@gavin-hu/my-pi-agent 0.18.0 → 0.19.0

package/extensions/plan/web-page.ts

@@ -25,7 +25,6 @@ import {
 	WEB_LAYOUT_CSS,
 	WEB_THEME_CSS,
 } from "../../lib/web/index.ts";
-import { escapeHtml } from "../../lib/escape.ts";
 import type { PlanBlock } from "./blocks.ts";
 import type { PlanAnnotation } from "./feedback.ts";
 import type { ReviewRole } from "./types.ts";
@@ -78,11 +77,6 @@ export interface ReviewPageData {
 	 * whether its name control is still a choice.
 	 */
 	author?: string;
-	/**
-	 * One line the owner needs before acting, such as why approval happens in the
-	 * terminal; absent when the page needs no caveat.
-	 */
-	note?: string;
 	/** A running share, so a reload re-renders the link the owner already minted. */
 	share?: ShareState;
 	/** Per-session secret the client echoes on every request. */
@@ -322,7 +316,6 @@ export function renderReviewPage(data: ReviewPageData): string {
 <div class="bf-panel review-panel">
 ${reviewFacts()}
 <nav class="review-nav" aria-labelledby="outline-title"><p class="review-nav__title" id="outline-title">Sections</p><ul id="outline-list"></ul></nav>
-${data.note ? `<p class="review-hint">${escapeHtml(data.note)}</p>` : ""}
 ${reviewHints(data.role, data.canApprove)}
 </div>
 </details>

package/extensions/plan/web-router.ts

@@ -13,14 +13,13 @@
  */
 
 import {
+	envelopeRefusal,
 	eventHeaders,
-	hostHeaderName,
-	isAllowedHostHeader,
 	jsonError,
-	jsonHeaders,
 	jsonResponse,
 	pageHeaders,
 	parseRequestUrl,
+	postOnly,
 	scriptHeaders,
 	type ServeResponse,
 } from "../../lib/http/index.ts";
@@ -84,12 +83,6 @@ function isResponse(value: PlanAnnotation[] | ServeResponse): value is ServeResp
 	return !Array.isArray(value);
 }
 
-/** The 405 for a route that only accepts POST, or nothing when the method is right. */
-function postOnly(method: string, what: string): ServeResponse | undefined {
-	if (method.toUpperCase() === "POST") return undefined;
-	return jsonError(405, `Use POST to ${what}.`);
-}
-
 /**
  * The 403 for a route the caller's role may not use, or nothing when it may. Each
  * route keeps its own sentence, because the reason differs: a reviewer posts
@@ -111,53 +104,6 @@ function linkIdOf(body: string): string | undefined {
 	return typeof id === "string" && id !== "" ? id : undefined;
 }
 
