@thacio/auditaria 0.28.0 → 0.30.1

package/bundle/mcp-bridge.js

@@ -17723,10 +17723,10 @@ function isTerminal(status) {
   return status === "completed" || status === "failed" || status === "cancelled";
 }
 
-// packages/core/node_modules/@modelcontextprotocol/sdk/node_modules/zod-to-json-schema/dist/esm/Options.js
+// node_modules/zod-to-json-schema/dist/esm/Options.js
 var ignoreOverride = Symbol("Let zodToJsonSchema decide on which parser to use");
 
-// packages/core/node_modules/@modelcontextprotocol/sdk/node_modules/zod-to-json-schema/dist/esm/parsers/string.js
+// node_modules/zod-to-json-schema/dist/esm/parsers/string.js
 var ALPHA_NUMERIC = new Set("ABCDEFGHIJKLMNOPQRSTUVXYZabcdefghijklmnopqrstuvxyz0123456789");
 
 // packages/core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js

package/bundle/policies/plan.toml

@@ -31,12 +31,12 @@
 decision = "deny"
 priority = 60
 modes = ["plan"]
-deny_message = "You are in Plan Mode - adjust your prompt to only use read and search tools."
+deny_message = "You are in Plan Mode with access to read-only tools. Execution of scripts (including those from skills) is blocked."
 
 # Explicitly Allow Read-Only Tools in Plan mode.
 
 [[rule]]
-toolName = ["glob", "grep_search", "list_directory", "read_file", "google_web_search"]
+toolName = ["glob", "grep_search", "list_directory", "read_file", "google_web_search", "activate_skill"]
 decision = "allow"
 priority = 70
 modes = ["plan"]
@@ -53,4 +53,4 @@ toolName = ["write_file", "replace"]
 decision = "allow"
 priority = 70
 modes = ["plan"]
-argsPattern = "\"file_path\":\"[^\"]+/\\.gemini/tmp/[a-zA-Z0-9_-]+/plans/[a-zA-Z0-9_-]+\\.md\""
+argsPattern = "\"file_path\":\"[^\"]+/\\.gemini/tmp/[a-zA-Z0-9_-]+/[a-zA-Z0-9_-]+/plans/[a-zA-Z0-9_-]+\\.md\""

package/bundle/policies/yolo.toml

@@ -23,10 +23,21 @@
 #   10: Write tools default to ASK_USER (becomes 1.010 in default tier)
 #   15: Auto-edit tool override (becomes 1.015 in default tier)
 #   50: Read-only tools (becomes 1.050 in default tier)
-#   999: YOLO mode allow-all (becomes 1.999 in default tier)
+#   998: YOLO mode allow-all (becomes 1.998 in default tier)
+#   999: Ask-user tool (becomes 1.999 in default tier)
 
+# Ask-user tool always requires user interaction, even in YOLO mode.
+# This ensures the model can gather user preferences/decisions when needed.
+# Note: In non-interactive mode, this decision is converted to DENY by the policy engine.
 [[rule]]
-decision = "allow"
+toolName = "ask_user"
+decision = "ask_user"
 priority = 999
 modes = ["yolo"]
+
+# Allow everything else in YOLO mode
+[[rule]]
+decision = "allow"
+priority = 998
+modes = ["yolo"]
 allow_redirection = true

package/bundle/{sandbox-macos-restrictive-closed.sb → sandbox-macos-strict-open.sb}

@@ -3,8 +3,43 @@
 ;; deny everything by default
 (deny default)
 
