@xbghc/warden 0.15.0 → 0.16.0

package/dist/cli.js

@@ -8,7 +8,7 @@ import { fileURLToPath } from "url";
 
 // packages/server/src/index.ts
 import net from "net";
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 
 // node_modules/.pnpm/@hono+node-server@1.19.17_hono@4.13.7/node_modules/@hono/node-server/dist/index.mjs
 import { createServer as createServerHTTP } from "http";
@@ -653,7 +653,8 @@ var serve = (options, listeningListener) => {
 
 // packages/server/src/app.ts
 import path9 from "path";
-import { randomUUID as randomUUID2 } from "crypto";
+import { stat as stat7 } from "fs/promises";
+import { randomUUID as randomUUID3 } from "crypto";
 
 // node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/compose.js
 var compose = (middleware, onError, onNotFound) => {
@@ -3000,6 +3001,17 @@ function moveBefore(list, id, before) {
   return rest;
 }
 
+// packages/shared/src/comments.ts
+function commentWorktree(c) {
+  return tryParseTargetKey(c.targetKey)?.worktree;
+}
+function awaitsAgent(c) {
+  return !c.exportedAt;
+}
+function awaitsReviewer(c) {
+  return c.replies?.at(-1)?.author === "agent";
+}
+
 // packages/server/src/errors.ts
 var HttpError = class extends Error {
   constructor(status, message, code) {
@@ -3399,35 +3411,245 @@ async function getRepoInfo(ctx, defaultTarget) {
 }
 
 // packages/server/src/targets.ts
-import path3 from "path";
-import { readFile } from "fs/promises";
+import path4 from "path";
+import { readFile as readFile2 } from "fs/promises";
 