-/** Validate method and `Host`; returns an error response to send instead. */
-function checkEnvelope(
-	ctx: ReviewContext,
-	method: string,
-	headers: Record<string, string | string[] | undefined>,
-): ServeResponse | undefined {
-	const upper = method.toUpperCase();
-	if (upper !== "GET" && upper !== "HEAD" && upper !== "POST") {
-		return {
-			...jsonError(405, "Only GET, HEAD, and POST are served."),
-			headers: { ...jsonHeaders(), Allow: "GET, HEAD, POST" },
-		};
-	}
-	// Fail closed: a missing or non-string Host is rejected too, not just a
-	// foreign one, so the DNS-rebinding guard cannot be skipped.
-	if (!isAllowedHostHeader(headers, { hosts: ctx.hosts(), required: true })) {
-		return jsonError(403, "Unexpected Host header.");
-	}
-	return upper === "POST" ? checkOrigin(headers) : undefined;
-}
-
-/**
- * Refuse a state-changing request another site made. A browser sends `Origin`
- * on every POST and `Sec-Fetch-Site` with its own classification; a request
- * with neither is a script or a test, which has no ambient credential to abuse.
- */
-function checkOrigin(headers: Record<string, string | string[] | undefined>): ServeResponse | undefined {
-	const site = headers["sec-fetch-site"];
-	if (typeof site === "string" && site !== "" && site !== "same-origin" && site !== "none") {
-		return jsonError(403, "Cross-origin request refused.");
-	}
-	const origin = headers.origin;
-	if (origin === undefined) return undefined;
-	if (typeof origin !== "string" || origin === "") return jsonError(403, "Unexpected Origin header.");
-	let parsed: URL;
-	try {
-		parsed = new URL(origin);
-	} catch {
-		return jsonError(403, "Unexpected Origin header.");
-	}
-	const host = headers.host;
-	if (typeof host !== "string" || hostHeaderName(parsed.host) !== hostHeaderName(host)) {
-		return jsonError(403, "Cross-origin request refused.");
-	}
-	return undefined;
-}
-
 /**
  * Handle one request. `method`, `rawUrl`, and `headers` are the raw HTTP
  * values; `body` is the request body for a POST.
@@ -169,7 +115,7 @@ export async function handleReviewRequest(
 	headers: Record<string, string | string[] | undefined> = {},
 	body = "",
 ): Promise<ServeResponse> {
-	const envelope = checkEnvelope(ctx, method, headers);
+	const envelope = envelopeRefusal({ method, headers, hosts: ctx.hosts() });
 	if (envelope) return envelope;
 
 	const parsed = parseRequestUrl(rawUrl);

package/extensions/plan/web-share-session.ts

@@ -3,13 +3,12 @@
  * network, and the state the owner's page and `/plan share` read.
  *
  * Separate from `web.ts` because the review session's job is its own lifecycle —
- * open, settle, close — while this module owns the socket that exists only while
- * the owner has sharing on. It is handed the one request handler, the token
+ * open, settle, close — while this module owns the address, the links, and the
+ * listener's lifetime. It is handed the one request handler, the token
  * hooks, and the frame hooks, so it never reaches into the session's maps.
  */
 
-import { createServer, type IncomingMessage, type Server, type ServerResponse } from "node:http";
-import { bindHost, createCloser, LOOPBACK_HOSTS } from "../../lib/http/index.ts";
+import { LOOPBACK_HOSTS, type LoopbackHandler, type LoopbackServer, serveLoopback } from "../../lib/http/index.ts";
 import { qrSvg } from "../../lib/qr.ts";
 import type { ReviewFrame, ReviewRole } from "./types.ts";
 import {
@@ -27,7 +26,9 @@ import {
 /** What the share listener needs from the review session it belongs to. */
 export interface ShareSessionDeps {
 	/** The one request handler: a loopback page and a shared page are the same page. */
-	handleRequest: (request: IncomingMessage, response: ServerResponse) => void;
+	handleRequest: LoopbackHandler;
+	/** The body cap both listeners read under, so a shared page is not read differently. */
+	maxBodyBytes: number;
 	/** The owner's bound port, reused for the link when it is free. */
 	ownerPort: () => number;
 	/** The machine's interfaces, or a snapshot a test injected. */
@@ -65,8 +66,7 @@ export interface ShareSession {
 export function createShareSession(deps: ShareSessionDeps): ShareSession {
 	let address = "";
 	let port = 0;
-	let server: Server | undefined;
-	let closeServer: (() => Promise<void>) | undefined;
+	let server: LoopbackServer | undefined;
 	const links: LinkTable = createLinkTable({
 		mint: deps.mintReviewer,
 		revoke: deps.revokeReviewer,
@@ -87,24 +87,20 @@ export function createShareSession(deps: ShareSessionDeps): ShareSession {
 
