@dev.fast/whiteboard 0.3.5-preview.20261020.130 → 0.3.5-preview.20261021.133

package/dist/{account-alias-CMyXCuuq.js → account-alias-BRRpaO9U.js}

@@ -1,10 +1,10 @@
 import { n as isJsonObject } from "./src-X9phtB2j.js";
-import { E as ReviewCliInstallStampSchema } from "./src-CyYCvVHx.js";
-import { C as disableTraceMachine, E as traceMachineStatus, G as listTraceRepositoryRoots, K as traceRepositoryStatus, Q as removeAgentTraceHook, S as configureTraceMachine, T as traceMachineEnabled, U as disableAllTraceRepositories, W as enableTraceRepository, X as describeTraceHookOwners, Y as AGENT_TRACE_HOOK_AGENTS, Z as installHarnessHooks, at as readStoreAuth, n as reviewDesktopStateDir, nt as traceScope, ut as StoreClient } from "./review-home-paths-D8AoCdd2.js";
+import { E as ReviewCliInstallStampSchema } from "./src-DYZLCUP_.js";
+import { C as disableTraceMachine, E as traceMachineStatus, G as listTraceRepositoryRoots, K as traceRepositoryStatus, Q as removeAgentTraceHook, S as configureTraceMachine, T as traceMachineEnabled, U as disableAllTraceRepositories, W as enableTraceRepository, X as describeTraceHookOwners, Y as AGENT_TRACE_HOOK_AGENTS, Z as installHarnessHooks, at as readStoreAuth, n as reviewDesktopStateDir, nt as traceScope, ut as StoreClient } from "./review-home-paths-BwH08ihj.js";
 import { I as writeFileAtomicAsync, L as writePrivateJsonAtomic, N as devReviewHome, j as withFileLock } from "./s3-config-CjcLyFV5.js";
-import { i as readReviewPackageVersion } from "./package-paths-BWxO-UEL.js";
+import { i as readReviewPackageVersion } from "./package-paths-BkeQsdaw.js";
 import { n as isFile, t as isDirectory } from "./fs-utils-BMPLt0cr.js";
-import { c as findExecutable, s as executableCommand } from "./fuzzy-match-BbaX-dGh.js";
+import { c as findExecutable, s as executableCommand } from "./fuzzy-match-SsirV9Ap.js";
 import { createHash } from "node:crypto";
 import { constants } from "node:fs";
 import { access, chmod, lstat, mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";

package/dist/{agent-cli-CahKfDT0.js → agent-cli-CFX3bHJV.js}

@@ -1,12 +1,12 @@
 import { n as isJsonObject, u as parseJsonText } from "./src-X9phtB2j.js";
-import { T as traceMachineEnabled } from "./review-home-paths-D8AoCdd2.js";
-import { a as toolResultText, i as connectReviewInstance, s as ReviewApiError } from "./agent-client-D2RmE9NL.js";
+import { T as traceMachineEnabled } from "./review-home-paths-BwH08ihj.js";
+import { a as toolResultText, i as connectReviewInstance, s as ReviewApiError } from "./agent-client-H53ajvrm.js";
 import { N as devReviewHome } from "./s3-config-CjcLyFV5.js";
-import { n as readBuildCommit } from "./package-paths-BWxO-UEL.js";
-import { b as selectReviewInstance, u as REVIEW_INSTANCE_ENV } from "./server-discovery-CRXG48Uz.js";
-import { n as reviewSessionAgent } from "./review-telemetry-B2JniTIs.js";
-import { a as REVIEW_VIA_HEADER, i as REVIEW_THREAD_HEADER, n as REVIEW_AGENT_HEADER, t as ASK_THREAD_ENV } from "./request-origin--8lLCclv.js";
-import { i as publicTool, n as RECOVERY, r as callPublicTool, t as toolFailure } from "./tool-failure-_makh_Sr.js";
+import { n as readBuildCommit } from "./package-paths-BkeQsdaw.js";
+import { b as selectReviewInstance, u as REVIEW_INSTANCE_ENV } from "./server-discovery-DeVTdcqK.js";
+import { n as reviewSessionAgent } from "./review-telemetry-Vnb2zKyn.js";
+import { a as REVIEW_VIA_HEADER, i as REVIEW_THREAD_HEADER, n as REVIEW_AGENT_HEADER, t as ASK_THREAD_ENV } from "./request-origin-BxaWyOpO.js";
+import { i as publicTool, n as RECOVERY, r as callPublicTool, t as toolFailure } from "./tool-failure-CQhyLht3.js";
 import { existsSync } from "node:fs";
 import path from "node:path";
 //#region src/review-api/install-update.ts
@@ -43,7 +43,7 @@ async function runReviewAgentCli(input) {
 			[REVIEW_THREAD_HEADER, thread ?? ""]
 		]);
 		if (mode === "mcp") {
-			const { serveReviewMcp } = await import("./mcp-yXnjUkOV.js");
+			const { serveReviewMcp } = await import("./mcp-cBtzXsmN.js");
 			exitOnInstallUpdate(input.stderr);
 			await serveReviewMcp(async (key, agentKind) => {
 				const connected = await connectReviewInstance(key ? {