 // packages/server/src/checkpoints.ts
-import path2 from "path";
+import path3 from "path";
 import { randomUUID } from "crypto";
-import { copyFile, mkdir, rm, stat, utimes } from "fs/promises";
+import { copyFile, mkdir as mkdir2, rm, stat as stat2, utimes } from "fs/promises";
+
+// packages/server/src/state.ts
+import os from "os";
+import path2 from "path";
+import { mkdir, open, readFile, rename, stat, unlink, writeFile } from "fs/promises";
+
+// packages/server/src/hash.ts
+import { createHash } from "crypto";
+function sha1(input) {
+  return createHash("sha1").update(input).digest("hex");
+}
+function lineHash(content) {
+  return sha1(content.trimEnd());
+}
+function hunkHash(lineContents) {
+  return sha1(
+    lineContents.map((l) => l.trimEnd()).join("\n").trim()
+  );
+}
+
+// packages/server/src/state.ts
+function dataDir() {
+  const xdg = process.env.XDG_DATA_HOME;
+  const base = xdg?.trim() ? xdg : path2.join(os.homedir(), ".local", "share");
+  return path2.join(base, "warden");
+}
+function repoHash(repoRoot) {
+  return sha1(repoRoot).slice(0, 12);
+}
+function stateFilePath(repoRoot, baseDir = dataDir()) {
+  return path2.join(baseDir, repoHash(repoRoot), "state.json");
+}
+function defaultPrefs() {
+  return { viewMode: "unified", nvimSocketByRoot: {}, autoRefresh: true, railOpen: false, ignoreDebug: true };
+}
+function defaultState(repoRoot) {
+  return { schemaVersion: 1, repoRoot, targets: {}, todos: [], checkpoints: [], prefs: defaultPrefs() };
+}
+function ensureTarget(state, key) {
+  let t = state.targets[key];
+  if (!t) {
+    t = { viewed: {}, comments: [] };
+    state.targets[key] = t;
+  }
+  return t;
+}
+var usable = (v) => !!v && typeof v === "object" && typeof v.id === "string";
+var usableCheckpoint = (v) => {
+  const c = v;
+  return !!c && typeof c === "object" && Number.isInteger(c.id) && typeof c.tree === "string" && (c.worktree === void 0 || typeof c.worktree === "string");
+};
+var usableComment = (v) => usable(v) && typeof v.anchor === "object" && !!v.anchor;
+function normalise(raw2, repoRoot) {
+  const base = defaultState(repoRoot);
+  if (!raw2 || typeof raw2 !== "object") return base;
+  const r = raw2;
+  if (r.schemaVersion !== 1) return base;
+  const targets = {};
+  for (const [k, v] of Object.entries(r.targets ?? {})) {
+    if (!v || typeof v !== "object") continue;
+    targets[k] = {
+      viewed: typeof v.viewed === "object" && v.viewed ? v.viewed : {},
+      comments: Array.isArray(v.comments) ? v.comments.filter(usableComment) : [],
+      ...typeof v.head === "string" ? { head: v.head } : {}
+    };
+  }
+  migrateLocalViews(targets);
+  return {
+    schemaVersion: 1,
+    repoRoot: r.repoRoot ?? repoRoot,
+    targets,
+    // Issues were folded into todos (a todo links comments now); the few there were are let go,
+    // and the next write leaves them out of the file.
+    todos: Array.isArray(r.todos) ? r.todos.filter(usable) : [],
+    checkpoints: Array.isArray(r.checkpoints) ? r.checkpoints.filter(usableCheckpoint) : [],
+    prefs: {
+      ...defaultPrefs(),
+      ...r.prefs ?? {},
+      nvimSocketByRoot: r.prefs?.nvimSocketByRoot ?? {},
+      autoRefresh: typeof r.prefs?.autoRefresh === "boolean" ? r.prefs.autoRefresh : true,
+      railOpen: typeof r.prefs?.railOpen === "boolean" ? r.prefs.railOpen : false,
+      ignoreDebug: typeof r.prefs?.ignoreDebug === "boolean" ? r.prefs.ignoreDebug : true
+    }
+  };
+}
+function migrateLocalViews(targets) {
+  for (const key of Object.keys(targets).sort()) {
+    const scope = commentScopeKey(key);
+    if (scope === key) continue;
+    const src = targets[key];
+    delete targets[key];
+    if (src.comments.length === 0) continue;
+    let dst = targets[scope];
+    if (!dst) {
+      dst = { viewed: {}, comments: [] };
+      targets[scope] = dst;
+    }
+    dst.comments.push(...src.comments);
+  }
+}
+var LOCK_STALE_MS = 5e3;
+var LOCK_WAIT_MS = 5e3;
+async function sleep(ms) {
+  await new Promise((r) => setTimeout(r, ms));
+}
+var StateStore = class {
+  constructor(file, repoRoot) {
+    this.file = file;
+    this.repoRoot = repoRoot;
+  }
+  file;
+  repoRoot;
+  queue = Promise.resolve();
+  async load() {
+    try {
+      const text = await readFile(this.file, "utf8");
+      return normalise(JSON.parse(text), this.repoRoot);
+    } catch (e) {
+      const err = e;
+      if (err.code === "ENOENT") return defaultState(this.repoRoot);
+      if (e instanceof SyntaxError) {
+        try {
+          await rename(this.file, `${this.file}.corrupt-${Date.now()}`);
+        } catch {
+        }
+        return defaultState(this.repoRoot);
+      }
+      throw e;
+    }
+  }
+  /** Apply a mutation under lock. The callback receives the freshest on-disk state. */
+  update(fn) {
+    const run2 = async () => {
+      await mkdir(path2.dirname(this.file), { recursive: true });
+      const release = await this.acquireLock();
+      try {
+        const state = await this.load();
+        const result = await fn(state);
+        await this.writeAtomic(state);
+        return result;
+      } finally {
+        await release();
+      }
+    };
+    const p = this.queue.then(run2, run2);
+    this.queue = p.catch(() => void 0);
+    return p;
+  }
+  async writeAtomic(state) {
+    const tmp = `${this.file}.${process.pid}.${Date.now()}.tmp`;
+    await writeFile(tmp, JSON.stringify(state, null, 2) + "\n", "utf8");
+    await rename(tmp, this.file);
+  }
+  async acquireLock() {
+    const lock = `${this.file}.lock`;
+    const started = Date.now();
+    for (; ; ) {
+      try {
+        const fh = await open(lock, "wx");
+        await fh.writeFile(String(process.pid));
+        await fh.close();
+        return async () => {
+          try {
+            await unlink(lock);
+          } catch {
+          }
+        };
+      } catch (e) {
+        const err = e;
+        if (err.code !== "EEXIST") throw e;
+        try {
+          const st = await stat(lock);
+          if (Date.now() - st.mtimeMs > LOCK_STALE_MS) {
+            await unlink(lock).catch(() => void 0);
+            continue;
+          }
+        } catch {
+          continue;
+        }
+        if (Date.now() - started > LOCK_WAIT_MS) {
+          throw new Error(`timed out waiting for state lock ${lock}`);
+        }
+        await sleep(20);
+      }
+    }
+  }
+};
+function forgetWorktreeTargets(state, worktreePath) {
+  const prefix = `worktree:${worktreePath}:`;
+  const gone = /* @__PURE__ */ new Set();
+  for (const key of Object.keys(state.targets)) {
+    if (!key.startsWith(prefix)) continue;
+    for (const c of state.targets[key].comments) gone.add(c.id);
+    delete state.targets[key];
+  }
+  unlinkComments(state, gone);
+  state.checkpoints = state.checkpoints.filter((c) => c.worktree !== worktreePath);
+}
+function unlinkComments(state, ids) {
+  const gone = new Set(ids);
+  if (gone.size === 0) return;
+  for (const todo of state.todos) {
+    if (!todo.commentIds?.some((id) => gone.has(id))) continue;
+    const kept = todo.commentIds.filter((id) => !gone.has(id));
+    if (kept.length) todo.commentIds = kept;
+    else delete todo.commentIds;
+  }
+}
+
+// packages/server/src/checkpoints.ts
 function checkpointStore(stateFile) {
-  return path2.join(path2.dirname(stateFile), "checkpoints");
+  return path3.join(path3.dirname(stateFile), "checkpoints");
 }
 async function repoObjects(cwd) {
   const r = await runGit(["rev-parse", "--git-path", "objects"], { cwd });
-  return path2.resolve(cwd, r.stdout.trim());
+  return path3.resolve(cwd, r.stdout.trim());
 }
 async function repoIndex(cwd) {
   const r = await runGit(["rev-parse", "--git-path", "index"], { cwd });
-  return path2.resolve(cwd, r.stdout.trim());
+  return path3.resolve(cwd, r.stdout.trim());
 }
 async function checkpointObjects(cwd, store) {
-  return { objects: path2.join(store, "objects"), alternates: await repoObjects(cwd) };
+  return { objects: path3.join(store, "objects"), alternates: await repoObjects(cwd) };
 }
 async function withIndexCopy(cwd, store, fn) {
-  const tmp = path2.join(store, "tmp");
-  await mkdir(path2.join(store, "objects"), { recursive: true });
-  await mkdir(tmp, { recursive: true });
+  const tmp = path3.join(store, "tmp");
+  await mkdir2(path3.join(store, "objects"), { recursive: true });
+  await mkdir2(tmp, { recursive: true });
   const [objects, index] = await Promise.all([checkpointObjects(cwd, store), repoIndex(cwd)]);
-  const copy = path2.join(tmp, `index-${randomUUID()}`);
+  const copy = path3.join(tmp, `index-${randomUUID()}`);
   try {
-    const st = await stat(index).catch(() => void 0);
+    const st = await stat2(index).catch(() => void 0);
     if (st) {
       await copyFile(index, copy);
       const earlier = Math.floor(st.mtimeMs / 1e3) - 1;
@@ -3468,29 +3690,24 @@ function forgetCheckpoint(state, c) {
   const key = checkpointKey(c);
   const gone = new Set((state.targets[key]?.comments ?? []).map((x) => x.id));
   delete state.targets[key];
-  if (gone.size) for (const issue of state.issues) issue.commentIds = issue.commentIds.filter((id) => !gone.has(id));
+  unlinkComments(state, gone);
 }
-function addCheckpoint(state, worktree, tree, head) {
+function addCheckpoint(state, worktree, tree, head, handoff = false) {
   const mine = checkpointsOf(state, worktree);
   const id = mine.reduce((n, c) => Math.max(n, c.id), 0) + 1;
-  const checkpoint = { id, ...worktree ? { worktree } : {}, tree, head, createdAt: (/* @__PURE__ */ new Date()).toISOString() };
+  const checkpoint = { id, ...worktree ? { worktree } : {}, tree, head, createdAt: (/* @__PURE__ */ new Date()).toISOString(), ...handoff ? { handoff } : {} };
   state.checkpoints.push(checkpoint);
   for (const old of mine.slice(0, Math.max(0, mine.length + 1 - MAX_CHECKPOINTS))) forgetCheckpoint(state, old);
   return checkpoint;
 }
-
-// packages/server/src/hash.ts
-import { createHash } from "crypto";
-function sha1(input) {
-  return createHash("sha1").update(input).digest("hex");
-}
-function lineHash(content) {
-  return sha1(content.trimEnd());
-}
-function hunkHash(lineContents) {
-  return sha1(
-    lineContents.map((l) => l.trimEnd()).join("\n").trim()
-  );
+async function takeCheckpoint(store, cwd, worktree, opts = {}) {
+  const tree = await snapshotWorktree(cwd, checkpointStore(store.file));
+  const head = await revParse(cwd, "HEAD") ?? "";
+  return store.update((s) => {
+    const newest = checkpointsOf(s, worktree).at(-1);
+    if (newest?.tree === tree) return { checkpoint: newest, unchanged: true };
+    return { checkpoint: addCheckpoint(s, worktree, tree, head, opts.handoff), unchanged: false };
+  });
 }
 
