codeam-cli 2.20.3 → 2.21.1

package/dist/index.js

@@ -441,7 +441,7 @@ var import_qrcode_terminal = __toESM(require("qrcode-terminal"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.20.3",
+  version: "2.21.1",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -735,7 +735,7 @@ async function postLinkCredential(input) {
   }
 }
 async function _postJsonAuthed(url, body, pluginAuthToken) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const data = JSON.stringify(body);
     const u2 = new URL(url);
     const transport = u2.protocol === "https:" ? https : http;
@@ -767,9 +767,9 @@ async function _postJsonAuthed(url, body, pluginAuthToken) {
             return;
           }
           try {
-            resolve4(JSON.parse(responseBody));
+            resolve5(JSON.parse(responseBody));
           } catch {
-            resolve4(null);
+            resolve5(null);
           }
         });
       }
@@ -784,7 +784,7 @@ async function _postJsonAuthed(url, body, pluginAuthToken) {
   });
 }
 async function _postJson(url, body) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const data = JSON.stringify(body);
     const u2 = new URL(url);
     const transport = u2.protocol === "https:" ? https : http;
@@ -813,9 +813,9 @@ async function _postJson(url, body) {
             return;
           }
           try {
-            resolve4(JSON.parse(body2));
+            resolve5(JSON.parse(body2));
           } catch {
-            resolve4(null);
+            resolve5(null);
           }
         });
       }
@@ -830,7 +830,7 @@ async function _postJson(url, body) {
   });
 }
 async function _getJson(url) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const u2 = new URL(url);
     const transport = u2.protocol === "https:" ? https : http;
     const req = transport.request(
@@ -854,9 +854,9 @@ async function _getJson(url) {
             return;
           }
           try {
-            resolve4(JSON.parse(body));
+            resolve5(JSON.parse(body));
           } catch {
-            resolve4(null);
+            resolve5(null);
           }
         });
       }
@@ -1026,8 +1026,8 @@ function createGetModuleFromFilename(basePath = process.argv[1] ? (0, import_pat
     return decodedFile;
   };
 }
-function normalizeWindowsPath(path37) {
-  return path37.replace(/^[A-Z]:/, "").replace(/\\/g, "/");
+function normalizeWindowsPath(path40) {
+  return path40.replace(/^[A-Z]:/, "").replace(/\\/g, "/");
 }
 
 // ../../node_modules/@posthog/core/dist/featureFlagUtils.mjs
@@ -3507,15 +3507,15 @@ async function addSourceContext(frames) {
   LRU_FILE_CONTENTS_CACHE.reduce();
   return frames;
 }
-function getContextLinesFromFile(path37, ranges, output) {
-  return new Promise((resolve4) => {
-    const stream = (0, import_node_fs.createReadStream)(path37);
+function getContextLinesFromFile(path40, ranges, output) {
+  return new Promise((resolve5) => {
+    const stream = (0, import_node_fs.createReadStream)(path40);
     const lineReaded = (0, import_node_readline.createInterface)({
       input: stream
     });
     function destroyStreamAndResolve() {
       stream.destroy();
-      resolve4();
+      resolve5();
     }
     let lineNumber = 0;
     let currentRangeIndex = 0;
@@ -3524,7 +3524,7 @@ function getContextLinesFromFile(path37, ranges, output) {
     let rangeStart = range[0];
     let rangeEnd = range[1];
     function onStreamError() {
-      LRU_FILE_CONTENTS_FS_READ_FAILED.set(path37, 1);
+      LRU_FILE_CONTENTS_FS_READ_FAILED.set(path40, 1);
       lineReaded.close();
       lineReaded.removeAllListeners();
       destroyStreamAndResolve();
@@ -3585,8 +3585,8 @@ function clearLineContext(frame) {
   delete frame.context_line;
   delete frame.post_context;
 }
-function shouldSkipContextLinesForFile(path37) {
-  return path37.startsWith("node:") || path37.endsWith(".min.js") || path37.endsWith(".min.cjs") || path37.endsWith(".min.mjs") || path37.startsWith("data:");
+function shouldSkipContextLinesForFile(path40) {
+  return path40.startsWith("node:") || path40.endsWith(".min.js") || path40.endsWith(".min.cjs") || path40.endsWith(".min.mjs") || path40.startsWith("data:");
 }
 function shouldSkipContextLinesForFrame(frame) {
   if (void 0 !== frame.lineno && frame.lineno > MAX_CONTEXTLINES_LINENO) return true;
@@ -4802,9 +4802,9 @@ var PostHogBackendClient = class extends PostHogCoreStateless {
     if (!waitUntil) return;
     if (this.disabled || this.optedOut) return;
     if (!this._waitUntilCycle) {
-      let resolve4;
+      let resolve5;
       const promise = new Promise((r) => {
-        resolve4 = r;
+        resolve5 = r;
       });
       try {
         waitUntil(promise);
@@ -4812,7 +4812,7 @@ var PostHogBackendClient = class extends PostHogCoreStateless {
         return;
       }
       this._waitUntilCycle = {
-        resolve: resolve4,
+        resolve: resolve5,
         startedAt: Date.now(),
         timer: void 0
       };
@@ -4836,12 +4836,12 @@ var PostHogBackendClient = class extends PostHogCoreStateless {
     return cycle?.resolve;
   }
   async resolveWaitUntilFlush() {
-    const resolve4 = this._consumeWaitUntilCycle();
+    const resolve5 = this._consumeWaitUntilCycle();
     try {
       await super.flush();
     } catch {
     } finally {
-      resolve4?.();
+      resolve5?.();
     }
   }
   getPersistedProperty(key) {
@@ -4933,15 +4933,15 @@ var PostHogBackendClient = class extends PostHogCoreStateless {
   async waitForLocalEvaluationReady(timeoutMs = THIRTY_SECONDS) {
     if (this.isLocalEvaluationReady()) return true;
     if (void 0 === this.featureFlagsPoller) return false;
-    return new Promise((resolve4) => {
+    return new Promise((resolve5) => {
       const timeout = setTimeout(() => {
         cleanup();
-        resolve4(false);
+        resolve5(false);
       }, timeoutMs);
       const cleanup = this._events.on("localEvaluationFlagsLoaded", (count) => {
         clearTimeout(timeout);
         cleanup();
