@xbghc/warden 0.14.0 → 0.16.0

package/dist/cli.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 
 // bin/cli.ts
-import path10 from "path";
+import path11 from "path";
 import { spawn } from "child_process";
 import { existsSync as existsSync2 } from "fs";
 import { fileURLToPath } from "url";
 
 // packages/server/src/index.ts
 import net from "net";
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 
 // node_modules/.pnpm/@hono+node-server@1.19.17_hono@4.13.7/node_modules/@hono/node-server/dist/index.mjs
 import { createServer as createServerHTTP } from "http";
@@ -652,8 +652,9 @@ var serve = (options, listeningListener) => {
 };
 
 // packages/server/src/app.ts
-import path8 from "path";
-import { randomUUID } from "crypto";
+import path9 from "path";
+import { stat as stat7 } from "fs/promises";
+import { randomUUID as randomUUID3 } from "crypto";
 
 // node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/compose.js
 var compose = (middleware, onError, onNotFound) => {
@@ -812,26 +813,26 @@ var throwNestingLimitExceeded = () => {
 };
 
 // node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/utils/url.js
-var splitPath = (path11) => {
-  const paths = path11.split("/");
+var splitPath = (path12) => {
+  const paths = path12.split("/");
   if (paths[0] === "") {
     paths.shift();
   }
   return paths;
 };
 var splitRoutingPath = (routePath) => {
-  const { groups, path: path11 } = extractGroupsFromPath(routePath);
-  const paths = splitPath(path11);
+  const { groups, path: path12 } = extractGroupsFromPath(routePath);
+  const paths = splitPath(path12);
   return replaceGroupMarks(paths, groups);
 };
-var extractGroupsFromPath = (path11) => {
+var extractGroupsFromPath = (path12) => {
   const groups = [];
-  path11 = path11.replace(/\{[^}]+\}/g, (match2, index) => {
+  path12 = path12.replace(/\{[^}]+\}/g, (match2, index) => {
     const mark = `@${index}`;
     groups.push([mark, match2]);
     return mark;
   });
-  return { groups, path: path11 };
+  return { groups, path: path12 };
 };
 var replaceGroupMarks = (paths, groups) => {
   for (let i = groups.length - 1; i >= 0; i--) {
@@ -888,8 +889,8 @@ var getPath = (request) => {
       const queryIndex = url.indexOf("?", i);
       const hashIndex = url.indexOf("#", i);
       const end = queryIndex === -1 ? hashIndex === -1 ? void 0 : hashIndex : hashIndex === -1 ? queryIndex : Math.min(queryIndex, hashIndex);
-      const path11 = url.slice(start, end);
-      return tryDecodeURI(path11.includes("%25") ? path11.replace(/%25/g, "%2525") : path11);
+      const path12 = url.slice(start, end);
+      return tryDecodeURI(path12.includes("%25") ? path12.replace(/%25/g, "%2525") : path12);
     } else if (charCode === 63 || charCode === 35) {
       break;
     }
@@ -906,11 +907,11 @@ var mergePath = (base, sub, ...rest) => {
   }
   return `${base?.[0] === "/" ? "" : "/"}${base}${sub === "/" ? "" : `${base?.at(-1) === "/" ? "" : "/"}${sub?.[0] === "/" ? sub.slice(1) : sub}`}`;
 };
-var checkOptionalParameter = (path11) => {
-  if (path11.charCodeAt(path11.length - 1) !== 63 || !path11.includes(":")) {
+var checkOptionalParameter = (path12) => {
+  if (path12.charCodeAt(path12.length - 1) !== 63 || !path12.includes(":")) {
     return null;
   }
-  const segments = path11.split("/");
+  const segments = path12.split("/");
   const results = [];
   let basePath = "";
   segments.forEach((segment) => {
@@ -1052,9 +1053,9 @@ var HonoRequest = class {
    */
   path;
   bodyCache = {};
-  constructor(request, path11 = "/", matchResult = [[]]) {
+  constructor(request, path12 = "/", matchResult = [[]]) {
     this.raw = request;
-    this.path = path11;
+    this.path = path12;
     this.#matchResult = matchResult;
   }
   param(key) {
@@ -1826,8 +1827,8 @@ var Hono = class _Hono {
         return this;
       };
     });
-    this.on = (method, path11, ...handlers) => {
-      for (const p of [path11].flat()) {
+    this.on = (method, path12, ...handlers) => {
+      for (const p of [path12].flat()) {
         this.#path = p;
         for (const m of [method].flat()) {
           const methodName = m.toUpperCase();
@@ -1885,8 +1886,8 @@ var Hono = class _Hono {
    * app.route("/api", app2) // GET /api/user
    * ```
    */
-  route(path11, app) {
-    const subApp = this.basePath(path11);
+  route(path12, app) {
+    const subApp = this.basePath(path12);
     app.routes.map((r) => {
       let handler;
       if (app.errorHandler === errorHandler) {
@@ -1912,9 +1913,9 @@ var Hono = class _Hono {
    * const api = new Hono().basePath('/api')
    * ```
    */
-  basePath(path11) {
+  basePath(path12) {
     const subApp = this.#clone();
-    subApp._basePath = mergePath(this._basePath, path11);
+    subApp._basePath = mergePath(this._basePath, path12);
     return subApp;
   }
   /**
@@ -1988,7 +1989,7 @@ var Hono = class _Hono {
    * })
    * ```
    */
-  mount(path11, applicationHandler, options) {
+  mount(path12, applicationHandler, options) {
     let replaceRequest;
     let optionHandler;
     if (options) {
@@ -2015,7 +2016,7 @@ var Hono = class _Hono {
       return [c.env, executionContext];
     };
     replaceRequest ||= (() => {
-      const mergedPath = mergePath(this._basePath, path11);
+      const mergedPath = mergePath(this._basePath, path12);
       const pathPrefixLength = mergedPath === "/" ? 0 : mergedPath.length;
       return (request) => {
         const url = new URL(request.url);
@@ -2030,18 +2031,18 @@ var Hono = class _Hono {
       }
       await next();
     };
-    this.#addRoute(METHOD_NAME_ALL, mergePath(path11, "*"), handler);
+    this.#addRoute(METHOD_NAME_ALL, mergePath(path12, "*"), handler);
     return this;
   }
-  #addRoute(method, path11, handler, baseRoutePath) {
-    path11 = mergePath(this._basePath, path11);
+  #addRoute(method, path12, handler, baseRoutePath) {
+    path12 = mergePath(this._basePath, path12);
     const r = {
       basePath: baseRoutePath !== void 0 ? mergePath(this._basePath, baseRoutePath) : this._basePath,
-      path: path11,
+      path: path12,
       method,
       handler
     };
-    this.router.add(method, path11, [handler, r]);
+    this.router.add(method, path12, [handler, r]);
     this.routes.push(r);
   }
   #handleError(err, c) {
@@ -2054,10 +2055,10 @@ var Hono = class _Hono {
     if (method === "HEAD") {
       return (async () => new Response(null, await this.#dispatch(request, executionCtx, env, "GET")))();
     }
-    const path11 = this.getPath(request, { env });
-    const matchResult = this.router.match(method, path11);
+    const path12 = this.getPath(request, { env });
+    const matchResult = this.router.match(method, path12);
     const c = new Context(request, {
-      path: path11,
+      path: path12,
       matchResult,
       env,
       executionCtx,
@@ -2160,7 +2161,7 @@ var createNullObject = () => /* @__PURE__ */ Object.create(null);
 
 // node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/router/reg-exp-router/matcher.js
 var emptyParam = [];
-function match(method, path11) {
+function match(method, path12) {
   const matchers = this.buildAllMatchers();
   const match2 = ((method2, path22) => {
     const matcher = matchers[method2] || matchers[METHOD_NAME_ALL];
@@ -2176,7 +2177,7 @@ function match(method, path11) {
     return [matcher[1][index], match3];
   });
   this.match = match2;
-  return match2(method, path11);
+  return match2(method, path12);
 }
 
 // node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/router/reg-exp-router/node.js
@@ -2293,14 +2294,14 @@ var Trie = class {
   #index = 0;
   // dynamic path -> [handler index, param assoc]; static paths are not registered
   paths = createNullObject();
-  insert(path11, isStatic) {
+  insert(path12, isStatic) {
     if (isStatic) {
-      this.#root.insert(path11.split(""), 0, [], this.#context, true);
+      this.#root.insert(path12.split(""), 0, [], this.#context, true);
       return;
     }
     const paramAssoc = [];
     const groups = [];
-    let markedPath = path11;
+    let markedPath = path12;
     for (let i = 0; ; ) {
       let replaced = false;
       markedPath = markedPath.replace(/\{[^}]+\}/g, (m) => {
@@ -2325,7 +2326,7 @@ var Trie = class {
       }
     }
     this.#root.insert(tokens, this.#index, paramAssoc, this.#context, false);
-    this.paths[path11] = [this.#index++, paramAssoc];
+    this.paths[path12] = [this.#index++, paramAssoc];
   }
   buildRegExp() {
     let regexp = this.#root.buildRegExpStr();
@@ -2352,17 +2353,17 @@ var Trie = class {
 
