@xbghc/warden 0.13.1 → 0.15.0

package/dist/cli.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 
 // bin/cli.ts
-import path10 from "path";
+import path11 from "path";
 import { spawn } from "child_process";
 import { existsSync as existsSync2 } from "fs";
 import { fileURLToPath } from "url";
 
 // packages/server/src/index.ts
 import net from "net";
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 
 // node_modules/.pnpm/@hono+node-server@1.19.17_hono@4.13.7/node_modules/@hono/node-server/dist/index.mjs
 import { createServer as createServerHTTP } from "http";
@@ -652,8 +652,8 @@ var serve = (options, listeningListener) => {
 };
 
 // packages/server/src/app.ts
-import path8 from "path";
-import { randomUUID } from "crypto";
+import path9 from "path";
+import { randomUUID as randomUUID2 } from "crypto";
 
 // node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/compose.js
 var compose = (middleware, onError, onNotFound) => {
@@ -812,26 +812,26 @@ var throwNestingLimitExceeded = () => {
 };
 
 // node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/utils/url.js
-var splitPath = (path11) => {
-  const paths = path11.split("/");
+var splitPath = (path12) => {
+  const paths = path12.split("/");
   if (paths[0] === "") {
     paths.shift();
   }
   return paths;
 };
 var splitRoutingPath = (routePath) => {
-  const { groups, path: path11 } = extractGroupsFromPath(routePath);
-  const paths = splitPath(path11);
+  const { groups, path: path12 } = extractGroupsFromPath(routePath);
+  const paths = splitPath(path12);
   return replaceGroupMarks(paths, groups);
 };
-var extractGroupsFromPath = (path11) => {
+var extractGroupsFromPath = (path12) => {
   const groups = [];
-  path11 = path11.replace(/\{[^}]+\}/g, (match2, index) => {
+  path12 = path12.replace(/\{[^}]+\}/g, (match2, index) => {
     const mark = `@${index}`;
     groups.push([mark, match2]);
     return mark;
   });
-  return { groups, path: path11 };
+  return { groups, path: path12 };
 };
 var replaceGroupMarks = (paths, groups) => {
   for (let i = groups.length - 1; i >= 0; i--) {
@@ -888,8 +888,8 @@ var getPath = (request) => {
       const queryIndex = url.indexOf("?", i);
       const hashIndex = url.indexOf("#", i);
       const end = queryIndex === -1 ? hashIndex === -1 ? void 0 : hashIndex : hashIndex === -1 ? queryIndex : Math.min(queryIndex, hashIndex);
-      const path11 = url.slice(start, end);
-      return tryDecodeURI(path11.includes("%25") ? path11.replace(/%25/g, "%2525") : path11);
+      const path12 = url.slice(start, end);
+      return tryDecodeURI(path12.includes("%25") ? path12.replace(/%25/g, "%2525") : path12);
     } else if (charCode === 63 || charCode === 35) {
       break;
     }
@@ -906,11 +906,11 @@ var mergePath = (base, sub, ...rest) => {
   }
   return `${base?.[0] === "/" ? "" : "/"}${base}${sub === "/" ? "" : `${base?.at(-1) === "/" ? "" : "/"}${sub?.[0] === "/" ? sub.slice(1) : sub}`}`;
 };
-var checkOptionalParameter = (path11) => {
-  if (path11.charCodeAt(path11.length - 1) !== 63 || !path11.includes(":")) {
+var checkOptionalParameter = (path12) => {
+  if (path12.charCodeAt(path12.length - 1) !== 63 || !path12.includes(":")) {
     return null;
   }
-  const segments = path11.split("/");
+  const segments = path12.split("/");
   const results = [];
   let basePath = "";
   segments.forEach((segment) => {
@@ -1052,9 +1052,9 @@ var HonoRequest = class {
    */
   path;
   bodyCache = {};
-  constructor(request, path11 = "/", matchResult = [[]]) {
+  constructor(request, path12 = "/", matchResult = [[]]) {
     this.raw = request;
-    this.path = path11;
+    this.path = path12;
     this.#matchResult = matchResult;
   }
   param(key) {
@@ -1826,8 +1826,8 @@ var Hono = class _Hono {
         return this;
       };
     });
-    this.on = (method, path11, ...handlers) => {
-      for (const p of [path11].flat()) {
+    this.on = (method, path12, ...handlers) => {
+      for (const p of [path12].flat()) {
         this.#path = p;
         for (const m of [method].flat()) {
           const methodName = m.toUpperCase();
@@ -1885,8 +1885,8 @@ var Hono = class _Hono {
    * app.route("/api", app2) // GET /api/user
    * ```
    */
-  route(path11, app) {
-    const subApp = this.basePath(path11);
+  route(path12, app) {
+    const subApp = this.basePath(path12);
     app.routes.map((r) => {
       let handler;
       if (app.errorHandler === errorHandler) {
@@ -1912,9 +1912,9 @@ var Hono = class _Hono {
    * const api = new Hono().basePath('/api')
    * ```
    */
-  basePath(path11) {
+  basePath(path12) {
     const subApp = this.#clone();
-    subApp._basePath = mergePath(this._basePath, path11);
+    subApp._basePath = mergePath(this._basePath, path12);
     return subApp;
   }
   /**
@@ -1988,7 +1988,7 @@ var Hono = class _Hono {
    * })
    * ```
    */
-  mount(path11, applicationHandler, options) {
+  mount(path12, applicationHandler, options) {
     let replaceRequest;
     let optionHandler;
     if (options) {
@@ -2015,7 +2015,7 @@ var Hono = class _Hono {
       return [c.env, executionContext];
     };
     replaceRequest ||= (() => {
-      const mergedPath = mergePath(this._basePath, path11);
+      const mergedPath = mergePath(this._basePath, path12);
       const pathPrefixLength = mergedPath === "/" ? 0 : mergedPath.length;
       return (request) => {
         const url = new URL(request.url);
@@ -2030,18 +2030,18 @@ var Hono = class _Hono {
       }
       await next();
     };
-    this.#addRoute(METHOD_NAME_ALL, mergePath(path11, "*"), handler);
+    this.#addRoute(METHOD_NAME_ALL, mergePath(path12, "*"), handler);
     return this;
   }
-  #addRoute(method, path11, handler, baseRoutePath) {
-    path11 = mergePath(this._basePath, path11);
+  #addRoute(method, path12, handler, baseRoutePath) {
+    path12 = mergePath(this._basePath, path12);
     const r = {
       basePath: baseRoutePath !== void 0 ? mergePath(this._basePath, baseRoutePath) : this._basePath,
-      path: path11,
+      path: path12,
       method,
       handler
     };
-    this.router.add(method, path11, [handler, r]);
+    this.router.add(method, path12, [handler, r]);
     this.routes.push(r);
   }
   #handleError(err, c) {
@@ -2054,10 +2054,10 @@ var Hono = class _Hono {
     if (method === "HEAD") {
       return (async () => new Response(null, await this.#dispatch(request, executionCtx, env, "GET")))();
     }
-    const path11 = this.getPath(request, { env });
-    const matchResult = this.router.match(method, path11);
+    const path12 = this.getPath(request, { env });
+    const matchResult = this.router.match(method, path12);
     const c = new Context(request, {
-      path: path11,
+      path: path12,
       matchResult,
       env,
       executionCtx,
@@ -2160,7 +2160,7 @@ var createNullObject = () => /* @__PURE__ */ Object.create(null);
 
 // node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/router/reg-exp-router/matcher.js
 var emptyParam = [];
-function match(method, path11) {
+function match(method, path12) {
   const matchers = this.buildAllMatchers();
   const match2 = ((method2, path22) => {
     const matcher = matchers[method2] || matchers[METHOD_NAME_ALL];
@@ -2176,7 +2176,7 @@ function match(method, path11) {
     return [matcher[1][index], match3];
   });
   this.match = match2;
-  return match2(method, path11);
+  return match2(method, path12);
 }
 
