@dev.fast/whiteboard 0.2.5-preview.20261015.116 → 0.2.5-preview.20261015.117

package/dist/{account-alias-ChZR3RIU.js → account-alias-3-HnWkjz.js}

@@ -1,4 +1,4 @@
-import { w as ReviewCliInstallStampSchema } from "./src-Bgvf1sEN.js";
+import { w as ReviewCliInstallStampSchema } from "./src-B8adXKNt.js";
 import { $ as removeAgentTraceHook, C as disableTraceMachine, E as traceMachineStatus, G as listTraceRepositoryRoots, K as traceRepositoryStatus, Q as installHarnessHooks, S as configureTraceMachine, T as traceMachineEnabled, U as disableAllTraceRepositories, W as enableTraceRepository, Y as AGENT_TRACE_HOOK_AGENTS, Z as describeTraceHookOwners, ft as StoreClient, n as reviewDesktopStateDir, rt as traceScope, st as readStoreAuth } from "./review-home-paths-zwevIq4I.js";
 import { A as withFileLock, F as writeFileAtomicAsync, I as writePrivateJsonAtomic, M as devReviewHome } from "./s3-config-DDWWMh5x.js";
 import { i as readReviewPackageVersion } from "./package-paths-BsuI4WUf.js";

package/dist/{agent-cli-CR2PnA9G.js → agent-cli-BabaNr6w.js}

@@ -1,11 +1,11 @@
 import { n as isJsonObject, u as parseJsonText } from "./src-X9phtB2j.js";
 import { T as traceMachineEnabled } from "./review-home-paths-zwevIq4I.js";
-import { a as toolResultText, i as connectReviewInstance, s as ReviewApiError } from "./agent-client-DVd-prfp.js";
+import { a as toolResultText, i as connectReviewInstance, s as ReviewApiError } from "./agent-client-DHKowVF7.js";
 import { M as devReviewHome } from "./s3-config-DDWWMh5x.js";
-import { b as selectReviewInstance, u as REVIEW_INSTANCE_ENV } from "./server-discovery-CifQ3yQS.js";
-import { n as reviewSessionAgent } from "./review-telemetry-BqB4CiTD.js";
-import { n as REVIEW_VIA_HEADER, t as REVIEW_AGENT_HEADER } from "./request-origin-DaRIV3cB.js";
-import { i as publicTool, n as RECOVERY, r as callPublicTool, t as toolFailure } from "./tool-failure-BXWzQG8T.js";
+import { b as selectReviewInstance, u as REVIEW_INSTANCE_ENV } from "./server-discovery-BY_MN7tj.js";
+import { n as reviewSessionAgent } from "./review-telemetry-ycbk-YeT.js";
+import { n as REVIEW_VIA_HEADER, t as REVIEW_AGENT_HEADER } from "./request-origin-DjOEwBAK.js";
+import { i as publicTool, n as RECOVERY, r as callPublicTool, t as toolFailure } from "./tool-failure--Jih7UeH.js";
 //#region src/review-api/agent-cli.ts
 const reviewAgentCliHelp = "whiteboard api tools  (one line per tool)\nwhiteboard api tools <tool-name>  (its description and input schema)\nwhiteboard api <tool-name> '<json>'\nwhiteboard api <tool-name> -  (read JSON from stdin)\nwhiteboard mcp  (stdio MCP adapter; Whiteboard Desktop or whiteboard server start must be running)\nSelect headless state with DEV_REVIEW_SERVER_DIR or whiteboard --state-dir <path> api/mcp.\n";
 async function runReviewAgentCli(input) {
@@ -20,7 +20,7 @@ async function runReviewAgentCli(input) {
 		if (extra.length || mode === "mcp" && name) throw new Error("Unexpected arguments. Use whiteboard api --help.");
 		const headers = Object.fromEntries([[REVIEW_VIA_HEADER, mode === "mcp" ? "mcp" : "api"], [REVIEW_AGENT_HEADER, reviewSessionAgent(env)]]);
 		if (mode === "mcp") {
-			const { serveReviewMcp } = await import("./mcp-DBbDwG4y.js");
+			const { serveReviewMcp } = await import("./mcp-Cjs0MnoL.js");
 			await serveReviewMcp(async (key, agentKind) => {
 				const connected = await connectReviewInstance(key ? {
 					...env,

package/dist/agent-cli-CGL0kFJI.js

@@ -0,0 +1,2 @@
+import { n as runReviewAgentCli } from "./agent-cli-BabaNr6w.js";
+export { runReviewAgentCli };

package/dist/{agent-client-DVd-prfp.js → agent-client-DHKowVF7.js}

@@ -1,7 +1,7 @@
 import { d as isBooleanValue, f as isNumberValue, m as isStringValue, u as parseJsonText } from "./src-X9phtB2j.js";
-import "./src-Bgvf1sEN.js";
+import "./src-B8adXKNt.js";
 import { t as ReviewInputError } from "./input-error-OLgB_h31.js";
-import { b as selectReviewInstance, c as reviewServerStateDir, d as ReviewInstanceUnavailableError, i as readReviewServerDiscovery, l as serverNotReady, m as healthyReviewInstance, s as reviewServerIsHealthy, y as reviewInstanceUnavailable } from "./server-discovery-CifQ3yQS.js";
+import { b as selectReviewInstance, c as reviewServerStateDir, d as ReviewInstanceUnavailableError, i as readReviewServerDiscovery, l as serverNotReady, m as healthyReviewInstance, s as reviewServerIsHealthy, y as reviewInstanceUnavailable } from "./server-discovery-BY_MN7tj.js";
 //#region ../review-protocol/src/review-api-client.ts
 const defaultRequest = (url, init) => fetch(url, init);
 /** A non-2xx reply; the status tells a caller whether retrying can help. */
@@ -250,7 +250,7 @@ async function connectReviewInstance(env = process.env, headers = {}, options =
 	const selection = await selectReviewInstance({ env });
 	const discovery = healthyReviewInstance(selection);
 	if (!discovery) {
-		const { ensureServerWithoutDesktop } = await import("./background-server-D2Rrr_e2.js");
+		const { ensureServerWithoutDesktop } = await import("./background-server-xlTnBsup.js");
 		const server = await ensureServerWithoutDesktop({
 			selection,
 			env,

package/dist/{authoring-tools-BXKEwhfi.js → authoring-tools-CuGm_pVC.js}

@@ -1,5 +1,5 @@
-import { _ as activityUpdateSchema, g as activityEndSchema, h as activityBeginSchema, i as commandSchema, n as uploadSchema } from "./local-data-yfLp5PiJ.js";
-import { x as publishedEditSchema, y as pathTargetSchema } from "./stored-document-migration-CFOvjRwW.js";
+import { _ as activityUpdateSchema, g as activityEndSchema, h as activityBeginSchema, i as commandSchema, n as uploadSchema } from "./local-data-DcnL0cBy.js";
+import { S as publishedEditSchema, y as pathTargetSchema } from "./stored-document-migration-CVMl7Te5.js";
 import { t as ReviewInputError } from "./input-error-OLgB_h31.js";
 import { t as findReviewPackageRoot } from "./package-paths-BsuI4WUf.js";
 import { z } from "zod";

