError } from "./local-data-Bm84Xdck.js";
+import { a as sharedReviewId, c as verifyShareRepository, d as StreamLimitError, f as readBoundedStream, l as exportShare, m as shareIdSchema, n as ShareClient, p as parseShareLink, r as SharePreflightError, s as readShareRepository, t as ShareAuthError, u as validateShareSources } from "./client-DzcSt6pV.js";
+import { _ as invalidateStructuralComparisons, a as inspectSnapshot, c as askAgentIds, d as askQuestionSchema, f as AgentSelectionSchema, i as commandSchema, l as askChoiceKinds, p as selectionMarkdown, r as SCRATCHPAD_ID, s as applyAskChange, u as askPicksSchema, v as diffrExecutable, y as diffrMissingError } from "./local-data-BlERtVm2.js";
 import { d as REVIEW_CLIENT_REMOTE, i as parseReviewVerbRequest, r as parseReviewDesktopVerbResult, u as REVIEW_CLIENT_HEADER, v as reviewDiffrSummarizerInputSchema, y as decodeStructuralDiffEvent } from "./src-WCbabvdS.js";
-import { C as TraceStorageDeniedError, G as readStoreAuth, H as DEFAULT_STORE_ORIGIN, U as clearStoreAuth, W as openUrlInBrowser, _ as isTraceStorageConfigured, b as selectTraceStorage, o as listReviewTraceSessions, q as runStoreLogin, s as loadReviewAgentTrace, y as resolveTraceStorage } from "./review-agent-traces-DNJFYzc8.js";
-import { $ as unionIntervals, G as selectionKey, H as comparisonKey, I as fileLineRangeSchema, J as coverageSources, N as lensSelections, Q as subtractIntervals, T as selectionReferences, U as formatAnchor, V as anchorSelection, W as resolveDiffSelection, Y as emptyCoverage, Z as scopedCoverage, h as elements, k as UNCATEGORIZED_LENS_ID, u as anchorPins } from "./stored-document-migration-BxZWQQjv.js";
-import { t as ReviewInputError } from "./input-error-OLgB_h31.js";
+import { B as TraceStorageDeniedError, D as listReviewTraceSessions, I as isTraceStorageConfigured, O as loadReviewAgentTrace, R as resolveTraceStorage, T as traceMachineEnabled, at as openUrlInBrowser, it as clearStoreAuth, ot as readStoreAuth, rt as DEFAULT_STORE_ORIGIN, st as runStoreLogin, z as selectTraceStorage } from "./review-home-paths-Y9mYWkCI.js";
+import { $ as unionIntervals, G as selectionKey, H as comparisonKey, I as fileLineRangeSchema, J as coverageSources, N as lensSelections, Q as subtractIntervals, T as selectionReferences, U as formatAnchor, V as anchorSelection, W as resolveDiffSelection, Y as emptyCoverage, Z as scopedCoverage, h as elements, k as UNCATEGORIZED_LENS_ID, u as anchorPins } from "./stored-document-migration-u4L_1VZa.js";
 import { A as devReviewHome, h as TraceConfigurationError, i as isS3MockMode } from "./s3-config-CAxhO9u_.js";
 import { t as errorMessage } from "./error-message-OtiDonty.js";
-import { T as traceMachineEnabled } from "./review-home-paths-6zZH-1c9.js";
-import { i as readReviewPackageVersion, n as readBuildCommit } from "./package-paths-B6-zxvIO.js";
+import { i as readReviewPackageVersion, n as readBuildCommit } from "./package-paths-B9PDoAl6.js";
 import { a as REVIEW_APP_SESSION_ID_HEADER, c as sanitizeUiTelemetryEvent, i as BUNDLE_FRAME_PATTERN, l as cleanTelemetryText, r as reviewRequestOrigin, s as isReportableCleanedMessage } from "./request-origin-DA4K1qWY.js";
-import { a as scratchpadAvailable, c as readQuerySchemas, i as renderInstructions, o as inspectQuerySchema, r as instructionsQuerySchema, s as queryAnchor, t as authoringTools } from "./authoring-tools-DvIO906l.js";
