@neuralis/brain-core 0.2.0 → 0.3.0

package/app/filesystem/ui/GitControlPanel.tsx

@@ -453,6 +453,7 @@ type ConfirmState = { title: string; message: string; confirmLabel: string; onCo
 type RescueState = { message: string; rescue: GitRescue };
 
 export function GitControlPanel({ agentId }: { agentId: string }) {
+  const client = useFilesystemStore((s) => s.client);
   const sources = useFilesystemStore((s) => s.sources);
   const projectId = useFilesystemStore((s) => s.activeProjectId);
   const activeSource = useFilesystemStore((s) => s.activeSource);
@@ -554,7 +555,7 @@ export function GitControlPanel({ agentId }: { agentId: string }) {
       if (cached && (cached instanceof Promise || !opts?.force)) return cached;
       const task = (async () => {
         try {
-          const res = await getGitRepos({ agentId, ...(projectId ? { projectId } : {}), source: slug });
+          const res = await getGitRepos({ agentId, ...(projectId ? { projectId } : {}), source: slug }, client);
           const repos = Array.isArray(res?.repos) ? res.repos : [];
           repoListsRef.current.set(slug, repos);
           setRepoLists((prev) => new Map(prev).set(slug, repos));
@@ -799,7 +800,7 @@ export function GitControlPanel({ agentId }: { agentId: string }) {
   const handleStage = useCallback(
     (paths: string[]) => {
       if (paths.length === 0) return;
-      void doWrite(() => stagePaths({ agentId, ...p, source: selectedSlug, paths }));
+      void doWrite(() => stagePaths({ agentId, ...p, source: selectedSlug, paths }, client));
     },
     [doWrite, agentId, p, selectedSlug],
   );
@@ -807,7 +808,7 @@ export function GitControlPanel({ agentId }: { agentId: string }) {
   const handleUnstage = useCallback(
     (paths: string[]) => {
       if (paths.length === 0) return;
-      void doWrite(() => unstagePaths({ agentId, ...p, source: selectedSlug, paths }));
+      void doWrite(() => unstagePaths({ agentId, ...p, source: selectedSlug, paths }, client));
     },
     [doWrite, agentId, p, selectedSlug],
   );
@@ -815,7 +816,7 @@ export function GitControlPanel({ agentId }: { agentId: string }) {
   const runDiscard = useCallback(
     (paths: string[]) => {
       void (async () => {
-        const res = await doWrite(() => discardPaths({ agentId, ...p, source: selectedSlug, paths }));
+        const res = await doWrite(() => discardPaths({ agentId, ...p, source: selectedSlug, paths }, client));
         if (res && res.rescue) {
           setRescue({
             message: `Discarded ${paths.length} file${paths.length === 1 ? '' : 's'} — recoverable`,
@@ -875,7 +876,7 @@ export function GitControlPanel({ agentId }: { agentId: string }) {
     const message = commitMessage.trim();
     if (!message) return;
     void (async () => {
-      const res = await doWrite(() => commitGit({ agentId, ...p, source: selectedSlug, message, amend }));
+      const res = await doWrite(() => commitGit({ agentId, ...p, source: selectedSlug, message, amend }, client));
       if (res && res.ok) {
         setCommitMessage('');
         setAmend(false);
@@ -901,7 +902,7 @@ export function GitControlPanel({ agentId }: { agentId: string }) {
     (ref: string) => {
       setBranchPickerOpen(false);
       void (async () => {
-        const res = await doWrite(() => checkoutGitBranch({ agentId, ...p, source: selectedSlug, ref }));
+        const res = await doWrite(() => checkoutGitBranch({ agentId, ...p, source: selectedSlug, ref }, client));
         if (res)
           void loadGitBranches({ agentId, projectId: projectId ?? null, source: selectedSlug, repo: activeRepoRel });
       })();
@@ -920,10 +921,10 @@ export function GitControlPanel({ agentId }: { agentId: string }) {
     void (async () => {
       // Create then switch to it (VS-Code "Create new branch" also checks out).
       const created = await doWrite(() =>
-        createGitBranch({ agentId, ...p, source: selectedSlug, name, ...(from ? { startPoint: from } : {}) }),
+        createGitBranch({ agentId, ...p, source: selectedSlug, name, ...(from ? { startPoint: from } : {}) }, client),
       );
       if (created) {
-        await doWrite(() => checkoutGitBranch({ agentId, ...p, source: selectedSlug, ref: name }));
+        await doWrite(() => checkoutGitBranch({ agentId, ...p, source: selectedSlug, ref: name }, client));
         void loadGitBranches({ agentId, projectId: projectId ?? null, source: selectedSlug, repo: activeRepoRel });
       }
     })();
@@ -932,7 +933,7 @@ export function GitControlPanel({ agentId }: { agentId: string }) {
   const runDeleteBranch = useCallback(
     (name: string) => {
       void (async () => {
-        const res = await doWrite(() => deleteGitBranch({ agentId, ...p, source: selectedSlug, name }));
+        const res = await doWrite(() => deleteGitBranch({ agentId, ...p, source: selectedSlug, name }, client));
         if (res && res.rescue) {
           setRescue({ message: `Deleted branch "${name}" — recoverable`, rescue: res.rescue });
         }
@@ -966,7 +967,7 @@ export function GitControlPanel({ agentId }: { agentId: string }) {
     if (!rescue) return;
     const carrier = rescue.rescue;
     setRescue(null);
-    void doWrite(() => restoreGit({ agentId, ...p, source: selectedSlug, rescue: carrier }));
+    void doWrite(() => restoreGit({ agentId, ...p, source: selectedSlug, rescue: carrier }, client));
   }, [rescue, doWrite, agentId, p, selectedSlug]);
 
