@norman-else/dsh-claude 0.1.29 → 0.1.33

package/lib/index.mjs

@@ -1,6 +1,6 @@
-import { A as TASK_TOOL_NAMES, C as CLAUDE_REPOSITORY_SETUP_PATH, D as CLAUDE_UPDATE_PATH, E as CLAUDE_UPDATE_CHECK_PATH, O as CLAUDE_USAGE_PATH, S as CLAUDE_REPOSITORY_FILE_PATH, T as CLAUDE_REVIEW_COMMENT_PATH, _ as CLAUDE_GLOBAL_SETTINGS_PATH, a as latestClaudeTasks, b as CLAUDE_REPOSITORY_ACTION_PATH, c as normalizeTasksEvent, d as CLAUDE_ACTIVITY_EVENT, f as CLAUDE_ASK_PATH, g as CLAUDE_DOCTOR_PATH, h as CLAUDE_CODE_PROVIDER_IDS, i as latestClaudeSessionBinding, l as redactText, m as CLAUDE_CODE_PROVIDER, n as currentClaudeActivityCursor, o as normalizeActivity, p as CLAUDE_CODE_PRESET_ID, r as latestClaudeContextUsage, s as normalizeContextUsage, t as boundText, u as safeDetail, v as CLAUDE_JIRA_PATH, w as CLAUDE_REPOSITORY_STATUS_PATH, x as CLAUDE_REPOSITORY_FEEDBACK_PATH, y as CLAUDE_PROJECTION_PATH } from "./events-lDt9nTUw.mjs";
-import { n as projectClaudeCommands, t as CLAUDE_COMMANDS_SERVICE } from "./command-bridge-BYj0VF4J.mjs";
-import { a as resolveClaudeExecutable, n as ensureManagedPreset, o as runClaudeDoctor, t as ManagedPresetConflictError } from "./preset-installer-CPOH9lAr.mjs";
+import { A as CLAUDE_UPDATE_PATH, C as CLAUDE_REPOSITORY_FEEDBACK_PATH, D as CLAUDE_REVIEW_COMMENT_PATH, E as CLAUDE_REPOSITORY_STATUS_PATH, N as TASK_TOOL_NAMES, O as CLAUDE_REWIND_PATH, S as CLAUDE_REPOSITORY_ACTION_PATH, T as CLAUDE_REPOSITORY_SETUP_PATH, _ as CLAUDE_DOCTOR_PATH, a as latestClaudeTasks, b as CLAUDE_JIRA_PATH, c as normalizeTasksEvent, d as CLAUDE_ACTIVITY_EVENT, f as CLAUDE_ASK_PATH, g as CLAUDE_CODE_PROVIDER_IDS, h as CLAUDE_CODE_PROVIDER, i as latestClaudeSessionBinding, j as CLAUDE_USAGE_PATH, k as CLAUDE_UPDATE_CHECK_PATH, l as redactText, m as CLAUDE_CODE_PRESET_ID, n as currentClaudeActivityCursor, o as normalizeActivity, p as CLAUDE_CLIENT_DIAGNOSTICS_PATH, r as latestClaudeContextUsage, s as normalizeContextUsage, t as boundText, u as safeDetail, v as CLAUDE_EDITOR_OPEN_PATH, w as CLAUDE_REPOSITORY_FILE_PATH, x as CLAUDE_PROJECTION_PATH, y as CLAUDE_GLOBAL_SETTINGS_PATH } from "./events-DeSV0S1-.mjs";
+import { n as projectClaudeCommands, t as CLAUDE_COMMANDS_SERVICE } from "./command-bridge-DXI6nWhB.mjs";
+import { a as resolveClaudeExecutable, n as ensureManagedPreset, o as runClaudeDoctor, t as ManagedPresetConflictError } from "./preset-installer-DbmlhBXI.mjs";
 import z from "@deepseek-ai/schemastery";
 import { createHash, randomUUID } from "node:crypto";
 import { chmod, mkdir, opendir, readFile, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
@@ -13,6 +13,67 @@ import { DSH_ENV_PREFIX, SENSITIVE_ENV_PATTERN } from "@deepseek-ai/dsh-subproce
 import { LlmAdapter, ReasoningEffortId } from "@deepseek-ai/dsh-llm";
 import { fileURLToPath } from "node:url";
 import { StringDecoder } from "node:string_decoder";
+//#region src/rewind.ts
+const EMPTY_REWIND_STATE = {
+	ranges: [],
+	anchors: []
+};
+/** Absorb one span into an ascending, non-overlapping range list. Adjacent
+*  spans merge so a rewind of a rewind reads as one hidden block. */
+function mergeRewindRanges(ranges, addition) {
+	const merged = [];
+	let { start, end } = addition;
+	for (const range of [...ranges].sort((left, right) => left.start - right.start)) if (range.end + 1 < start) merged.push(range);
+	else if (range.start > end + 1) {
+		merged.push({
+			start,
+			end
+		});
+		start = range.start;
+		end = range.end;
+	} else {
+		start = Math.min(start, range.start);
+		end = Math.max(end, range.end);
+	}
+	merged.push({
+		start,
+		end
+	});
+	return merged.slice(-200);
+}
+/** Record one completed turn's last chain entry, replacing a re-run turn. */
+function recordRewindAnchor(state, anchor) {
+	const anchors = [...state.anchors.filter((item) => item.turn !== anchor.turn), anchor].sort((left, right) => left.turn - right.turn).slice(-2e3);
+	return {
+		...state,
+		anchors
+	};
+}
+/** The turn a surface seq belongs to: the first turn opened at or after it.
+*  A message accepted but never run belongs to no logged turn, so nothing
+*  Claude holds is discarded and every anchor stays valid. */
+function turnAtOrAfter(events, seq) {
+	for (const event of events) if (event.seq >= seq && event.type === "turn/start") return event.data.turn;
+}
+/** Plan one rewind at `seq`, or undefined when the seq is not in the log.
+*  Anchors of the discarded turns go with them: after this rewind Claude no
+*  longer holds those entries, so a later rewind must never fork at one. */
+function planRewind(state, events, seq) {
+	const last = events.at(-1)?.seq;
+	if (last === void 0 || seq > last) return void 0;
+	const turn = turnAtOrAfter(events, seq) ?? Number.MAX_SAFE_INTEGER;
+	const anchors = state.anchors.filter((anchor) => anchor.turn < turn);
+	const kept = anchors.at(-1);
+	return {
+		ranges: mergeRewindRanges(state.ranges, {
+			start: seq,
+			end: last
+		}),
+		anchors,
+		pending: kept === void 0 ? { fresh: true } : { resumeAt: kept.uuid }
+	};
+}
+//#endregion
 //#region src/sidecar.ts
 const SIDECAR_SCHEMA_VERSION = 1;
 const MAX_ACTIVITIES = 1e4;
@@ -26,7 +87,7 @@ function emptyProjection() {
 		activities: []
 	};
 }
-function record$11(value) {
+function record$13(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 function finiteInteger(value) {
@@ -36,7 +97,7 @@ function string$4(value, max) {
 	return typeof value === "string" && value.length > 0 && value.length <= max;
 }
 function binding(value) {
-	const input = record$11(value);
+	const input = record$13(value);
 	if (input === void 0 || !string$4(input.claudeSessionId, 512) || !string$4(input.sdkVersion, 128) || !string$4(input.cwd, 4096) || input.cliVersion !== void 0 && !string$4(input.cliVersion, 128)) return void 0;
 	return {
 		claudeSessionId: input.claudeSessionId,
@@ -48,6 +109,7 @@ function binding(value) {
 const ACTIVITY_KINDS = /* @__PURE__ */ new Set([
 	"text",
 	"status",
+	"compaction",
 	"thinking",
 	"tool-call",
 	"tool-result",
@@ -66,36 +128,77 @@ const ACTIVITY_PHASES = /* @__PURE__ */ new Set([
 	"failed"
 ]);
 function activity(value) {
-	const input = record$11(value);
+	const input = record$13(value);
 	if (input === void 0 || !finiteInteger(input.turn) || !finiteInteger(input.step) || !finiteInteger(input.ordinal) || typeof input.kind !== "string" || !ACTIVITY_KINDS.has(input.kind) || input.phase !== void 0 && (typeof input.phase !== "string" || !ACTIVITY_PHASES.has(input.phase))) return void 0;
 	return normalizeActivity(input);
 }
 function contextUsage(value) {
-	const input = record$11(value);
+	const input = record$13(value);
 	if (input === void 0 || !Array.isArray(input.categories)) return void 0;
 	return normalizeContextUsage(input);
 }
+function rewind(value) {
+	const input = record$13(value);
+	if (input === void 0 || !Array.isArray(input.ranges) || input.ranges.length > 200 || !Array.isArray(input.anchors) || input.anchors.length > 2e3) return void 0;
+	const ranges = [];
+	for (const item of input.ranges) {
+		const range = record$13(item);
+		if (range === void 0 || !finiteInteger(range.start) || !finiteInteger(range.end) || range.end < range.start) return void 0;
+		ranges.push({
+			start: range.start,
+			end: range.end
+		});
+	}
+	const anchors = [];
+	for (const item of input.anchors) {
+		const anchor = record$13(item);
+		if (anchor === void 0 || !finiteInteger(anchor.turn) || !string$4(anchor.uuid, 128)) return void 0;
+		anchors.push({
+			turn: anchor.turn,
+			uuid: anchor.uuid
+		});
+	}
+	const pending = record$13(input.pending);
+	if (input.pending !== void 0 && pending === void 0) return void 0;
+	if (pending === void 0) return {
+		ranges,
+		anchors
+	};
+	if (pending.fresh === true) return {
+		ranges,
+		anchors,
+		pending: { fresh: true }
+	};
+	if (!string$4(pending.resumeAt, 128)) return void 0;
+	return {
+		ranges,
+		anchors,
+		pending: { resumeAt: pending.resumeAt }
+	};
+}
 function tasks(value) {
-	const input = record$11(value);
+	const input = record$13(value);
 	if (input === void 0 || !Array.isArray(input.tasks)) return void 0;
 	return normalizeTasksEvent(input.tasks);
 }
 function parseClaudeSidecar(value) {
-	const input = record$11(value);
+	const input = record$13(value);
 	if (input === void 0 || input.schemaVersion !== SIDECAR_SCHEMA_VERSION || !finiteInteger(input.revision) || !Array.isArray(input.activities) || input.activities.length > MAX_ACTIVITIES) throw new Error("dsh-claude: invalid sidecar document");
 	const activities = input.activities.map(activity);
 	if (activities.some((item) => item === void 0)) throw new Error("dsh-claude: invalid sidecar activity");
 	const parsedBinding = input.binding === void 0 ? void 0 : binding(input.binding);
 	const parsedUsage = input.contextUsage === void 0 ? void 0 : contextUsage(input.contextUsage);
 	const parsedTasks = input.tasks === void 0 ? void 0 : tasks(input.tasks);
-	if (input.binding !== void 0 && parsedBinding === void 0 || input.contextUsage !== void 0 && parsedUsage === void 0 || input.tasks !== void 0 && parsedTasks === void 0) throw new Error("dsh-claude: invalid sidecar projection");
+	const parsedRewind = input.rewind === void 0 ? void 0 : rewind(input.rewind);
+	if (input.binding !== void 0 && parsedBinding === void 0 || input.contextUsage !== void 0 && parsedUsage === void 0 || input.tasks !== void 0 && parsedTasks === void 0 || input.rewind !== void 0 && parsedRewind === void 0) throw new Error("dsh-claude: invalid sidecar projection");
 	return {
 		schemaVersion: SIDECAR_SCHEMA_VERSION,
 		revision: input.revision,
 		activities,
 		...parsedBinding === void 0 ? {} : { binding: parsedBinding },
 		...parsedUsage === void 0 ? {} : { contextUsage: parsedUsage },
-		...parsedTasks === void 0 ? {} : { tasks: parsedTasks }
+		...parsedTasks === void 0 ? {} : { tasks: parsedTasks },
+		...parsedRewind === void 0 ? {} : { rewind: parsedRewind }
 	};
 }
 function compareActivity(left, right) {
@@ -279,6 +382,35 @@ var ClaudeSidecarRepository = class {
 			value: normalized
 		});
 	}
+	/** Land one planned rewind: hidden ranges, surviving anchors, and the fork
+	*  target the next Claude spawn consumes. */
+	writeRewind(sessionId, value) {
+		return this.#update(sessionId, (current) => ({
+			...current,
+			rewind: value
+		}), false, { kind: "sync" });
+	}
+	/** Remember where Claude's chain ended for one completed DSH turn. */
+	recordRewindAnchor(sessionId, turn, uuid) {
+		return this.#update(sessionId, (current) => ({
+			...current,
+			rewind: recordRewindAnchor(current.rewind ?? EMPTY_REWIND_STATE, {
+				turn,
+				uuid
+			})
+		}));
+	}
+	/** Disarm the fork target once a Claude process has resumed at it, so a
+	*  later respawn continues the rewound session instead of re-truncating it. */
+	clearRewindPending(sessionId) {
+		return this.#update(sessionId, (current) => current.rewind?.pending === void 0 ? current : {
+			...current,
+			rewind: {
+				ranges: current.rewind.ranges,
+				anchors: current.rewind.anchors
+			}
+		});
+	}
 	importLegacy(sessionId, events) {
 		const importedActivities = events.filter((event) => event.type === CLAUDE_ACTIVITY_EVENT).map((event) => activity(event.data)).filter((item) => item !== void 0);
 		const importedBinding = latestClaudeSessionBinding(events);
@@ -654,12 +786,15 @@ function createUserQuestionBridge(userQuestions, activeContext) {
 }
 //#endregion
 //#region src/sdk-messages.ts
-function record$10(value) {
+function record$12(value) {
 	return value !== null && typeof value === "object" ? value : void 0;
 }
 function string$3(value) {
 	return typeof value === "string" ? value : void 0;
 }
+function finiteNumber(value) {
+	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
 function taskUsageOf(usage) {
 	if (usage === void 0) return void 0;
 	const normalized = {};
@@ -668,20 +803,28 @@ function taskUsageOf(usage) {
 	if (typeof usage.duration_ms === "number") normalized.durationMs = usage.duration_ms;