package/dist/{background-server-Cw7CcfaZ.js → background-server-3SrIevG5.js}

@@ -1,8 +1,8 @@
 import "./review-home-paths-zwevIq4I.js";
 import { D as liveLockOwner, O as processIsAlive } from "./s3-config-DDWWMh5x.js";
 import { t as findReviewPackageRoot } from "./package-paths-BsuI4WUf.js";
-import { a as readReviewServerHealth, c as reviewServerStateDir, i as readReviewServerDiscovery, n as desktopOwnsHome, p as desktopUsesHome, r as headlessServerLockPath } from "./server-discovery-CifQ3yQS.js";
-import { t as desktopApplicationInstalled } from "./review-app-launcher-D7I4DGoH.js";
+import { a as readReviewServerHealth, c as reviewServerStateDir, i as readReviewServerDiscovery, n as desktopOwnsHome, p as desktopUsesHome, r as headlessServerLockPath } from "./server-discovery-BY_MN7tj.js";
+import { t as desktopApplicationInstalled } from "./review-app-launcher-BkNRvyip.js";
 import { mkdir, open, readFile, realpath, stat } from "node:fs/promises";
 import path from "node:path";
 import { spawn } from "node:child_process";

package/dist/{background-server-D2Rrr_e2.js → background-server-xlTnBsup.js}

@@ -1,2 +1,2 @@
-import { a as headlessServerOwner, c as stopBackgroundServer, i as ensureServerWithoutDesktop, r as ensureBackgroundServer } from "./background-server-Cw7CcfaZ.js";
+import { a as headlessServerOwner, c as stopBackgroundServer, i as ensureServerWithoutDesktop, r as ensureBackgroundServer } from "./background-server-3SrIevG5.js";
 export { ensureBackgroundServer, ensureServerWithoutDesktop, headlessServerOwner, stopBackgroundServer };

package/dist/build-info.json

@@ -1 +1 @@
-{"version":"0.2.5-preview.20261015.116","commit":"5f769d5d5d8db0ee9b2a6ef0746c6dd2b5a322a0","dirty":true,"builtAt":"2026-10-15T00:57:30.329Z"}
+{"version":"0.2.5-preview.20261015.117","commit":"b93a4fc67175685fab7275af8c2d80577d50513b","dirty":true,"builtAt":"2026-10-15T14:00:53.987Z"}

package/dist/{cli-CSrz_wGk.js → cli-C8eB7Ot9.js}

@@ -1,4 +1,4 @@
-import { r as connectReviewApi } from "./agent-client-DVd-prfp.js";
+import { r as connectReviewApi } from "./agent-client-DHKowVF7.js";
 import { randomUUID } from "node:crypto";
 import { z } from "zod";
 //#region src/sharing/cli.ts