 // node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/router/reg-exp-router/router.js
 var wildcardRegExpCache = createNullObject();
-function buildWildcardRegExp(path11) {
-  return wildcardRegExpCache[path11] ??= new RegExp(
-    `^${path11.replace(
+function buildWildcardRegExp(path12) {
+  return wildcardRegExpCache[path12] ??= new RegExp(
+    `^${path12.replace(
       /\/:[^/{}]+(?:\{\[\^\/]\+})?(?=[/{]|$)|\/?\*$|([.\\+*[^\]$()?{}|])/g,
       (match2, metaChar) => metaChar ? `\\${metaChar}` : match2 === "/*" ? TAIL_WILDCARD_REG_EXP_STR : match2 === "*" ? ONLY_WILDCARD_REG_EXP_STR : `/:${LABEL_REG_EXP_STR}`
     )}$`
   );
 }
-function findMiddleware(middleware, path11) {
+function findMiddleware(middleware, path12) {
   for (const k of Object.keys(middleware).sort((a, b) => b.length - a.length)) {
-    if (buildWildcardRegExp(k).test(path11)) {
+    if (buildWildcardRegExp(k).test(path12)) {
       return [...middleware[k]];
     }
   }
@@ -2378,14 +2379,14 @@ var RegExpRouter = class {
     this.#routes = { [METHOD_NAME_ALL]: createNullObject() };
     this.#tries = { [METHOD_NAME_ALL]: new Trie() };
   }
-  #insertPath(method, path11) {
+  #insertPath(method, path12) {
     try {
-      this.#tries[method].insert(path11, !/\*|\/:/.test(path11));
+      this.#tries[method].insert(path12, !/\*|\/:/.test(path12));
     } catch (e) {
-      throw e === PATH_ERROR ? new UnsupportedPathError(path11) : e;
+      throw e === PATH_ERROR ? new UnsupportedPathError(path12) : e;
     }
   }
-  add(method, path11, handler) {
+  add(method, path12, handler) {
     const middleware = this.#middleware;
     const routes = this.#routes;
     if (!middleware) {
@@ -2401,28 +2402,28 @@ var RegExpRouter = class {
         }
       }
     }
-    if (path11 === "/*") {
-      path11 = "*";
+    if (path12 === "/*") {
+      path12 = "*";
     }
     const methods = method === METHOD_NAME_ALL ? Object.keys(middleware) : [method];
-    if (/\*$/.test(path11)) {
-      const re = buildWildcardRegExp(path11);
+    if (/\*$/.test(path12)) {
+      const re = buildWildcardRegExp(path12);
       for (const m of methods) {
-        if (!middleware[m][path11]) {
-          this.#insertPath(m, path11);
-          middleware[m][path11] = findMiddleware(middleware[m], path11) || findMiddleware(middleware[METHOD_NAME_ALL], path11) || [];
+        if (!middleware[m][path12]) {
+          this.#insertPath(m, path12);
+          middleware[m][path12] = findMiddleware(middleware[m], path12) || findMiddleware(middleware[METHOD_NAME_ALL], path12) || [];
         }
       }
       for (const handlerMap of [middleware, routes]) {
         for (const m of methods) {
           for (const p in handlerMap[m]) {
-            re.test(p) && handlerMap[m][p].push([handler, path11]);
+            re.test(p) && handlerMap[m][p].push([handler, path12]);
           }
         }
       }
       return;
     }
-    const paths = checkOptionalParameter(path11) || [path11];
+    const paths = checkOptionalParameter(path12) || [path12];
     for (const path22 of paths) {
       for (const m of methods) {
         if (!routes[m][path22]) {
@@ -2451,11 +2452,11 @@ var RegExpRouter = class {
     const handlerData = [];
     const [regexp, indexReplacementMap, paramReplacementMap] = trie.buildRegExp();
     for (const r of [middleware, routes]) {
-      for (const path11 in r) {
-        const handlers = r[path11];
-        const pathData = trie.paths[path11];
+      for (const path12 in r) {
+        const handlers = r[path12];
+        const pathData = trie.paths[path12];
         if (!pathData) {
-          staticMap[path11] = [handlers.map(([h]) => [h, createNullObject()]), emptyParam];
+          staticMap[path12] = [handlers.map(([h]) => [h, createNullObject()]), emptyParam];
           continue;
         }
         handlerData[pathData[0]] = handlers.map(([h, handlerPath]) => [
@@ -2479,13 +2480,13 @@ var SmartRouter = class {
   constructor(init) {
     this.#routers = init.routers;
   }
-  add(method, path11, handler) {
+  add(method, path12, handler) {
     if (!this.#routes) {
       throw new Error(MESSAGE_MATCHER_IS_ALREADY_BUILT);
     }
-    this.#routes.push([method, path11, handler]);
+    this.#routes.push([method, path12, handler]);
   }
-  match(method, path11) {
+  match(method, path12) {
     if (!this.#routes) {
       throw new Error("Fatal error");
     }
@@ -2500,7 +2501,7 @@ var SmartRouter = class {
         for (let i2 = 0, len2 = routes.length; i2 < len2; i2++) {
           router.add(...routes[i2]);
         }
-        res = router.match(method, path11);
+        res = router.match(method, path12);
       } catch (e) {
         if (e instanceof UnsupportedPathError) {
           continue;
@@ -2535,9 +2536,9 @@ var Node2 = class _Node2 {
   #patterns = [];
   #pattern;
   #params = emptyParams;
-  insert(method, path11, handler) {
+  insert(method, path12, handler) {
     let curNode = this;
-    const parts = splitRoutingPath(path11);
+    const parts = splitRoutingPath(path12);
     const possibleKeys = /* @__PURE__ */ new Set();
     let i = 0;
     for (const p of parts) {
@@ -2577,12 +2578,12 @@ var Node2 = class _Node2 {
       }
     }
   }
-  search(method, path11) {
+  search(method, path12) {
     const handlerSets = [];
     this.#params = emptyParams;
     const curNode = this;
     let curNodes = [curNode];
-    const parts = splitPath(path11);
+    const parts = splitPath(path12);
     const curNodesQueue = [];
     const len = parts.length;
     let partOffsets = null;
@@ -2624,13 +2625,13 @@ var Node2 = class _Node2 {
           if (matcher !== true) {
             if (!partOffsets) {
               partOffsets = [];
-              let offset = path11[0] === "/" ? 1 : 0;
+              let offset = path12[0] === "/" ? 1 : 0;
               for (let p = 0; p < len; p++) {
                 partOffsets[p] = offset;
                 offset += parts[p].length + 1;
               }
             }
-            const restPathString = path11.slice(partOffsets[i]);
+            const restPathString = path12.slice(partOffsets[i]);
             const m = matcher.exec(restPathString);
             if (m) {
               params[name] = m[0];
@@ -2690,13 +2691,13 @@ var Node2 = class _Node2 {
 var TrieRouter = class {
   name = "TrieRouter";
   #node = new Node2();
-  add(method, path11, handler) {
-    for (const result of checkOptionalParameter(path11) || [path11]) {
+  add(method, path12, handler) {
+    for (const result of checkOptionalParameter(path12) || [path12]) {
       this.#node.insert(method, result, handler);
     }
   }
-  match(method, path11) {
-    return this.#node.search(method, path11);
+  match(method, path12) {
+    return this.#node.search(method, path12);
   }
 };
 
@@ -2902,6 +2903,11 @@ function parseSuffix(rest) {
     if (!isValidRef(ref)) throw new TargetKeyError(`invalid base ref: ${ref}`);
     return { kind: "base", ref };
   }
+  if (rest.startsWith("checkpoint:")) {
+    const n = rest.slice("checkpoint:".length);
+    if (!/^[1-9][0-9]{0,8}$/.test(n)) throw new TargetKeyError(`invalid checkpoint: ${n}`);
+    return { kind: "checkpoint", id: Number(n) };
+  }
   if (rest.startsWith("range:")) {
     const spec = rest.slice("range:".length);
     const idx = spec.indexOf("..");
@@ -2917,7 +2923,7 @@ function parseTargetKey(key) {
   if (typeof key !== "string" || !key) throw new TargetKeyError("empty target key");
   if (key.startsWith("worktree:")) {
     const rest = key.slice("worktree:".length);
-    const m = /^(.+):(working|staged|all|commit:.+|range:.+|base:.+)$/.exec(rest);
+    const m = /^(.+):(working|staged|all|commit:.+|range:.+|base:.+|checkpoint:[0-9]+)$/.exec(rest);
     if (!m?.[1] || !m[2]) throw new TargetKeyError(`invalid worktree target key: ${key}`);
     const worktree = m[1];
     if (!worktree.startsWith("/")) throw new TargetKeyError(`worktree path must be absolute: ${worktree}`);
@@ -2942,6 +2948,9 @@ function formatTargetKey(t) {
     case "base":
       suffix = `base:${t.ref}`;
       break;
+    case "checkpoint":
+      suffix = `checkpoint:${t.id}`;
+      break;
   }
   return t.worktree ? `worktree:${t.worktree}:${suffix}` : suffix;
 }
@@ -2992,6 +3001,17 @@ function moveBefore(list, id, before) {
   return rest;
 }
 
+// packages/shared/src/comments.ts
+function commentWorktree(c) {
+  return tryParseTargetKey(c.targetKey)?.worktree;
+}
+function awaitsAgent(c) {
+  return !c.exportedAt;
+}
+function awaitsReviewer(c) {
+  return c.replies?.at(-1)?.author === "agent";
+}
+
 // packages/server/src/errors.ts
 var HttpError = class extends Error {
   constructor(status, message, code) {
@@ -3075,6 +3095,14 @@ var GitError = class extends HttpError {
   exitCode;
   stderr;
 };
+function snapshotVars(snapshot) {
+  if (!snapshot) return {};
+  return {
+    GIT_OBJECT_DIRECTORY: snapshot.objects,
+    GIT_ALTERNATE_OBJECT_DIRECTORIES: snapshot.alternates,
+    ...snapshot.index ? { GIT_INDEX_FILE: snapshot.index } : {}
+  };
+}
 function assertAllowedGitArgs(args) {
   const sub = args[0];
   if (!sub || !ALLOWED_SUBCOMMANDS.has(sub)) {
@@ -3120,7 +3148,8 @@ async function runGit(args, opts) {
           LC_ALL: "C",
           GIT_PAGER: "cat",
           PAGER: "cat",
-          GIT_TERMINAL_PROMPT: "0"
+          GIT_TERMINAL_PROMPT: "0",
+          ...snapshotVars(opts.snapshot)
         },
         windowsHide: true
       },
@@ -3212,6 +3241,14 @@ async function applyOnce(cwd, patch, opts) {
   });
 }
 async function runGitWrite(args, opts) {
+  return execWrite(args, opts, {});
+}
+async function runGitSnapshot(args, opts) {
+  const allowed = args[0] === "add" && args[1] === "--all" && args.slice(2).every((a) => a === "--intent-to-add") || args[0] === "write-tree" && args[1] === "--missing-ok" && args.length === 2;
+  if (!allowed) throw new GitError(`not a snapshot command: git ${args.join(" ")}`, null, "", 400, "git_subcommand_forbidden");
+  return execWrite(args, opts, { GIT_OBJECT_DIRECTORY: opts.objects, GIT_INDEX_FILE: opts.index });
+}
+function execWrite(args, opts, extraEnv) {
   for (const arg of args) if (arg.includes("\0")) throw new GitError("NUL byte in git argument", null, "", 400, "git_bad_argument");
   return new Promise((resolve, reject) => {
     execFile(
@@ -3222,7 +3259,7 @@ async function runGitWrite(args, opts) {
         timeout: opts.timeoutMs ?? DEFAULT_GIT_TIMEOUT_MS,
         maxBuffer: 16 * 1024 * 1024,
         encoding: "utf8",
-        env: { ...process.env, LC_ALL: "C", GIT_PAGER: "cat", PAGER: "cat", GIT_TERMINAL_PROMPT: "0" },
+        env: { ...process.env, LC_ALL: "C", GIT_PAGER: "cat", PAGER: "cat", GIT_TERMINAL_PROMPT: "0", ...extraEnv },
         windowsHide: true
       },
       (error, stdout, stderr) => {
@@ -3374,8 +3411,18 @@ async function getRepoInfo(ctx, defaultTarget) {
 }
 
 // packages/server/src/targets.ts
+import path4 from "path";
+import { readFile as readFile2 } from "fs/promises";
+
+// packages/server/src/checkpoints.ts
+import path3 from "path";
+import { randomUUID } from "crypto";
+import { copyFile, mkdir as mkdir2, rm, stat as stat2, utimes } from "fs/promises";
+
+// packages/server/src/state.ts
+import os from "os";
 import path2 from "path";
-import { readFile } from "fs/promises";
+import { mkdir, open, readFile, rename, stat, unlink, writeFile } from "fs/promises";
 
 // packages/server/src/hash.ts
 import { createHash } from "crypto";
@@ -3391,6 +3438,278 @@ function hunkHash(lineContents) {
   );
 }
 