-;; allow reading files from anywhere on host
-(allow file-read*)
+;; allow reading ONLY from working directory, system paths, and essential user paths
+(allow file-read*
+    (literal "/")
+    (subpath (param "TARGET_DIR"))
+    (subpath (param "TMP_DIR"))
+    (subpath (param "CACHE_DIR"))
+    ;; Only allow reading essential dotfiles/directories under HOME, not the entire HOME
+    (subpath (string-append (param "HOME_DIR") "/.gemini"))
+    (subpath (string-append (param "HOME_DIR") "/.npm"))
+    (subpath (string-append (param "HOME_DIR") "/.cache"))
+    (literal (string-append (param "HOME_DIR") "/.gitconfig"))
+    (subpath (string-append (param "HOME_DIR") "/.nvm"))
+    (subpath (string-append (param "HOME_DIR") "/.fnm"))
+    (subpath (string-append (param "HOME_DIR") "/.node"))
+    (subpath (string-append (param "HOME_DIR") "/.config"))
+    ;; Allow reads from included directories
+    (subpath (param "INCLUDE_DIR_0"))
+    (subpath (param "INCLUDE_DIR_1"))
+    (subpath (param "INCLUDE_DIR_2"))
+    (subpath (param "INCLUDE_DIR_3"))
+    (subpath (param "INCLUDE_DIR_4"))
+    ;; System paths required for Node.js, shell, and common tools
+    (subpath "/usr")
+    (subpath "/bin")
+    (subpath "/sbin")
+    (subpath "/Library")
+    (subpath "/System")
+    (subpath "/private")
+    (subpath "/dev")
+    (subpath "/etc")
+    (subpath "/opt")
+    (subpath "/Applications")
+)
+
+;; allow path traversal everywhere (metadata only: stat/lstat, NOT readdir or file content)
+;; this is needed for Node.js module resolution to traverse intermediate directories
+(allow file-read-metadata)
 
 ;; allow exec/fork (children inherit policy)
 (allow process-exec)
@@ -70,7 +105,7 @@
     (subpath (string-append (param "HOME_DIR") "/.gemini"))
     (subpath (string-append (param "HOME_DIR") "/.npm"))
     (subpath (string-append (param "HOME_DIR") "/.cache"))
-    (subpath (string-append (param "HOME_DIR") "/.gitconfig"))
+    (literal (string-append (param "HOME_DIR") "/.gitconfig"))
     ;; Allow writes to included directories from --include-directories
     (subpath (param "INCLUDE_DIR_0"))
     (subpath (param "INCLUDE_DIR_1"))
@@ -90,4 +125,7 @@
 (allow file-ioctl (regex #"^/dev/tty.*"))
 
 ;; allow inbound network traffic on debugger port
-(allow network-inbound (local ip "localhost:9229"))
+(allow network-inbound (local ip "localhost:9229"))
+
+;; allow all outbound network traffic
+(allow network-outbound)