 // node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/router/reg-exp-router/node.js
@@ -2293,14 +2293,14 @@ var Trie = class {
   #index = 0;
   // dynamic path -> [handler index, param assoc]; static paths are not registered
   paths = createNullObject();
-  insert(path11, isStatic) {
+  insert(path12, isStatic) {
     if (isStatic) {
-      this.#root.insert(path11.split(""), 0, [], this.#context, true);
+      this.#root.insert(path12.split(""), 0, [], this.#context, true);
       return;
     }
     const paramAssoc = [];
     const groups = [];
-    let markedPath = path11;
+    let markedPath = path12;
     for (let i = 0; ; ) {
       let replaced = false;
       markedPath = markedPath.replace(/\{[^}]+\}/g, (m) => {
@@ -2325,7 +2325,7 @@ var Trie = class {
       }
     }
     this.#root.insert(tokens, this.#index, paramAssoc, this.#context, false);
-    this.paths[path11] = [this.#index++, paramAssoc];
+    this.paths[path12] = [this.#index++, paramAssoc];
   }
   buildRegExp() {
     let regexp = this.#root.buildRegExpStr();
@@ -2352,17 +2352,17 @@ var Trie = class {
 
 // node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/router/reg-exp-router/router.js
 var wildcardRegExpCache = createNullObject();
-function buildWildcardRegExp(path11) {
-  return wildcardRegExpCache[path11] ??= new RegExp(
-    `^${path11.replace(
+function buildWildcardRegExp(path12) {
+  return wildcardRegExpCache[path12] ??= new RegExp(
+    `^${path12.replace(
       /\/:[^/{}]+(?:\{\[\^\/]\+})?(?=[/{]|$)|\/?\*$|([.\\+*[^\]$()?{}|])/g,
       (match2, metaChar) => metaChar ? `\\${metaChar}` : match2 === "/*" ? TAIL_WILDCARD_REG_EXP_STR : match2 === "*" ? ONLY_WILDCARD_REG_EXP_STR : `/:${LABEL_REG_EXP_STR}`
     )}$`
   );
 }
-function findMiddleware(middleware, path11) {
+function findMiddleware(middleware, path12) {
   for (const k of Object.keys(middleware).sort((a, b) => b.length - a.length)) {
-    if (buildWildcardRegExp(k).test(path11)) {
+    if (buildWildcardRegExp(k).test(path12)) {
       return [...middleware[k]];
     }
   }
@@ -2378,14 +2378,14 @@ var RegExpRouter = class {
     this.#routes = { [METHOD_NAME_ALL]: createNullObject() };
     this.#tries = { [METHOD_NAME_ALL]: new Trie() };
   }
-  #insertPath(method, path11) {
+  #insertPath(method, path12) {
     try {
-      this.#tries[method].insert(path11, !/\*|\/:/.test(path11));
+      this.#tries[method].insert(path12, !/\*|\/:/.test(path12));
     } catch (e) {
-      throw e === PATH_ERROR ? new UnsupportedPathError(path11) : e;
+      throw e === PATH_ERROR ? new UnsupportedPathError(path12) : e;
     }
   }
-  add(method, path11, handler) {
+  add(method, path12, handler) {
     const middleware = this.#middleware;
     const routes = this.#routes;
     if (!middleware) {
@@ -2401,28 +2401,28 @@ var RegExpRouter = class {
         }
       }
     }
-    if (path11 === "/*") {
-      path11 = "*";
+    if (path12 === "/*") {
+      path12 = "*";
     }
     const methods = method === METHOD_NAME_ALL ? Object.keys(middleware) : [method];
-    if (/\*$/.test(path11)) {
-      const re = buildWildcardRegExp(path11);
+    if (/\*$/.test(path12)) {
+      const re = buildWildcardRegExp(path12);
       for (const m of methods) {
-        if (!middleware[m][path11]) {
-          this.#insertPath(m, path11);
-          middleware[m][path11] = findMiddleware(middleware[m], path11) || findMiddleware(middleware[METHOD_NAME_ALL], path11) || [];
+        if (!middleware[m][path12]) {
+          this.#insertPath(m, path12);
+          middleware[m][path12] = findMiddleware(middleware[m], path12) || findMiddleware(middleware[METHOD_NAME_ALL], path12) || [];
         }
       }
       for (const handlerMap of [middleware, routes]) {
         for (const m of methods) {
           for (const p in handlerMap[m]) {
-            re.test(p) && handlerMap[m][p].push([handler, path11]);
+            re.test(p) && handlerMap[m][p].push([handler, path12]);
           }
         }
       }
       return;
     }
-    const paths = checkOptionalParameter(path11) || [path11];
+    const paths = checkOptionalParameter(path12) || [path12];
     for (const path22 of paths) {
       for (const m of methods) {
         if (!routes[m][path22]) {
@@ -2451,11 +2451,11 @@ var RegExpRouter = class {
     const handlerData = [];
     const [regexp, indexReplacementMap, paramReplacementMap] = trie.buildRegExp();
     for (const r of [middleware, routes]) {
-      for (const path11 in r) {
-        const handlers = r[path11];
-        const pathData = trie.paths[path11];
+      for (const path12 in r) {
+        const handlers = r[path12];
+        const pathData = trie.paths[path12];
         if (!pathData) {
-          staticMap[path11] = [handlers.map(([h]) => [h, createNullObject()]), emptyParam];
+          staticMap[path12] = [handlers.map(([h]) => [h, createNullObject()]), emptyParam];
           continue;
         }
         handlerData[pathData[0]] = handlers.map(([h, handlerPath]) => [
@@ -2479,13 +2479,13 @@ var SmartRouter = class {
   constructor(init) {
     this.#routers = init.routers;
   }
-  add(method, path11, handler) {
+  add(method, path12, handler) {
     if (!this.#routes) {
       throw new Error(MESSAGE_MATCHER_IS_ALREADY_BUILT);
     }
-    this.#routes.push([method, path11, handler]);
+    this.#routes.push([method, path12, handler]);
   }
-  match(method, path11) {
+  match(method, path12) {
     if (!this.#routes) {
       throw new Error("Fatal error");
     }
@@ -2500,7 +2500,7 @@ var SmartRouter = class {
         for (let i2 = 0, len2 = routes.length; i2 < len2; i2++) {
           router.add(...routes[i2]);
         }
-        res = router.match(method, path11);
+        res = router.match(method, path12);
       } catch (e) {
         if (e instanceof UnsupportedPathError) {
           continue;
@@ -2535,9 +2535,9 @@ var Node2 = class _Node2 {
   #patterns = [];
   #pattern;
   #params = emptyParams;
-  insert(method, path11, handler) {
+  insert(method, path12, handler) {
     let curNode = this;
-    const parts = splitRoutingPath(path11);
+    const parts = splitRoutingPath(path12);
     const possibleKeys = /* @__PURE__ */ new Set();
     let i = 0;
     for (const p of parts) {
@@ -2577,12 +2577,12 @@ var Node2 = class _Node2 {
       }
     }
   }
-  search(method, path11) {
+  search(method, path12) {
     const handlerSets = [];
     this.#params = emptyParams;
     const curNode = this;
     let curNodes = [curNode];
-    const parts = splitPath(path11);
+    const parts = splitPath(path12);
     const curNodesQueue = [];
     const len = parts.length;
     let partOffsets = null;
@@ -2624,13 +2624,13 @@ var Node2 = class _Node2 {
           if (matcher !== true) {
             if (!partOffsets) {
               partOffsets = [];
-              let offset = path11[0] === "/" ? 1 : 0;
+              let offset = path12[0] === "/" ? 1 : 0;
               for (let p = 0; p < len; p++) {
                 partOffsets[p] = offset;
                 offset += parts[p].length + 1;
               }
             }
-            const restPathString = path11.slice(partOffsets[i]);
+            const restPathString = path12.slice(partOffsets[i]);
             const m = matcher.exec(restPathString);
             if (m) {
               params[name] = m[0];
@@ -2690,13 +2690,13 @@ var Node2 = class _Node2 {
 var TrieRouter = class {
   name = "TrieRouter";
   #node = new Node2();
-  add(method, path11, handler) {
-    for (const result of checkOptionalParameter(path11) || [path11]) {
+  add(method, path12, handler) {
+    for (const result of checkOptionalParameter(path12) || [path12]) {
       this.#node.insert(method, result, handler);
     }
   }
-  match(method, path11) {
-    return this.#node.search(method, path11);
+  match(method, path12) {
+    return this.#node.search(method, path12);
   }
 };
 