 // packages/server/src/diffparse.ts
@@ -3892,7 +4109,7 @@ async function getFullFile(ctx, filePath, side) {
   const ref = await refForSide(ctx, side);
   if (ref === void 0) {
     try {
-      const buf = await readFile(path3.join(ctx.cwd, filePath));
+      const buf = await readFile2(path4.join(ctx.cwd, filePath));
       return buf.toString("utf8");
     } catch {
       return null;
@@ -4192,15 +4409,15 @@ function buildStagePatch(diff, mode, selection, opts = {}) {
 }
 
 // packages/server/src/worktrees.ts
-import path4 from "path";
-import { readdir, realpath as realpath2, stat as stat2 } from "fs/promises";
+import path5 from "path";
+import { readdir, realpath as realpath2, stat as stat3 } from "fs/promises";
 function slotPath(ctx, slot) {
-  return path4.join(path4.dirname(ctx.commonRoot), `${path4.basename(ctx.commonRoot)}-${slot}`);
+  return path5.join(path5.dirname(ctx.commonRoot), `${path5.basename(ctx.commonRoot)}-${slot}`);
 }
 function slotOf(ctx, p) {
-  if (path4.dirname(p) !== path4.dirname(ctx.commonRoot)) return void 0;
-  const prefix = `${path4.basename(ctx.commonRoot)}-`;
-  const name = path4.basename(p);
+  if (path5.dirname(p) !== path5.dirname(ctx.commonRoot)) return void 0;
+  const prefix = `${path5.basename(ctx.commonRoot)}-`;
+  const name = path5.basename(p);
   const n = name.startsWith(prefix) ? name.slice(prefix.length) : "";
   return /^[1-9]\d*$/.test(n) ? Number(n) : void 0;
 }
@@ -4285,7 +4502,7 @@ async function assertBranchName(ctx, name) {
   }
 }
 async function dirUsable(p) {
-  const st = await stat2(p).catch((e) => {
+  const st = await stat3(p).catch((e) => {
     if (e.code === "ENOENT") return void 0;
     throw e;
   });
@@ -4363,8 +4580,8 @@ async function checkoutWorktree(ctx, req) {
     if (e instanceof GitError && /already (checked out|used by worktree)/.test(e.stderr)) throw new HttpError(409, e.message, "branch_in_use");
     throw e;
   }
-  const real = await realpath2(target.path).catch(() => target.path);
-  const worktree = (await listWorktrees(ctx)).find((w) => w.path === real);
+  const real2 = await realpath2(target.path).catch(() => target.path);
+  const worktree = (await listWorktrees(ctx)).find((w) => w.path === real2);
   if (!worktree) throw new HttpError(500, `git checked ${branch} out at ${target.path} but does not list it`, "git_failed");
   return { worktree, slot: target.slot, reused: target.reuse };
 }
@@ -4382,7 +4599,7 @@ async function dropBranch(ctx, wt, asked) {
 }
 async function releaseWorktree(ctx, req) {
   const p = req.path.trim();
-  const wt = (await listWorktreesAll(ctx)).find((w) => w.path === p || p && w.path === path4.resolve(p));
+  const wt = (await listWorktreesAll(ctx)).find((w) => w.path === p || p && w.path === path5.resolve(p));
   if (!wt) throw badRequest(`unknown worktree: ${p}`, "unknown_worktree");
   if (wt.isMain) throw badRequest("the main worktree cannot be released", "main_worktree");
   if (wt.bare || slotOf(ctx, wt.path) === void 0) throw badRequest(`${wt.path} is not a slot; remove it instead`, "not_a_slot");
@@ -4398,7 +4615,7 @@ async function releaseWorktree(ctx, req) {
 }
 async function removeWorktree(ctx, req) {
   const p = req.path.trim();
-  const wt = (await listWorktreesAll(ctx)).find((w) => w.path === p || p && w.path === path4.resolve(p));
+  const wt = (await listWorktreesAll(ctx)).find((w) => w.path === p || p && w.path === path5.resolve(p));
   if (!wt) throw badRequest(`unknown worktree: ${p}`, "unknown_worktree");
   if (wt.isMain) throw badRequest("the main worktree cannot be removed", "main_worktree");
   const args = ["worktree", "remove"];
@@ -4418,187 +4635,6 @@ async function removeWorktree(ctx, req) {
   return dropBranch(ctx, wt, req.deleteBranch);
 }
 