package/dist/{cli-runner-PlGqBeMw.js → cli-runner-VEEG16zJ.js}

@@ -1,19 +1,19 @@
 import { C as setLocalVcsCommandObserver, E as __toESM, T as __require, w as __commonJSMin } from "./src-BMPuxWv4.js";
 import { c as jsonString, n as isJsonObject, u as parseJsonText } from "./src-X9phtB2j.js";
-import { _ as REVIEW_REMOTE_AGENT_IDS, p as REVIEW_CLI_INSTALL_TARGET_LABELS, v as REVIEW_REMOTE_ATTACH_BEGIN, y as REVIEW_REMOTE_ATTACH_END } from "./src-Bgvf1sEN.js";
+import { _ as REVIEW_REMOTE_AGENT_IDS, p as REVIEW_CLI_INSTALL_TARGET_LABELS, v as REVIEW_REMOTE_ATTACH_BEGIN, y as REVIEW_REMOTE_ATTACH_END } from "./src-B8adXKNt.js";
 import { A as runTraceDeny, E as traceMachineStatus, F as describeSelection, H as resolveTraceRepositoryTarget, J as HOSTED_CAPTURE_SCOPE_DESCRIPTION, K as traceRepositoryStatus, L as loadS3TraceStorage, M as runTraceSessions, N as runTraceStoreDelete, P as runTraceStoreInfo, T as traceMachineEnabled, V as requireTraceConsent, X as agentTraceHomeDirectory, _ as runTraceRepair, _t as jsonRequestedInArgv, b as runTraceGitHook, c as registerTraceCommands, ct as runStoreLogin, d as runTraceList$1, dt as StoreApiError, et as resolveTraceCommand, f as runTracePull$1, ft as StoreClient, g as runTraceInstallMachine, gt as humanStream, h as runTraceEnable, ht as failWithJsonError, it as DEFAULT_STORE_ORIGIN, j as runTraceOnboard, k as runTraceAllow, l as resolveTraceReadStorage, lt as runStoreLogout, m as runTraceDisable, mt as emitJsonEvent, nt as traceHomeDir, p as runTraceShow, pt as withStoreAuthorization, q as readTraceUserConfig, rt as traceScope, st as readStoreAuth, u as runTraceBlame, ut as runStoreWhoami, v as runTraceStatus, w as readLegacyCaptureSettings, x as runTraceHook, y as runTraceSync, z as selectTraceStorage } from "./review-home-paths-zwevIq4I.js";
-import { o as ReviewApiClient, s as ReviewApiError } from "./agent-client-DVd-prfp.js";
+import { o as ReviewApiClient, s as ReviewApiError } from "./agent-client-DHKowVF7.js";
 import { t as resolveReviewRoot } from "./runtime-CKiWhGrf.js";
 import { C as s3ProfileSchema, E as writeTraceConfigFile, M as devReviewHome, N as normalizeStoreOrigin, S as readTraceConfigFile, T as sameS3Profile, _ as emptyTraceConfig, c as resolveS3Setup, g as currentStore, h as TraceConfigurationError, i as isS3MockMode, n as clearTraceEnvCache, o as readTraceEnvFile, p as traceSettingsPath, w as s3Store } from "./s3-config-DDWWMh5x.js";
 import { t as errorMessage } from "./error-message-OtiDonty.js";
 import { i as readReviewPackageVersion, r as readBuildInfo, t as findReviewPackageRoot } from "./package-paths-BsuI4WUf.js";
-import { a as readReviewServerHealth, b as selectReviewInstance, c as reviewServerStateDir, d as ReviewInstanceUnavailableError, f as clearDefaultReviewInstance, g as requireHealthyReviewDesktop, h as readDefaultReviewInstance, i as readReviewServerDiscovery, l as serverNotReady, m as healthyReviewInstance, p as desktopUsesHome, t as DESKTOP_TAKEOVER_SIGNAL, u as REVIEW_INSTANCE_ENV, x as writeDefaultReviewInstance, y as reviewInstanceUnavailable } from "./server-discovery-CifQ3yQS.js";
+import { a as readReviewServerHealth, b as selectReviewInstance, c as reviewServerStateDir, d as ReviewInstanceUnavailableError, f as clearDefaultReviewInstance, g as requireHealthyReviewDesktop, h as readDefaultReviewInstance, i as readReviewServerDiscovery, l as serverNotReady, m as healthyReviewInstance, p as desktopUsesHome, t as DESKTOP_TAKEOVER_SIGNAL, u as REVIEW_INSTANCE_ENV, x as writeDefaultReviewInstance, y as reviewInstanceUnavailable } from "./server-discovery-BY_MN7tj.js";
 import { t as isDirectory } from "./fs-utils-BMPLt0cr.js";
-import { t as ReviewTelemetry } from "./review-telemetry-BqB4CiTD.js";
-import { _ as connectPrompts, a as isOwnedShim, f as windowsInstallerCommand, g as CONNECT_COMMANDS, h as isInstallTarget, m as ALL_INSTALL_TARGETS, o as pathShimPath, p as scanLegacySkills, t as aliasInstallationToAccount } from "./account-alias-ChZR3RIU.js";
+import { t as ReviewTelemetry } from "./review-telemetry-ycbk-YeT.js";
+import { _ as connectPrompts, a as isOwnedShim, f as windowsInstallerCommand, g as CONNECT_COMMANDS, h as isInstallTarget, m as ALL_INSTALL_TARGETS, o as pathShimPath, p as scanLegacySkills, t as aliasInstallationToAccount } from "./account-alias-3-HnWkjz.js";
 import { t as fuzzyRank } from "./fuzzy-match-BoAmcyak.js";
-import { n as focusReviewDesktop, r as runReviewAppLaunch } from "./review-app-launcher-D7I4DGoH.js";
-import { t as reviewAgentCliHelp } from "./agent-cli-CR2PnA9G.js";
+import { n as focusReviewDesktop, r as runReviewAppLaunch } from "./review-app-launcher-BkNRvyip.js";
+import { t as reviewAgentCliHelp } from "./agent-cli-BabaNr6w.js";
 import { z } from "zod";
 import { constants, existsSync, mkdirSync, renameSync, writeFileSync } from "node:fs";
 import { access, readFile, realpath } from "node:fs/promises";
@@ -4451,7 +4451,7 @@ async function runReviewCli(input) {
 		if (!Number.isInteger(port) || port < 0 || port > 65535) throw new ReviewCliUsageError("--port must be an integer between 0 and 65535.");
 		const stateDir = reviewServerStateDir(authoringEnv(options.stateDir));
 		if (options.detach) {
-			const { ensureBackgroundServer } = await import("./background-server-D2Rrr_e2.js");
+			const { ensureBackgroundServer } = await import("./background-server-xlTnBsup.js");
 			const { discovery, started } = await ensureBackgroundServer({
 				stateDir,
 				env,
@@ -4473,7 +4473,7 @@ async function runReviewCli(input) {
 		process.once("SIGINT", stop);
 		process.once("SIGTERM", stop);
 		process.once(DESKTOP_TAKEOVER_SIGNAL, takeover);
-		const { HeadlessServerBusyError, runHeadlessServer } = await import("./headless-host-Cp37C-v0.js");
+		const { HeadlessServerBusyError, runHeadlessServer } = await import("./headless-host-CEaaG0YT.js");
 		try {
 			await runHeadlessServer({
 				stateDir,
@@ -4510,7 +4510,7 @@ async function runReviewCli(input) {
 	configureJsonOutput(serverCommand.command("stop").description("Stop a background server started by --detach, the CLI, or Desktop").option("--state-dir <path>", "directory selected when starting the server"), "plain").action(async (_options, command) => {
 		const options = command.optsWithGlobals();
 		const stateDir = reviewServerStateDir(authoringEnv(options.stateDir));
-		const { headlessServerOwner, stopBackgroundServer } = await import("./background-server-D2Rrr_e2.js");
+		const { headlessServerOwner, stopBackgroundServer } = await import("./background-server-xlTnBsup.js");
 		const owner = await headlessServerOwner(stateDir);
 		const discovery = await readReviewServerDiscovery(stateDir);
 		if (owner === void 0) {
@@ -4538,7 +4538,7 @@ async function runReviewCli(input) {
 		if (!existsSync(path.join(stateDir, "review-api.db"))) throw new Error(`No saved reviews in ${stateDir}, so there is no server id to reset. Check --state-dir.`);
 		const inUse = `A Whiteboard server is using ${stateDir}. Stop it first, then run whiteboard server reset-id again.`;
 		if (await desktopUsesHome(stateDir, env)) return refuse(inUse, options.json);
-		const [{ openReviewProfile }, { withHeadlessServerLock }] = await Promise.all([import("./profile-BSOkA6A-.js"), import("./headless-host-Cp37C-v0.js")]);
+		const [{ openReviewProfile }, { withHeadlessServerLock }] = await Promise.all([import("./profile-BIwE4tC6.js"), import("./headless-host-CEaaG0YT.js")]);
 		const reset = await withHeadlessServerLock(await realpath(stateDir), async () => {
 			const local = await openReviewProfile(stateDir, { manageWorkspaces: false });
 			try {
@@ -4560,7 +4560,7 @@ async function runReviewCli(input) {
 	configureJsonOutput(remote.command("attach").description("Start a background server if none is healthy and report how to reach it").option("--state-dir <path>", "directory for saved reviews and server discovery").option("--groups <groups>", "comma-separated optional extension groups the Desktop has enabled, such as go").option("--replace", "stop a running server of another version that the CLI or Desktop started, and start this one"), "plain").action(async (_options, command) => {
 		const options = command.optsWithGlobals();
 		const stateDir = reviewServerStateDir(authoringEnv(options.stateDir));
-		const { remoteAttach } = await import("./remote-attach-BAt2eZx3.js");
+		const { remoteAttach } = await import("./remote-attach-xGlaS772.js");
 		let attach;
 		try {
 			attach = await remoteAttach({
@@ -4583,11 +4583,11 @@ async function runReviewCli(input) {
 			state.exitCode = 1;
 			return;
 		}
-		input.stdout.write(options.json ? `${REVIEW_REMOTE_ATTACH_BEGIN}\n${JSON.stringify(attach)}\n${REVIEW_REMOTE_ATTACH_END}\n` : `Whiteboard server ${attach.startedServer ? "started" : "already running"} at ${attach.url}\nLanguage features: ${attach.languageServer ? `VS Code server on port ${attach.languageServer.port}` : `unavailable (${attach.languageServerDetail})`}\n`);
+		input.stdout.write(options.json ? `${REVIEW_REMOTE_ATTACH_BEGIN}\n${JSON.stringify(attach)}\n${REVIEW_REMOTE_ATTACH_END}\n` : `Whiteboard server ${attach.startedServer ? "started" : "already running"} at ${attach.url}\nLanguage features: ${attach.languageServer ? `language server on port ${attach.languageServer.port}` : `unavailable (${attach.languageServerDetail})`}\n`);
 	});
-	configureJsonOutput(remote.command("extensions").description("Language extensions for the VS Code server on a remote").command("ensure").description("Download the curated extensions for this machine and list them for the VS Code server").option("--groups <groups>", "comma-separated optional extension groups the Desktop has enabled, such as go"), "plain").action(async (_options, command) => {
+	configureJsonOutput(remote.command("extensions").description("Language extensions for the language server on a remote").command("ensure").description("Download the curated extensions for this machine and list them for the language server").option("--groups <groups>", "comma-separated optional extension groups the Desktop has enabled, such as go"), "plain").action(async (_options, command) => {
 		const { json, groups } = command.optsWithGlobals();
-		const { ensureRemoteExtensions } = await import("./remote-extensions-2Cxf3hMo.js");
+		const { ensureRemoteExtensions } = await import("./remote-extensions-ByiuSl1D.js");
 		const result = await ensureRemoteExtensions({
 			env,
 			groups: groups?.split(",").map((group) => group.trim())
@@ -4602,7 +4602,7 @@ async function runReviewCli(input) {
 	configureJsonOutput(remote.command("uninstall").description("Remove what Whiteboard Desktop installed on this host, stopping a server it started").addOption(new Option("--keep-reviews", "leave the saved reviews in place").conflicts("deleteReviews")).addOption(new Option("--delete-reviews", "also delete the saved reviews")).option("--state-dir <path>", "directory for saved reviews and server discovery"), "plain").action(async (_options, command) => {
 		const options = command.optsWithGlobals();
 		const stateDir = reviewServerStateDir(authoringEnv(options.stateDir));
-		const { remoteUninstall } = await import("./remote-uninstall-DLtDG0o7.js");
+		const { remoteUninstall } = await import("./remote-uninstall-DGdIgpEg.js");
 		let deleteReviews = options.deleteReviews ? true : options.keepReviews ? false : void 0;
 		if (deleteReviews === void 0 && !options.json && input.stdin?.isTTY) {
 			const prompt = createInterface$1({
@@ -4810,14 +4810,14 @@ async function runReviewCli(input) {
 		command.showHelpAfterError(false).error("Markdown review migration is no longer supported. Ask your agent to migrate your old Whiteboard reviews.");
 	});
 	configureJsonOutput(configureJsonOutput(program.command("share").description("Upload an immutable review snapshot and return its share link"), "plain").option("--review <id>", "review ID").option("--version <number>", "Saved version to share").option("--preview", "Open the share link in Whiteboard Preview by default").option("--request-id <uuid>", "Reuse this ID when retrying the same immutable upload").action(async (options) => {
-		const { runShareCli } = await import("./cli-CSrz_wGk.js");
+		const { runShareCli } = await import("./cli-C8eB7Ot9.js");
 		state.exitCode = await runShareCli({
 			...input,
 			...options,
 			env: authoringEnv()
 		});
 	}).command("revoke <share-id>").description("Revoke future downloads of a share"), "plain").action(async (shareId, options) => {
-		const { runShareCli } = await import("./cli-CSrz_wGk.js");
+		const { runShareCli } = await import("./cli-C8eB7Ot9.js");
 		state.exitCode = await runShareCli({
 			...input,
 			...options,
@@ -4898,7 +4898,7 @@ async function runReviewCli(input) {
 		return commands;
 	} });
 	for (const [name, description] of [["api", "Call a JSON review authoring tool on the running server"], ["mcp", "Serve the JSON review authoring tools over stdio MCP"]]) configureOutput(program.command(name).description(description).argument("[args...]", "tool name and JSON input").allowUnknownOption().allowExcessArguments().helpOption(false).passThroughOptions().addHelpText("after", `\n${reviewAgentCliHelp}`), "plain").action(async (args) => {
-		const { runReviewAgentCli } = await import("./agent-cli-CRPPmS3l.js");
+		const { runReviewAgentCli } = await import("./agent-cli-CGL0kFJI.js");
 		state.exitCode = await runReviewAgentCli({
 			...input,
 			env: authoringEnv(),