-        resolve4(count > 0);
+        resolve5(count > 0);
       });
     });
   }
@@ -5378,13 +5378,13 @@ var PostHogBackendClient = class extends PostHogCoreStateless {
     this.context?.enter(data, options);
   }
   async _shutdown(shutdownTimeoutMs) {
-    const resolve4 = this._consumeWaitUntilCycle();
+    const resolve5 = this._consumeWaitUntilCycle();
     await this.featureFlagsPoller?.stopPoller(shutdownTimeoutMs);
     this.errorTracking.shutdown();
     try {
       return await super._shutdown(shutdownTimeoutMs);
     } finally {
-      resolve4?.();
+      resolve5?.();
     }
   }
   async _requestRemoteConfigPayload(flagKey) {
@@ -5740,7 +5740,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.20.3" : "0.0.0-dev",
+    cliVersion: true ? "2.21.1" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -8874,15 +8874,15 @@ function runInstaller() {
     "-Command",
     "irm https://claude.ai/install.ps1 | iex"
   ] : ["-c", "curl -fsSL https://claude.ai/install.sh | bash"];
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const proc = (0, import_child_process4.spawn)(cmd, args2, { stdio: "inherit" });
     proc.on("error", (err) => {
       console.error(`
   \u2717 Installer failed to launch: ${err.message}`);
-      resolve4(false);
+      resolve5(false);
     });
     proc.on("exit", (code) => {
-      resolve4(code === 0);
+      resolve5(code === 0);
     });
   });
 }
@@ -9045,17 +9045,17 @@ function parseUsageOutput(raw) {
   return { percent, resetAt };
 }
 async function fetchClaudeQuota() {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const claudeCmd = findInPath("claude") ? "claude" : "claude-code";
     if (!claudeCmd) {
-      resolve4(null);
+      resolve5(null);
       return;
     }
     const helperPath = path11.join(os10.tmpdir(), "codeam-quota-helper.py");
     fs8.writeFileSync(helperPath, HELPER_SCRIPT, { mode: 420 });
     const python = findInPath("python3") ?? findInPath("python");
     if (!python) {
-      resolve4(null);
+      resolve5(null);
       return;
     }
     const proc = (0, import_child_process5.spawn)(python, [helperPath, claudeCmd, "--tools", ""], {
@@ -9082,13 +9082,13 @@ async function fetchClaudeQuota() {
           fs8.unlinkSync(helperPath);
         } catch {
         }
-        resolve4(result);
+        resolve5(result);
       }, 5e3);
     }, 8e3);
     setTimeout(() => {
       if (!resolved) {
         resolved = true;
-        resolve4(null);
+        resolve5(null);
       }
       try {
         proc.kill();
@@ -10428,12 +10428,12 @@ function resolveNpm(os26) {
   return os26.id === "win32" ? "npm.cmd" : "npm";
 }
 async function installCodexViaNpm(os26) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const proc = (0, import_node_child_process4.spawn)(resolveNpm(os26), ["install", "-g", "@openai/codex"], {
       stdio: "inherit"
     });
     proc.on("close", (code) => {
-      if (code === 0) resolve4();
+      if (code === 0) resolve5();
       else reject(new Error(`npm install -g @openai/codex exited ${code}`));
     });
     proc.on("error", (err) => {
@@ -10548,12 +10548,12 @@ async function ensureCoderabbitInstalled(os26) {
     return false;
   }
   console.log("\n  CodeRabbit CLI not found \u2014 installing via the official script\u2026\n");
-  const ok = await new Promise((resolve4) => {
+  const ok = await new Promise((resolve5) => {
     const proc = (0, import_node_child_process5.spawn)("sh", ["-c", `curl -fsSL ${INSTALL_URL} | sh`], {
       stdio: "inherit"
     });
-    proc.on("close", (code) => resolve4(code === 0));
-    proc.on("error", () => resolve4(false));
+    proc.on("close", (code) => resolve5(code === 0));
+    proc.on("error", () => resolve5(false));
   });
   if (!ok) return false;
   os26.augmentPath([`${os26.homeDir()}/.local/bin`, "/opt/homebrew/bin"]);
@@ -10610,11 +10610,11 @@ function parseReview(stdout) {
   for (const line of lines) {
     const m = line.match(HUNK_LINE_RE);
     if (!m) continue;
-    const [, path37, lineNo, sevToken, message] = m;
-    if (!path37 || !lineNo || !message) continue;
+    const [, path40, lineNo, sevToken, message] = m;
+    if (!path40 || !lineNo || !message) continue;
     const cleanedMessage = message.trim().replace(/^[*-]\s+/, "");
     hunks.push({
-      path: path37.trim(),
+      path: path40.trim(),
       line: Number(lineNo),
       severity: sevToken ? SEVERITY_MAP[sevToken.toLowerCase()] : void 0,
       message: cleanedMessage
@@ -10672,7 +10672,7 @@ var CoderabbitRuntimeStrategy = class {
   }
   async runOneShot(input) {
     const launch = await this.prepareInvocation(input);
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve5, reject) => {
       const stdoutBuf = [];
       const stderrBuf = [];
       const proc = (0, import_node_child_process7.spawn)(launch.cmd, launch.args, {
@@ -10683,7 +10683,7 @@ var CoderabbitRuntimeStrategy = class {
       proc.stderr?.on("data", (b) => stderrBuf.push(b));
       proc.on("error", (err) => reject(err));
       proc.on("close", (code) => {
-        resolve4(
+        resolve5(
           this.parseOutput({
             exitCode: code ?? 0,
             stdout: Buffer.concat(stdoutBuf).toString("utf8"),
@@ -11216,14 +11216,14 @@ var ChunkEmitter = class {
       "chunkEmitter",
       `send type=${body.type ?? "(clear)"} bytes=${payload.length} done=${body.done === true}`
     );
-    return new Promise((resolve4) => {
+    return new Promise((resolve5) => {
       const attempt = (attemptsLeft) => {
         _transport2.post(this.url, this.headers, payload).then(({ statusCode, body: resBody }) => {
           const tookMs = Date.now() - t0;
           if (statusCode === 410 || statusCode === 404 && /SESSION_NOT_FOUND|SESSION_GONE/.test(resBody)) {
             process.stderr.write("[codeam] session was deleted/disconnected \u2014 stopping output stream.\n");
             log.info("chunkEmitter", `dead status=${statusCode} took=${tookMs}ms`);