-// packages/server/src/state.ts
-import os from "os";
-import path5 from "path";
-import { mkdir as mkdir2, open, readFile as readFile2, rename, stat as stat3, unlink, writeFile } from "fs/promises";
-function dataDir() {
-  const xdg = process.env.XDG_DATA_HOME;
-  const base = xdg?.trim() ? xdg : path5.join(os.homedir(), ".local", "share");
-  return path5.join(base, "warden");
-}
-function repoHash(repoRoot) {
-  return sha1(repoRoot).slice(0, 12);
-}
-function stateFilePath(repoRoot, baseDir = dataDir()) {
-  return path5.join(baseDir, repoHash(repoRoot), "state.json");
-}
-function defaultPrefs() {
-  return { viewMode: "unified", nvimSocketByRoot: {}, autoRefresh: true, railOpen: false, ignoreDebug: true };
-}
-function defaultState(repoRoot) {
-  return { schemaVersion: 1, repoRoot, targets: {}, issues: [], todos: [], checkpoints: [], prefs: defaultPrefs() };
-}
-function ensureTarget(state, key) {
-  let t = state.targets[key];
-  if (!t) {
-    t = { viewed: {}, comments: [] };
-    state.targets[key] = t;
-  }
-  return t;
-}
-var usable = (v) => !!v && typeof v === "object" && typeof v.id === "string";
-var usableCheckpoint = (v) => {
-  const c = v;
-  return !!c && typeof c === "object" && Number.isInteger(c.id) && typeof c.tree === "string" && (c.worktree === void 0 || typeof c.worktree === "string");
-};
-var usableComment = (v) => usable(v) && typeof v.anchor === "object" && !!v.anchor;
-function normalise(raw2, repoRoot) {
-  const base = defaultState(repoRoot);
-  if (!raw2 || typeof raw2 !== "object") return base;
-  const r = raw2;
-  if (r.schemaVersion !== 1) return base;
-  const targets = {};
-  for (const [k, v] of Object.entries(r.targets ?? {})) {
-    if (!v || typeof v !== "object") continue;
-    targets[k] = {
-      viewed: typeof v.viewed === "object" && v.viewed ? v.viewed : {},
-      comments: Array.isArray(v.comments) ? v.comments.filter(usableComment) : [],
-      ...typeof v.head === "string" ? { head: v.head } : {}
-    };
-  }
-  migrateLocalViews(targets);
-  return {
-    schemaVersion: 1,
-    repoRoot: r.repoRoot ?? repoRoot,
-    targets,
-    issues: Array.isArray(r.issues) ? r.issues.filter(usable) : [],
-    todos: Array.isArray(r.todos) ? r.todos.filter(usable) : [],
-    checkpoints: Array.isArray(r.checkpoints) ? r.checkpoints.filter(usableCheckpoint) : [],
-    prefs: {
-      ...defaultPrefs(),
-      ...r.prefs ?? {},
-      nvimSocketByRoot: r.prefs?.nvimSocketByRoot ?? {},
-      autoRefresh: typeof r.prefs?.autoRefresh === "boolean" ? r.prefs.autoRefresh : true,
-      railOpen: typeof r.prefs?.railOpen === "boolean" ? r.prefs.railOpen : false,
-      ignoreDebug: typeof r.prefs?.ignoreDebug === "boolean" ? r.prefs.ignoreDebug : true
-    }
-  };
-}
-function migrateLocalViews(targets) {
-  for (const key of Object.keys(targets).sort()) {
-    const scope = commentScopeKey(key);
-    if (scope === key) continue;
-    const src = targets[key];
-    delete targets[key];
-    if (src.comments.length === 0) continue;
-    let dst = targets[scope];
-    if (!dst) {
-      dst = { viewed: {}, comments: [] };
-      targets[scope] = dst;
-    }
-    dst.comments.push(...src.comments);
-  }
-}
-var LOCK_STALE_MS = 5e3;
-var LOCK_WAIT_MS = 5e3;
-async function sleep(ms) {
-  await new Promise((r) => setTimeout(r, ms));
-}
-var StateStore = class {
-  constructor(file, repoRoot) {
-    this.file = file;
-    this.repoRoot = repoRoot;
-  }
-  file;
-  repoRoot;
-  queue = Promise.resolve();
-  async load() {
-    try {
-      const text = await readFile2(this.file, "utf8");
-      return normalise(JSON.parse(text), this.repoRoot);
-    } catch (e) {
-      const err = e;
-      if (err.code === "ENOENT") return defaultState(this.repoRoot);
-      if (e instanceof SyntaxError) {
-        try {
-          await rename(this.file, `${this.file}.corrupt-${Date.now()}`);
-        } catch {
-        }
-        return defaultState(this.repoRoot);
-      }
-      throw e;
-    }
-  }
-  /** Apply a mutation under lock. The callback receives the freshest on-disk state. */
-  update(fn) {
-    const run2 = async () => {
-      await mkdir2(path5.dirname(this.file), { recursive: true });
-      const release = await this.acquireLock();
-      try {
-        const state = await this.load();
-        const result = await fn(state);
-        await this.writeAtomic(state);
-        return result;
-      } finally {
-        await release();
-      }
-    };
-    const p = this.queue.then(run2, run2);
-    this.queue = p.catch(() => void 0);
-    return p;
-  }
-  async writeAtomic(state) {
-    const tmp = `${this.file}.${process.pid}.${Date.now()}.tmp`;
-    await writeFile(tmp, JSON.stringify(state, null, 2) + "\n", "utf8");
-    await rename(tmp, this.file);
-  }
-  async acquireLock() {
-    const lock = `${this.file}.lock`;
-    const started = Date.now();
-    for (; ; ) {
-      try {
-        const fh = await open(lock, "wx");
-        await fh.writeFile(String(process.pid));
-        await fh.close();
-        return async () => {
-          try {
-            await unlink(lock);
-          } catch {
-          }
-        };
-      } catch (e) {
-        const err = e;
-        if (err.code !== "EEXIST") throw e;
-        try {
-          const st = await stat3(lock);
-          if (Date.now() - st.mtimeMs > LOCK_STALE_MS) {
-            await unlink(lock).catch(() => void 0);
-            continue;
-          }
-        } catch {
-          continue;
-        }
-        if (Date.now() - started > LOCK_WAIT_MS) {
-          throw new Error(`timed out waiting for state lock ${lock}`);
-        }
-        await sleep(20);
-      }
-    }
-  }
-};
-function forgetWorktreeTargets(state, worktreePath) {
-  const prefix = `worktree:${worktreePath}:`;
-  const gone = /* @__PURE__ */ new Set();
-  for (const key of Object.keys(state.targets)) {
-    if (!key.startsWith(prefix)) continue;
-    for (const c of state.targets[key].comments) gone.add(c.id);
-    delete state.targets[key];
-  }
-  if (gone.size) for (const issue of state.issues) issue.commentIds = issue.commentIds.filter((id) => !gone.has(id));
-  state.checkpoints = state.checkpoints.filter((c) => c.worktree !== worktreePath);
-}
-
 // packages/server/src/export.ts
 var LANG_BY_EXT = {
   ts: "ts",
@@ -4646,29 +4682,116 @@ function langForPath(filePath) {
   if (!m?.[1]) return "";
   return LANG_BY_EXT[m[1].toLowerCase()] ?? m[1].toLowerCase();
 }
+function shortId(id) {
+  return id.slice(0, 8);
+}
+var quote = (text) => text.replace(/\r\n/g, "\n").split("\n").map((l) => l ? `> ${l}` : ">").join("\n");
 function formatCommentSection(c) {
   const range = c.startLine === c.endLine ? `${c.startLine}` : `${c.startLine}-${c.endLine}`;
   const width = String(c.endLine).length;
   const code = c.codeSnippet.map((line, i) => `${String(c.startLine + i).padStart(width, " ")} | ${line}`).join("\n");
   const lang = langForPath(c.filePath);
-  const body = c.body.replace(/\r\n/g, "\n").split("\n").map((l) => l ? `> ${l}` : ">").join("\n");
   const fence = code.includes("```") ? "````" : "```";
   const orphanNote = c.status === "orphaned" ? " [orphaned: original location no longer exists]" : "";
-  return [`## ${c.filePath}:${range} (${c.side})${orphanNote}`, `${fence}${lang}`, code, fence, body].join("\n");
+  const parts = [`## ${c.filePath}:${range} (${c.side}) [id: ${shortId(c.id)}]${orphanNote}`, `${fence}${lang}`, code, fence, quote(c.body)];
+  for (const r of c.replies ?? []) parts.push(`${r.author === "agent" ? "Agent" : "Reviewer"} replied:
+${quote(r.body)}`);
+  return parts.join("\n");
+}
+function replyFooter(replyCommand) {
+  return `When you have dealt with a comment, answer it with \`${replyCommand} reply <id> "<what you changed, or why you did not>"\` so the reviewer sees your answer beside it.`;
 }
-function formatCommentsExport({ repoRoot, comments }) {
+function formatCommentsExport({ repoRoot, comments, replyCommand }) {
   const targets = [...new Set(comments.map((c) => c.targetKey))];
   const head = ["# Review comments", `Target: ${targets.join(", ") || "-"}`, `Repo: ${repoRoot}`, `Count: ${comments.length}`];
   const sections = comments.map(formatCommentSection);
-  return [head.join("\n"), ...sections].join("\n\n") + "\n";
+  const tail = replyCommand && comments.length > 0 ? [replyFooter(replyCommand)] : [];
+  return [head.join("\n"), ...sections, ...tail].join("\n\n") + "\n";
 }
-function formatIssueExport({ repoRoot, issue, comments }) {
-  const targets = [...new Set(comments.map((c) => c.targetKey))];
-  const head = [`# Issue: ${issue.title}`, `Status: ${issue.status}`, `Target: ${targets.join(", ") || "-"}`, `Repo: ${repoRoot}`, `Count: ${comments.length}`];
-  const parts = [head.join("\n")];
-  if (issue.body.trim()) parts.push(issue.body.trim());
-  parts.push(...comments.map(formatCommentSection));
-  return parts.join("\n\n") + "\n";
+function formatTodoExport({ todo, comments, replyCommand }) {
+  const body = todo.body.replace(/\r\n/g, "\n").trim();
+  const parts = [todo.title, ...body ? [body] : [], ...comments.map(formatCommentSection)];
+  if (replyCommand && comments.length > 0) parts.push(replyFooter(replyCommand));
+  return parts.join("\n\n");
+}
+
+// packages/server/src/feedback.ts
+import { realpath as realpath3 } from "fs/promises";
+import { randomUUID as randomUUID2 } from "crypto";
+async function real(p) {
+  try {
+    return await realpath3(p);
+  } catch {
+    return p;
+  }
+}
+function worktreeOf(c, mainRoot) {
+  return commentWorktree(c) ?? mainRoot;
+}
+async function commentsIn(state, worktreeRoot, mainRoot) {
+  const want = await real(worktreeRoot);
+  const resolved = /* @__PURE__ */ new Map();
+  const out = [];
+  for (const t of Object.values(state.targets)) {
+    for (const c of t.comments) {
+      const wt = worktreeOf(c, mainRoot);
+      let p = resolved.get(wt);
+      if (!p) {
+        p = real(wt);
+        resolved.set(wt, p);
+      }
+      if (await p === want) out.push(c);
+    }
+  }
+  return out;
+}
+async function takeFeedback(store, opts) {
+  if (opts.peek) return (await commentsIn(await store.load(), opts.worktreeRoot, opts.mainRoot)).filter(awaitsAgent);
+  return store.update(async (s) => {
+    const ids = new Set((await commentsIn(s, opts.worktreeRoot, opts.mainRoot)).filter(awaitsAgent).map((c) => c.id));
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const taken = [];
+    for (const t of Object.values(s.targets)) {
+      t.comments = t.comments.map((c) => {
+        if (!ids.has(c.id)) return c;
+        const next = { ...c, exportedAt: now, updatedAt: now, status: c.status === "active" ? "exported" : c.status };
+        taken.push(next);
+        return next;
+      });
+    }
+    return taken;
+  });
+}
+function locate(state, ref) {
+  const needle = ref.trim().toLowerCase();
+  if (!needle) throw badRequest("a comment id is required", "bad_comment_id");
+  const hits = [];
+  for (const t of Object.values(state.targets)) {
+    t.comments.forEach((c, index) => {
+      if (c.id === needle) hits.unshift({ list: t.comments, index });
+      else if (c.id.startsWith(needle)) hits.push({ list: t.comments, index });
+    });
+  }
+  const exact = hits[0] && hits[0].list[hits[0].index].id === needle;
+  if (hits.length === 0) throw notFound(`no comment with id ${ref}; it may have been resolved or deleted`, "unknown_comment");
+  if (!exact && hits.length > 1) throw badRequest(`id ${ref} matches ${hits.length} comments; give more of it`, "ambiguous_comment");
+  return hits[0];
+}
+async function addReply(store, ref, author, body) {
+  if (!body.trim()) throw badRequest("reply must not be empty", "empty_reply");
+  return store.update((s) => {
+    const { list, index } = locate(s, ref);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const reply2 = { id: randomUUID2(), author, body: body.trim(), at: now };
+    const prev = list[index];
+    const next = { ...prev, replies: [...prev.replies ?? [], reply2], updatedAt: now };
+    if (author === "reviewer") {
+      delete next.exportedAt;
+      if (next.status === "exported") next.status = "active";
+    }
+    list[index] = next;
+    return next;
+  });
 }
 