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { a as jsonNumber, c as jsonString, o as jsonObject, u as parseJsonText } from "./src-X9phtB2j.js";
-import "./src-Bgvf1sEN.js";
+import "./src-B8adXKNt.js";
 import { existsSync, readFileSync, readdirSync, realpathSync } from "node:fs";
 import path from "node:path";
 import os from "node:os";
@@ -17,7 +17,7 @@ async function runCli(effectivePath) {
 `);
 		return 1;
 	}
-	const { runReviewCli } = await import("./cli-runner-PlGqBeMw.js");
+	const { runReviewCli } = await import("./cli-runner-VEEG16zJ.js");
 	return runReviewCli({
 		argv,
 		cliPaths: {

package/dist/{client-DhZzPePs.js → client-BBBwu0P7.js}

@@ -1,7 +1,7 @@
 import { f as gitAt } from "./src-BMPuxWv4.js";
 import { n as isJsonObject, u as parseJsonText } from "./src-X9phtB2j.js";
-import "./src-Bgvf1sEN.js";
-import { B as parseMarkdown, C as resourceReferences, E as sourceReferences, K as sourceAnchors, M as lensSchema, N as lensSelections, O as checkReferences, S as resourceReference, _ as hasCodeReferences, b as pinsSchema, c as traceSchema, h as elements, l as textIncludesQuote, n as migrateStoredDocument, o as normalizedSoftwareElementSchema, p as documentSchema, r as migrateStoredLenses, s as normalizedSoftwareRelationshipSchema, t as liftFileLenses, u as anchorPins, z as markdownNodes } from "./stored-document-migration-CFOvjRwW.js";
+import "./src-B8adXKNt.js";
+import { B as markdownNodes, C as resourceReference, D as sourceReferences, N as lensSchema, P as lensSelections, V as parseMarkdown, _ as hasCodeReferences, c as traceSchema, h as elements, k as checkReferences, l as textIncludesQuote, n as migrateStoredDocument, o as normalizedSoftwareElementSchema, p as documentSchema, q as sourceAnchors, r as migrateStoredLenses, s as normalizedSoftwareRelationshipSchema, t as liftFileLenses, u as anchorPins, w as resourceReferences, x as pinsSchema } from "./stored-document-migration-CVMl7Te5.js";
 import { t as ReviewInputError } from "./input-error-OLgB_h31.js";
 import { createHash, randomUUID } from "node:crypto";
 import { z } from "zod";

package/dist/{headless-host-Cp37C-v0.js → headless-host-CEaaG0YT.js}

@@ -1,2 +1,2 @@
-import { i as withHeadlessServerLock, n as runHeadlessServer, r as takeOverServerHome, t as HeadlessServerBusyError } from "./headless-host-CVXTSIlx.js";
+import { i as withHeadlessServerLock, n as runHeadlessServer, r as takeOverServerHome, t as HeadlessServerBusyError } from "./headless-host-DI82imwx.js";
 export { HeadlessServerBusyError, runHeadlessServer, takeOverServerHome, withHeadlessServerLock };