-            resolve4({ dead: true });
+            resolve5({ dead: true });
             return;
           }
           if (statusCode >= 400) {
@@ -11233,7 +11233,7 @@ var ChunkEmitter = class {
           } else {
             log.info("chunkEmitter", `ok status=${statusCode} took=${tookMs}ms`);
           }
-          resolve4({ dead: false });
+          resolve5({ dead: false });
         }).catch((err) => {
           log.warn(
             "chunkEmitter",
@@ -11244,7 +11244,7 @@ var ChunkEmitter = class {
             const delay = 200 * (maxRetries - attemptsLeft + 1);
             setTimeout(() => attempt(attemptsLeft - 1), delay);
           } else {
-            resolve4({ dead: false });
+            resolve5({ dead: false });
           }
         });
       };
@@ -11256,7 +11256,7 @@ var _transport2 = {
   post: _post
 };
 function _post(url, headers, payload) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     let settled = false;
     const u2 = new URL(url);
     const transport = u2.protocol === "https:" ? https3 : http3;
@@ -11280,7 +11280,7 @@ function _post(url, headers, payload) {
         res.on("end", () => {
           if (settled) return;
           settled = true;
-          resolve4({ statusCode: res.statusCode ?? 0, body: resData });
+          resolve5({ statusCode: res.statusCode ?? 0, body: resData });
         });
       }
     );
@@ -11781,7 +11781,7 @@ function parseJsonl(filePath) {
   return messages;
 }
 function post(endpoint, body) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const payload = JSON.stringify(body);
     const u2 = new URL(`${API_BASE4}${endpoint}`);
     const transport = u2.protocol === "https:" ? https4 : http4;
@@ -11802,17 +11802,17 @@ function post(endpoint, body) {
         res.resume();
         const ok = res.statusCode !== void 0 && res.statusCode >= 200 && res.statusCode < 300;
         if (!ok) log.warn("history:post", `${endpoint} \u2192 HTTP ${res.statusCode}`);
-        resolve4(ok);
+        resolve5(ok);
       }
     );
     req.on("error", (err) => {
       log.warn("history:post", `${endpoint} network error`, err);
-      resolve4(false);
+      resolve5(false);
     });
     req.on("timeout", () => {
       log.warn("history:post", `${endpoint} timeout after 15s`);
       req.destroy();
-      resolve4(false);
+      resolve5(false);
     });
     req.write(payload);
     req.end();
@@ -12296,7 +12296,7 @@ var _transport3 = {
   post: _post2
 };
 function _post2(url, headers, payload) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     let settled = false;
     const u2 = new URL(url);
     const lib = u2.protocol === "https:" ? https5 : http5;
@@ -12321,7 +12321,7 @@ function _post2(url, headers, payload) {
         res.on("end", () => {
           if (settled) return;
           settled = true;
-          resolve4({ statusCode: res.statusCode ?? 0, body });
+          resolve5({ statusCode: res.statusCode ?? 0, body });
         });
       }
     );
@@ -12576,6 +12576,7 @@ var FileWatcherService = class {
       );
       return;
     }
+    this.opts.onRepoDirty?.(gitRoot);
     const relPathInRepo = path25.relative(gitRoot, absPath);
     if (!relPathInRepo || relPathInRepo.startsWith("..")) return;
     const repoPath = path25.relative(this.opts.workingDir, gitRoot);
@@ -12690,6 +12691,7 @@ var FileWatcherService = class {
       "X-Plugin-Auth-Token": this.opts.pluginAuthToken
     };
     for (let attempt = 0; attempt <= MAX_RETRIES; attempt += 1) {
+      if (this.stopped) return;
       try {
         const { statusCode, body: resBody } = await _transport3.post(url, headers, payload);
         if (statusCode >= 200 && statusCode < 300) {
@@ -12738,12 +12740,12 @@ var _gitSeam = {
   run: _runGitImpl
 };
 async function _runGitImpl(cwd, args2, opts = {}) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     let proc;
     try {
       proc = (0, import_child_process7.spawn)("git", args2, { cwd, env: process.env });
     } catch {
-      resolve4(null);
+      resolve5(null);
       return;
     }
     let stdout = "";
@@ -12754,13 +12756,13 @@ async function _runGitImpl(cwd, args2, opts = {}) {
     proc.stderr?.on("data", (c2) => {
       stderr += c2.toString();
     });
-    proc.on("error", () => resolve4(null));
+    proc.on("error", () => resolve5(null));
     proc.on("close", (code) => {
       if (code === 0 || opts.allowNonZeroExit) {
-        resolve4(stdout);
+        resolve5(stdout);
       } else {
         log.trace("fileWatcher", `git ${args2.join(" ")} exited ${code} stderr=${stderr.slice(0, 200)}`);
-        resolve4(null);
+        resolve5(null);
       }
     });
   });
@@ -12769,9 +12771,493 @@ function _runGit(cwd, args2, opts = {}) {
   return _gitSeam.run(cwd, args2, opts);
 }
 
-// src/services/streaming-emitter.service.ts
+// src/services/turn-files/turn-file-aggregator.ts
 var import_crypto2 = require("crypto");
 
+// src/services/turn-files/git-changeset.ts
+var import_child_process8 = require("child_process");
+var path26 = __toESM(require("path"));
+async function collectRepoChangeset(opts) {
+  const status2 = await runGit2(opts.repoRoot, ["status", "--porcelain=v1", "-z"]);
+  if (status2 === null) return null;
+  const numstatRaw = await runGit2(opts.repoRoot, [
+    "diff",
+    "--numstat",
+    "-z",
+    "HEAD"
+  ]).catch(() => null);
+  const numstat = parseNumstat(numstatRaw ?? "");
+  const entries = [];
+  for (const row of parseStatus(status2)) {
+    const stats = numstat.get(row.filePath) ?? { added: 0, removed: 0 };
+    entries.push({
+      filePath: row.filePath,
+      fileStatus: row.fileStatus,
+      linesAdded: stats.added,
+      linesRemoved: stats.removed,
+      // hunkCount isn't surfaced by --numstat. For the rail / drawer
+      // it's only a count badge; defaulting to 1 when the file has
+      // any non-zero stat is good enough until we wire a follow-up
+      // per-file `git diff --shortstat` if we ever want exact hunks.