@@ -2902,6 +2902,11 @@ function parseSuffix(rest) {
     if (!isValidRef(ref)) throw new TargetKeyError(`invalid base ref: ${ref}`);
     return { kind: "base", ref };
   }
+  if (rest.startsWith("checkpoint:")) {
+    const n = rest.slice("checkpoint:".length);
+    if (!/^[1-9][0-9]{0,8}$/.test(n)) throw new TargetKeyError(`invalid checkpoint: ${n}`);
+    return { kind: "checkpoint", id: Number(n) };
+  }
   if (rest.startsWith("range:")) {
     const spec = rest.slice("range:".length);
     const idx = spec.indexOf("..");
@@ -2917,7 +2922,7 @@ function parseTargetKey(key) {
   if (typeof key !== "string" || !key) throw new TargetKeyError("empty target key");
   if (key.startsWith("worktree:")) {
     const rest = key.slice("worktree:".length);
-    const m = /^(.+):(working|staged|all|commit:.+|range:.+|base:.+)$/.exec(rest);
+    const m = /^(.+):(working|staged|all|commit:.+|range:.+|base:.+|checkpoint:[0-9]+)$/.exec(rest);
     if (!m?.[1] || !m[2]) throw new TargetKeyError(`invalid worktree target key: ${key}`);
     const worktree = m[1];
     if (!worktree.startsWith("/")) throw new TargetKeyError(`worktree path must be absolute: ${worktree}`);
@@ -2942,6 +2947,9 @@ function formatTargetKey(t) {
     case "base":
       suffix = `base:${t.ref}`;
       break;
+    case "checkpoint":
+      suffix = `checkpoint:${t.id}`;
+      break;
   }
   return t.worktree ? `worktree:${t.worktree}:${suffix}` : suffix;
 }
@@ -3059,7 +3067,8 @@ var ALLOWED_SUBCOMMANDS = /* @__PURE__ */ new Set([
   "merge-base",
   "rev-list",
   "for-each-ref",
-  "check-ref-format"
+  "check-ref-format",
+  "grep"
 ]);
 var FORBIDDEN_OPTION_PREFIXES = ["--output", "--ext-diff", "--textconv", "-c", "--config-env", "--exec-path", "--git-dir", "--work-tree"];
 var DEFAULT_GIT_TIMEOUT_MS = 3e4;
@@ -3074,6 +3083,14 @@ var GitError = class extends HttpError {
   exitCode;
   stderr;
 };
+function snapshotVars(snapshot) {
+  if (!snapshot) return {};
+  return {
+    GIT_OBJECT_DIRECTORY: snapshot.objects,
+    GIT_ALTERNATE_OBJECT_DIRECTORIES: snapshot.alternates,
+    ...snapshot.index ? { GIT_INDEX_FILE: snapshot.index } : {}
+  };
+}
 function assertAllowedGitArgs(args) {
   const sub = args[0];
   if (!sub || !ALLOWED_SUBCOMMANDS.has(sub)) {
@@ -3082,6 +3099,15 @@ function assertAllowedGitArgs(args) {
   if (sub === "worktree" && args[1] !== "list") {
     throw new GitError(`git worktree ${args[1] ?? ""} is not allowed`, null, "", 400, "git_subcommand_forbidden");
   }
+  if (sub === "grep") {
+    for (const arg of args.slice(1)) {
+      if (arg === "--") break;
+      const name = arg.split("=")[0];
+      if (arg.startsWith("-O") || name.length > 3 && "--open-files-in-pager".startsWith(name)) {
+        throw new GitError(`git option not allowed: ${arg}`, null, "", 400, "git_option_forbidden");
+      }
+    }
+  }
   for (const arg of args.slice(1)) {
     if (arg.includes("\0")) throw new GitError("NUL byte in git argument", null, "", 400, "git_bad_argument");
     for (const prefix of FORBIDDEN_OPTION_PREFIXES) {
@@ -3110,7 +3136,8 @@ async function runGit(args, opts) {
           LC_ALL: "C",
           GIT_PAGER: "cat",
           PAGER: "cat",
-          GIT_TERMINAL_PROMPT: "0"
+          GIT_TERMINAL_PROMPT: "0",
+          ...snapshotVars(opts.snapshot)
         },
         windowsHide: true
       },
@@ -3202,6 +3229,14 @@ async function applyOnce(cwd, patch, opts) {
   });
 }
 async function runGitWrite(args, opts) {
+  return execWrite(args, opts, {});
+}
+async function runGitSnapshot(args, opts) {
+  const allowed = args[0] === "add" && args[1] === "--all" && args.slice(2).every((a) => a === "--intent-to-add") || args[0] === "write-tree" && args[1] === "--missing-ok" && args.length === 2;
+  if (!allowed) throw new GitError(`not a snapshot command: git ${args.join(" ")}`, null, "", 400, "git_subcommand_forbidden");
+  return execWrite(args, opts, { GIT_OBJECT_DIRECTORY: opts.objects, GIT_INDEX_FILE: opts.index });
+}
+function execWrite(args, opts, extraEnv) {
   for (const arg of args) if (arg.includes("\0")) throw new GitError("NUL byte in git argument", null, "", 400, "git_bad_argument");
   return new Promise((resolve, reject) => {
     execFile(
@@ -3212,7 +3247,7 @@ async function runGitWrite(args, opts) {
         timeout: opts.timeoutMs ?? DEFAULT_GIT_TIMEOUT_MS,
         maxBuffer: 16 * 1024 * 1024,
         encoding: "utf8",
-        env: { ...process.env, LC_ALL: "C", GIT_PAGER: "cat", PAGER: "cat", GIT_TERMINAL_PROMPT: "0" },
+        env: { ...process.env, LC_ALL: "C", GIT_PAGER: "cat", PAGER: "cat", GIT_TERMINAL_PROMPT: "0", ...extraEnv },
         windowsHide: true
       },
       (error, stdout, stderr) => {
@@ -3364,9 +3399,86 @@ async function getRepoInfo(ctx, defaultTarget) {
 }
 
 // packages/server/src/targets.ts
-import path2 from "path";
+import path3 from "path";
 import { readFile } from "fs/promises";
 