 	/** Bind the shared listener on `chosen`, reusing the owner's port when it is free. */
 	const bind = async (chosen: string): Promise<void> => {
-		const candidate = createServer(deps.handleRequest);
-		let bound: number | undefined;
-		for (const attempt of [deps.ownerPort(), 0]) {
-			try {
-				bound = await bindHost(candidate, chosen, attempt);
-				break;
-			} catch {
-				bound = undefined;
-			}
+		try {
+			const bound = await serveLoopback({
+				host: chosen,
+				ports: [deps.ownerPort(), 0],
+				maxBodyBytes: deps.maxBodyBytes,
+				handler: deps.handleRequest,
+			});
+			server = bound;
+			address = chosen;
+			port = bound.port;
+		} catch {
+			// Neither the owner's port nor a free one answered: the caller reports it.
+			server = undefined;
 		}
-		if (bound === undefined) {
-			candidate.close();
-			return;
-		}
-		server = candidate;
-		closeServer = createCloser(candidate);
-		address = chosen;
-		port = bound;
 	};
 
 	/**
@@ -176,21 +172,19 @@ export function createShareSession(deps: ShareSessionDeps): ShareSession {
 		// The reviewers are told before their listener goes away; the review itself
 		// stays open for its owner.
 		deps.endStreams("revoked", { role: "reviewer" });
-		const closer = closeServer;
+		const closer = server;
 		server = undefined;
-		closeServer = undefined;
 		address = "";
 		port = 0;
 		reason = undefined;
-		if (closer) await closer();
+		if (closer) await closer.close();
 		return settle();
 	};
 
 	const close = async (): Promise<void> => {
-		const closer = closeServer;
+		const closer = server;
 		server = undefined;
-		closeServer = undefined;
-		if (closer) await closer();
+		if (closer) await closer.close();
 	};
 
 	return { share, invite, revoke, stop, state: snapshot, hosts, close };

package/extensions/plan/web-streams.ts

@@ -3,9 +3,11 @@
  * when a closed tab ends the review.
  *
  * A frame carries only a kind, so the registry is the only thing that knows who
- * is connected. It is keyed by response — a page may hold more than one stream —
- * and records the caller it belongs to, so an owner-only frame, or one revoked
- * link, can be addressed without the caller reaching into the map.
+ * is connected. It is keyed by sink — a page may hold more than one stream — and
+ * records the caller it belongs to, so an owner-only frame, or one revoked link,
+ * can be addressed without the caller reaching into the map. Liveness is the
+ * sink's own (a write after the end is a no-op), so the registry never asks the
+ * socket whether it is still writable.
  *
  * The closed-tab rule lives here because it is a fact about streams: a reviewer's
  * tab opening or closing changes nothing, while the owner's own page going away
@@ -13,7 +15,7 @@
  * against that reload, so it takes the timer as a seam a test can drive by hand.
  */
 
-import type { ServerResponse } from "node:http";
+import type { EventSink } from "../../lib/http/index.ts";
 import type { ArmTimer } from "../../lib/timer.ts";
 import type { ReviewFrame, ReviewRole } from "./types.ts";
 
@@ -44,9 +46,9 @@ export interface StreamRegistryDeps {
 /** The stream set one running review holds. */
 export interface StreamRegistry {
 	/** Register a stream, and stand down a pending closed-tab grace. */
-	add(response: ServerResponse, record: StreamRecord): void;
+	add(sink: EventSink, record: StreamRecord): void;
 	/** Forget a stream, arming the grace when it was the owner's last one. */
-	remove(response: ServerResponse): void;
+	remove(sink: EventSink): void;
 	/** Tell the open pages something changed. */
 	broadcast(kind: ReviewFrame, only?: StreamFilter): void;
 	/** Send one last frame and end the stream with it. */
@@ -60,7 +62,7 @@ export interface StreamRegistry {
 }
 
 export function createStreams(deps: StreamRegistryDeps): StreamRegistry {
-	const clients = new Map<ServerResponse, StreamRecord>();
+	const clients = new Map<EventSink, StreamRecord>();
 	let sawOwner = false;
 	let cancelDrop: (() => void) | undefined;
 