 	return Object.keys(normalized).length === 0 ? void 0 : normalized;
 }
-function resultUsage(message) {
-	const usage = record$10(message.usage);
+/** Read one Anthropic `usage` envelope. Shared by the per-call sample on an
+*  assistant message and the turn total on a result message. */
+function usageOf(usage) {
 	const normalized = {};
-	if (usage !== void 0) {
-		if (typeof usage.input_tokens === "number") normalized.inputTokens = usage.input_tokens;
-		if (typeof usage.output_tokens === "number") normalized.outputTokens = usage.output_tokens;
-		if (typeof usage.cache_read_input_tokens === "number") normalized.cacheReadTokens = usage.cache_read_input_tokens;
-		if (typeof usage.cache_creation_input_tokens === "number") normalized.cacheCreationTokens = usage.cache_creation_input_tokens;
-	}
+	if (usage === void 0) return normalized;
+	if (typeof usage.input_tokens === "number") normalized.inputTokens = usage.input_tokens;
+	if (typeof usage.output_tokens === "number") normalized.outputTokens = usage.output_tokens;
+	if (typeof usage.cache_read_input_tokens === "number") normalized.cacheReadTokens = usage.cache_read_input_tokens;
+	if (typeof usage.cache_creation_input_tokens === "number") normalized.cacheCreationTokens = usage.cache_creation_input_tokens;
+	return normalized;
+}
+function hasUsageCounts(usage) {
+	return usage.inputTokens !== void 0 || usage.outputTokens !== void 0 || usage.cacheReadTokens !== void 0 || usage.cacheCreationTokens !== void 0;
+}
+function resultUsage(message) {
+	const normalized = usageOf(record$12(message.usage));
 	if (typeof message.total_cost_usd === "number") normalized.cumulativeCostUsd = message.total_cost_usd;
 	return normalized;
 }
 function normalizeAssistant(message) {
-	const content = record$10(message.message)?.content;
+	const envelope = record$12(message.message);
+	const content = envelope?.content;
 	if (!Array.isArray(content)) return [{
 		kind: "protocol-error",
 		title: "Malformed Claude assistant message",
@@ -690,7 +833,7 @@ function normalizeAssistant(message) {
 	const parentToolUseId = string$3(message.parent_tool_use_id);
 	const normalized = [];
 	for (const item of content) {
-		const block = record$10(item);
+		const block = record$12(item);
 		if (block === void 0) continue;
 		if (block.type === "text") {
 			const text = string$3(block.text);
@@ -719,11 +862,17 @@ function normalizeAssistant(message) {
 			});
 		}
 	}
+	const usage = usageOf(record$12(envelope?.usage));
+	if (hasUsageCounts(usage)) normalized.push({
+		kind: "request-usage",
+		usage,
+		...parentToolUseId === void 0 ? {} : { parentToolUseId }
+	});
 	return normalized;
 }
 function normalizeUser(message) {
 	if (message.isReplay === true) return [];
-	const content = record$10(message.message)?.content;
+	const content = record$12(message.message)?.content;
 	if (typeof content === "string") return [];
 	if (!Array.isArray(content)) return [{
 		kind: "protocol-error",
@@ -733,7 +882,7 @@ function normalizeUser(message) {
 	const parentToolUseId = string$3(message.parent_tool_use_id);
 	const normalized = [];
 	for (const item of content) {
-		const block = record$10(item);
+		const block = record$12(item);
 		if (block?.type !== "tool_result") continue;
 		const toolUseId = string$3(block.tool_use_id);
 		if (toolUseId === void 0) continue;
@@ -814,7 +963,7 @@ function normalizeSystem(message) {
 		const summary = string$3(message.summary);
 		const subagentType = string$3(message.subagent_type);
 		const lastToolName = string$3(message.last_tool_name);
-		const usage = taskUsageOf(record$10(message.usage));
+		const usage = taskUsageOf(record$12(message.usage));
 		return [{
 			kind: "subagent",
 			title: summary ?? description ?? "Claude subagent update",
@@ -830,7 +979,7 @@ function normalizeSystem(message) {
 		}];
 	}
 	if (subtype === "task_updated") {
-		const patch = record$10(message.patch);
+		const patch = record$12(message.patch);
 		const status = string$3(patch?.status);
 		const taskId = string$3(message.task_id);
 		const description = string$3(patch?.description);
@@ -853,7 +1002,7 @@ function normalizeSystem(message) {
 		const taskId = string$3(message.task_id);
 		const summary = string$3(message.summary);
 		const taskStatus = failed ? "failed" : stopped ? "stopped" : "completed";
-		const usage = taskUsageOf(record$10(message.usage));
+		const usage = taskUsageOf(record$12(message.usage));
 		return [{
 			kind: "subagent",
 			title: summary ?? taskId ?? "Claude subagent finished",
@@ -868,7 +1017,7 @@ function normalizeSystem(message) {
 	if (subtype === "background_tasks_changed") return [{
 		kind: "background-tasks",
 		tasks: (Array.isArray(message.tasks) ? message.tasks : []).flatMap((item) => {
-			const entry = record$10(item);
+			const entry = record$12(item);
 			const taskId = string$3(entry?.task_id);
 			const description = string$3(entry?.description);
 			const taskType = string$3(entry?.task_type);
@@ -885,6 +1034,20 @@ function normalizeSystem(message) {
 		title: "Claude API retry",
 		detail: message
 	}];
+	if (subtype === "compact_boundary") {
+		const metadata = record$12(message.compact_metadata);
+		const trigger = metadata?.trigger === "auto" || metadata?.trigger === "manual" ? metadata.trigger : void 0;
+		const preTokens = finiteNumber(metadata?.pre_tokens);
+		const postTokens = finiteNumber(metadata?.post_tokens);
+		const durationMs = finiteNumber(metadata?.duration_ms);
+		return [{
+			kind: "compaction",
+			...trigger === void 0 ? {} : { trigger },
+			...preTokens === void 0 ? {} : { preTokens },
+			...postTokens === void 0 ? {} : { postTokens },
+			...durationMs === void 0 ? {} : { durationMs }
+		}];
+	}
 	if (subtype === "informational" || subtype === "notification" || subtype === "local_command_output") return [{
 		kind: message.level === "warning" ? "warning" : "status",
 		title: string$3(message.content) ?? string$3(message.text) ?? "Claude Code notice",
@@ -911,10 +1074,10 @@ const RESULT_ERROR_SUBTYPES = /* @__PURE__ */ new Set([
 function normalizeSdkMessage(message) {
 	const value = message;
 	if (value.type === "stream_event") {
-		const event = record$10(value.event);
+		const event = record$12(value.event);
 		const parentToolUseId = string$3(value.parent_tool_use_id);
 		if (event?.type === "content_block_delta") {
-			const delta = record$10(event.delta);
+			const delta = record$12(event.delta);
 			if (delta?.type === "text_delta") {
 				const text = string$3(delta.text);
 				return text === void 0 ? [] : [{
@@ -949,7 +1112,7 @@ function normalizeSdkMessage(message) {
 		const errors = Array.isArray(value.errors) ? value.errors.filter((item) => typeof item === "string") : void 0;
 		const terminalReason = string$3(value.terminal_reason);
 		const userMessageUuid = string$3(value.user_message_uuid);
-		const permissionDenials = Array.isArray(value.permission_denials) ? value.permission_denials.map((item) => record$10(item)).filter((item) => item !== void 0).map((item) => {
+		const permissionDenials = Array.isArray(value.permission_denials) ? value.permission_denials.map((item) => record$12(item)).filter((item) => item !== void 0).map((item) => {
 			const toolName = string$3(item.tool_name);
 			const toolUseId = string$3(item.tool_use_id);
 			return toolName === void 0 || toolUseId === void 0 ? void 0 : {
@@ -975,7 +1138,7 @@ function normalizeSdkMessage(message) {
 		detail: value.error ?? value.output
 	}];
 	if (value.type === "rate_limit_event") {
-		const status = string$3(record$10(value.rate_limit_info)?.status);
+		const status = string$3(record$12(value.rate_limit_info)?.status);
 		return [{
 			kind: "status",
 			title: status !== void 0 && status !== "allowed" ? "Claude rate limit is blocking requests" : "Claude rate limit status changed",
@@ -1014,7 +1177,7 @@ const FIXED_WINDOWS = [
 	"seven_day_opus",
 	"seven_day_sonnet"
 ];
-function record$9(value) {
+function record$11(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
 /** Utilization is documented as 0-100; clamp so a server glitch cannot render
@@ -1026,7 +1189,7 @@ function resetsAt(value) {
 	return typeof value === "string" && value.length > 0 ? value : void 0;
 }
 function window(id, source, label) {
-	const entry = record$9(source);
+	const entry = record$11(source);
 	if (entry === void 0) return void 0;
 	const used = utilization(entry.utilization);
 	const reset = resetsAt(entry.resets_at);
@@ -1040,9 +1203,9 @@ function window(id, source, label) {
 }
 /** Project the SDK's `/usage` response onto the windows the settings card shows. */
 function normalizePlanUsage(value, fetchedAt) {
-	const response = record$9(value);
+	const response = record$11(value);
 	const subscription = typeof response?.subscription_type === "string" ? response.subscription_type : void 0;
-	const limits = record$9(response?.rate_limits);
+	const limits = record$11(response?.rate_limits);
 	if (response?.rate_limits_available !== true || limits === void 0) return {
 		available: false,
 		...subscription === void 0 ? {} : { subscription },
@@ -1050,7 +1213,7 @@ function normalizePlanUsage(value, fetchedAt) {
 		fetchedAt
 	};
 	const windows = [...FIXED_WINDOWS.map((id) => window(id, limits[id])), ...(Array.isArray(limits.model_scoped) ? limits.model_scoped : []).map((entry, index) => {
-		const name = record$9(entry)?.display_name;
+		const name = record$11(entry)?.display_name;
 		return window(`model:${typeof name === "string" ? name : index}`, entry, typeof name === "string" ? name : void 0);
 	})].filter((entry) => entry !== void 0);
 	return {
@@ -1086,7 +1249,9 @@ async function probePlanUsage(executablePath, fetchedAt, factory = query) {
 		(async () => {
 			for await (const _ of query$1);
 		})().catch(() => void 0);
-		return normalizePlanUsage(await readPlanUsageFrom(query$1), fetchedAt);
+		return normalizePlanUsage(await Promise.race([readPlanUsageFrom(query$1), new Promise((_resolve, reject) => {
+			setTimeout(() => reject(/* @__PURE__ */ new Error("dsh-claude: the plan usage request did not answer in time")), PLAN_USAGE_TIMEOUT_MS).unref?.();
+		})]), fetchedAt);
 	} finally {
 		clearTimeout(timer);
 		lifetime.abort();
@@ -1237,6 +1402,14 @@ async function withTimeout(operation, timeoutMs, label) {
 		if (timer !== void 0) clearTimeout(timer);
 	}
 }
+/** The uuid of one main-chain transcript entry, or undefined for anything a
+*  rewind must not fork at: stream partials, results, and sidechain traffic. */
+function chainEntryUuid(message) {
+	if (message.type !== "assistant" && message.type !== "user") return void 0;
+	const envelope = message;
+	if (typeof envelope.parent_tool_use_id === "string") return void 0;
+	return typeof envelope.uuid === "string" && envelope.uuid.length > 0 ? envelope.uuid : void 0;
+}
 function sdkUserMessage(prompt, uuid) {
 	return {
 		type: "user",
@@ -1307,13 +1480,39 @@ var ClaudeSupervisor = class {
 	}
 	async contextUsage(agent, model = this.#config.defaultModel) {
 		const usage = await this.#runMetadata(agent, model, (query) => query.getContextUsage());
-		const contextWindow = usage.rawMaxTokens > 0 ? usage.rawMaxTokens : usage.maxTokens;
-		if (contextWindow > 0) {
-			this.#contextWindows.set(model, contextWindow);
-			this.#contextWindows.set(usage.model, contextWindow);
-		}
+		this.#recordContextWindow(model, usage);
 		return usage;
 	}
+	/** Cache a window under both the selector id the caller asked for and the
+	*  concrete model the CLI reports, so either name resolves it later. */
+	#recordContextWindow(model, usage) {
+		const contextWindow = usage.rawMaxTokens > 0 ? usage.rawMaxTokens : usage.maxTokens;
+		if (contextWindow <= 0) return;
+		this.#contextWindows.set(model, contextWindow);
+		this.#contextWindows.set(usage.model, contextWindow);
+	}
+	/** Learn a model's context window the first time a turn finishes on it.