package/dist/agent-cli-D2P4EoAk.js

@@ -0,0 +1,2 @@
+import { n as runReviewAgentCli } from "./agent-cli-CFX3bHJV.js";
+export { runReviewAgentCli };

package/dist/{agent-client-D2RmE9NL.js → agent-client-H53ajvrm.js}

@@ -1,7 +1,7 @@
 import { d as isBooleanValue, f as isNumberValue, m as isStringValue, u as parseJsonText } from "./src-X9phtB2j.js";
-import "./src-CyYCvVHx.js";
+import "./src-DYZLCUP_.js";
 import { t as ReviewInputError } from "./input-error-OLgB_h31.js";
-import { b as selectReviewInstance, c as reviewServerStateDir, d as ReviewInstanceUnavailableError, i as readReviewServerDiscovery, l as serverNotReady, m as healthyReviewInstance, s as reviewServerIsHealthy, y as reviewInstanceUnavailable } from "./server-discovery-CRXG48Uz.js";
+import { b as selectReviewInstance, c as reviewServerStateDir, d as ReviewInstanceUnavailableError, i as readReviewServerDiscovery, l as serverNotReady, m as healthyReviewInstance, s as reviewServerIsHealthy, y as reviewInstanceUnavailable } from "./server-discovery-DeVTdcqK.js";
 //#region ../review-protocol/src/review-api-client.ts
 const defaultRequest = (url, init) => fetch(url, init);
 /** A non-2xx reply; the status tells a caller whether retrying can help. */
@@ -259,7 +259,7 @@ async function connectReviewInstance(env = process.env, headers = {}, options =
 	const selection = await selectReviewInstance({ env });
 	const discovery = healthyReviewInstance(selection);
 	if (!discovery) {
-		const { ensureServerWithoutDesktop } = await import("./background-server-CFUU4VtN.js");
+		const { ensureServerWithoutDesktop } = await import("./background-server-BSYXD9au.js");
 		const server = await ensureServerWithoutDesktop({
 			selection,
 			env,

package/dist/{authoring-tools-BLhYKrNN.js → authoring-tools-BCquUsB3.js}

@@ -1,8 +1,8 @@
 import { n as isJsonObject } from "./src-X9phtB2j.js";
-import { c as activityBeginSchema, l as activityEndSchema, n as uploadSchema, r as commandSchema, u as activityUpdateSchema } from "./local-data-DrNSaiS5.js";
-import { C as pathTargetSchema, D as publishedEditSchema } from "./stored-document-migration-B_BijGHF.js";
+import { c as activityBeginSchema, l as activityEndSchema, n as uploadSchema, r as commandSchema, u as activityUpdateSchema } from "./local-data-mbCb1HDH.js";
+import { C as pathTargetSchema, D as publishedEditSchema } from "./stored-document-migration-B29lve9-.js";
 import { t as ReviewInputError } from "./input-error-OLgB_h31.js";
-import { t as findReviewPackageRoot } from "./package-paths-BWxO-UEL.js";
+import { t as findReviewPackageRoot } from "./package-paths-BkeQsdaw.js";
 import { z } from "zod";
 import { readFile } from "node:fs/promises";
 import path from "node:path";
@@ -162,7 +162,7 @@ function authoringTools(traceEnabled = false) {
 		kind: true
 	});
 	const descriptions = {
-		create: "Create a whiteboard. target names its repository by the checkout's path, and what it shows: {kind:\"project\"} for a plan in that repository's project with no change; {kind:\"worktree\", base?} for the saved files in the checkout, uncommitted ones included and untracked ones left out (git add -N a new file to include it), against base, by default the repository's default branch, from the merge base of base and HEAD, which follows rebases; {kind:\"commits\", head, base?} for immutable commits (omitted base means source at head with no diff; supply the parent to review introduced changes); {kind:\"pullRequest\", pullRequest} for a GitHub PR by URL or number, fetched into that checkout and pinned at the PR head and GitHub diff base. For a branch stacked on another, pass the branch below it as base. Group plan implementations or a PR stack under one project-target overview with parentId, and order its children with dependsOn; Git bases do not set these relationships. Revisions are resolved on acceptance. With a PR and no title the PR's title is used. When the existing review for that PR is in Trash, creation reports its ID; restore it with review_lifecycle state:\"active\" before continuing. When an active review for that PR exists, it is returned instead, reporting whether its head moved and whether an agent is working on it; update it in place, move its target with review_set_target, or create a separate review with reuseExisting:false. The result carries review, as review_list shows it, with its target and repositoryPath, so no follow-up read is needed before diffing. When Desktop is available the review opens there and the result reports opened, softwareMapEnabled and environmentIssues, as review_open does; set open:false to author in the background without taking over Desktop. parentId and dependsOn set its place among the project's reviews, as review_set_parent and review_set_dependencies do.",
+		create: "Create a whiteboard. target names its repository by the checkout's path, and what it shows: {kind:\"project\"} for a plan in that repository's project with no change; {kind:\"worktree\", base?} for the saved files in the checkout, uncommitted ones included and untracked ones left out (git add -N a new file to include it), against base, by default the repository's default branch, from the merge base of base and HEAD, which follows rebases; {kind:\"commits\", head, base?} for immutable commits (omitted base means source at head with no diff; supply the parent to review introduced changes); {kind:\"pullRequest\", pullRequest} for a GitHub PR by URL or number, fetched into that checkout and pinned at the PR head and GitHub diff base. For a branch stacked on another, pass the branch below it as base. Group plan implementations or a PR stack under one project-target overview with parentId, and order its children with dependsOn; Git bases do not set these relationships. Revisions are resolved on acceptance. With a PR and no title the PR's title is used. When the existing review for that PR is in Trash, creation reports its ID; restore it with review_lifecycle state:\"active\" before continuing. When an active review for that PR exists, it is returned instead, reporting whether its head moved and whether an agent is working on it; update it in place, move its target with review_set_target, or create a separate review with reuseExisting:false. The result carries review, as review_list shows it, with its target and repositoryPath, so no follow-up read is needed before diffing. When Desktop is available the review opens there and the result reports opened, softwareMapEnabled and environmentIssues, as review_open does; set open:false to author in the background without taking over Desktop. parentId and dependsOn set its place among the project's reviews, as review_set_parent and review_set_dependencies do; projectId files it in another project, by project.id from review_list.",
 		set_target: "Move the review to a new target (the same targets review_create takes), such as the commits after a rebase or amend, or commits or a PR for a board that had none. The document and component IDs are kept. Revisions are resolved on acceptance. Returns warnings for retained source ranges in files the new commits changed, to verify, and resources that no longer match; fix them with review_edit. Earlier versions keep their source. A PR target names the PR; other targets keep it within the same repository and clear it across repositories.",
 		edit: [
 			"Edit one document component. content is one component, named by its type; each type's fields are in the Components section of session_get_instructions.",