 // packages/server/src/nvim.ts
@@ -4792,7 +4915,7 @@ var NvimService = class {
 
 // packages/server/src/tmux.ts
 import { execFile as execFile3 } from "child_process";
-import { realpath as realpath3 } from "fs/promises";
+import { realpath as realpath4 } from "fs/promises";
 var runTmux = (args) => new Promise((resolve, reject) => {
   execFile3("tmux", args, { encoding: "utf8", timeout: 5e3, maxBuffer: 1024 * 1024, windowsHide: true }, (error, stdout, stderr) => {
     if (!error) return resolve(stdout);
@@ -4808,21 +4931,21 @@ var TmuxService = class {
   }
   run;
   async sessions(mainRoot) {
-    const root = await realpath3(mainRoot);
+    const root = await realpath4(mainRoot);
     const output = await this.run(["list-sessions", "-F", "#{session_id}	#{session_name}	#{session_path}"]);
     const sessions = [];
     for (const line of output.trimEnd().split("\n")) {
       const [id, name, ...parts] = line.split("	");
       const path12 = parts.join("	");
       if (!id || !/^\$\d+$/.test(id) || !name || !path12) continue;
-      if (await realpath3(path12).catch(() => null) === root) sessions.push({ id, name, path: path12 });
+      if (await realpath4(path12).catch(() => null) === root) sessions.push({ id, name, path: path12 });
     }
     return sessions;
   }
   async open(mainRoot, worktreePath, sessionId) {
     const session = (await this.sessions(mainRoot)).find((s) => s.id === sessionId);
     if (!session) throw new HttpError(409, "\u4E3B\u4ED3\u5E93\u5BF9\u5E94\u7684 tmux session \u5DF2\u4E0D\u5B58\u5728\uFF0C\u8BF7\u5237\u65B0\u540E\u91CD\u8BD5", "tmux_session_missing");
-    const directory = await realpath3(worktreePath);
+    const directory = await realpath4(worktreePath);
     const window = (await this.run(["new-window", "-d", "-P", "-F", "#{window_id}", "-t", `${session.id}:`, "-c", directory.replaceAll("#", "##")])).trim();
     return { session: session.name, window };
   }
@@ -4990,6 +5113,7 @@ async function serveStaticFile(c, webDir) {
 