+// packages/server/src/state.ts
+function dataDir() {
+  const xdg = process.env.XDG_DATA_HOME;
+  const base = xdg?.trim() ? xdg : path2.join(os.homedir(), ".local", "share");
+  return path2.join(base, "warden");
+}
+function repoHash(repoRoot) {
+  return sha1(repoRoot).slice(0, 12);
+}
+function stateFilePath(repoRoot, baseDir = dataDir()) {
+  return path2.join(baseDir, repoHash(repoRoot), "state.json");
+}
+function defaultPrefs() {
+  return { viewMode: "unified", nvimSocketByRoot: {}, autoRefresh: true, railOpen: false, ignoreDebug: true };
+}
+function defaultState(repoRoot) {
+  return { schemaVersion: 1, repoRoot, targets: {}, todos: [], checkpoints: [], prefs: defaultPrefs() };
+}
+function ensureTarget(state, key) {
+  let t = state.targets[key];
+  if (!t) {
+    t = { viewed: {}, comments: [] };
+    state.targets[key] = t;
+  }
+  return t;
+}
+var usable = (v) => !!v && typeof v === "object" && typeof v.id === "string";
+var usableCheckpoint = (v) => {
+  const c = v;
+  return !!c && typeof c === "object" && Number.isInteger(c.id) && typeof c.tree === "string" && (c.worktree === void 0 || typeof c.worktree === "string");
+};
+var usableComment = (v) => usable(v) && typeof v.anchor === "object" && !!v.anchor;
+function normalise(raw2, repoRoot) {
+  const base = defaultState(repoRoot);
+  if (!raw2 || typeof raw2 !== "object") return base;
+  const r = raw2;
+  if (r.schemaVersion !== 1) return base;
+  const targets = {};
+  for (const [k, v] of Object.entries(r.targets ?? {})) {
+    if (!v || typeof v !== "object") continue;
+    targets[k] = {
+      viewed: typeof v.viewed === "object" && v.viewed ? v.viewed : {},
+      comments: Array.isArray(v.comments) ? v.comments.filter(usableComment) : [],
+      ...typeof v.head === "string" ? { head: v.head } : {}
+    };
+  }
+  migrateLocalViews(targets);
+  return {
+    schemaVersion: 1,
+    repoRoot: r.repoRoot ?? repoRoot,
+    targets,
+    // Issues were folded into todos (a todo links comments now); the few there were are let go,
+    // and the next write leaves them out of the file.
+    todos: Array.isArray(r.todos) ? r.todos.filter(usable) : [],
+    checkpoints: Array.isArray(r.checkpoints) ? r.checkpoints.filter(usableCheckpoint) : [],
+    prefs: {
+      ...defaultPrefs(),
+      ...r.prefs ?? {},
+      nvimSocketByRoot: r.prefs?.nvimSocketByRoot ?? {},
+      autoRefresh: typeof r.prefs?.autoRefresh === "boolean" ? r.prefs.autoRefresh : true,
+      railOpen: typeof r.prefs?.railOpen === "boolean" ? r.prefs.railOpen : false,
+      ignoreDebug: typeof r.prefs?.ignoreDebug === "boolean" ? r.prefs.ignoreDebug : true
+    }
+  };
+}
+function migrateLocalViews(targets) {
+  for (const key of Object.keys(targets).sort()) {
+    const scope = commentScopeKey(key);
+    if (scope === key) continue;
+    const src = targets[key];
+    delete targets[key];
+    if (src.comments.length === 0) continue;
+    let dst = targets[scope];
+    if (!dst) {
+      dst = { viewed: {}, comments: [] };
+      targets[scope] = dst;
+    }
+    dst.comments.push(...src.comments);
+  }
+}
+var LOCK_STALE_MS = 5e3;
+var LOCK_WAIT_MS = 5e3;
+async function sleep(ms) {
+  await new Promise((r) => setTimeout(r, ms));
+}
+var StateStore = class {
+  constructor(file, repoRoot) {
+    this.file = file;
+    this.repoRoot = repoRoot;
+  }
+  file;
+  repoRoot;
+  queue = Promise.resolve();
+  async load() {
+    try {
+      const text = await readFile(this.file, "utf8");
+      return normalise(JSON.parse(text), this.repoRoot);
+    } catch (e) {
+      const err = e;
+      if (err.code === "ENOENT") return defaultState(this.repoRoot);
+      if (e instanceof SyntaxError) {
+        try {
+          await rename(this.file, `${this.file}.corrupt-${Date.now()}`);
+        } catch {
+        }
+        return defaultState(this.repoRoot);
+      }
+      throw e;
+    }
+  }
+  /** Apply a mutation under lock. The callback receives the freshest on-disk state. */
+  update(fn) {
+    const run2 = async () => {
+      await mkdir(path2.dirname(this.file), { recursive: true });
+      const release = await this.acquireLock();
+      try {
+        const state = await this.load();
+        const result = await fn(state);
+        await this.writeAtomic(state);
+        return result;
+      } finally {
+        await release();
+      }
+    };
+    const p = this.queue.then(run2, run2);
+    this.queue = p.catch(() => void 0);
+    return p;
+  }
+  async writeAtomic(state) {
+    const tmp = `${this.file}.${process.pid}.${Date.now()}.tmp`;
+    await writeFile(tmp, JSON.stringify(state, null, 2) + "\n", "utf8");
+    await rename(tmp, this.file);
+  }
+  async acquireLock() {
+    const lock = `${this.file}.lock`;
+    const started = Date.now();
+    for (; ; ) {
+      try {
+        const fh = await open(lock, "wx");
+        await fh.writeFile(String(process.pid));
+        await fh.close();
+        return async () => {
+          try {
+            await unlink(lock);
+          } catch {
+          }
+        };
+      } catch (e) {
+        const err = e;
+        if (err.code !== "EEXIST") throw e;
+        try {
+          const st = await stat(lock);
+          if (Date.now() - st.mtimeMs > LOCK_STALE_MS) {
+            await unlink(lock).catch(() => void 0);
+            continue;
+          }
+        } catch {
+          continue;
+        }
+        if (Date.now() - started > LOCK_WAIT_MS) {
+          throw new Error(`timed out waiting for state lock ${lock}`);
+        }
+        await sleep(20);
+      }
+    }
+  }
+};
+function forgetWorktreeTargets(state, worktreePath) {
+  const prefix = `worktree:${worktreePath}:`;
+  const gone = /* @__PURE__ */ new Set();
+  for (const key of Object.keys(state.targets)) {
+    if (!key.startsWith(prefix)) continue;
+    for (const c of state.targets[key].comments) gone.add(c.id);
+    delete state.targets[key];
+  }
+  unlinkComments(state, gone);
+  state.checkpoints = state.checkpoints.filter((c) => c.worktree !== worktreePath);
+}
+function unlinkComments(state, ids) {
+  const gone = new Set(ids);
+  if (gone.size === 0) return;
+  for (const todo of state.todos) {
+    if (!todo.commentIds?.some((id) => gone.has(id))) continue;
+    const kept = todo.commentIds.filter((id) => !gone.has(id));
+    if (kept.length) todo.commentIds = kept;
+    else delete todo.commentIds;
+  }
+}
+
+// packages/server/src/checkpoints.ts
+function checkpointStore(stateFile) {
+  return path3.join(path3.dirname(stateFile), "checkpoints");
+}
+async function repoObjects(cwd) {
+  const r = await runGit(["rev-parse", "--git-path", "objects"], { cwd });
+  return path3.resolve(cwd, r.stdout.trim());
+}
+async function repoIndex(cwd) {
+  const r = await runGit(["rev-parse", "--git-path", "index"], { cwd });
+  return path3.resolve(cwd, r.stdout.trim());
+}
+async function checkpointObjects(cwd, store) {
+  return { objects: path3.join(store, "objects"), alternates: await repoObjects(cwd) };
+}
+async function withIndexCopy(cwd, store, fn) {
+  const tmp = path3.join(store, "tmp");
+  await mkdir2(path3.join(store, "objects"), { recursive: true });
+  await mkdir2(tmp, { recursive: true });
+  const [objects, index] = await Promise.all([checkpointObjects(cwd, store), repoIndex(cwd)]);
+  const copy = path3.join(tmp, `index-${randomUUID()}`);
+  try {
+    const st = await stat2(index).catch(() => void 0);
+    if (st) {
+      await copyFile(index, copy);
+      const earlier = Math.floor(st.mtimeMs / 1e3) - 1;
+      await utimes(copy, earlier, earlier);
+    }
+    return await fn({ ...objects, index: copy });
+  } finally {
+    await rm(copy, { force: true });
+    await rm(`${copy}.lock`, { force: true });
+  }
+}
+async function snapshotWorktree(cwd, store) {
+  return withIndexCopy(cwd, store, async (snapshot) => {
+    await runGitSnapshot(["add", "--all"], { cwd, ...snapshot });
+    const r = await runGitSnapshot(["write-tree", "--missing-ok"], { cwd, ...snapshot });
+    return r.stdout.trim();
+  });
+}
+async function withCheckpointIndex(cwd, store, fn) {
+  return withIndexCopy(cwd, store, async (snapshot) => {
+    await runGitSnapshot(["add", "--all", "--intent-to-add"], { cwd, ...snapshot });
+    return fn(snapshot);
+  });
+}
+var MAX_CHECKPOINTS = 20;
+var sameWorktree = (c, worktree) => c.worktree === worktree;
+function checkpointsOf(state, worktree) {
+  return state.checkpoints.filter((c) => sameWorktree(c, worktree));
+}
+function findCheckpoint(state, worktree, id) {
+  return state.checkpoints.find((c) => sameWorktree(c, worktree) && c.id === id);
+}
+function checkpointKey(c) {
+  return formatTargetKey({ kind: "checkpoint", id: c.id, ...c.worktree ? { worktree: c.worktree } : {} });
+}
+function forgetCheckpoint(state, c) {
+  state.checkpoints = state.checkpoints.filter((x) => x !== c);
+  const key = checkpointKey(c);
+  const gone = new Set((state.targets[key]?.comments ?? []).map((x) => x.id));
+  delete state.targets[key];
+  unlinkComments(state, gone);
+}
+function addCheckpoint(state, worktree, tree, head, handoff = false) {
+  const mine = checkpointsOf(state, worktree);
+  const id = mine.reduce((n, c) => Math.max(n, c.id), 0) + 1;
+  const checkpoint = { id, ...worktree ? { worktree } : {}, tree, head, createdAt: (/* @__PURE__ */ new Date()).toISOString(), ...handoff ? { handoff } : {} };
+  state.checkpoints.push(checkpoint);
+  for (const old of mine.slice(0, Math.max(0, mine.length + 1 - MAX_CHECKPOINTS))) forgetCheckpoint(state, old);
+  return checkpoint;
+}
+async function takeCheckpoint(store, cwd, worktree, opts = {}) {
+  const tree = await snapshotWorktree(cwd, checkpointStore(store.file));
+  const head = await revParse(cwd, "HEAD") ?? "";
+  return store.update((s) => {
+    const newest = checkpointsOf(s, worktree).at(-1);
+    if (newest?.tree === tree) return { checkpoint: newest, unchanged: true };
+    return { checkpoint: addCheckpoint(s, worktree, tree, head, opts.handoff), unchanged: false };
+  });
+}
+
 // packages/server/src/diffparse.ts
 function unquotePath(p) {
   if (!(p.length >= 2 && p.startsWith('"') && p.endsWith('"'))) return p;
@@ -3632,6 +3951,17 @@ function markDebugLines(diff, newSide, oldSide) {
 }
 