package/dist/{background-server-CFUU4VtN.js → background-server-BSYXD9au.js}

@@ -1,2 +1,2 @@
-import { a as headlessServerOwner, c as stopBackgroundServer, i as ensureServerWithoutDesktop, r as ensureBackgroundServer } from "./background-server-k4K_Hvh1.js";
+import { a as headlessServerOwner, c as stopBackgroundServer, i as ensureServerWithoutDesktop, r as ensureBackgroundServer } from "./background-server-Xom8cA_u.js";
 export { ensureBackgroundServer, ensureServerWithoutDesktop, headlessServerOwner, stopBackgroundServer };

package/dist/{background-server-k4K_Hvh1.js → background-server-Xom8cA_u.js}

@@ -1,8 +1,8 @@
-import "./review-home-paths-D8AoCdd2.js";
+import "./review-home-paths-BwH08ihj.js";
 import { D as liveLockOwner, k as processIsAlive } from "./s3-config-CjcLyFV5.js";
-import { t as findReviewPackageRoot } from "./package-paths-BWxO-UEL.js";
-import { a as readReviewServerHealth, c as reviewServerStateDir, i as readReviewServerDiscovery, n as desktopOwnsHome, p as desktopUsesHome, r as headlessServerLockPath } from "./server-discovery-CRXG48Uz.js";
-import { t as desktopApplicationInstalled } from "./review-app-launcher-KA2_mOeo.js";
+import { t as findReviewPackageRoot } from "./package-paths-BkeQsdaw.js";
+import { a as readReviewServerHealth, c as reviewServerStateDir, i as readReviewServerDiscovery, n as desktopOwnsHome, p as desktopUsesHome, r as headlessServerLockPath } from "./server-discovery-DeVTdcqK.js";
+import { t as desktopApplicationInstalled } from "./review-app-launcher-DZvG5ZAh.js";
 import { mkdir, open, readFile, realpath, stat } from "node:fs/promises";
 import path from "node:path";
 import { spawn } from "node:child_process";

package/dist/build-info.json

@@ -1 +1 @@
-{"version":"0.3.5-preview.20261020.130","commit":"e4fb75564bd27f464cf214a4b3a9a75ada3d54a3","dirty":true,"builtAt":"2026-10-20T18:45:03.626Z"}
+{"version":"0.3.5-preview.20261021.133","commit":"6c2c2de6384ef9b8d4f9d6a3c63d9cbbcee0ebe8","dirty":true,"builtAt":"2026-10-21T19:05:08.496Z"}

package/dist/{cli-BUVSMGud.js → cli-BOnV4cCh.js}

@@ -1,4 +1,4 @@
-import { r as connectReviewApi } from "./agent-client-D2RmE9NL.js";
+import { r as connectReviewApi } from "./agent-client-H53ajvrm.js";
 import { randomUUID } from "node:crypto";
 import { z } from "zod";
 //#region src/sharing/cli.ts

