@xbghc/warden 0.6.1 → 0.8.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // bin/cli.ts
-import path8 from "path";
+import path9 from "path";
 import { spawn } from "child_process";
 import { existsSync as existsSync2 } from "fs";
 import { fileURLToPath } from "url";
@@ -652,7 +652,7 @@ var serve = (options, listeningListener) => {
 };
 
 // packages/server/src/app.ts
-import path7 from "path";
+import path8 from "path";
 import { randomUUID } from "crypto";
 
 // node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/compose.js
@@ -812,26 +812,26 @@ var throwNestingLimitExceeded = () => {
 };
 
 // node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/utils/url.js
-var splitPath = (path9) => {
-  const paths = path9.split("/");
+var splitPath = (path10) => {
+  const paths = path10.split("/");
   if (paths[0] === "") {
     paths.shift();
   }
   return paths;
 };
 var splitRoutingPath = (routePath) => {
-  const { groups, path: path9 } = extractGroupsFromPath(routePath);
-  const paths = splitPath(path9);
+  const { groups, path: path10 } = extractGroupsFromPath(routePath);
+  const paths = splitPath(path10);
   return replaceGroupMarks(paths, groups);
 };
-var extractGroupsFromPath = (path9) => {
+var extractGroupsFromPath = (path10) => {
   const groups = [];
-  path9 = path9.replace(/\{[^}]+\}/g, (match2, index) => {
+  path10 = path10.replace(/\{[^}]+\}/g, (match2, index) => {
     const mark = `@${index}`;
     groups.push([mark, match2]);
     return mark;
   });
-  return { groups, path: path9 };
+  return { groups, path: path10 };
 };
 var replaceGroupMarks = (paths, groups) => {
   for (let i = groups.length - 1; i >= 0; i--) {
@@ -888,8 +888,8 @@ var getPath = (request) => {
       const queryIndex = url.indexOf("?", i);
       const hashIndex = url.indexOf("#", i);
       const end = queryIndex === -1 ? hashIndex === -1 ? void 0 : hashIndex : hashIndex === -1 ? queryIndex : Math.min(queryIndex, hashIndex);
-      const path9 = url.slice(start, end);
-      return tryDecodeURI(path9.includes("%25") ? path9.replace(/%25/g, "%2525") : path9);
+      const path10 = url.slice(start, end);
+      return tryDecodeURI(path10.includes("%25") ? path10.replace(/%25/g, "%2525") : path10);
     } else if (charCode === 63 || charCode === 35) {
       break;
     }
@@ -906,11 +906,11 @@ var mergePath = (base, sub, ...rest) => {
   }
   return `${base?.[0] === "/" ? "" : "/"}${base}${sub === "/" ? "" : `${base?.at(-1) === "/" ? "" : "/"}${sub?.[0] === "/" ? sub.slice(1) : sub}`}`;
 };
-var checkOptionalParameter = (path9) => {
-  if (path9.charCodeAt(path9.length - 1) !== 63 || !path9.includes(":")) {
+var checkOptionalParameter = (path10) => {
+  if (path10.charCodeAt(path10.length - 1) !== 63 || !path10.includes(":")) {
     return null;
   }
-  const segments = path9.split("/");
+  const segments = path10.split("/");
   const results = [];
   let basePath = "";
   segments.forEach((segment) => {
@@ -1052,9 +1052,9 @@ var HonoRequest = class {
    */
   path;
   bodyCache = {};
-  constructor(request, path9 = "/", matchResult = [[]]) {
+  constructor(request, path10 = "/", matchResult = [[]]) {
     this.raw = request;
-    this.path = path9;
+    this.path = path10;
     this.#matchResult = matchResult;
   }
   param(key) {
@@ -1826,8 +1826,8 @@ var Hono = class _Hono {
         return this;
       };
     });
-    this.on = (method, path9, ...handlers) => {
-      for (const p of [path9].flat()) {
+    this.on = (method, path10, ...handlers) => {
+      for (const p of [path10].flat()) {
         this.#path = p;
         for (const m of [method].flat()) {
           const methodName = m.toUpperCase();
@@ -1885,8 +1885,8 @@ var Hono = class _Hono {
    * app.route("/api", app2) // GET /api/user
    * ```
    */
-  route(path9, app) {
-    const subApp = this.basePath(path9);
+  route(path10, app) {
+    const subApp = this.basePath(path10);
     app.routes.map((r) => {
       let handler;
       if (app.errorHandler === errorHandler) {
@@ -1912,9 +1912,9 @@ var Hono = class _Hono {
    * const api = new Hono().basePath('/api')
    * ```
    */
-  basePath(path9) {
+  basePath(path10) {
     const subApp = this.#clone();
-    subApp._basePath = mergePath(this._basePath, path9);
+    subApp._basePath = mergePath(this._basePath, path10);
     return subApp;
   }
   /**
@@ -1988,7 +1988,7 @@ var Hono = class _Hono {
    * })
    * ```
    */
-  mount(path9, applicationHandler, options) {
+  mount(path10, applicationHandler, options) {
     let replaceRequest;
     let optionHandler;
     if (options) {
@@ -2015,7 +2015,7 @@ var Hono = class _Hono {
       return [c.env, executionContext];
     };
     replaceRequest ||= (() => {
-      const mergedPath = mergePath(this._basePath, path9);
+      const mergedPath = mergePath(this._basePath, path10);
       const pathPrefixLength = mergedPath === "/" ? 0 : mergedPath.length;
       return (request) => {
         const url = new URL(request.url);
@@ -2030,18 +2030,18 @@ var Hono = class _Hono {
       }
       await next();
     };
-    this.#addRoute(METHOD_NAME_ALL, mergePath(path9, "*"), handler);
+    this.#addRoute(METHOD_NAME_ALL, mergePath(path10, "*"), handler);
     return this;
   }
-  #addRoute(method, path9, handler, baseRoutePath) {
-    path9 = mergePath(this._basePath, path9);
+  #addRoute(method, path10, handler, baseRoutePath) {
+    path10 = mergePath(this._basePath, path10);
     const r = {
       basePath: baseRoutePath !== void 0 ? mergePath(this._basePath, baseRoutePath) : this._basePath,
-      path: path9,
+      path: path10,
       method,
       handler
     };
-    this.router.add(method, path9, [handler, r]);
+    this.router.add(method, path10, [handler, r]);
     this.routes.push(r);
   }
   #handleError(err, c) {
@@ -2054,10 +2054,10 @@ var Hono = class _Hono {
     if (method === "HEAD") {