+import { a as scratchpadAvailable, c as readQuerySchemas, i as renderInstructions, o as inspectQuerySchema, r as instructionsQuerySchema, s as queryAnchor, t as authoringTools } from "./authoring-tools-D8WXsm_g.js";
 import { t as fuzzyRank } from "./fuzzy-match-BoAmcyak.js";
 import { createRequire } from "node:module";
 import crypto$1, { createHash, randomUUID } from "node:crypto";
@@ -571,11 +570,9 @@ function deriveErrorTelemetryProperties(cause) {
 		if (name !== void 0 && name.length > 0 && name.length <= MAX_ERROR_NAME_LENGTH && ERROR_NAME_PATTERN.test(name)) derived.error_name = name;
 		const message = jsonString(cause.message);
 		if (message !== void 0 && message.length > 0) {
-			derived.message_hash = hashErrorMessage(message);
-			if (!SCHEMA_ERROR_NAMES.has(derived.error_name ?? "")) {
-				const cleaned = cleanTelemetryText(message, NO_DELETED_DIRECTORIES);
-				if (isReportableCleanedMessage(cleaned)) derived.message = cleaned;
-			}
+			const cleaned = cleanTelemetryText(message, NO_DELETED_DIRECTORIES);
+			derived.message_hash = hashErrorMessage(cleaned);
+			if (!SCHEMA_ERROR_NAMES.has(derived.error_name ?? "") && isReportableCleanedMessage(cleaned)) derived.message = cleaned;
 		}
 		const frames = packBundleFrames(cause.stack);
 		if (frames) derived.frames = frames;
@@ -901,6 +898,7 @@ const askAgents = {
 			executableEnv: "CLAUDE_CODE_EXECUTABLE"
 		},
 		signIn: "claude auth login",
+		steers: true,
 		readOnlyMode: "default",
 		sessionMeta: { claudeCode: { options: {
 			disallowedTools: [
@@ -1221,6 +1219,12 @@ const REFUSED_KINDS = /* @__PURE__ */ new Set([
 ]);
 const piGreetingSchema = z.object({ piAcp: z.object({ startupInfo: z.string() }) });
 const cursorTodosSchema = z.object({ todos: z.unknown() }).loose();
+/** The steering extension Claude's adapter takes: a follow-up joins the
+* turn under way rather than waiting for it to end. */
+const STEER_METHOD = "_session/steering";
+/** How an agent says, in its `initialize` response, that it takes steering. */
+const steeringSchema = z.object({ steering: z.object({ supported: z.literal(true) }) });
+const steerOutcomeSchema = z.object({ outcome: z.string() });
 /** MCP servers the reviewer's own agent may bring whose tools only read,
 * so their calls run without asking, like the agent reading files. */
 const READ_ONLY_MCP_SERVERS = /* @__PURE__ */ new Set(["fff"]);
@@ -1282,6 +1286,10 @@ var AskThread = class {
 	/** What Pi greets a new session with, its version and skills, which is no
 	* part of the answer. */
 	greeting;
+	/** The agent takes follow-ups into the turn under way. */
+	steerable = false;
+	/** Follow-ups waiting for the turn under way to end, oldest first. */
+	queue = [];
 	constructor(launch, start, mcpServers = () => [], limits = askThreadLimits) {
 		this.launch = launch;
 		this.start = start;
@@ -1352,15 +1360,22 @@ var AskThread = class {
 	/** Why a question cannot be asked now, if it cannot. */
 	askRefusal() {
 		switch (this.state.status) {
-			case "idle": return;
+			case "idle":
+			case "running":
+			case "waiting": return;
 			case "failed": return `${this.state.agentName} stopped. Try again first.`;
-			default: return "The agent is still answering.";
+			default: return `${this.state.agentName} is still starting.`;
 		}
 	}
-	/** Asks a follow-up, starting the agent again if it has stopped since. */
+	/** Asks a follow-up, starting the agent again if it has stopped since.