package/dist/{cli-runner-C7W6VA94.js → cli-runner-nE62FMPA.js}

@@ -1,18 +1,18 @@
-import { A as __require, O as setLocalVcsCommandObserver, j as __toESM, k as __commonJSMin } from "./src-WPaQn75m.js";
+import { D as __commonJSMin, E as setLocalVcsCommandObserver, O as __require, k as __toESM } from "./src-DtfSndqS.js";
 import { c as jsonString, n as isJsonObject, u as parseJsonText } from "./src-X9phtB2j.js";
-import { S as REVIEW_REMOTE_ATTACH_END, b as REVIEW_REMOTE_AGENT_IDS, h as REVIEW_CLI_INSTALL_TARGET_LABELS, l as boardTitle, x as REVIEW_REMOTE_ATTACH_BEGIN } from "./src-CyYCvVHx.js";
-import { $ as resolveTraceCommand, A as runTraceDeny, E as traceMachineStatus, F as describeSelection, H as resolveTraceRepositoryTarget, J as HOSTED_CAPTURE_SCOPE_DESCRIPTION, K as traceRepositoryStatus, L as loadS3TraceStorage, M as runTraceSessions, N as runTraceStoreDelete, P as runTraceStoreInfo, T as traceMachineEnabled, V as requireTraceConsent, _ as runTraceRepair, at as readStoreAuth, b as runTraceGitHook, c as registerTraceCommands, ct as runStoreWhoami, d as runTraceList$1, dt as withStoreAuthorization, f as runTracePull$1, ft as emitJsonEvent, g as runTraceInstallMachine, h as runTraceEnable, ht as jsonRequestedInArgv, j as runTraceOnboard, k as runTraceAllow, l as resolveTraceReadStorage, lt as StoreApiError, m as runTraceDisable, mt as humanStream, nt as traceScope, ot as runStoreLogin, p as runTraceShow, pt as failWithJsonError, q as readTraceUserConfig, rt as DEFAULT_STORE_ORIGIN, st as runStoreLogout, tt as traceHomeDir, u as runTraceBlame, ut as StoreClient, v as runTraceStatus, w as readLegacyCaptureSettings, x as runTraceHook, y as runTraceSync, z as selectTraceStorage } from "./review-home-paths-D8AoCdd2.js";
-import { o as ReviewApiClient, s as ReviewApiError } from "./agent-client-D2RmE9NL.js";
-import { t as resolveReviewRoot } from "./runtime-Bj2tD33R.js";
+import { S as REVIEW_REMOTE_ATTACH_END, b as REVIEW_REMOTE_AGENT_IDS, h as REVIEW_CLI_INSTALL_TARGET_LABELS, l as boardTitle, x as REVIEW_REMOTE_ATTACH_BEGIN } from "./src-DYZLCUP_.js";
+import { $ as resolveTraceCommand, A as runTraceDeny, E as traceMachineStatus, F as describeSelection, H as resolveTraceRepositoryTarget, J as HOSTED_CAPTURE_SCOPE_DESCRIPTION, K as traceRepositoryStatus, L as loadS3TraceStorage, M as runTraceSessions, N as runTraceStoreDelete, P as runTraceStoreInfo, T as traceMachineEnabled, V as requireTraceConsent, _ as runTraceRepair, at as readStoreAuth, b as runTraceGitHook, c as registerTraceCommands, ct as runStoreWhoami, d as runTraceList$1, dt as withStoreAuthorization, f as runTracePull$1, ft as emitJsonEvent, g as runTraceInstallMachine, h as runTraceEnable, ht as jsonRequestedInArgv, j as runTraceOnboard, k as runTraceAllow, l as resolveTraceReadStorage, lt as StoreApiError, m as runTraceDisable, mt as humanStream, nt as traceScope, ot as runStoreLogin, p as runTraceShow, pt as failWithJsonError, q as readTraceUserConfig, rt as DEFAULT_STORE_ORIGIN, st as runStoreLogout, tt as traceHomeDir, u as runTraceBlame, ut as StoreClient, v as runTraceStatus, w as readLegacyCaptureSettings, x as runTraceHook, y as runTraceSync, z as selectTraceStorage } from "./review-home-paths-BwH08ihj.js";
+import { o as ReviewApiClient, s as ReviewApiError } from "./agent-client-H53ajvrm.js";
+import { t as resolveReviewRoot } from "./runtime-CF4JXdb8.js";
 import { C as s3ProfileSchema, E as writeTraceConfigFile, N as devReviewHome, P as normalizeStoreOrigin, S as readTraceConfigFile, T as sameS3Profile, _ as emptyTraceConfig, c as resolveS3Setup, g as currentStore, h as TraceConfigurationError, i as isS3MockMode, n as clearTraceEnvCache, o as readTraceEnvFile, p as traceSettingsPath, w as s3Store } from "./s3-config-CjcLyFV5.js";
 import { t as errorMessage } from "./error-message-OtiDonty.js";
-import { i as readReviewPackageVersion, r as readBuildInfo, t as findReviewPackageRoot } from "./package-paths-BWxO-UEL.js";
-import { a as readReviewServerHealth, b as selectReviewInstance, c as reviewServerStateDir, d as ReviewInstanceUnavailableError, f as clearDefaultReviewInstance, g as requireHealthyReviewDesktop, h as readDefaultReviewInstance, i as readReviewServerDiscovery, l as serverNotReady, m as healthyReviewInstance, p as desktopUsesHome, t as DESKTOP_TAKEOVER_SIGNAL, u as REVIEW_INSTANCE_ENV, x as writeDefaultReviewInstance, y as reviewInstanceUnavailable } from "./server-discovery-CRXG48Uz.js";
-import { t as ReviewTelemetry } from "./review-telemetry-B2JniTIs.js";