+      hunkCount: stats.added + stats.removed > 0 ? 1 : 0,
+      repoPath: opts.repoPath,
+      repoName: opts.repoName
+    });
+  }
+  return entries;
+}
+function parseStatus(raw) {
+  const tokens = raw.split("\0");
+  const rows = [];
+  for (let i = 0; i < tokens.length; i++) {
+    const token = tokens[i];
+    if (!token || token.length < 3) continue;
+    const code = token.slice(0, 2);
+    const filePath = token.slice(3);
+    if (!filePath) continue;
+    const indexCode = code[0];
+    const worktreeCode = code[1];
+    if (indexCode === "R" || worktreeCode === "R") {
+      rows.push({ filePath, fileStatus: "renamed" });
+      i += 1;
+      continue;
+    }
+    if (code === "??" || indexCode === "A" || worktreeCode === "A") {
+      rows.push({ filePath, fileStatus: "added" });
+      continue;
+    }
+    if (indexCode === "D" || worktreeCode === "D") {
+      rows.push({ filePath, fileStatus: "deleted" });
+      continue;
+    }
+    rows.push({ filePath, fileStatus: "modified" });
+  }
+  return rows;
+}
+function parseNumstat(raw) {
+  const out2 = /* @__PURE__ */ new Map();
+  for (const record of raw.split("\0")) {
+    if (!record) continue;
+    const parts = record.split("	");
+    if (parts.length < 3) continue;
+    const added = parts[0] === "-" ? 0 : parseInt(parts[0], 10) || 0;
+    const removed = parts[1] === "-" ? 0 : parseInt(parts[1], 10) || 0;
+    const filePath = parts.slice(2).join("	");
+    if (!filePath) continue;
+    out2.set(filePath, { added, removed });
+  }
+  return out2;
+}
+var _runGitImpl2 = {
+  run: defaultRunGit
+};
+function runGit2(cwd, args2) {
+  return _runGitImpl2.run(cwd, args2);
+}
+function defaultRunGit(cwd, args2) {
+  return new Promise((resolve5) => {
+    let proc;
+    try {
+      proc = (0, import_child_process8.spawn)("git", args2, { cwd, env: process.env });
+    } catch {
+      resolve5(null);
+      return;
+    }
+    let stdout = "";
+    let stderr = "";
+    proc.stdout?.on("data", (c2) => {
+      stdout += c2.toString();
+    });
+    proc.stderr?.on("data", (c2) => {
+      stderr += c2.toString();
+    });
+    proc.on("error", () => resolve5(null));
+    proc.on("close", (code) => {
+      if (code === 0) {
+        resolve5(stdout);
+      } else {
+        log.trace(
+          "turnFiles",
+          `git ${args2.join(" ")} exited ${code} stderr=${stderr.slice(0, 200)}`
+        );
+        resolve5(null);
+      }
+    });
+  });
+}
+async function discoverRepos(workingDir, maxDepth = 4) {
+  const fs31 = await import("fs/promises");
+  const out2 = [];
+  await walk(workingDir, 0);
+  return out2;
+  async function walk(dir, depth) {
+    if (depth > maxDepth) return;
+    let entries = [];
+    try {
+      const dirents = await fs31.readdir(dir, { withFileTypes: true });
+      entries = dirents.filter((d3) => !d3.name.startsWith(".") || d3.name === ".git").map((d3) => ({ name: d3.name, isDirectory: d3.isDirectory() }));
+    } catch {
+      return;
+    }
+    const hasGit = entries.some(
+      (e) => e.name === ".git" && (e.isDirectory || true)
+    );
+    if (hasGit) {
+      out2.push({
+        repoRoot: dir,
+        repoPath: path26.relative(workingDir, dir),
+        repoName: path26.basename(dir)
+      });
+      return;
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory) continue;
+      if (entry.name === "node_modules") continue;
+      if (entry.name === "dist" || entry.name === "build") continue;
+      await walk(path26.join(dir, entry.name), depth + 1);
+    }
+  }
+}
+
+// src/services/turn-files/files-outbox.ts
+var fs22 = __toESM(require("fs/promises"));
+var path27 = __toESM(require("path"));
+var import_os6 = require("os");
+var HOME_OUTBOX_DIR = ".codeam/outbox";
+var MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+var BACKOFF_STEPS_MS = [
+  1e3,
+  // 1 s
+  2e3,
+  // 2 s
+  4e3,
+  // 4 s
+  8e3,
+  // 8 s
+  16e3,
+  // 16 s
+  32e3,
+  // 32 s
+  6e4,
+  // 1 min
+  12e4,
+  // 2 min
+  3e5
+  // 5 min — cap
+];
+var FilesOutbox = class {
+  filePath;
+  post;
+  autoSchedule;
+  flushTimer = null;
+  flushing = false;
+  backoffIndex = 0;
+  stopped = false;
+  constructor(opts) {
+    const base = opts.baseDir ?? path27.join(homeDir(), HOME_OUTBOX_DIR);
+    this.filePath = path27.join(base, `${opts.sessionId}.jsonl`);
+    this.post = opts.post;
+    this.autoSchedule = opts.autoSchedule !== false;
+  }
+  /** Persist the entry to disk and trigger a flush. Returns once the
+   *  line is durable on disk (not once the POST succeeds). */
+  async enqueue(entry) {
+    await fs22.mkdir(path27.dirname(this.filePath), { recursive: true });
+    await fs22.appendFile(this.filePath, JSON.stringify(entry) + "\n", "utf8");
+    this.backoffIndex = 0;
+    if (this.autoSchedule) this.scheduleFlush(0);
+  }
+  /** Stop the scheduler. Idempotent. The on-disk file is left alone
+   *  so the next process pickup can flush whatever's pending. */
+  stop() {
+    this.stopped = true;
+    if (this.flushTimer) {
+      clearTimeout(this.flushTimer);
+      this.flushTimer = null;
+    }
+  }
+  /** Visible for tests. Forces a flush attempt right now. */
+  async _flushNow() {
+    return this.flush();
+  }
+  scheduleFlush(delayMs) {
+    if (this.stopped) return;
+    if (this.flushTimer) clearTimeout(this.flushTimer);
+    const jittered = delayMs === 0 ? 0 : applyJitter(delayMs);
+    this.flushTimer = setTimeout(() => {
+      this.flushTimer = null;
+      void this.flush();
+    }, jittered);
+  }
+  async flush() {
+    if (this.stopped) return;
+    if (this.flushing) {
+      return;
+    }
+    this.flushing = true;
+    try {
+      const entries = await this.readAll();
+      if (entries.length === 0) return;
+      const now = Date.now();
+      const fresh = entries.filter((e) => now - e.enqueuedAt <= MAX_AGE_MS);