       return (async () => new Response(null, await this.#dispatch(request, executionCtx, env, "GET")))();
     }
-    const path9 = this.getPath(request, { env });
-    const matchResult = this.router.match(method, path9);
+    const path10 = this.getPath(request, { env });
+    const matchResult = this.router.match(method, path10);
     const c = new Context(request, {
-      path: path9,
+      path: path10,
       matchResult,
       env,
       executionCtx,
@@ -2160,7 +2160,7 @@ var createNullObject = () => /* @__PURE__ */ Object.create(null);
 
 // node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/router/reg-exp-router/matcher.js
 var emptyParam = [];
-function match(method, path9) {
+function match(method, path10) {
   const matchers = this.buildAllMatchers();
   const match2 = ((method2, path22) => {
     const matcher = matchers[method2] || matchers[METHOD_NAME_ALL];
@@ -2176,7 +2176,7 @@ function match(method, path9) {
     return [matcher[1][index], match3];
   });
   this.match = match2;
-  return match2(method, path9);
+  return match2(method, path10);
 }
 
 // node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/router/reg-exp-router/node.js
@@ -2293,14 +2293,14 @@ var Trie = class {
   #index = 0;
   // dynamic path -> [handler index, param assoc]; static paths are not registered
   paths = createNullObject();
-  insert(path9, isStatic) {
+  insert(path10, isStatic) {
     if (isStatic) {
-      this.#root.insert(path9.split(""), 0, [], this.#context, true);
+      this.#root.insert(path10.split(""), 0, [], this.#context, true);
       return;
     }
     const paramAssoc = [];
     const groups = [];
-    let markedPath = path9;
+    let markedPath = path10;
     for (let i = 0; ; ) {
       let replaced = false;
       markedPath = markedPath.replace(/\{[^}]+\}/g, (m) => {
@@ -2325,7 +2325,7 @@ var Trie = class {
       }
     }
     this.#root.insert(tokens, this.#index, paramAssoc, this.#context, false);
-    this.paths[path9] = [this.#index++, paramAssoc];
+    this.paths[path10] = [this.#index++, paramAssoc];
   }
   buildRegExp() {
     let regexp = this.#root.buildRegExpStr();
@@ -2352,17 +2352,17 @@ var Trie = class {
 
 // node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/router/reg-exp-router/router.js
 var wildcardRegExpCache = createNullObject();
-function buildWildcardRegExp(path9) {
-  return wildcardRegExpCache[path9] ??= new RegExp(
-    `^${path9.replace(
+function buildWildcardRegExp(path10) {
+  return wildcardRegExpCache[path10] ??= new RegExp(
+    `^${path10.replace(
       /\/:[^/{}]+(?:\{\[\^\/]\+})?(?=[/{]|$)|\/?\*$|([.\\+*[^\]$()?{}|])/g,
       (match2, metaChar) => metaChar ? `\\${metaChar}` : match2 === "/*" ? TAIL_WILDCARD_REG_EXP_STR : match2 === "*" ? ONLY_WILDCARD_REG_EXP_STR : `/:${LABEL_REG_EXP_STR}`
     )}$`
   );
 }
-function findMiddleware(middleware, path9) {
+function findMiddleware(middleware, path10) {
   for (const k of Object.keys(middleware).sort((a, b) => b.length - a.length)) {
-    if (buildWildcardRegExp(k).test(path9)) {
+    if (buildWildcardRegExp(k).test(path10)) {
       return [...middleware[k]];
     }
   }
@@ -2378,14 +2378,14 @@ var RegExpRouter = class {
     this.#routes = { [METHOD_NAME_ALL]: createNullObject() };
     this.#tries = { [METHOD_NAME_ALL]: new Trie() };
   }
-  #insertPath(method, path9) {
+  #insertPath(method, path10) {
     try {
-      this.#tries[method].insert(path9, !/\*|\/:/.test(path9));
+      this.#tries[method].insert(path10, !/\*|\/:/.test(path10));
     } catch (e) {
-      throw e === PATH_ERROR ? new UnsupportedPathError(path9) : e;
+      throw e === PATH_ERROR ? new UnsupportedPathError(path10) : e;
     }
   }
-  add(method, path9, handler) {
+  add(method, path10, handler) {
     const middleware = this.#middleware;
     const routes = this.#routes;
     if (!middleware) {
@@ -2401,28 +2401,28 @@ var RegExpRouter = class {
         }
       }
     }
-    if (path9 === "/*") {
-      path9 = "*";
+    if (path10 === "/*") {
+      path10 = "*";
     }
     const methods = method === METHOD_NAME_ALL ? Object.keys(middleware) : [method];
-    if (/\*$/.test(path9)) {
-      const re = buildWildcardRegExp(path9);
+    if (/\*$/.test(path10)) {
+      const re = buildWildcardRegExp(path10);
       for (const m of methods) {
-        if (!middleware[m][path9]) {
-          this.#insertPath(m, path9);
-          middleware[m][path9] = findMiddleware(middleware[m], path9) || findMiddleware(middleware[METHOD_NAME_ALL], path9) || [];
+        if (!middleware[m][path10]) {
+          this.#insertPath(m, path10);
+          middleware[m][path10] = findMiddleware(middleware[m], path10) || findMiddleware(middleware[METHOD_NAME_ALL], path10) || [];
         }
       }
       for (const handlerMap of [middleware, routes]) {
         for (const m of methods) {
           for (const p in handlerMap[m]) {
-            re.test(p) && handlerMap[m][p].push([handler, path9]);
+            re.test(p) && handlerMap[m][p].push([handler, path10]);
           }
         }
       }
       return;
     }
-    const paths = checkOptionalParameter(path9) || [path9];
+    const paths = checkOptionalParameter(path10) || [path10];
     for (const path22 of paths) {
       for (const m of methods) {
         if (!routes[m][path22]) {
@@ -2451,11 +2451,11 @@ var RegExpRouter = class {
     const handlerData = [];
     const [regexp, indexReplacementMap, paramReplacementMap] = trie.buildRegExp();
     for (const r of [middleware, routes]) {
-      for (const path9 in r) {
-        const handlers = r[path9];
-        const pathData = trie.paths[path9];
+      for (const path10 in r) {
+        const handlers = r[path10];
+        const pathData = trie.paths[path10];
         if (!pathData) {
-          staticMap[path9] = [handlers.map(([h]) => [h, createNullObject()]), emptyParam];
+          staticMap[path10] = [handlers.map(([h]) => [h, createNullObject()]), emptyParam];
