@dev.fast/whiteboard 0.3.5-preview.20261021.131 → 0.3.5-preview.20261021.133

package/dist/{account-alias-CisiYUZT.js → account-alias-BRRpaO9U.js}

@@ -4,7 +4,7 @@ import { C as disableTraceMachine, E as traceMachineStatus, G as listTraceReposi
 import { I as writeFileAtomicAsync, L as writePrivateJsonAtomic, N as devReviewHome, j as withFileLock } from "./s3-config-CjcLyFV5.js";
 import { i as readReviewPackageVersion } from "./package-paths-BkeQsdaw.js";
 import { n as isFile, t as isDirectory } from "./fs-utils-BMPLt0cr.js";
-import { c as findExecutable, s as executableCommand } from "./fuzzy-match-D_x3wumC.js";
+import { c as findExecutable, s as executableCommand } from "./fuzzy-match-SsirV9Ap.js";
 import { createHash } from "node:crypto";
 import { constants } from "node:fs";
 import { access, chmod, lstat, mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";

package/dist/{agent-cli-TJ7_5_B3.js → agent-cli-CFX3bHJV.js}

@@ -4,8 +4,8 @@ import { a as toolResultText, i as connectReviewInstance, s as ReviewApiError }
 import { N as devReviewHome } from "./s3-config-CjcLyFV5.js";
 import { n as readBuildCommit } from "./package-paths-BkeQsdaw.js";
 import { b as selectReviewInstance, u as REVIEW_INSTANCE_ENV } from "./server-discovery-DeVTdcqK.js";
-import { n as reviewSessionAgent } from "./review-telemetry-AZ0imsmJ.js";
-import { a as REVIEW_VIA_HEADER, i as REVIEW_THREAD_HEADER, n as REVIEW_AGENT_HEADER, t as ASK_THREAD_ENV } from "./request-origin-icXPv6jh.js";
+import { n as reviewSessionAgent } from "./review-telemetry-Vnb2zKyn.js";
+import { a as REVIEW_VIA_HEADER, i as REVIEW_THREAD_HEADER, n as REVIEW_AGENT_HEADER, t as ASK_THREAD_ENV } from "./request-origin-BxaWyOpO.js";
 import { i as publicTool, n as RECOVERY, r as callPublicTool, t as toolFailure } from "./tool-failure-CQhyLht3.js";
 import { existsSync } from "node:fs";
 import path from "node:path";

package/dist/agent-cli-D2P4EoAk.js

@@ -0,0 +1,2 @@
+import { n as runReviewAgentCli } from "./agent-cli-CFX3bHJV.js";
+export { runReviewAgentCli };

package/dist/build-info.json

@@ -1 +1 @@
-{"version":"0.3.5-preview.20261021.131","commit":"6bf7b672e0c4d566b582d555044a624620c6311f","dirty":true,"builtAt":"2026-10-21T16:51:06.481Z"}
+{"version":"0.3.5-preview.20261021.133","commit":"6c2c2de6384ef9b8d4f9d6a3c63d9cbbcee0ebe8","dirty":true,"builtAt":"2026-10-21T19:05:08.496Z"}