   // --- Remote operations (G4 keyring-kestrel Slice 2) ------------------------
@@ -976,17 +977,17 @@ export function GitControlPanel({ agentId }: { agentId: string }) {
 
   const handleFetch = useCallback(() => {
     setRemotePickerOpen(false);
-    void doWrite(() => fetchGit({ agentId, ...p, source: selectedSlug }));
+    void doWrite(() => fetchGit({ agentId, ...p, source: selectedSlug }, client));
   }, [doWrite, agentId, p, selectedSlug]);
 
   const handlePull = useCallback(() => {
     setRemotePickerOpen(false);
-    void doWrite(() => pullGit({ agentId, ...p, source: selectedSlug }));
+    void doWrite(() => pullGit({ agentId, ...p, source: selectedSlug }, client));
   }, [doWrite, agentId, p, selectedSlug]);
 
   const handlePush = useCallback(() => {
     setRemotePickerOpen(false);
-    void doWrite(() => pushGit({ agentId, ...p, source: selectedSlug }));
+    void doWrite(() => pushGit({ agentId, ...p, source: selectedSlug }, client));
   }, [doWrite, agentId, p, selectedSlug]);
 
   const unstagedChanges = gitStatus?.unstaged ?? [];
@@ -1201,7 +1202,6 @@ export function GitControlPanel({ agentId }: { agentId: string }) {
             size="sm"
             skill="git"
             packageId="@neuralis/brain-core"
-            scripts={["scripts/git.sh"]}
             label="Status, diff, commit, branch, fetch or push with the agent"
             icon="GitBranch"
           />

package/app/filesystem/ui/GitDiffView.tsx

@@ -26,15 +26,21 @@ export function GitDiffView({
   agentId: string | null;
   projectId: string | null;
 }): React.ReactElement {
-  const [canWrite, setCanWrite] = useState(false);
+  const client = useFilesystemStore((s) => s.client);
   const revision = useFilesystemStore(state => state.sourceChangeRevision[target.source] ?? 0);
+  const context = `${agentId ?? ''}\u0000${projectId ?? ''}\u0000${target.source}\u0000${target.repo ?? ''}`;
+  const [permission, setPermission] = useState<{ client: typeof client; context: string; revision: number; allowed: boolean; pending: boolean } | null>(null);
+  const current = permission?.client === client && permission.context === context;
+  const canWrite = current && !permission.pending && permission.revision === revision && permission.allowed;
+  const stageRows = current && permission.allowed;
   useEffect(() => {
-    let alive = true; setCanWrite(false);
-    if (agentId) void getGitRepos({ agentId, ...(projectId ? { projectId } : {}), source: target.source }).then(result => {
-      if (alive) setCanWrite(result.repos.find(repo => repo.rel === (target.repo ?? ''))?.canWrite === true);
-    }).catch(() => { if (alive) setCanWrite(false); });
+    let alive = true;
+    setPermission(previous => ({ client, context, revision, pending: true, allowed: previous?.client === client && previous.context === context && previous.allowed }));
+    if (agentId) void getGitRepos({ agentId, ...(projectId ? { projectId } : {}), source: target.source }, client).then(result => {
+      if (alive) setPermission({ client, context, revision, pending: false, allowed: result.repos.find(repo => repo.rel === (target.repo ?? ''))?.canWrite === true });
+    }).catch(() => { if (alive) setPermission({ client, context, revision, pending: false, allowed: false }); });
     return () => { alive = false; };
-  }, [agentId, projectId, target.source, target.repo, revision]);
+  }, [client, context, agentId, projectId, target.source, target.repo, revision]);
   const mode = useMemo(() => gitDiffModeFromTarget(target), [target]);
   return (
     <GitFileDiff
@@ -48,6 +54,8 @@ export function GitDiffView({
       projectId={projectId}
       variant="tab"
       canWrite={canWrite}
+      stageRows={stageRows}
+      permissionPending={!current || permission.pending || permission.revision !== revision}
       revision={revision}
     />
   );

package/app/filesystem/ui/GitFileDiff.tsx

@@ -36,7 +36,7 @@ import {
 import { computeGitDiffTokens, renderShikiToken } from './gitDiffShikiTokenizer';
 import { resolveShikiLang, isShikiReady, ensureLanguage, getHighlighter } from './codeEditor/shikiHighlighter';
 import { detectCodeLanguage } from '../lib/detectLanguage';
-import { useContainerWidth } from '../hooks/useContainerWidth';
+import { useContainerWidth } from '@neuralis/package-system/client';
 import type { VisibleDiffQueue } from '../hooks/useVisibleDiffCards';
 import { DiffModeToggle } from './DiffModeToggle';
 