+	*
+	*  DSH hides its context meter entirely unless the route publishes a
+	*  capacity, and these numbers move with Claude releases — so none are
+	*  hardcoded; the CLI is asked over the session's own live process.
+	*
+	*  Turn completion is the earliest honest moment to ask. `entry.model` is
+	*  already the model that just ran, so no model switch is provoked — which
+	*  rules out asking from `resolveModel`, since DSH resolves every model in
+	*  the catalog to build its picker and `#metadataEntry` would switch the live
+	*  session once per entry. And nothing is lost by waiting: the meter needs a
+	*  usage sample too, and no turn has reported one before the first turn ends.
+	*
+	*  Best-effort — a failure leaves the window unknown (the meter stays hidden,
+	*  exactly as before) and the next completed turn tries again. */
+	async #learnContextWindow(entry) {
+		if (this.#contextWindows.has(entry.model)) return;
+		try {
+			const usage = await withTimeout(entry.query.getContextUsage(), CLAUDE_METADATA_TIMEOUT_MS, "Claude context window probe");
+			this.#recordContextWindow(entry.model, usage);
+		} catch {}
+	}
 	contextWindow(model) {
 		return this.#contextWindows.get(model);
 	}
@@ -1362,7 +1561,7 @@ var ClaudeSupervisor = class {
 		} else {
 			await this.#syncPermissionMode(entry);
 			if (model !== entry.model) {
-				await entry.query.setModel(model);
+				await this.#control(entry, entry.query.setModel(model), "Claude Code model switch");
 				entry.model = model;
 			}
 		}
@@ -1381,6 +1580,7 @@ var ClaudeSupervisor = class {
 			transcriptText: "",
 			transcriptTextOrdinal: void 0,
 			thinking: "",
+			requestUsage: void 0,
 			aborted: false,
 			deniedToolUseIds: /* @__PURE__ */ new Set(),
 			callNames: /* @__PURE__ */ new Map(),
@@ -1432,7 +1632,7 @@ var ClaudeSupervisor = class {
 			const entry = await this.#metadataEntry(agent, model);
 			try {
 				await entry.sdkInitialization;
-				return await withTimeout(operation(entry.query, entry), CLAUDE_METADATA_TIMEOUT_MS, "Claude metadata request");
+				return await this.#control(entry, operation(entry.query, entry), "Claude metadata request");
 			} finally {
 				entry.lastUsedAt = Date.now();
 				if (entry.active === void 0 && entry.state === "idle") this.#armIdleTimer(entry);
@@ -1462,15 +1662,34 @@ var ClaudeSupervisor = class {
 		}
 		await this.#syncPermissionMode(entry);
 		if (model !== entry.model) {
-			await entry.query.setModel(model);
+			await this.#control(entry, entry.query.setModel(model), "Claude Code model switch");
 			entry.model = model;
 		}
 		return entry;
 	}
+	/** Run one SDK control request against a live entry, and discard the entry if
+	*  it does not answer.
+	*
+	*  Turn admission and every metadata read share one process-wide gate, so an
+	*  unbounded control request stalls every session until the Host restarts.
+	*  Bounding it is only half the cure: a timeout also proves this query has
+	*  stopped answering, and keeping the entry means the next caller reuses the
+	*  same dead process — timing out again, forever. Discarding it lets the next
+	*  attempt spawn a fresh one. Every control request goes through here so a
+	*  new call site cannot quietly reintroduce either half. */
+	async #control(entry, operation, label, timeoutMs = CLAUDE_METADATA_TIMEOUT_MS) {
+		try {
+			return await withTimeout(operation, timeoutMs, label);
+		} catch (error) {
+			if (this.#entries.get(entry.sessionId) === entry) this.#entries.delete(entry.sessionId);
+			await this.#disposeEntry(entry);
+			throw error;
+		}
+	}
 	async #syncPermissionMode(entry) {
 		const mode = claudePermissionMode(entry.ownerAgent.session.events);
 		if (mode === entry.permissionMode) return;
-		await entry.query.setPermissionMode(mode);
+		await this.#control(entry, entry.query.setPermissionMode(mode), "Claude Code permission mode switch");
 		entry.permissionMode = mode;
 	}
 	async disposeSession(sessionId) {
@@ -1498,7 +1717,11 @@ var ClaudeSupervisor = class {
 		const cwd = agent.session.header.cwd ?? process.cwd();
 		const input = new AsyncQueue();
 		const lifetime = new AbortController();
-		const binding = (await this.#sidecar.importLegacy(sessionId, agent.session.events)).binding;
+		const projection = await this.#sidecar.importLegacy(sessionId, agent.session.events);
+		const binding = projection.binding;
+		const pendingRewind = projection.rewind?.pending;
+		const forkAt = pendingRewind !== void 0 && "resumeAt" in pendingRewind ? pendingRewind.resumeAt : void 0;
+		const startFresh = pendingRewind !== void 0 && "fresh" in pendingRewind;
 		const permissionMode = claudePermissionMode(agent.session.events);
 		const entry = {
 			sessionId,
@@ -1511,8 +1734,10 @@ var ClaudeSupervisor = class {
 			lastUsedAt: Date.now(),
 			input,
 			lifetime,
-			claudeSessionId: binding?.claudeSessionId,
-			expectedResume: binding?.claudeSessionId,
+			claudeSessionId: startFresh ? void 0 : binding?.claudeSessionId,
+			expectedResume: startFresh || forkAt !== void 0 ? void 0 : binding?.claudeSessionId,
+			lastChainUuid: void 0,
+			consumedRewind: pendingRewind !== void 0,
 			initialized: false,
 			idleTimer: void 0,
 			tasks: /* @__PURE__ */ new Map(),
@@ -1563,7 +1788,10 @@ var ClaudeSupervisor = class {
 			spawnClaudeCodeProcess: createManagedClaudeSpawner(this.#runtime, this.#config.executablePath, (process) => {
 				entry.process = process;
 			}),
-			...binding === void 0 ? {} : { resume: binding.claudeSessionId },
+			...binding === void 0 || startFresh ? {} : {
+				resume: binding.claudeSessionId,
+				...forkAt === void 0 ? {} : { resumeSessionAt: forkAt }
+			},
 			model,
 			...thinkingMode === void 0 ? {} : thinkingMode === "off" ? { thinking: { type: "disabled" } } : thinkingMode === "ultracode" ? { settings: { ultracode: true } } : { effort: thinkingMode }
 		};
@@ -1580,7 +1808,11 @@ var ClaudeSupervisor = class {
 	}
 	async #pump(entry) {
 		try {
-			for await (const sdkMessage of entry.query) for (const message of normalizeSdkMessage(sdkMessage)) await this.#handleMessage(entry, message);
+			for await (const sdkMessage of entry.query) {
+				const chainUuid = chainEntryUuid(sdkMessage);
+				if (chainUuid !== void 0) entry.lastChainUuid = chainUuid;
+				for (const message of normalizeSdkMessage(sdkMessage)) await this.#handleMessage(entry, message);
+			}
 			if (entry.state !== "disposed") await this.#handleDisconnect(entry, /* @__PURE__ */ new Error("Claude Code stream ended"));
 		} catch (error) {
 			if (entry.state !== "disposed") await this.#handleDisconnect(entry, error);
@@ -1603,6 +1835,10 @@ var ClaudeSupervisor = class {
 				cliVersion: message.cliVersion,
 				cwd: message.cwd
 			});
+			if (entry.consumedRewind) {
+				entry.consumedRewind = false;
+				await this.#sidecar.clearRewindPending(entry.sessionId);
+			}
 			return;
 		}
 		const taskId = message.kind === "subagent" ? message.taskId : void 0;
@@ -1701,6 +1937,23 @@ var ClaudeSupervisor = class {
 					isError: message.phase === "failed"
 				});
 				return;
+			case "request-usage":
+				if (message.parentToolUseId === void 0) active.requestUsage = message.usage;
+				return;
+			case "compaction":
+				this.#closeTranscriptTextSegment(active);
+				await this.#appendActivity(active, {
+					kind: "compaction",
+					phase: "completed",
+					title: "Claude compacted the conversation",
+					detail: {
+						...message.trigger === void 0 ? {} : { trigger: message.trigger },
+						...message.preTokens === void 0 ? {} : { preTokens: message.preTokens },
+						...message.postTokens === void 0 ? {} : { postTokens: message.postTokens },
+						...message.durationMs === void 0 ? {} : { durationMs: message.durationMs }
+					}
+				});
+				return;
 			case "status":
 			case "warning":
 			case "unknown":
@@ -1832,6 +2085,31 @@ var ClaudeSupervisor = class {
 		entry.taskSnapshotAt = Date.now();
 		await this.#sidecar.writeTasks(entry.sessionId, [...entry.tasks.values()]).catch(() => void 0);
 	}
+	/** What DSH is told about token usage: newest call's prompt, whole turn's output.
+	*
+	*  `TokenUsage` is documented as "token accounting for ONE model call", and
+	*  DSH's token meter divides `uncachedInput + cacheRead + cacheWrite` by the
+	*  context window to draw context pressure. One Claude turn makes many calls
+	*  and the CLI's result usage sums all of them, so reporting that sum pinned
+	*  the meter at 100%: a 35-call turn reads the same prompt from cache 35
+	*  times, which sums past the window without the conversation ever growing.
+	*  The newest single call answers "how big is this conversation now".
+	*
+	*  Output is deliberately excluded from that pressure sum, so the same
+	*  argument never applied to it — and taking it from the newest call reported
+	*  whatever the wrap-up message happened to cost, which is a couple of tokens
+	*  after a turn that wrote thousands. The turn total is the honest figure.
+	*
+	*  The sidecar activity keeps the whole turn total for both — that is the
+	*  audit and cost record, and nothing divides it by a window. */
+	#reportedUsage(active, result) {
+		const prompt = active.requestUsage;
+		if (prompt === void 0) return result.usage;
+		return {
+			...prompt,
+			...result.usage.outputTokens === void 0 ? {} : { outputTokens: result.usage.outputTokens }
+		};
+	}
 	async #completeProgressSegment(active, result, recordUsage = true) {
 		if (recordUsage && (result.usage.inputTokens !== void 0 || result.usage.outputTokens !== void 0 || result.usage.cumulativeCostUsd !== void 0)) {
 			await this.#appendSafely(active, {
@@ -1843,7 +2121,7 @@ var ClaudeSupervisor = class {
 			});
 			active.output.push({
 				type: "usage",
-				usage: result.usage
+				usage: this.#reportedUsage(active, result)
 			});
 		}
 		if (!active.sawTextDelta && active.text.length === 0 && result.text !== void 0) {
@@ -1878,6 +2156,7 @@ var ClaudeSupervisor = class {
 			entry.active = void 0;
 			entry.state = "idle";
 			entry.lastUsedAt = Date.now();
+			await this.#recordChainAnchor(entry, active);
 			this.#armIdleTimer(entry);
 			return;
 		}
@@ -1891,7 +2170,7 @@ var ClaudeSupervisor = class {
 			});
 			active.output.push({
 				type: "usage",
-				usage: result.usage
+				usage: this.#reportedUsage(active, result)
 			});
 		}
 		const unmatchedDenials = (result.permissionDenials ?? []).filter((denial) => !active.deniedToolUseIds.has(denial.toolUseId));
@@ -1959,8 +2238,20 @@ var ClaudeSupervisor = class {
 		entry.active = void 0;
 		entry.state = "idle";
 		entry.lastUsedAt = Date.now();
+		await this.#recordChainAnchor(entry, active);
+		await this.#learnContextWindow(entry);
 		this.#armIdleTimer(entry);
 	}
+	/** Pin where Claude's chain ended for the DSH turn that just settled, so a
+	*  later rewind of the following turn can fork exactly here. Best effort:
+	*  a missing anchor only makes a rewind fall back to an earlier turn. */
+	async #recordChainAnchor(entry, active) {
+		const uuid = entry.lastChainUuid;
+		if (uuid === void 0) return;
+		try {
+			await this.#sidecar.recordRewindAnchor(entry.sessionId, active.cursor.turn, uuid);
+		} catch {}
+	}
 	async #upsertTranscriptText(active) {
 		if (active.transcriptText.length === 0) return;
 		const ordinal = active.transcriptTextOrdinal ?? active.cursor.nextOrdinal++;
@@ -2159,28 +2450,28 @@ const MODELS = [
 	{
 		id: "default",
 		name: "Default (recommended)",
-		description: "Use Claude Code’s recommended default model."
+		description: ""
 	},
 	{
 		id: "opus[1m]",
 		name: "Opus (1M context)",
-		description: "Use Opus with a 1M-token context window.",
+		description: "",
 		contextWindow: 1e6
 	},
 	{
 		id: "fable",
 		name: "Fable",
-		description: "Use Fable, Claude Code’s most capable coding model."