package/dist/{cli-runner-cRY5NOno.js → cli-runner-nE62FMPA.js}

@@ -8,11 +8,11 @@ import { C as s3ProfileSchema, E as writeTraceConfigFile, N as devReviewHome, P
 import { t as errorMessage } from "./error-message-OtiDonty.js";
 import { i as readReviewPackageVersion, r as readBuildInfo, t as findReviewPackageRoot } from "./package-paths-BkeQsdaw.js";
 import { a as readReviewServerHealth, b as selectReviewInstance, c as reviewServerStateDir, d as ReviewInstanceUnavailableError, f as clearDefaultReviewInstance, g as requireHealthyReviewDesktop, h as readDefaultReviewInstance, i as readReviewServerDiscovery, l as serverNotReady, m as healthyReviewInstance, p as desktopUsesHome, t as DESKTOP_TAKEOVER_SIGNAL, u as REVIEW_INSTANCE_ENV, x as writeDefaultReviewInstance, y as reviewInstanceUnavailable } from "./server-discovery-DeVTdcqK.js";
-import { t as ReviewTelemetry } from "./review-telemetry-AZ0imsmJ.js";
-import { t as fuzzyRank } from "./fuzzy-match-D_x3wumC.js";
-import { _ as isInstallTarget, a as isOwnedShim, f as windowsInstallerCommand, g as ALL_INSTALL_TARGETS, h as detectConnectAgents, m as connectAgent, o as pathShimPath, p as scanLegacySkills, t as aliasInstallationToAccount, v as connectPrompts } from "./account-alias-CisiYUZT.js";
+import { t as ReviewTelemetry } from "./review-telemetry-Vnb2zKyn.js";
+import { t as fuzzyRank } from "./fuzzy-match-SsirV9Ap.js";
+import { _ as isInstallTarget, a as isOwnedShim, f as windowsInstallerCommand, g as ALL_INSTALL_TARGETS, h as detectConnectAgents, m as connectAgent, o as pathShimPath, p as scanLegacySkills, t as aliasInstallationToAccount, v as connectPrompts } from "./account-alias-BRRpaO9U.js";
 import { n as focusReviewDesktop, r as runReviewAppLaunch } from "./review-app-launcher-DZvG5ZAh.js";
-import { t as reviewAgentCliHelp } from "./agent-cli-TJ7_5_B3.js";
+import { t as reviewAgentCliHelp } from "./agent-cli-CFX3bHJV.js";
 import { existsSync, mkdirSync, renameSync, writeFileSync } from "node:fs";
 import { realpath } from "node:fs/promises";
 import path from "node:path";
@@ -4355,7 +4355,7 @@ async function runReviewCli(input) {
 		process.once("SIGINT", stop);
 		process.once("SIGTERM", stop);
 		process.once(DESKTOP_TAKEOVER_SIGNAL, takeover);
-		const { HeadlessServerBusyError, runHeadlessServer } = await import("./headless-host-BEe-aFtB.js");
+		const { HeadlessServerBusyError, runHeadlessServer } = await import("./headless-host-DN6rrMrK.js");
 		try {
 			await runHeadlessServer({
 				stateDir,
@@ -4420,7 +4420,7 @@ async function runReviewCli(input) {
 		if (!existsSync(path.join(stateDir, "review-api.db"))) throw new Error(`No saved reviews in ${stateDir}, so there is no server id to reset. Check --state-dir.`);
 		const inUse = `A Whiteboard server is using ${stateDir}. Stop it first, then run whiteboard server reset-id again.`;
 		if (await desktopUsesHome(stateDir, env)) return refuse(inUse, options.json);
-		const [{ openReviewProfile }, { withHeadlessServerLock }] = await Promise.all([import("./profile-Dbyidrcr.js"), import("./headless-host-BEe-aFtB.js")]);
+		const [{ openReviewProfile }, { withHeadlessServerLock }] = await Promise.all([import("./profile-Dbyidrcr.js"), import("./headless-host-DN6rrMrK.js")]);
 		const reset = await withHeadlessServerLock(await realpath(stateDir), async () => {
 			const local = await openReviewProfile(stateDir, { manageWorkspaces: false });
 			try {
@@ -4794,7 +4794,7 @@ async function runReviewCli(input) {
 		return commands;
 	} });
 	for (const [name, description] of [["api", "Call a JSON review authoring tool on the running server"], ["mcp", "Serve the JSON review authoring tools over stdio MCP"]]) configureOutput(program.command(name).description(description).argument("[args...]", "tool name and JSON input").allowUnknownOption().allowExcessArguments().helpOption(false).passThroughOptions().addHelpText("after", `\n${reviewAgentCliHelp}`), "plain").action(async (args) => {
-		const { runReviewAgentCli } = await import("./agent-cli-BglNRDZN.js");
+		const { runReviewAgentCli } = await import("./agent-cli-D2P4EoAk.js");
 		state.exitCode = await runReviewAgentCli({
 			...input,
 			env: authoringEnv(),

package/dist/cli.js

@@ -17,7 +17,7 @@ async function runCli(effectivePath) {
 `);
 		return 1;
 	}
-	const { runReviewCli } = await import("./cli-runner-cRY5NOno.js");
+	const { runReviewCli } = await import("./cli-runner-nE62FMPA.js");
 	return runReviewCli({
 		argv,
 		cliPaths: {

package/dist/{fuzzy-match-D_x3wumC.js → fuzzy-match-SsirV9Ap.js}

@@ -1,7 +1,7 @@
 import "./review-home-paths-BwH08ihj.js";
 import { N as devReviewHome } from "./s3-config-CjcLyFV5.js";
 import { n as askAgentIds } from "./thread-state-BPpvKFwQ.js";
-import { t as ASK_THREAD_ENV } from "./request-origin-icXPv6jh.js";
+import { t as ASK_THREAD_ENV } from "./request-origin-BxaWyOpO.js";
 import { createRequire } from "node:module";
 import { constants } from "node:fs";
 import { access, chmod, mkdir, readFile, rename, stat, writeFile } from "node:fs/promises";