 // packages/server/src/targets.ts
+function checkpointOf(ctx) {
+  if (!ctx.checkpoint) throw new Error(`checkpoint of ${ctx.key} was not looked up`);
+  return ctx.checkpoint;
+}
+async function objectsFor(ctx) {
+  return ctx.target.kind === "checkpoint" ? { snapshot: await checkpointObjects(ctx.cwd, checkpointOf(ctx).store) } : {};
+}
+async function runDiff(ctx, args) {
+  if (ctx.target.kind !== "checkpoint") return (await runGit(args, { cwd: ctx.cwd })).stdout;
+  return withCheckpointIndex(ctx.cwd, checkpointOf(ctx).store, async (snapshot) => (await runGit(args, { cwd: ctx.cwd, snapshot })).stdout);
+}
 var DIFF_BASE_ARGS = ["diff", "--no-color", "--no-ext-diff", "-U3", "-M", "--find-renames"];
 function resolveTargetContext(repo, worktrees, key) {
   let target;
@@ -3685,6 +4015,8 @@ async function diffArgs(ctx) {
     }
     case "base":
       return [...DIFF_BASE_ARGS, await baseSha(ctx, t.ref)];
+    case "checkpoint":
+      return [...DIFF_BASE_ARGS, checkpointOf(ctx).tree];
   }
 }
 function includesUntracked(t) {
@@ -3726,8 +4058,7 @@ async function mapLimit(items, limit, fn) {
 }
 async function listTargetDiffs(ctx) {
   const args = await diffArgs(ctx);
-  const r = await runGit(args, { cwd: ctx.cwd });
-  const files = parseUnifiedDiff(r.stdout);
+  const files = parseUnifiedDiff(await runDiff(ctx, args));
   if (includesUntracked(ctx.target)) {
     const untracked = await listUntracked(ctx.cwd);
     const extra = await mapLimit(untracked, 8, (f) => untrackedDiff(ctx.cwd, f).catch(() => void 0));
@@ -3749,8 +4080,7 @@ async function getFileDiff(ctx, filePath, hints = {}) {
   const args = await diffArgs(ctx);
   const pathspec = [literal(filePath)];
   if (hints.oldPath && hints.oldPath !== filePath) pathspec.push(literal(hints.oldPath));
-  const r = await runGit([...args, "--", ...pathspec], { cwd: ctx.cwd });
-  const files = parseUnifiedDiff(r.stdout);
+  const files = parseUnifiedDiff(await runDiff(ctx, [...args, "--", ...pathspec]));
   return files.find((f) => f.path === filePath) ?? files[0];
 }
 async function refForSide(ctx, side) {
@@ -3770,6 +4100,8 @@ async function refForSide(ctx, side) {
       return await mergeBase(ctx.cwd, t.base, t.head) ?? t.base;
     case "base":
       return side === "new" ? void 0 : baseSha(ctx, t.ref);
+    case "checkpoint":
+      return side === "new" ? void 0 : checkpointOf(ctx).tree;
   }
 }
 async function getFullFile(ctx, filePath, side) {
@@ -3777,14 +4109,14 @@ async function getFullFile(ctx, filePath, side) {
   const ref = await refForSide(ctx, side);
   if (ref === void 0) {
     try {
-      const buf = await readFile(path2.join(ctx.cwd, filePath));
+      const buf = await readFile2(path4.join(ctx.cwd, filePath));
       return buf.toString("utf8");
     } catch {
       return null;
     }
   }
   try {
-    const r = await runGit(["show", `${ref}:${filePath}`], { cwd: ctx.cwd });
+    const r = await runGit(["show", `${ref}:${filePath}`], { cwd: ctx.cwd, ...await objectsFor(ctx) });
     return r.stdout;
   } catch (e) {
     if (e instanceof HttpError && e.code === "git_failed") return null;
@@ -3801,9 +4133,10 @@ async function pathsWithMarkers(ctx, side, paths) {
   else if (ref === ":0") args.push("--cached");
   else args.push(ref);
   const prefix = ref === void 0 || ref === ":0" ? "" : `${ref}:`;
+  const objects = await objectsFor(ctx);
   for (let i = 0; i < paths.length; i += GREP_CHUNK) {
     const chunk = paths.slice(i, i + GREP_CHUNK).map(literal);
-    const r = await runGit([...args, "--", ...chunk], { cwd: ctx.cwd, okCodes: [0, 1] });
+    const r = await runGit([...args, "--", ...chunk], { cwd: ctx.cwd, okCodes: [0, 1], ...objects });
     for (const p of r.stdout.split("\0")) if (p) found.add(p.startsWith(prefix) ? p.slice(prefix.length) : p);
   }
   return found;
@@ -4076,15 +4409,15 @@ function buildStagePatch(diff, mode, selection, opts = {}) {
 }
 
 // packages/server/src/worktrees.ts
-import path3 from "path";
-import { readdir, realpath as realpath2, stat } from "fs/promises";
+import path5 from "path";
+import { readdir, realpath as realpath2, stat as stat3 } from "fs/promises";
 function slotPath(ctx, slot) {
-  return path3.join(path3.dirname(ctx.commonRoot), `${path3.basename(ctx.commonRoot)}-${slot}`);
+  return path5.join(path5.dirname(ctx.commonRoot), `${path5.basename(ctx.commonRoot)}-${slot}`);
 }
 function slotOf(ctx, p) {
-  if (path3.dirname(p) !== path3.dirname(ctx.commonRoot)) return void 0;
-  const prefix = `${path3.basename(ctx.commonRoot)}-`;
-  const name = path3.basename(p);
+  if (path5.dirname(p) !== path5.dirname(ctx.commonRoot)) return void 0;
+  const prefix = `${path5.basename(ctx.commonRoot)}-`;
+  const name = path5.basename(p);
   const n = name.startsWith(prefix) ? name.slice(prefix.length) : "";
   return /^[1-9]\d*$/.test(n) ? Number(n) : void 0;
 }
@@ -4169,7 +4502,7 @@ async function assertBranchName(ctx, name) {
   }
 }
 async function dirUsable(p) {
-  const st = await stat(p).catch((e) => {
+  const st = await stat3(p).catch((e) => {
     if (e.code === "ENOENT") return void 0;
     throw e;
   });
@@ -4247,8 +4580,8 @@ async function checkoutWorktree(ctx, req) {
     if (e instanceof GitError && /already (checked out|used by worktree)/.test(e.stderr)) throw new HttpError(409, e.message, "branch_in_use");
     throw e;
   }
-  const real = await realpath2(target.path).catch(() => target.path);
-  const worktree = (await listWorktrees(ctx)).find((w) => w.path === real);
+  const real2 = await realpath2(target.path).catch(() => target.path);
+  const worktree = (await listWorktrees(ctx)).find((w) => w.path === real2);
   if (!worktree) throw new HttpError(500, `git checked ${branch} out at ${target.path} but does not list it`, "git_failed");
   return { worktree, slot: target.slot, reused: target.reuse };
 }
@@ -4266,7 +4599,7 @@ async function dropBranch(ctx, wt, asked) {
 }
 async function releaseWorktree(ctx, req) {
   const p = req.path.trim();
-  const wt = (await listWorktreesAll(ctx)).find((w) => w.path === p || p && w.path === path3.resolve(p));
+  const wt = (await listWorktreesAll(ctx)).find((w) => w.path === p || p && w.path === path5.resolve(p));
   if (!wt) throw badRequest(`unknown worktree: ${p}`, "unknown_worktree");
   if (wt.isMain) throw badRequest("the main worktree cannot be released", "main_worktree");
   if (wt.bare || slotOf(ctx, wt.path) === void 0) throw badRequest(`${wt.path} is not a slot; remove it instead`, "not_a_slot");
@@ -4282,7 +4615,7 @@ async function releaseWorktree(ctx, req) {
 }
 async function removeWorktree(ctx, req) {
   const p = req.path.trim();
-  const wt = (await listWorktreesAll(ctx)).find((w) => w.path === p || p && w.path === path3.resolve(p));
+  const wt = (await listWorktreesAll(ctx)).find((w) => w.path === p || p && w.path === path5.resolve(p));
   if (!wt) throw badRequest(`unknown worktree: ${p}`, "unknown_worktree");
   if (wt.isMain) throw badRequest("the main worktree cannot be removed", "main_worktree");
   const args = ["worktree", "remove"];
@@ -4302,181 +4635,6 @@ async function removeWorktree(ctx, req) {
   return dropBranch(ctx, wt, req.deleteBranch);
 }
 