package/bundle/sandbox-macos-strict-proxied.sb

@@ -0,0 +1,133 @@
+(version 1)
+
+;; deny everything by default
+(deny default)
+
+;; allow reading ONLY from working directory, system paths, and essential user paths
+(allow file-read*
+    (literal "/")
+    (subpath (param "TARGET_DIR"))
+    (subpath (param "TMP_DIR"))
+    (subpath (param "CACHE_DIR"))
+    ;; Only allow reading essential dotfiles/directories under HOME, not the entire HOME
+    (subpath (string-append (param "HOME_DIR") "/.gemini"))
+    (subpath (string-append (param "HOME_DIR") "/.npm"))
+    (subpath (string-append (param "HOME_DIR") "/.cache"))
+    (literal (string-append (param "HOME_DIR") "/.gitconfig"))
+    (subpath (string-append (param "HOME_DIR") "/.nvm"))
+    (subpath (string-append (param "HOME_DIR") "/.fnm"))
+    (subpath (string-append (param "HOME_DIR") "/.node"))
+    (subpath (string-append (param "HOME_DIR") "/.config"))
+    ;; Allow reads from included directories
+    (subpath (param "INCLUDE_DIR_0"))
+    (subpath (param "INCLUDE_DIR_1"))
+    (subpath (param "INCLUDE_DIR_2"))
+    (subpath (param "INCLUDE_DIR_3"))
+    (subpath (param "INCLUDE_DIR_4"))
+    ;; System paths required for Node.js, shell, and common tools
+    (subpath "/usr")
+    (subpath "/bin")
+    (subpath "/sbin")
+    (subpath "/Library")
+    (subpath "/System")
+    (subpath "/private")
+    (subpath "/dev")
+    (subpath "/etc")
+    (subpath "/opt")
+    (subpath "/Applications")
+)
+
+;; allow path traversal everywhere (metadata only: stat/lstat, NOT readdir or file content)
+;; this is needed for Node.js module resolution to traverse intermediate directories
+(allow file-read-metadata)
+
+;; allow exec/fork (children inherit policy)
+(allow process-exec)
+(allow process-fork)
+
+;; allow signals to self, e.g. SIGPIPE on write to closed pipe
+(allow signal (target self))
+
+;; allow read access to specific information about system
+;; from https://source.chromium.org/chromium/chromium/src/+/main:sandbox/policy/mac/common.sb;l=273-319;drc=7b3962fe2e5fc9e2ee58000dc8fbf3429d84d3bd
+(allow sysctl-read
+  (sysctl-name "hw.activecpu")
+  (sysctl-name "hw.busfrequency_compat")
+  (sysctl-name "hw.byteorder")
+  (sysctl-name "hw.cacheconfig")
+  (sysctl-name "hw.cachelinesize_compat")
+  (sysctl-name "hw.cpufamily")
+  (sysctl-name "hw.cpufrequency_compat")
+  (sysctl-name "hw.cputype")
+  (sysctl-name "hw.l1dcachesize_compat")
+  (sysctl-name "hw.l1icachesize_compat")
+  (sysctl-name "hw.l2cachesize_compat")
+  (sysctl-name "hw.l3cachesize_compat")
+  (sysctl-name "hw.logicalcpu_max")
+  (sysctl-name "hw.machine")
+  (sysctl-name "hw.ncpu")
+  (sysctl-name "hw.nperflevels")
+  (sysctl-name "hw.optional.arm.FEAT_BF16")
+  (sysctl-name "hw.optional.arm.FEAT_DotProd")
+  (sysctl-name "hw.optional.arm.FEAT_FCMA")
+  (sysctl-name "hw.optional.arm.FEAT_FHM")
+  (sysctl-name "hw.optional.arm.FEAT_FP16")
+  (sysctl-name "hw.optional.arm.FEAT_I8MM")
+  (sysctl-name "hw.optional.arm.FEAT_JSCVT")
+  (sysctl-name "hw.optional.arm.FEAT_LSE")
+  (sysctl-name "hw.optional.arm.FEAT_RDM")
+  (sysctl-name "hw.optional.arm.FEAT_SHA512")
+  (sysctl-name "hw.optional.armv8_2_sha512")
+  (sysctl-name "hw.packages")
+  (sysctl-name "hw.pagesize_compat")
+  (sysctl-name "hw.physicalcpu_max")
+  (sysctl-name "hw.tbfrequency_compat")
+  (sysctl-name "hw.vectorunit")
+  (sysctl-name "kern.hostname")
+  (sysctl-name "kern.maxfilesperproc")
+  (sysctl-name "kern.osproductversion")
+  (sysctl-name "kern.osrelease")
+  (sysctl-name "kern.ostype")
+  (sysctl-name "kern.osvariant_status")
+  (sysctl-name "kern.osversion")
+  (sysctl-name "kern.secure_kernel")
+  (sysctl-name "kern.usrstack64")
+  (sysctl-name "kern.version")
+  (sysctl-name "sysctl.proc_cputype")
+  (sysctl-name-prefix "hw.perflevel")
+)
+
+;; allow writes to specific paths
+(allow file-write*
+    (subpath (param "TARGET_DIR"))
+    (subpath (param "TMP_DIR"))
+    (subpath (param "CACHE_DIR"))
+    (subpath (string-append (param "HOME_DIR") "/.gemini"))
+    (subpath (string-append (param "HOME_DIR") "/.npm"))
+    (subpath (string-append (param "HOME_DIR") "/.cache"))
+    (literal (string-append (param "HOME_DIR") "/.gitconfig"))
+    ;; Allow writes to included directories from --include-directories
+    (subpath (param "INCLUDE_DIR_0"))
+    (subpath (param "INCLUDE_DIR_1"))
+    (subpath (param "INCLUDE_DIR_2"))
+    (subpath (param "INCLUDE_DIR_3"))
+    (subpath (param "INCLUDE_DIR_4"))
+    (literal "/dev/stdout")
+    (literal "/dev/stderr")
+    (literal "/dev/null")
+)
+
+;; allow communication with sysmond for process listing (e.g. for pgrep)
+(allow mach-lookup (global-name "com.apple.sysmond"))
+
+;; enable terminal access required by ink
+;; fixes setRawMode EPERM failure (at node:tty:81:24)
+(allow file-ioctl (regex #"^/dev/tty.*"))
+
+;; allow inbound network traffic on debugger port
+(allow network-inbound (local ip "localhost:9229"))
+
+;; allow outbound network traffic through proxy on localhost:8877
+;; set `GEMINI_SANDBOX_PROXY_COMMAND=<command>` to run proxy alongside sandbox
+;; proxy must listen on :::8877 (see docs/examples/proxy-script.md)
+(allow network-outbound (remote tcp "localhost:8877"))