+		description: ""
 	},
 	{
 		id: "sonnet",
 		name: "Sonnet",
-		description: "Use Sonnet for efficient routine coding work."
+		description: ""
 	},
 	{
 		id: "haiku",
 		name: "Haiku",
-		description: "Use Haiku for fast, lightweight tasks."
+		description: ""
 	}
 ];
 const THINKING_MODES = [
@@ -2594,7 +2885,7 @@ function registerClaudeDoctorRoutes(ctx, runtime, supervisor, config, resolution
 }
 //#endregion
 //#region src/projection-routes.ts
-const MAX_SESSION_ID_CHARS$4 = 1024;
+const MAX_SESSION_ID_CHARS$6 = 1024;
 /** Slow-moving metadata refresh and stream heartbeat cadence; deliberately off
 *  the transcript hot path so git/gh latency never delays visible text. */
 const META_REFRESH_MS = 5e3;
@@ -2608,7 +2899,7 @@ function targetFromUrl(rawUrl) {
 		if (stream) encoded = encoded.slice(0, -7);
 		if (encoded.length === 0 || encoded.includes("/")) return void 0;
 		const sessionId = decodeURIComponent(encoded);
-		if (sessionId.length === 0 || sessionId.length > MAX_SESSION_ID_CHARS$4) return void 0;
+		if (sessionId.length === 0 || sessionId.length > MAX_SESSION_ID_CHARS$6) return void 0;
 		return {
 			sessionId,
 			stream
@@ -2627,7 +2918,8 @@ function envelope(projection, meta) {
 		...projection.contextUsage === void 0 ? {} : { contextUsage: projection.contextUsage },
 		...projection.tasks === void 0 ? {} : { tasks: projection.tasks },
 		...meta.repository === void 0 ? {} : { repository: meta.repository },
-		reviewComments: meta.reviewComments
+		reviewComments: meta.reviewComments,
+		...projection.rewind === void 0 ? {} : { rewind: { ranges: projection.rewind.ranges } }
 	};
 }
 /** Register the browser-readable, credential-free sidecar projection endpoint.
@@ -2768,7 +3060,7 @@ function registerClaudeProjectionRoute(ctx, sidecar, ownsSession, commandsForSes
 }
 //#endregion
 //#region src/repository-status.ts
-const MAX_OUTPUT_BYTES$3 = 65536;
+const MAX_OUTPUT_BYTES$4 = 65536;
 const MAX_DIFF_BYTES = 262144;
 const MAX_FILE_BYTES = 8388608;
 const MAX_UNTRACKED_DIFFS = 50;
@@ -2788,7 +3080,7 @@ async function collect$3(handle) {
 		lossy: stdout?.lossy === true
 	};
 }
-async function run(runtime, executable, args, cwd, timeoutMs, maxBytes = MAX_OUTPUT_BYTES$3) {
+async function run(runtime, executable, args, cwd, timeoutMs, maxBytes = MAX_OUTPUT_BYTES$4) {
 	const signal = AbortSignal.timeout(timeoutMs);
 	return collect$3(runtime.spawn({
 		argv: [executable, ...args],
@@ -2796,7 +3088,7 @@ async function run(runtime, executable, args, cwd, timeoutMs, maxBytes = MAX_OUT
 		stdio: {
 			stdin: "ignore",
 			stdout: { maxBytes },
-			stderr: { maxBytes: MAX_OUTPUT_BYTES$3 }
+			stderr: { maxBytes: MAX_OUTPUT_BYTES$4 }
 		},
 		graceMs: 1e3,
 		signal,
@@ -2866,14 +3158,14 @@ function parseGitHubRemote(value) {
 	if (match?.[1] === void 0 || match[2] === void 0) return void 0;
 	return `${match[1]}/${match[2]}`;
 }
-function record$8(value) {
+function record$10(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 function aggregateChecks(value) {
 	if (!Array.isArray(value) || value.length === 0) return "none";
 	let pending = false;
 	for (const item of value) {
-		const check = record$8(item);
+		const check = record$10(item);
 		if (check === void 0) continue;
 		const conclusion = typeof check.conclusion === "string" ? check.conclusion.toUpperCase() : void 0;
 		const status = typeof check.status === "string" ? check.status.toUpperCase() : void 0;
@@ -2897,7 +3189,7 @@ function reviewState(value) {
 	return "none";
 }
 function parsePullRequest(value) {
-	const input = record$8(value);
+	const input = record$10(value);
 	if (input === void 0 || !Number.isSafeInteger(input.number) || Number(input.number) <= 0 || typeof input.title !== "string" || typeof input.url !== "string") return void 0;
 	let url;
 	try {
@@ -2918,7 +3210,7 @@ function parsePullRequest(value) {
 		review: reviewState(input.reviewDecision),
 		checks: aggregateChecks(input.statusCheckRollup),
 		...typeof input.mergeStateStatus === "string" ? { mergeState: bounded(input.mergeStateStatus) } : {},
-		...typeof record$8(input.author)?.login === "string" ? { author: bounded(String(record$8(input.author)?.login)) } : {},
+		...typeof record$10(input.author)?.login === "string" ? { author: bounded(String(record$10(input.author)?.login)) } : {},
 		...typeof input.createdAt === "string" && Number.isFinite(Date.parse(input.createdAt)) ? { createdAt: new Date(input.createdAt).toISOString() } : {},
 		...typeof input.mergedAt === "string" && Number.isFinite(Date.parse(input.mergedAt)) ? { mergedAt: new Date(input.mergedAt).toISOString() } : {},
 		...typeof input.baseRefName === "string" && bounded(input.baseRefName).length > 0 ? { baseBranch: bounded(input.baseRefName) } : {}
@@ -3212,7 +3504,7 @@ var RepositoryStatusService = class {
 };
 //#endregion
 //#region src/repository-setup.ts
-const MAX_OUTPUT_BYTES$2 = 131072;
+const MAX_OUTPUT_BYTES$3 = 131072;
 const GIT_TIMEOUT_MS$2 = 1e4;
 const GIT_FETCH_TIMEOUT_MS = 6e4;
 const MAX_PATH_CHARS$2 = 4096;
@@ -3299,8 +3591,18 @@ var RepositorySetupService = class {
 		this.#cleanupGraceMs = options.cleanupGraceMs ?? CLEANUP_GRACE_MS;
 	}
 	async listBranches(cwd) {
+		const git = await this.#git();
+		return this.#listBranches(git, await this.#repositoryRoot(git, safePath(cwd)));
+	}
+	/** Refresh remote-tracking refs before listing: a branch pushed after this
+	*  checkout last fetched has no local ref, so the picker cannot offer it. */
+	async refreshBranches(cwd) {
 		const git = await this.#git();
 		const root = await this.#repositoryRoot(git, safePath(cwd));
+		await this.#fetchRemotes(git, root);
+		return this.#listBranches(git, root);
+	}
+	async #listBranches(git, root) {
 		const [status, refs, remoteRefs] = await Promise.all([
 			this.#run(git, [
 				"status",
@@ -3514,6 +3816,16 @@ var RepositorySetupService = class {
 			branch: localBranch
 		};
 	}
+	async #fetchRemotes(git, root) {
+		const fetched = await this.#run(git, [
+			"-c",
+			"credential.interactive=never",
+			"fetch",
+			"--all",
+			"--prune"
+		], root, GIT_FETCH_TIMEOUT_MS);
+		if (fetched.exitCode !== 0 || fetched.lossy) throw new RepositorySetupError("fetch-failed", "Git could not refresh remote references.");
+	}
 	async #checkout(info, branch) {
 		if (info.current !== branch) {
 			if (info.dirty) throw new RepositorySetupError("dirty-workspace", "Commit or stash workspace changes before switching branches.");
@@ -3542,14 +3854,7 @@ var RepositorySetupService = class {
 	async #createWorktree(root, baseBranch, baseRef, explicitBranchName, reuseExistingBranch, progress) {
 		const git = await this.#git();
 		progress("fetching");
-		const fetched = await this.#run(git, [
-			"-c",
-			"credential.interactive=never",
-			"fetch",
-			"--all",
-			"--prune"
-		], root, GIT_FETCH_TIMEOUT_MS);
-		if (fetched.exitCode !== 0 || fetched.lossy) throw new RepositorySetupError("fetch-failed", "Git could not refresh remote references before creating the worktree.");
+		await this.#fetchRemotes(git, root);
 		const suffix = randomUUID().slice(0, 8);
 		const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[-:]/gu, "").replace(/\.\d{3}Z$/u, "Z");
 		const branch = explicitBranchName ?? `${safeBranch(await this.#branchPrefix())}/${slug(baseBranch, "branch")}-${stamp}-${suffix}`;
@@ -3636,8 +3941,8 @@ var RepositorySetupService = class {
 			cwd,
 			stdio: {
 				stdin: "ignore",
-				stdout: { maxBytes: MAX_OUTPUT_BYTES$2 },
-				stderr: { maxBytes: MAX_OUTPUT_BYTES$2 }
+				stdout: { maxBytes: MAX_OUTPUT_BYTES$3 },
+				stderr: { maxBytes: MAX_OUTPUT_BYTES$3 }
 			},
 			graceMs: 1e3,
 			signal: AbortSignal.timeout(timeoutMs),
@@ -3678,7 +3983,7 @@ var RepositorySetupService = class {
 };
 //#endregion
 //#region src/repository-actions.ts
-const MAX_OUTPUT_BYTES$1 = 262144;
+const MAX_OUTPUT_BYTES$2 = 262144;
 const MAX_PATCH_CHARS = 65536;
 const MAX_MESSAGE_CHARS = 512;
 const MAX_PR_TEXT_CHARS = 8192;
@@ -3686,6 +3991,24 @@ const MAX_UNPUSHED_COMMITS = 20;
 const GIT_TIMEOUT_MS$1 = 15e3;
 const REMOTE_TIMEOUT_MS = 6e4;
 const GENERATE_TIMEOUT_MS = 6e4;
+/** One cold `claude -p` per generation, so everything the subject line cannot
+*  use is cost: MCP servers (which `ask` already skips for the same reason,
+*  and which stall for as long as an unreachable one takes to give up) and the
+*  user's own hooks and settings. Project settings stay: a repository's commit
+*  conventions belong in the message. `--tools ''` keeps `--output-format`
+*  between it and the prompt -- both flags are variadic. */
+const GENERATE_ARGUMENTS = [
+	"-p",
+	"--strict-mcp-config",
+	"--mcp-config",
+	"{\"mcpServers\":{}}",
+	"--setting-sources",
+	"project,local",
+	"--tools",
+	"",
+	"--output-format",
+	"text"
+];
 var RepositoryActionError = class extends Error {
 	code;
 	commit;
@@ -3789,14 +4112,7 @@ var RepositoryActionService = class {
 			`Diff:\n${preview.patch.slice(0, 24576)}`
 		].join("\n");
 		try {
-			const result = await this.#run(this.#claudeExecutable, [
-				"-p",
-				"--tools",
-				"",
-				"--output-format",
-				"text",
-				prompt
-			], preview.root, GENERATE_TIMEOUT_MS);
+			const result = await this.#run(this.#claudeExecutable, GENERATE_ARGUMENTS.concat(prompt), preview.root, GENERATE_TIMEOUT_MS);
 			return result.exitCode === 0 && !result.lossy ? normalizedGeneratedMessage(result.stdout, fallback) : fallback;
 		} catch {
 			return fallback;
@@ -4005,7 +4321,7 @@ var RepositoryActionService = class {
 				"--",
 				":(exclude)WARP.md",
 				":(exclude)**/WARP.md"
-			], root, GIT_TIMEOUT_MS$1, MAX_OUTPUT_BYTES$1),
+			], root, GIT_TIMEOUT_MS$1, MAX_OUTPUT_BYTES$2),
 			this.#run(git, [
 				"diff",
 				"--no-ext-diff",
@@ -4014,7 +4330,7 @@ var RepositoryActionService = class {
 				"--",
 				":(exclude)WARP.md",
 				":(exclude)**/WARP.md"
-			], root, GIT_TIMEOUT_MS$1, MAX_OUTPUT_BYTES$1)
+			], root, GIT_TIMEOUT_MS$1, MAX_OUTPUT_BYTES$2)
 		]);
 		if (branchResult.exitCode !== 0) throw new RepositoryActionError("detached-head", "A detached HEAD cannot be committed from this panel.");
 		if (headResult.exitCode !== 0 || statusResult.exitCode !== 0 || statusResult.lossy) throw new RepositoryActionError("repository-unavailable", "Repository state is unavailable.");
@@ -4108,14 +4424,14 @@ var RepositoryActionService = class {
 		if (result.exitCode !== 0 || result.lossy) throw new RepositoryActionError(code, message);
 		return result;
 	}
-	#run(executable, args, cwd, timeoutMs, maxBytes = MAX_OUTPUT_BYTES$1) {
+	#run(executable, args, cwd, timeoutMs, maxBytes = MAX_OUTPUT_BYTES$2) {
 		return collect$1(this.#runtime.spawn({
 			argv: [executable, ...args],
 			cwd,
 			stdio: {
 				stdin: "ignore",
 				stdout: { maxBytes },
-				stderr: { maxBytes: MAX_OUTPUT_BYTES$1 }
+				stderr: { maxBytes: MAX_OUTPUT_BYTES$2 }
 			},
 			graceMs: 1e3,
 			signal: AbortSignal.timeout(timeoutMs),
@@ -4125,20 +4441,20 @@ var RepositoryActionService = class {
 };
 //#endregion
 //#region src/repository-setup-routes.ts
-const MAX_BODY_BYTES$4 = 16384;
-function record$7(value) {
+const MAX_BODY_BYTES$6 = 16384;
+function record$9(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
-async function readJson$4(req) {
+async function readJson$6(req) {
 	const chunks = [];
 	let size = 0;
 	for await (const chunk of req) {
 		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
 		size += buffer.length;
-		if (size > MAX_BODY_BYTES$4) throw new RepositorySetupError("body-too-large", "The request body is too large.");
+		if (size > MAX_BODY_BYTES$6) throw new RepositorySetupError("body-too-large", "The request body is too large.");
 		chunks.push(buffer);
 	}
-	const value = record$7(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+	const value = record$9(JSON.parse(Buffer.concat(chunks).toString("utf8")));
 	if (value === void 0) throw new RepositorySetupError("invalid-request", "The request body is invalid.");
 	return value;
 }
@@ -4198,6 +4514,11 @@ function registerRepositorySetupRoute(ctx, service) {
 			if (!trustedRequest(req)) return json(res, 403, { error: "forbidden" });
 			const pathname = new URL(req.url ?? "/", "http://localhost").pathname;
 			try {