package/dist/{headless-host-CVXTSIlx.js → headless-host-DI82imwx.js}

@@ -1,20 +1,20 @@
 import { d as git, r as defaultBranch } from "./src-BMPuxWv4.js";
 import { c as jsonString, m as isStringValue, n as isJsonObject, p as isObjectValue, u as parseJsonText } from "./src-X9phtB2j.js";
-import { a as sharedReviewId, c as verifyShareRepository, d as StreamLimitError, f as readBoundedStream, l as exportShare, m as shareIdSchema, n as ShareClient, p as parseShareLink, r as SharePreflightError, s as readShareRepository, t as ShareAuthError, u as validateShareSources } from "./client-DhZzPePs.js";
-import { a as inspectSnapshot, b as diffrMissingError, c as askAgentIds, d as askPicksSchema, f as askQuestionSchema, i as commandSchema, l as askChoiceKinds, m as selectionMarkdown, p as AgentSelectionSchema, r as SCRATCHPAD_ID, s as applyAskChange, u as askPermissionsSchema, v as invalidateStructuralComparisons, y as diffrExecutable } from "./local-data-yfLp5PiJ.js";
-import { A as reviewDiffrSummarizerInputSchema, D as ReviewOnboardingRunRequestSchema, a as parseReviewVerbRequest, g as REVIEW_HOST_HEADER, i as parseReviewDesktopVerbResult, j as decodeStructuralDiffEvent } from "./src-Bgvf1sEN.js";
+import { a as sharedReviewId, c as verifyShareRepository, d as StreamLimitError, f as readBoundedStream, l as exportShare, m as shareIdSchema, n as ShareClient, p as parseShareLink, r as SharePreflightError, s as readShareRepository, t as ShareAuthError, u as validateShareSources } from "./client-BBBwu0P7.js";
+import { a as inspectSnapshot, b as diffrMissingError, c as askAgentIds, d as askPicksSchema, f as askQuestionSchema, i as commandSchema, l as askChoiceKinds, m as selectionMarkdown, p as AgentSelectionSchema, r as SCRATCHPAD_ID, s as applyAskChange, u as askPermissionsSchema, v as invalidateStructuralComparisons, y as diffrExecutable } from "./local-data-DcnL0cBy.js";
+import { A as reviewDiffrSummarizerInputSchema, D as ReviewOnboardingRunRequestSchema, a as parseReviewVerbRequest, g as REVIEW_HOST_HEADER, i as parseReviewDesktopVerbResult, j as decodeStructuralDiffEvent } from "./src-B8adXKNt.js";
 import { B as TraceStorageDeniedError, D as listReviewTraceSessions, I as isTraceStorageConfigured, O as loadReviewAgentTrace, R as resolveTraceStorage, T as traceMachineEnabled, at as clearStoreAuth, ct as runStoreLogin, it as DEFAULT_STORE_ORIGIN, ot as openUrlInBrowser, st as readStoreAuth, tt as shellQuote, z as selectTraceStorage } from "./review-home-paths-zwevIq4I.js";
-import { $ as unionIntervals, G as selectionKey, H as comparisonKey, I as fileLineRangeSchema, J as coverageSources, N as lensSelections, Q as subtractIntervals, T as selectionReferences, U as formatAnchor, V as anchorSelection, W as resolveDiffSelection, Y as emptyCoverage, Z as scopedCoverage, h as elements, k as UNCATEGORIZED_LENS_ID, u as anchorPins } from "./stored-document-migration-CFOvjRwW.js";
+import { $ as subtractIntervals, A as UNCATEGORIZED_LENS_ID, E as selectionReferences, G as resolveDiffSelection, H as anchorSelection, K as selectionKey, L as fileLineRangeSchema, P as lensSelections, Q as scopedCoverage, U as comparisonKey, W as formatAnchor, X as emptyCoverage, Y as coverageSources, et as unionIntervals, h as elements, u as anchorPins } from "./stored-document-migration-CVMl7Te5.js";
 import { t as ReviewInputError } from "./input-error-OLgB_h31.js";
 import { A as withFileLock, I as writePrivateJsonAtomic, M as devReviewHome, h as TraceConfigurationError, i as isS3MockMode } from "./s3-config-DDWWMh5x.js";
 import { t as errorMessage } from "./error-message-OtiDonty.js";
 import { i as readReviewPackageVersion, n as readBuildCommit, t as findReviewPackageRoot } from "./package-paths-BsuI4WUf.js";
-import { i as readReviewServerDiscovery, n as desktopOwnsHome, o as reviewServerDiscoveryPath, p as desktopUsesHome, r as headlessServerLockPath, t as DESKTOP_TAKEOVER_SIGNAL } from "./server-discovery-CifQ3yQS.js";
-import { t as openReviewProfile } from "./profile-pAzg7fxC.js";
-import { a as REVIEW_APP_SESSION_ID_HEADER, c as sanitizeUiTelemetryEvent, i as BUNDLE_FRAME_PATTERN, l as cleanTelemetryText, r as reviewRequestOrigin, s as isReportableCleanedMessage } from "./request-origin-DaRIV3cB.js";
-import { a as scratchpadAvailable, c as readQuerySchemas, i as renderInstructions, o as inspectQuerySchema, r as instructionsQuerySchema, s as queryAnchor, t as authoringTools } from "./authoring-tools-BXKEwhfi.js";
+import { i as readReviewServerDiscovery, n as desktopOwnsHome, o as reviewServerDiscoveryPath, p as desktopUsesHome, r as headlessServerLockPath, t as DESKTOP_TAKEOVER_SIGNAL } from "./server-discovery-BY_MN7tj.js";
+import { t as openReviewProfile } from "./profile-BoWYDne6.js";
+import { a as REVIEW_APP_SESSION_ID_HEADER, c as sanitizeUiTelemetryEvent, i as BUNDLE_FRAME_PATTERN, l as cleanTelemetryText, r as reviewRequestOrigin, s as isReportableCleanedMessage } from "./request-origin-DjOEwBAK.js";
+import { a as scratchpadAvailable, c as readQuerySchemas, i as renderInstructions, o as inspectQuerySchema, r as instructionsQuerySchema, s as queryAnchor, t as authoringTools } from "./authoring-tools-CuGm_pVC.js";
 import { t as fuzzyRank } from "./fuzzy-match-BoAmcyak.js";
-import { a as headlessServerOwner, c as stopBackgroundServer } from "./background-server-Cw7CcfaZ.js";
+import { a as headlessServerOwner, c as stopBackgroundServer } from "./background-server-3SrIevG5.js";
 import { createRequire } from "node:module";
 import crypto$1, { createHash, randomBytes, randomUUID } from "node:crypto";
 import { z } from "zod";
@@ -2146,8 +2146,14 @@ function applyCorsHeaders(request, response) {
 	response.headers.set("access-control-expose-headers", REVIEW_HOST_HEADER);
 	return response;
 }
+/** The allowed origin, headers and methods hold for the server's lifetime, so
+* the client may reuse a preflight. Chromium otherwise keeps one for 5 s, and
+* nearly every request paid a second round trip. Two hours is Chromium's cap. */
+const PREFLIGHT_MAX_AGE_SECONDS = 7200;
 function corsPreflightResponse(request) {
-	return applyCorsHeaders(request, new Response(null, { status: 204 }));
+	const response = applyCorsHeaders(request, new Response(null, { status: 204 }));
+	response.headers.set("access-control-max-age", String(PREFLIGHT_MAX_AGE_SECONDS));
+	return response;
 }
 function isAuthorizedRequest(request, expectedToken) {
 	const supplied = request.headers.get("x-review-token") ?? new URL(request.url).searchParams.get("token");
@@ -4262,7 +4268,7 @@ function createReviewApi(store, data, open, shared, capabilities = () => ({
 			head: `b/${diff.newPath}`
 		} : void 0);
 		return [
-			target.kind === "review" ? `Whiteboard: ${snapshot.title}` : `Selected ${target.kind === "text" ? "text" : "code"} from Whiteboard: ${snapshot.title}`,
+			`Whiteboard: ${snapshot.title}`,
 			`Session ID: ${snapshot.reviewId}`,
 			`Version: ${snapshot.version}`,
 			...selection.apiSource?.commit ? [`Selected commit: ${selection.apiSource.commit}`] : [],