           continue;
         }
         handlerData[pathData[0]] = handlers.map(([h, handlerPath]) => [
@@ -2479,13 +2479,13 @@ var SmartRouter = class {
   constructor(init) {
     this.#routers = init.routers;
   }
-  add(method, path9, handler) {
+  add(method, path10, handler) {
     if (!this.#routes) {
       throw new Error(MESSAGE_MATCHER_IS_ALREADY_BUILT);
     }
-    this.#routes.push([method, path9, handler]);
+    this.#routes.push([method, path10, handler]);
   }
-  match(method, path9) {
+  match(method, path10) {
     if (!this.#routes) {
       throw new Error("Fatal error");
     }
@@ -2500,7 +2500,7 @@ var SmartRouter = class {
         for (let i2 = 0, len2 = routes.length; i2 < len2; i2++) {
           router.add(...routes[i2]);
         }
-        res = router.match(method, path9);
+        res = router.match(method, path10);
       } catch (e) {
         if (e instanceof UnsupportedPathError) {
           continue;
@@ -2535,9 +2535,9 @@ var Node2 = class _Node2 {
   #patterns = [];
   #pattern;
   #params = emptyParams;
-  insert(method, path9, handler) {
+  insert(method, path10, handler) {
     let curNode = this;
-    const parts = splitRoutingPath(path9);
+    const parts = splitRoutingPath(path10);
     const possibleKeys = /* @__PURE__ */ new Set();
     let i = 0;
     for (const p of parts) {
@@ -2577,12 +2577,12 @@ var Node2 = class _Node2 {
       }
     }
   }
-  search(method, path9) {
+  search(method, path10) {
     const handlerSets = [];
     this.#params = emptyParams;
     const curNode = this;
     let curNodes = [curNode];
-    const parts = splitPath(path9);
+    const parts = splitPath(path10);
     const curNodesQueue = [];
     const len = parts.length;
     let partOffsets = null;
@@ -2624,13 +2624,13 @@ var Node2 = class _Node2 {
           if (matcher !== true) {
             if (!partOffsets) {
               partOffsets = [];
-              let offset = path9[0] === "/" ? 1 : 0;
+              let offset = path10[0] === "/" ? 1 : 0;
               for (let p = 0; p < len; p++) {
                 partOffsets[p] = offset;
                 offset += parts[p].length + 1;
               }
             }
-            const restPathString = path9.slice(partOffsets[i]);
+            const restPathString = path10.slice(partOffsets[i]);
             const m = matcher.exec(restPathString);
             if (m) {
               params[name] = m[0];
@@ -2690,13 +2690,13 @@ var Node2 = class _Node2 {
 var TrieRouter = class {
   name = "TrieRouter";
   #node = new Node2();
-  add(method, path9, handler) {
-    for (const result of checkOptionalParameter(path9) || [path9]) {
+  add(method, path10, handler) {
+    for (const result of checkOptionalParameter(path10) || [path10]) {
       this.#node.insert(method, result, handler);
     }
   }
-  match(method, path9) {
-    return this.#node.search(method, path9);
+  match(method, path10) {
+    return this.#node.search(method, path10);
   }
 };
 
@@ -2960,6 +2960,11 @@ function commentScopeKey(key) {
   if (!t || !isLocalTarget(t)) return key;
   return t.worktree ? `worktree:${t.worktree}:local` : "local";
 }
+function stageModeFor(t) {
+  if (t.kind === "working") return "stage";
+  if (t.kind === "staged") return "unstage";
+  return void 0;
+}
 function localViewKeys(key) {
   const t = tryParseTargetKey(key);
   const wt = t?.worktree ? { worktree: t.worktree } : {};
@@ -2970,6 +2975,24 @@ function localViewKeys(key) {
   ];
 }
 
+// packages/shared/src/order.ts
+function insertAfter(list, item, after) {
+  const idx = after === void 0 ? -1 : list.findIndex((x) => x.id === after);
+  if (idx < 0) return [item, ...list];
+  return [...list.slice(0, idx + 1), item, ...list.slice(idx + 1)];
+}
+function moveBefore(list, id, before) {
+  const item = list.find((x) => x.id === id);
+  if (!item) return null;
+  if (before === id) return [...list];
+  const rest = list.filter((x) => x.id !== id);
+  if (before === null) return [...rest, item];
+  const idx = rest.findIndex((x) => x.id === before);
+  if (idx < 0) return null;
+  rest.splice(idx, 0, item);
+  return rest;
+}
+
 // packages/server/src/errors.ts
 var HttpError = class extends Error {
   constructor(status, message, code) {
@@ -3026,7 +3049,7 @@ function parseCommitLog(stdout) {
 // packages/server/src/git.ts
 import { execFile } from "child_process";
 import { existsSync } from "fs";
-var ALLOWED_SUBCOMMANDS = /* @__PURE__ */ new Set(["rev-parse", "diff", "show", "log", "worktree", "ls-files", "status", "merge-base"]);
+var ALLOWED_SUBCOMMANDS = /* @__PURE__ */ new Set(["rev-parse", "diff", "show", "log", "worktree", "ls-files", "status", "merge-base", "rev-list", "for-each-ref", "check-ref-format"]);
 var FORBIDDEN_OPTION_PREFIXES = ["--output", "--ext-diff", "--textconv", "-c", "--config-env", "--exec-path", "--git-dir", "--work-tree"];
 var DEFAULT_GIT_TIMEOUT_MS = 3e4;
 var EMPTY_TREE_SHA = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
@@ -3109,6 +3132,103 @@ async function runGit(args, opts) {
     );
   });
 }
+async function applyToIndex(cwd, patch, opts = {}) {
+  for (let attempt = 1; ; attempt++) {
+    try {
+      await applyOnce(cwd, patch, opts);
+      return;
+    } catch (e) {
+      if (!(e instanceof GitError && e.code === "index_locked") || attempt >= 3) throw e;
+      await new Promise((r) => setTimeout(r, 150 * attempt));
+    }
+  }
+}
+async function applyOnce(cwd, patch, opts) {
+  const args = ["apply", "--cached", "--whitespace=nowarn"];
+  if (opts.reverse) args.push("--reverse");
+  args.push("-");
+  await new Promise((resolve, reject) => {
+    const child = execFile(
+      "git",
+      args,
+      {
+        cwd,
+        timeout: opts.timeoutMs ?? DEFAULT_GIT_TIMEOUT_MS,
+        maxBuffer: 16 * 1024 * 1024,
+        encoding: "utf8",
+        env: { ...process.env, LC_ALL: "C", GIT_PAGER: "cat", PAGER: "cat", GIT_TERMINAL_PROMPT: "0" },