+	* While the agent answers, it joins that turn or waits for it to end. */
 	async ask(question) {
 		const refusal = this.askRefusal();
 		if (refusal) throw new Error(refusal);
+		if (this.state.status !== "idle") {
+			await this.steer(question);
+			return;
+		}
 		this.asking = {
 			id: this.addUser(question),
 			question
@@ -1402,6 +1417,49 @@ var AskThread = class {
 			});
 		});
 	}
+	/** Gives the turn under way a follow-up when the agent takes one, else
+	* keeps it for when the turn ends. */
+	async steer(question) {
+		const { connection, sessionId } = this;
+		if (this.steerable && connection && sessionId) {
+			const id = this.addUser(question);
+			if (await connection.agent.request(STEER_METHOD, {
+				sessionId,
+				prompt: [{
+					type: "text",
+					text: question.text
+				}, ...this.attachments(question)],
+				_meta: { steering: { idleBehavior: "promptRequired" } }
+			}).then((response) => steerOutcomeSchema.safeParse(response).data?.outcome).catch(() => void 0) === "injected") return;
+			this.emit({
+				type: "remove",
+				ids: [id]
+			});
+		}
+		this.queue.push({
+			id: randomUUID(),
+			question
+		});
+		this.showQueue();
+		this.askQueued();
+	}
+	/** Asks the oldest waiting follow-up, once no turn is under way. */
+	askQueued() {
+		if (this.closed || this.state.status !== "idle") return;
+		const next = this.queue.shift();
+		if (!next) return;
+		this.showQueue();
+		this.ask(next.question);
+	}
+	showQueue() {
+		this.emit({
+			type: "set",
+			queued: this.queue.map(({ id, question }) => ({
+				id,
+				text: question.text
+			}))
+		});
+	}
 	decide(permissionId, optionId) {
 		const resolve = this.decisions.get(permissionId);
 		if (!resolve) return false;
@@ -1414,6 +1472,10 @@ var AskThread = class {
 	/** Stops the turn, or the start, in progress. A turn the agent does not
 	* end soon after is ended by stopping the agent. */
 	async cancel() {
+		if (this.queue.length) {
+			this.queue = [];
+			this.showQueue();
+		}
 		for (const resolve of this.decisions.values()) resolve({ outcome: { outcome: "cancelled" } });
 		const { status } = this.state;
 		if (status === "starting") {
@@ -1428,16 +1490,19 @@ var AskThread = class {
 		}, this.limits.stopGraceMs);
 		if (sessionId) await connection.agent.notify(methods.agent.session.cancel, { sessionId }).catch(() => {});
 	}
-	close() {
+	close(save = true) {
 		if (this.closed) return;
 		this.closed = true;
-		if (this.sessionId && this.state.status !== "starting" && this.state.status !== "failed") this.start.onSave?.(settled(this.state.entries));
-		for (const resolve of this.decisions.values()) resolve({ outcome: { outcome: "cancelled" } });
-		if (this.connection && this.sessionId) this.connection.agent.notify(methods.agent.session.cancel, { sessionId: this.sessionId }).catch(() => {});
-		this.disconnect();
-		this.listeners.clear();
-		for (const closed of this.closers) closed();
-		this.closers.clear();
+		try {
+			if (save && this.sessionId && this.state.status !== "starting" && this.state.status !== "failed") this.start.onSave?.(settled(this.state.entries));
+		} finally {
+			for (const resolve of this.decisions.values()) resolve({ outcome: { outcome: "cancelled" } });
+			if (this.connection && this.sessionId) this.connection.agent.notify(methods.agent.session.cancel, { sessionId: this.sessionId }).catch(() => {});
+			this.disconnect();
+			this.listeners.clear();
+			for (const closed of this.closers) closed();
+			this.closers.clear();
+		}
 	}
 	/** Runs when the thread closes, at once if it already has. */
 	onClose(closed) {
@@ -1546,6 +1611,7 @@ var AskThread = class {
 				version: "1"
 			}
 		});
+		this.steerable = askAgents[this.start.agent].steers === true && steeringSchema.safeParse(initialized._meta).success;
 		this.emit({
 			type: "set",
 			accepts: { image: initialized.agentCapabilities?.promptCapabilities?.image === true }
@@ -1700,6 +1766,7 @@ var AskThread = class {