package/dist/{local-data-yfLp5PiJ.js → local-data-DcnL0cBy.js}

@@ -1,8 +1,8 @@
 import { _ as parseGitRemote, a as diff, b as resolveRepoContextSync, c as diffFileSummariesWorkingTree, d as git, g as listTrackedFilesAtCommit, h as listCommitRange, i as detectLocalVcs, l as diffTrees, m as jjRevisionIsConflicted, n as createBlobBatchReader, p as gitCommonDir, s as diffFileSummariesTrees, t as LocalVcsToolsMissingError, u as diffWorkingTree, v as readFileAtCommit, x as resolveRevision, y as resolveRepoContext } from "./src-BMPuxWv4.js";
 import { c as jsonString, o as jsonObject, u as parseJsonText } from "./src-X9phtB2j.js";
-import { C as ReviewApiSelectionSourceSchema, M as structuralChangeCounts, O as ReviewSelectedDiffSchema, j as decodeStructuralDiffEvent, k as SCRATCHPAD_REVIEW_ID } from "./src-Bgvf1sEN.js";
+import { C as ReviewApiSelectionSourceSchema, M as structuralChangeCounts, O as ReviewSelectedDiffSchema, j as decodeStructuralDiffEvent, k as SCRATCHPAD_REVIEW_ID } from "./src-B8adXKNt.js";
 import { s as safeStorageSegment } from "./review-home-paths-zwevIq4I.js";
-import { $ as unionIntervals, A as applyLensEdit, C as resourceReferences, D as summarizeEdit, E as sourceReferences, F as checkSourcePath, I as fileLineRangeSchema, K as sourceAnchors, L as requireVisibleSource, N as lensSelections, O as checkReferences, P as SourceRangeError, Q as subtractIntervals, R as sliceSourceRange, S as resourceReference, X as intersectIntervals, Y as emptyCoverage, a as defineSoftwareMap, b as pinsSchema, c as traceSchema, d as applyEdit, et as updateCoverage, f as assignFreshIds, g as explicitPins, h as elements, i as SoftwareModelValidationError, j as lensEditSchema, l as textIncludesQuote, m as editSchema, n as migrateStoredDocument, p as documentSchema, q as coverageSchema, r as migrateStoredLenses, t as liftFileLenses, u as anchorPins, v as isUnit, w as reviewTargetSchema } from "./stored-document-migration-CFOvjRwW.js";
+import { $ as subtractIntervals, C as resourceReference, D as sourceReferences, F as SourceRangeError, I as checkSourcePath, J as coverageSchema, L as fileLineRangeSchema, M as lensEditSchema, O as summarizeEdit, P as lensSelections, R as requireVisibleSource, T as reviewTargetSchema, X as emptyCoverage, Z as intersectIntervals, a as defineSoftwareMap, b as pinnedRepositoryIds, c as traceSchema, d as applyEdit, et as unionIntervals, f as assignFreshIds, g as explicitPins, h as elements, i as SoftwareModelValidationError, j as applyLensEdit, k as checkReferences, l as textIncludesQuote, m as editSchema, n as migrateStoredDocument, p as documentSchema, q as sourceAnchors, r as migrateStoredLenses, t as liftFileLenses, tt as updateCoverage, u as anchorPins, v as isUnit, w as resourceReferences, x as pinsSchema, z as sliceSourceRange } from "./stored-document-migration-CVMl7Te5.js";
 import { t as ReviewInputError } from "./input-error-OLgB_h31.js";
 import { A as withFileLock, I as writePrivateJsonAtomic, O as processIsAlive } from "./s3-config-DDWWMh5x.js";
 import { t as errorMessage } from "./error-message-OtiDonty.js";
@@ -1698,14 +1698,14 @@ const AgentSelectionSchema = z.strictObject({
 });
 function selectionMarkdown(selection, sourceExcerpt = "", diffPaths) {
 	const target = selection.target;
-	if (selection.selectedDiff) return selectedDiffMarkdown(selection.selectedDiff, diffPaths);
+	if (selection.selectedDiff) return `Selected diff:\n${selectedDiffMarkdown(selection.selectedDiff, diffPaths)}`;
 	if (target.kind === "review") return "";
-	if (target.kind === "text") return target.quote.split(/\r?\n/).map((line) => `> ${line}`).join("\n");
-	return [
+	if (target.kind === "text") return `Selected text:\n${target.quote.split(/\r?\n/).map((line) => `> ${line}`).join("\n")}`;
+	return `Selected code:\n${[
 		`## ${selection.title}`,
 		selection.detail ?? "",
 		sourceExcerpt
-	].filter(Boolean).join("\n\n");
+	].filter(Boolean).join("\n\n")}`;
 }
 function selectedDiffMarkdown(diff, paths) {
 	const oldCount = diff.rows.filter((row) => row.kind !== "added").length;
@@ -2376,16 +2376,63 @@ var ReviewStore = class {
 		};
 	}
 	refreshPending;
+	/** What the last refresh saw of each review. A live worktree's snapshot is
+	* kept, since every pass projects it again. */
+	refreshed = /* @__PURE__ */ new Map();
+	availableRepositories;
+	/** Reviews whose source may have moved since the last pass: every live
+	* worktree, and any other review that is new, edited, restored from trash or
+	* reads from a repository that appeared or went away. */
+	*reviewsToRefresh() {
+		const available = new Set(this.repositories().filter((repository) => existsSync(repository.path)).map((repository) => repository.id));
+		const previous = this.availableRepositories;
+		this.availableRepositories = available;
+		const flipped = (id) => !previous || previous.has(id) !== available.has(id);
+		const rows = this.db.prepare("SELECT reviews.id, reviews.version, review_attention.deleted_at FROM reviews LEFT JOIN review_attention ON review_attention.review_id=reviews.id").all();
+		const present = /* @__PURE__ */ new Set();
+		for (const row of rows) {
+			const reviewId = String(row.id);
+			const version = Number(row.version);
+			const state = `${version}\0${row.deleted_at ?? ""}`;
+			present.add(reviewId);
+			let seen = this.refreshed.get(reviewId);
+			if (seen?.state === state) {
+				if (seen.live) yield seen.live;
+				else if ([...seen.repositories].some(flipped)) yield this.read(reviewId, version);
+				continue;
+			}
+			const snapshot = row.deleted_at ? void 0 : this.read(reviewId, version);
+			if (!snapshot) {
+				this.refreshed.set(reviewId, {
+					state,
+					repositories: /* @__PURE__ */ new Set()
+				});
+				continue;
+			}
+			const live = snapshot.target?.kind === "worktree";
+			seen = {
+				state,
+				repositories: live ? /* @__PURE__ */ new Set() : /* @__PURE__ */ new Set([...snapshot.pins ? [snapshot.pins.repositoryId] : [], ...pinnedRepositoryIds(snapshot.document)]),
+				live: live ? snapshot : void 0
+			};
+			this.refreshed.set(reviewId, seen);
+			yield snapshot;
+		}
+		for (const reviewId of this.refreshed.keys()) if (!present.has(reviewId)) this.refreshed.delete(reviewId);
+	}
 	/** Refresh source state without writing authored document versions. Serialized with edits. */
 	refreshWorktrees() {
 		if (this.closing || !this.providers.resolveTarget) return Promise.resolve();
 		if (this.refreshPending) return this.refreshPending;
 		const run = this.pending.then(async () => {
-			for (const summary of this.list()) {
-				if (summary.trashedAt) continue;
-				const snapshot = this.read(summary.reviewId, summary.version);
+			let slice = performance.now();
+			for (const snapshot of this.reviewsToRefresh()) {
+				if (performance.now() - slice > 16) {
+					await new Promise((resolve) => setImmediate(resolve));
+					slice = performance.now();
+				}
 				try {
-					const live = this.liveSources.get(summary.reviewId);
+					const live = this.liveSources.get(snapshot.reviewId);
 					const last = live?.version === snapshot.version ? live : snapshot;
 					const previous = last.pins;
 					const projected = await this.projectLiveSource(snapshot, last);
@@ -3139,6 +3186,27 @@ function inspectSnapshot(snapshot, targetId) {
 	}));
 }
 //#endregion
+//#region src/review-api/version-cache.ts
+/** A stored version never changes, so work derived from it runs once. Keeps
+* the `capacity` most recently used results. */
+var VersionCache = class {
+	derive;
+	options;
+	results = /* @__PURE__ */ new Map();
+	constructor(derive, options) {
+		this.derive = derive;
+		this.options = options;
+	}
+	get(input) {
+		const key = this.options.key?.(input) ?? `${input.reviewId}\0${input.version}`;
+		const result = this.results.get(key) ?? this.derive(input);
+		this.results.delete(key);
+		if (this.results.size >= this.options.capacity) this.results.delete(this.results.keys().next().value);
+		this.results.set(key, result);
+		return result;
+	}
+};
+//#endregion
 //#region src/review-api/workspaces.ts
 const OWNED_ELSEWHERE = "Another Whiteboard server is managing this review's language workspaces. Retry once it stops.";
 /** Local lifecycle only: source and authored history never depend on preparation.
@@ -3942,18 +4010,20 @@ var LocalReviewData = class {
 		if (!existsSync(this.store.repositoryPath(anchor.repositoryId))) throw unavailableCheckout();
 		return anchorPins({ pins: anchor }, void 0);
 	}
-	/** References whose own repository is unregistered or gone from disk. */
+	/** References whose own repository is unregistered or gone from disk.
+	* `snapshot` is a stored version. */
 	async unavailableAnchors(snapshot) {
 		const missing = /* @__PURE__ */ new Set();
-		for (const pins of explicitPins(sourceReferences(snapshot.document, { tolerant: true }))) try {
-			await this.anchorSourcePins(pins);
+		for (const repositoryId of pinnedRepositoryIds(snapshot.document)) try {
+			if (!existsSync(this.store.repositoryPath(repositoryId))) missing.add(repositoryId);
 		} catch (error) {
 			if (!(error instanceof ReviewInputError)) throw error;
-			missing.add(pins.repositoryId);
+			missing.add(repositoryId);
 		}
 		if (!missing.size) return [];
-		return sourceReferences(snapshot.document, { tolerant: true }).filter((ref) => ref.source.pins && missing.has(ref.source.pins.repositoryId)).map((ref) => ref.id);
+		return this.storedReferences.get(snapshot).filter((ref) => ref.source.pins && missing.has(ref.source.pins.repositoryId)).map((ref) => ref.id);
 	}
+	storedReferences = new VersionCache((snapshot) => sourceReferences(snapshot.document, { tolerant: true }), { capacity: 512 });
 	trackedFiles = /* @__PURE__ */ new Map();
 	repositories = /* @__PURE__ */ new Map();
 	readers = /* @__PURE__ */ new Map();