+// packages/server/src/checkpoints.ts
+import path2 from "path";
+import { randomUUID } from "crypto";
+import { copyFile, mkdir, rm, stat, utimes } from "fs/promises";
+function checkpointStore(stateFile) {
+  return path2.join(path2.dirname(stateFile), "checkpoints");
+}
+async function repoObjects(cwd) {
+  const r = await runGit(["rev-parse", "--git-path", "objects"], { cwd });
+  return path2.resolve(cwd, r.stdout.trim());
+}
+async function repoIndex(cwd) {
+  const r = await runGit(["rev-parse", "--git-path", "index"], { cwd });
+  return path2.resolve(cwd, r.stdout.trim());
+}
+async function checkpointObjects(cwd, store) {
+  return { objects: path2.join(store, "objects"), alternates: await repoObjects(cwd) };
+}
+async function withIndexCopy(cwd, store, fn) {
+  const tmp = path2.join(store, "tmp");
+  await mkdir(path2.join(store, "objects"), { recursive: true });
+  await mkdir(tmp, { recursive: true });
+  const [objects, index] = await Promise.all([checkpointObjects(cwd, store), repoIndex(cwd)]);
+  const copy = path2.join(tmp, `index-${randomUUID()}`);
+  try {
+    const st = await stat(index).catch(() => void 0);
+    if (st) {
+      await copyFile(index, copy);
+      const earlier = Math.floor(st.mtimeMs / 1e3) - 1;
+      await utimes(copy, earlier, earlier);
+    }
+    return await fn({ ...objects, index: copy });
+  } finally {
+    await rm(copy, { force: true });
+    await rm(`${copy}.lock`, { force: true });
+  }
+}
+async function snapshotWorktree(cwd, store) {
+  return withIndexCopy(cwd, store, async (snapshot) => {
+    await runGitSnapshot(["add", "--all"], { cwd, ...snapshot });
+    const r = await runGitSnapshot(["write-tree", "--missing-ok"], { cwd, ...snapshot });
+    return r.stdout.trim();
+  });
+}
+async function withCheckpointIndex(cwd, store, fn) {
+  return withIndexCopy(cwd, store, async (snapshot) => {
+    await runGitSnapshot(["add", "--all", "--intent-to-add"], { cwd, ...snapshot });
+    return fn(snapshot);
+  });
+}
+var MAX_CHECKPOINTS = 20;
+var sameWorktree = (c, worktree) => c.worktree === worktree;
+function checkpointsOf(state, worktree) {
+  return state.checkpoints.filter((c) => sameWorktree(c, worktree));
+}
+function findCheckpoint(state, worktree, id) {
+  return state.checkpoints.find((c) => sameWorktree(c, worktree) && c.id === id);
+}
+function checkpointKey(c) {
+  return formatTargetKey({ kind: "checkpoint", id: c.id, ...c.worktree ? { worktree: c.worktree } : {} });
+}
+function forgetCheckpoint(state, c) {
+  state.checkpoints = state.checkpoints.filter((x) => x !== c);
+  const key = checkpointKey(c);
+  const gone = new Set((state.targets[key]?.comments ?? []).map((x) => x.id));
+  delete state.targets[key];
+  if (gone.size) for (const issue of state.issues) issue.commentIds = issue.commentIds.filter((id) => !gone.has(id));
+}
+function addCheckpoint(state, worktree, tree, head) {
+  const mine = checkpointsOf(state, worktree);
+  const id = mine.reduce((n, c) => Math.max(n, c.id), 0) + 1;
+  const checkpoint = { id, ...worktree ? { worktree } : {}, tree, head, createdAt: (/* @__PURE__ */ new Date()).toISOString() };
+  state.checkpoints.push(checkpoint);
+  for (const old of mine.slice(0, Math.max(0, mine.length + 1 - MAX_CHECKPOINTS))) forgetCheckpoint(state, old);
+  return checkpoint;
+}
+
 // packages/server/src/hash.ts
 import { createHash } from "crypto";
 function sha1(input) {
@@ -3587,7 +3699,52 @@ function parseUnifiedDiff(text) {
   return files;
 }
 
+// packages/server/src/debug.ts
+var LEADER = String.raw`(?:\/\/+|\/\*+|#+|--|<!--|;+|%+)\s*`;
+var BLOCK_START = new RegExp(`${LEADER}(?:debug|develblock):start\\b`, "i");
+var BLOCK_END = new RegExp(`${LEADER}(?:debug|develblock):end\\b`, "i");
+var LINE_TAG = new RegExp(`${LEADER}[@!]?(?:no-?commit|do not commit)\\b`, "i");
+var DEBUG_MARKER_STRINGS = ["debug:start", "develblock:start", "nocommit", "no-commit", "do not commit"];
+function debugLineNumbers(text) {
+  const out = /* @__PURE__ */ new Set();
+  const lines = text.split("\n");
+  let depth = 0;
+  lines.forEach((line, i) => {
+    const no = i + 1;
+    if (BLOCK_START.test(line)) depth++;
+    if (depth > 0 || LINE_TAG.test(line)) out.add(no);
+    if (depth > 0 && BLOCK_END.test(line)) depth--;
+  });
+  return out;
+}
+function markDebugLines(diff, newSide, oldSide) {
+  let added = 0;
+  let deleted = 0;
+  for (const hunk of diff.hunks) {
+    for (const line of hunk.lines) {
+      const debug = line.type === "del" ? !!oldSide?.has(line.oldLineNo) : !!newSide?.has(line.newLineNo);
+      if (!debug) continue;
+      line.debug = true;
+      if (line.type === "add") added++;
+      else if (line.type === "del") deleted++;
+    }
+  }
+  if (added) diff.debugAdditions = added;
+  if (deleted) diff.debugDeletions = deleted;
+}
+
 // packages/server/src/targets.ts
+function checkpointOf(ctx) {
+  if (!ctx.checkpoint) throw new Error(`checkpoint of ${ctx.key} was not looked up`);
+  return ctx.checkpoint;
+}
+async function objectsFor(ctx) {
+  return ctx.target.kind === "checkpoint" ? { snapshot: await checkpointObjects(ctx.cwd, checkpointOf(ctx).store) } : {};
+}
+async function runDiff(ctx, args) {
+  if (ctx.target.kind !== "checkpoint") return (await runGit(args, { cwd: ctx.cwd })).stdout;
+  return withCheckpointIndex(ctx.cwd, checkpointOf(ctx).store, async (snapshot) => (await runGit(args, { cwd: ctx.cwd, snapshot })).stdout);
+}
 var DIFF_BASE_ARGS = ["diff", "--no-color", "--no-ext-diff", "-U3", "-M", "--find-renames"];
 function resolveTargetContext(repo, worktrees, key) {
   let target;
@@ -3641,6 +3798,8 @@ async function diffArgs(ctx) {
     }
     case "base":
       return [...DIFF_BASE_ARGS, await baseSha(ctx, t.ref)];
+    case "checkpoint":
+      return [...DIFF_BASE_ARGS, checkpointOf(ctx).tree];
   }
 }
 function includesUntracked(t) {
@@ -3682,8 +3841,7 @@ async function mapLimit(items, limit, fn) {
 }
 async function listTargetDiffs(ctx) {
   const args = await diffArgs(ctx);
-  const r = await runGit(args, { cwd: ctx.cwd });
-  const files = parseUnifiedDiff(r.stdout);
+  const files = parseUnifiedDiff(await runDiff(ctx, args));
   if (includesUntracked(ctx.target)) {
     const untracked = await listUntracked(ctx.cwd);
     const extra = await mapLimit(untracked, 8, (f) => untrackedDiff(ctx.cwd, f).catch(() => void 0));
@@ -3705,8 +3863,7 @@ async function getFileDiff(ctx, filePath, hints = {}) {
   const args = await diffArgs(ctx);
   const pathspec = [literal(filePath)];
   if (hints.oldPath && hints.oldPath !== filePath) pathspec.push(literal(hints.oldPath));
-  const r = await runGit([...args, "--", ...pathspec], { cwd: ctx.cwd });
-  const files = parseUnifiedDiff(r.stdout);
+  const files = parseUnifiedDiff(await runDiff(ctx, [...args, "--", ...pathspec]));
   return files.find((f) => f.path === filePath) ?? files[0];
 }
 async function refForSide(ctx, side) {
@@ -3722,9 +3879,12 @@ async function refForSide(ctx, side) {
       if (side === "new") return t.sha;
       return await revParse(ctx.cwd, `${t.sha}^`) ?? EMPTY_TREE_SHA;
     case "range":
-      return side === "new" ? t.head : t.base;
+      if (side === "new") return t.head;
+      return await mergeBase(ctx.cwd, t.base, t.head) ?? t.base;
     case "base":
       return side === "new" ? void 0 : baseSha(ctx, t.ref);
+    case "checkpoint":
+      return side === "new" ? void 0 : checkpointOf(ctx).tree;
   }
 }
 async function getFullFile(ctx, filePath, side) {
@@ -3732,20 +3892,64 @@ async function getFullFile(ctx, filePath, side) {
   const ref = await refForSide(ctx, side);
   if (ref === void 0) {
     try {
-      const buf = await readFile(path2.join(ctx.cwd, filePath));
+      const buf = await readFile(path3.join(ctx.cwd, filePath));
       return buf.toString("utf8");
     } catch {
       return null;
     }
   }
   try {
-    const r = await runGit(["show", `${ref}:${filePath}`], { cwd: ctx.cwd });
+    const r = await runGit(["show", `${ref}:${filePath}`], { cwd: ctx.cwd, ...await objectsFor(ctx) });
     return r.stdout;
   } catch (e) {
     if (e instanceof HttpError && e.code === "git_failed") return null;
     throw e;
   }
 }
+var GREP_CHUNK = 500;
+async function pathsWithMarkers(ctx, side, paths) {
+  const found = /* @__PURE__ */ new Set();
+  if (paths.length === 0) return found;
+  const ref = await refForSide(ctx, side);
+  const args = ["grep", "-l", "-z", "-I", "-i", "-F", ...DEBUG_MARKER_STRINGS.flatMap((m) => ["-e", m])];
+  if (ref === void 0) args.push("--untracked");
+  else if (ref === ":0") args.push("--cached");
+  else args.push(ref);
+  const prefix = ref === void 0 || ref === ":0" ? "" : `${ref}:`;
+  const objects = await objectsFor(ctx);
+  for (let i = 0; i < paths.length; i += GREP_CHUNK) {
+    const chunk = paths.slice(i, i + GREP_CHUNK).map(literal);
+    const r = await runGit([...args, "--", ...chunk], { cwd: ctx.cwd, okCodes: [0, 1], ...objects });
+    for (const p of r.stdout.split("\0")) if (p) found.add(p.startsWith(prefix) ? p.slice(prefix.length) : p);
+  }
+  return found;
+}
+async function annotateDebug(ctx, files) {
+  const text = files.filter((f) => !f.binary && f.hunks.length > 0);
+  const oldPathOf = (f) => f.oldPath ?? f.path;
+  const none = () => /* @__PURE__ */ new Set();
+  const [onNew, onOld] = await Promise.all([
+    pathsWithMarkers(
+      ctx,
+      "new",
+      text.filter((f) => f.status !== "deleted").map((f) => f.path)
+    ).catch(none),
+    pathsWithMarkers(ctx, "old", text.filter((f) => f.status !== "added").map(oldPathOf)).catch(none)
+  ]);
+  const read = async (p, side, marked) => {
+    if (!marked.has(p)) return void 0;
+    const content = await getFullFile(ctx, p, side).catch(() => null);
+    return content === null ? void 0 : debugLineNumbers(content);
+  };
+  await mapLimit(
+    text.filter((f) => onNew.has(f.path) || onOld.has(oldPathOf(f))),
+    8,
+    async (f) => {
+      const [n, o] = await Promise.all([read(f.path, "new", onNew), read(oldPathOf(f), "old", onOld)]);
+      markDebugLines(f, n, o);
+    }
+  );
+}
 