@@ -91,29 +93,27 @@ export function createStreams(deps: StreamRegistryDeps): StreamRegistry {
 	};
 
 	return {
-		add(response, record) {
-			clients.set(response, record);
+		add(sink, record) {
+			clients.set(sink, record);
 			if (record.role === "owner") {
 				sawOwner = true;
 				cancel();
 			}
 		},
-		remove(response) {
-			const record = clients.get(response);
-			clients.delete(response);
+		remove(sink) {
+			const record = clients.get(sink);
+			clients.delete(sink);
 			if (record?.role === "owner") scheduleDrop();
 		},
 		broadcast(kind, only) {
 			for (const [client, record] of clients) {
 				if (!matches(record, only)) continue;
-				if (client.writableEnded || client.destroyed) continue;
 				client.write(`data: ${kind}\n\n`);
 			}
 		},
 		end(kind, only) {
 			for (const [client, record] of clients) {
 				if (!matches(record, only)) continue;
-				if (client.writableEnded || client.destroyed) continue;
 				client.end(`data: ${kind}\n\n`);
 			}
 		},

package/extensions/plan/web-tokens.ts

@@ -15,7 +15,7 @@
  *   carries only the name, so a shared name is a shared marker.
  */
 
-import { randomBytes } from "node:crypto";
+import { mintToken } from "../../lib/http/index.ts";
 import type { ReviewCaller, ReviewRole } from "./types.ts";
 
 /** The token → caller table one running review holds. */
@@ -38,7 +38,7 @@ export interface TokenTable {
 const COLLISION_ATTEMPTS = 8;
 
 /** A 128-bit token; the one credential a reviewer holds. */
-const defaultToken = (): string => randomBytes(16).toString("hex");
+const defaultToken = (): string => mintToken();
 
 /** Build the table for one review. `mint` is the generator a test replaces. */
 export function createTokens(mint: () => string = defaultToken): TokenTable {

package/extensions/plan/web.ts

@@ -6,39 +6,38 @@
  * for one plan, opens the default browser at a tokenized URL, and resolves
  * `done` when the user saves feedback, cancels, closes the tab (detected by the
  * event stream dropping), or aborts the turn. The route logic lives in the pure
- * `web-router.ts`; this module is the only part that owns a socket and timers,
- * and it takes injected seams so tests can run one on `127.0.0.1:0`.
+ * `web-router.ts`; this module owns the routes and the timers, `lib/http` owns
+ * the socket, and it takes injected seams so tests can run one on `127.0.0.1:0`.
  */
 
-import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
 import { networkInterfaces } from "node:os";
 import { basename } from "node:path";
 import { openInBrowser } from "../../lib/browser.ts";
 import {
-	bindLoopback,
-	createCloser,
 	jsonHeaders,
-	openEventStream,
+	type LoopbackRequest,
+	type LoopbackReply,
+	type LoopbackServer,
 	parseRequestUrl,
-	respond,
+	serveLoopback,
 	type ServeResponse,
 } from "../../lib/http/index.ts";
 import { fenceLanguage, highlightLines } from "../../lib/highlight.ts";
 import { type ArmTimer, defaultInterval, defaultTimer, type RepeatTimer } from "../../lib/timer.ts";
-import { codeBody, fenceInfo, planBlocks } from "./blocks.ts";
+import { codeBody, fenceInfo } from "./blocks.ts";
 import {
 	claimAuthor,
 	MAX_ANNOTATIONS,
 	MAX_COMMENT_LENGTH,
 	MAX_QUOTE_LENGTH,
 	normalizeAuthor,
-	parseFeedback,
+	readFeedback,
 	stripFeedback,
 	type PlanAnnotation,
 } from "./feedback.ts";
 import { planTitle, type PlanStore, type StoredPlan } from "./plans.ts";
 import { changedSections, planDigest, type SectionDigest } from "./plan-text.ts";
-import { extractPlanSections, extractPlanSteps } from "./steps.ts";
+import { extractPlanSteps } from "./steps.ts";
 import type { ReviewCaller } from "./types.ts";
 import { handleReviewRequest, type ReviewContext, type SaveResult } from "./web-router.ts";
 import type { ReviewPageData } from "./web-page.ts";
@@ -71,8 +70,6 @@ export interface PlanReviewOptions {
 	signal?: AbortSignal;
 	/** Whether the browser may approve the plan (only the `exit_plan_mode` flow). */
 	canApprove?: boolean;
-	/** A line the page shows the owner, such as why approval belongs in the terminal. */
-	note?: string;
 	/** The section digests the previous review showed, so this page can mark changed sections. */
 	baseline?: SectionDigest[];
 	/**
@@ -143,40 +140,6 @@ const DROP_GRACE_MS = 1500;
  */
 const PLAN_POLL_MS = 1000;
 