package/dist/{headless-host-CEb5d-A0.js → headless-host-CG1XSd5n.js}

@@ -13,8 +13,8 @@ import { i as readReviewPackageVersion, n as readBuildCommit, t as findReviewPac
 import { _ as reviewInstanceIdentity, n as desktopOwnsHome, o as reviewServerDiscoveryPath, p as desktopUsesHome, r as headlessServerLockPath, t as DESKTOP_TAKEOVER_SIGNAL } from "./server-discovery-DeVTdcqK.js";
 import { c as askPicksSchema, d as selectionMarkdown, l as askQuestionSchema, n as askAgentIds, r as askChoiceKinds, s as askPermissionsSchema, t as applyAskChange, u as AgentSelectionSchema } from "./thread-state-BPpvKFwQ.js";
 import { t as openReviewProfile } from "./profile-duqp5uPa.js";
-import { c as REVIEW_APP_SESSION_ID_HEADER, d as sanitizeUiTelemetryEvent, f as cleanTelemetryText, o as reviewRequestOrigin, r as REVIEW_PERSON_HEADER, s as BUNDLE_FRAME_PATTERN, t as ASK_THREAD_ENV, u as isReportableCleanedMessage } from "./request-origin-icXPv6jh.js";
-import { a as defaultAskPermissions, i as askAgents, l as launchAskAgent, n as askAgentSettings, o as detectAskAgents, r as askAgentTakesMcp, t as fuzzyRank } from "./fuzzy-match-D_x3wumC.js";
+import { c as REVIEW_APP_SESSION_ID_HEADER, d as sanitizeUiTelemetryEvent, f as cleanTelemetryText, o as reviewRequestOrigin, r as REVIEW_PERSON_HEADER, s as BUNDLE_FRAME_PATTERN, t as ASK_THREAD_ENV, u as isReportableCleanedMessage } from "./request-origin-BxaWyOpO.js";
+import { a as defaultAskPermissions, i as askAgents, l as launchAskAgent, n as askAgentSettings, o as detectAskAgents, r as askAgentTakesMcp, t as fuzzyRank } from "./fuzzy-match-SsirV9Ap.js";
 import { a as inspectQuerySchema, i as renderInstructions, o as queryAnchor, r as instructionsQuerySchema, s as readQuerySchemas, t as authoringTools } from "./authoring-tools-BCquUsB3.js";
 import { a as headlessServerOwner, c as stopBackgroundServer, o as recordedBackgroundServer } from "./background-server-Xom8cA_u.js";
 import crypto$1, { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -28,11 +28,11 @@ import { promisify } from "node:util";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { Writable } from "node:stream";
-import { createServer } from "node:http";
 import { PROTOCOL_VERSION, RequestError, client, methods } from "@agentclientprotocol/sdk";
 import { Hono } from "hono";
 import { stringify } from "smol-toml";
 import { getRequestListener } from "@hono/node-server";
+import { createServer } from "node:http";
 import { streamSSE } from "hono/streaming";
 import { once } from "node:events";
 //#region src/ask/protocol.ts
@@ -1857,8 +1857,21 @@ var ReviewServerError = class extends Error {
 };
 //#endregion
 //#region src/server/hono-http.ts
+const H2_FORBIDDEN_HEADERS = [
+	"connection",
+	"keep-alive",
+	"proxy-connection",
+	"transfer-encoding",
+	"upgrade"
+];
 function createNodeRequestListener(app) {
-	return getRequestListener(app.fetch);
+	return getRequestListener(async (request, env) => {
+		const response = await app.fetch(request, env);
+		if (env.incoming.httpVersionMajor !== 2 || !H2_FORBIDDEN_HEADERS.some((name) => response.headers.has(name))) return response;
+		const stripped = new Response(response.body, response);
+		for (const name of H2_FORBIDDEN_HEADERS) stripped.headers.delete(name);
+		return stripped;
+	});
 }
 function jsonResponse(body, status, options = {}) {
 	const headers = new Headers({ "content-type": options.contentType ?? "application/json; charset=utf-8" });
@@ -2623,6 +2636,27 @@ async function resolveReviewStackLayers(subject, reviews, options = {}) {
 		};
 	});
 }
+const STACKS_FRESH_MS = 6e4;
+const stackReads = /* @__PURE__ */ new WeakMap();
+function readGitHubStacks(runGitHubApi, host, repository, pullRequestNumber) {
+	const reads = stackReads.get(runGitHubApi) ?? /* @__PURE__ */ new Map();
+	stackReads.set(runGitHubApi, reads);
+	const keyOf = (number) => `${host}/${repository}#${number}`;
+	const cached = reads.get(keyOf(pullRequestNumber));
+	if (cached && Date.now() - cached.at < STACKS_FRESH_MS) return cached.stacks;
+	const read = {
+		at: Date.now(),
+		stacks: runGitHubApi(host, `repos/${repository}/stacks?pull_request=${pullRequestNumber}`).then((text) => GitHubStacksSchema.parse(JSON.parse(text)))
+	};
+	reads.set(keyOf(pullRequestNumber), read);
+	read.stacks.then((stacks) => {
+		const stack = stacks.find((candidate) => candidate.pull_requests.some((pr) => pr.number === pullRequestNumber));
+		for (const pr of stack?.pull_requests ?? []) reads.set(keyOf(pr.number), read);
+	}, () => {
+		if (reads.get(keyOf(pullRequestNumber)) === read) reads.delete(keyOf(pullRequestNumber));
+	});
+	return read.stacks;
+}
 async function gitHubStack(subject, reviews, runGitHubApi) {
 	const binding = subject.origin?.pullRequestUrl?.match(/^https:\/\/([a-z0-9.-]+)\/([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)\/pull\/([1-9]\d*)$/);
 	if (!binding) return [];
@@ -2631,7 +2665,7 @@ async function gitHubStack(subject, reviews, runGitHubApi) {
 	const repoKey = `https://${host}/${owner}/${repository}`;
 	let stacks;
 	try {
-		stacks = GitHubStacksSchema.parse(JSON.parse(await runGitHubApi(host, `repos/${owner}/${repository}/stacks?pull_request=${number}`)));
+		stacks = await readGitHubStacks(runGitHubApi, host, `${owner}/${repository}`, pullRequestNumber);
 	} catch {
 		return [];
 	}

package/dist/{headless-host-BEe-aFtB.js → headless-host-DN6rrMrK.js}

@@ -1,2 +1,2 @@
-import { i as withHeadlessServerLock, n as runHeadlessServer, r as takeOverServerHome, t as HeadlessServerBusyError } from "./headless-host-CEb5d-A0.js";
+import { i as withHeadlessServerLock, n as runHeadlessServer, r as takeOverServerHome, t as HeadlessServerBusyError } from "./headless-host-CG1XSd5n.js";
 export { HeadlessServerBusyError, runHeadlessServer, takeOverServerHome, withHeadlessServerLock };

package/dist/{request-origin-icXPv6jh.js → request-origin-BxaWyOpO.js}

@@ -687,6 +687,10 @@ const UI_TELEMETRY_EVENTS = {
 			install_location: INSTALL_LOCATION
 		}
 	},
+	loopback_tls_fallback: {
+		event: "review_loopback_tls_fallback",
+		properties: { error_name: "enum_free_short" }
+	},
 	error_burst: {
 		event: "review_error_burst",
 		properties: {