-import { t as fuzzyRank } from "./fuzzy-match-BbaX-dGh.js";
-import { _ as isInstallTarget, a as isOwnedShim, f as windowsInstallerCommand, g as ALL_INSTALL_TARGETS, h as detectConnectAgents, m as connectAgent, o as pathShimPath, p as scanLegacySkills, t as aliasInstallationToAccount, v as connectPrompts } from "./account-alias-CMyXCuuq.js";
-import { n as focusReviewDesktop, r as runReviewAppLaunch } from "./review-app-launcher-KA2_mOeo.js";
-import { t as reviewAgentCliHelp } from "./agent-cli-CahKfDT0.js";
+import { i as readReviewPackageVersion, r as readBuildInfo, t as findReviewPackageRoot } from "./package-paths-BkeQsdaw.js";
+import { a as readReviewServerHealth, b as selectReviewInstance, c as reviewServerStateDir, d as ReviewInstanceUnavailableError, f as clearDefaultReviewInstance, g as requireHealthyReviewDesktop, h as readDefaultReviewInstance, i as readReviewServerDiscovery, l as serverNotReady, m as healthyReviewInstance, p as desktopUsesHome, t as DESKTOP_TAKEOVER_SIGNAL, u as REVIEW_INSTANCE_ENV, x as writeDefaultReviewInstance, y as reviewInstanceUnavailable } from "./server-discovery-DeVTdcqK.js";
+import { t as ReviewTelemetry } from "./review-telemetry-Vnb2zKyn.js";
+import { t as fuzzyRank } from "./fuzzy-match-SsirV9Ap.js";
+import { _ as isInstallTarget, a as isOwnedShim, f as windowsInstallerCommand, g as ALL_INSTALL_TARGETS, h as detectConnectAgents, m as connectAgent, o as pathShimPath, p as scanLegacySkills, t as aliasInstallationToAccount, v as connectPrompts } from "./account-alias-BRRpaO9U.js";
+import { n as focusReviewDesktop, r as runReviewAppLaunch } from "./review-app-launcher-DZvG5ZAh.js";
+import { t as reviewAgentCliHelp } from "./agent-cli-CFX3bHJV.js";
 import { existsSync, mkdirSync, renameSync, writeFileSync } from "node:fs";
 import { realpath } from "node:fs/promises";
 import path from "node:path";
@@ -1787,6 +1787,20 @@ var require_delete_log_property = /* @__PURE__ */ __commonJSMin(((exports, modul
 //#endregion
 //#region ../../node_modules/fast-copy/dist/cjs/index.cjs
 var require_cjs = /* @__PURE__ */ __commonJSMin(((exports) => {
+	/**
+	* Error thrown when the copier traverses deeper than the configured `maxDepth`.
+	*
+	* @note
+	* Extends `RangeError` for backwards compatibility, since exceeding the maximum depth
+	* previously surfaced as a native `RangeError` from stack exhaustion.
+	*/
+	var MaxDepthExceededError = class extends RangeError {
+		constructor(maxDepth) {
+			super(`Maximum copy depth of ${String(maxDepth)} exceeded; the value copied is nested too deeply.`);
+			this.maxDepth = maxDepth;
+			this.name = "MaxDepthExceededError";
+		}
+	};
 	const toStringFunction = Function.prototype.toString;
 	const toStringObject = Object.prototype.toString;
 	/**
@@ -1951,10 +1965,19 @@ var require_cjs = /* @__PURE__ */ __commonJSMin(((exports) => {
 	function copySetStrict(set, state) {
 		return copyOwnPropertiesStrict(set, copySetLoose(set, state), state);
 	}
+	/**
+	* The maximum depth traversed when none is provided.
+	*
+	* @note
+	* This is deliberately below the depth at which the native call stack is exhausted
+	* (~1875 for strict copies in node), so that untrusted, deeply-nested values fail with a
+	* catchable, descriptive error instead of a raw `RangeError`.
+	*/
+	const DEFAULT_MAX_DEPTH = 1e3;
 	function createDefaultCache() {
 		return /* @__PURE__ */ new WeakMap();
 	}
-	function getOptions({ createCache: createCacheOverride, methods: methodsOverride, strict }) {
+	function getOptions({ createCache: createCacheOverride, maxDepth, methods: methodsOverride, strict }) {
 		const defaultMethods = {
 			array: strict ? copyArrayStrict : copyArrayLoose,
 			arrayBuffer: copyArrayBuffer,
@@ -1976,6 +1999,7 @@ var require_cjs = /* @__PURE__ */ __commonJSMin(((exports) => {
 		return {
 			createCache,
 			copiers,
+			maxDepth: maxDepth == null ? DEFAULT_MAX_DEPTH : maxDepth,
 			methods,
 			strict: Boolean(strict)
 		};
@@ -2024,25 +2048,32 @@ var require_cjs = /* @__PURE__ */ __commonJSMin(((exports) => {
 	*   - `strict` mode to copy all properties with their descriptors
 	*/
 	function createCopier(options = {}) {
-		const { createCache, copiers } = getOptions(options);
+		const { createCache, copiers, maxDepth } = getOptions(options);
 		const { Array: copyArray, Object: copyObject } = copiers;
 		function copier(value, state) {
 			state.prototype = state.Constructor = void 0;
 			if (!value || typeof value !== "object") return value;
 			if (state.cache.has(value)) return state.cache.get(value);