@@ -130,6 +130,8 @@ export function GitFileDiff({
   variant = 'tab',
   revision = 0,
   canWrite = false,
+  stageRows = canWrite,
+  permissionPending = false,
   runContent,
   peekContent,
 }: {
@@ -151,11 +153,14 @@ export function GitFileDiff({
   variant?: 'tab' | 'card';
   revision?: number;
   canWrite?: boolean;
+  stageRows?: boolean;
+  permissionPending?: boolean;
   /** A virtualized list's content lane; `cache` lets a re-mounted card reuse its answer. */
   runContent?: VisibleDiffQueue['run'];
   /** The lane's synchronous cache read: a re-mounted card paints its last answer on its first frame. */
   peekContent?: VisibleDiffQueue['peek'];
 }): React.ReactElement {
+  const client = useFilesystemStore((s) => s.client);
   const [initial] = useState(() => peekContent?.<DiffAnswer>(`${diffFamily(source, repo, path, mode)}\u0000${revision}`, diffFamily(source, repo, path, mode)));
   const [raw, setRaw] = useState<string | null>(() => initial === undefined ? null : initial && initial.ok !== false ? initial.diff : '');
   const [loading, setLoading] = useState(false);
@@ -229,7 +234,7 @@ export function GitFileDiff({
   }, [language]);
 
   useEffect(() => {
-    sourceCacheRef.current.clear();
+    sourceCacheRef.current.clear(); setHunkBusy(null); setHunkError(null);
     // New target/revision (or post-stage refetch): drop cached source and expansion state —
     // the ranges are relative to the OLD raw's original hunks — AND the
     // server-flag states: `serverTruncated`/`tooLarge` belong to the PREVIOUS
@@ -262,7 +267,7 @@ export function GitFileDiff({
           path,
           // ONE mode per request — the server 400s any combination.
           ...diffRequestParams(normalizedMode),
-        });
+        }, client);
         // Keyed on everything the answer depends on; after a hunk apply the refetch
         // replaces the cached answer instead of reading it.
         const family = diffFamily(source, repo, path, normalizedMode);
@@ -292,7 +297,7 @@ export function GitFileDiff({
       }
     })();
     return () => { seqRef.current++; };
-  }, [agentId, projectId, source, repo, path, normalizedMode, reloadNonce, revision, runContent]);
+  }, [client, agentId, projectId, source, repo, path, normalizedMode, reloadNonce, revision, runContent]);
 
   // The ONE parse of the raw diff — the ORIGINAL (staging) model.
   const { files, truncated, hunkPatches } = useMemo(
@@ -316,7 +321,7 @@ export function GitFileDiff({
   // parsed count, or the index→patch mapping is unsafe.
   const singleFile: FileData | null = files.length === 1 ? files[0] : null;
   const canStageHunks =
-    canWrite && kind === 'working' &&
+    stageRows && kind === 'working' &&
     !!agentId &&
     !!singleFile &&
     singleFile.type === 'modify' &&
@@ -364,7 +369,7 @@ export function GitFileDiff({
           ...(repo ? { repo } : {}),
           path,
           rev: expanderSrc.rev,
-        });
+        }, client);
         const res = runContent ? await runContent(fetchSource, () => mySeq === seqRef.current) : await fetchSource();
         if (!res || mySeq !== seqRef.current) return null;
         return settle(res.ok ? { ok: true, content: res.content } : { ok: false });
@@ -376,7 +381,7 @@ export function GitFileDiff({
         agentId,
         ...(projectId ? { projectId } : {}),
         files: [`${source}://${repo ? `${repo}/` : ''}${path}`],
-      });
+      }, client);
       const res = runContent ? await runContent(fetchSource, () => mySeq === seqRef.current) : await fetchSource();
       if (!res || mySeq !== seqRef.current) return null;
       const file = extractReadFilesPayload(res)[0];
@@ -385,7 +390,7 @@ export function GitFileDiff({
     } catch {
       return settle({ ok: false });
     }
-  }, [agentId, projectId, source, repo, path, expanderSrc, runContent]);
+  }, [client, agentId, projectId, source, repo, path, expanderSrc, runContent]);
 
   // The synthetic OLD-side lines (`expandFromRawCode` slices by old-line
   // numbers) + the RENDER-ONLY expanded hunk list. `oldTotal` also sizes the
@@ -457,20 +462,22 @@ export function GitFileDiff({
   const applyHunk = useCallback(
     async (hunkIndex: number) => {
       // A raw shown while its fresh answer loads may be an older revision's — never stage from it.
-      if (loading || !canStageHunks || !hunkPatches || !agentId) return;
+      if (loading || permissionPending || !canWrite || !canStageHunks || !hunkPatches || !agentId) return;
       const patch = assembleHunkPatch(hunkPatches.header, hunkPatches.hunks[hunkIndex]);
       if (!patch) {
         setHunkError('Could not build a hunk patch for this change.');
         return;
       }
+      const mySeq = seqRef.current;
       setHunkBusy(hunkIndex);
       setHunkError(null);
       try {
         if (staged) {
-          await unstageHunk({ agentId, ...(projectId ? { projectId } : {}), source, ...(repo ? { repo } : {}), hunk: patch });
+          await unstageHunk({ agentId, ...(projectId ? { projectId } : {}), source, ...(repo ? { repo } : {}), hunk: patch }, client);
         } else {
-          await stageHunk({ agentId, ...(projectId ? { projectId } : {}), source, ...(repo ? { repo } : {}), hunk: patch });
+          await stageHunk({ agentId, ...(projectId ? { projectId } : {}), source, ...(repo ? { repo } : {}), hunk: patch }, client);
         }
+        if (mySeq !== seqRef.current) return;
         // The index changed → the cached `rev=index` source is stale (the WT
         // entry would survive, but a whole-map clear is cheap and race-free).
         sourceCacheRef.current.clear();
@@ -486,12 +493,12 @@ export function GitFileDiff({
         void loadGitStatus({ agentId, projectId });
         setReloadNonce((n) => n + 1);
       } catch (e) {
-        setHunkError(e instanceof Error ? e.message : 'Hunk apply failed');
+        if (mySeq === seqRef.current) setHunkError(e instanceof Error ? e.message : 'Hunk apply failed');
       } finally {
-        setHunkBusy(null);
+        if (mySeq === seqRef.current) setHunkBusy(null);
       }
     },
-    [loading, canStageHunks, hunkPatches, agentId, projectId, source, repo, staged, loadGitStatus],
+    [client, loading, permissionPending, canWrite, canStageHunks, hunkPatches, agentId, projectId, source, repo, staged, loadGitStatus],
   );
 