+				if (pathname === `/plugins/dsh-claude/repository/setup/branches/refresh`) {
+					if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
+					const input = await readJson$6(req);
+					return json(res, 200, await service.refreshBranches(string$2(input, "cwd")));
+				}
 				if (pathname === `/plugins/dsh-claude/repository/setup/branches`) {
 					if (req.method !== "GET") return json(res, 405, { error: "method not allowed" });
 					const cwd = new URL(req.url ?? "/", "http://localhost").searchParams.get("cwd");
@@ -4206,19 +4527,19 @@ function registerRepositorySetupRoute(ctx, service) {
 				}
 				if (pathname === "/plugins/dsh-claude/repository/setup") {
 					if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
-					const input = await readJson$4(req);
+					const input = await readJson$6(req);
 					if (typeof input.worktree !== "boolean") throw new RepositorySetupError("invalid-request", "The worktree field is required.");
 					await streamSetup(res, service, input);
 					return;
 				}
 				if (pathname === `/plugins/dsh-claude/repository/setup/cleanup`) {
 					if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
-					const input = await readJson$4(req);
+					const input = await readJson$6(req);
 					return json(res, 200, await service.cleanupMerged(string$2(input, "path"), string$2(input, "baseBranch")));
 				}
 				if (pathname === `/plugins/dsh-claude/repository/setup/bind`) {
 					if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
-					const input = await readJson$4(req);
+					const input = await readJson$6(req);
 					await service.bindLease(string$2(input, "leaseId"), string$2(input, "sessionId"));
 					return json(res, 200, { ok: true });
 				}
@@ -4236,8 +4557,8 @@ function registerRepositorySetupRoute(ctx, service) {
 }
 //#endregion
 //#region src/repository-action-routes.ts
-const MAX_BODY_BYTES$3 = 16384;
-const MAX_SESSION_ID_CHARS$3 = 1024;
+const MAX_BODY_BYTES$5 = 16384;
+const MAX_SESSION_ID_CHARS$5 = 1024;
 const ACTIONS = /* @__PURE__ */ new Set([
 	"commit",
 	"commit-push",
@@ -4246,25 +4567,25 @@ const ACTIONS = /* @__PURE__ */ new Set([
 	"merge-pr",
 	"update-branch"
 ]);
-function record$6(value) {
+function record$8(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
-async function readJson$3(req) {
+async function readJson$5(req) {
 	const chunks = [];
 	let size = 0;
 	for await (const chunk of req) {
 		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
 		size += buffer.length;
-		if (size > MAX_BODY_BYTES$3) throw new RepositoryActionError("body-too-large", "The request body is too large.");
+		if (size > MAX_BODY_BYTES$5) throw new RepositoryActionError("body-too-large", "The request body is too large.");
 		chunks.push(buffer);
 	}
-	const value = record$6(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+	const value = record$8(JSON.parse(Buffer.concat(chunks).toString("utf8")));
 	if (value === void 0) throw new RepositoryActionError("invalid-request", "The request body is invalid.");
 	return value;
 }
 function sessionId$1(url) {
 	const value = url.searchParams.get("sessionId");
-	if (value === null || value.length === 0 || value.length > MAX_SESSION_ID_CHARS$3) throw new RepositoryActionError("invalid-session", "The session is invalid.");
+	if (value === null || value.length === 0 || value.length > MAX_SESSION_ID_CHARS$5) throw new RepositoryActionError("invalid-session", "The session is invalid.");
 	return value;
 }
 function string$1(input, key) {
@@ -4313,12 +4634,12 @@ function registerRepositoryActionRoute(ctx, service, cwdForSession) {
 				}
 				if (url.pathname === `/plugins/dsh-claude/repository/action/message`) {
 					if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
-					const input = await readJson$3(req);
+					const input = await readJson$5(req);
 					return json(res, 200, { message: await service.generateMessage(cwd, string$1(input, "fingerprint")) });
 				}
 				if (url.pathname === "/plugins/dsh-claude/repository/action") {
 					if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
-					return json(res, 200, await service.execute(cwd, actionRequest(await readJson$3(req))));
+					return json(res, 200, await service.execute(cwd, actionRequest(await readJson$5(req))));
 				}
 				return json(res, 404, { error: "not found" });
 			} catch (error) {
@@ -4337,11 +4658,190 @@ function registerRepositoryActionRoute(ctx, service, cwdForSession) {
 	}), "dsh-claude: repository action route");
 }
 //#endregion
+//#region src/editor-open.ts
+const MAX_OUTPUT_BYTES$1 = 8192;
+/** Long enough for a launcher shim to fail loudly, short enough that the
+*  request returns while the IDE is still booting. On Windows and Linux the
+*  IDE binary IS the launched process, so still running past this is success. */
+const SETTLE_MS = 1500;
+const EDITOR_IDS = /* @__PURE__ */ new Set(["cursor", "idea"]);
+/** Launch commands tried in order, first success wins. macOS keeps `open -a`
+*  behind the CLI shim because both shims are opt-in installs there, while
+*  `open -a` finds the bundle wherever Toolbox or the DMG dropped it. */
+const LAUNCHERS = {
+	cursor: {
+		darwin: [["cursor"], [
+			"open",
+			"-a",
+			"Cursor"
+		]],
+		win32: [["cursor"]],
+		linux: [["cursor"]]
+	},
+	idea: {
+		darwin: [
+			["idea"],
+			[
+				"open",
+				"-a",
+				"IntelliJ IDEA"
+			],
+			[
+				"open",
+				"-a",
+				"IntelliJ IDEA CE"
+			]
+		],
+		win32: [["idea"], ["idea64.exe"]],
+		linux: [["idea"], ["idea.sh"]]
+	}
+};
+/** cmd.exe re-interprets these, and a mis-parsed path opens the wrong project
+*  rather than failing. Refuse instead of guessing. */
+const WINDOWS_UNSAFE = /["&|<>^%]/u;
+var EditorOpenError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "EditorOpenError";
+		this.code = code;
+	}
+};
+/** Open a session's working directory in a desktop editor. */
+var EditorOpenService = class {
+	#runtime;
+	#platform;
+	#settleMs;
+	constructor(runtime, platform = process.platform, settleMs = SETTLE_MS) {
+		this.#runtime = runtime;
+		this.#platform = platform;
+		this.#settleMs = settleMs;
+	}
+	async open(cwd, editor) {
+		if (this.#platform === "win32" && WINDOWS_UNSAFE.test(cwd)) throw new EditorOpenError("unsupported-path", "The project path cannot be opened through the Windows shell.");
+		const candidates = LAUNCHERS[editor][this.#platform] ?? LAUNCHERS[editor].linux ?? [];
+		let found = false;
+		for (const candidate of candidates) {
+			const argv = await this.#argv(candidate, cwd);
+			if (argv === void 0) continue;
+			found = true;
+			if (await this.#launch(argv, cwd)) return;
+		}
+		throw found ? new EditorOpenError("launch-failed", "The editor refused to open the project.") : new EditorOpenError("editor-unavailable", "The editor was not found on PATH.");
+	}
+	async #argv(candidate, cwd) {
+		const [program, ...rest] = candidate;
+		if (program === void 0) return void 0;
+		if (this.#platform === "win32") return [
+			"cmd.exe",
+			"/d",
+			"/s",
+			"/c",
+			program,
+			...rest,
+			cwd
+		];
+		try {
+			return [
+				await this.#runtime.resolveExecutable(program),
+				...rest,
+				cwd
+			];
+		} catch {
+			return;
+		}
+	}
+	/** True once the editor is launched: either the shim exited cleanly or the
+	*  process is still alive past the settle window. */
+	async #launch(argv, cwd) {
+		let handle;
+		try {
+			handle = this.#runtime.spawn({
+				argv,
+				cwd,
+				stdio: {
+					stdin: "ignore",
+					stdout: { maxBytes: MAX_OUTPUT_BYTES$1 },
+					stderr: { maxBytes: MAX_OUTPUT_BYTES$1 }
+				},
+				graceMs: 1e3,
+				env: {}
+			});
+		} catch {
+			return false;
+		}
+		return await Promise.race([handle.done.then((outcome) => outcome.exitCode === 0), new Promise((resolve) => {
+			setTimeout(() => resolve(true), this.#settleMs).unref?.();
+		})]);
+	}
+};
+//#endregion
+//#region src/editor-open-routes.ts
+const MAX_SESSION_ID_CHARS$4 = 1024;
+/** Open the session's working directory in a desktop editor. Query-only: the
+*  request carries two enum-ish values, so there is no body to parse. */
+function registerEditorOpenRoute(ctx, service, cwdForSession) {
+	ctx.effect(() => ctx.webServer.register({
+		kind: "exact",
+		path: CLAUDE_EDITOR_OPEN_PATH,
+		handler: async (req, res) => {
+			if (!trustedRequest(req)) return json(res, 403, { error: "forbidden" });
+			if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
+			const params = new URL(req.url ?? "/", "http://localhost").searchParams;
+			const id = params.get("sessionId");
+			const editor = params.get("editor");
+			if (id === null || id.length === 0 || id.length > MAX_SESSION_ID_CHARS$4) return json(res, 400, {
+				error: "invalid-session",
+				message: "The session is invalid."
+			});
+			if (editor === null || !EDITOR_IDS.has(editor)) return json(res, 400, {
+				error: "invalid-editor",
+				message: "The editor is invalid."
+			});
+			const cwd = cwdForSession(id);
+			if (cwd === void 0) return json(res, 409, {
+				error: "session-unavailable",
+				message: "The Claude session is unavailable."
+			});
+			try {
+				await service.open(cwd, editor);
+				return json(res, 200, { opened: true });
+			} catch (error) {
+				if (error instanceof EditorOpenError) return json(res, 409, {
+					error: error.code,
+					message: error.message
+				});
+				return json(res, 500, {
+					error: "editor-open-unavailable",
+					message: "The editor could not be launched."
+				});
+			}
+		}
+	}), "dsh-claude: editor open route");
+}
+//#endregion
+//#region src/github-url.ts
+/** Only GitHub's own image hosts; the browser loads these directly, so a URL
+*  the API did not vouch for must never become an outbound request. */
+function githubAvatarUrl(value) {
+	if (typeof value !== "string" || value.length === 0 || value.length > 1024) return void 0;
+	try {
+		const url = new URL(value);
+		const allowed = url.hostname === "github.com" || url.hostname === "githubusercontent.com" || url.hostname.endsWith(".githubusercontent.com");
+		return url.protocol === "https:" && allowed ? url.href : void 0;
+	} catch {
+		return;
+	}
+}
+//#endregion
 //#region src/pr-feedback.ts
 const MAX_OUTPUT_BYTES = 524288;
 const GIT_TIMEOUT_MS = 1e4;
 const GH_TIMEOUT_MS = 6e4;
 const MAX_COMMENTS = 100;
+const MAX_THREADS = 100;
+const MAX_MENTIONABLE_USERS = 20;
+const MAX_REPLY_CHARS$1 = 2e3;
 const MAX_COMMENT_CHARS = 4096;
 const MAX_FAILING_CHECKS = 3;
 const MAX_LOG_CHARS = 8192;
@@ -4353,6 +4853,31 @@ var PullRequestFeedbackError = class extends Error {
 		this.code = code;
 	}
 };
+/** Threads carry the anchor; comments carry the prose. `isOutdated` marks a
+*  thread whose lines the branch has since moved past. */
+const REVIEW_THREADS_QUERY = `query($owner:String!,$name:String!,$number:Int!){
+  repository(owner:$owner,name:$name){
+    pullRequest(number:$number){
+      reviewThreads(first:100){
+        nodes{
+          id isResolved isOutdated path line originalLine diffSide
+          comments(first:50){ nodes{ databaseId body url createdAt author{ __typename login avatarUrl } } }
+        }
+      }
+    }
+  }
+}`;
+const RESOLVE_MUTATION = `mutation($threadId:ID!){
+  resolveReviewThread(input:{threadId:$threadId}){ thread{ isResolved } }
+}`;
+const UNRESOLVE_MUTATION = `mutation($threadId:ID!){
+  unresolveReviewThread(input:{threadId:$threadId}){ thread{ isResolved } }
+}`;
+const MENTIONABLE_USERS_QUERY = `query($owner:String!,$name:String!,$q:String!){
+  repository(owner:$owner,name:$name){
+    mentionableUsers(first:20,query:$q){ nodes{ login avatarUrl } }
+  }
+}`;
 async function collect(handle) {
 	const outcome = await handle.done;
 	const stdout = handle.collected.stdout?.readFrom(0);
@@ -4362,32 +4887,100 @@ async function collect(handle) {
 		lossy: stdout?.lossy === true
 	};
 }
-function record$5(value) {
+function record$7(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
-function parseReviewComments(value) {
-	if (!Array.isArray(value)) return [];
-	const comments = [];
-	for (const item of value) {
-		const input = record$5(item);
-		if (input === void 0 || !Number.isSafeInteger(input.id)) continue;
-		const body = typeof input.body === "string" ? input.body.trim() : "";
+/** Read `repository.pullRequest.reviewThreads.nodes` out of a GraphQL response.