+			if (++state.depth > maxDepth) throw new MaxDepthExceededError(maxDepth);
 			state.prototype = Object.getPrototypeOf(value);
 			state.Constructor = state.prototype && state.prototype.constructor;
-			if (!state.Constructor || state.Constructor === Object) return copyObject(value, state);
-			if (Array.isArray(value)) return copyArray(value, state);
-			const tagSpecificCopier = copiers[getTag(value)];
-			if (tagSpecificCopier) return tagSpecificCopier(value, state);
-			return typeof value.then === "function" ? value : copyObject(value, state);
+			let clone;
+			if (!state.Constructor || state.Constructor === Object) clone = copyObject(value, state);
+			else if (Array.isArray(value)) clone = copyArray(value, state);
+			else {
+				const tagSpecificCopier = copiers[getTag(value)];
+				if (tagSpecificCopier) clone = tagSpecificCopier(value, state);
+				else clone = typeof value.then === "function" ? value : copyObject(value, state);
+			}
+			--state.depth;
+			return clone;
 		}
 		return function copy(value) {
 			return copier(value, {
 				Constructor: void 0,
 				cache: createCache(),
 				copier,
+				depth: 0,
 				prototype: void 0
 			});
 		};
@@ -2053,7 +2084,12 @@ var require_cjs = /* @__PURE__ */ __commonJSMin(((exports) => {
 	* original property descriptors on both objects and arrays.
 	*/
 	const copyStrict = createCopier({ strict: true });
-	exports.copy = createCopier();
+	/**
+	* Copy an value deeply as much as possible.
+	*/
+	const copy = createCopier();
+	exports.MaxDepthExceededError = MaxDepthExceededError;
+	exports.copy = copy;
 	exports.copyStrict = copyStrict;
 	exports.createCopier = createCopier;
 }));
@@ -4297,7 +4333,7 @@ async function runReviewCli(input) {
 		if (!Number.isInteger(port) || port < 0 || port > 65535) throw new ReviewCliUsageError("--port must be an integer between 0 and 65535.");
 		const stateDir = reviewServerStateDir(authoringEnv(options.stateDir));
 		if (options.detach) {
-			const { ensureBackgroundServer } = await import("./background-server-CFUU4VtN.js");
+			const { ensureBackgroundServer } = await import("./background-server-BSYXD9au.js");
 			const { discovery, started } = await ensureBackgroundServer({
 				stateDir,
 				env,
@@ -4319,7 +4355,7 @@ async function runReviewCli(input) {
 		process.once("SIGINT", stop);
 		process.once("SIGTERM", stop);
 		process.once(DESKTOP_TAKEOVER_SIGNAL, takeover);
-		const { HeadlessServerBusyError, runHeadlessServer } = await import("./headless-host-cYdlRYPB.js");
+		const { HeadlessServerBusyError, runHeadlessServer } = await import("./headless-host-DN6rrMrK.js");
 		try {
 			await runHeadlessServer({
 				stateDir,
@@ -4356,7 +4392,7 @@ async function runReviewCli(input) {
 	configureJsonOutput(serverCommand.command("stop").description("Stop a background server started by --detach, the CLI, or Desktop").option("--state-dir <path>", "directory selected when starting the server"), "plain").action(async (_options, command) => {
 		const options = command.optsWithGlobals();
 		const stateDir = reviewServerStateDir(authoringEnv(options.stateDir));
-		const { headlessServerOwner, stopBackgroundServer } = await import("./background-server-CFUU4VtN.js");
+		const { headlessServerOwner, stopBackgroundServer } = await import("./background-server-BSYXD9au.js");
 		const owner = await headlessServerOwner(stateDir);
 		const discovery = await readReviewServerDiscovery(stateDir);
 		if (owner === void 0) {
@@ -4384,7 +4420,7 @@ async function runReviewCli(input) {
 		if (!existsSync(path.join(stateDir, "review-api.db"))) throw new Error(`No saved reviews in ${stateDir}, so there is no server id to reset. Check --state-dir.`);
 		const inUse = `A Whiteboard server is using ${stateDir}. Stop it first, then run whiteboard server reset-id again.`;
 		if (await desktopUsesHome(stateDir, env)) return refuse(inUse, options.json);
-		const [{ openReviewProfile }, { withHeadlessServerLock }] = await Promise.all([import("./profile-CGxNfeYQ.js"), import("./headless-host-cYdlRYPB.js")]);
+		const [{ openReviewProfile }, { withHeadlessServerLock }] = await Promise.all([import("./profile-Dbyidrcr.js"), import("./headless-host-DN6rrMrK.js")]);
 		const reset = await withHeadlessServerLock(await realpath(stateDir), async () => {
 			const local = await openReviewProfile(stateDir, { manageWorkspaces: false });
 			try {
@@ -4406,7 +4442,7 @@ async function runReviewCli(input) {