package/dist/{review-telemetry-AZ0imsmJ.js → review-telemetry-Vnb2zKyn.js}

@@ -3,7 +3,7 @@ import "./src-DYZLCUP_.js";
 import "./review-home-paths-BwH08ihj.js";
 import { F as writeFileAtomic, N as devReviewHome, j as withFileLock, k as processIsAlive } from "./s3-config-CjcLyFV5.js";
 import { i as readReviewPackageVersion, t as findReviewPackageRoot } from "./package-paths-BkeQsdaw.js";
-import "./request-origin-icXPv6jh.js";
+import "./request-origin-BxaWyOpO.js";
 import { createHmac, randomUUID } from "node:crypto";
 import { z } from "zod";
 import { existsSync, readFileSync, rmSync } from "node:fs";

package/dist/server/desktop-host.js

@@ -12,10 +12,10 @@ import { t as errorMessage } from "../error-message-OtiDonty.js";
 import { i as readReviewPackageVersion, t as findReviewPackageRoot } from "../package-paths-BkeQsdaw.js";
 import { _ as reviewInstanceIdentity, u as REVIEW_INSTANCE_ENV } from "../server-discovery-DeVTdcqK.js";
 import { t as openReviewProfile } from "../profile-duqp5uPa.js";
-import { r as reviewTelemetryChannel, t as ReviewTelemetry } from "../review-telemetry-AZ0imsmJ.js";
-import { l as REVIEW_TELEMETRY_TABS } from "../request-origin-icXPv6jh.js";
-import { c as removeLegacyReviewSkills, d as skipCliInstall, h as detectConnectAgents, i as finishCliInstallUpdate, l as resetCliInstall, m as connectAgent, n as applyCliInstall, o as pathShimPath, r as declineCliInstall, s as removeCliInstall, t as aliasInstallationToAccount, u as resolveCliInstallStatus } from "../account-alias-CisiYUZT.js";
-import { C as saveDiffrSummarizer, E as cliAskTools, S as readDiffrConfig, T as testDiffrSummarizer, _ as DEFAULT_MAX_REQUEST_BYTES, a as drainServerCrashReport, b as GlobalReviewDesktopVerbRelay, c as answerErrorsAsJson, d as legacyModeSchema, f as captureSanitizedUiTelemetry, g as readBoundedRequestJson, h as createNodeRequestListener, l as createWhiteboardCore, m as recordClientError, o as installProcessErrorTelemetry, p as clientErrorsForSession, r as takeOverServerHome, s as serverCrashReportPath, u as serverJson, v as HttpJsonError, w as setDiffrConfigValue, x as migrateDiffrConfig, y as ReviewServerError } from "../headless-host-CEb5d-A0.js";
+import { r as reviewTelemetryChannel, t as ReviewTelemetry } from "../review-telemetry-Vnb2zKyn.js";
+import { l as REVIEW_TELEMETRY_TABS } from "../request-origin-BxaWyOpO.js";
+import { c as removeLegacyReviewSkills, d as skipCliInstall, h as detectConnectAgents, i as finishCliInstallUpdate, l as resetCliInstall, m as connectAgent, n as applyCliInstall, o as pathShimPath, r as declineCliInstall, s as removeCliInstall, t as aliasInstallationToAccount, u as resolveCliInstallStatus } from "../account-alias-BRRpaO9U.js";
+import { C as saveDiffrSummarizer, E as cliAskTools, S as readDiffrConfig, T as testDiffrSummarizer, _ as DEFAULT_MAX_REQUEST_BYTES, a as drainServerCrashReport, b as GlobalReviewDesktopVerbRelay, c as answerErrorsAsJson, d as legacyModeSchema, f as captureSanitizedUiTelemetry, g as readBoundedRequestJson, h as createNodeRequestListener, l as createWhiteboardCore, m as recordClientError, o as installProcessErrorTelemetry, p as clientErrorsForSession, r as takeOverServerHome, s as serverCrashReportPath, u as serverJson, v as HttpJsonError, w as setDiffrConfigValue, x as migrateDiffrConfig, y as ReviewServerError } from "../headless-host-CG1XSd5n.js";
 import { s as readQuerySchemas } from "../authoring-tools-BCquUsB3.js";
 import crypto, { createHash, randomBytes } from "node:crypto";
 import { z } from "zod";
@@ -28,8 +28,10 @@ import { pathToFileURL } from "node:url";
 import { Readable, Writable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { gzip, gzipSync } from "node:zlib";
-import { createServer } from "node:http";
 import { Hono } from "hono";
+import { createServer } from "node:http";
+import { createSecureServer } from "node:http2";
+import { createServer as createServer$1 } from "node:net";
 import { Agent, request } from "undici";
 //#region ../review-protocol/src/review-host-status.ts
 const OFFLINE = {
@@ -766,6 +768,94 @@ function createJsonReviewReporting(store, telemetry, options = {}) {
 	});
 	return app;
 }
+//#endregion
+//#region src/server/loopback-server.ts
+const FIRST_BYTE_TIMEOUT_MS$1 = 1e4;
+const CLOSE_GRACE_MS = 1e3;
+/**
+* Plain HTTP, or with `tls` one port for both: a TLS ClientHello starts with
+* 0x16, a plain HTTP request never does.
+*/
+function createLoopbackServer(listener, tls, log) {
+	const plain = createServer(listener);
+	const plainOnly = {
+		server: plain,
+		secure: false,
+		close: () => closeServer(plain)
+	};
+	if (!tls) return plainOnly;
+	let secure;
+	try {
+		secure = createSecureServer({
+			...tls,
+			allowHTTP1: true,
+			maxSessionMemory: 1024
+		}, listener);
+	} catch (error) {
+		log?.(`TLS unavailable, serving plain HTTP only: ${String(error)}`);
+		return plainOnly;
+	}
+	plain.emit("listening");
+	const sockets = /* @__PURE__ */ new Set();
+	const pending = /* @__PURE__ */ new Set();
+	const sessions = /* @__PURE__ */ new Set();
+	secure.on("session", (session) => {
+		sessions.add(session);
+		session.once("close", () => sessions.delete(session));
+	});
+	secure.on("tlsClientError", (_error, socket) => socket.destroy());
+	const server = createServer$1((socket) => {
+		sockets.add(socket);
+		pending.add(socket);
+		socket.once("close", () => {
+			sockets.delete(socket);
+			pending.delete(socket);
+		});