   /** One collapsed-gap row: clickable expander, or static text once refused. */
@@ -541,7 +548,7 @@ export function GitFileDiff({
               key={idx}
               type="button"
               onClick={() => void applyHunk(idx)}
-              disabled={hunkBusy !== null || loading}
+              disabled={hunkBusy !== null || loading || permissionPending || !canWrite}
               className={cn(
                 'inline-flex items-center gap-1 rounded-md border px-2 py-0.5 text-[10px] transition-colors disabled:opacity-40',
                 staged

package/app/filesystem/ui/PendingChangesPanel.tsx

@@ -23,7 +23,7 @@ import {
   ChevronLeft, CheckCheck, X, XCircle, Wrench, Unlink, ShieldAlert,
 } from 'lucide-react';
 import { SkillLauncher } from '@neuralis/package-system/client';
-import { useFilesystemStore } from '../store/filesystemStore';
+import { useFilesystemStore, useFilesystemStoreApi } from '../store/filesystemStore';
 import {
   listPendingChanges, previewPendingChange, discardPendingChange, discardOrphanedPending,
   type PendingChangeRecord, type PendingPreview,
@@ -115,6 +115,7 @@ export const PendingDiffCard = memo(function PendingDiffCard({
   /** The dialog's post-409 refetch: `'wait'` while in flight, then its answer ONCE for the key it was taken for. */
   takeRefetch: (id: string, key: string) => PendingPreview | 'wait' | undefined; extra?: React.ReactNode;
 }) {
+  const client = useFilesystemStore((s) => s.client);
   // Cards open inline by default — the diff is the review unit.
   const [expanded, setExpanded] = useState(true);
   // The last answer this record had (a remount or a new source revision) stays on screen
@@ -140,7 +141,7 @@ export const PendingDiffCard = memo(function PendingDiffCard({
     if (adopted === 'wait') { setLoading(true); return; }
     if (adopted) { setPreview(adopted); setLoadError(null); setAnswerKey(cacheKey); loadedKey.current = cacheKey; setLoading(false); return; }
     setLoading(true);
-    void queue.run(() => previewPendingChange({ agentId, ...(projectId ? { projectId } : {}), id: rec.id }),
+    void queue.run(() => previewPendingChange({ agentId, ...(projectId ? { projectId } : {}), id: rec.id }, client),
       () => generation === seq.current && active.current, { key: cacheKey, bytes: previewBytes }).then(next => {
       if (!next || generation !== seq.current || !active.current) return;
       onPreview(next);
@@ -152,7 +153,7 @@ export const PendingDiffCard = memo(function PendingDiffCard({
       setLoadError(error instanceof Error ? error.message : 'Failed to load review'); setLoading(false);
     });
     return () => { seq.current++; };
-  }, [agentId, projectId, rec.id, cacheKey, expanded, shown, queue.run]);
+  }, [client, agentId, projectId, rec.id, cacheKey, expanded, shown, queue.run]);
 
   const hunks = useMemo(() => preview ? hunksOf(preview) : null, [preview]);
   const computed = useMemo(() => hunks ? countHunks(hunks) : null, [hunks]);
@@ -183,6 +184,7 @@ export const PendingDiffCard = memo(function PendingDiffCard({
         {indexState && indexState !== 'stored' ? <span className="text-[10px] text-amber-200/80 shrink-0">
           {indexState === 'missing' ? 'Index missing' : indexState === 'stale' ? 'Index stale' : 'Recovery only'}
         </span> : null}
+        {rec.conflict === 'PENDING_GENERATION_CHANGED' ? <span className="text-[10px] text-amber-200/80 shrink-0" title="Pending generation changed; this record cannot be repaired automatically.">Pending generation changed</span> : null}
         {orphaned ? ORPHAN_BADGE : rec.status === 'approved' || rec.status === 'reverted' ? (
           <span className={`w-1.5 h-1.5 rounded-full shrink-0 ${statusTone(rec.status)}`} title={rec.status} />
         ) : null}
@@ -212,8 +214,10 @@ const NO_FILTERS: ChangeFilters = { kind: 'all', source: '', repo: '', branch: '
 /** One bulk pass (the sweep and the grouped dialog) covers at most this many records. */ const REVIEW_BATCH = 100;
 