+      if (fresh.length < entries.length) {
+        log.warn(
+          "turnFiles",
+          `dropping ${entries.length - fresh.length} outbox entries older than ${MAX_AGE_MS / 1e3}s`
+        );
+      }
+      const stillPending = [];
+      let anyFailed = false;
+      for (const entry of fresh) {
+        if (this.stopped) {
+          stillPending.push(entry);
+          continue;
+        }
+        try {
+          const res = await this.post(entry);
+          if (res.ok) continue;
+          if (res.statusCode === 404 || res.statusCode === 410) {
+            log.warn(
+              "turnFiles",
+              `session dead (status=${res.statusCode}); dropping turnId=${entry.turnId.slice(0, 8)}`
+            );
+            continue;
+          }
+          anyFailed = true;
+          stillPending.push(entry);
+        } catch (err) {
+          anyFailed = true;
+          stillPending.push(entry);
+          log.trace(
+            "turnFiles",
+            `outbox post threw for turnId=${entry.turnId.slice(0, 8)}: ${err.message}`
+          );
+        }
+      }
+      await this.rewrite(stillPending);
+      if (anyFailed) {
+        const delay = BACKOFF_STEPS_MS[Math.min(this.backoffIndex, BACKOFF_STEPS_MS.length - 1)];
+        this.backoffIndex = Math.min(
+          this.backoffIndex + 1,
+          BACKOFF_STEPS_MS.length - 1
+        );
+        this.scheduleFlush(delay);
+      } else {
+        this.backoffIndex = 0;
+      }
+    } finally {
+      this.flushing = false;
+    }
+  }
+  async readAll() {
+    let raw = "";
+    try {
+      raw = await fs22.readFile(this.filePath, "utf8");
+    } catch {
+      return [];
+    }
+    const out2 = [];
+    for (const line of raw.split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      try {
+        out2.push(JSON.parse(trimmed));
+      } catch {
+      }
+    }
+    return out2;
+  }
+  /**
+   * Atomic compaction: write to `<file>.tmp`, fsync, rename over the
+   * original. A crash between any of these steps leaves either the
+   * original (no progress) or the new file (clean compaction) — never
+   * a torn write.
+   */
+  async rewrite(entries) {
+    const tmpPath = `${this.filePath}.${process.pid}.tmp`;
+    if (entries.length === 0) {
+      await fs22.unlink(this.filePath).catch(() => void 0);
+      return;
+    }
+    const payload = entries.map((e) => JSON.stringify(e)).join("\n") + "\n";
+    await fs22.writeFile(tmpPath, payload, "utf8");
+    await fs22.rename(tmpPath, this.filePath);
+  }
+};
+function applyJitter(ms) {
+  const factor = 0.8 + Math.random() * 0.4;
+  return Math.round(ms * factor);
+}
+function homeDir() {
+  return process.env.HOME ?? process.env.USERPROFILE ?? (0, import_os6.tmpdir)();
+}
+
+// src/services/turn-files/turn-file-aggregator.ts
+var API_BASE6 = resolveApiBaseUrl();
+var ENDPOINT = "/api/files/batch";
+var MAX_BATCH_SIZE = 1e3;
+var TurnFileAggregator = class {
+  constructor(opts) {
+    this.opts = opts;
+    this.apiBase = opts.apiBaseUrl ?? API_BASE6;
+    this.outbox = new FilesOutbox({
+      sessionId: opts.sessionId,
+      baseDir: opts.outboxDir,
+      post: (entry) => this.postEntry(entry),
+      autoSchedule: opts.outboxAutoSchedule
+    });
+    this.discovering = discoverRepos(opts.workingDir).then((repos) => {
+      this.repos = repos;
+      opts.dirtyTracker?.markAllDirty(repos);
+      log.info(
+        "turnFiles",
+        `discovered ${repos.length} repo(s) under ${opts.workingDir}: ${repos.map((r) => r.repoName || "<root>").join(", ")}`
+      );
+    });
+  }
+  opts;
+  apiBase;
+  outbox;
+  repos = [];
+  discovering = null;
+  stopped = false;
+  /** Stop the outbox scheduler. Idempotent. */
+  stop() {
+    this.stopped = true;
+    this.outbox.stop();
+  }
+  /**
+   * Run the discovery + git collection + POST pipeline for one
+   * turn. Errors are swallowed (logged) so an agent never blocks on a
+   * file-changeset failure; the outbox covers the network half.
+   */
+  async flushTurn() {
+    if (this.stopped) return;
+    try {
+      if (this.discovering) {
+        await this.discovering;
+        this.discovering = null;
+      }
+      if (this.repos.length === 0) {
+        log.trace("turnFiles", "no repos discovered \u2014 skipping flush");
+        return;
+      }
+      const reposToScan = this.opts.dirtyTracker ? this.filterByDirty(this.opts.dirtyTracker) : this.repos;
+      if (reposToScan.length === 0) {
+        log.trace("turnFiles", "dirty set empty \u2014 skipping flush");
+        return;
+      }
+      const files = [];
+      for (const repo of reposToScan) {
+        const entries = await collectRepoChangeset(repo);
+        if (entries) files.push(...entries);
+      }
+      if (files.length === 0) {
+        log.trace("turnFiles", "no changes detected this turn \u2014 skipping POST");
+        return;
+      }
+      const chunks = chunkArray(files, MAX_BATCH_SIZE);
+      for (const chunk of chunks) {
+        const entry = {
+          turnId: (0, import_crypto2.randomUUID)(),
+          sessionId: this.opts.sessionId,
+          pluginId: this.opts.pluginId,
+          enqueuedAt: Date.now(),
+          files: chunk
+        };
+        await this.outbox.enqueue(entry);
+      }
+    } catch (err) {
+      log.warn(
+        "turnFiles",
+        `flushTurn failed: ${err.message ?? String(err)}`
+      );
+    }
+  }
+  /**
+   * Consume the tracker's dirty set and intersect with the
+   * discovered repos so we never spawn git for a path the watcher
+   * marked outside our discovered set (e.g. a sibling repo that
+   * appeared after construction). Unknown roots get dropped on the
+   * floor — they'll re-mark themselves on the next event if they're
+   * inside `workingDir`.