 				mcpServers: this.mcpServers,
 				_meta: this.sessionMeta()
 			});
+			if (this.closed) throw new Error("This conversation has ended.");
 			this.sessionId = response.sessionId;
 			start.onSession?.(response.sessionId);
 			this.greeting = piGreetingSchema.safeParse(response._meta).data?.piAcp.startupInfo;
@@ -1763,6 +1830,7 @@ var AskThread = class {
 		} finally {
 			clearTimeout(this.stopTimer);
 		}
+		if (this.closed) return;
 		if (withSelection) this.needsContext = false;
 		if (withPermission) this.permitted = false;
 		this.asking = void 0;
@@ -1786,6 +1854,7 @@ var AskThread = class {
 		});
 		this.start.onTurn?.();
 		this.start.onSave?.(this.state.entries);
+		this.askQueued();
 	}
 	async requestPermission(request, signal) {
 		const id = request.toolCall.toolCallId;
@@ -2265,10 +2334,14 @@ var AskThreads = class {
 		}
 		return offer;
 	}
-	close(id) {
-		this.threads.get(id)?.close();
+	close(id, save = true) {
+		const thread = this.threads.get(id);
 		this.threads.delete(id);
 		this.unwatchedSince.delete(id);
+		thread?.close(save);
+	}
+	closeDeletedReviews(isDeleted) {
+		for (const [id, thread] of this.threads) if (isDeleted(thread.reviewId)) this.close(id, false);
 	}
 	closeAll() {
 		for (const id of [...this.threads.keys()]) this.close(id);
@@ -2478,7 +2551,7 @@ async function resolveReviewStackLayers(subject, reviews, runGitHubApi = default
 		const matches = reviews.filter((candidate) => {
 			return (candidate.origin?.pullRequestUrl?.replace(/\/pull\/\d+.*$/, "") ?? candidate.pins?.repositoryId) === repoKey && candidate.origin?.pullRequestNumber === pr.number;
 		});
-		const review = matches.find((candidate) => candidate.reviewId === subject.reviewId) ?? matches.findLast((candidate) => !candidate.dismissedAt) ?? matches.at(-1);
+		const review = matches.find((candidate) => candidate.reviewId === subject.reviewId) ?? matches.findLast((candidate) => !candidate.trashedAt) ?? matches.at(-1);
 		return {
 			branch: pr.head.ref,
 			pullRequestNumber: pr.number,
@@ -3228,6 +3301,16 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 	});
 	const sharedData = shared ? new SharedReviewData(shared) : void 0;
 	const isShared = (id) => id.startsWith("shared-");
+	const assertWritable = (id) => {
+		if (isShared(id)) shared?.assertWritable(id);
+		else store.assertWritable(id);
+	};
+	const reviewAccess = (access) => async (context, next) => {
+		const id = context.req.param("id");
+		if (access !== "read") assertWritable(id);
+		if (access === "edit" && isShared(id)) throw new ReviewInputError("Shared reviews are read-only.", 409);
+		await next();
+	};
 	const sharedCommandSchema = z.object({ operation: z.object({ reviewId: z.string().optional() }) });
 	const ensureScratchpad = async (id) => {
 		if (open && scratchpadEnabled() && (!id || id === SCRATCHPAD_ID)) await store.ensureScratchpad();
@@ -3242,7 +3325,6 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 		if (!id || !isShared(id)) return next();
 		const query = readQuerySchemas.get.parse({ version: context.req.query("version") });
 		readReview(id, query.version);
-		if (context.req.method !== "GET" && !/\/(open|source|copy-context|environment)$/.test(context.req.path) && !/\/workspaces\/[^/]+\/retry$/.test(context.req.path)) throw new ReviewInputError("Shared reviews are read-only.", 409);
 		return next();
 	};
 	app.use("/:id", sharedGuard);
@@ -3292,7 +3374,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 		}
 		return context.json(await reviewProgress(store, data, snapshot, context.req.raw.signal, query.mode));
 	});
-	app.post("/:id/progress", async (context) => {
+	app.post("/:id/progress", reviewAccess("edit"), async (context) => {
 		if (!data) throw new ReviewInputError("Source data is unavailable.", 409);
 		const input = progressUpdateSchema.parse(await readBoundedRequestJson(context.req.raw));
 		const id = context.req.param("id");
@@ -3342,7 +3424,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 		"begin",