 // packages/server/src/app.ts
 var SSE_HEARTBEAT_MS = 15e3;
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "localhost"]);
 var LISTING_HINT_TTL_MS = 5 * 6e4;
 function createApp(opts) {
   const { repo, store } = opts;
@@ -5014,6 +5138,10 @@ function createApp(opts) {
     return list;
   };
   const checkpoints = checkpointStore(store.file);
+  const stateStamp = () => stat7(store.file).then(
+    (st) => st.mtimeMs,
+    () => 0
+  );
   const worktreeCtx = async (key) => {
     let list = await worktrees();
     try {
@@ -5041,6 +5169,14 @@ function createApp(opts) {
       untracked: explicit?.untracked ?? hint?.untracked
     });
   };
+  const checkpointHandoff = (comments) => {
+    const worktrees2 = new Set(comments.map((x) => tryParseTargetKey(x.targetKey)?.worktree));
+    for (const wt of worktrees2) {
+      takeCheckpoint(store, wt ?? repo.root, wt, { handoff: true }).catch((e) => {
+        console.error(`warden: no checkpoint for the comments handed over in ${wt ?? repo.root}: ${e instanceof Error ? e.message : e}`);
+      });
+    }
+  };
   const findComment = (state, id) => {
     for (const [targetKey, t] of Object.entries(state.targets)) {
       const index = t.comments.findIndex((c) => c.id === id);
@@ -5048,6 +5184,13 @@ function createApp(opts) {
     }
     return void 0;
   };
+  const linkable = (state, raw2) => {
+    if (!Array.isArray(raw2) || raw2.some((x) => typeof x !== "string")) throw badRequest("commentIds must be a list of ids");
+    const ids = [...new Set(raw2)];
+    const missing = ids.find((x) => !findComment(state, x));
+    if (missing) throw notFound(`no comment with id ${missing}`, "unknown_comment");
+    return ids;
+  };
   app.onError((err, c) => {
     if (err instanceof HttpError) {
       return c.json({ error: err.message, code: err.code }, err.status);
@@ -5055,10 +5198,20 @@ function createApp(opts) {
     console.error(err);
     return c.json({ error: err instanceof Error ? err.message : String(err), code: "internal" }, 500);
   });
+  app.use("*", async (c, next) => {
+    const host = new URL(c.req.url).hostname;
+    if (!LOOPBACK_HOSTS.has(host)) {
+      throw new HttpError(403, `requests for host ${host} are refused; open warden at http://127.0.0.1 or http://localhost`, "bad_host");
+    }
+    await next();
+  });
   const api = new Hono2();
   api.use("*", async (c, next) => {
-    if (c.req.method !== "GET" && c.req.method !== "HEAD" && c.req.header("sec-fetch-site") === "cross-site") {
-      throw new HttpError(403, "cross-site requests are refused", "cross_site");
+    if (c.req.method !== "GET" && c.req.method !== "HEAD") {
+      const origin = c.req.header("origin");
+      if (c.req.header("sec-fetch-site") === "cross-site" || origin && origin !== new URL(c.req.url).origin) {
+        throw new HttpError(403, "cross-site requests are refused", "cross_site");
+      }
     }
     await next();
   });
@@ -5175,15 +5328,9 @@ function createApp(opts) {
   });
   api.post("/targets/:key/checkpoints", async (c) => {
     const ctx = await worktreeCtx(c.req.param("key"));
-    const tree = await snapshotWorktree(ctx.cwd, checkpoints);
-    const head = await revParse(ctx.cwd, "HEAD") ?? "";
-    const res = await store.update((s) => {
-      const newest = checkpointsOf(s, ctx.target.worktree).at(-1);
-      const unchanged = newest?.tree === tree;
-      const checkpoint = unchanged ? newest : addCheckpoint(s, ctx.target.worktree, tree, head);
-      return { checkpoint, unchanged, targetKey: checkpointKey(checkpoint) };
-    });
-    return c.json(res, res.unchanged ? 200 : 201);
+    const { checkpoint, unchanged } = await takeCheckpoint(store, ctx.cwd, ctx.target.worktree);
+    const res = { checkpoint, unchanged, targetKey: checkpointKey(checkpoint) };
+    return c.json(res, unchanged ? 200 : 201);
   });
   api.delete("/targets/:key/checkpoints/:id", async (c) => {
     const ctx = await worktreeCtx(c.req.param("key"));
@@ -5236,7 +5383,7 @@ function createApp(opts) {
     if (!anchored) throw badRequest("selection is not fully visible in the diff on that side (must be inside one hunk)", "bad_selection");
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const comment = {
-      id: randomUUID2(),
+      id: randomUUID3(),
       targetKey: key,
       filePath: body.filePath,
       side: body.side,
@@ -5307,12 +5454,19 @@ function createApp(opts) {
       if (!t) return false;
       const before = t.comments.length;
       t.comments = t.comments.filter((x) => x.id !== id);
-      for (const issue of s.issues) issue.commentIds = issue.commentIds.filter((x) => x !== id);
+      unlinkComments(s, [id]);
       return t.comments.length !== before;
     });
     if (!removed) throw notFound("comment not found");
     return c.json({ ok: true });
   });
+  api.post("/targets/:key/comments/:id/replies", async (c) => {
+    const body = await c.req.json();
+    if (typeof body.body !== "string") throw badRequest("body is required");
+    const found = findComment(await store.load(), c.req.param("id"));
+    if (!found || found.targetKey !== commentScopeKey(c.req.param("key"))) throw notFound("comment not found");
+    return c.json(await addReply(store, found.comment.id, "reviewer", body.body), 201);
+  });
   api.post("/targets/:key/comments/reanchor", async (c) => {
     const key = c.req.param("key");
     const ctx = await targetCtx(key);
@@ -5384,7 +5538,7 @@ function createApp(opts) {
         const patch = located.get(cm.id);
         if (!patch) {
           if (!comments.some((x) => x.id === cm.id)) return [cm];
-          if (committed) {
+          if (committed && !cm.replies?.length) {
             dropped.push(cm.id);
             return [];
           }
@@ -5394,9 +5548,7 @@ function createApp(opts) {
         const unchanged = cm.targetKey === next.targetKey && cm.status === next.status && cm.startLine === next.startLine && cm.endLine === next.endLine && cm.anchor.hunkHash === next.anchor.hunkHash;
         return [unchanged ? cm : { ...next, updatedAt: now }];
       });
-      for (const id of dropped) {
-        for (const issue of s.issues) issue.commentIds = issue.commentIds.filter((x) => x !== id);
-      }
+      unlinkComments(s, dropped);
       t.head = head;
       return t.comments;
     });
@@ -5407,6 +5559,7 @@ function createApp(opts) {
     const body = await c.req.json();
     if (!Array.isArray(body.commentIds)) throw badRequest("commentIds required");
     const ids = body.commentIds.filter((x) => typeof x === "string");
+    let handed = [];
     const res = await store.update((s) => {
       const now = (/* @__PURE__ */ new Date()).toISOString();
       const selected = [];
@@ -5418,94 +5571,14 @@ function createApp(opts) {
         s.targets[found.targetKey].comments[found.index] = next;
         selected.push(next);
       }
+      handed = selected;
       return {
-        text: formatCommentsExport({ repoRoot: repo.root, comments: selected }),
+        text: formatCommentsExport({ repoRoot: repo.root, comments: selected, replyCommand: opts.replyCommand }),
         count: selected.length,
         commentIds: selected.map((x) => x.id)
       };
     });
-    return c.json(res);
-  });
-  api.get("/issues", async (c) => {
-    const s = await store.load();
-    return c.json({ issues: s.issues });
-  });
-  api.post("/issues", async (c) => {
-    const body = await c.req.json();
-    if (!body.title?.trim()) throw badRequest("title is required");
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const issue = {
-      id: randomUUID2(),
-      title: body.title.trim(),
-      body: typeof body.body === "string" ? body.body : "",
-      status: body.status === "closed" ? "closed" : "open",
-      commentIds: Array.isArray(body.commentIds) ? body.commentIds.filter((x) => typeof x === "string") : [],
-      createdAt: now,
-      updatedAt: now
-    };
-    await store.update((s) => {
-      s.issues = insertAfter(s.issues, issue, typeof body.after === "string" ? body.after : void 0);
-    });
-    return c.json(issue, 201);
-  });
-  api.post("/issues/:id/move", async (c) => {
-    const id = c.req.param("id");
-    const body = await c.req.json();
-    if (body.before !== null && typeof body.before !== "string") throw badRequest("before must be an id or null");
-    const issues = await store.update((s) => {
-      const next = moveBefore(s.issues, id, body.before);
-      if (!next) throw notFound("issue not found");
-      s.issues = next;
-      return s.issues;
-    });
-    return c.json({ issues });
-  });
-  api.patch("/issues/:id", async (c) => {
-    const id = c.req.param("id");
-    const body = await c.req.json();
-    const updated = await store.update((s) => {
-      const issue = s.issues.find((i) => i.id === id);
-      if (!issue) throw notFound("issue not found");
-      if (typeof body.title === "string" && body.title.trim()) issue.title = body.title.trim();
-      if (typeof body.body === "string") issue.body = body.body;
-      if (body.status === "open" || body.status === "closed") issue.status = body.status;
-      if (Array.isArray(body.commentIds)) issue.commentIds = [...new Set(body.commentIds.filter((x) => typeof x === "string"))];
-      issue.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-      return issue;
-    });
-    return c.json(updated);
-  });
-  api.delete("/issues/:id", async (c) => {
-    const id = c.req.param("id");
-    const removed = await store.update((s) => {
-      const before = s.issues.length;
-      s.issues = s.issues.filter((i) => i.id !== id);
-      return s.issues.length !== before;
-    });
-    if (!removed) throw notFound("issue not found");
-    return c.json({ ok: true });
-  });
-  api.post("/issues/:id/export", async (c) => {
-    const id = c.req.param("id");
-    const res = await store.update((s) => {
-      const issue = s.issues.find((i) => i.id === id);
-      if (!issue) throw notFound("issue not found");
-      const now = (/* @__PURE__ */ new Date()).toISOString();
-      const comments = [];
-      for (const cid of issue.commentIds) {
-        const found = findComment(s, cid);
-        if (!found) continue;
-        const next = { ...found.comment, exportedAt: now, updatedAt: now };
-        if (next.status === "active") next.status = "exported";
-        s.targets[found.targetKey].comments[found.index] = next;
-        comments.push(next);
-      }
-      return {
-        text: formatIssueExport({ repoRoot: repo.root, issue, comments }),
-        count: comments.length,
-        commentIds: comments.map((x) => x.id)
-      };
-    });
+    checkpointHandoff(handed);
     return c.json(res);
   });
   const knownRoot = async (rootParam) => {
@@ -5529,7 +5602,7 @@ function createApp(opts) {
     const branch = body.branch?.trim() || await currentBranch(await knownRoot(body.root));
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const todo = {
-      id: randomUUID2(),
+      id: randomUUID3(),
       branch,
       title: body.title.trim(),
       body: typeof body.body === "string" ? body.body : "",
@@ -5538,6 +5611,10 @@ function createApp(opts) {
       updatedAt: now
     };
     await store.update((s) => {
+      if (body.commentIds !== void 0) {
+        const ids = linkable(s, body.commentIds);
+        if (ids.length) todo.commentIds = ids;
+      }
       s.todos = insertAfter(s.todos, todo, typeof body.after === "string" ? body.after : void 0);
     });
     return c.json(todo, 201);
@@ -5564,11 +5641,40 @@ function createApp(opts) {
       if (typeof body.title === "string" && body.title.trim()) todo.title = body.title.trim();
       if (typeof body.body === "string") todo.body = body.body;
       if (body.status === "open" || body.status === "done") todo.status = body.status;
+      if (body.commentIds !== void 0) {
+        const ids = linkable(s, body.commentIds);
+        if (ids.length) todo.commentIds = ids;
+        else delete todo.commentIds;
+      }
       todo.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
       return todo;
     });
     return c.json(updated);
   });
+  api.post("/todos/:id/export", async (c) => {
+    const id = c.req.param("id");
+    const handed = [];
+    const res = await store.update((s) => {
+      const todo = s.todos.find((t) => t.id === id);
+      if (!todo) throw notFound("todo not found");
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      for (const cid of todo.commentIds ?? []) {
+        const found = findComment(s, cid);
+        if (!found) continue;
+        const next = { ...found.comment, exportedAt: now, updatedAt: now };
+        if (next.status === "active") next.status = "exported";
+        s.targets[found.targetKey].comments[found.index] = next;
+        handed.push(next);
+      }
+      return {
+        text: formatTodoExport({ todo, comments: handed, replyCommand: opts.replyCommand }),
+        count: handed.length,
+        commentIds: handed.map((x) => x.id)
+      };
+    });
+    checkpointHandoff(handed);
+    return c.json(res);
+  });
   api.delete("/todos/:id", async (c) => {
     const id = c.req.param("id");
     const removed = await store.update((s) => {
@@ -5647,8 +5753,31 @@ function createApp(opts) {
     return c.json(await tmux.open(repo.commonRoot, wt.path, body.sessionId), 201);
   });
   api.get("/worktrees", async (c) => {
-    const list = await listWorktreesDetailed(repo);
+    const [list, state] = await Promise.all([listWorktreesDetailed(repo), store.load()]);
     const [branches, newSlot] = await Promise.all([listBranches(repo, list), nextSlot(repo, list)]);
+    const review = /* @__PURE__ */ new Map();
+    const latest = /* @__PURE__ */ new Map();
+    for (const t of Object.values(state.targets)) {
+      for (const cm of t.comments) {
+        const at = commentWorktree(cm) ?? repo.root;
+        const r = review.get(at) ?? { toAgent: 0, toReviewer: 0 };
+        const seen = latest.get(at) ?? { agent: "", reviewer: "" };
+        if (awaitsAgent(cm)) {
+          r.toAgent++;
+          if (cm.updatedAt >= seen.agent) [seen.agent, r.toAgentTarget] = [cm.updatedAt, cm.targetKey];
+        }
+        if (awaitsReviewer(cm)) {
+          r.toReviewer++;
+          if (cm.updatedAt >= seen.reviewer) [seen.reviewer, r.toReviewerTarget] = [cm.updatedAt, cm.targetKey];
+        }
+        review.set(at, r);
+        latest.set(at, seen);
+      }
+    }
+    for (const wt of list) {
+      const r = review.get(wt.path);
+      if (r && (r.toAgent || r.toReviewer)) wt.review = r;
+    }
     const res = { worktrees: list, branches, newSlot };
     return c.json(res);
   });
@@ -5695,7 +5824,19 @@ function createApp(opts) {
         const event = { type: "changed", ...change };
         void enqueue(() => stream2.writeSSE({ event: "changed", data: JSON.stringify(event) }));
       });
-      stream2.onAbort(release);
+      let stamp = await stateStamp();
+      const statePoll = setInterval(() => {
+        void stateStamp().then((next) => {
+          if (next === stamp) return;
+          stamp = next;
+          const event = { type: "state", at: (/* @__PURE__ */ new Date()).toISOString() };
+          void enqueue(() => stream2.writeSSE({ event: "state", data: JSON.stringify(event) }));
+        });
+      }, opts.watchIntervalMs ?? DEFAULT_POLL_INTERVAL_MS);
+      stream2.onAbort(() => {
+        clearInterval(statePoll);
+        release();
+      });
       try {
         while (!stream2.aborted && !stream2.closed) {
           await stream2.sleep(SSE_HEARTBEAT_MS);
@@ -5703,6 +5844,7 @@ function createApp(opts) {
           await enqueue(() => stream2.write(": ping\n\n"));
         }
       } finally {
+        clearInterval(statePoll);
         release();
       }
     });
@@ -5877,8 +6019,8 @@ async function startServer(opts) {
   const repo = await resolveRepo(opts.repoPath);
   const stateFile = opts.stateFile ?? stateFilePath(repo.commonRoot);
   const store = new StateStore(stateFile, repo.commonRoot);
-  const instanceToken = randomUUID3();
-  const app = createApp({ repo, store, nvim: new NvimService(), webDir: opts.webDir, instanceToken, update: opts.update });
+  const instanceToken = randomUUID4();
+  const app = createApp({ repo, store, nvim: new NvimService(), webDir: opts.webDir, instanceToken, update: opts.update, replyCommand: opts.replyCommand });
   const listen = (p) => new Promise((resolve, reject) => {
     const s = serve({ fetch: app.fetch, hostname: HOST, port: p }, () => resolve(s));
     s.once("error", reject);
@@ -5920,8 +6062,68 @@ async function startServer(opts) {
   };
 }
 