 // packages/server/src/anchor.ts
 function sideLines(diff, side) {
@@ -3895,9 +4099,9 @@ function cutHunk(hunk, picked, mode) {
   });
   return out;
 }
-function pickedLines(diff, selection) {
+function pickedLines(diff, selection, skipDebug) {
   const picked = /* @__PURE__ */ new Map();
-  const changed = (h) => h.lines.map((l, i) => l.type === "context" ? -1 : i).filter((i) => i >= 0);
+  const changed = (h) => h.lines.map((l, i) => l.type === "context" || skipDebug && l.debug ? -1 : i).filter((i) => i >= 0);
   if (selection === void 0) {
     for (const [i, h] of diff.hunks.entries()) picked.set(i, new Set(changed(h)));
     return picked;
@@ -3921,10 +4125,11 @@ function pickedLines(diff, selection) {
   }
   return picked;
 }
-function buildStagePatch(diff, mode, selection) {
+function buildStagePatch(diff, mode, selection, opts = {}) {
   if (diff.binary) throw badRequest("binary files cannot be staged from here; use git add", "not_stageable");
   const whole = selection === void 0;
-  const picked = pickedLines(diff, selection);
+  const skipDebug = !!opts.skipDebug && mode === "stage";
+  const picked = pickedLines(diff, selection, skipDebug);
   let lines = 0;
   for (const set of picked.values()) lines += set.size;
   const changedTotal = diff.hunks.reduce((n, h) => n + h.lines.filter((l) => l.type !== "context").length, 0);
@@ -3957,7 +4162,11 @@ function buildStagePatch(diff, mode, selection) {
   }
   if (lines === 0) {
     const headerOnly = whole && (modeChange || rename2 || (diff.status === "added" || diff.status === "deleted") && diff.hunks.length === 0);
-    if (!headerOnly) throw badRequest("no changed lines selected", "empty_selection");
+    if (!headerOnly) {
+      if (skipDebug && [...pickedLines(diff, selection, false).values()].some((set) => set.size > 0))
+        throw badRequest("every changed line picked is debug code; pick those lines one by one to stage them anyway", "debug_only");
+      throw badRequest("no changed lines selected", "empty_selection");
+    }
     return { patch: header.join("\n") + "\n", lines: 0 };
   }
   let delta = 0;
@@ -3983,15 +4192,15 @@ function buildStagePatch(diff, mode, selection) {
 }
 
 // packages/server/src/worktrees.ts
-import path3 from "path";
-import { readdir, realpath as realpath2, stat } from "fs/promises";
+import path4 from "path";
+import { readdir, realpath as realpath2, stat as stat2 } from "fs/promises";
 function slotPath(ctx, slot) {
-  return path3.join(path3.dirname(ctx.commonRoot), `${path3.basename(ctx.commonRoot)}-${slot}`);
+  return path4.join(path4.dirname(ctx.commonRoot), `${path4.basename(ctx.commonRoot)}-${slot}`);
 }
 function slotOf(ctx, p) {
-  if (path3.dirname(p) !== path3.dirname(ctx.commonRoot)) return void 0;
-  const prefix = `${path3.basename(ctx.commonRoot)}-`;
-  const name = path3.basename(p);
+  if (path4.dirname(p) !== path4.dirname(ctx.commonRoot)) return void 0;
+  const prefix = `${path4.basename(ctx.commonRoot)}-`;
+  const name = path4.basename(p);
   const n = name.startsWith(prefix) ? name.slice(prefix.length) : "";
   return /^[1-9]\d*$/.test(n) ? Number(n) : void 0;
 }
@@ -4076,7 +4285,7 @@ async function assertBranchName(ctx, name) {
   }
 }
 async function dirUsable(p) {
-  const st = await stat(p).catch((e) => {
+  const st = await stat2(p).catch((e) => {
     if (e.code === "ENOENT") return void 0;
     throw e;
   });
@@ -4173,7 +4382,7 @@ async function dropBranch(ctx, wt, asked) {
 }
 async function releaseWorktree(ctx, req) {
   const p = req.path.trim();
-  const wt = (await listWorktreesAll(ctx)).find((w) => w.path === p || p && w.path === path3.resolve(p));
+  const wt = (await listWorktreesAll(ctx)).find((w) => w.path === p || p && w.path === path4.resolve(p));
   if (!wt) throw badRequest(`unknown worktree: ${p}`, "unknown_worktree");
   if (wt.isMain) throw badRequest("the main worktree cannot be released", "main_worktree");
   if (wt.bare || slotOf(ctx, wt.path) === void 0) throw badRequest(`${wt.path} is not a slot; remove it instead`, "not_a_slot");
@@ -4189,7 +4398,7 @@ async function releaseWorktree(ctx, req) {
 }
 async function removeWorktree(ctx, req) {
   const p = req.path.trim();
-  const wt = (await listWorktreesAll(ctx)).find((w) => w.path === p || p && w.path === path3.resolve(p));
+  const wt = (await listWorktreesAll(ctx)).find((w) => w.path === p || p && w.path === path4.resolve(p));
   if (!wt) throw badRequest(`unknown worktree: ${p}`, "unknown_worktree");
   if (wt.isMain) throw badRequest("the main worktree cannot be removed", "main_worktree");
   const args = ["worktree", "remove"];
@@ -4211,24 +4420,24 @@ async function removeWorktree(ctx, req) {
 