 		"update",
 		"end"
-	]) app.post(`/:id/activity/${action}`, async (context) => {
+	]) app.post(`/:id/activity/${action}`, reviewAccess("edit"), async (context) => {
 		const input = await readBoundedRequestJson(context.req.raw);
 		const id = context.req.param("id");
 		store.assertExists(id);
@@ -3375,7 +3457,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 				});
 				return marked;
 			};
-			return watch$1(() => subscriptions.map(({ reviewId, mode }, index) => {
+			return watch(() => subscriptions.map(({ reviewId, mode }, index) => {
 				if (!dirty.delete(index)) return null;
 				try {
 					return { value: reviewId === null ? catalog(mode) : {
@@ -3415,7 +3497,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 			}, () => {});
 		}
 		await ensureScratchpad();
-		return watch$1(() => catalog(coverageModeSchema.parse(context.req.query("mode"))), (notify) => {
+		return watch(() => catalog(coverageModeSchema.parse(context.req.query("mode"))), (notify) => {
 			const local = store.subscribeCatalog(notify);
 			const activity = store.activity.subscribeWorking(notify);
 			const imported = shared?.subscribe(notify);
@@ -3463,7 +3545,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 			};
 		}
 	};
-	app.post("/:id/open", async (context) => {
+	app.post("/:id/open", reviewAccess("active"), async (context) => {
 		const id = context.req.param("id");
 		if (isShared(id)) await shared?.assertReady(id);
 		return context.json({
@@ -3474,7 +3556,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 	app.get("/:id/watch", (context) => {
 		const id = context.req.param("id");
 		let document;
-		return watch$1(() => ({
+		return watch(() => ({
 			...document ??= readReview(id),
 			activity: isShared(id) ? {
 				workingCount: 0,
@@ -3523,7 +3605,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 			}, result.status);
 			return context.json(result);
 		});
-		app.post("/:id/navigator", async (context) => {
+		app.post("/:id/navigator", reviewAccess("edit"), async (context) => {
 			if (remoteCaller(context)) throw new ReviewInputError("Source windows are not available for a review on another machine.", 409);
 			const input = readQuerySchemas.file.extend({
 				side: z.enum(["base", "head"]).default("head"),
@@ -3580,7 +3662,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 				...environment.issue && { issue: "The checkout for language features is not available on the remote machine." }
 			} : environment);
 		});
-		app.post("/:id/environment", async (context) => {
+		app.post("/:id/environment", reviewAccess("active"), async (context) => {
 			const input = z.strictObject({ retry: z.boolean().optional() }).parse(await readBoundedRequestJson(context.req.raw));
 			return context.json({ issues: await data.environmentIssues(readReview(context.req.param("id")), input.retry) });
 		});
@@ -3593,7 +3675,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 			readReview(context.req.param("id"));
 			return context.json(data.workspaces.list(context.req.param("id")));
 		});
-		app.post("/:id/workspaces/:workspaceId/retry", async (context) => {
+		app.post("/:id/workspaces/:workspaceId/retry", reviewAccess("active"), async (context) => {
 			return context.json(await data.workspaces.retry(context.req.param("id"), context.req.param("workspaceId")));
 		});
 		app.get("/:id/file", async (context) => {
@@ -3660,7 +3742,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 			return context.json(await data.commits((await data.resolveSource(readReview(context.req.param("id"), input.version))).pins));
 		});
 	}
-	app.post("/:id/copy-context", async (context) => {
+	app.post("/:id/copy-context", reviewAccess("read"), async (context) => {
 		const query = readQuerySchemas.get.pick({ version: true }).extend({ mode: coverageModeSchema }).parse(context.req.query());
 		const selection = AgentSelectionSchema.parse(await readBoundedRequestJson(context.req.raw));