-// packages/server/src/state.ts
-import os from "os";
-import path4 from "path";
-import { mkdir, open, readFile as readFile2, rename, stat as stat2, unlink, writeFile } from "fs/promises";
-function dataDir() {
-  const xdg = process.env.XDG_DATA_HOME;
-  const base = xdg?.trim() ? xdg : path4.join(os.homedir(), ".local", "share");
-  return path4.join(base, "warden");
-}
-function repoHash(repoRoot) {
-  return sha1(repoRoot).slice(0, 12);
-}
-function stateFilePath(repoRoot, baseDir = dataDir()) {
-  return path4.join(baseDir, repoHash(repoRoot), "state.json");
-}
-function defaultPrefs() {
-  return { viewMode: "unified", nvimSocketByRoot: {}, autoRefresh: true, railOpen: false, ignoreDebug: true };
-}
-function defaultState(repoRoot) {
-  return { schemaVersion: 1, repoRoot, targets: {}, issues: [], todos: [], prefs: defaultPrefs() };
-}
-function ensureTarget(state, key) {
-  let t = state.targets[key];
-  if (!t) {
-    t = { viewed: {}, comments: [] };
-    state.targets[key] = t;
-  }
-  return t;
-}
-var usable = (v) => !!v && typeof v === "object" && typeof v.id === "string";
-var usableComment = (v) => usable(v) && typeof v.anchor === "object" && !!v.anchor;
-function normalise(raw2, repoRoot) {
-  const base = defaultState(repoRoot);
-  if (!raw2 || typeof raw2 !== "object") return base;
-  const r = raw2;
-  if (r.schemaVersion !== 1) return base;
-  const targets = {};
-  for (const [k, v] of Object.entries(r.targets ?? {})) {
-    if (!v || typeof v !== "object") continue;
-    targets[k] = {
-      viewed: typeof v.viewed === "object" && v.viewed ? v.viewed : {},
-      comments: Array.isArray(v.comments) ? v.comments.filter(usableComment) : [],
-      ...typeof v.head === "string" ? { head: v.head } : {}
-    };
-  }
-  migrateLocalViews(targets);
-  return {
-    schemaVersion: 1,
-    repoRoot: r.repoRoot ?? repoRoot,
-    targets,
-    issues: Array.isArray(r.issues) ? r.issues.filter(usable) : [],
-    todos: Array.isArray(r.todos) ? r.todos.filter(usable) : [],
-    prefs: {
-      ...defaultPrefs(),
-      ...r.prefs ?? {},
-      nvimSocketByRoot: r.prefs?.nvimSocketByRoot ?? {},
-      autoRefresh: typeof r.prefs?.autoRefresh === "boolean" ? r.prefs.autoRefresh : true,
-      railOpen: typeof r.prefs?.railOpen === "boolean" ? r.prefs.railOpen : false,
-      ignoreDebug: typeof r.prefs?.ignoreDebug === "boolean" ? r.prefs.ignoreDebug : true
-    }
-  };
-}
-function migrateLocalViews(targets) {
-  for (const key of Object.keys(targets).sort()) {
-    const scope = commentScopeKey(key);
-    if (scope === key) continue;
-    const src = targets[key];
-    delete targets[key];
-    if (src.comments.length === 0) continue;
-    let dst = targets[scope];
-    if (!dst) {
-      dst = { viewed: {}, comments: [] };
-      targets[scope] = dst;
-    }
-    dst.comments.push(...src.comments);
-  }
-}
-var LOCK_STALE_MS = 5e3;
-var LOCK_WAIT_MS = 5e3;
-async function sleep(ms) {
-  await new Promise((r) => setTimeout(r, ms));
-}
-var StateStore = class {
-  constructor(file, repoRoot) {
-    this.file = file;
-    this.repoRoot = repoRoot;
-  }
-  file;
-  repoRoot;
-  queue = Promise.resolve();
-  async load() {
-    try {
-      const text = await readFile2(this.file, "utf8");
-      return normalise(JSON.parse(text), this.repoRoot);
-    } catch (e) {
-      const err = e;
-      if (err.code === "ENOENT") return defaultState(this.repoRoot);
-      if (e instanceof SyntaxError) {
-        try {
-          await rename(this.file, `${this.file}.corrupt-${Date.now()}`);
-        } catch {
-        }
-        return defaultState(this.repoRoot);
-      }
-      throw e;
-    }
-  }
-  /** Apply a mutation under lock. The callback receives the freshest on-disk state. */
-  update(fn) {
-    const run2 = async () => {
-      await mkdir(path4.dirname(this.file), { recursive: true });
-      const release = await this.acquireLock();
-      try {
-        const state = await this.load();
-        const result = await fn(state);
-        await this.writeAtomic(state);
-        return result;
-      } finally {
-        await release();
-      }
-    };
-    const p = this.queue.then(run2, run2);
-    this.queue = p.catch(() => void 0);
-    return p;
-  }
-  async writeAtomic(state) {
-    const tmp = `${this.file}.${process.pid}.${Date.now()}.tmp`;
-    await writeFile(tmp, JSON.stringify(state, null, 2) + "\n", "utf8");
-    await rename(tmp, this.file);
-  }
-  async acquireLock() {
-    const lock = `${this.file}.lock`;
-    const started = Date.now();
-    for (; ; ) {
-      try {
-        const fh = await open(lock, "wx");
-        await fh.writeFile(String(process.pid));
-        await fh.close();
-        return async () => {
-          try {
-            await unlink(lock);
-          } catch {
-          }
-        };
-      } catch (e) {
-        const err = e;
-        if (err.code !== "EEXIST") throw e;
-        try {
-          const st = await stat2(lock);
-          if (Date.now() - st.mtimeMs > LOCK_STALE_MS) {
-            await unlink(lock).catch(() => void 0);
-            continue;
-          }
-        } catch {
-          continue;
-        }
-        if (Date.now() - started > LOCK_WAIT_MS) {
-          throw new Error(`timed out waiting for state lock ${lock}`);
-        }
-        await sleep(20);
-      }
-    }
-  }
-};
-function forgetWorktreeTargets(state, worktreePath) {
-  const prefix = `worktree:${worktreePath}:`;
-  const gone = /* @__PURE__ */ new Set();
-  for (const key of Object.keys(state.targets)) {
-    if (!key.startsWith(prefix)) continue;
-    for (const c of state.targets[key].comments) gone.add(c.id);
-    delete state.targets[key];
-  }
-  if (gone.size) for (const issue of state.issues) issue.commentIds = issue.commentIds.filter((id) => !gone.has(id));
-}
-
 // packages/server/src/export.ts
 var LANG_BY_EXT = {
   ts: "ts",
@@ -4524,36 +4682,123 @@ function langForPath(filePath) {
   if (!m?.[1]) return "";
   return LANG_BY_EXT[m[1].toLowerCase()] ?? m[1].toLowerCase();
 }
+function shortId(id) {
+  return id.slice(0, 8);
+}
+var quote = (text) => text.replace(/\r\n/g, "\n").split("\n").map((l) => l ? `> ${l}` : ">").join("\n");
 function formatCommentSection(c) {
   const range = c.startLine === c.endLine ? `${c.startLine}` : `${c.startLine}-${c.endLine}`;
   const width = String(c.endLine).length;
   const code = c.codeSnippet.map((line, i) => `${String(c.startLine + i).padStart(width, " ")} | ${line}`).join("\n");
   const lang = langForPath(c.filePath);
-  const body = c.body.replace(/\r\n/g, "\n").split("\n").map((l) => l ? `> ${l}` : ">").join("\n");
   const fence = code.includes("```") ? "````" : "```";
   const orphanNote = c.status === "orphaned" ? " [orphaned: original location no longer exists]" : "";
-  return [`## ${c.filePath}:${range} (${c.side})${orphanNote}`, `${fence}${lang}`, code, fence, body].join("\n");
+  const parts = [`## ${c.filePath}:${range} (${c.side}) [id: ${shortId(c.id)}]${orphanNote}`, `${fence}${lang}`, code, fence, quote(c.body)];
+  for (const r of c.replies ?? []) parts.push(`${r.author === "agent" ? "Agent" : "Reviewer"} replied:
+${quote(r.body)}`);
+  return parts.join("\n");
 }
-function formatCommentsExport({ repoRoot, comments }) {
+function replyFooter(replyCommand) {
+  return `When you have dealt with a comment, answer it with \`${replyCommand} reply <id> "<what you changed, or why you did not>"\` so the reviewer sees your answer beside it.`;
+}
+function formatCommentsExport({ repoRoot, comments, replyCommand }) {
   const targets = [...new Set(comments.map((c) => c.targetKey))];
   const head = ["# Review comments", `Target: ${targets.join(", ") || "-"}`, `Repo: ${repoRoot}`, `Count: ${comments.length}`];
   const sections = comments.map(formatCommentSection);
-  return [head.join("\n"), ...sections].join("\n\n") + "\n";
+  const tail = replyCommand && comments.length > 0 ? [replyFooter(replyCommand)] : [];
+  return [head.join("\n"), ...sections, ...tail].join("\n\n") + "\n";
 }
-function formatIssueExport({ repoRoot, issue, comments }) {
-  const targets = [...new Set(comments.map((c) => c.targetKey))];
-  const head = [`# Issue: ${issue.title}`, `Status: ${issue.status}`, `Target: ${targets.join(", ") || "-"}`, `Repo: ${repoRoot}`, `Count: ${comments.length}`];
-  const parts = [head.join("\n")];
-  if (issue.body.trim()) parts.push(issue.body.trim());
-  parts.push(...comments.map(formatCommentSection));
-  return parts.join("\n\n") + "\n";
+function formatTodoExport({ todo, comments, replyCommand }) {
+  const body = todo.body.replace(/\r\n/g, "\n").trim();
+  const parts = [todo.title, ...body ? [body] : [], ...comments.map(formatCommentSection)];
+  if (replyCommand && comments.length > 0) parts.push(replyFooter(replyCommand));
+  return parts.join("\n\n");
+}
+
+// packages/server/src/feedback.ts
+import { realpath as realpath3 } from "fs/promises";
+import { randomUUID as randomUUID2 } from "crypto";
+async function real(p) {
+  try {
+    return await realpath3(p);
+  } catch {
+    return p;
+  }
+}
+function worktreeOf(c, mainRoot) {
+  return commentWorktree(c) ?? mainRoot;
+}
+async function commentsIn(state, worktreeRoot, mainRoot) {
+  const want = await real(worktreeRoot);
+  const resolved = /* @__PURE__ */ new Map();
+  const out = [];
+  for (const t of Object.values(state.targets)) {
+    for (const c of t.comments) {
+      const wt = worktreeOf(c, mainRoot);
+      let p = resolved.get(wt);
+      if (!p) {
+        p = real(wt);
+        resolved.set(wt, p);
+      }
+      if (await p === want) out.push(c);
+    }
+  }
+  return out;
+}
+async function takeFeedback(store, opts) {
+  if (opts.peek) return (await commentsIn(await store.load(), opts.worktreeRoot, opts.mainRoot)).filter(awaitsAgent);
+  return store.update(async (s) => {
+    const ids = new Set((await commentsIn(s, opts.worktreeRoot, opts.mainRoot)).filter(awaitsAgent).map((c) => c.id));
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const taken = [];
+    for (const t of Object.values(s.targets)) {
+      t.comments = t.comments.map((c) => {
+        if (!ids.has(c.id)) return c;
+        const next = { ...c, exportedAt: now, updatedAt: now, status: c.status === "active" ? "exported" : c.status };
+        taken.push(next);
+        return next;
+      });
+    }
+    return taken;
+  });
+}
+function locate(state, ref) {
+  const needle = ref.trim().toLowerCase();
+  if (!needle) throw badRequest("a comment id is required", "bad_comment_id");
+  const hits = [];
+  for (const t of Object.values(state.targets)) {
+    t.comments.forEach((c, index) => {
+      if (c.id === needle) hits.unshift({ list: t.comments, index });
+      else if (c.id.startsWith(needle)) hits.push({ list: t.comments, index });
+    });
+  }
+  const exact = hits[0] && hits[0].list[hits[0].index].id === needle;
+  if (hits.length === 0) throw notFound(`no comment with id ${ref}; it may have been resolved or deleted`, "unknown_comment");
+  if (!exact && hits.length > 1) throw badRequest(`id ${ref} matches ${hits.length} comments; give more of it`, "ambiguous_comment");
+  return hits[0];
+}
+async function addReply(store, ref, author, body) {
+  if (!body.trim()) throw badRequest("reply must not be empty", "empty_reply");
+  return store.update((s) => {
+    const { list, index } = locate(s, ref);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const reply2 = { id: randomUUID2(), author, body: body.trim(), at: now };
+    const prev = list[index];
+    const next = { ...prev, replies: [...prev.replies ?? [], reply2], updatedAt: now };
+    if (author === "reviewer") {
+      delete next.exportedAt;
+      if (next.status === "exported") next.status = "active";
+    }
+    list[index] = next;
+    return next;
+  });
 }
 