package/dist/{mcp-DBbDwG4y.js → mcp-Cjs0MnoL.js}

@@ -1,7 +1,7 @@
-import { a as toolResultText, s as ReviewApiError } from "./agent-client-DVd-prfp.js";
+import { a as toolResultText, s as ReviewApiError } from "./agent-client-DHKowVF7.js";
 import { t as ReviewInputError } from "./input-error-OLgB_h31.js";
-import { n as REVIEW_STATUS_TOOL, t as authoringTools } from "./authoring-tools-BXKEwhfi.js";
-import { i as publicTool, n as RECOVERY, r as callPublicTool, t as toolFailure } from "./tool-failure-BXWzQG8T.js";
+import { n as REVIEW_STATUS_TOOL, t as authoringTools } from "./authoring-tools-CuGm_pVC.js";
+import { i as publicTool, n as RECOVERY, r as callPublicTool, t as toolFailure } from "./tool-failure--Jih7UeH.js";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";

package/dist/profile-BIwE4tC6.js

@@ -0,0 +1,2 @@
+import { t as openReviewProfile } from "./profile-BoWYDne6.js";
+export { openReviewProfile };

package/dist/{profile-pAzg7fxC.js → profile-BoWYDne6.js}

@@ -1,4 +1,4 @@
-import { o as initializeReviewStoreSchema, t as openLocalReviewStore } from "./local-data-yfLp5PiJ.js";
+import { o as initializeReviewStoreSchema, t as openLocalReviewStore } from "./local-data-DcnL0cBy.js";
 import "./review-home-paths-zwevIq4I.js";
 import { A as withFileLock } from "./s3-config-DDWWMh5x.js";
 import { access, mkdir } from "node:fs/promises";