+		socket.on("error", () => socket.destroy());
+		const silent = () => socket.destroy();
+		socket.setTimeout(FIRST_BYTE_TIMEOUT_MS$1);
+		socket.once("timeout", silent);
+		socket.once("data", (head) => {
+			pending.delete(socket);
+			socket.setTimeout(0);
+			socket.off("timeout", silent);
+			socket.pause();
+			socket.unshift(head);
+			if (head[0] === 22) secure.emit("connection", socket);
+			else {
+				plain.emit("connection", socket);
+				socket.resume();
+			}
+		});
+	});
+	return {
+		server,
+		secure: true,
+		close: async () => {
+			const closed = closeServer(server);
+			for (const socket of pending) socket.destroy();
+			plain.close();
+			for (const session of sessions) session.close();
+			const force = setTimeout(() => {
+				for (const socket of sockets) socket.destroy();
+			}, CLOSE_GRACE_MS);
+			try {
+				await closed;
+			} finally {
+				clearTimeout(force);
+			}
+		}
+	};
+}
+function closeServer(server) {
+	return new Promise((resolve, reject) => {
+		if (!server.listening) {
+			resolve();
+			return;
+		}
+		server.close((error) => error ? reject(error) : resolve());
+	});
+}
 const MAX_RETRY_MS = 3e4;
 const FIRST_BYTE_TIMEOUT_MS = 1e4;
 const NO_ANSWER = `it did not answer within ${FIRST_BYTE_TIMEOUT_MS / 1e3} seconds`;
@@ -2183,15 +2273,16 @@ function createGlobalReviewServer(input) {
 		if (!request.success) throw new ReviewServerError("Invalid agent.", 400);
 		return serverJson(200, await connectAgent(request.data.target, { hasShim: existsSync(pathShimPath()) }));
 	});
-	const httpServer = createServer(createNodeRequestListener(app));
+	const loopback = createLoopbackServer(createNodeRequestListener(app), input.tls, input.log);
 	return {
 		discovery,
+		secure: loopback.secure,
 		get url() {
 			return urlForBoundPort();
 		},
 		listen: async () => {
 			await migrateDiffrConfig();
-			boundPort = await listen(httpServer, input.port);
+			boundPort = await listen(loopback.server, input.port);
 			discovery.url = urlForBoundPort();
 			for (const discoveryPath of discoveryPaths) await writePrivateJsonAtomic(discoveryPath, discovery);
 		},
@@ -2202,7 +2293,7 @@ function createGlobalReviewServer(input) {
 			for (const discoveryPath of discoveryPaths) await removeMatchingDiscovery(discoveryPath, discovery);
 			relay.close();
 			openWatchdog.dispose();
-			await closeHttpServer(httpServer);
+			await loopback.close();
 			await gateway.close();
 			await telemetry.shutdown(1500);
 		},
@@ -2259,15 +2350,6 @@ function listen(server, port) {
 		});
 	});
 }
-function closeHttpServer(server) {
-	return new Promise((resolve, reject) => {
-		if (!server.listening) {
-			resolve();
-			return;
-		}
-		server.close((error) => error ? reject(error) : resolve());
-	});
-}
 async function removeMatchingDiscovery(filePath, discovery) {
 	try {
 		const current = JSON.parse(await readFile(filePath, "utf8"));
@@ -2287,6 +2369,7 @@ async function runDesktopHost(env = process.env) {
 	const appPid = requiredPositiveInteger(env.DEV_FAST_REVIEW_APP_PID, "DEV_FAST_REVIEW_APP_PID");
 	const packageRoot = findReviewPackageRoot(import.meta.url);
 	const toolingRoot = env.DEV_FAST_REVIEW_TOOLING_ROOT || packageRoot;
+	const tls = takeLoopbackTls(env);
 	const telemetryEnv = { ...env };
 	delete telemetryEnv.DEV_FAST_REVIEW_TELEMETRY_DISABLED;
 	const telemetry = ReviewTelemetry.fromEnv(telemetryEnv, { surface: "desktop" });
@@ -2309,7 +2392,8 @@ async function runDesktopHost(env = process.env) {
 		token: env.DEV_FAST_REVIEW_SERVER_TOKEN,
 		instanceId: env.DEV_FAST_REVIEW_INSTANCE_ID,
 		identity: reviewInstanceIdentity(env),
-		telemetry
+		telemetry,
+		tls
 	};
 	const home = devReviewHome(env);
 	await mkdir(home, { recursive: true });
@@ -2351,7 +2435,8 @@ async function runDesktopHost(env = process.env) {
 	process.stdout.write(`${JSON.stringify({
 		event: "ready",
 		...server.discovery,
-		installationId
+		installationId,
+		...server.secure && { tls: true }
 	})}\n`);
 	const stageRustAnalyzer = () => ensureBundledRustAnalyzer({ env }).catch((error) => {
 		const reason = error instanceof Error ? error.message : String(error);
@@ -2381,6 +2466,17 @@ async function runDesktopHost(env = process.env) {
 function isEnabledEnvValue(value) {
 	return value === "1" || value?.toLowerCase() === "true";
 }
+/** Read once, then dropped so no child process inherits the private key. */
+function takeLoopbackTls(env) {
+	const key = env.DEV_FAST_REVIEW_SERVER_TLS_KEY;
+	const cert = env.DEV_FAST_REVIEW_SERVER_TLS_CERT;
+	delete env.DEV_FAST_REVIEW_SERVER_TLS_KEY;
+	delete env.DEV_FAST_REVIEW_SERVER_TLS_CERT;
+	return key && cert ? {
+		key,
+		cert
+	} : void 0;
+}
 function requiredPort(value) {
 	const parsed = Number(value);
 	if (!Number.isSafeInteger(parsed) || parsed < 0 || parsed > 65535) throw new Error("DEV_FAST_REVIEW_SERVER_PORT must be a port between 0 and 65535.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dev.fast/whiteboard",
-  "version": "0.3.5-preview.20261021.131",
+  "version": "0.3.5-preview.20261021.133",
   "private": false,
   "license": "MIT",
   "repository": {
@@ -88,7 +88,7 @@
     "repo": "devdotfast/review",
     "docs": "packages/review/instructions/authoring.md"
   },
-  "gitHead": "6bf7b672e0c4d566b582d555044a624620c6311f",
+  "gitHead": "6c2c2de6384ef9b8d4f9d6a3c63d9cbbcee0ebe8",
   "scripts": {
     "prebuild": "pnpm run build:workspace-deps",
     "build": "node --max-old-space-size=8192 node_modules/tsdown/dist/run.mjs",