 // packages/server/src/nvim.ts
 import os2 from "os";
-import path5 from "path";
+import path6 from "path";
 import { execFile as execFile2 } from "child_process";
-import { readdir as readdir2, stat as stat3 } from "fs/promises";
+import { readdir as readdir2, stat as stat4 } from "fs/promises";
 var QUERY_TIMEOUT_MS = 500;
 var CACHE_TTL_MS = 1e4;
 function execNvim(args, timeoutMs) {
@@ -4582,14 +4827,14 @@ function socketDirs(env = process.env) {
     }
   }
   const tmp = env.TMPDIR || "/tmp";
-  if (user) dirs.push(path5.join(tmp, `nvim.${user}`));
-  if (env.NVIM_LISTEN_ADDRESS) dirs.push(path5.dirname(env.NVIM_LISTEN_ADDRESS));
+  if (user) dirs.push(path6.join(tmp, `nvim.${user}`));
+  if (env.NVIM_LISTEN_ADDRESS) dirs.push(path6.dirname(env.NVIM_LISTEN_ADDRESS));
   return [...new Set(dirs)];
 }
 var SOCKET_NAME = /^nvim\.(\d+)\.\d+$/;
 async function isSocket(p) {
   try {
-    return (await stat3(p)).isSocket();
+    return (await stat4(p)).isSocket();
   } catch {
     return false;
   }
@@ -4604,7 +4849,7 @@ async function findSockets(dirs = socketDirs()) {
       return;
     }
     for (const ent of entries) {
-      const full = path5.join(dir, ent.name);
+      const full = path6.join(dir, ent.name);
       const m = SOCKET_NAME.exec(ent.name);
       if (m && (ent.isSocket() || await isSocket(full))) {
         found.set(full, Number(m[1]));
@@ -4670,7 +4915,7 @@ var NvimService = class {
 
 // packages/server/src/tmux.ts
 import { execFile as execFile3 } from "child_process";
-import { realpath as realpath3 } from "fs/promises";
+import { realpath as realpath4 } from "fs/promises";
 var runTmux = (args) => new Promise((resolve, reject) => {
   execFile3("tmux", args, { encoding: "utf8", timeout: 5e3, maxBuffer: 1024 * 1024, windowsHide: true }, (error, stdout, stderr) => {
     if (!error) return resolve(stdout);
@@ -4686,29 +4931,29 @@ var TmuxService = class {
   }
   run;
   async sessions(mainRoot) {
-    const root = await realpath3(mainRoot);
+    const root = await realpath4(mainRoot);
     const output = await this.run(["list-sessions", "-F", "#{session_id}	#{session_name}	#{session_path}"]);
     const sessions = [];
     for (const line of output.trimEnd().split("\n")) {
       const [id, name, ...parts] = line.split("	");
-      const path11 = parts.join("	");
-      if (!id || !/^\$\d+$/.test(id) || !name || !path11) continue;
-      if (await realpath3(path11).catch(() => null) === root) sessions.push({ id, name, path: path11 });
+      const path12 = parts.join("	");
+      if (!id || !/^\$\d+$/.test(id) || !name || !path12) continue;
+      if (await realpath4(path12).catch(() => null) === root) sessions.push({ id, name, path: path12 });
     }
     return sessions;
   }
   async open(mainRoot, worktreePath, sessionId) {
     const session = (await this.sessions(mainRoot)).find((s) => s.id === sessionId);
     if (!session) throw new HttpError(409, "\u4E3B\u4ED3\u5E93\u5BF9\u5E94\u7684 tmux session \u5DF2\u4E0D\u5B58\u5728\uFF0C\u8BF7\u5237\u65B0\u540E\u91CD\u8BD5", "tmux_session_missing");
-    const directory = await realpath3(worktreePath);
+    const directory = await realpath4(worktreePath);
     const window = (await this.run(["new-window", "-d", "-P", "-F", "#{window_id}", "-t", `${session.id}:`, "-c", directory.replaceAll("#", "##")])).trim();
     return { session: session.name, window };
   }
 };
 
 // packages/server/src/watcher.ts
-import path6 from "path";
-import { stat as stat4 } from "fs/promises";
+import path7 from "path";
+import { stat as stat5 } from "fs/promises";
 var DEFAULT_POLL_INTERVAL_MS = 1500;
 function statusPaths(out) {
   const parts = out.split("\0");
@@ -4804,7 +5049,7 @@ var RepoWatcher = class {
     const stats = await Promise.all(
       statusPaths(statusRes.stdout).map(async (rel) => {
         try {
-          const st = await stat4(path6.join(this.root, rel));
+          const st = await stat5(path7.join(this.root, rel));
           return `${rel}	${st.mtimeMs}	${st.size}`;
         } catch {
           return `${rel}	-`;
@@ -4816,8 +5061,8 @@ var RepoWatcher = class {
 };
 
 // packages/server/src/static.ts
-import path7 from "path";
-import { readFile as readFile3, stat as stat5 } from "fs/promises";
+import path8 from "path";
+import { readFile as readFile3, stat as stat6 } from "fs/promises";
 var MIME = {
   ".html": "text/html; charset=utf-8",
   ".js": "text/javascript; charset=utf-8",
@@ -4834,20 +5079,20 @@ var MIME = {
   ".txt": "text/plain; charset=utf-8"
 };
 async function serveStaticFile(c, webDir) {
-  const root = path7.resolve(webDir);
+  const root = path8.resolve(webDir);
   let rel;
   try {
     rel = decodeURIComponent(c.req.path);
   } catch {
     return c.text("Bad Request", 400);
   }
-  let target = path7.resolve(root, "." + rel);
-  if (target !== root && !target.startsWith(root + path7.sep)) return c.text("Forbidden", 403);
+  let target = path8.resolve(root, "." + rel);
+  if (target !== root && !target.startsWith(root + path8.sep)) return c.text("Forbidden", 403);
   try {
-    const st = await stat5(target);
-    if (st.isDirectory()) target = path7.join(target, "index.html");
+    const st = await stat6(target);
+    if (st.isDirectory()) target = path8.join(target, "index.html");
   } catch {
-    target = path7.join(root, "index.html");
+    target = path8.join(root, "index.html");
   }
   let body;
   try {
@@ -4855,7 +5100,7 @@ async function serveStaticFile(c, webDir) {
   } catch {
     return c.text("Not Found", 404);
   }
-  const ext = path7.extname(target).toLowerCase();
+  const ext = path8.extname(target).toLowerCase();
   const isAsset = rel.startsWith("/assets/");
   return new Response(new Uint8Array(body), {
     status: 200,
@@ -4868,6 +5113,7 @@ async function serveStaticFile(c, webDir) {
 