-/** A request body, or the fact that it was too large to read. */
-type BodyResult = { ok: true; body: string } | { ok: false };
-
-/**
- * Read a request body, stopping at {@link MAX_BODY_BYTES}. An oversize body is
- * reported rather than destroyed here, so the handler can still answer 413 over
- * the open socket instead of the client seeing a dropped connection.
- */
-function readBody(request: IncomingMessage, limit: number): Promise<BodyResult> {
-	return new Promise((resolve) => {
-		const chunks: Buffer[] = [];
-		let size = 0;
-		let done = false;
-		const settle = (result: BodyResult): void => {
-			if (done) return;
-			done = true;
-			resolve(result);
-		};
-		request.on("data", (chunk: Buffer) => {
-			if (done) return;
-			size += chunk.length;
-			if (size > limit) {
-				chunks.length = 0;
-				request.pause();
-				settle({ ok: false });
-				return;
-			}
-			chunks.push(chunk);
-		});
-		request.on("end", () => settle({ ok: true, body: Buffer.concat(chunks).toString("utf-8") }));
-		request.on("error", () => settle({ ok: false }));
-	});
-}
-
 export function createPlanWebReview(store: PlanStore, deps: PlanWebReviewDeps = {}): PlanWebReview {
 	const sessions = new Set<PlanReviewSession>();
 	// What each running review can do about sharing; the session itself stays the
@@ -193,7 +156,9 @@ export function createPlanWebReview(store: PlanStore, deps: PlanWebReviewDeps =
 	): Promise<PlanReviewSession | undefined> => {
 		const { signal } = options;
 		const canApprove = options.canApprove === true;
-		const maxBody = deps.maxBodyBytes ?? MAX_BODY_BYTES;
+		// One cap for both listeners: a reviewer's page posts the same bodies as the
+		// owner's, so the shared one cannot be the stricter or the looser of the two.
+		const bodyLimit = deps.maxBodyBytes ?? MAX_BODY_BYTES;
 		// One token per holder: the owner's is minted here and never shared, and a
 		// reviewer token is minted by `share()`. The table owns the collision rule and
 		// the name each link has bound.
@@ -279,13 +244,16 @@ export function createPlanWebReview(store: PlanStore, deps: PlanWebReviewDeps =
 		const page = async (caller: ReviewCaller): Promise<ReviewPageData> => {
 			const { role } = caller;
 			const stored = await refreshPageText();
-			const current = pageText;
-			const blocks = planBlocks(current);
-			const sections = extractPlanSections(current);
-			// Per-occurrence change flags, aligned with the sections list: the same shape
-			// the terminal review renders, so duplicate headings cannot both light up.
-			const changed = changedSections(options.baseline, current);
-			const outline = sections.flatMap((section, index) =>
+			// The body, its blocks, and the comments out of one read of the file: an
+			// anchor names a block from this same parse, so the island cannot mark a
+			// comment onto a line the page never rendered.
+			const read = readFeedback(stored.content);
+			const current = read.body;
+			const blocks = read.blocks;
+			// Per-section change marks, each carrying its own section: the same shape the
+			// terminal review renders, so a heading and its mark cannot be paired wrongly.
+			const marks = changedSections(options.baseline, current);
+			const outline = marks.flatMap(({ section, changed }) =>
 				section.title === ""
 					? []
 					: [
@@ -294,7 +262,7 @@ export function createPlanWebReview(store: PlanStore, deps: PlanWebReviewDeps =
 								line: section.line,
 								level: section.level,
 								text: section.title,
-								...(changed[index] ? { changed: true } : {}),
+								...(changed ? { changed: true } : {}),
 							},
 						],
 			);
@@ -312,9 +280,9 @@ export function createPlanWebReview(store: PlanStore, deps: PlanWebReviewDeps =
 			return {
 				// The document's own H1 reads better than the file-name slug, and the
 				// slug is still the fallback for a plan that starts with something else.
-				title: sections.find((section) => section.level === 1)?.title || planTitle(basename(plan.path)),
+				title: marks.find((mark) => mark.section.level === 1)?.section.title || planTitle(basename(plan.path)),
 				blocks,
-				annotations: parseFeedback(stored.content),
+				annotations: read.annotations,
 				outline,
 				steps: {
 					done: stepList.filter((step) => step.status === "completed").length,