 	configureJsonOutput(remote.command("attach").description("Start a background server if none is healthy and report how to reach it").option("--state-dir <path>", "directory for saved reviews and server discovery").option("--groups <groups>", "comma-separated optional extension groups the Desktop has enabled, such as go").option("--replace", "stop a running server of another version that the CLI or Desktop started, and start this one"), "plain").action(async (_options, command) => {
 		const options = command.optsWithGlobals();
 		const stateDir = reviewServerStateDir(authoringEnv(options.stateDir));
-		const { remoteAttach } = await import("./remote-attach-CZTrtWIk.js");
+		const { remoteAttach } = await import("./remote-attach-BeKuMm_x.js");
 		let attach;
 		try {
 			attach = await remoteAttach({
@@ -4433,7 +4469,7 @@ async function runReviewCli(input) {
 	});
 	configureJsonOutput(remote.command("extensions").description("Language extensions for the language server on a remote").command("ensure").description("Download the curated extensions for this machine and list them for the language server").option("--groups <groups>", "comma-separated optional extension groups the Desktop has enabled, such as go"), "plain").action(async (_options, command) => {
 		const { json, groups } = command.optsWithGlobals();
-		const { ensureRemoteExtensions } = await import("./remote-extensions-VP-kfq0C.js");
+		const { ensureRemoteExtensions } = await import("./remote-extensions-CX2fAec1.js");
 		const result = await ensureRemoteExtensions({
 			env,
 			groups: groups?.split(",").map((group) => group.trim())
@@ -4448,7 +4484,7 @@ async function runReviewCli(input) {
 	configureJsonOutput(remote.command("uninstall").description("Remove what Whiteboard Desktop installed on this host, stopping a server it started").addOption(new Option("--keep-reviews", "leave the saved reviews in place").conflicts("deleteReviews")).addOption(new Option("--delete-reviews", "also delete the saved reviews")).option("--state-dir <path>", "directory for saved reviews and server discovery"), "plain").action(async (_options, command) => {
 		const options = command.optsWithGlobals();
 		const stateDir = reviewServerStateDir(authoringEnv(options.stateDir));
-		const { remoteUninstall } = await import("./remote-uninstall-CFTkoioA.js");
+		const { remoteUninstall } = await import("./remote-uninstall-Y3S0YmJs.js");
 		let deleteReviews = options.deleteReviews ? true : options.keepReviews ? false : void 0;
 		if (deleteReviews === void 0 && !options.json && input.stdin?.isTTY) {
 			const prompt = createInterface$1({
@@ -4670,14 +4706,14 @@ async function runReviewCli(input) {
 		command.showHelpAfterError(false).error("Markdown review migration is no longer supported. Ask your agent to migrate your old Whiteboard reviews.");
 	});
 	configureJsonOutput(configureJsonOutput(program.command("share").description("Upload an immutable review snapshot and return its share link"), "plain").option("--review <id>", "review ID").option("--version <number>", "Saved version to share").option("--preview", "Open the share link in Whiteboard Preview by default").option("--request-id <uuid>", "Reuse this ID when retrying the same immutable upload").action(async (options) => {
-		const { runShareCli } = await import("./cli-BUVSMGud.js");
+		const { runShareCli } = await import("./cli-BOnV4cCh.js");
 		state.exitCode = await runShareCli({
 			...input,
 			...options,
 			env: authoringEnv()
 		});
 	}).command("revoke <share-id>").description("Revoke future downloads of a share"), "plain").action(async (shareId, options) => {
-		const { runShareCli } = await import("./cli-BUVSMGud.js");
+		const { runShareCli } = await import("./cli-BOnV4cCh.js");
 		state.exitCode = await runShareCli({
 			...input,
 			...options,
@@ -4758,7 +4794,7 @@ async function runReviewCli(input) {
 		return commands;
 	} });
 	for (const [name, description] of [["api", "Call a JSON review authoring tool on the running server"], ["mcp", "Serve the JSON review authoring tools over stdio MCP"]]) configureOutput(program.command(name).description(description).argument("[args...]", "tool name and JSON input").allowUnknownOption().allowExcessArguments().helpOption(false).passThroughOptions().addHelpText("after", `\n${reviewAgentCliHelp}`), "plain").action(async (args) => {
-		const { runReviewAgentCli } = await import("./agent-cli-CvYV2R6c.js");
+		const { runReviewAgentCli } = await import("./agent-cli-D2P4EoAk.js");
 		state.exitCode = await runReviewAgentCli({
 			...input,
 			env: authoringEnv(),