+        windowsHide: true
+      },
+      (error, _stdout, stderr) => {
+        const err = error;
+        if (!err) {
+          resolve();
+          return;
+        }
+        if (err.killed || err.signal === "SIGTERM") {
+          reject(new GitError("git apply timed out", null, stderr, 504, "git_timeout"));
+          return;
+        }
+        if (err.code === "ENOENT") {
+          if (!existsSync(cwd)) {
+            reject(new GitError(`working directory no longer exists: ${cwd}`, null, "", 400, "unknown_worktree"));
+            return;
+          }
+          reject(new GitError("git executable not found in PATH", null, "", 500, "git_missing"));
+          return;
+        }
+        const code = typeof err.code === "number" ? err.code : -1;
+        const first = stderr.trim().split("\n")[0] || err.message;
+        if (/index\.lock/.test(stderr)) {
+          reject(new GitError("the index is locked by another git process; try again", code, stderr, 409, "index_locked"));
+          return;
+        }
+        reject(new GitError(first.replace(/^error: /, ""), code, stderr, 409, "apply_failed"));
+      }
+    );
+    child.stdin?.on("error", () => void 0);
+    child.stdin?.end(patch);
+  });
+}
+async function runGitWrite(args, opts) {
+  for (const arg of args) if (arg.includes("\0")) throw new GitError("NUL byte in git argument", null, "", 400, "git_bad_argument");
+  return new Promise((resolve, reject) => {
+    execFile(
+      "git",
+      [...args],
+      {
+        cwd: opts.cwd,
+        timeout: opts.timeoutMs ?? DEFAULT_GIT_TIMEOUT_MS,
+        maxBuffer: 16 * 1024 * 1024,
+        encoding: "utf8",
+        env: { ...process.env, LC_ALL: "C", GIT_PAGER: "cat", PAGER: "cat", GIT_TERMINAL_PROMPT: "0" },
+        windowsHide: true
+      },
+      (error, stdout, stderr) => {
+        const err = error;
+        if (!err) {
+          resolve({ stdout, stderr, code: 0 });
+          return;
+        }
+        if (err.killed || err.signal === "SIGTERM") {
+          reject(new GitError(`git ${args[0]} timed out`, null, stderr, 504, "git_timeout"));
+          return;
+        }
+        if (err.code === "ENOENT") {
+          if (!existsSync(opts.cwd)) {
+            reject(new GitError(`working directory no longer exists: ${opts.cwd}`, null, "", 400, "unknown_worktree"));
+            return;
+          }
+          reject(new GitError("git executable not found in PATH", null, "", 500, "git_missing"));
+          return;
+        }
+        const code = typeof err.code === "number" ? err.code : -1;
+        const first = stderr.split("\n").find((l) => l.trim()) ?? err.message;
+        reject(new GitError(first.trim().replace(/^(fatal|error): /, ""), code, stderr, 500, "git_failed"));
+      }
+    );
+  });
+}
 async function refExists(cwd, ref) {
   try {
     await runGit(["rev-parse", "--verify", "--quiet", `${ref}^{commit}`], { cwd });
@@ -3159,19 +3279,20 @@ async function resolveRepo(dir) {
   const commonRoot = path.basename(commonDir) === ".git" ? path.dirname(commonDir) : root;
   return { root, commonRoot };
 }
-async function listWorktrees(ctx) {
+async function listWorktreesAll(ctx) {
   const r = await runGit(["worktree", "list", "--porcelain"], { cwd: ctx.root });
   const out = [];
   let cur = null;
   const flush = () => {
-    if (cur && cur.path && !cur.prunable) {
+    if (cur && cur.path) {
       out.push({
         path: cur.path,
         head: cur.head ?? "",
         branch: cur.branch,
         isMain: false,
         detached: cur.detached ?? false,
-        bare: cur.bare ?? false
+        bare: cur.bare ?? false,
+        prunable: cur.prunable ?? false
       });
     }
     cur = null;
@@ -3199,6 +3320,9 @@ async function listWorktrees(ctx) {
   }
   return out;
 }
+async function listWorktrees(ctx) {
+  return (await listWorktreesAll(ctx)).filter((w) => !w.prunable).map(({ prunable: _prunable, ...w }) => w);
+}
 async function currentBranch(cwd) {
   const res = await runGit(["rev-parse", "--abbrev-ref", "HEAD"], { cwd }).catch(() => ({ stdout: "" }));
   const name = res.stdout.trim();
@@ -3730,20 +3854,253 @@ function reanchorComment(comment, diff, now = (/* @__PURE__ */ new Date()).toISO
   };
 }
 
+// packages/server/src/patch.ts
+function quotePath(p) {
+  if (!/[\s"\\\x00-\x1f\x7f]|[^\x00-\x7f]/.test(p)) return p;
+  let out = '"';
+  for (const byte of Buffer.from(p, "utf8")) {
+    if (byte === 34) out += '\\"';
+    else if (byte === 92) out += "\\\\";
+    else if (byte === 10) out += "\\n";
+    else if (byte === 9) out += "\\t";
+    else if (byte < 32 || byte >= 127) out += "\\" + byte.toString(8).padStart(3, "0");
+    else out += String.fromCharCode(byte);
+  }
+  return out + '"';
+}
+function cutHunk(hunk, picked, mode) {
+  const out = [];
+  hunk.lines.forEach((l, i) => {
+    const noNewline = !!l.noNewline;
+    if (l.type === "context") out.push({ ch: " ", content: l.content, noNewline });
+    else if (picked.has(i)) out.push({ ch: l.type === "add" ? "+" : "-", content: l.content, noNewline });
+    else if (l.type === "del" === (mode === "stage")) out.push({ ch: " ", content: l.content, noNewline });
+  });
+  out.forEach((l, j) => {
+    if (!l.noNewline) return;
+    const rest = out.slice(j + 1);
+    const ok = l.ch === " " ? rest.length === 0 : l.ch === "-" ? rest.every((r) => r.ch === "+") : rest.every((r) => r.ch === "-");
+    if (!ok) throw badRequest("the selection splits the missing newline at the end of the file; include the neighbouring changed lines", "newline_split");
+  });
+  return out;
+}
+function pickedLines(diff, selection) {
+  const picked = /* @__PURE__ */ new Map();
+  const changed = (h) => h.lines.map((l, i) => l.type === "context" ? -1 : i).filter((i) => i >= 0);
+  if (selection === void 0) {
+    diff.hunks.forEach((h, i) => picked.set(i, new Set(changed(h))));
+    return picked;
+  }