 		return context.json({ text: await selectionContext(context.req.param("id"), selection, query.version) });
@@ -3753,7 +3835,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 			const files = fuzzyRank(query, await mentionableFiles(cwd), (file) => [file, file.slice(file.lastIndexOf("/") + 1)]);
 			return context.json({ paths: files.slice(0, MENTION_LIMIT) });
 		});
-		app.post("/:id/ask", async (context) => {
+		app.post("/:id/ask", reviewAccess("edit"), async (context) => {
 			const reviewId = context.req.param("id");
 			const { version } = readQuerySchemas.get.pick({ version: true }).parse(context.req.query());
 			const input = askStartSchema.parse(await readBoundedRequestJson(context.req.raw, ASK_REQUEST_MAX_BYTES));
@@ -3762,6 +3844,8 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 			const target = input.selection.target;
 			const id = crypto.randomUUID();
 			const createdAt = (/* @__PURE__ */ new Date()).toISOString();
+			const initialContext = await askContext(input.agent, snapshot, checkout, input.selection, version);
+			assertWritable(reviewId);
 			const thread = ask.threads.open({
 				id,
 				reviewId,
@@ -3793,7 +3877,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 					title: input.selection.title,
 					quote: target.kind === "text" ? target.quote : void 0
 				},
-				context: await askContext(input.agent, snapshot, checkout, input.selection, version),
+				context: initialContext,
 				question: input.question
 			});
 			return context.json({ threadId: thread.id });
@@ -3803,7 +3887,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 			readReview(reviewId);
 			return context.json({ threads: store.askHistory.list(reviewId) });
 		});
-		app.post("/:id/ask/watch", async (context) => {
+		app.post("/:id/ask/watch", reviewAccess("read"), async (context) => {
 			const reviewId = context.req.param("id");
 			readReview(reviewId);
 			const { threads } = askWatchSchema.parse(await readBoundedRequestJson(context.req.raw));
@@ -3833,7 +3917,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 				entries: record.entries ?? []
 			});
 		});
-		app.post("/:id/ask/:threadId/open", async (context) => {
+		app.post("/:id/ask/:threadId/open", reviewAccess("edit"), async (context) => {
 			const reviewId = context.req.param("id");
 			const threadId = context.req.param("threadId");
 			if (ask.threads.get(threadId)?.reviewId === reviewId) return context.json({ threadId });
@@ -3843,6 +3927,8 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 			const snapshot = readReview(reviewId, record.version);
 			const checkout = await data.agentCheckout(snapshot);
 			const target = record.selection.target;
+			const initialContext = await askContext(record.agent, snapshot, checkout, record.selection, record.version);
+			assertWritable(reviewId);
 			ask.threads.open({
 				id: record.id,
 				reviewId,
@@ -3857,7 +3943,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 					sessionId: record.sessionId,
 					entries: record.entries
 				},
-				context: await askContext(record.agent, snapshot, checkout, record.selection, record.version),
+				context: initialContext,
 				onSession: (sessionId) => store.askHistory.updateSession(record.id, sessionId),
 				onTurn: () => store.askHistory.touch(record.id),
 				onSave: (entries) => store.askHistory.saveEntries(record.id, entries),
@@ -3869,7 +3955,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 			});
 			return context.json({ threadId: record.id });
 		});
-		app.post("/:id/ask/:threadId/prompt", async (context) => {
+		app.post("/:id/ask/:threadId/prompt", reviewAccess("edit"), async (context) => {
 			const thread = readThread(context.req.param("id"), context.req.param("threadId"));
 			const { question } = askFollowUpSchema.parse(await readBoundedRequestJson(context.req.raw, ASK_REQUEST_MAX_BYTES));
 			const refusal = thread.askRefusal();
@@ -3877,13 +3963,13 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 			thread.ask(question);