+   */
+  filterByDirty(tracker) {
+    const dirty = tracker.consume();
+    if (dirty.size === 0) return [];
+    return this.repos.filter((repo) => dirty.has(repo.repoRoot));
+  }
+  async postEntry(entry) {
+    const url = `${this.apiBase}${ENDPOINT}`;
+    const headers = {
+      "Content-Type": "application/json",
+      "X-Codeam-Protocol-Version": PROTOCOL_VERSION,
+      "X-Plugin-Auth-Token": this.opts.pluginAuthToken
+    };
+    const body = JSON.stringify({
+      sessionId: entry.sessionId,
+      pluginId: entry.pluginId,
+      turnId: entry.turnId,
+      files: entry.files
+    });
+    try {
+      const res = await _transport3.post(url, headers, body);
+      return { ok: res.statusCode >= 200 && res.statusCode < 300, statusCode: res.statusCode };
+    } catch (err) {
+      log.trace(
+        "turnFiles",
+        `batch POST threw turnId=${entry.turnId.slice(0, 8)}: ${err.message}`
+      );
+      return { ok: false, statusCode: 0 };
+    }
+  }
+};
+function chunkArray(arr, size) {
+  if (arr.length <= size) return [arr];
+  const out2 = [];
+  for (let i = 0; i < arr.length; i += size) {
+    out2.push(arr.slice(i, i + size));
+  }
+  return out2;
+}
+
+// src/services/turn-files/repo-dirty-tracker.ts
+var RepoDirtyTracker = class {
+  dirty = /* @__PURE__ */ new Set();
+  /** Add a repo root to the dirty set. Idempotent. */
+  markDirty(repoRoot) {
+    this.dirty.add(repoRoot);
+  }
+  /** Seed every known repo as dirty — used right after `discoverRepos`
+   *  returns so the first end-of-turn flush captures worktree state
+   *  that predates the pairing. */
+  markAllDirty(repoRoots) {
+    for (const r of repoRoots) this.dirty.add(r.repoRoot);
+  }
+  /** Snapshot the current dirty set without clearing — useful for
+   *  diagnostic logs / tests. */
+  peek() {
+    return new Set(this.dirty);
+  }
+  /** Atomically read AND clear the dirty set. The aggregator calls
+   *  this on each `done:true`; subsequent filesystem events
+   *  re-populate it for the next turn. */
+  consume() {
+    const snapshot = new Set(this.dirty);
+    this.dirty.clear();
+    return snapshot;
+  }
+  /** True when the set is non-empty. Cheap pre-flight gate so the
+   *  aggregator can early-return on chat-only turns without
+   *  touching the dirty set. */
+  hasDirty() {
+    return this.dirty.size > 0;
+  }
+};
+
+// src/services/streaming-emitter.service.ts
+var import_crypto3 = require("crypto");
+
 // src/services/streaming/transport.ts
 var http6 = __toESM(require("http"));
 var https6 = __toESM(require("https"));
@@ -12780,7 +13266,7 @@ var _transport4 = {
   get: _get
 };
 function _post3(url, headers, payload) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     let settled = false;
     const u2 = new URL(url);
     const lib = u2.protocol === "https:" ? https6 : http6;
@@ -12805,7 +13291,7 @@ function _post3(url, headers, payload) {
         res.on("end", () => {
           if (settled) return;
           settled = true;
-          resolve4({ statusCode: res.statusCode ?? 0, body });
+          resolve5({ statusCode: res.statusCode ?? 0, body });
         });
       }
     );
@@ -12822,7 +13308,7 @@ function _post3(url, headers, payload) {
   });
 }
 function _get(url, headers) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     let settled = false;
     const u2 = new URL(url);
     const lib = u2.protocol === "https:" ? https6 : http6;
@@ -12846,7 +13332,7 @@ function _get(url, headers) {
         res.on("end", () => {
           if (settled) return;
           settled = true;
-          resolve4({ statusCode: res.statusCode ?? 0, body });
+          resolve5({ statusCode: res.statusCode ?? 0, body });
         });
       }
     );
@@ -12863,7 +13349,7 @@ function _get(url, headers) {
 }
 
 // src/services/streaming-emitter.service.ts
-var API_BASE6 = resolveApiBaseUrl();
+var API_BASE7 = resolveApiBaseUrl();
 var TICK_MS = 50;
 var ANSWER_POLL_MS = 1500;
 var SELECTOR_STABLE_MS = 800;
@@ -12874,7 +13360,7 @@ var TAIL_KEEP_BYTES2 = 1.5 * 1024 * 1024;
 var StreamingEmitterService = class {
   constructor(opts) {
     this.opts = opts;
-    this.apiBase = opts.apiBaseUrl ?? API_BASE6;
+    this.apiBase = opts.apiBaseUrl ?? API_BASE7;
     this.headers = {
       "Content-Type": "application/json",
       "X-Codeam-Protocol-Version": "2.0.0",
@@ -12993,7 +13479,7 @@ var StreamingEmitterService = class {
       });
     }
     this.activeChunk = {
-      chunkId: (0, import_crypto2.randomUUID)(),
+      chunkId: (0, import_crypto3.randomUUID)(),
       kind: last.kind,
       emittedContent: "",
       currentContent: last.content,
@@ -13061,7 +13547,7 @@ var StreamingEmitterService = class {
     }
     if (this.pendingAnswer) return;
     if (now - this.selectorFirstSeenAt < SELECTOR_STABLE_MS) return;
-    const questionId = (0, import_crypto2.randomUUID)();
+    const questionId = (0, import_crypto3.randomUUID)();
     this.pendingAnswer = {
       questionId,
       options: selector.options.length > 0 ? selector.options : void 0,
@@ -13224,13 +13710,13 @@ function fetchQuotaUsage(runtime, historySvc) {
 }
 
 // src/commands/start/keep-alive.ts
-var import_child_process8 = require("child_process");
+var import_child_process9 = require("child_process");
 function buildKeepAlive(ctx) {
   let timer = null;
   async function setIdleTimeout(minutes) {
     if (!ctx.inCodespace || !ctx.codespaceName) return;
-    await new Promise((resolve4) => {
-      const proc = (0, import_child_process8.spawn)(
+    await new Promise((resolve5) => {
+      const proc = (0, import_child_process9.spawn)(
         "gh",
         [
           "api",
@@ -13243,8 +13729,8 @@ function buildKeepAlive(ctx) {
         { stdio: "ignore", detached: true }
       );
       proc.unref();
-      proc.on("exit", () => resolve4());
-      proc.on("error", () => resolve4());
+      proc.on("exit", () => resolve5());
+      proc.on("error", () => resolve5());
     });
   }
   return {
@@ -13267,11 +13753,11 @@ function buildKeepAlive(ctx) {
 }
 
 // src/commands/start/handlers.ts
-var fs24 = __toESM(require("fs"));
+var fs26 = __toESM(require("fs"));
 var os23 = __toESM(require("os"));
-var path29 = __toESM(require("path"));
-var import_crypto4 = require("crypto");
-var import_child_process11 = require("child_process");
+var path32 = __toESM(require("path"));
+var import_crypto5 = require("crypto");
+var import_child_process13 = require("child_process");
 
 // src/lib/payload.ts
 var import_zod2 = require("zod");
@@ -13319,7 +13805,15 @@ var startCommandSchema = import_zod2.z.object({
   data: import_zod2.z.string().max(64 * 1024).optional(),
   cwd: import_zod2.z.string().max(4096).optional(),
   cols: import_zod2.z.number().int().min(1).max(500).optional(),
-  rows: import_zod2.z.number().int().min(1).max(200).optional()
+  rows: import_zod2.z.number().int().min(1).max(200).optional(),
+  // `apply_file_review` (Epic B follow-up — backend pushes this when
+  // the user clicks APPROVE_CHANGES / REJECT_CHANGES in the diff
+  // drawer). `filePath` is relative to the enclosing git repo; the
+  // handler walks up from it to find `.git/` and runs `git add` or
+  // `git restore` from there. `action='approved'` stages the edit,
+  // `action='rejected'` discards every worktree change on the file.