+// bin/agent.ts
+var AGENT_COMMANDS = ["feedback", "reply"];
+function agentUsage(cmd) {
+  return `Commands for the agent, run inside the worktree under review:
+  ${cmd} feedback [--peek]      Print the review comments not yet handed over, and mark them handed
+                               over (--peek leaves them as they are)
+  ${cmd} reply <id> <message>   Answer a comment; <id> is the one in its heading. A message of "-",
+                               or none with stdin piped, is read from stdin
+`;
+}
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8");
+}
+async function openStore() {
+  const repo = await resolveRepo(process.cwd());
+  return { store: new StateStore(stateFilePath(repo.commonRoot), repo.commonRoot), root: repo.root, commonRoot: repo.commonRoot };
+}
+async function feedback(args, replyCommand) {
+  const unknown = args.find((a) => a !== "--peek");
+  if (unknown) throw new Error(`unknown argument: ${unknown}`);
+  const { store, root, commonRoot } = await openStore();
+  const peek = args.includes("--peek");
+  const comments = await takeFeedback(store, { worktreeRoot: root, mainRoot: commonRoot, peek });
+  if (comments.length === 0) {
+    console.log("No review comments are waiting for you.");
+    return;
+  }
+  if (!peek) {
+    await takeCheckpoint(store, root, root === commonRoot ? void 0 : root, { handoff: true }).catch((e) => {
+      console.error(`warden feedback: no checkpoint taken: ${e instanceof Error ? e.message : e}`);
+    });
+  }
+  process.stdout.write(formatCommentsExport({ repoRoot: root, comments, replyCommand }));
+}
+async function reply(args) {
+  const [id, ...words] = args;
+  if (!id) throw new Error("reply needs a comment id");
+  let body = words.join(" ");
+  if (body === "-" || !body && !process.stdin.isTTY) body = await readStdin();
+  if (!body.trim()) throw new Error("reply needs a message");
+  const { store } = await openStore();
+  const c = await addReply(store, id, "agent", body);
+  const range = c.startLine === c.endLine ? `${c.startLine}` : `${c.startLine}-${c.endLine}`;
+  console.log(`Replied to ${shortId(c.id)} (${c.filePath}:${range}).`);
+}
+async function runAgentCommand(argv, replyCommand) {
+  const [cmd, ...rest] = argv;
+  if (!cmd || !AGENT_COMMANDS.includes(cmd)) return void 0;
+  try {
+    if (cmd === "feedback") await feedback(rest, replyCommand);
+    else await reply(rest);
+    return 0;
+  } catch (e) {
+    console.error(`warden ${cmd}: ${e instanceof HttpError || e instanceof Error ? e.message : String(e)}`);
+    return 1;
+  }
+}
+
 // bin/cli.ts
-var VERSION = true ? "0.15.0" : "dev";
+var VERSION = true ? "0.16.0" : "dev";
 function parseArgs(argv) {
   const args = { repoPath: process.cwd(), open: true, updateCheck: true, help: false, version: false };
   for (let i = 0; i < argv.length; i++) {
@@ -5944,10 +6146,13 @@ function parseArgs(argv) {
   }
   return args;
 }
+var viaNpx = fileURLToPath(import.meta.url).includes(`${path11.sep}_npx${path11.sep}`);
+var selfCommand = viaNpx ? "npx @xbghc/warden" : "warden";
 function usage() {
   return `warden \u2014 local git diff review UI
 