 			return context.json({ ok: true });
 		});
-		app.post("/:id/ask/:threadId/permission", async (context) => {
+		app.post("/:id/ask/:threadId/permission", reviewAccess("edit"), async (context) => {
 			const thread = readThread(context.req.param("id"), context.req.param("threadId"));
 			const decision = askDecisionSchema.parse(await readBoundedRequestJson(context.req.raw));
 			if (!thread.decide(decision.permissionId, decision.optionId)) throw new ReviewInputError("This request was already answered.", 409);
 			return context.json({ ok: true });
 		});
-		app.post("/:id/ask/:threadId/files", async (context) => {
+		app.post("/:id/ask/:threadId/files", reviewAccess("edit"), async (context) => {
 			const thread = readThread(context.req.param("id"), context.req.param("threadId"));
 			const { paths } = askFilesSchema.parse(await readBoundedRequestJson(context.req.raw));
 			const { cwd, entries } = thread.read();
@@ -3894,7 +3980,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 				file
 			})) });
 		});
-		app.post("/:id/ask/:threadId/choice", async (context) => {
+		app.post("/:id/ask/:threadId/choice", reviewAccess("edit"), async (context) => {
 			const thread = readThread(context.req.param("id"), context.req.param("threadId"));
 			const { kind, value } = askChoiceSchema.parse(await readBoundedRequestJson(context.req.raw));
 			if (thread.read().status !== "idle") throw new ReviewInputError("Settings can change once the agent finishes answering.", 409);
@@ -3905,7 +3991,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 			}
 			return context.json({ ok: true });
 		});
-		app.post("/:id/ask/:threadId/permissions", async (context) => {
+		app.post("/:id/ask/:threadId/permissions", reviewAccess("edit"), async (context) => {
 			const thread = readThread(context.req.param("id"), context.req.param("threadId"));
 			const { bypass } = askPermitSchema.parse(await readBoundedRequestJson(context.req.raw));
 			if (thread.read().status !== "idle") throw new ReviewInputError("Settings can change once the agent finishes answering.", 409);
@@ -3916,22 +4002,22 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 			}
 			return context.json({ ok: true });
 		});
-		app.post("/:id/ask/:threadId/retry", (context) => {
+		app.post("/:id/ask/:threadId/retry", reviewAccess("edit"), (context) => {
 			const thread = readThread(context.req.param("id"), context.req.param("threadId"));
 			if (thread.read().status !== "failed") throw new ReviewInputError("Only a conversation that failed can try again.", 409);
 			thread.retry();
 			return context.json({ ok: true });
 		});
-		app.post("/:id/ask/:threadId/cancel", async (context) => {
+		app.post("/:id/ask/:threadId/cancel", reviewAccess("read"), async (context) => {
 			await readThread(context.req.param("id"), context.req.param("threadId")).cancel();
 			return context.json({ ok: true });
 		});
-		app.post("/:id/ask/:threadId/close", (context) => {
+		app.post("/:id/ask/:threadId/close", reviewAccess("read"), (context) => {
 			readThread(context.req.param("id"), context.req.param("threadId"));
-			ask.threads.close(context.req.param("threadId"));
+			ask.threads.close(context.req.param("threadId"), !readReview(context.req.param("id")).trashedAt);
 			return context.json({ ok: true });
 		});
-		app.delete("/:id/ask/:threadId", (context) => {
+		app.delete("/:id/ask/:threadId", reviewAccess("edit"), (context) => {
 			const reviewId = context.req.param("id");
 			const threadId = context.req.param("threadId");
 			if (store.askHistory.get(threadId)?.reviewId !== reviewId) throw new ReviewInputError("This conversation was not found.", 404);
@@ -4003,6 +4089,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 		if (command.success && command.data.operation.reviewId?.startsWith("shared-")) {
 			const parsed = commandSchema.parse(input);
 			if (shared && parsed.operation.type === "delete") {
+				if (!shared.get(parsed.operation.reviewId).snapshot.trashedAt) throw new ReviewInputError("Move this whiteboard to Trash before deleting it.", 409);