+  filePath: import_zod2.z.string().min(1).max(4096).optional(),
+  action: import_zod2.z.enum(["approved", "rejected"]).optional()
 });
 function parsePayload2(schema, raw) {
   const result = schema.safeParse(raw);
@@ -13327,8 +13821,8 @@ function parsePayload2(schema, raw) {
 }
 
 // src/services/file-ops.service.ts
-var fs22 = __toESM(require("fs/promises"));
-var path26 = __toESM(require("path"));
+var fs23 = __toESM(require("fs/promises"));
+var path28 = __toESM(require("path"));
 var MAX_FILE_BYTES = 5 * 1024 * 1024;
 var MAX_WALK_DEPTH = 6;
 var MAX_VISITED_DIRS = 5e3;
@@ -13363,12 +13857,12 @@ var SUBDIR_IGNORE = /* @__PURE__ */ new Set([
   "__pycache__"
 ]);
 function isUnder(parent, candidate) {
-  const rel = path26.relative(parent, candidate);
-  return rel === "" || !rel.startsWith("..") && !path26.isAbsolute(rel);
+  const rel = path28.relative(parent, candidate);
+  return rel === "" || !rel.startsWith("..") && !path28.isAbsolute(rel);
 }
 async function isExistingFile(absPath) {
   try {
-    const stat3 = await fs22.stat(absPath);
+    const stat3 = await fs23.stat(absPath);
     return stat3.isFile();
   } catch {
     return false;
@@ -13381,13 +13875,13 @@ async function walkForSuffix(dir, needleVariants, depth, ctx) {
   ctx.visited++;
   let entries = [];
   try {
-    entries = await fs22.readdir(dir, { withFileTypes: true });
+    entries = await fs23.readdir(dir, { withFileTypes: true });
   } catch {
     return;
   }
   for (const e of entries) {
     if (!e.isFile()) continue;
-    const full = path26.join(dir, e.name);
+    const full = path28.join(dir, e.name);
     if (needleVariants.some((needle) => full.endsWith(needle))) {
       ctx.matches.push(full);
       if (ctx.matches.length >= ctx.cap) return;
@@ -13397,21 +13891,21 @@ async function walkForSuffix(dir, needleVariants, depth, ctx) {
     if (!e.isDirectory()) continue;
     if (SUBDIR_IGNORE.has(e.name)) continue;
     if (e.name.startsWith(".") && SUBDIR_IGNORE.has(e.name)) continue;
-    await walkForSuffix(path26.join(dir, e.name), needleVariants, depth + 1, ctx);
+    await walkForSuffix(path28.join(dir, e.name), needleVariants, depth + 1, ctx);
     if (ctx.matches.length >= ctx.cap) return;
   }
 }
 async function findFile(rawPath) {
   const cwd = process.cwd();
-  if (path26.isAbsolute(rawPath)) {
-    const abs = path26.normalize(rawPath);
+  if (path28.isAbsolute(rawPath)) {
+    const abs = path28.normalize(rawPath);
     if (isUnder(cwd, abs) && await isExistingFile(abs)) return abs;
   }
-  const direct = path26.resolve(cwd, rawPath);
+  const direct = path28.resolve(cwd, rawPath);
   if (isUnder(cwd, direct) && await isExistingFile(direct)) return direct;
-  const normalized = path26.normalize(rawPath).replace(/^[./\\]+/, "");
+  const normalized = path28.normalize(rawPath).replace(/^[./\\]+/, "");
   const needles = [
-    `${path26.sep}${normalized}`,
+    `${path28.sep}${normalized}`,
     `/${normalized}`
   ].filter((v, i, a) => a.indexOf(v) === i);
   const ctx = { visited: 0, matches: [], cap: 16 };
@@ -13425,7 +13919,7 @@ async function findWriteTarget(rawPath) {
   const found = await findFile(rawPath);
   if (found) return found;
   const cwd = process.cwd();
-  const fallback = path26.isAbsolute(rawPath) ? path26.normalize(rawPath) : path26.resolve(cwd, rawPath);
+  const fallback = path28.isAbsolute(rawPath) ? path28.normalize(rawPath) : path28.resolve(cwd, rawPath);
   if (!isUnder(cwd, fallback)) return null;
   return fallback;
 }
@@ -13442,11 +13936,11 @@ async function readProjectFile(rawPath) {
     if (!abs) {
       return { error: `File not found in the project tree: ${rawPath}` };
     }
-    const stat3 = await fs22.stat(abs);
+    const stat3 = await fs23.stat(abs);
     if (stat3.size > MAX_FILE_BYTES) {
       return { error: `File too large (${(stat3.size / 1024 / 1024).toFixed(1)} MB > ${MAX_FILE_BYTES / 1024 / 1024} MB).` };
     }
-    const buf = await fs22.readFile(abs);
+    const buf = await fs23.readFile(abs);
     if (looksBinary(buf)) {
       return { error: "Binary file \u2014 refusing to open in a code editor." };
     }
@@ -13465,8 +13959,8 @@ async function writeProjectFile(rawPath, content) {
     if (Buffer.byteLength(content, "utf-8") > MAX_FILE_BYTES) {
       return { error: "Content too large." };
     }
-    await fs22.mkdir(path26.dirname(abs), { recursive: true });
-    await fs22.writeFile(abs, content, "utf-8");
+    await fs23.mkdir(path28.dirname(abs), { recursive: true });
+    await fs23.writeFile(abs, content, "utf-8");
     return { ok: true };
   } catch (e) {
     const msg = e instanceof Error ? e.message : "Write failed";
@@ -13475,11 +13969,11 @@ async function writeProjectFile(rawPath, content) {
 }
 
 // src/services/project-ops.service.ts
-var import_child_process9 = require("child_process");