package/dist/{remote-attach-BAt2eZx3.js → remote-attach-xGlaS772.js}

@@ -1,7 +1,7 @@
 import { i as readReviewPackageVersion } from "./package-paths-BsuI4WUf.js";
-import { a as readReviewServerHealth, l as serverNotReady } from "./server-discovery-CifQ3yQS.js";
-import { c as stopBackgroundServer, o as recordedBackgroundServer, r as ensureBackgroundServer } from "./background-server-Cw7CcfaZ.js";
-import { t as ensureRemoteLanguageServer } from "./remote-language-server-DQgWUNeV.js";
+import { a as readReviewServerHealth, l as serverNotReady } from "./server-discovery-BY_MN7tj.js";
+import { c as stopBackgroundServer, o as recordedBackgroundServer, r as ensureBackgroundServer } from "./background-server-3SrIevG5.js";
+import { t as ensureRemoteLanguageServer } from "./remote-language-server-Chz8NQvC.js";
 import path from "node:path";
 import { spawn } from "node:child_process";
 import { gt, valid } from "semver";

package/dist/{remote-extensions-2Cxf3hMo.js → remote-extensions-ByiuSl1D.js}

@@ -1,2 +1,2 @@
-import { t as ensureRemoteExtensions } from "./remote-extensions-BiNx6NQK.js";
+import { t as ensureRemoteExtensions } from "./remote-extensions-D_4DSOhO.js";
 export { ensureRemoteExtensions };

package/dist/{remote-extensions-BiNx6NQK.js → remote-extensions-D_4DSOhO.js}

@@ -15,7 +15,7 @@ import yauzl from "yauzl";
 //#region src/pinned-download.ts
 const DOWNLOAD_TIMEOUT_MS = 12e4;
 /** Streams `url` into `file` through a temporary file and returns its sha256. */
-async function downloadFile(url, file, { size, timeoutMs = DOWNLOAD_TIMEOUT_MS, signal } = {}) {
+async function downloadFile(url, file, { timeoutMs = DOWNLOAD_TIMEOUT_MS, signal } = {}) {
 	const { host } = new URL(url);
 	const partial = `${file}.${process.pid}.part`;
 	let response;
@@ -27,13 +27,9 @@ async function downloadFile(url, file, { size, timeoutMs = DOWNLOAD_TIMEOUT_MS,
 	}
 	if (!response.ok || !response.body) throw new Error(`${host} answered ${response.status} for ${url}`);
 	const hash = createHash("sha256");
-	let received = 0;
-	const tooLarge = /* @__PURE__ */ new Error(`${url} is larger than its pinned ${size} bytes`);
 	try {
 		await pipeline(Readable.fromWeb(response.body), async function* (chunks) {
 			for await (const chunk of chunks) {
-				received += chunk.length;
-				if (size !== void 0 && received > size) throw tooLarge;
 				hash.update(chunk);
 				yield chunk;
 			}
@@ -41,7 +37,6 @@ async function downloadFile(url, file, { size, timeoutMs = DOWNLOAD_TIMEOUT_MS,
 		await rename(partial, file);
 	} catch (error) {
 		await rm(partial, { force: true });
-		if (error === tooLarge) throw error;
 		throw new Error(`Network error downloading from ${host}: ${error instanceof Error ? networkCause(error) : String(error)}`);
 	}
 	return hash.digest("hex");
@@ -49,10 +44,7 @@ async function downloadFile(url, file, { size, timeoutMs = DOWNLOAD_TIMEOUT_MS,
 /** Leaves a matching `file` in place; otherwise downloads it and checks the pin. */
 async function downloadPinned(pin, file, options = {}) {
 	if (await sha256File(file).catch(() => void 0) === pin.sha256) return;
-	const actual = await downloadFile(pin.url, file, {
-		...options,
-		size: pin.size
-	});
+	const actual = await downloadFile(pin.url, file, options);
 	if (actual !== pin.sha256) {
 		await rm(file, { force: true });
 		throw new Error(`Checksum mismatch for ${pin.url}: expected ${pin.sha256}, got ${actual}. The download was deleted.`);
@@ -73,8 +65,7 @@ const manifestSchema = z.looseObject({
 	engines: z.looseObject({ vscode: z.string().optional() }).optional()
 });
 /** Unpacks a VSIX's `extension/` payload into `destination`. */
-async function extractVsix(vsix, destination, maxBytes = Number.POSITIVE_INFINITY) {
-	let unpacked = 0;
+async function extractVsix(vsix, destination) {
 	const zip = await new Promise((resolve, reject) => yauzl.open(vsix, { lazyEntries: true }, (error, opened) => error ? reject(error) : resolve(opened)));
 	const openReadStream = (entry) => new Promise((resolve, reject) => zip.openReadStream(entry, (error, stream) => error ? reject(error) : resolve(stream)));
 	try {
@@ -90,8 +81,6 @@ async function extractVsix(vsix, destination, maxBytes = Number.POSITIVE_INFINIT
 					const mode = entry.externalFileAttributes >>> 16 & 65535;
 					if (parts.some((part) => part === ".." || part === "." || part === "" || part.includes(":")) || path.posix.isAbsolute(relative)) throw new Error(`VSIX contains an unsafe path: ${name}`);
 					if ((mode & 61440) === 40960) throw new Error(`VSIX contains a symlink: ${name}`);
-					unpacked += entry.uncompressedSize;
-					if (unpacked > maxBytes) throw new Error(`VSIX unpacks to more than ${maxBytes} bytes`);
 					const output = path.join(destination, ...parts);
 					await mkdir(path.dirname(output), { recursive: true });
 					await pipeline(await openReadStream(entry), createWriteStream(output));
@@ -127,8 +116,7 @@ const STAMP_FILE = ".curated.json";
 const curatedDownloadSchema = z.object({
 	universal: z.boolean(),
 	url: z.string(),
-	sha256: z.string(),
-	size: z.number()
+	sha256: z.string()
 });
 const curatedExtensionSchema = z.object({
 	id: z.string(),
@@ -256,7 +244,7 @@ function requestedGroups(curated, groups, failed) {
 async function readPackagedCurated() {
 	const file = path.join(findReviewPackageRoot(import.meta.url), "vscode-server", "curated.json");
 	const text = await readFile(file, "utf8").catch(() => {
-		throw new Error(`This package has no VS Code server (${file} is missing).`);
+		throw new Error(`This Whiteboard server has no language server (${file} is missing).`);
 	});
 	return z.object({ extensions: z.array(curatedExtensionSchema) }).parse(JSON.parse(text)).extensions;
 }
@@ -278,7 +266,7 @@ async function install(extension, download, directory, stamp, timeoutMs, signal)
 			recursive: true,
 			force: true
 		});
-		await extractVsix(part, staging, download.size * 8);
+		await extractVsix(part, staging);
 		await sanitizeVsixManifest(staging, extension);
 		await checkExecutables(staging, extension);
 		await writeFile(path.join(staging, STAMP_FILE), `${JSON.stringify(stamp)}\n`);