 export function PendingChangesPanel({ agentId, projectId }: Props) {
+  const client = useFilesystemStore((s) => s.client);
   const host = useFilesystemHost();
   const canWrite = hasFeature({ grantedFeatures: [...(host.grantedFeatures ?? [])] }, 'drive.write');
+  const storeApi = useFilesystemStoreApi();
   const sources = useFilesystemStore(s => s.sources);
   const liveRevisions = useFilesystemStore(s => s.sourceChangeRevision);
   // A review batch (the sweep, a dialog group) HOLDS the revisions its own writes bump: one re-list
@@ -258,17 +262,20 @@ export function PendingChangesPanel({ agentId, projectId }: Props) {
   const [nonces, setNonces] = useState<Readonly<Record<string, number>>>({});
   const latest = useRef({ nonces, revisions }); latest.current = { nonces, revisions };
   const refetch = useCallback(async (rec: PendingChangeRecord): Promise<PendingPreview> => {
+    const epoch = contextEpoch.current;
     refetches.current.set(rec.id, null);
     try {
       const listed = (await relisted.current.promise)?.find(r => r.id === rec.id) ?? rec;
-      const fresh = await previewPendingChange({ agentId, ...(projectId ? { projectId } : {}), id: rec.id });
+      if (epoch !== contextEpoch.current) throw new Error('Review context changed');
+      const fresh = await previewPendingChange({ agentId, ...(projectId ? { projectId } : {}), id: rec.id }, client);
+      if (epoch !== contextEpoch.current) throw new Error('Review context changed');
       const revision = (latest.current.nonces[rec.id] ?? 0) + 1 + (latest.current.revisions[listed.sourceSlug] ?? 0);
       refetches.current.set(rec.id, { key: previewKey(listed, revision), preview: fresh });
       previews.current.set(rec.id, fresh);
       return fresh;
-    } catch (failure) { refetches.current.delete(rec.id); throw failure; }
-    finally { setNonces(prev => ({ ...prev, [rec.id]: (prev[rec.id] ?? 0) + 1 })); }
-  }, [agentId, projectId]);
+    } catch (failure) { if (epoch === contextEpoch.current) refetches.current.delete(rec.id); throw failure; }
+    finally { if (epoch === contextEpoch.current) setNonces(prev => ({ ...prev, [rec.id]: (prev[rec.id] ?? 0) + 1 })); }
+  }, [client, agentId, projectId]);
   const [focusIndex, setFocusIndex] = useState(0);
   const [review, setReview] = useState<ReviewRequest | null>(null);
   const [results, setResults] = useState<ReviewResult[]>([]);
@@ -279,27 +286,50 @@ export function PendingChangesPanel({ agentId, projectId }: Props) {
   const [collapsedGit, setCollapsedGit] = useState<ReadonlySet<string>>(new Set());
   const repairTimer = useRef<ReturnType<typeof setTimeout> | null>(null);
   const listSeq = useRef(0);
+  const orphanSeq = useRef(0);
+  const contextEpoch = useRef(0);
+  const changesRef = useRef(changes); changesRef.current = changes;
+  const classified = useRef(new Map<string, string>());
+  const [nextCursor, setNextCursor] = useState<string | undefined>();
+  const [partial, setPartial] = useState(false);
+  const [repairProgress, setRepairProgress] = useState('');
+  const repairStop = useRef(false);
+  const repairCursor = useRef<string | undefined>(undefined);
+  const [repairPaused, setRepairPaused] = useState(false);
+  const generation = (rec: PendingChangeRecord): string => JSON.stringify([rec.id, rec.updatedAt, rec.snapshotHash, rec.status]);
 
   const inventory = useGitChangesInventory({ agentId, projectId, sources, revisions, resetKey: `${agentId}\u0000${projectId}\u0000${convFilter}` });
 