+  if (!Array.isArray(selection)) throw badRequest("hunks must be an array", "bad_selection");
+  for (const sel of selection) {
+    if (!sel || !Number.isInteger(sel.index) || sel.index < 0 || sel.index >= diff.hunks.length) throw badRequest(`no such hunk: ${sel?.index}`, "bad_selection");
+    const hunk = diff.hunks[sel.index];
+    const set = picked.get(sel.index) ?? /* @__PURE__ */ new Set();
+    picked.set(sel.index, set);
+    if (sel.lines === void 0) {
+      for (const i of changed(hunk)) set.add(i);
+      continue;
+    }
+    if (!Array.isArray(sel.lines)) throw badRequest("lines must be an array of indices", "bad_selection");
+    for (const i of sel.lines) {
+      if (!Number.isInteger(i) || i < 0 || i >= hunk.lines.length) throw badRequest(`no such line in hunk ${sel.index}: ${i}`, "bad_selection");
+      if (hunk.lines[i].type !== "context") set.add(i);
+    }
+  }
+  return picked;
+}
+function buildStagePatch(diff, mode, selection) {
+  if (diff.binary) throw badRequest("binary files cannot be staged from here; use git add", "not_stageable");
+  const whole = selection === void 0;
+  const picked = pickedLines(diff, selection);
+  let lines = 0;
+  for (const set of picked.values()) lines += set.size;
+  const changedTotal = diff.hunks.reduce((n, h) => n + h.lines.filter((l) => l.type !== "context").length, 0);
+  const full = lines === changedTotal;
+  const modeChange = !!(diff.oldMode && diff.newMode && diff.oldMode !== diff.newMode);
+  const rename2 = diff.status === "renamed" && !!diff.oldPath && diff.oldPath !== diff.path;
+  const oldPath = diff.oldPath ?? diff.path;
+  const newPath = diff.path;
+  const gitLine = (a, b) => `diff --git ${quotePath(`a/${a}`)} ${quotePath(`b/${b}`)}`;
+  const from = (p) => p === null ? "--- /dev/null" : `--- ${quotePath(`a/${p}`)}`;
+  const to = (p) => p === null ? "+++ /dev/null" : `+++ ${quotePath(`b/${p}`)}`;
+  const header = [];
+  if (diff.status === "added" && (mode === "stage" || full)) {
+    header.push(gitLine(newPath, newPath), `new file mode ${diff.newMode ?? "100644"}`);
+    if (lines > 0) header.push(from(null), to(newPath));
+  } else if (diff.status === "deleted" && full) {
+    header.push(gitLine(oldPath, oldPath), `deleted file mode ${diff.oldMode ?? "100644"}`);
+    if (lines > 0) header.push(from(oldPath), to(null));
+  } else if (diff.status === "deleted" && mode === "unstage") {
+    throw badRequest("a staged deletion can only be unstaged as a whole", "whole_file_only");
+  } else if (rename2 && full) {
+    header.push(gitLine(oldPath, newPath));
+    if (whole && modeChange) header.push(`old mode ${diff.oldMode}`, `new mode ${diff.newMode}`);
+    header.push(`rename from ${quotePath(oldPath)}`, `rename to ${quotePath(newPath)}`);
+    if (lines > 0) header.push(from(oldPath), to(newPath));
+  } else {
+    header.push(gitLine(newPath, newPath));
+    if (whole && modeChange) header.push(`old mode ${diff.oldMode}`, `new mode ${diff.newMode}`);
+    if (lines > 0) header.push(from(newPath), to(newPath));
+  }
+  if (lines === 0) {
+    const headerOnly = whole && (modeChange || rename2 || (diff.status === "added" || diff.status === "deleted") && diff.hunks.length === 0);
+    if (!headerOnly) throw badRequest("no changed lines selected", "empty_selection");
+    return { patch: header.join("\n") + "\n", lines: 0 };
+  }
+  let delta = 0;
+  const hunks = [];
+  diff.hunks.forEach((hunk, index) => {
+    const set = picked.get(index);
+    if (!set || set.size === 0) return;
+    const out = cutHunk(hunk, set, mode);
+    const oldLines = out.filter((l) => l.ch !== "+").length;
+    const newLines = out.filter((l) => l.ch !== "-").length;
+    const oldBegin = hunk.oldLines === 0 ? hunk.oldStart + 1 : hunk.oldStart;
+    const oldStart = oldLines === 0 ? oldBegin - 1 : oldBegin;
+    const newStart = newLines === 0 ? oldBegin + delta - 1 : oldBegin + delta;
+    delta += newLines - oldLines;
+    const text = [`@@ -${oldStart},${oldLines} +${newStart},${newLines} @@${hunk.header ? " " + hunk.header : ""}`];
+    for (const l of out) {
+      text.push(l.ch + l.content);
+      if (l.noNewline) text.push("\");
+    }
+    hunks.push(text.join("\n"));
+  });
+  return { patch: [...header, ...hunks].join("\n") + "\n", lines };
+}
+
+// packages/server/src/worktrees.ts
+import path3 from "path";
+import { readdir, realpath as realpath2, stat } from "fs/promises";
+function worktreePathPrefix(ctx) {
+  return path3.join(path3.dirname(ctx.commonRoot), `${path3.basename(ctx.commonRoot)}-`);
+}
+async function dirtyCount(cwd) {
+  try {
+    const r = await runGit(["status", "--porcelain", "--untracked-files=all"], { cwd });
+    return r.stdout.split("\n").filter((l) => l.trim()).length;
+  } catch {
+    return 0;
+  }
+}
+async function listWorktreesDetailed(ctx) {
+  const all = await listWorktreesAll(ctx);
+  return Promise.all(all.map(async (w) => ({ ...w, dirty: w.prunable || w.bare ? 0 : await dirtyCount(w.path) })));
+}
+async function listBranches(ctx, worktrees) {
+  const r = await runGit(["for-each-ref", "--format=%(refname:short)%09%(objectname:short)", "refs/heads"], { cwd: ctx.commonRoot });
+  const at = /* @__PURE__ */ new Map();
+  for (const w of worktrees) if (w.branch) at.set(w.branch, w.path);
+  return r.stdout.split("\n").filter(Boolean).map((line) => {
+    const [name = "", sha = ""] = line.split("	");
+    const worktree = at.get(name);
+    return { name, sha, ...worktree ? { worktree } : {} };
+  });
+}
+async function assertBranchName(ctx, name) {
+  if (!isValidRef(name) || name.includes("@{") || name.startsWith("refs/")) throw badRequest(`invalid branch name: ${name}`, "invalid_branch");
+  try {
+    await runGit(["check-ref-format", "--branch", name], { cwd: ctx.commonRoot });
+  } catch {
+    throw badRequest(`invalid branch name: ${name}`, "invalid_branch");
+  }
+}
+async function assertNewWorktreePath(ctx, worktrees, p) {