package/src/review-stack.ts

@@ -78,6 +78,58 @@ export async function resolveReviewStackLayers(
   });
 }
 
+type GitHubStacks = z.infer<typeof GitHubStacksSchema>;
+
+// One GitHub answer serves every pull request in a stack for a minute.
+const STACKS_FRESH_MS = 60_000;
+
+const stackReads = new WeakMap<
+  RunGitHubApi,
+  Map<string, { at: number; stacks: Promise<GitHubStacks> }>
+>();
+
+function readGitHubStacks(
+  runGitHubApi: RunGitHubApi,
+  host: string,
+  repository: string,
+  pullRequestNumber: number,
+): Promise<GitHubStacks> {
+  const reads = stackReads.get(runGitHubApi) ?? new Map();
+
+  stackReads.set(runGitHubApi, reads);
+
+  const keyOf = (number: number) => `${host}/${repository}#${number}`;
+  const cached = reads.get(keyOf(pullRequestNumber));
+
+  if (cached && Date.now() - cached.at < STACKS_FRESH_MS) return cached.stacks;
+
+  const read = {
+    at: Date.now(),
+    stacks: runGitHubApi(
+      host,
+      `repos/${repository}/stacks?pull_request=${pullRequestNumber}`,
+    ).then((text) => GitHubStacksSchema.parse(JSON.parse(text))),
+  };
+
+  reads.set(keyOf(pullRequestNumber), read);
+  read.stacks.then(
+    (stacks) => {
+      const stack = stacks.find((candidate) =>
+        candidate.pull_requests.some((pr) => pr.number === pullRequestNumber),
+      );
+
+      for (const pr of stack?.pull_requests ?? [])
+        reads.set(keyOf(pr.number), read);
+    },
+    () => {
+      if (reads.get(keyOf(pullRequestNumber)) === read)
+        reads.delete(keyOf(pullRequestNumber));
+    },
+  );
+
+  return read.stacks;
+}
+
 async function gitHubStack(
   subject: Subject,
   reviews: readonly Candidate[],
@@ -91,16 +143,14 @@ async function gitHubStack(
   const [, host, owner, repository, number] = binding;
   const pullRequestNumber = Number(number);
   const repoKey = `https://${host}/${owner}/${repository}`;
-  let stacks: z.infer<typeof GitHubStacksSchema>;
+  let stacks: GitHubStacks;
 
   try {
-    stacks = GitHubStacksSchema.parse(
-      JSON.parse(
-        await runGitHubApi(
-          host!,
-          `repos/${owner}/${repository}/stacks?pull_request=${number}`,
-        ),
-      ),
+    stacks = await readGitHubStacks(
+      runGitHubApi,
+      host!,
+      `${owner}/${repository}`,
+      pullRequestNumber,
     );
   } catch {
     // Stack discovery must not make the Review unavailable when GitHub or

package/src/server/desktop-host.ts

@@ -37,6 +37,7 @@ export async function runDesktopHost(
 
   const packageRoot = findReviewPackageRoot(import.meta.url);
   const toolingRoot = env.DEV_FAST_REVIEW_TOOLING_ROOT || packageRoot;
+  const tls = takeLoopbackTls(env);
   const telemetryEnv = { ...env };
   delete telemetryEnv.DEV_FAST_REVIEW_TELEMETRY_DISABLED;
 