 Usage: warden [repoPath] [options]
+       warden <command> [args]
 
 Options:
   --port <n>, -p <n>   Listen on a fixed port (default: first free port from 4100, and under WSL
@@ -5957,6 +6162,9 @@ Options:
                        (also: WARDEN_NO_UPDATE_CHECK=1, NO_UPDATE_NOTIFIER=1, CI)
   -h, --help           Show this help
   -v, --version        Print version
+
+${agentUsage("warden")}
+A repository in a directory named after a command is given as ./<name>.
 `;
 }
 async function openBrowser(url) {
@@ -5999,6 +6207,8 @@ function resolveWebDir() {
   return void 0;
 }
 async function main() {
+  const code = await runAgentCommand(process.argv.slice(2), selfCommand);
+  if (code !== void 0) process.exit(code);
   let args;
   try {
     args = parseArgs(process.argv.slice(2));
@@ -6019,12 +6229,11 @@ async function main() {
   if (!webDir) {
     console.error("warning: built web assets not found (dist/web). Only the /api endpoints will be served.");
   }
-  const viaNpx = fileURLToPath(import.meta.url).includes(`${path11.sep}_npx${path11.sep}`);
   const checking = args.updateCheck && VERSION !== "dev" && updateCheckEnabled();
   const update = checking ? checkForUpdate({ current: VERSION, npx: viaNpx }) : Promise.resolve(null);
   let server;
   try {
-    server = await startServer({ repoPath: args.repoPath, port: args.port, webDir, update });
+    server = await startServer({ repoPath: args.repoPath, port: args.port, webDir, update, replyCommand: selfCommand });
   } catch (e) {
     console.error(`warden: ${e.message}`);
     process.exit(1);