+  if (!p || !path3.isAbsolute(p)) throw badRequest("worktree path must be absolute", "invalid_path");
+  const target = path3.resolve(p);
+  const parent = path3.dirname(ctx.commonRoot);
+  if (target === parent || !target.startsWith(parent + path3.sep)) throw badRequest(`worktree path must be under ${parent}`, "invalid_path");
+  for (const w of worktrees) {
+    if (target === w.path || target.startsWith(w.path + path3.sep)) throw badRequest(`${target} is inside the worktree at ${w.path}`, "invalid_path");
+  }
+  let st;
+  try {
+    st = await stat(target);
+  } catch (e) {
+    if (e.code === "ENOENT") return target;
+    throw e;
+  }
+  if (!st.isDirectory() || (await readdir(target)).length > 0) throw badRequest(`${target} already exists`, "path_exists");
+  return target;
+}
+async function addWorktree(ctx, req) {
+  const branch = req.branch.trim();
+  const base = req.base?.trim();
+  await assertBranchName(ctx, branch);
+  const existing = await listWorktreesAll(ctx);
+  const target = await assertNewWorktreePath(ctx, existing, req.path.trim());
+  const cwd = ctx.commonRoot;
+  const branchExists = await refExists(cwd, `refs/heads/${branch}`);
+  let args;
+  if (base) {
+    if (!isValidRef(base)) throw badRequest(`invalid base ref: ${base}`, "invalid_ref");
+    if (!await refExists(cwd, base)) throw badRequest(`unknown ref: ${base}`, "unknown_ref");
+    if (branchExists) throw new HttpError(409, `branch ${branch} already exists`, "branch_exists");
+    args = ["worktree", "add", "-b", branch, target, base];
+  } else {
+    if (!branchExists) throw badRequest(`unknown branch: ${branch}`, "unknown_ref");
+    const holder = existing.find((w) => w.branch === branch);
+    if (holder) throw new HttpError(409, `${branch} is already checked out at ${holder.path}`, "branch_in_use");
+    args = ["worktree", "add", target, branch];
+  }
+  try {
+    await runGitWrite(args, { cwd });
+  } catch (e) {
+    if (e instanceof GitError && /already (checked out|used by worktree)/.test(e.stderr)) throw new HttpError(409, e.message, "branch_in_use");
+    throw e;
+  }
+  const real = await realpath2(target).catch(() => target);
+  const made = (await listWorktrees(ctx)).find((w) => w.path === real);
+  if (!made) throw new HttpError(500, `git created ${target} but does not list it`, "git_failed");
+  return made;
+}
+async function removeWorktree(ctx, req) {
+  const p = req.path.trim();
+  const wt = (await listWorktreesAll(ctx)).find((w) => w.path === p || p && w.path === path3.resolve(p));
+  if (!wt) throw badRequest(`unknown worktree: ${p}`, "unknown_worktree");
+  if (wt.isMain) throw badRequest("the main worktree cannot be removed", "main_worktree");
+  const cwd = ctx.commonRoot;
+  const args = ["worktree", "remove"];
+  if (req.force) args.push("--force");
+  args.push(wt.path);
+  try {
+    await runGitWrite(args, { cwd });
+  } catch (e) {
+    if (e instanceof GitError && /contains modified or untracked files/.test(e.stderr)) {
+      throw new HttpError(409, `${wt.path} has uncommitted changes`, "worktree_dirty");
+    }
+    if (e instanceof GitError && !req.force && /use --force|validation failed/.test(e.stderr)) {
+      throw new HttpError(409, e.message, "needs_force");
+    }
+    throw e;
+  }
+  const res = { ok: true, branchDeleted: false };
+  if (req.deleteBranch && wt.branch) {
+    try {
+      await runGitWrite(["branch", "-d", wt.branch], { cwd });
+      res.branchDeleted = true;
+    } catch (e) {
+      res.branchError = e instanceof Error ? e.message : String(e);
+    }
+  }
+  return res;
+}
+
 // packages/server/src/state.ts
 import os from "os";
-import path3 from "path";
-import { mkdir, open, readFile as readFile2, rename, stat, unlink, writeFile } from "fs/promises";
+import path4 from "path";
+import { mkdir, open, readFile as readFile2, rename, stat as stat2, unlink, writeFile } from "fs/promises";
 function dataDir() {
   const xdg = process.env.XDG_DATA_HOME;
-  const base = xdg && xdg.trim() ? xdg : path3.join(os.homedir(), ".local", "share");
-  return path3.join(base, "warden");
+  const base = xdg && xdg.trim() ? xdg : path4.join(os.homedir(), ".local", "share");
+  return path4.join(base, "warden");
 }
 function repoHash(repoRoot) {
   return sha1(repoRoot).slice(0, 12);
 }
 function stateFilePath(repoRoot, baseDir = dataDir()) {
-  return path3.join(baseDir, repoHash(repoRoot), "state.json");
+  return path4.join(baseDir, repoHash(repoRoot), "state.json");
 }
 function defaultPrefs() {
   return { viewMode: "unified", nvimSocketByRoot: {}, autoRefresh: true };
@@ -3838,7 +4195,7 @@ var StateStore = class {
   /** Apply a mutation under lock. The callback receives the freshest on-disk state. */
   update(fn) {
     const run2 = async () => {
-      await mkdir(path3.dirname(this.file), { recursive: true });
+      await mkdir(path4.dirname(this.file), { recursive: true });
       const release = await this.acquireLock();
       try {
         const state = await this.load();
@@ -3876,7 +4233,7 @@ var StateStore = class {
         const err = e;
         if (err.code !== "EEXIST") throw e;
         try {
-          const st = await stat(lock);
+          const st = await stat2(lock);
           if (Date.now() - st.mtimeMs > LOCK_STALE_MS) {
             await unlink(lock).catch(() => void 0);
             continue;
@@ -3973,9 +4330,9 @@ function formatIssueExport({ repoRoot, issue, comments }) {
 
 // packages/server/src/nvim.ts
 import os2 from "os";
-import path4 from "path";
+import path5 from "path";
 import { execFile as execFile2 } from "child_process";
-import { readdir, stat as stat2 } from "fs/promises";
+import { readdir as readdir2, stat as stat3 } from "fs/promises";
 var QUERY_TIMEOUT_MS = 500;
 var CACHE_TTL_MS = 1e4;
 function execNvim(args, timeoutMs) {
@@ -4004,14 +4361,14 @@ function socketDirs(env = process.env) {
     }
   }
   const tmp = env.TMPDIR || "/tmp";