package/bundle/web-client/client.js

@@ -17,6 +17,7 @@ import { attachmentCacheManager } from './managers/AttachmentCacheManager.js';
 import { ttsManager } from './providers/tts/TTSManager.js';
 import { ConfirmationQueue } from './confirmation-queue.js';
 import { SlashAutocompleteManager } from './managers/SlashAutocompleteManager.js';
+import { InputHistoryManager } from './managers/InputHistoryManager.js';
 import { themeManager } from './utils/theme-manager.js';
 import { layoutManager } from './utils/layout-manager.js';
 import { showErrorToast, showInfoToast } from './components/Toast.js';
@@ -60,6 +61,9 @@ class AuditariaWebClient {
         // Initialize slash command autocomplete (after UI init)
         this.slashAutocomplete = null; // Will be initialized after UI elements are ready
 
+        // Initialize input history (ArrowUp/Down navigation)
+        this.inputHistory = new InputHistoryManager();
+
         // State properties
         this.hasFooterData = false;
         this.latestFooterData = null;
@@ -188,6 +192,10 @@ class AuditariaWebClient {
         
         this.wsManager.addEventListener('history_item', (e) => {
             this.messageManager.addHistoryItem(e.detail);
+            // Track user messages for input history (captures CLI-side inputs too)
+            if (e.detail.type === 'user' && e.detail.text) {
+                this.inputHistory.addInput(e.detail.text);
+            }
         });
         
         // WEB_INTERFACE: Unified response state replaces fragmented pending_item
@@ -236,6 +244,20 @@ class AuditariaWebClient {
         
         this.wsManager.addEventListener('history_sync', (e) => {
             this.messageManager.loadHistoryItems(e.detail.history);
+            // Fallback: populate input history from conversation history
+            // (overridden by input_history_sync if the CLI sends it)
+            if (this.inputHistory.length === 0) {
+                const userMessages = (e.detail.history || [])
+                    .filter(item => item.type === 'user' && item.text)
+                    .map(item => item.text.trim())
+                    .filter(Boolean);
+                this.inputHistory.loadHistory(userMessages);
+            }
+        });
+
+        // Input history sync from CLI (includes past sessions — shared with CLI's ArrowUp/Down)
+        this.wsManager.addEventListener('input_history_sync', (e) => {
+            this.inputHistory.loadHistory(e.detail.history || []);
         });
         
         this.wsManager.addEventListener('loading_state', (e) => {
@@ -309,6 +331,32 @@ class AuditariaWebClient {
             if (event.key === 'Enter' && !event.shiftKey) {
                 event.preventDefault();
                 this.sendMessage();
+                return;
+            }
+
+            // ArrowUp/Down — input history navigation
+            if (event.key === 'ArrowUp' && this._cursorOnFirstLine()) {
+                const text = this.inputHistory.navigateUp(this.messageInput.value);
+                if (text !== null) {
+                    event.preventDefault();
+                    this.messageInput.value = text;
+                    this.autoResizeTextarea();
+                    // Place cursor at end
+                    this.messageInput.setSelectionRange(text.length, text.length);
+                }
+                return;
+            }
+
+            if (event.key === 'ArrowDown' && this._cursorOnLastLine()) {
+                const text = this.inputHistory.navigateDown();
+                if (text !== null) {
+                    event.preventDefault();
+                    this.messageInput.value = text;
+                    this.autoResizeTextarea();
+                    // Place cursor at end
+                    this.messageInput.setSelectionRange(text.length, text.length);
+                }
+                return;
             }
         });
 