 // packages/server/src/state.ts
 import os from "os";
-import path4 from "path";
-import { mkdir, open, readFile as readFile2, rename, stat as stat2, unlink, writeFile } from "fs/promises";
+import path5 from "path";
+import { mkdir as mkdir2, open, readFile as readFile2, rename, stat as stat3, unlink, writeFile } from "fs/promises";
 function dataDir() {
   const xdg = process.env.XDG_DATA_HOME;
-  const base = xdg?.trim() ? xdg : path4.join(os.homedir(), ".local", "share");
-  return path4.join(base, "warden");
+  const base = xdg?.trim() ? xdg : path5.join(os.homedir(), ".local", "share");
+  return path5.join(base, "warden");
 }
 function repoHash(repoRoot) {
   return sha1(repoRoot).slice(0, 12);
 }
 function stateFilePath(repoRoot, baseDir = dataDir()) {
-  return path4.join(baseDir, repoHash(repoRoot), "state.json");
+  return path5.join(baseDir, repoHash(repoRoot), "state.json");
 }
 function defaultPrefs() {
-  return { viewMode: "unified", nvimSocketByRoot: {}, autoRefresh: true, railOpen: false };
+  return { viewMode: "unified", nvimSocketByRoot: {}, autoRefresh: true, railOpen: false, ignoreDebug: true };
 }
 function defaultState(repoRoot) {
-  return { schemaVersion: 1, repoRoot, targets: {}, issues: [], todos: [], prefs: defaultPrefs() };
+  return { schemaVersion: 1, repoRoot, targets: {}, issues: [], todos: [], checkpoints: [], prefs: defaultPrefs() };
 }
 function ensureTarget(state, key) {
   let t = state.targets[key];
@@ -4239,6 +4448,10 @@ function ensureTarget(state, key) {
   return t;
 }
 var usable = (v) => !!v && typeof v === "object" && typeof v.id === "string";
+var usableCheckpoint = (v) => {
+  const c = v;
+  return !!c && typeof c === "object" && Number.isInteger(c.id) && typeof c.tree === "string" && (c.worktree === void 0 || typeof c.worktree === "string");
+};
 var usableComment = (v) => usable(v) && typeof v.anchor === "object" && !!v.anchor;
 function normalise(raw2, repoRoot) {
   const base = defaultState(repoRoot);
@@ -4261,12 +4474,14 @@ function normalise(raw2, repoRoot) {
     targets,
     issues: Array.isArray(r.issues) ? r.issues.filter(usable) : [],
     todos: Array.isArray(r.todos) ? r.todos.filter(usable) : [],
+    checkpoints: Array.isArray(r.checkpoints) ? r.checkpoints.filter(usableCheckpoint) : [],
     prefs: {
       ...defaultPrefs(),
       ...r.prefs ?? {},
       nvimSocketByRoot: r.prefs?.nvimSocketByRoot ?? {},
       autoRefresh: typeof r.prefs?.autoRefresh === "boolean" ? r.prefs.autoRefresh : true,
-      railOpen: typeof r.prefs?.railOpen === "boolean" ? r.prefs.railOpen : false
+      railOpen: typeof r.prefs?.railOpen === "boolean" ? r.prefs.railOpen : false,
+      ignoreDebug: typeof r.prefs?.ignoreDebug === "boolean" ? r.prefs.ignoreDebug : true
     }
   };
 }
@@ -4318,7 +4533,7 @@ var StateStore = class {
   /** Apply a mutation under lock. The callback receives the freshest on-disk state. */
   update(fn) {
     const run2 = async () => {
-      await mkdir(path4.dirname(this.file), { recursive: true });
+      await mkdir2(path5.dirname(this.file), { recursive: true });
       const release = await this.acquireLock();
       try {
         const state = await this.load();
@@ -4356,7 +4571,7 @@ var StateStore = class {
         const err = e;
         if (err.code !== "EEXIST") throw e;
         try {
-          const st = await stat2(lock);
+          const st = await stat3(lock);
           if (Date.now() - st.mtimeMs > LOCK_STALE_MS) {
             await unlink(lock).catch(() => void 0);
             continue;
@@ -4381,6 +4596,7 @@ function forgetWorktreeTargets(state, worktreePath) {
     delete state.targets[key];
   }
   if (gone.size) for (const issue of state.issues) issue.commentIds = issue.commentIds.filter((id) => !gone.has(id));
+  state.checkpoints = state.checkpoints.filter((c) => c.worktree !== worktreePath);
 }
 
 // packages/server/src/export.ts
@@ -4457,9 +4673,9 @@ function formatIssueExport({ repoRoot, issue, comments }) {
 
 // packages/server/src/nvim.ts
 import os2 from "os";
-import path5 from "path";
+import path6 from "path";
 import { execFile as execFile2 } from "child_process";
-import { readdir as readdir2, stat as stat3 } from "fs/promises";
+import { readdir as readdir2, stat as stat4 } from "fs/promises";
 var QUERY_TIMEOUT_MS = 500;
 var CACHE_TTL_MS = 1e4;
 function execNvim(args, timeoutMs) {
@@ -4488,14 +4704,14 @@ function socketDirs(env = process.env) {
     }
   }
   const tmp = env.TMPDIR || "/tmp";
-  if (user) dirs.push(path5.join(tmp, `nvim.${user}`));
-  if (env.NVIM_LISTEN_ADDRESS) dirs.push(path5.dirname(env.NVIM_LISTEN_ADDRESS));
+  if (user) dirs.push(path6.join(tmp, `nvim.${user}`));
+  if (env.NVIM_LISTEN_ADDRESS) dirs.push(path6.dirname(env.NVIM_LISTEN_ADDRESS));
   return [...new Set(dirs)];
 }
 var SOCKET_NAME = /^nvim\.(\d+)\.\d+$/;
 async function isSocket(p) {
   try {
-    return (await stat3(p)).isSocket();
+    return (await stat4(p)).isSocket();
   } catch {
     return false;
   }
@@ -4510,7 +4726,7 @@ async function findSockets(dirs = socketDirs()) {
       return;
     }
     for (const ent of entries) {
-      const full = path5.join(dir, ent.name);
+      const full = path6.join(dir, ent.name);
       const m = SOCKET_NAME.exec(ent.name);
       if (m && (ent.isSocket() || await isSocket(full))) {
         found.set(full, Number(m[1]));
@@ -4597,9 +4813,9 @@ var TmuxService = class {
     const sessions = [];
     for (const line of output.trimEnd().split("\n")) {
       const [id, name, ...parts] = line.split("	");
-      const path11 = parts.join("	");
-      if (!id || !/^\$\d+$/.test(id) || !name || !path11) continue;
-      if (await realpath3(path11).catch(() => null) === root) sessions.push({ id, name, path: path11 });
+      const path12 = parts.join("	");
+      if (!id || !/^\$\d+$/.test(id) || !name || !path12) continue;
+      if (await realpath3(path12).catch(() => null) === root) sessions.push({ id, name, path: path12 });
     }
     return sessions;
   }
@@ -4613,8 +4829,8 @@ var TmuxService = class {
 };
 