   /** The pending list. The orphan probe (one connector stat per record) runs only on mount, Refresh and Repair. */
-  const fetchPending = useCallback(async (withOrphans: boolean): Promise<PendingChangeRecord[] | undefined> => {
+  const fetchPending = useCallback(async (withOrphans: boolean, append = false): Promise<PendingChangeRecord[] | undefined> => {
     if (!agentId) return undefined;
     const mine = ++listSeq.current;
+    const scan = withOrphans ? ++orphanSeq.current : orphanSeq.current;
+    const epoch = contextEpoch.current;
     setLoading(true); setError(null);
     try {
       const list = await listPendingChanges({ agentId, ...(projectId ? { projectId } : {}),
-        ...(convFilter ? { conversationId: convFilter } : {}), ...(withOrphans ? { include_orphans: true } : {}) });
+        ...(convFilter ? { conversationId: convFilter } : {}), ...(withOrphans ? { include_orphans: true } : {}),
+        ...(append && nextCursor ? { cursor: nextCursor } : {}) }, client);
+      if (epoch !== contextEpoch.current) return undefined;
+      if (withOrphans && scan === orphanSeq.current) {
+        for (const rec of list.changes) classified.current.set(rec.id, `${generation(rec)}:${list.orphanIds?.includes(rec.id) === true}`);
+        setOrphanIds(new Set(changesRef.current.filter(rec => classified.current.get(rec.id) === `${generation(rec)}:true`).map(rec => rec.id)));
+      }
       if (mine !== listSeq.current) return undefined;
-      const ids = new Set(list.changes.map(rec => rec.id));
-      setChanges(list.changes);
-      setOrphanIds(previous => withOrphans ? new Set(list.orphanIds) : new Set([...previous].filter(id => ids.has(id))));
-      return list.changes;
+      if (list.restartRequired) { setNextCursor(undefined); setError('Changes moved. Refresh to restart the list.'); return undefined; }
+      const prior = new Map(changesRef.current.map(rec => [rec.id, rec]));
+      const fresh = new Map(list.changes.map(rec => [rec.id, rec]));
+      const merged = append ? [...changesRef.current.map(rec => fresh.get(rec.id) ?? rec), ...list.changes.filter(rec => !prior.has(rec.id))] : list.changes;
+      changesRef.current = merged; setChanges(merged);
+      setOrphanIds(new Set(merged.filter(rec => classified.current.get(rec.id) === `${generation(rec)}:true`).map(rec => rec.id)));
+      setNextCursor(list.nextCursor); setPartial(list.partial);
+      return merged;
     } catch (failure) {
-      if (mine === listSeq.current) setError(failure instanceof Error ? failure.message : 'Failed to load changes');
+      if (epoch === contextEpoch.current && mine === listSeq.current) setError(failure instanceof Error ? failure.message : 'Failed to load changes');
       return undefined;
-    } finally { if (mine === listSeq.current) setLoading(false); }
-  }, [agentId, projectId, convFilter]);
+    } finally { if (epoch === contextEpoch.current && mine === listSeq.current) setLoading(false); }
+  }, [client, agentId, projectId, convFilter, nextCursor]);
 
   const refreshAll = useCallback(async () => {
     await Promise.all([fetchPending(true), inventory.refresh(true)]);
@@ -307,10 +337,14 @@ export function PendingChangesPanel({ agentId, projectId }: Props) {
   }, [fetchPending, inventory.refresh, refreshPendingCount, agentId, projectId]);
 
   useEffect(() => {
-    previews.current.clear(); setReview(null); setChanges([]); setOrphanIds(new Set()); setResults([]);
+    contextEpoch.current++; repairStop.current = true; repairCursor.current = undefined; setRepairPaused(false);
+    relisted.current.resolve(undefined); relisted.current = Promise.withResolvers(); refetches.current.clear();
+    setRepairing(false); setBusyId(null); setApprovingAll(false); setConfirmAll(false); setConfirmRepair(false);
+    classified.current.clear(); previews.current.clear(); setReview(null); changesRef.current = [];
+    setChanges([]); setOrphanIds(new Set()); setResults([]); setNextCursor(undefined); setPartial(false); setHeld(null);
     void fetchPending(true);
-    return () => { listSeq.current++; previews.current.clear(); };
-  }, [fetchPending]);
+    return () => { contextEpoch.current++; listSeq.current++; orphanSeq.current++; repairStop.current = true; previews.current.clear(); };
+  }, [client, agentId, projectId, convFilter]);
   // A source revision re-reads the plain list, never the orphan probe; a context change is the effect above's.
   const fetchPendingRef = useRef(fetchPending); fetchPendingRef.current = fetchPending;
   const firstRevision = useRef(true);
@@ -372,11 +406,12 @@ export function PendingChangesPanel({ agentId, projectId }: Props) {
    */
   const dropResolvedDeleteRow = useCallback((rec: PendingChangeRecord) => {
     if (rec.op !== 'delete' || !rec.uri) return;
-    const node = useFilesystemStore.getState().files[rec.uri];
+    const node = storeApi.getState().files[rec.uri];
     if (!node || node.status === 'deleted') removeFilePath(rec.uri);
-  }, [removeFilePath]);
+  }, [removeFilePath, storeApi]);
 
   const afterMutation = useCallback(async (done: ReviewResult[]) => {
+    const epoch = contextEpoch.current;
     for (const result of done) {
       const rec = changes.find(c => c.id === result.id);
       if (rec && result.outcome === 'ok' && result.action !== 'revert') dropResolvedDeleteRow(rec);
@@ -387,48 +422,66 @@ export function PendingChangesPanel({ agentId, projectId }: Props) {
     if (refused.length) setNonces(prev => { const next = { ...prev }; for (const r of refused) next[r.id] = (next[r.id] ?? 0) + 1; return next; });
     setResults(done);
     const after = await fetchPending(false);
+    if (epoch !== contextEpoch.current) return;
     // The STORE's value, not the last render's: the batch's own bumps may not have rendered yet.
-    listedRevisions.current = useFilesystemStore.getState().sourceChangeRevision; setHeld(null);
+    listedRevisions.current = storeApi.getState().sourceChangeRevision; setHeld(null);
     relisted.current.resolve(after); relisted.current = Promise.withResolvers();
     void refreshPendingCount({ agentId, projectId });
-  }, [changes, dropResolvedDeleteRow, fetchPending, refreshPendingCount, agentId, projectId]);
+  }, [changes, dropResolvedDeleteRow, fetchPending, refreshPendingCount, agentId, projectId, storeApi]);
 
   const resolveReview = useCallback(async (rec: PendingChangeRecord, action: ReviewAction) => {
     if (!canWrite) return;
     const preview = previews.current.get(rec.id);
     if (!preview || preview.requiresAcknowledgement.length) { setReview({ kind: 'single', rec, action, ...(preview ? { preview } : {}) }); return; }
+    const epoch = contextEpoch.current;
     setBusyId(rec.id);
-    try { await afterMutation([await applyReview({ agentId, projectId }, rec, preview, action, false)]); }
-    finally { setBusyId(null); }
-  }, [canWrite, agentId, projectId, afterMutation]);
+    try { const result = await applyReview({ agentId, projectId, client }, rec, preview, action, false); if (epoch === contextEpoch.current) await afterMutation([result]); }
+    finally { if (epoch === contextEpoch.current) setBusyId(null); }
+  }, [client, canWrite, agentId, projectId, afterMutation]);
 