+*  A payload carrying `errors` instead of data yields nothing rather than
+*  throwing: the caller distinguishes "no threads" from "call failed" by the
+*  process exit code. */
+function parseReviewThreads(value) {
+	const nodes = record$7(record$7(record$7(record$7(record$7(value)?.data)?.repository)?.pullRequest)?.reviewThreads)?.nodes;
+	if (!Array.isArray(nodes)) return [];
+	const threads = [];
+	let total = 0;
+	for (const item of nodes) {
+		const input = record$7(item);
+		if (input === void 0 || typeof input.id !== "string" || input.id.length === 0) continue;
 		const path = typeof input.path === "string" ? input.path : "";
-		const url = typeof input.html_url === "string" ? input.html_url : "";
-		if (body.length === 0 || path.length === 0) continue;
-		const line = Number.isSafeInteger(input.line) ? Number(input.line) : Number.isSafeInteger(input.original_line) ? Number(input.original_line) : void 0;
-		comments.push({
-			id: Number(input.id),
+		if (path.length === 0) continue;
+		const line = Number.isSafeInteger(input.line) ? Number(input.line) : Number.isSafeInteger(input.originalLine) ? Number(input.originalLine) : void 0;
+		const side = input.diffSide === "LEFT" ? "old" : "new";
+		const anchor = {
 			path,
 			...line === void 0 ? {} : { line },
-			side: input.side === "LEFT" ? "old" : "new",
-			author: typeof record$5(input.user)?.login === "string" ? String(record$5(input.user)?.login) : "unknown",
-			body: body.slice(0, MAX_COMMENT_CHARS),
-			url
+			side
+		};
+		const comments = [];
+		const commentNodes = record$7(input.comments)?.nodes;
+		for (const node of Array.isArray(commentNodes) ? commentNodes : []) {
+			if (total >= MAX_COMMENTS) break;
+			const comment = record$7(node);
+			if (comment === void 0 || !Number.isSafeInteger(comment.databaseId)) continue;
+			const body = typeof comment.body === "string" ? comment.body.trim() : "";
+			if (body.length === 0) continue;
+			const author = record$7(comment.author);
+			const avatarUrl = githubAvatarUrl(author?.avatarUrl);
+			const login = typeof author?.login === "string" ? author.login : "unknown";
+			comments.push({
+				id: Number(comment.databaseId),
+				...anchor,
+				author: login,
+				...author?.__typename === "Bot" || login.endsWith("[bot]") ? { bot: true } : {},
+				...avatarUrl === void 0 ? {} : { avatarUrl },
+				body: body.slice(0, MAX_COMMENT_CHARS),
+				url: typeof comment.url === "string" ? comment.url : "",
+				...typeof comment.createdAt === "string" ? { createdAt: comment.createdAt } : {}
+			});
+			total += 1;
+		}
+		if (comments.length === 0) continue;
+		threads.push({
+			id: input.id,
+			...anchor,
+			resolved: input.isResolved === true,
+			outdated: input.isOutdated === true,
+			comments
+		});
+		if (threads.length >= MAX_THREADS || total >= MAX_COMMENTS) break;
+	}
+	return threads;
+}
+/** One posted reply, shaped like the thread comments it joins. */
+function parseReplyComment(value, anchor) {
+	const input = record$7(value);
+	if (input === void 0 || !Number.isSafeInteger(input.id)) return void 0;
+	const body = typeof input.body === "string" ? input.body.trim() : "";
+	if (body.length === 0) return void 0;
+	const user = record$7(input.user);
+	const avatarUrl = githubAvatarUrl(user?.avatar_url);
+	const login = typeof user?.login === "string" ? user.login : "unknown";
+	return {
+		id: Number(input.id),
+		...anchor,
+		author: login,
+		...user?.type === "Bot" || login.endsWith("[bot]") ? { bot: true } : {},
+		...avatarUrl === void 0 ? {} : { avatarUrl },
+		body: body.slice(0, MAX_COMMENT_CHARS),
+		url: typeof input.html_url === "string" ? input.html_url : "",
+		...typeof input.created_at === "string" ? { createdAt: input.created_at } : {}
+	};
+}
+function parseMentionableUsers(value) {
+	const nodes = record$7(record$7(record$7(record$7(value)?.data)?.repository)?.mentionableUsers)?.nodes;
+	if (!Array.isArray(nodes)) return [];
+	const users = [];
+	for (const item of nodes) {
+		const input = record$7(item);
+		if (input === void 0 || typeof input.login !== "string" || input.login.length === 0) continue;
+		const avatarUrl = githubAvatarUrl(input.avatarUrl);
+		users.push({
+			login: input.login,
+			...avatarUrl === void 0 ? {} : { avatarUrl }
 		});
-		if (comments.length >= MAX_COMMENTS) break;
+		if (users.length >= MAX_MENTIONABLE_USERS) break;
 	}
-	return comments;
+	return users;
 }
 /** Extract the Actions job id from a check run link, when it is one. */
 function actionsJobId(link) {
@@ -4398,7 +4991,7 @@ function parseFailingChecks(value) {
 	if (!Array.isArray(value)) return [];
 	const failing = [];
 	for (const item of value) {
-		const input = record$5(item);
+		const input = record$7(item);
 		if (input === void 0 || input.bucket !== "fail" || typeof input.name !== "string") continue;
 		failing.push({
 			name: input.name,
@@ -4420,22 +5013,103 @@ var PullRequestFeedbackService = class {
 	constructor(runtime) {
 		this.#runtime = runtime;
 	}
-	async comments(cwd, pullNumber) {
-		const repository = await this.#repository(cwd);
+	async threads(cwd, pullNumber) {
+		const { owner, name } = await this.#repositoryParts(cwd);
 		const gh = await this.#gh();
 		const result = await this.#run(gh, [
 			"api",
-			`repos/${repository}/pulls/${pullNumber}/comments`,
-			"--paginate"
+			"graphql",
+			"-f",
+			`owner=${owner}`,
+			"-f",
+			`name=${name}`,
+			"-F",
+			`number=${pullNumber}`,
+			"-f",
+			`query=${REVIEW_THREADS_QUERY}`
 		], cwd, GH_TIMEOUT_MS);
 		if (result.exitCode !== 0) throw new PullRequestFeedbackError("comments-unavailable", "Pull request comments could not be loaded.");
 		try {
-			const pages = result.stdout.replaceAll("][", ",");
-			return parseReviewComments(JSON.parse(pages));
+			return parseReviewThreads(JSON.parse(result.stdout));
 		} catch {
 			throw new PullRequestFeedbackError("comments-unavailable", "Pull request comments could not be parsed.");
 		}
 	}
+	/** Post a reply into the thread the given comment belongs to. GitHub parses
+	*  `@login` in the body server-side, so mentions need nothing from us. */
+	async reply(cwd, pullNumber, commentId, body) {
+		const text = body.trim();
+		if (text.length === 0 || text.length > MAX_REPLY_CHARS$1) throw new PullRequestFeedbackError("invalid-request", "The reply body is invalid.");
+		const repository = await this.#repository(cwd);
+		const gh = await this.#gh();
+		const result = await this.#run(gh, [
+			"api",
+			"-X",
+			"POST",
+			`repos/${repository}/pulls/${pullNumber}/comments/${commentId}/replies`,
+			"--input",
+			"-"
+		], cwd, GH_TIMEOUT_MS, JSON.stringify({ body: text }));
+		if (result.exitCode !== 0) throw new PullRequestFeedbackError("reply-failed", "The reply could not be posted.");
+		let posted;
+		try {
+			const parsed = JSON.parse(result.stdout);
+			const path = typeof record$7(parsed)?.path === "string" ? String(record$7(parsed)?.path) : "";
+			const line = Number.isSafeInteger(record$7(parsed)?.line) ? Number(record$7(parsed)?.line) : void 0;
+			posted = parseReplyComment(parsed, {
+				path,
+				...line === void 0 ? {} : { line },
+				side: record$7(parsed)?.side === "LEFT" ? "old" : "new"
+			});
+		} catch {
+			posted = void 0;
+		}
+		if (posted === void 0) throw new PullRequestFeedbackError("reply-failed", "The posted reply could not be read back.");
+		return posted;
+	}
+	/** Resolve or reopen a thread. Returns the state GitHub reports afterwards. */
+	async setResolved(cwd, threadId, resolved) {
+		const gh = await this.#gh();
+		const result = await this.#run(gh, [
+			"api",
+			"graphql",
+			"-f",
+			`threadId=${threadId}`,
+			"-f",
+			`query=${resolved ? RESOLVE_MUTATION : UNRESOLVE_MUTATION}`
+		], cwd, GH_TIMEOUT_MS);
+		if (result.exitCode !== 0) throw new PullRequestFeedbackError("resolve-failed", "The thread could not be updated.");
+		try {
+			const thread = record$7(record$7(record$7(record$7(JSON.parse(result.stdout))?.data)?.[resolved ? "resolveReviewThread" : "unresolveReviewThread"])?.thread);
+			if (typeof thread?.isResolved !== "boolean") throw new Error("missing state");
+			return thread.isResolved;
+		} catch {
+			throw new PullRequestFeedbackError("resolve-failed", "The thread state could not be read back.");
+		}
+	}
+	/** Logins GitHub would notify from this repository, for the reply composer. */
+	async mentionables(cwd, query) {
+		const { owner, name } = await this.#repositoryParts(cwd);
+		const gh = await this.#gh();
+		const result = await this.#run(gh, [
+			"api",
+			"graphql",
+			"-f",
+			`owner=${owner}`,
+			"-f",
+			`name=${name}`,
+			"-f",
+			`q=${query}`,
+			"-f",
+			`query=${MENTIONABLE_USERS_QUERY}`
+		], cwd, GH_TIMEOUT_MS);
+		if (result.exitCode !== 0) return [];
+		try {
+			return parseMentionableUsers(JSON.parse(result.stdout));
+		} catch {
+			return [];
+		}
+	}
 	async failingChecks(cwd, pullNumber) {
 		const gh = await this.#gh();
 		const result = await this.#run(gh, [
@@ -4483,6 +5157,16 @@ var PullRequestFeedbackService = class {
 		if (repository === void 0) throw new PullRequestFeedbackError("no-github-remote", "The repository has no GitHub origin remote.");
 		return repository;
 	}
+	/** GraphQL takes the owner and the name as separate variables, so they never
+	*  reach the query text itself. */
+	async #repositoryParts(cwd) {
+		const [owner, name] = (await this.#repository(cwd)).split("/");
+		if (owner === void 0 || name === void 0 || owner.length === 0 || name.length === 0) throw new PullRequestFeedbackError("no-github-remote", "The repository has no GitHub origin remote.");
+		return {
+			owner,
+			name
+		};
+	}
 	#git() {
 		this.#gitExecutable ??= this.#runtime.resolveExecutable("git");
 		return this.#gitExecutable;
@@ -4493,27 +5177,64 @@ var PullRequestFeedbackService = class {
 		});
 		return this.#ghExecutable;
 	}