@@ -328,7 +296,6 @@ export function createPlanWebReview(store: PlanStore, deps: PlanWebReviewDeps =
 				rev: planDigest(current),
 				...(caller.name === undefined ? {} : { author: caller.name }),
 				canApprove: role === "owner" && canApprove,
-				...(role === "owner" && options.note !== undefined ? { note: options.note } : {}),
 				share: role === "owner" ? shareSession.state() : undefined,
 			};
 		};
@@ -376,6 +343,7 @@ export function createPlanWebReview(store: PlanStore, deps: PlanWebReviewDeps =
 		// frame hooks, so sharing stays one concern instead of five fields here.
 		const shareSession = createShareSession({
 			handleRequest,
+			maxBodyBytes: bodyLimit,
 			ownerPort: () => currentPort,
 			networkInterfaces: deps.networkInterfaces ?? networkInterfaces,
 			mintReviewer: () => tokens.mint("reviewer"),
@@ -410,78 +378,56 @@ export function createPlanWebReview(store: PlanStore, deps: PlanWebReviewDeps =
 		// Live event streams, used only to notice a closed owner tab: a reviewer's
 		// tab is not the review's lifetime. The explicit Cancel button and the abort
 		// signal are the deterministic paths.
-		const server = createServer(handleRequest);
 		/** One request, on either listener: the loopback page or a shared one. */
-		function handleRequest(request: IncomingMessage, response: ServerResponse): void {
-			void (async () => {
-				const method = request.method ?? "GET";
-				const read =
-					method.toUpperCase() === "POST" ? await readBody(request, maxBody) : { ok: true as const, body: "" };
-				if (!read.ok) {
-					response.writeHead(413, { ...jsonHeaders(), Connection: "close" });
-					response.end(JSON.stringify({ error: "The request body is too large." }));
-					return;
-				}
-				const body = read.body;
-				let result: ServeResponse;
-				try {
-					result = await handleReviewRequest(context, method, request.url ?? "/", request.headers, body);
-				} catch {
-					result = {
-						status: 500,
-						headers: jsonHeaders(),
-						body: JSON.stringify({ error: "Internal error" }),
-					};
-				}
-				if (result.stream) {
-					openEventStream(response, result);
-					// A page that walks away mid-frame must not take the session down.
-					response.on("error", () => {});
-					const token = parseRequestUrl(request.url ?? "/")?.search.get("token") ?? "";
-					const streamCaller = context.caller(token);
-					if (streamCaller !== undefined) streams.add(response, { role: streamCaller.role, token });
-					request.on("close", () => streams.remove(response));
-					return;
-				}
-				// A save or cancel only resolves the session after its response is on the
-				// wire; otherwise `close()` would force-close the socket mid-reply. The
-				// `close` path covers a client that walks away before the flush callback
-				// runs, so a settle cannot be lost with the socket.
-				const settlePending = (): void => {
-					const terminal = pendingResult;
-					if (!terminal) return;
-					pendingResult = undefined;
-					finish(terminal);
+		async function handleRequest(request: LoopbackRequest): Promise<LoopbackReply> {
+			let result: ServeResponse;
+			try {
+				result = await handleReviewRequest(context, request.method, request.url, request.headers, request.body);
+			} catch {
+				result = {
+					status: 500,
+					headers: jsonHeaders(),
+					body: JSON.stringify({ error: "Internal error" }),
 				};
-				respond(request, response, result, settlePending);
-				response.on("close", settlePending);
-			})();
+			}
+			// A save or cancel only resolves the session after its response is on the
+			// wire; otherwise `close()` would force-close the socket mid-reply. The same
+			// hook covers a client that walks away before the flush, so a settle cannot be
+			// lost with the socket.
+			const settlePending = (): void => {
+				const terminal = pendingResult;
+				if (!terminal) return;
+				pendingResult = undefined;
+				finish(terminal);
+			};
+			if (!result.stream) return { result, afterResponse: settlePending };
+			const token = parseRequestUrl(request.url)?.search.get("token") ?? "";
+			const streamCaller = context.caller(token);
+			return {
+				result,
+				openSink: (sink) => {
+					if (streamCaller !== undefined) streams.add(sink, { role: streamCaller.role, token });
+					return () => streams.remove(sink);
+				},
+			};
 		}
 