   // Discard a single ORPHANED row — removes the review record + baseline blob + vector point.
   const discard = useCallback(async (rec: PendingChangeRecord) => {
+    const epoch = contextEpoch.current;
     setBusyId(rec.id);
     try {
-      const res = await discardPendingChange({ agentId, ...(projectId ? { projectId } : {}), id: rec.id });
+      const res = await discardPendingChange({ agentId, ...(projectId ? { projectId } : {}), id: rec.id }, client);
+      if (epoch !== contextEpoch.current) return;
       if (!res.ok) setError(res.error || 'Discard failed'); else dropResolvedDeleteRow(rec);
       await fetchPending(false);
       void refreshPendingCount({ agentId, projectId });
-    } catch (e) { setError(e instanceof Error ? e.message : 'Discard failed'); } finally { setBusyId(null); }
-  }, [agentId, projectId, fetchPending, dropResolvedDeleteRow, refreshPendingCount]);
+    } catch (e) { if (epoch === contextEpoch.current) setError(e instanceof Error ? e.message : 'Discard failed'); } finally { if (epoch === contextEpoch.current) setBusyId(null); }
+  }, [client, agentId, projectId, fetchPending, dropResolvedDeleteRow, refreshPendingCount]);
 
   // Repair: bulk-discard every orphaned change the caller can write. Which records
   // went is read from the refetch — the route re-authorizes each one.
   const repair = useCallback(async () => {
     if (repairTimer.current) { clearTimeout(repairTimer.current); repairTimer.current = null; }
-    setRepairing(true); setConfirmRepair(false); setError(null);
+    const epoch = contextEpoch.current;
+    repairStop.current = false; holdRevisions(); setRepairing(true); setConfirmRepair(false); setError(null);
+    let cursor = repairCursor.current; setRepairPaused(false);
+    let scanned = 0; let discarded = 0; let refused = 0; let failed = 0;
     try {
-      await discardOrphanedPending({ agentId, ...(projectId ? { projectId } : {}), ...(convFilter ? { conversationId: convFilter } : {}) });
-      const candidates = changes.filter((rec) => orphanIds.has(rec.id));
-      const after = await fetchPending(true);
-      if (after) {
-        const survivors = new Set(after.map((rec) => rec.id));
-        for (const rec of candidates) if (!survivors.has(rec.id)) dropResolvedDeleteRow(rec);
-      }
+      do {
+        const page = await discardOrphanedPending({ agentId, ...(projectId ? { projectId } : {}),
+          ...(convFilter ? { conversationId: convFilter } : {}), ...(cursor ? { cursor } : {}) }, client);
+        if (epoch !== contextEpoch.current) return;
+        scanned += page.scannedVisible; discarded += page.discarded; refused += page.refused; failed += page.failed;
+        setRepairProgress(`${scanned} scanned · ${discarded} discarded · ${refused} refused · ${failed} failed`);
+        cursor = page.nextCursor; repairCursor.current = cursor;
+        if (page.restartRequired) { repairCursor.current = undefined; setRepairPaused(true); setError('Changes moved. Refresh before continuing repair.'); break; }
+        if (page.failed > 0) { setRepairPaused(true); setError('Repair paused after a failed change. Refresh before continuing.'); break; }
+        if (page.partial) { setRepairPaused(true); setError('Repair paused; part of the inventory or orphan checks are unavailable.'); break; }
+      } while (cursor && !repairStop.current);
+      if (cursor) setRepairPaused(true);
+      if (epoch !== contextEpoch.current) return;
+      await fetchPending(true);
+      if (epoch !== contextEpoch.current) return;
+      listedRevisions.current = storeApi.getState().sourceChangeRevision; setHeld(null);
       void refreshPendingCount({ agentId, projectId });
-    } catch (e) { setError(e instanceof Error ? e.message : 'Repair failed'); } finally { setRepairing(false); }
-  }, [agentId, projectId, convFilter, fetchPending, changes, orphanIds, dropResolvedDeleteRow, refreshPendingCount]);
+    } catch (e) { if (epoch === contextEpoch.current) { setRepairPaused(true); setError(e instanceof Error ? e.message : 'Repair failed'); } }
+    finally { if (epoch === contextEpoch.current) { setRepairing(false); setHeld(null); } }
+  }, [client, agentId, projectId, convFilter, fetchPending, refreshPendingCount, holdRevisions, storeApi]);
+
   const onRepairClick = useCallback(() => {
     if (confirmRepair) { void repair(); return; }
     setConfirmRepair(true);
@@ -440,27 +493,32 @@ export function PendingChangesPanel({ agentId, projectId }: Props) {
   // confirm). A record whose fresh preview turns out to need one is reported AND handed
   // to the grouped review dialog, where it is approved or dismissed with its acknowledgement.
   const approveAll = useCallback(async () => {
+    const epoch = contextEpoch.current;
     setApprovingAll(true); setConfirmAll(false); setError(null); holdRevisions();
     const done: ReviewResult[] = [];
     try {
       for (const rec of approvable) {
+        if (epoch !== contextEpoch.current) break;
         let preview = previews.current.get(rec.id);
         if (!preview) {
-          try { preview = await previewPendingChange({ agentId, ...(projectId ? { projectId } : {}), id: rec.id }); }
+          try { preview = await previewPendingChange({ agentId, ...(projectId ? { projectId } : {}), id: rec.id }, client); }
           catch (e) { done.push({ id: rec.id, uri: rec.uri, action: 'approve', outcome: 'error', detail: e instanceof Error ? e.message : 'Preview failed' }); continue; }
+          if (epoch !== contextEpoch.current) break;
           previews.current.set(rec.id, preview);
         }
         if (preview.requiresAcknowledgement.length) { done.push({ id: rec.id, uri: rec.uri, action: 'approve', outcome: 'needs-ack' }); continue; }
-        done.push(await applyReview({ agentId, projectId }, rec, preview, 'approve', false));
+        done.push(await applyReview({ agentId, projectId, client }, rec, preview, 'approve', false));
       }
     } finally {
+      if (epoch !== contextEpoch.current) return;
       setApprovingAll(false);
       const handed = approvable.filter(rec => done.some(r => r.id === rec.id && r.outcome === 'needs-ack'));
       if (handed.length) setAckPreviews(n => n + 1);
       await afterMutation(done);
+      if (epoch !== contextEpoch.current) return;
       if (handed.length && canWrite) { reviewed.current.clear(); setReview({ kind: 'group', records: handed.slice(0, REVIEW_BATCH), total: handed.length }); }
     }
-  }, [approvable, agentId, projectId, afterMutation, canWrite]);
+  }, [approvable, agentId, projectId, client, afterMutation, canWrite]);
 