-	#run(executable, args, cwd, timeoutMs) {
-		return collect(this.#runtime.spawn({
+	#run(executable, args, cwd, timeoutMs, input) {
+		const handle = this.#runtime.spawn({
 			argv: [executable, ...args],
 			cwd,
 			stdio: {
-				stdin: "ignore",
+				stdin: input === void 0 ? "ignore" : "pipe",
 				stdout: { maxBytes: MAX_OUTPUT_BYTES },
 				stderr: { maxBytes: 65536 }
 			},
 			graceMs: 1e3,
 			signal: AbortSignal.timeout(timeoutMs),
 			env: {}
-		}));
+		});
+		if (input !== void 0) handle.stdin?.end(input);
+		return collect(handle);
 	}
 };
 //#endregion
 //#region src/pr-feedback-routes.ts
-const MAX_SESSION_ID_CHARS$2 = 1024;
+const MAX_SESSION_ID_CHARS$3 = 1024;
+const MAX_BODY_BYTES$4 = 16384;
+const MAX_REPLY_CHARS = 2e3;
+const MAX_THREAD_ID_CHARS = 512;
+const MAX_MENTION_QUERY_CHARS = 64;
+function record$6(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+async function readJson$4(req) {
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of req) {
+		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+		size += buffer.length;
+		if (size > MAX_BODY_BYTES$4) throw new PullRequestFeedbackError("body-too-large", "The request body is too large.");
+		chunks.push(buffer);
+	}
+	const value = record$6(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+	if (value === void 0) throw new PullRequestFeedbackError("invalid-request", "The request body is invalid.");
+	return value;
+}
+function replyBody(input) {
+	const body = typeof input.body === "string" ? input.body.trim() : "";
+	if (body.length === 0 || body.length > MAX_REPLY_CHARS || body.includes("\0")) throw new PullRequestFeedbackError("invalid-request", "The reply body is invalid.");
+	return body;
+}
+function commentId(input) {
+	const value = input.commentId;
+	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new PullRequestFeedbackError("invalid-request", "The comment id is invalid.");
+	return value;
+}
+function threadId(input) {
+	const value = input.threadId;
+	if (typeof value !== "string" || value.length === 0 || value.length > MAX_THREAD_ID_CHARS) throw new PullRequestFeedbackError("invalid-request", "The thread id is invalid.");
+	return value;
+}
 function sessionId(url) {
 	const value = url.searchParams.get("sessionId");
-	if (value === null || value.length === 0 || value.length > MAX_SESSION_ID_CHARS$2) throw new PullRequestFeedbackError("invalid-session", "The session is invalid.");
+	if (value === null || value.length === 0 || value.length > MAX_SESSION_ID_CHARS$3) throw new PullRequestFeedbackError("invalid-session", "The session is invalid.");
 	return value;
 }
 function pullNumber(url) {
@@ -4527,19 +5248,43 @@ function registerPullRequestFeedbackRoute(ctx, service, cwdForSession) {
 		path: CLAUDE_REPOSITORY_FEEDBACK_PATH,
 		handler: async (req, res) => {
 			if (!trustedRequest(req)) return json(res, 403, { error: "forbidden" });
-			if (req.method !== "GET") return json(res, 405, { error: "method not allowed" });
 			const url = new URL(req.url ?? "/", "http://localhost");
+			const reads = req.method === "GET";
+			const writes = req.method === "POST";
 			try {
 				const cwd = cwdForSession(sessionId(url));
 				if (cwd === void 0) throw new PullRequestFeedbackError("session-unavailable", "The Claude session is unavailable.");
-				if (url.pathname === `/plugins/dsh-claude/repository/feedback/comments`) return json(res, 200, { comments: await service.comments(cwd, pullNumber(url)) });
-				if (url.pathname === `/plugins/dsh-claude/repository/feedback/checks`) return json(res, 200, { checks: await service.failingChecks(cwd, pullNumber(url)) });
+				if (url.pathname === `/plugins/dsh-claude/repository/feedback/comments`) {
+					if (!reads) return json(res, 405, { error: "method not allowed" });
+					return json(res, 200, { threads: await service.threads(cwd, pullNumber(url)) });
+				}
+				if (url.pathname === `/plugins/dsh-claude/repository/feedback/checks`) {
+					if (!reads) return json(res, 405, { error: "method not allowed" });
+					return json(res, 200, { checks: await service.failingChecks(cwd, pullNumber(url)) });
+				}
+				if (url.pathname === `/plugins/dsh-claude/repository/feedback/mentionables`) {
+					if (!reads) return json(res, 405, { error: "method not allowed" });
+					const query = (url.searchParams.get("q") ?? "").slice(0, MAX_MENTION_QUERY_CHARS);
+					return json(res, 200, { users: await service.mentionables(cwd, query) });
+				}
+				if (url.pathname === `/plugins/dsh-claude/repository/feedback/reply`) {
+					if (!writes) return json(res, 405, { error: "method not allowed" });
+					const input = await readJson$4(req);
+					return json(res, 200, { comment: await service.reply(cwd, pullNumber(url), commentId(input), replyBody(input)) });
+				}
+				if (url.pathname === `/plugins/dsh-claude/repository/feedback/resolve`) {
+					if (!writes) return json(res, 405, { error: "method not allowed" });
+					const input = await readJson$4(req);
+					if (typeof input.resolved !== "boolean") throw new PullRequestFeedbackError("invalid-request", "The resolved field is required.");
+					return json(res, 200, { resolved: await service.setResolved(cwd, threadId(input), input.resolved) });
+				}
 				return json(res, 404, { error: "not found" });
 			} catch (error) {
 				if (error instanceof PullRequestFeedbackError) return json(res, 409, {
 					error: error.code,
 					message: error.message
 				});
+				if (error instanceof SyntaxError) return json(res, 400, { error: "invalid-json" });
 				return json(res, 500, {
 					error: "pr-feedback-unavailable",
 					message: "Pull request feedback is unavailable."
@@ -4629,7 +5374,7 @@ var JiraError = class extends Error {
 		this.code = code;
 	}
 };
-function record$4(value) {
+function record$5(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 /** Jira Cloud sites are origins; Data Center may carry a context path. */
@@ -4647,6 +5392,30 @@ function ticketKeyOf(query) {
 	const match = /^([A-Za-z][A-Za-z0-9_]*)-(\d+)$/u.exec(query.trim());
 	return match === null ? void 0 : `${match[1].toUpperCase()}-${match[2]}`;
 }
+/** Jira's text index carries summary, description and comments -- never the
+*  issue key -- so a bare ticket number ("5697") can never reach PSOS-5697
+*  through `text ~`. The issue picker is the endpoint behind Jira's own quick
+*  search and does match keys; its hits become the key filter the normal
+*  search then reads the display fields from. */
+function pickerKeys(value, number) {
+	const sections = record$5(value)?.sections;
+	if (!Array.isArray(sections)) return [];
+	const keys = [];
+	for (const section of sections) {
+		const issues = record$5(section)?.issues;
+		if (!Array.isArray(issues)) continue;
+		for (const issue of issues) {
+			const raw = record$5(issue)?.key;
+			const key = ticketKeyOf(typeof raw === "string" ? raw : "");
+			if (key !== void 0 && key.endsWith(`-${number}`) && !keys.includes(key)) keys.push(key);
+		}
+	}
+	return keys;
+}
+/** Keys arrive validated by `ticketKeyOf`, so they cannot break out of the quotes. */
+function keyJql(keys) {
+	return `key in (${keys.map((key) => `"${key}"`).join(", ")}) ORDER BY updated DESC`;
+}
 function buildJql(query) {
 	const trimmed = query.trim().slice(0, MAX_QUERY_CHARS);
 	if (trimmed.length === 0) return "statusCategory != Done ORDER BY updated DESC";
@@ -4655,15 +5424,15 @@ function buildJql(query) {
 	return `text ~ "${trimmed.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"")}*" ORDER BY updated DESC`;
 }
 function parseTickets(value, siteUrl) {
-	const issues = record$4(value)?.issues;
+	const issues = record$5(value)?.issues;
 	if (!Array.isArray(issues)) return [];
 	const tickets = [];
 	for (const item of issues) {
-		const issue = record$4(item);
-		const fields = record$4(issue?.fields);
+		const issue = record$5(item);
+		const fields = record$5(issue?.fields);
 		if (issue === void 0 || typeof issue.key !== "string" || fields === void 0) continue;
-		const status = record$4(fields.status)?.name;
-		const type = record$4(fields.issuetype)?.name;
+		const status = record$5(fields.status)?.name;
+		const type = record$5(fields.issuetype)?.name;
 		tickets.push({
 			key: issue.key,
 			summary: typeof fields.summary === "string" ? fields.summary.slice(0, 256) : "",
@@ -4705,7 +5474,7 @@ var JiraService = class {
 			email,
 			apiToken
 		};
-		const myself = record$4(await this.#json(connection, "/rest/api/3/myself"));
+		const myself = record$5(await this.#json(connection, "/rest/api/3/myself"));
 		const displayName = typeof myself?.displayName === "string" ? myself.displayName : void 0;
 		const accountId = typeof myself?.accountId === "string" ? myself.accountId : void 0;
 		const store = {
@@ -4724,7 +5493,7 @@ var JiraService = class {
 		if (ticket === void 0) throw new JiraError("invalid-request", "The ticket key is invalid.");
 		let accountId = store.accountId;
 		if (accountId === void 0) {
-			const myself = record$4(await this.#json(store, "/rest/api/3/myself"));
+			const myself = record$5(await this.#json(store, "/rest/api/3/myself"));
 			if (typeof myself?.accountId !== "string") throw new JiraError("jira-failed", "The Jira account id is unavailable.");
 			accountId = myself.accountId;
 			await this.#write({
@@ -4744,7 +5513,7 @@ var JiraService = class {
 		const store = await this.#read();
 		if (store === void 0) throw new JiraError("not-connected", "Connect Jira in Settings first.");
 		const params = new URLSearchParams({
-			jql: buildJql(query),
+			jql: await this.#searchJql(store, query.trim().slice(0, MAX_QUERY_CHARS)),
 			maxResults: String(MAX_RESULTS),
 			fields: "summary,status,issuetype"
 		});
@@ -4757,6 +5526,14 @@ var JiraService = class {
 		}
 		return parseTickets(body, store.siteUrl);
 	}
+	/** A bare ticket number resolves through the picker; everything else is JQL.