 				await shared.removeLocal(parsed.operation.reviewId);
 				return context.json({
 					reviewId: parsed.operation.reviewId,
@@ -4010,8 +4097,11 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 					deleted: true
 				});
 			}
-			if (shared && parsed.operation.type === "attention") {
-				await shared.setAttention(parsed.operation.reviewId, parsed.operation.action);
+			if (shared && (parsed.operation.type === "attention" || parsed.operation.type === "lifecycle")) {
+				if (parsed.operation.type === "lifecycle") await shared.setLifecycle(parsed.operation.reviewId, parsed.operation.state);
+				else await shared.setAttention(parsed.operation.reviewId);
+				const reviewId = parsed.operation.reviewId;
+				if (shared.get(reviewId).snapshot.trashedAt) ask?.threads.closeDeletedReviews((id) => id === reviewId);
 				return context.json({
 					reviewId: parsed.operation.reviewId,
 					version: shared.get(parsed.operation.reviewId).snapshot.version,
@@ -4021,6 +4111,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 			throw new ReviewInputError("Shared reviews are read-only.", 409);
 		}
 		const result = await store.execute(input);
+		if (result.deleted || result.lifecycle && store.read(result.reviewId).trashedAt) ask?.threads.closeDeletedReviews((id) => id === result.reviewId);
 		if (input.operation.type === "edit" && data && !result.deleted) {
 			const { quotes, unquoted } = await anchorQuotes(result.version > 0 ? store.read(result.reviewId, result.version - 1) : void 0, store.read(result.reviewId, result.version), async (pins, side, file) => (await data.file(pins, side, file)).text);
 			return context.json({
@@ -4105,7 +4196,7 @@ async function locateRepositories(body, register) {
 	};
 }
 /** Send committed state, coalescing updates when the reader falls behind. */
-function watch$1(read, subscribe, probe = read) {
+function watch(read, subscribe, probe = read) {
 	probe();
 	let stop = () => {};
 	let dirty = true;
@@ -4209,6 +4300,11 @@ function createWhiteboardCore(input) {
 	});
 	const callbacks = relayReviewCallbacks(input.relay, input.softwareMapEnabled);
 	const askThreads = input.ask && new AskThreads(launchAskAgent, input.ask.tools);
+	const closeDeletedThreads = () => askThreads?.closeDeletedReviews((id) => id.startsWith("shared-") ? !shared?.has(id) || Boolean(shared.get(id).snapshot.trashedAt) : !store.has(id) || Boolean(store.read(id).trashedAt));
+	const stopLocal = askThreads && store.subscribe((result) => {
+		if (result.deleted || result.lifecycle) closeDeletedThreads();
+	});
+	const stopShared = askThreads && shared?.subscribe(closeDeletedThreads);
 	const api = createReviewApi(store, data, callbacks.open, shared, callbacks.capabilities, input.scratchpad, () => traceMachineEnabled(), input.status, input.hooks, askThreads && {
 		threads: askThreads,
 		agents: () => detectAskAgents()
@@ -4217,7 +4313,12 @@ function createWhiteboardCore(input) {
 	return {
 		app,
 		api,
-		close: () => askThreads?.closeAll()
+		close: () => {
+			stopLocal?.();
+			stopShared?.();
+			closeDeletedThreads();
+			askThreads?.closeAll();
+		}
 	};
 }
 /** The Desktop callbacks `createReviewApi` takes, answered over the relay. */

package/dist/{profile-RDEioF8b.js → profile-BsYDBr7t.js}

@@ -1,6 +1,6 @@
-import { o as initializeReviewStoreSchema, t as openLocalReviewStore } from "./local-data-Bm84Xdck.js";
+import { o as initializeReviewStoreSchema, t as openLocalReviewStore } from "./local-data-BlERtVm2.js";
+import "./review-home-paths-Y9mYWkCI.js";
 import { O as withFileLock } from "./s3-config-CAxhO9u_.js";
-import "./review-home-paths-6zZH-1c9.js";
 import { access, mkdir } from "node:fs/promises";
 import path from "node:path";
 import { DatabaseSync } from "node:sqlite";

package/dist/profile-j97aRTS7.js

@@ -0,0 +1,2 @@
+import { t as openReviewProfile } from "./profile-BsYDBr7t.js";
+export { openReviewProfile };