-		// The accept-level `error` listener lives in `bindHost`, so a transient
-		// failure cannot take the host down; the review still ends through its own
-		// paths: cancel, abort, drop, or shutdown.
 		const preferred = deps.port ?? ports.get(plan.path) ?? 0;
-		let port: number | undefined;
+		let server: LoopbackServer;
 		try {
-			port = await bindLoopback(server, preferred);
+			server = await serveLoopback({
+				ports: preferred === 0 ? [0] : [preferred, 0],
+				maxBodyBytes: bodyLimit,
+				handler: handleRequest,
+			});
 		} catch {
-			// The remembered port may have been taken between turns; fall back once.
-			if (preferred !== 0) {
-				try {
-					port = await bindLoopback(server, 0);
-				} catch {
-					port = undefined;
-				}
-			}
-		}
-		if (port === undefined) {
-			server.close();
+			// The remembered port may have been taken between turns; the fallback above
+			// covers that, so reaching here means neither port answered.
 			return undefined;
 		}
+		const port = server.port;
 		ports.set(plan.path, port);
 		currentPort = port;
-		const closeServer = createCloser(server);
 
 		const url = `http://127.0.0.1:${port}/?token=${token}`;
 		let closed = false;
@@ -498,7 +444,7 @@ export function createPlanWebReview(store: PlanStore, deps: PlanWebReviewDeps =
 			stopTicker();
 			streams.clear();
 			await shareSession.close();
-			await closeServer();
+			await server.close();
 		};
 
 		const session: PlanReviewSession = { url, port, done, close };

package/extensions/rewind/{commands.ts → commands/commands.ts}

@@ -8,13 +8,13 @@
  */
 
 import type { ExtensionAPI, ExtensionCommandContext } from "@earendil-works/pi-coding-agent";
-import { withRailsSuppressed } from "../../lib/rails.ts";
-import { formatRewindListText, formatRewindRow } from "./format.ts";
+import { withRailsSuppressed } from "../../../lib/rails.ts";
+import { formatRewindListText, formatRewindRow } from "../text/format.ts";
 import { openReview } from "./review.ts";
 import { rewindTo } from "./rewind.ts";
-import type { RewindRuntime } from "./runtime.ts";
-import { RewindListComponent } from "./rewind-tui.ts";
-import { buildRewindPoints, type RewindPoint } from "./timeline.ts";
+import type { RewindRuntime } from "../state/runtime.ts";
+import { RewindListComponent } from "../view/rewind-tui.ts";
+import { buildRewindPoints, type RewindPoint } from "../state/timeline.ts";
 
 /** Pick a point from the timeline, or undefined when the user cancels. */
 async function choosePoint(ctx: ExtensionCommandContext, points: RewindPoint[]): Promise<RewindPoint | undefined> {