 // packages/server/src/app.ts
 var SSE_HEARTBEAT_MS = 15e3;
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "localhost"]);
 var LISTING_HINT_TTL_MS = 5 * 6e4;
 function createApp(opts) {
   const { repo, store } = opts;
@@ -4891,7 +5137,12 @@ function createApp(opts) {
     worktreeCache = { at: Date.now(), list };
     return list;
   };
-  const targetCtx = async (key) => {
+  const checkpoints = checkpointStore(store.file);
+  const stateStamp = () => stat7(store.file).then(
+    (st) => st.mtimeMs,
+    () => 0
+  );
+  const worktreeCtx = async (key) => {
     let list = await worktrees();
     try {
       return resolveTargetContext(repo, list, key);
@@ -4903,6 +5154,13 @@ function createApp(opts) {
       throw e;
     }
   };
+  const targetCtx = async (key) => {
+    const ctx = await worktreeCtx(key);
+    if (ctx.target.kind !== "checkpoint") return ctx;
+    const cp = findCheckpoint(await store.load(), ctx.target.worktree, ctx.target.id);
+    if (!cp) throw notFound(`no checkpoint #${ctx.target.id} in this worktree`, "unknown_checkpoint");
+    return { ...ctx, checkpoint: { tree: cp.tree, store: checkpoints } };
+  };
   const fileDiffWithHints = async (ctx, filePath, explicit) => {
     const cached = listings.get(ctx.key);
     const hint = cached && Date.now() - cached.at < LISTING_HINT_TTL_MS ? cached.files.find((f) => f.path === filePath) : void 0;
@@ -4911,6 +5169,14 @@ function createApp(opts) {
       untracked: explicit?.untracked ?? hint?.untracked
     });
   };
+  const checkpointHandoff = (comments) => {
+    const worktrees2 = new Set(comments.map((x) => tryParseTargetKey(x.targetKey)?.worktree));
+    for (const wt of worktrees2) {
+      takeCheckpoint(store, wt ?? repo.root, wt, { handoff: true }).catch((e) => {
+        console.error(`warden: no checkpoint for the comments handed over in ${wt ?? repo.root}: ${e instanceof Error ? e.message : e}`);
+      });
+    }
+  };
   const findComment = (state, id) => {
     for (const [targetKey, t] of Object.entries(state.targets)) {
       const index = t.comments.findIndex((c) => c.id === id);
@@ -4918,6 +5184,13 @@ function createApp(opts) {
     }
     return void 0;
   };
+  const linkable = (state, raw2) => {
+    if (!Array.isArray(raw2) || raw2.some((x) => typeof x !== "string")) throw badRequest("commentIds must be a list of ids");
+    const ids = [...new Set(raw2)];
+    const missing = ids.find((x) => !findComment(state, x));
+    if (missing) throw notFound(`no comment with id ${missing}`, "unknown_comment");
+    return ids;
+  };
   app.onError((err, c) => {
     if (err instanceof HttpError) {
       return c.json({ error: err.message, code: err.code }, err.status);
@@ -4925,10 +5198,20 @@ function createApp(opts) {
     console.error(err);
     return c.json({ error: err instanceof Error ? err.message : String(err), code: "internal" }, 500);
   });
+  app.use("*", async (c, next) => {
+    const host = new URL(c.req.url).hostname;
+    if (!LOOPBACK_HOSTS.has(host)) {
+      throw new HttpError(403, `requests for host ${host} are refused; open warden at http://127.0.0.1 or http://localhost`, "bad_host");
+    }
+    await next();
+  });
   const api = new Hono2();
   api.use("*", async (c, next) => {
-    if (c.req.method !== "GET" && c.req.method !== "HEAD" && c.req.header("sec-fetch-site") === "cross-site") {
-      throw new HttpError(403, "cross-site requests are refused", "cross_site");
+    if (c.req.method !== "GET" && c.req.method !== "HEAD") {
+      const origin = c.req.header("origin");
+      if (c.req.header("sec-fetch-site") === "cross-site" || origin && origin !== new URL(c.req.url).origin) {
+        throw new HttpError(403, "cross-site requests are refused", "cross_site");
+      }
     }
     await next();
   });
@@ -4939,7 +5222,7 @@ function createApp(opts) {
     worktreeCache = { at: Date.now(), list: info.worktrees };
     const last = state.prefs.lastTarget;
     const target = last ? tryParseTargetKey(last) : void 0;
-    const usable2 = !!target && (!target.worktree || info.worktrees.some((w) => w.path === target.worktree));
+    const usable2 = !!target && (!target.worktree || info.worktrees.some((w) => w.path === target.worktree)) && (target.kind !== "checkpoint" || !!findCheckpoint(state, target.worktree, target.id));
     if (last && usable2) info.defaultTarget = last;
     else if (last) {
       await store.update((s) => {
@@ -5038,6 +5321,27 @@ function createApp(opts) {
     changedNotices.get(key)?.delete(body.path);
     return c.json({ viewed });
   });
+  api.get("/targets/:key/checkpoints", async (c) => {
+    const ctx = await worktreeCtx(c.req.param("key"));
+    const res = { checkpoints: checkpointsOf(await store.load(), ctx.target.worktree) };
+    return c.json(res);
+  });
+  api.post("/targets/:key/checkpoints", async (c) => {
+    const ctx = await worktreeCtx(c.req.param("key"));
+    const { checkpoint, unchanged } = await takeCheckpoint(store, ctx.cwd, ctx.target.worktree);
+    const res = { checkpoint, unchanged, targetKey: checkpointKey(checkpoint) };
+    return c.json(res, unchanged ? 200 : 201);
+  });
+  api.delete("/targets/:key/checkpoints/:id", async (c) => {
+    const ctx = await worktreeCtx(c.req.param("key"));
+    const id = Number(c.req.param("id"));
+    await store.update((s) => {
+      const cp = Number.isInteger(id) ? findCheckpoint(s, ctx.target.worktree, id) : void 0;
+      if (!cp) throw notFound(`no checkpoint #${c.req.param("id")} in this worktree`, "unknown_checkpoint");
+      forgetCheckpoint(s, cp);
+    });
+    return c.json({ ok: true });
+  });
   api.post("/targets/:key/stage", async (c) => {
     const key = c.req.param("key");
     const ctx = await targetCtx(key);
@@ -5079,7 +5383,7 @@ function createApp(opts) {
     if (!anchored) throw badRequest("selection is not fully visible in the diff on that side (must be inside one hunk)", "bad_selection");
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const comment = {
-      id: randomUUID(),
+      id: randomUUID3(),
       targetKey: key,
       filePath: body.filePath,
       side: body.side,
@@ -5150,12 +5454,19 @@ function createApp(opts) {
       if (!t) return false;
       const before = t.comments.length;
       t.comments = t.comments.filter((x) => x.id !== id);
-      for (const issue of s.issues) issue.commentIds = issue.commentIds.filter((x) => x !== id);
+      unlinkComments(s, [id]);
       return t.comments.length !== before;
     });
     if (!removed) throw notFound("comment not found");
     return c.json({ ok: true });
   });
+  api.post("/targets/:key/comments/:id/replies", async (c) => {
+    const body = await c.req.json();
+    if (typeof body.body !== "string") throw badRequest("body is required");
+    const found = findComment(await store.load(), c.req.param("id"));
+    if (!found || found.targetKey !== commentScopeKey(c.req.param("key"))) throw notFound("comment not found");
+    return c.json(await addReply(store, found.comment.id, "reviewer", body.body), 201);
+  });
   api.post("/targets/:key/comments/reanchor", async (c) => {
     const key = c.req.param("key");
     const ctx = await targetCtx(key);
@@ -5227,7 +5538,7 @@ function createApp(opts) {
         const patch = located.get(cm.id);
         if (!patch) {
           if (!comments.some((x) => x.id === cm.id)) return [cm];
-          if (committed) {
+          if (committed && !cm.replies?.length) {
             dropped.push(cm.id);
             return [];
           }
@@ -5237,9 +5548,7 @@ function createApp(opts) {
         const unchanged = cm.targetKey === next.targetKey && cm.status === next.status && cm.startLine === next.startLine && cm.endLine === next.endLine && cm.anchor.hunkHash === next.anchor.hunkHash;
         return [unchanged ? cm : { ...next, updatedAt: now }];
       });
-      for (const id of dropped) {
-        for (const issue of s.issues) issue.commentIds = issue.commentIds.filter((x) => x !== id);
-      }
+      unlinkComments(s, dropped);
       t.head = head;
       return t.comments;
     });
@@ -5250,6 +5559,7 @@ function createApp(opts) {
     const body = await c.req.json();
     if (!Array.isArray(body.commentIds)) throw badRequest("commentIds required");
     const ids = body.commentIds.filter((x) => typeof x === "string");
+    let handed = [];
     const res = await store.update((s) => {
       const now = (/* @__PURE__ */ new Date()).toISOString();
       const selected = [];
@@ -5261,94 +5571,14 @@ function createApp(opts) {
         s.targets[found.targetKey].comments[found.index] = next;
         selected.push(next);
       }
+      handed = selected;
       return {
-        text: formatCommentsExport({ repoRoot: repo.root, comments: selected }),
+        text: formatCommentsExport({ repoRoot: repo.root, comments: selected, replyCommand: opts.replyCommand }),
         count: selected.length,
         commentIds: selected.map((x) => x.id)
       };
     });
-    return c.json(res);
-  });
-  api.get("/issues", async (c) => {
-    const s = await store.load();
-    return c.json({ issues: s.issues });
-  });
-  api.post("/issues", async (c) => {
-    const body = await c.req.json();
-    if (!body.title?.trim()) throw badRequest("title is required");
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const issue = {
-      id: randomUUID(),
-      title: body.title.trim(),
-      body: typeof body.body === "string" ? body.body : "",
-      status: body.status === "closed" ? "closed" : "open",
-      commentIds: Array.isArray(body.commentIds) ? body.commentIds.filter((x) => typeof x === "string") : [],
-      createdAt: now,
-      updatedAt: now
-    };
-    await store.update((s) => {
-      s.issues = insertAfter(s.issues, issue, typeof body.after === "string" ? body.after : void 0);
-    });
-    return c.json(issue, 201);
-  });
-  api.post("/issues/:id/move", async (c) => {
-    const id = c.req.param("id");
-    const body = await c.req.json();
-    if (body.before !== null && typeof body.before !== "string") throw badRequest("before must be an id or null");
-    const issues = await store.update((s) => {
-      const next = moveBefore(s.issues, id, body.before);
-      if (!next) throw notFound("issue not found");
-      s.issues = next;
-      return s.issues;
-    });
-    return c.json({ issues });
-  });
-  api.patch("/issues/:id", async (c) => {
-    const id = c.req.param("id");
-    const body = await c.req.json();
-    const updated = await store.update((s) => {
-      const issue = s.issues.find((i) => i.id === id);
-      if (!issue) throw notFound("issue not found");
-      if (typeof body.title === "string" && body.title.trim()) issue.title = body.title.trim();
-      if (typeof body.body === "string") issue.body = body.body;
-      if (body.status === "open" || body.status === "closed") issue.status = body.status;
-      if (Array.isArray(body.commentIds)) issue.commentIds = [...new Set(body.commentIds.filter((x) => typeof x === "string"))];
-      issue.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-      return issue;
-    });
-    return c.json(updated);
-  });
-  api.delete("/issues/:id", async (c) => {
-    const id = c.req.param("id");
-    const removed = await store.update((s) => {
-      const before = s.issues.length;
-      s.issues = s.issues.filter((i) => i.id !== id);
-      return s.issues.length !== before;
-    });
-    if (!removed) throw notFound("issue not found");
-    return c.json({ ok: true });
-  });
-  api.post("/issues/:id/export", async (c) => {
-    const id = c.req.param("id");
-    const res = await store.update((s) => {
-      const issue = s.issues.find((i) => i.id === id);
-      if (!issue) throw notFound("issue not found");
-      const now = (/* @__PURE__ */ new Date()).toISOString();
-      const comments = [];
-      for (const cid of issue.commentIds) {
-        const found = findComment(s, cid);
-        if (!found) continue;
-        const next = { ...found.comment, exportedAt: now, updatedAt: now };
-        if (next.status === "active") next.status = "exported";
-        s.targets[found.targetKey].comments[found.index] = next;
-        comments.push(next);
-      }
-      return {
-        text: formatIssueExport({ repoRoot: repo.root, issue, comments }),
-        count: comments.length,
-        commentIds: comments.map((x) => x.id)
-      };
-    });
+    checkpointHandoff(handed);
     return c.json(res);
   });
   const knownRoot = async (rootParam) => {
@@ -5372,7 +5602,7 @@ function createApp(opts) {
     const branch = body.branch?.trim() || await currentBranch(await knownRoot(body.root));
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const todo = {
-      id: randomUUID(),
+      id: randomUUID3(),
       branch,
       title: body.title.trim(),
       body: typeof body.body === "string" ? body.body : "",
@@ -5381,6 +5611,10 @@ function createApp(opts) {
       updatedAt: now
     };
     await store.update((s) => {
+      if (body.commentIds !== void 0) {
+        const ids = linkable(s, body.commentIds);
+        if (ids.length) todo.commentIds = ids;
+      }
       s.todos = insertAfter(s.todos, todo, typeof body.after === "string" ? body.after : void 0);
     });
     return c.json(todo, 201);
@@ -5407,11 +5641,40 @@ function createApp(opts) {
       if (typeof body.title === "string" && body.title.trim()) todo.title = body.title.trim();
       if (typeof body.body === "string") todo.body = body.body;
       if (body.status === "open" || body.status === "done") todo.status = body.status;
+      if (body.commentIds !== void 0) {
+        const ids = linkable(s, body.commentIds);
+        if (ids.length) todo.commentIds = ids;
+        else delete todo.commentIds;
+      }
       todo.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
       return todo;
     });
     return c.json(updated);
   });
+  api.post("/todos/:id/export", async (c) => {
+    const id = c.req.param("id");
+    const handed = [];
+    const res = await store.update((s) => {
+      const todo = s.todos.find((t) => t.id === id);
+      if (!todo) throw notFound("todo not found");
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      for (const cid of todo.commentIds ?? []) {
+        const found = findComment(s, cid);
+        if (!found) continue;
+        const next = { ...found.comment, exportedAt: now, updatedAt: now };
+        if (next.status === "active") next.status = "exported";
+        s.targets[found.targetKey].comments[found.index] = next;
+        handed.push(next);
+      }
+      return {
+        text: formatTodoExport({ todo, comments: handed, replyCommand: opts.replyCommand }),
+        count: handed.length,
+        commentIds: handed.map((x) => x.id)
+      };
+    });
+    checkpointHandoff(handed);
+    return c.json(res);
+  });
   api.delete("/todos/:id", async (c) => {
     const id = c.req.param("id");
     const removed = await store.update((s) => {
@@ -5490,8 +5753,31 @@ function createApp(opts) {
     return c.json(await tmux.open(repo.commonRoot, wt.path, body.sessionId), 201);
   });
   api.get("/worktrees", async (c) => {
-    const list = await listWorktreesDetailed(repo);
+    const [list, state] = await Promise.all([listWorktreesDetailed(repo), store.load()]);
     const [branches, newSlot] = await Promise.all([listBranches(repo, list), nextSlot(repo, list)]);
+    const review = /* @__PURE__ */ new Map();
+    const latest = /* @__PURE__ */ new Map();
+    for (const t of Object.values(state.targets)) {
+      for (const cm of t.comments) {
+        const at = commentWorktree(cm) ?? repo.root;
+        const r = review.get(at) ?? { toAgent: 0, toReviewer: 0 };
+        const seen = latest.get(at) ?? { agent: "", reviewer: "" };
+        if (awaitsAgent(cm)) {
+          r.toAgent++;
+          if (cm.updatedAt >= seen.agent) [seen.agent, r.toAgentTarget] = [cm.updatedAt, cm.targetKey];
+        }
+        if (awaitsReviewer(cm)) {
+          r.toReviewer++;
+          if (cm.updatedAt >= seen.reviewer) [seen.reviewer, r.toReviewerTarget] = [cm.updatedAt, cm.targetKey];
+        }
+        review.set(at, r);
+        latest.set(at, seen);
+      }
+    }
+    for (const wt of list) {
+      const r = review.get(wt.path);
+      if (r && (r.toAgent || r.toReviewer)) wt.review = r;
+    }
     const res = { worktrees: list, branches, newSlot };
     return c.json(res);
   });
@@ -5538,7 +5824,19 @@ function createApp(opts) {
         const event = { type: "changed", ...change };
         void enqueue(() => stream2.writeSSE({ event: "changed", data: JSON.stringify(event) }));
       });
-      stream2.onAbort(release);
+      let stamp = await stateStamp();
+      const statePoll = setInterval(() => {
+        void stateStamp().then((next) => {
+          if (next === stamp) return;
+          stamp = next;
+          const event = { type: "state", at: (/* @__PURE__ */ new Date()).toISOString() };
+          void enqueue(() => stream2.writeSSE({ event: "state", data: JSON.stringify(event) }));
+        });
+      }, opts.watchIntervalMs ?? DEFAULT_POLL_INTERVAL_MS);
+      stream2.onAbort(() => {
+        clearInterval(statePoll);
+        release();
+      });
       try {
         while (!stream2.aborted && !stream2.closed) {
           await stream2.sleep(SSE_HEARTBEAT_MS);
@@ -5546,6 +5844,7 @@ function createApp(opts) {
           await enqueue(() => stream2.write(": ping\n\n"));
         }
       } finally {
+        clearInterval(statePoll);
         release();
       }
     });
@@ -5574,7 +5873,7 @@ function createApp(opts) {
   api.post("/nvim/open", async (c) => {
     const body = await c.req.json();
     if (!body.socket || !body.absPath) throw badRequest("socket and absPath are required");
-    if (!path8.isAbsolute(body.absPath)) throw badRequest("absPath must be absolute");
+    if (!path9.isAbsolute(body.absPath)) throw badRequest("absPath must be absolute");
     const scan = await nvim.scan();
     if (!scan.instances.some((i) => i.socket === body.socket)) {
       const fresh = await nvim.scan(true);
@@ -5634,14 +5933,14 @@ function reachableFromWindows(port, token, timeoutMs = PROBE_TIMEOUT_MS) {
 }
 