-  if (user) dirs.push(path4.join(tmp, `nvim.${user}`));
-  if (env.NVIM_LISTEN_ADDRESS) dirs.push(path4.dirname(env.NVIM_LISTEN_ADDRESS));
+  if (user) dirs.push(path5.join(tmp, `nvim.${user}`));
+  if (env.NVIM_LISTEN_ADDRESS) dirs.push(path5.dirname(env.NVIM_LISTEN_ADDRESS));
   return [...new Set(dirs)];
 }
 var SOCKET_NAME = /^nvim\.(\d+)\.\d+$/;
 async function isSocket(p) {
   try {
-    return (await stat2(p)).isSocket();
+    return (await stat3(p)).isSocket();
   } catch {
     return false;
   }
@@ -4021,12 +4378,12 @@ async function findSockets(dirs = socketDirs()) {
   const visit = async (dir, depth) => {
     let entries;
     try {
-      entries = await readdir(dir, { withFileTypes: true });
+      entries = await readdir2(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const ent of entries) {
-      const full = path4.join(dir, ent.name);
+      const full = path5.join(dir, ent.name);
       const m = SOCKET_NAME.exec(ent.name);
       if (m && (ent.isSocket() || await isSocket(full))) {
         found.set(full, Number(m[1]));
@@ -4091,8 +4448,8 @@ var NvimService = class {
 };
 
 // packages/server/src/watcher.ts
-import path5 from "path";
-import { stat as stat3 } from "fs/promises";
+import path6 from "path";
+import { stat as stat4 } from "fs/promises";
 var DEFAULT_POLL_INTERVAL_MS = 1500;
 function statusPaths(out) {
   const parts = out.split("\0");
@@ -4188,7 +4545,7 @@ var RepoWatcher = class {
     const stats = await Promise.all(
       statusPaths(statusRes.stdout).map(async (rel) => {
         try {
-          const st = await stat3(path5.join(this.root, rel));
+          const st = await stat4(path6.join(this.root, rel));
           return `${rel}	${st.mtimeMs}	${st.size}`;
         } catch {
           return `${rel}	-`;
@@ -4200,8 +4557,8 @@ var RepoWatcher = class {
 };
 
 // packages/server/src/static.ts
-import path6 from "path";
-import { readFile as readFile3, stat as stat4 } from "fs/promises";
+import path7 from "path";
+import { readFile as readFile3, stat as stat5 } from "fs/promises";
 var MIME = {
   ".html": "text/html; charset=utf-8",
   ".js": "text/javascript; charset=utf-8",
@@ -4218,20 +4575,20 @@ var MIME = {
   ".txt": "text/plain; charset=utf-8"
 };
 async function serveStaticFile(c, webDir) {
-  const root = path6.resolve(webDir);
+  const root = path7.resolve(webDir);
   let rel;
   try {
     rel = decodeURIComponent(c.req.path);
   } catch {
     return c.text("Bad Request", 400);
   }
-  let target = path6.resolve(root, "." + rel);
-  if (target !== root && !target.startsWith(root + path6.sep)) return c.text("Forbidden", 403);
+  let target = path7.resolve(root, "." + rel);
+  if (target !== root && !target.startsWith(root + path7.sep)) return c.text("Forbidden", 403);
   try {
-    const st = await stat4(target);
-    if (st.isDirectory()) target = path6.join(target, "index.html");
+    const st = await stat5(target);
+    if (st.isDirectory()) target = path7.join(target, "index.html");
   } catch {
-    target = path6.join(root, "index.html");
+    target = path7.join(root, "index.html");
   }
   let body;
   try {
@@ -4239,7 +4596,7 @@ async function serveStaticFile(c, webDir) {
   } catch {
     return c.text("Not Found", 404);
   }
-  const ext = path6.extname(target).toLowerCase();
+  const ext = path7.extname(target).toLowerCase();
   const isAsset = rel.startsWith("/assets/");
   return new Response(new Uint8Array(body), {
     status: 200,
@@ -4310,6 +4667,12 @@ function createApp(opts) {
     return c.json({ error: err instanceof Error ? err.message : String(err), code: "internal" }, 500);
   });
   const api = new Hono2();
+  api.use("*", async (c, next) => {
+    if (c.req.method !== "GET" && c.req.method !== "HEAD" && c.req.header("sec-fetch-site") === "cross-site") {
+      throw new HttpError(403, "cross-site requests are refused", "cross_site");
+    }
+    await next();
+  });
   api.get("/ping", (c) => c.text(opts.instanceToken ?? ""));
   api.get("/repo", async (c) => {
     const state = await store.load();
@@ -4407,6 +4770,24 @@ function createApp(opts) {
     changedNotices.get(key)?.delete(body.path);
     return c.json({ viewed });
   });
+  api.post("/targets/:key/stage", async (c) => {
+    const key = c.req.param("key");
+    const ctx = await targetCtx(key);
+    const mode = stageModeFor(ctx.target);
+    if (!mode) throw badRequest("only the working (stage) and staged (unstage) views can be staged from", "not_stageable");
+    const body = await c.req.json();
+    if (!body.path || typeof body.path !== "string") throw badRequest("missing path");
+    if (!body.contentHash || typeof body.contentHash !== "string") throw badRequest("contentHash is required");
+    if (body.hunks !== void 0 && !Array.isArray(body.hunks)) throw badRequest("hunks must be an array", "bad_selection");
+    const diff = await fileDiffWithHints(ctx, body.path);
+    if (!diff) throw badRequest(`file ${body.path} is not part of ${key}`, "no_diff");
+    if (diff.contentHash !== body.contentHash) throw new HttpError(409, "the diff changed since it was loaded; refresh and pick the lines again", "diff_changed");
+    const { patch, lines } = buildStagePatch(diff, mode, body.hunks);
+    await applyToIndex(ctx.cwd, patch, { reverse: mode === "unstage" });
+    void watchers.get(ctx.cwd)?.poll();
+    const res = { ok: true, lines };
+    return c.json(res);
+  });
   api.get("/targets/:key/comments", async (c) => {
     const key = c.req.param("key");
     const state = await store.load();
@@ -4629,16 +5010,28 @@ function createApp(opts) {
       id: randomUUID(),
       title: body.title.trim(),
       body: typeof body.body === "string" ? body.body : "",
-      status: "open",
+      status: body.status === "closed" ? "closed" : "open",
       commentIds: Array.isArray(body.commentIds) ? body.commentIds.filter((x) => typeof x === "string") : [],
       createdAt: now,