@@ -405,6 +453,8 @@ class AuditariaWebClient {
         
         // Send message with attachments (but not for slash commands)
         if (this.wsManager.sendUserMessage(message, isSlashCommand ? [] : this.attachments)) {
+            // Track input for ArrowUp/Down history
+            this.inputHistory.addInput(message);
             this.messageInput.value = '';
             // Only clear attachments if we're not sending a slash command
             if (!isSlashCommand) {
@@ -1106,21 +1156,39 @@ class AuditariaWebClient {
             const section = document.createElement('div');
             section.className = 'web-footer-model-menu-section';
             const isCodexGroup = group.id === 'codex';
+            const isAvailable = group.available !== false; // AUDITARIA_PROVIDER_AVAILABILITY: Default to true for backwards compatibility
 
             const title = document.createElement('div');
             title.className = 'web-footer-model-menu-title';
             title.textContent = group.label;
             section.append(title);
 
+            // AUDITARIA_PROVIDER_AVAILABILITY: Show install message for unavailable providers
+            if (!isAvailable && group.installMessage) {
+                const installMsg = document.createElement('div');
+                installMsg.className = 'web-footer-model-menu-install-message';
+                installMsg.textContent = group.installMessage;
+                section.append(installMsg);
+            }
+
             for (const option of group.options || []) {
                 const item = document.createElement('div');
                 item.className = 'web-footer-model-menu-item';
-                item.setAttribute('role', 'button');
-                item.setAttribute('tabindex', '0');
+
+                // AUDITARIA_PROVIDER_AVAILABILITY: Disable unavailable providers
+                if (!isAvailable) {
+                    item.classList.add('is-disabled');
+                    item.setAttribute('aria-disabled', 'true');
+                    item.title = `${option.label} (not available - install required)`;
+                } else {
+                    item.setAttribute('role', 'button');
+                    item.setAttribute('tabindex', '0');
+                    item.title = option.description || option.label;
+                }
+
                 if (option.selection === this.modelMenuData.activeSelection) {
                     item.classList.add('is-active');
                 }
-                item.title = option.description || option.label;
                 if (isCodexGroup) {
                     item.classList.add('web-footer-model-menu-item-codex');
                 }
@@ -1231,6 +1299,11 @@ class AuditariaWebClient {
                 }
 
                 item.addEventListener('click', () => {
+                    // AUDITARIA_PROVIDER_AVAILABILITY: Prevent selection of unavailable providers
+                    if (!isAvailable) {
+                        return;
+                    }
+
                     if (isCodexGroup) {
                         const state = this.getCodexEffortStateForSelection(option.selection);
                         this.wsManager.sendModelSelection(
@@ -1492,6 +1565,26 @@ class AuditariaWebClient {
         this.messageInput.style.height = 'auto';
         this.messageInput.style.height = Math.min(this.messageInput.scrollHeight, 120) + 'px';
     }
+
+    /**
+     * Returns true when the caret is on the first line of the textarea
+     * (or the textarea is empty), so ArrowUp should navigate history.
+     */
+    _cursorOnFirstLine() {
+        const { value, selectionStart } = this.messageInput;
+        // On first line if no newline before the cursor
+        return value.substring(0, selectionStart).indexOf('\n') === -1;
+    }
+
+    /**
+     * Returns true when the caret is on the last line of the textarea
+     * (or the textarea is empty), so ArrowDown should navigate history.
+     */
+    _cursorOnLastLine() {
+        const { value, selectionStart } = this.messageInput;
+        // On last line if no newline after the cursor
+        return value.substring(selectionStart).indexOf('\n') === -1;
+    }
     
     handleConfirmationResponse(callId, outcome, payload) {
         this.wsManager.sendConfirmationResponse(callId, outcome, payload);