 // packages/server/src/watcher.ts
-import path6 from "path";
-import { stat as stat4 } from "fs/promises";
+import path7 from "path";
+import { stat as stat5 } from "fs/promises";
 var DEFAULT_POLL_INTERVAL_MS = 1500;
 function statusPaths(out) {
   const parts = out.split("\0");
@@ -4710,7 +4926,7 @@ var RepoWatcher = class {
     const stats = await Promise.all(
       statusPaths(statusRes.stdout).map(async (rel) => {
         try {
-          const st = await stat4(path6.join(this.root, rel));
+          const st = await stat5(path7.join(this.root, rel));
           return `${rel}	${st.mtimeMs}	${st.size}`;
         } catch {
           return `${rel}	-`;
@@ -4722,8 +4938,8 @@ var RepoWatcher = class {
 };
 
 // packages/server/src/static.ts
-import path7 from "path";
-import { readFile as readFile3, stat as stat5 } from "fs/promises";
+import path8 from "path";
+import { readFile as readFile3, stat as stat6 } from "fs/promises";
 var MIME = {
   ".html": "text/html; charset=utf-8",
   ".js": "text/javascript; charset=utf-8",
@@ -4740,20 +4956,20 @@ var MIME = {
   ".txt": "text/plain; charset=utf-8"
 };
 async function serveStaticFile(c, webDir) {
-  const root = path7.resolve(webDir);
+  const root = path8.resolve(webDir);
   let rel;
   try {
     rel = decodeURIComponent(c.req.path);
   } catch {
     return c.text("Bad Request", 400);
   }
-  let target = path7.resolve(root, "." + rel);
-  if (target !== root && !target.startsWith(root + path7.sep)) return c.text("Forbidden", 403);
+  let target = path8.resolve(root, "." + rel);
+  if (target !== root && !target.startsWith(root + path8.sep)) return c.text("Forbidden", 403);
   try {
-    const st = await stat5(target);
-    if (st.isDirectory()) target = path7.join(target, "index.html");
+    const st = await stat6(target);
+    if (st.isDirectory()) target = path8.join(target, "index.html");
   } catch {
-    target = path7.join(root, "index.html");
+    target = path8.join(root, "index.html");
   }
   let body;
   try {
@@ -4761,7 +4977,7 @@ async function serveStaticFile(c, webDir) {
   } catch {
     return c.text("Not Found", 404);
   }
-  const ext = path7.extname(target).toLowerCase();
+  const ext = path8.extname(target).toLowerCase();
   const isAsset = rel.startsWith("/assets/");
   return new Response(new Uint8Array(body), {
     status: 200,
@@ -4797,7 +5013,8 @@ function createApp(opts) {
     worktreeCache = { at: Date.now(), list };
     return list;
   };
-  const targetCtx = async (key) => {
+  const checkpoints = checkpointStore(store.file);
+  const worktreeCtx = async (key) => {
     let list = await worktrees();
     try {
       return resolveTargetContext(repo, list, key);
@@ -4809,6 +5026,13 @@ function createApp(opts) {
       throw e;
     }
   };
+  const targetCtx = async (key) => {
+    const ctx = await worktreeCtx(key);
+    if (ctx.target.kind !== "checkpoint") return ctx;
+    const cp = findCheckpoint(await store.load(), ctx.target.worktree, ctx.target.id);
+    if (!cp) throw notFound(`no checkpoint #${ctx.target.id} in this worktree`, "unknown_checkpoint");
+    return { ...ctx, checkpoint: { tree: cp.tree, store: checkpoints } };
+  };
   const fileDiffWithHints = async (ctx, filePath, explicit) => {
     const cached = listings.get(ctx.key);
     const hint = cached && Date.now() - cached.at < LISTING_HINT_TTL_MS ? cached.files.find((f) => f.path === filePath) : void 0;
@@ -4845,7 +5069,7 @@ function createApp(opts) {
     worktreeCache = { at: Date.now(), list: info.worktrees };
     const last = state.prefs.lastTarget;
     const target = last ? tryParseTargetKey(last) : void 0;
-    const usable2 = !!target && (!target.worktree || info.worktrees.some((w) => w.path === target.worktree));
+    const usable2 = !!target && (!target.worktree || info.worktrees.some((w) => w.path === target.worktree)) && (target.kind !== "checkpoint" || !!findCheckpoint(state, target.worktree, target.id));
     if (last && usable2) info.defaultTarget = last;
     else if (last) {
       await store.update((s) => {
@@ -4863,6 +5087,7 @@ function createApp(opts) {
       if (typeof body.lastTarget === "string") s.prefs.lastTarget = body.lastTarget;
       if (typeof body.autoRefresh === "boolean") s.prefs.autoRefresh = body.autoRefresh;
       if (typeof body.railOpen === "boolean") s.prefs.railOpen = body.railOpen;
+      if (typeof body.ignoreDebug === "boolean") s.prefs.ignoreDebug = body.ignoreDebug;
       if (body.nvimSocketByRoot && typeof body.nvimSocketByRoot === "object") {
         s.prefs.nvimSocketByRoot = { ...s.prefs.nvimSocketByRoot, ...body.nvimSocketByRoot };
       }
@@ -4874,6 +5099,7 @@ function createApp(opts) {
     const key = c.req.param("key");
     const ctx = await targetCtx(key);
     const diffs = await listTargetDiffs(ctx);
+    await annotateDebug(ctx, diffs);
     listings.set(key, { at: Date.now(), files: diffs });
     const notices = changedNotices.get(key) ?? /* @__PURE__ */ new Set();
     changedNotices.set(key, notices);
@@ -4914,6 +5140,7 @@ function createApp(opts) {
     const untracked = c.req.query("untracked") === "1" ? true : void 0;
     const diff = await fileDiffWithHints(ctx, filePath, { oldPath, untracked });
     if (!diff) throw notFound(`no diff for ${filePath} in ${key}`, "no_diff");
+    await annotateDebug(ctx, [diff]);
     return c.json(diff);
   });
   api.get("/targets/:key/file/full", async (c) => {
@@ -4941,6 +5168,33 @@ function createApp(opts) {
     changedNotices.get(key)?.delete(body.path);
     return c.json({ viewed });
   });
+  api.get("/targets/:key/checkpoints", async (c) => {
+    const ctx = await worktreeCtx(c.req.param("key"));
+    const res = { checkpoints: checkpointsOf(await store.load(), ctx.target.worktree) };
+    return c.json(res);
+  });
+  api.post("/targets/:key/checkpoints", async (c) => {
+    const ctx = await worktreeCtx(c.req.param("key"));
+    const tree = await snapshotWorktree(ctx.cwd, checkpoints);
+    const head = await revParse(ctx.cwd, "HEAD") ?? "";
+    const res = await store.update((s) => {
+      const newest = checkpointsOf(s, ctx.target.worktree).at(-1);
+      const unchanged = newest?.tree === tree;
+      const checkpoint = unchanged ? newest : addCheckpoint(s, ctx.target.worktree, tree, head);
+      return { checkpoint, unchanged, targetKey: checkpointKey(checkpoint) };
+    });
+    return c.json(res, res.unchanged ? 200 : 201);
+  });
+  api.delete("/targets/:key/checkpoints/:id", async (c) => {
+    const ctx = await worktreeCtx(c.req.param("key"));
+    const id = Number(c.req.param("id"));
+    await store.update((s) => {
+      const cp = Number.isInteger(id) ? findCheckpoint(s, ctx.target.worktree, id) : void 0;
+      if (!cp) throw notFound(`no checkpoint #${c.req.param("id")} in this worktree`, "unknown_checkpoint");
+      forgetCheckpoint(s, cp);
+    });
+    return c.json({ ok: true });
+  });
   api.post("/targets/:key/stage", async (c) => {
     const key = c.req.param("key");
     const ctx = await targetCtx(key);
@@ -4950,11 +5204,13 @@ function createApp(opts) {
     if (!body.path || typeof body.path !== "string") throw badRequest("missing path");
     if (!body.contentHash || typeof body.contentHash !== "string") throw badRequest("contentHash is required");
     if (body.hunks !== void 0 && !Array.isArray(body.hunks)) throw badRequest("hunks must be an array", "bad_selection");
+    if (body.skipDebug !== void 0 && typeof body.skipDebug !== "boolean") throw badRequest("skipDebug must be a boolean", "bad_selection");
     const diff = await fileDiffWithHints(ctx, body.path);
     if (!diff) throw badRequest(`file ${body.path} is not part of ${key}`, "no_diff");
     if (diff.contentHash !== body.contentHash)
       throw new HttpError(409, "the diff changed since it was loaded; refresh and pick the lines again", "diff_changed");
-    const { patch, lines } = buildStagePatch(diff, mode, body.hunks);
+    if (body.skipDebug) await annotateDebug(ctx, [diff]);
+    const { patch, lines } = buildStagePatch(diff, mode, body.hunks, { skipDebug: body.skipDebug });
     await applyToIndex(ctx.cwd, patch, { reverse: mode === "unstage" });
     void watchers.get(ctx.cwd)?.poll();
     const res = { ok: true, lines };
@@ -4980,7 +5236,7 @@ function createApp(opts) {
     if (!anchored) throw badRequest("selection is not fully visible in the diff on that side (must be inside one hunk)", "bad_selection");
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const comment = {
-      id: randomUUID(),
+      id: randomUUID2(),
       targetKey: key,
       filePath: body.filePath,
       side: body.side,
@@ -5179,7 +5435,7 @@ function createApp(opts) {
     if (!body.title?.trim()) throw badRequest("title is required");
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const issue = {
-      id: randomUUID(),
+      id: randomUUID2(),
       title: body.title.trim(),
       body: typeof body.body === "string" ? body.body : "",
       status: body.status === "closed" ? "closed" : "open",
@@ -5273,7 +5529,7 @@ function createApp(opts) {
     const branch = body.branch?.trim() || await currentBranch(await knownRoot(body.root));
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const todo = {
-      id: randomUUID(),
+      id: randomUUID2(),
       branch,
       title: body.title.trim(),
       body: typeof body.body === "string" ? body.body : "",
@@ -5475,7 +5731,7 @@ function createApp(opts) {
   api.post("/nvim/open", async (c) => {
     const body = await c.req.json();
     if (!body.socket || !body.absPath) throw badRequest("socket and absPath are required");
-    if (!path8.isAbsolute(body.absPath)) throw badRequest("absPath must be absolute");
+    if (!path9.isAbsolute(body.absPath)) throw badRequest("absPath must be absolute");
     const scan = await nvim.scan();
     if (!scan.instances.some((i) => i.socket === body.socket)) {
       const fresh = await nvim.scan(true);
@@ -5535,14 +5791,14 @@ function reachableFromWindows(port, token, timeoutMs = PROBE_TIMEOUT_MS) {
 }
 