@@ -73,6 +74,7 @@ export async function runDesktopHost(
     instanceId: env.DEV_FAST_REVIEW_INSTANCE_ID,
     identity: reviewInstanceIdentity(env),
     telemetry,
+    tls,
   };
 
   const home = devReviewHome(env);
@@ -119,7 +121,7 @@ export async function runDesktopHost(
   });
 
   process.stdout.write(
-    `${JSON.stringify({ event: "ready", ...server.discovery, installationId })}\n`,
+    `${JSON.stringify({ event: "ready", ...server.discovery, installationId, ...(server.secure && { tls: true }) })}\n`,
   );
 
   const stageRustAnalyzer = () =>
@@ -172,6 +174,17 @@ function isEnabledEnvValue(value: string | undefined): boolean {
   return value === "1" || value?.toLowerCase() === "true";
 }
 
+/** Read once, then dropped so no child process inherits the private key. */
+function takeLoopbackTls(env: NodeJS.ProcessEnv) {
+  const key = env.DEV_FAST_REVIEW_SERVER_TLS_KEY;
+  const cert = env.DEV_FAST_REVIEW_SERVER_TLS_CERT;
+
+  delete env.DEV_FAST_REVIEW_SERVER_TLS_KEY;
+  delete env.DEV_FAST_REVIEW_SERVER_TLS_CERT;
+
+  return key && cert ? { key, cert } : undefined;
+}
+
 function requiredPort(value: string | undefined): number {
   const parsed = Number(value);
 

package/src/server/desktop-server.ts

@@ -1,8 +1,7 @@
 import crypto from "node:crypto";
 import { existsSync } from "node:fs";
 import { readFile, rm } from "node:fs/promises";
-import { type Server, createServer } from "node:http";
-import type { AddressInfo } from "node:net";
+import type { AddressInfo, Server } from "node:net";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 
@@ -78,6 +77,7 @@ import {
   captureReviewUiEvent,
   createJsonReviewReporting,
 } from "./json-review-reporting";
+import { type LoopbackTls, createLoopbackServer } from "./loopback-server";
 import { createReviewGateway } from "./review-gateway";
 import { reviewLifecycleTelemetry } from "./review-lifecycle-telemetry";
 import { ReviewOpenWatchdog } from "./review-open-watchdog";
@@ -110,6 +110,7 @@ export interface GlobalReviewServerInput {
   relay?: ReviewDesktopVerbRelay;
   /** Electron's Review crash dump directory; `/crash-reports` reads only inside it. */
   crashDumpsDir?: string;
+  tls?: LoopbackTls;
   onRemoteHostRestarted?(alias: string): void;
   log?(message: string): void;
 }
@@ -117,6 +118,7 @@ export interface GlobalReviewServerInput {
 export interface GlobalReviewServer {
   readonly discovery: ReviewDesktopDiscovery;
   readonly url: string;
+  readonly secure: boolean;
   listen(): Promise<void>;
   close(reason?: "app-exit"): Promise<void>;
   setRemoteHosts(hosts: ReviewGatewayHost[]): void;
@@ -483,16 +485,21 @@ export function createGlobalReviewServer(
     );
   });
 
-  const httpServer = createServer(createNodeRequestListener(app));
+  const loopback = createLoopbackServer(
+    createNodeRequestListener(app),
+    input.tls,
+    input.log,
+  );
 
   return {
     discovery,
+    secure: loopback.secure,
     get url() {
       return urlForBoundPort();
     },
     listen: async () => {
       await migrateDiffrConfig();
-      boundPort = await listen(httpServer, input.port);
+      boundPort = await listen(loopback.server, input.port);
       discovery.url = urlForBoundPort();
 
       for (const discoveryPath of discoveryPaths)
@@ -508,7 +515,7 @@ export function createGlobalReviewServer(
       relay.close();
       openWatchdog.dispose();
 
-      await closeHttpServer(httpServer);
+      await loopback.close();
       await gateway.close();
       await telemetry.shutdown(1_500);
     },
@@ -594,18 +601,6 @@ function listen(server: Server, port: number): Promise<number> {
   });
 }
 
-function closeHttpServer(server: Server): Promise<void> {
-  return new Promise((resolve, reject) => {
-    if (!server.listening) {
-      resolve();
-
-      return;
-    }
-
-    server.close((error) => (error ? reject(error) : resolve()));
-  });
-}
-
 async function removeMatchingDiscovery(
   filePath: string,
   discovery: ReviewDesktopDiscovery,

package/src/server/hono-http.ts

@@ -1,12 +1,15 @@
 import crypto from "node:crypto";
-import type { IncomingMessage, ServerResponse } from "node:http";
 
 import {
   type JsonValue,
   REVIEW_HOST_HEADER,
   parseJsonText,
 } from "@dev.fast/review-protocol";
-import { type HttpBindings, getRequestListener } from "@hono/node-server";
+import {
+  type Http2Bindings,
+  type HttpBindings,
+  getRequestListener,
+} from "@hono/node-server";
 import { REVIEW_PERSON_HEADER } from "@review/review-api/request-origin";
 import { REVIEW_APP_SESSION_ID_HEADER } from "@review/ui-telemetry-events";
 import type { Hono } from "hono";
@@ -16,13 +19,36 @@ import { StreamLimitError, readBoundedStream } from "./bounded-stream.js";
 import { DEFAULT_MAX_REQUEST_BYTES, HttpJsonError } from "./http-json";
 
 export type ReviewHonoEnv = {
-  Bindings: HttpBindings;
+  Bindings: HttpBindings | Http2Bindings;
 };
 