package/bundle/web-client/components/DiffContextMenu.js

@@ -0,0 +1,252 @@
+/**
+ * @license
+ * Copyright 2025 Thacio
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { ContextMenu } from './ContextMenu.js';
+
+/**
+ * DiffContextMenu — right-click context menu for diff editors.
+ *
+ * Attaches to a Monaco diff editor's modified side.
+ * When the cursor is on a changed hunk:
+ *   - Shows "Revert This Change", "Copy Original", "Revert All Changes"
+ * When the cursor is NOT on a hunk:
+ *   - Falls through to Monaco's native context menu
+ *
+ * All reverts use executeEdits() so Ctrl+Z works.
+ */
+export class DiffContextMenu {
+  /**
+   * @param {object} diffEditor - Monaco IDiffEditor instance
+   * @param {object} monaco - Monaco namespace (for Range, etc.)
+   */
+  constructor(diffEditor, monaco) {
+    this.diffEditor = diffEditor;
+    this.monaco = monaco;
+    this.contextMenu = new ContextMenu();
+    this.disposables = [];
+
+    this.attach();
+  }
+
+  /**
+   * Attach the context menu listener to the modified (right) editor
+   */
+  attach() {
+    const modifiedEditor = this.diffEditor.getModifiedEditor();
+
+    const disposable = modifiedEditor.onContextMenu((e) => {
+      const position = e.target?.position;
+      if (!position) return;
+
+      const hunk = this.findHunkAtLine(position.lineNumber);
+      if (!hunk) {
+        // Not on a hunk — let Monaco's native context menu handle it
+        return;
+      }
+
+      // On a changed hunk — suppress Monaco's menu and show ours
+      e.event.preventDefault();
+      e.event.stopPropagation();
+
+      const items = this.buildMenuItems(hunk);
+      this.contextMenu.show(
+        e.event.posx ?? e.event.clientX ?? e.event.browserEvent?.clientX ?? 0,
+        e.event.posy ?? e.event.clientY ?? e.event.browserEvent?.clientY ?? 0,
+        items
+      );
+    });
+
+    this.disposables.push(disposable);
+  }
+
+  /**
+   * Find the diff hunk containing the given line number (in the modified editor)
+   * @param {number} lineNumber
+   * @returns {object|null} The matching ILineChange or null
+   */
+  findHunkAtLine(lineNumber) {
+    const changes = this.diffEditor.getLineChanges();
+    if (!changes) return null;
+
+    for (const change of changes) {
+      // Modification or insertion: modifiedEndLineNumber > 0
+      if (change.modifiedEndLineNumber > 0) {
+        if (lineNumber >= change.modifiedStartLineNumber &&
+            lineNumber <= change.modifiedEndLineNumber) {
+          return change;
+        }
+      }
+      // Deletion: modifiedEndLineNumber === 0, lines only exist in original
+      // The deletion marker sits at modifiedStartLineNumber (the line after which content was deleted)
+      else if (change.modifiedEndLineNumber === 0) {
+        if (lineNumber === change.modifiedStartLineNumber ||
+            lineNumber === change.modifiedStartLineNumber + 1) {
+          return change;
+        }
+      }
+    }
+
+    return null;
+  }
+
+  /**
+   * Build context menu items for a hunk
+   * @param {object} hunk - ILineChange
+   * @returns {Array} Menu items
+   */
+  buildMenuItems(hunk) {
+    const items = [
+      {
+        label: 'Revert This Change',
+        icon: 'codicon codicon-discard',
+        action: () => this.revertHunk(hunk)
+      },
+      {
+        label: 'Copy Original',
+        icon: 'codicon codicon-copy',
+        action: () => this.copyOriginal(hunk)
+      },
+      { separator: true },
+      {
+        label: 'Revert All Changes',
+        icon: 'codicon codicon-clear-all',
+        action: () => this.revertAll()
+      }
+    ];
+
+    return items;
+  }
+
+  /**
+   * Revert a single hunk: replace modified lines with original lines.
+   * Uses executeEdits for undo stack integration (Ctrl+Z works).
+   * @param {object} hunk - ILineChange
+   */
+  revertHunk(hunk) {
+    const { Range } = this.monaco;
+    const modifiedEditor = this.diffEditor.getModifiedEditor();
+    const modifiedModel = modifiedEditor.getModel();
+    const originalModel = this.diffEditor.getOriginalEditor().getModel();
+
+    if (!modifiedModel || !originalModel) return;
+
+    let editRange;