       updatedAt: now
     };
     await store.update((s) => {
-      s.issues.push(issue);
+      s.issues = insertAfter(s.issues, issue, typeof body.after === "string" ? body.after : void 0);
     });
     return c.json(issue, 201);
   });
+  api.post("/issues/:id/move", async (c) => {
+    const id = c.req.param("id");
+    const body = await c.req.json();
+    if (body.before !== null && typeof body.before !== "string") throw badRequest("before must be an id or null");
+    const issues = await store.update((s) => {
+      const next = moveBefore(s.issues, id, body.before);
+      if (!next) throw notFound("issue not found");
+      s.issues = next;
+      return s.issues;
+    });
+    return c.json({ issues });
+  });
   api.patch("/issues/:id", async (c) => {
     const id = c.req.param("id");
     const body = await c.req.json();
@@ -4712,15 +5105,28 @@ function createApp(opts) {
       branch,
       title: body.title.trim(),
       body: typeof body.body === "string" ? body.body : "",
-      status: "open",
+      status: body.status === "done" ? "done" : "open",
       createdAt: now,
       updatedAt: now
     };
     await store.update((s) => {
-      s.todos.push(todo);
+      s.todos = insertAfter(s.todos, todo, typeof body.after === "string" ? body.after : void 0);
     });
     return c.json(todo, 201);
   });
+  api.post("/todos/:id/move", async (c) => {
+    const id = c.req.param("id");
+    const body = await c.req.json();
+    if (body.before !== null && typeof body.before !== "string") throw badRequest("before must be an id or null");
+    const todos = await store.update((s) => {
+      const next = moveBefore(s.todos, id, body.before);
+      if (!next) throw notFound("todo not found");
+      s.todos = next;
+      return s.todos;
+    });
+    const res = { todos };
+    return c.json(res);
+  });
   api.patch("/todos/:id", async (c) => {
     const id = c.req.param("id");
     const body = await c.req.json();
@@ -4792,6 +5198,37 @@ function createApp(opts) {
     const res = { commits, hasMore };
     return c.json(res);
   });
+  api.get("/fork-point", async (c) => {
+    const base = (c.req.query("base") ?? "").trim();
+    if (!isValidRef(base)) throw badRequest("invalid base ref");
+    const cwd = await knownRoot(c.req.query("root") || void 0);
+    if (!await refExists(cwd, base)) throw badRequest(`unknown ref: ${base}`, "unknown_ref");
+    const sha = await refExists(cwd, "HEAD") ? await mergeBase(cwd, base, "HEAD") : void 0;
+    if (!sha) throw badRequest(`${base} and HEAD share no history`, "no_merge_base");
+    const counts = (await runGit(["rev-list", "--left-right", "--count", `${base}...HEAD`], { cwd })).stdout.trim().split(/\s+/);
+    const res = { base, sha, ahead: Number(counts[1] ?? 0), behind: Number(counts[0] ?? 0) };
+    return c.json(res);
+  });
+  api.get("/worktrees", async (c) => {
+    const list = await listWorktreesDetailed(repo);
+    const res = { worktrees: list, branches: await listBranches(repo, list), pathPrefix: worktreePathPrefix(repo) };
+    return c.json(res);
+  });
+  api.post("/worktrees", async (c) => {
+    const body = await c.req.json();
+    if (typeof body.path !== "string" || typeof body.branch !== "string") throw badRequest("path and branch are required");
+    if (body.base !== void 0 && typeof body.base !== "string") throw badRequest("base must be a ref");
+    const made = await addWorktree(repo, body);
+    worktreeCache = null;
+    return c.json(made, 201);
+  });
+  api.post("/worktrees/remove", async (c) => {
+    const body = await c.req.json();
+    if (typeof body.path !== "string") throw badRequest("path is required");
+    const res = await removeWorktree(repo, body);
+    worktreeCache = null;
+    return c.json(res);
+  });
   api.get("/events", async (c) => {
     const root = c.req.query("root") || repo.root;
     const known = root === repo.root || root === repo.commonRoot || (await worktrees()).some((w) => w.path === root);
@@ -4843,7 +5280,7 @@ function createApp(opts) {
   api.post("/nvim/open", async (c) => {
     const body = await c.req.json();
     if (!body.socket || !body.absPath) throw badRequest("socket and absPath are required");
-    if (!path7.isAbsolute(body.absPath)) throw badRequest("absPath must be absolute");
+    if (!path8.isAbsolute(body.absPath)) throw badRequest("absPath must be absolute");
     const scan = await nvim.scan();
     if (!scan.instances.some((i) => i.socket === body.socket)) {
       const fresh = await nvim.scan(true);
@@ -4969,7 +5406,7 @@ async function startServer(opts) {
 }
 
 // bin/cli.ts
-var VERSION = true ? "0.6.1" : "dev";
+var VERSION = true ? "0.8.0" : "dev";
 function parseArgs(argv) {
   const args = { repoPath: process.cwd(), open: true, help: false, version: false };
   for (let i = 0; i < argv.length; i++) {
@@ -4987,7 +5424,7 @@ function parseArgs(argv) {
     } else if (a === "--help" || a === "-h") args.help = true;
     else if (a === "--version" || a === "-v") args.version = true;
     else if (a.startsWith("-")) throw new Error(`unknown option: ${a}`);
-    else args.repoPath = path8.resolve(a);
+    else args.repoPath = path9.resolve(a);
   }
   return args;
 }
@@ -5030,16 +5467,16 @@ async function openBrowser(url) {
   return false;
 }
 function resolveWebDir() {
-  const here = path8.dirname(fileURLToPath(import.meta.url));
+  const here = path9.dirname(fileURLToPath(import.meta.url));
   const candidates = [
     process.env.WARDEN_WEB_DIR,
-    path8.join(here, "web"),
+    path9.join(here, "web"),
     // dist/cli.js -> dist/web
-    path8.join(here, "..", "dist", "web")
+    path9.join(here, "..", "dist", "web")
     // bin/cli.ts (tsx dev) -> dist/web
   ].filter((p) => !!p);
   for (const dir of candidates) {
-    if (existsSync2(path8.join(dir, "index.html"))) return dir;
+    if (existsSync2(path9.join(dir, "index.html"))) return dir;
   }
   return void 0;
 }