+	*  A site that cannot serve the picker falls back to the text search rather
+	*  than failing the whole lookup. */
+	async #searchJql(store, query) {
+		if (!/^\d+$/u.test(query)) return buildJql(query);
+		const keys = await this.#json(store, `/rest/api/3/issue/picker?query=${encodeURIComponent(query)}`).then((body) => pickerKeys(body, query), () => []);
+		return keys.length === 0 ? buildJql(query) : keyJql(keys);
+	}
 	async #json(connection, path, init = {}) {
 		let response;
 		try {
@@ -4792,7 +5569,7 @@ var JiraService = class {
 			throw error;
 		}
 		if (Buffer.byteLength(text) > MAX_STORE_BYTES) return void 0;
-		const input = record$4(JSON.parse(text));
+		const input = record$5(JSON.parse(text));
 		if (input === void 0 || typeof input.siteUrl !== "string" || typeof input.email !== "string" || typeof input.apiToken !== "string") return void 0;
 		return {
 			siteUrl: input.siteUrl,
@@ -4823,20 +5600,20 @@ var JiraService = class {
 };
 //#endregion
 //#region src/jira-routes.ts
-const MAX_BODY_BYTES$2 = 8192;
-function record$3(value) {
+const MAX_BODY_BYTES$3 = 8192;
+function record$4(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
-async function readJson$2(req) {
+async function readJson$3(req) {
 	const chunks = [];
 	let size = 0;
 	for await (const chunk of req) {
 		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
 		size += buffer.length;
-		if (size > MAX_BODY_BYTES$2) throw new JiraError("body-too-large", "The request body is too large.");
+		if (size > MAX_BODY_BYTES$3) throw new JiraError("body-too-large", "The request body is too large.");
 		chunks.push(buffer);
 	}
-	const value = record$3(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+	const value = record$4(JSON.parse(Buffer.concat(chunks).toString("utf8")));
 	if (value === void 0) throw new JiraError("invalid-request", "The request body is invalid.");
 	return value;
 }
@@ -4859,7 +5636,7 @@ function registerJiraRoute(ctx, service) {
 				}
 				if (url.pathname === `/plugins/dsh-claude/jira/connect`) {
 					if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
-					const input = await readJson$2(req);
+					const input = await readJson$3(req);
 					return json(res, 200, await service.connect({
 						siteUrl: string(input, "siteUrl"),
 						email: string(input, "email"),
@@ -4873,7 +5650,7 @@ function registerJiraRoute(ctx, service) {
 				}
 				if (url.pathname === `/plugins/dsh-claude/jira/assign`) {
 					if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
-					const input = await readJson$2(req);
+					const input = await readJson$3(req);
 					await service.assignToMe(string(input, "key"));
 					return json(res, 200, { assigned: true });
 				}
@@ -4971,12 +5748,12 @@ function askArguments(preferences) {
 		...READ_ONLY_TOOLS
 	];
 }
-function record$2(value) {
+function record$3(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 /** One-line description of a tool call, mirroring the main window's step titles. */
 function toolSummary(input) {
-	const fields = record$2(input);
+	const fields = record$3(input);
 	if (fields === void 0) return void 0;
 	const candidate = [
 		fields.command,
@@ -4990,7 +5767,7 @@ function toolSummary(input) {
 function eventsOfStreamLine(line) {
 	let parsed;
 	try {
-		parsed = record$2(JSON.parse(line));
+		parsed = record$3(JSON.parse(line));
 	} catch {
 		return [];
 	}
@@ -5000,9 +5777,9 @@ function eventsOfStreamLine(line) {
 		text: "ready"
 	}];
 	if (parsed.type === "stream_event") {
-		const event = record$2(parsed.event);
+		const event = record$3(parsed.event);
 		if (event?.type === "content_block_start") {
-			const block = record$2(event.content_block);
+			const block = record$3(event.content_block);
 			if (block?.type === "tool_use" && typeof block.id === "string" && typeof block.name === "string") return [{
 				type: "tool",
 				id: block.id,
@@ -5011,7 +5788,7 @@ function eventsOfStreamLine(line) {
 			}];
 			return [];
 		}
-		const delta = record$2(event?.delta);
+		const delta = record$3(event?.delta);
 		if (event?.type !== "content_block_delta" || delta === void 0) return [];
 		if (delta.type === "text_delta" && typeof delta.text === "string") return [{
 			type: "text",
@@ -5024,11 +5801,11 @@ function eventsOfStreamLine(line) {
 		return [];
 	}
 	if (parsed.type === "assistant" || parsed.type === "user") {
-		const content = record$2(parsed.message)?.content;
+		const content = record$3(parsed.message)?.content;
 		if (!Array.isArray(content)) return [];
 		const events = [];
 		for (const item of content) {
-			const block = record$2(item);
+			const block = record$3(item);
 			if (block?.type === "tool_use" && typeof block.id === "string" && typeof block.name === "string") {
 				const summary = toolSummary(block.input);
 				events.push({
@@ -5120,21 +5897,21 @@ var AskService = class {
 };
 //#endregion
 //#region src/ask-routes.ts
-const MAX_BODY_BYTES$1 = 131072;
-const MAX_SESSION_ID_CHARS$1 = 1024;
-function record$1(value) {
+const MAX_BODY_BYTES$2 = 131072;
+const MAX_SESSION_ID_CHARS$2 = 1024;
+function record$2(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
-async function readJson$1(req) {
+async function readJson$2(req) {
 	const chunks = [];
 	let size = 0;
 	for await (const chunk of req) {
 		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
 		size += buffer.length;
-		if (size > MAX_BODY_BYTES$1) throw new AskError("body-too-large", "The request body is too large.");
+		if (size > MAX_BODY_BYTES$2) throw new AskError("body-too-large", "The request body is too large.");
 		chunks.push(buffer);
 	}
-	const value = record$1(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+	const value = record$2(JSON.parse(Buffer.concat(chunks).toString("utf8")));
 	if (value === void 0) throw new AskError("invalid-request", "The request body is invalid.");
 	return value;
 }
@@ -5162,12 +5939,12 @@ function registerAskRoute(ctx, service, cwdForSession, preferencesFor) {
 			let sessionId;
 			try {
 				const value = url.searchParams.get("sessionId");
-				if (value === null || value.length === 0 || value.length > MAX_SESSION_ID_CHARS$1) throw new AskError("invalid-session", "The session is invalid.");
+				if (value === null || value.length === 0 || value.length > MAX_SESSION_ID_CHARS$2) throw new AskError("invalid-session", "The session is invalid.");
 				sessionId = value;
 				const resolved = cwdForSession(sessionId);
 				if (resolved === void 0) throw new AskError("session-unavailable", "The Claude session is unavailable.");
 				cwd = resolved;
-				request = askRequest(await readJson$1(req));
+				request = askRequest(await readJson$2(req));
 			} catch (error) {
 				if (error instanceof AskError) return json(res, 409, {
 					error: error.code,
@@ -5211,27 +5988,27 @@ function registerAskRoute(ctx, service, cwdForSession, preferencesFor) {
 }
 //#endregion
 //#region src/review-comment-routes.ts
-const MAX_BODY_BYTES = 16384;
-const MAX_SESSION_ID_CHARS = 1024;
-function record(value) {
+const MAX_BODY_BYTES$1 = 16384;
+const MAX_SESSION_ID_CHARS$1 = 1024;
+function record$1(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
-async function readJson(req) {
+async function readJson$1(req) {
 	const chunks = [];
 	let size = 0;
 	for await (const chunk of req) {
 		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
 		size += buffer.length;
-		if (size > MAX_BODY_BYTES) throw new ReviewCommentError("body-too-large", "The request body is too large.");
+		if (size > MAX_BODY_BYTES$1) throw new ReviewCommentError("body-too-large", "The request body is too large.");
 		chunks.push(buffer);
 	}
-	const value = record(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+	const value = record$1(JSON.parse(Buffer.concat(chunks).toString("utf8")));
 	if (value === void 0) throw new ReviewCommentError("invalid-request", "The request body is invalid.");
 	return value;
 }
 function sessionIdFromUrl(url) {
 	const value = url.searchParams.get("sessionId");
-	if (value === null || value.length === 0 || value.length > MAX_SESSION_ID_CHARS) throw new ReviewCommentError("invalid-session", "The session is invalid.");
+	if (value === null || value.length === 0 || value.length > MAX_SESSION_ID_CHARS$1) throw new ReviewCommentError("invalid-session", "The session is invalid.");
 	return value;
 }
 function registerReviewCommentRoute(ctx, store, ownsSession) {
@@ -5245,7 +6022,7 @@ function registerReviewCommentRoute(ctx, store, ownsSession) {
 				const sessionId = sessionIdFromUrl(url);
 				if (!ownsSession(sessionId)) throw new ReviewCommentError("session-unavailable", "The Claude session is unavailable.");
 				if (url.pathname === "/plugins/dsh-claude/review-comments" && req.method === "POST") {
-					const input = await readJson(req);
+					const input = await readJson$1(req);
 					return json(res, 200, { comment: store.add(sessionId, {
 						path: input.path,
 						line: input.line,
@@ -5256,7 +6033,7 @@ function registerReviewCommentRoute(ctx, store, ownsSession) {
 				}
 				if (url.pathname === `/plugins/dsh-claude/review-comments/clear` && req.method === "POST") return json(res, 200, { removed: store.drain(sessionId).length });
 				if (url.pathname === `/plugins/dsh-claude/review-comments/remove` && req.method === "POST") {
-					const input = await readJson(req);
+					const input = await readJson$1(req);
 					if (typeof input.id !== "string" || input.id.length === 0 || input.id.length > 128) throw new ReviewCommentError("invalid-request", "The comment id is invalid.");
 					return json(res, 200, { removed: store.remove(sessionId, input.id) });
 				}
@@ -5276,6 +6053,99 @@ function registerReviewCommentRoute(ctx, store, ownsSession) {
 	}), "dsh-claude: review comment route");
 }
 //#endregion
+//#region src/client-diagnostics-routes.ts
+/** Enough for a message plus a trimmed stack; the client caps its own volume. */
+const MAX_DIAGNOSTIC_BYTES = 8192;
+const MAX_DETAIL_CHARS = 2e3;
+const MAX_KIND_CHARS = 60;
+async function readBody(req) {
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of req) {
+		const buffer = chunk;
+		size += buffer.length;
+		if (size > MAX_DIAGNOSTIC_BYTES) throw new Error("diagnostic too large");
+		chunks.push(buffer);
+	}
+	return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+}
+/** `POST <path>` with `{ kind, detail }`: write one renderer finding to the Host log.
+*
+*  The renderer has no other way to speak. A Slot entry that throws is caught
+*  by the Host's Slot system and dropped, the shipped Desktop opens no
+*  DevTools, and startup still reports `rendererStatus: "healthy"` — so a
+*  plugin whose UI died silently is indistinguishable from a working one.
+*  Every finding here is data written by this package's own client half, but
+*  it is still bounded and redacted like any other untrusted input. */
+function registerClaudeClientDiagnosticsRoute(ctx) {
+	ctx.effect(() => ctx.webServer.register({
+		kind: "exact",
+		path: CLAUDE_CLIENT_DIAGNOSTICS_PATH,
+		handler: async (req, res) => {
+			if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
+			if (!trustedRequest(req)) return json(res, 403, { error: "forbidden" });
+			try {
+				const body = await readBody(req);
+				const kind = typeof body?.kind === "string" ? body.kind.slice(0, MAX_KIND_CHARS) : "unknown";
+				const detail = typeof body?.detail === "string" ? body.detail : "";
+				if (detail === "") return json(res, 400, { error: "invalid-request" });
+				ctx.logger.warn(`dsh-claude client [${kind}]: ${redactText(detail, MAX_DETAIL_CHARS)}`);
+				return json(res, 200, { ok: true });
+			} catch (error) {
+				if (error instanceof SyntaxError) return json(res, 400, { error: "invalid-json" });
+				return json(res, 400, { error: "invalid-request" });
+			}
+		}
+	}), "dsh-claude: client diagnostics route");
+}
+//#endregion
+//#region src/rewind-routes.ts
+const MAX_BODY_BYTES = 4096;
+const MAX_SESSION_ID_CHARS = 1024;
+function record(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+async function readJson(req) {
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of req) {
+		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+		size += buffer.length;
+		if (size > MAX_BODY_BYTES) return void 0;
+		chunks.push(buffer);
+	}
+	return record(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+}
+/** `POST <path>` with `{ sessionId, seq }`: hide that surface event and every
+*  later one, and arm Claude to resume before the turn it opened. */
+function registerClaudeRewindRoute(ctx, sidecar, access) {
+	ctx.effect(() => ctx.webServer.register({
+		kind: "exact",
+		path: CLAUDE_REWIND_PATH,
+		handler: async (req, res) => {
+			if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
+			if (!trustedRequest(req)) return json(res, 403, { error: "forbidden" });
+			try {
+				const input = await readJson(req);
+				const sessionId = input?.sessionId;
+				const seq = input?.seq;
+				if (typeof sessionId !== "string" || sessionId.length === 0 || sessionId.length > MAX_SESSION_ID_CHARS || typeof seq !== "number" || !Number.isSafeInteger(seq) || seq < 0) return json(res, 400, { error: "invalid-request" });
+				const events = access.eventsFor(sessionId);
+				if (events === void 0) return json(res, 409, { error: "session-unavailable" });
+				if (access.busy(sessionId)) return json(res, 409, { error: "session-busy" });
+				const planned = planRewind((await sidecar.read(sessionId)).rewind ?? EMPTY_REWIND_STATE, events, seq);
+				if (planned === void 0) return json(res, 409, { error: "seq-unavailable" });
+				await sidecar.writeRewind(sessionId, planned);
+				await access.reset(sessionId);
+				return json(res, 200, { ranges: planned.ranges });
+			} catch (error) {
+				if (error instanceof SyntaxError) return json(res, 400, { error: "invalid-json" });
+				return json(res, 500, { error: "rewind-unavailable" });
+			}
+		}
+	}), "dsh-claude: rewind route");
+}
+//#endregion
 //#region src/update-routes.ts
 const PLUGIN_PACKAGE_NAME = "@norman-else/dsh-claude";
 const UPDATE_TIMEOUT_MS = 3e4;
@@ -6099,6 +6969,7 @@ async function apply(ctx, config) {
 	ctx.effect(() => () => supervisor.dispose(), "dsh-claude: process supervisor");
 	ctx.effect(() => () => repositoryStatus.dispose(), "dsh-claude: repository status cache");
 	ctx.inject(["webServer"], (webCtx) => {
+		registerClaudeClientDiagnosticsRoute(webCtx);
 		registerClaudeDoctorRoutes(webCtx, webCtx.subprocess, supervisor, supervisorConfig, resolutionError);
 		const desktopActions = webCtx.get("desktopActions");
 		registerClaudeUpdateRoutes(webCtx, webCtx.subprocess, { ...typeof desktopActions?.requestRestart === "function" ? { requestRestart: desktopActions.requestRestart.bind(desktopActions) } : {} });
@@ -6117,6 +6988,7 @@ async function apply(ctx, config) {
 			return agent.session.header.cwd;
 		};
 		registerRepositoryActionRoute(webCtx, repositoryActions, cwdForClaudeSession);
+		registerEditorOpenRoute(webCtx, new EditorOpenService(webCtx.subprocess), cwdForClaudeSession);
 		registerPullRequestFeedbackRoute(webCtx, new PullRequestFeedbackService(webCtx.subprocess), cwdForClaudeSession);
 		registerAskRoute(webCtx, new AskService(webCtx.subprocess, supervisorConfig.executablePath), cwdForClaudeSession, (sessionId) => {
 			const snapshot = supervisor.snapshots().find((item) => item.sessionId === sessionId);
@@ -6130,6 +7002,14 @@ async function apply(ctx, config) {
 			return agent !== void 0 && webCtx.agentPresets.composedPreset(agent.ctx) === "claude";
 		};
 		registerReviewCommentRoute(webCtx, reviewComments, ownsClaudeSession);
+		registerClaudeRewindRoute(webCtx, sidecar, {
+			eventsFor: (sessionId) => {
+				const agent = webCtx.agents.get(sessionId);
+				return agent === void 0 || webCtx.agentPresets.composedPreset(agent.ctx) !== "claude" ? void 0 : agent.session.events;
+			},
+			busy: (sessionId) => supervisor.snapshots().some((item) => item.sessionId === sessionId && (item.state === "running" || item.state === "interrupting")),
+			reset: (sessionId) => supervisor.disposeSession(sessionId)
+		});
 		registerPlanUsageRoute(webCtx, (fetchedAt) => probePlanUsage(supervisorConfig.executablePath, fetchedAt));
 		registerClaudeProjectionRoute(webCtx, sidecar, ownsClaudeSession, (sessionId) => commandCatalogs.get(sessionId) ?? [], async (sessionId) => {
 			const agent = webCtx.agents.get(sessionId);