+// HTTP/2 rejects connection-specific headers, such as streamSSE's chunked framing.
+const H2_FORBIDDEN_HEADERS = [
+  "connection",
+  "keep-alive",
+  "proxy-connection",
+  "transfer-encoding",
+  "upgrade",
+];
+
 export function createNodeRequestListener(
   app: Hono<ReviewHonoEnv>,
-): (request: IncomingMessage, response: ServerResponse) => Promise<void> {
-  return getRequestListener(app.fetch);
+): ReturnType<typeof getRequestListener> {
+  return getRequestListener(async (request, env) => {
+    const response = await app.fetch(request, env);
+
+    if (
+      env.incoming.httpVersionMajor !== 2 ||
+      !H2_FORBIDDEN_HEADERS.some((name) => response.headers.has(name))
+    )
+      return response;
+
+    const stripped = new Response(response.body, response);
+
+    for (const name of H2_FORBIDDEN_HEADERS) stripped.headers.delete(name);
+
+    return stripped;
+  });
 }
 
 export function jsonResponse<T>(

package/src/server/loopback-server.ts

@@ -0,0 +1,146 @@
+import {
+  type IncomingMessage,
+  type ServerResponse,
+  createServer,
+} from "node:http";
+import {
+  type Http2ServerRequest,
+  type Http2ServerResponse,
+  type ServerHttp2Session,
+  createSecureServer,
+} from "node:http2";
+import {
+  type Server as NetServer,
+  type Socket,
+  createServer as createNetServer,
+} from "node:net";
+
+export interface LoopbackTls {
+  key: string;
+  cert: string;
+}
+
+export interface LoopbackServer {
+  server: NetServer;
+  secure: boolean;
+  close(): Promise<void>;
+}
+
+type Listener = (
+  request: IncomingMessage | Http2ServerRequest,
+  response: ServerResponse | Http2ServerResponse,
+) => Promise<void>;
+
+const FIRST_BYTE_TIMEOUT_MS = 10_000;
+
+const CLOSE_GRACE_MS = 1_000;
+
+/**
+ * Plain HTTP, or with `tls` one port for both: a TLS ClientHello starts with
+ * 0x16, a plain HTTP request never does.
+ */
+export function createLoopbackServer(
+  listener: Listener,
+  tls?: LoopbackTls,
+  log?: (message: string) => void,
+): LoopbackServer {
+  const plain = createServer(listener);
+
+  const plainOnly = {
+    server: plain,
+    secure: false,
+    close: () => closeServer(plain),
+  };
+
+  if (!tls) return plainOnly;
+
+  let secure: ReturnType<typeof createSecureServer>;
+
+  try {
+    secure = createSecureServer(
+      // In MB. At Node's 10 MB default, queued large responses reset streams.
+      { ...tls, allowHTTP1: true, maxSessionMemory: 1_024 },
+      listener,
+    );
+  } catch (error) {
+    log?.(`TLS unavailable, serving plain HTTP only: ${String(error)}`);
+
+    return plainOnly;
+  }
+
+  // Sniffed sockets bypass plain.listen(), which starts its idle and timeout tracking.
+  plain.emit("listening");
+
+  const sockets = new Set<Socket>();
+  const pending = new Set<Socket>();
+  const sessions = new Set<ServerHttp2Session>();
+
+  secure.on("session", (session) => {
+    sessions.add(session);
+    session.once("close", () => sessions.delete(session));
+  });
+  secure.on("tlsClientError", (_error, socket) => socket.destroy());
+
+  const server = createNetServer((socket) => {
+    sockets.add(socket);
+    pending.add(socket);
+    socket.once("close", () => {
+      sockets.delete(socket);
+      pending.delete(socket);
+    });
+    socket.on("error", () => socket.destroy());
+
+    const silent = () => socket.destroy();
+
+    socket.setTimeout(FIRST_BYTE_TIMEOUT_MS);
+    socket.once("timeout", silent);
+    socket.once("data", (head: Buffer) => {
+      pending.delete(socket);
+      socket.setTimeout(0);
+      socket.off("timeout", silent);
+      socket.pause();
+      socket.unshift(head);
+
+      if (head[0] === 0x16) secure.emit("connection", socket);
+      else {
+        plain.emit("connection", socket);
+        socket.resume();
+      }
+    });
+  });
+
+  return {
+    server,
+    secure: true,
+    close: async () => {
+      const closed = closeServer(server);
+
+      for (const socket of pending) socket.destroy();
+      plain.close();
+
+      for (const session of sessions) session.close();
+
+      const force = setTimeout(() => {
+        for (const socket of sockets) socket.destroy();
+      }, CLOSE_GRACE_MS);
+
+      try {
+        await closed;
+      } finally {
+        clearTimeout(force);
+      }
+    },
+  };
+}
+
+function closeServer(server: NetServer): Promise<void> {
+  return new Promise((resolve, reject) => {
+    if (!server.listening) {
+      resolve();
+
+      return;
+    }
+
+    server.close((error) => (error ? reject(error) : resolve()));
+  });
+}

package/src/ui-telemetry-events.ts

@@ -605,6 +605,10 @@ export const UI_TELEMETRY_EVENTS = {
     event: "review_app_ready",
     properties: { duration_ms: "number", install_location: INSTALL_LOCATION },
   },
+  loopback_tls_fallback: {
+    event: "review_loopback_tls_fallback",
+    properties: { error_name: "enum_free_short" },
+  },
   error_burst: {
     event: "review_error_burst",
     properties: { message_hash: "hash_hex", suppressed: "number" },

package/dist/agent-cli-BglNRDZN.js

@@ -1,2 +0,0 @@
-import { n as runReviewAgentCli } from "./agent-cli-TJ7_5_B3.js";
-export { runReviewAgentCli };