 // packages/server/src/update.ts
-import path9 from "path";
-import { mkdir as mkdir2, readFile as readFile5, writeFile as writeFile2 } from "fs/promises";
+import path10 from "path";
+import { mkdir as mkdir3, readFile as readFile5, writeFile as writeFile2 } from "fs/promises";
 var PACKAGE = "@xbghc/warden";
 var LATEST_URL = "https://registry.npmjs.org/@xbghc%2fwarden/latest";
 var FETCH_TIMEOUT_MS = 3e3;
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
 function updateCacheFile(baseDir = dataDir()) {
-  return path9.join(baseDir, "update-check.json");
+  return path10.join(baseDir, "update-check.json");
 }
 function updateCheckEnabled(env = process.env) {
   return !env.WARDEN_NO_UPDATE_CHECK && !env.NO_UPDATE_NOTIFIER && !env.CI;
@@ -5675,7 +5974,7 @@ async function readCache(file, now) {
 }
 async function writeCache(file, cache) {
   try {
-    await mkdir2(path9.dirname(file), { recursive: true });
+    await mkdir3(path10.dirname(file), { recursive: true });
     await writeFile2(file, JSON.stringify(cache));
   } catch {
   }
@@ -5720,8 +6019,8 @@ async function startServer(opts) {
   const repo = await resolveRepo(opts.repoPath);
   const stateFile = opts.stateFile ?? stateFilePath(repo.commonRoot);
   const store = new StateStore(stateFile, repo.commonRoot);
-  const instanceToken = randomUUID2();
-  const app = createApp({ repo, store, nvim: new NvimService(), webDir: opts.webDir, instanceToken, update: opts.update });
+  const instanceToken = randomUUID4();
+  const app = createApp({ repo, store, nvim: new NvimService(), webDir: opts.webDir, instanceToken, update: opts.update, replyCommand: opts.replyCommand });
   const listen = (p) => new Promise((resolve, reject) => {
     const s = serve({ fetch: app.fetch, hostname: HOST, port: p }, () => resolve(s));
     s.once("error", reject);
@@ -5763,8 +6062,68 @@ async function startServer(opts) {
   };
 }
 
+// bin/agent.ts
+var AGENT_COMMANDS = ["feedback", "reply"];
+function agentUsage(cmd) {
+  return `Commands for the agent, run inside the worktree under review:
+  ${cmd} feedback [--peek]      Print the review comments not yet handed over, and mark them handed
+                               over (--peek leaves them as they are)
+  ${cmd} reply <id> <message>   Answer a comment; <id> is the one in its heading. A message of "-",
+                               or none with stdin piped, is read from stdin
+`;
+}
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8");
+}
+async function openStore() {
+  const repo = await resolveRepo(process.cwd());
+  return { store: new StateStore(stateFilePath(repo.commonRoot), repo.commonRoot), root: repo.root, commonRoot: repo.commonRoot };
+}
+async function feedback(args, replyCommand) {
+  const unknown = args.find((a) => a !== "--peek");
+  if (unknown) throw new Error(`unknown argument: ${unknown}`);
+  const { store, root, commonRoot } = await openStore();
+  const peek = args.includes("--peek");
+  const comments = await takeFeedback(store, { worktreeRoot: root, mainRoot: commonRoot, peek });
+  if (comments.length === 0) {
+    console.log("No review comments are waiting for you.");
+    return;
+  }
+  if (!peek) {
+    await takeCheckpoint(store, root, root === commonRoot ? void 0 : root, { handoff: true }).catch((e) => {
+      console.error(`warden feedback: no checkpoint taken: ${e instanceof Error ? e.message : e}`);
+    });
+  }
+  process.stdout.write(formatCommentsExport({ repoRoot: root, comments, replyCommand }));
+}
+async function reply(args) {
+  const [id, ...words] = args;
+  if (!id) throw new Error("reply needs a comment id");
+  let body = words.join(" ");
+  if (body === "-" || !body && !process.stdin.isTTY) body = await readStdin();
+  if (!body.trim()) throw new Error("reply needs a message");
+  const { store } = await openStore();
+  const c = await addReply(store, id, "agent", body);
+  const range = c.startLine === c.endLine ? `${c.startLine}` : `${c.startLine}-${c.endLine}`;
+  console.log(`Replied to ${shortId(c.id)} (${c.filePath}:${range}).`);
+}
+async function runAgentCommand(argv, replyCommand) {
+  const [cmd, ...rest] = argv;
+  if (!cmd || !AGENT_COMMANDS.includes(cmd)) return void 0;
+  try {
+    if (cmd === "feedback") await feedback(rest, replyCommand);
+    else await reply(rest);
+    return 0;
+  } catch (e) {
+    console.error(`warden ${cmd}: ${e instanceof HttpError || e instanceof Error ? e.message : String(e)}`);
+    return 1;
+  }
+}
+
 // bin/cli.ts
-var VERSION = true ? "0.14.0" : "dev";
+var VERSION = true ? "0.16.0" : "dev";
 function parseArgs(argv) {
   const args = { repoPath: process.cwd(), open: true, updateCheck: true, help: false, version: false };
   for (let i = 0; i < argv.length; i++) {
@@ -5783,14 +6142,17 @@ function parseArgs(argv) {
     } else if (a === "--help" || a === "-h") args.help = true;
     else if (a === "--version" || a === "-v") args.version = true;
     else if (a.startsWith("-")) throw new Error(`unknown option: ${a}`);
-    else args.repoPath = path10.resolve(a);
+    else args.repoPath = path11.resolve(a);
   }
   return args;
 }
+var viaNpx = fileURLToPath(import.meta.url).includes(`${path11.sep}_npx${path11.sep}`);
+var selfCommand = viaNpx ? "npx @xbghc/warden" : "warden";
 function usage() {
   return `warden \u2014 local git diff review UI
 
 Usage: warden [repoPath] [options]
+       warden <command> [args]
 
 Options:
   --port <n>, -p <n>   Listen on a fixed port (default: first free port from 4100, and under WSL
@@ -5800,6 +6162,9 @@ Options:
                        (also: WARDEN_NO_UPDATE_CHECK=1, NO_UPDATE_NOTIFIER=1, CI)
   -h, --help           Show this help
   -v, --version        Print version
+
+${agentUsage("warden")}
+A repository in a directory named after a command is given as ./<name>.
 `;
 }
 async function openBrowser(url) {
@@ -5828,20 +6193,22 @@ async function openBrowser(url) {
   return false;
 }
 function resolveWebDir() {
-  const here = path10.dirname(fileURLToPath(import.meta.url));
+  const here = path11.dirname(fileURLToPath(import.meta.url));
   const candidates = [
     process.env.WARDEN_WEB_DIR,
-    path10.join(here, "web"),
+    path11.join(here, "web"),
     // dist/cli.js -> dist/web
-    path10.join(here, "..", "dist", "web")
+    path11.join(here, "..", "dist", "web")
     // bin/cli.ts (tsx dev) -> dist/web
   ].filter((p) => !!p);
   for (const dir of candidates) {
-    if (existsSync2(path10.join(dir, "index.html"))) return dir;
+    if (existsSync2(path11.join(dir, "index.html"))) return dir;
   }
   return void 0;
 }
 async function main() {
+  const code = await runAgentCommand(process.argv.slice(2), selfCommand);
+  if (code !== void 0) process.exit(code);
   let args;
   try {
     args = parseArgs(process.argv.slice(2));
@@ -5862,12 +6229,11 @@ async function main() {
   if (!webDir) {
     console.error("warning: built web assets not found (dist/web). Only the /api endpoints will be served.");
   }
-  const viaNpx = fileURLToPath(import.meta.url).includes(`${path10.sep}_npx${path10.sep}`);
   const checking = args.updateCheck && VERSION !== "dev" && updateCheckEnabled();
   const update = checking ? checkForUpdate({ current: VERSION, npx: viaNpx }) : Promise.resolve(null);
   let server;
   try {
-    server = await startServer({ repoPath: args.repoPath, port: args.port, webDir, update });
+    server = await startServer({ repoPath: args.repoPath, port: args.port, webDir, update, replyCommand: selfCommand });
   } catch (e) {
     console.error(`warden: ${e.message}`);
     process.exit(1);