 // packages/server/src/update.ts
-import path9 from "path";
-import { mkdir as mkdir2, readFile as readFile5, writeFile as writeFile2 } from "fs/promises";
+import path10 from "path";
+import { mkdir as mkdir3, readFile as readFile5, writeFile as writeFile2 } from "fs/promises";
 var PACKAGE = "@xbghc/warden";
 var LATEST_URL = "https://registry.npmjs.org/@xbghc%2fwarden/latest";
 var FETCH_TIMEOUT_MS = 3e3;
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
 function updateCacheFile(baseDir = dataDir()) {
-  return path9.join(baseDir, "update-check.json");
+  return path10.join(baseDir, "update-check.json");
 }
 function updateCheckEnabled(env = process.env) {
   return !env.WARDEN_NO_UPDATE_CHECK && !env.NO_UPDATE_NOTIFIER && !env.CI;
@@ -5576,7 +5832,7 @@ async function readCache(file, now) {
 }
 async function writeCache(file, cache) {
   try {
-    await mkdir2(path9.dirname(file), { recursive: true });
+    await mkdir3(path10.dirname(file), { recursive: true });
     await writeFile2(file, JSON.stringify(cache));
   } catch {
   }
@@ -5621,7 +5877,7 @@ async function startServer(opts) {
   const repo = await resolveRepo(opts.repoPath);
   const stateFile = opts.stateFile ?? stateFilePath(repo.commonRoot);
   const store = new StateStore(stateFile, repo.commonRoot);
-  const instanceToken = randomUUID2();
+  const instanceToken = randomUUID3();
   const app = createApp({ repo, store, nvim: new NvimService(), webDir: opts.webDir, instanceToken, update: opts.update });
   const listen = (p) => new Promise((resolve, reject) => {
     const s = serve({ fetch: app.fetch, hostname: HOST, port: p }, () => resolve(s));
@@ -5665,7 +5921,7 @@ async function startServer(opts) {
 }
 
 // bin/cli.ts
-var VERSION = true ? "0.13.1" : "dev";
+var VERSION = true ? "0.15.0" : "dev";
 function parseArgs(argv) {
   const args = { repoPath: process.cwd(), open: true, updateCheck: true, help: false, version: false };
   for (let i = 0; i < argv.length; i++) {
@@ -5684,7 +5940,7 @@ function parseArgs(argv) {
     } else if (a === "--help" || a === "-h") args.help = true;
     else if (a === "--version" || a === "-v") args.version = true;
     else if (a.startsWith("-")) throw new Error(`unknown option: ${a}`);
-    else args.repoPath = path10.resolve(a);
+    else args.repoPath = path11.resolve(a);
   }
   return args;
 }
@@ -5729,16 +5985,16 @@ async function openBrowser(url) {
   return false;
 }
 function resolveWebDir() {
-  const here = path10.dirname(fileURLToPath(import.meta.url));
+  const here = path11.dirname(fileURLToPath(import.meta.url));
   const candidates = [
     process.env.WARDEN_WEB_DIR,
-    path10.join(here, "web"),
+    path11.join(here, "web"),
     // dist/cli.js -> dist/web
-    path10.join(here, "..", "dist", "web")
+    path11.join(here, "..", "dist", "web")
     // bin/cli.ts (tsx dev) -> dist/web
   ].filter((p) => !!p);
   for (const dir of candidates) {
-    if (existsSync2(path10.join(dir, "index.html"))) return dir;
+    if (existsSync2(path11.join(dir, "index.html"))) return dir;
   }
   return void 0;
 }
@@ -5763,7 +6019,7 @@ async function main() {
   if (!webDir) {
     console.error("warning: built web assets not found (dist/web). Only the /api endpoints will be served.");
   }
-  const viaNpx = fileURLToPath(import.meta.url).includes(`${path10.sep}_npx${path10.sep}`);
+  const viaNpx = fileURLToPath(import.meta.url).includes(`${path11.sep}_npx${path11.sep}`);
   const checking = args.updateCheck && VERSION !== "dev" && updateCheckEnabled();
   const update = checking ? checkForUpdate({ current: VERSION, npx: viaNpx }) : Promise.resolve(null);
   let server;