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { a as jsonNumber, c as jsonString, o as jsonObject, u as parseJsonText } from "./src-X9phtB2j.js";
-import "./src-CyYCvVHx.js";
+import "./src-DYZLCUP_.js";
 import { existsSync, readFileSync, readdirSync, realpathSync } from "node:fs";
 import path from "node:path";
 import os from "node:os";
@@ -17,7 +17,7 @@ async function runCli(effectivePath) {
 `);
 		return 1;
 	}
-	const { runReviewCli } = await import("./cli-runner-C7W6VA94.js");
+	const { runReviewCli } = await import("./cli-runner-nE62FMPA.js");
 	return runReviewCli({
 		argv,
 		cliPaths: {

package/dist/{client-B0f4EJ7v.js → client-UH1bEG7Z.js}

@@ -1,8 +1,8 @@
-import { f as gitAt } from "./src-WPaQn75m.js";
+import { f as gitAt } from "./src-DtfSndqS.js";
 import { n as isJsonObject, u as parseJsonText } from "./src-X9phtB2j.js";
-import "./src-CyYCvVHx.js";
-import { f as sourceAnchors } from "./lens-selection-CAtsGaym.js";
-import { $ as parseMarkdown, A as resourceReferences, E as pinsSchema, G as lensSelections, I as sourceReferences, O as readsAtBoardPins, R as checkReferences, W as lensSchema, Z as markdownNodes, _ as boardRepositoryId, c as normalizedSoftwareRelationshipSchema, f as anchorPins, k as resourceReference, l as traceSchema, n as migrateStoredDocument, r as migrateStoredLenses, s as normalizedSoftwareElementSchema, t as liftFileLenses, u as textIncludesQuote, x as elements, y as documentSchema } from "./stored-document-migration-B_BijGHF.js";
+import "./src-DYZLCUP_.js";
+import { f as sourceAnchors } from "./lens-selection-BxPk53c8.js";
+import { $ as parseMarkdown, A as resourceReferences, E as pinsSchema, G as lensSelections, I as sourceReferences, O as readsAtBoardPins, R as checkReferences, W as lensSchema, Z as markdownNodes, _ as boardRepositoryId, c as normalizedSoftwareRelationshipSchema, f as anchorPins, k as resourceReference, l as traceSchema, n as migrateStoredDocument, r as migrateStoredLenses, s as normalizedSoftwareElementSchema, t as liftFileLenses, u as textIncludesQuote, x as elements, y as documentSchema } from "./stored-document-migration-B29lve9-.js";
 import { t as ReviewInputError } from "./input-error-OLgB_h31.js";
 import { createHash, randomUUID } from "node:crypto";
 import { z } from "zod";
@@ -259,6 +259,7 @@ function sharedGit(cwd, args) {
 }
 function fetchError(stderr, publishing) {
 	if (/not our ref|couldn't find remote ref|unadvertised object/i.test(stderr)) return new ReviewInputError(publishing ? "Push the reviewed commits to GitHub before sharing." : "The shared commits are no longer available on GitHub. Ask the sender to restore them, then retry.", 409);
+	if (/could not read (?:username|password)|authentication failed|permission denied \(publickey|repository not found|returned error: 40[13]|\bSAML\b/i.test(stderr)) return new ReviewInputError("Git couldn't access this GitHub repository. Your Whiteboard sign-in doesn't grant repository access, so set up Git credentials for it, then retry.", 409);
 	return new ReviewInputError("Could not fetch the GitHub repository. Check your connection and Git credentials for this repository, then retry.", 409);
 }
 /** Recipients need complete history; publication only checks that the commits exist.
@@ -448,18 +449,22 @@ async function readShareRepository(root) {
 	}
 	return { cloneUrl };
 }
-async function verifyShareRepository(root, pins, repository, commits = []) {
-	const { cloneUrl } = repository ?? await readShareRepository(root);
+/** Fetches through origin itself, so its transport and credentials apply. */
+async function verifyShareRepository(root, pins, commits = []) {
+	const origin = (await sharedGit(root, [
+		"remote",
+		"get-url",
+		"origin"
+	])).stdout.trim();
 	const temporary = await mkdtemp(path.join(tmpdir(), "review-share-check-"));
 	try {
-		await fetchPinnedRepository(temporary, cloneUrl, pins, true, commits);
+		await fetchPinnedRepository(temporary, origin, pins, true, commits);
 	} finally {
 		await rm(temporary, {
 			recursive: true,
 			force: true
 		});
 	}
-	return { cloneUrl };
 }
 //#endregion
 //#region src/sharing/import.ts

package/dist/{fuzzy-match-BbaX-dGh.js → fuzzy-match-SsirV9Ap.js}

@@ -1,7 +1,7 @@
-import "./review-home-paths-D8AoCdd2.js";
+import "./review-home-paths-BwH08ihj.js";
 import { N as devReviewHome } from "./s3-config-CjcLyFV5.js";
-import { n as askAgentIds } from "./thread-state-D6MlnGv7.js";
-import { t as ASK_THREAD_ENV } from "./request-origin--8lLCclv.js";
+import { n as askAgentIds } from "./thread-state-BPpvKFwQ.js";
+import { t as ASK_THREAD_ENV } from "./request-origin-BxaWyOpO.js";
 import { createRequire } from "node:module";
 import { constants } from "node:fs";
 import { access, chmod, mkdir, readFile, rename, stat, writeFile } from "node:fs/promises";