+    let originalText;
+
+    if (hunk.originalEndLineNumber === 0) {
+      // Pure insertion — content only in modified, nothing in original.
+      // Delete the inserted lines from modified.
+      const lastCol = modifiedModel.getLineMaxColumn(hunk.modifiedEndLineNumber);
+
+      if (hunk.modifiedStartLineNumber === 1) {
+        // Insertion at very beginning — delete lines and the trailing newline
+        const nextLineExists = hunk.modifiedEndLineNumber < modifiedModel.getLineCount();
+        editRange = new Range(
+          1, 1,
+          nextLineExists ? hunk.modifiedEndLineNumber + 1 : hunk.modifiedEndLineNumber,
+          nextLineExists ? 1 : lastCol
+        );
+      } else {
+        // Delete from end of previous line (to eat the newline) through end of last inserted line
+        const prevLineLastCol = modifiedModel.getLineMaxColumn(hunk.modifiedStartLineNumber - 1);
+        editRange = new Range(
+          hunk.modifiedStartLineNumber - 1, prevLineLastCol,
+          hunk.modifiedEndLineNumber, lastCol
+        );
+      }
+
+      originalText = '';
+    } else if (hunk.modifiedEndLineNumber === 0) {
+      // Pure deletion — content only in original, nothing in modified.
+      // Insert the original lines into modified.
+      const origLastCol = originalModel.getLineMaxColumn(hunk.originalEndLineNumber);
+      originalText = originalModel.getValueInRange(
+        new Range(hunk.originalStartLineNumber, 1, hunk.originalEndLineNumber, origLastCol)
+      );
+
+      // Insert after modifiedStartLineNumber (the deletion marker line)
+      const insertLine = hunk.modifiedStartLineNumber;
+      const insertCol = modifiedModel.getLineMaxColumn(insertLine);
+      editRange = new Range(insertLine, insertCol, insertLine, insertCol);
+      originalText = '\n' + originalText;
+    } else {
+      // Modification — replace modified lines with original lines
+      const origLastCol = originalModel.getLineMaxColumn(hunk.originalEndLineNumber);
+      originalText = originalModel.getValueInRange(
+        new Range(hunk.originalStartLineNumber, 1, hunk.originalEndLineNumber, origLastCol)
+      );
+
+      const modLastCol = modifiedModel.getLineMaxColumn(hunk.modifiedEndLineNumber);
+      editRange = new Range(
+        hunk.modifiedStartLineNumber, 1,
+        hunk.modifiedEndLineNumber, modLastCol
+      );
+    }
+
+    modifiedEditor.executeEdits('revert-change', [{
+      range: editRange,
+      text: originalText
+    }]);
+  }
+
+  /**
+   * Copy the original (left-side) content of a hunk to clipboard
+   * @param {object} hunk - ILineChange
+   */
+  copyOriginal(hunk) {
+    const { Range } = this.monaco;
+    const originalModel = this.diffEditor.getOriginalEditor().getModel();
+    if (!originalModel) return;
+
+    if (hunk.originalEndLineNumber === 0) {
+      // Pure insertion — no original content to copy
+      return;
+    }
+
+    const origLastCol = originalModel.getLineMaxColumn(hunk.originalEndLineNumber);
+    const text = originalModel.getValueInRange(
+      new Range(hunk.originalStartLineNumber, 1, hunk.originalEndLineNumber, origLastCol)
+    );
+
+    navigator.clipboard.writeText(text).catch((err) => {
+      console.warn('Failed to copy to clipboard:', err);
+    });
+  }
+
+  /**
+   * Revert all changes: replace entire modified content with original content
+   */
+  revertAll() {
+    const modifiedEditor = this.diffEditor.getModifiedEditor();
+    const modifiedModel = modifiedEditor.getModel();
+    const originalModel = this.diffEditor.getOriginalEditor().getModel();
+
+    if (!modifiedModel || !originalModel) return;
+
+    const originalText = originalModel.getValue();
+    const fullRange = modifiedModel.getFullModelRange();
+
+    modifiedEditor.executeEdits('revert-all', [{
+      range: fullRange,
+      text: originalText
+    }]);
+  }
+
+  /**
+   * Dispose all listeners and the context menu
+   */
+  dispose() {
+    for (const d of this.disposables) {
+      d.dispose();
+    }
+    this.disposables = [];
+
+    if (this.contextMenu) {
+      this.contextMenu.destroy();
+      this.contextMenu = null;
+    }
+  }
+}