   const move = useCallback((delta: number) => setFocusIndex((i) => (visible.length === 0 ? 0
     : Math.max(0, Math.min(visible.length - 1, i + delta)))), [visible.length]);
@@ -511,6 +569,7 @@ export function PendingChangesPanel({ agentId, projectId }: Props) {
     </div>;
   };
 
+  const renderedEpoch = contextEpoch.current;
   const failed = results.filter(r => r.outcome !== 'ok');
   const busy = loading || inventory.loading;
   return (
@@ -519,7 +578,7 @@ export function PendingChangesPanel({ agentId, projectId }: Props) {
         key={review.kind === 'group' ? `group\u0000${review.records[0]?.id ?? ''}` : `single\u0000${review.rec.id}`}
         onClose={() => setReview(null)} next={review.kind === 'group' ? unreviewed.filter(rec => !review.records.some(r => r.id === rec.id)).length : 0}
         onNext={openReviewBatch} refetch={refetch} onBatchStart={holdRevisions}
-        onDone={done => { for (const result of done) reviewed.current.add(result.id); void afterMutation(done); }} /> : null}
+        onDone={done => { if (renderedEpoch !== contextEpoch.current) return; for (const result of done) reviewed.current.add(result.id); void afterMutation(done); }} /> : null}
       {/* Header: title + nav cursor + approve-all + view toggle + refresh */}
       <div className="flex flex-wrap items-center gap-1.5 px-3 py-2 border-b border-white/5 shrink-0">
         <span className="text-xs font-semibold text-white/80">Changes</span>
@@ -570,10 +629,15 @@ export function PendingChangesPanel({ agentId, projectId }: Props) {
           </button>
           {/* Additive — the per-row buttons stay the primary path. */}
           <SkillLauncher variant="icon" size="sm" skill="manage-files" packageId="@neuralis/brain-core"
-            scripts={["scripts/pending.sh", "scripts/approve.sh"]} label="Review or approve pending changes with the agent" icon="FileText" />
+            label="Review or approve pending changes with the agent" icon="FileText" />
         </div>
       </div>
 
+      {repairing ? <button type="button" onClick={() => { repairStop.current = true; }} className="px-3 py-1 text-xs text-amber-200">Stop after this batch</button> : null}
+      {repairProgress ? <div role="status" className="px-3 py-1 text-xs text-white/60">{repairProgress}</div> : null}
+      {canWrite && repairPaused && !repairing ? <button type="button" onClick={() => void repair()} className="px-3 py-1 text-xs text-amber-200">{repairCursor.current ? 'Continue available repair' : 'Retry repair'}</button> : null}
+      {partial ? <div role="status" className="px-3 py-1 text-xs text-amber-200">Showing available changes; some inventory or orphan checks are unavailable.</div> : null}
+      {nextCursor ? <button type="button" disabled={loading || repairing} onClick={() => void fetchPending(true, true)} className="px-3 py-1 text-xs text-violet-200 disabled:opacity-40">Load more</button> : null}
       {/* Filter bar */}
       <div className="flex flex-wrap items-center gap-2 px-3 py-1.5 border-b border-white/5 shrink-0 text-[11px]">
         {convFilter ? <span className="inline-flex items-center gap-1 px-1.5 py-0.5 rounded bg-violet-500/15 text-violet-200/90" title={convFilter}>