+var import_child_process10 = require("child_process");
 var import_util2 = require("util");
-var fs23 = __toESM(require("fs/promises"));
-var path27 = __toESM(require("path"));
-var execFileP3 = (0, import_util2.promisify)(import_child_process9.execFile);
+var fs24 = __toESM(require("fs/promises"));
+var path29 = __toESM(require("path"));
+var execFileP3 = (0, import_util2.promisify)(import_child_process10.execFile);
 var PROJECT_IGNORE = /* @__PURE__ */ new Set([
   "node_modules",
   ".git",
@@ -13526,7 +14020,7 @@ async function listProjectFiles(opts = {}) {
     }
     let entries = [];
     try {
-      entries = await fs23.readdir(dir, { withFileTypes: true });
+      entries = await fs24.readdir(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -13536,18 +14030,18 @@ async function listProjectFiles(opts = {}) {
         return;
       }
       if (PROJECT_IGNORE.has(e.name)) continue;
-      const full = path27.join(dir, e.name);
+      const full = path29.join(dir, e.name);
       if (e.isDirectory()) {
         if (depth >= 12) continue;
         await walk(full, depth + 1);
       } else if (e.isFile()) {
-        const rel = path27.relative(root, full);
+        const rel = path29.relative(root, full);
         if (q2 && !rel.toLowerCase().includes(q2) && !e.name.toLowerCase().includes(q2)) {
           continue;
         }
         let size = 0;
         try {
-          const st3 = await fs23.stat(full);
+          const st3 = await fs24.stat(full);
           size = st3.size;
         } catch {
         }
@@ -13649,8 +14143,8 @@ async function gitStatus(cwd) {
   let hasMergeInProgress = false;
   try {
     const gitDir = (await git(["rev-parse", "--git-dir"], root)).stdout.trim();
-    const mergeHead = path27.isAbsolute(gitDir) ? path27.join(gitDir, "MERGE_HEAD") : path27.join(root, gitDir, "MERGE_HEAD");
-    await fs23.access(mergeHead);
+    const mergeHead = path29.isAbsolute(gitDir) ? path29.join(gitDir, "MERGE_HEAD") : path29.join(root, gitDir, "MERGE_HEAD");
+    await fs24.access(mergeHead);
     hasMergeInProgress = true;
   } catch {
   }
@@ -13796,7 +14290,7 @@ async function jsSearchFiles(opts, cwd, cap) {
     }
     let content = "";
     try {
-      content = await fs23.readFile(path27.join(cwd, f.path), "utf8");
+      content = await fs24.readFile(path29.join(cwd, f.path), "utf8");
     } catch {
       continue;
     }
@@ -13819,8 +14313,8 @@ async function jsSearchFiles(opts, cwd, cap) {
 }
 
 // src/services/terminal-ops.service.ts
-var import_child_process10 = require("child_process");
-var import_crypto3 = require("crypto");
+var import_child_process11 = require("child_process");
+var import_crypto4 = require("crypto");
 var import_path3 = __toESM(require("path"));
 var MAX_CONCURRENT_SESSIONS = 4;
 var nodePtyModule;
@@ -13941,7 +14435,7 @@ function createPythonSession(id, shell, cwd, env, cols, rows) {
   }
   let child;
   try {
-    child = (0, import_child_process10.spawn)(python, ["-c", PYTHON_TERMINAL_HELPER, shell], {
+    child = (0, import_child_process11.spawn)(python, ["-c", PYTHON_TERMINAL_HELPER, shell], {
       cwd,
       env: { ...env, COLUMNS: String(cols), LINES: String(rows) },
       stdio: ["pipe", "pipe", "pipe"]
@@ -13996,7 +14490,7 @@ function openTerminal(opts) {
   };
   const cols = Math.max(1, Math.min(opts.cols ?? 80, 500));
   const rows = Math.max(1, Math.min(opts.rows ?? 24, 200));
-  const id = (0, import_crypto3.randomUUID)();
+  const id = (0, import_crypto4.randomUUID)();
   const ptyMod = loadNodePty2();
   if (ptyMod) {
     try {
@@ -14075,12 +14569,96 @@ function closeAllTerminals() {
   for (const id of Array.from(sessions.keys())) closeTerminal(id);
 }
 
+// src/services/apply-file-review.service.ts
+var import_child_process12 = require("child_process");
+var fs25 = __toESM(require("fs"));
+var path31 = __toESM(require("path"));
+async function applyFileReview(workingDir, filePath, action) {
+  if (filePath.includes("..") || path31.isAbsolute(filePath)) {
+    return { ok: false, action, filePath, error: "invalid file path" };
+  }
+  const absFile = path31.resolve(workingDir, filePath);
+  const repoRoot = findGitRoot2(path31.dirname(absFile));
+  if (!repoRoot) {
+    return {
+      ok: false,
+      action,
+      filePath,
+      error: `no enclosing git repo for ${filePath}`
+    };
+  }
+  const relInRepo = path31.relative(repoRoot, absFile);
+  if (!relInRepo || relInRepo.startsWith("..")) {
+    return { ok: false, action, filePath, error: "path escapes repo root" };
+  }
+  const args2 = action === "approved" ? ["add", "--", relInRepo] : ["restore", "--", relInRepo];
+  const result = await runGit3(repoRoot, args2);
+  if (!result.ok) {
+    return {
+      ok: false,
+      action,
+      filePath,
+      repoRoot,
+      error: result.stderr.slice(0, 500) || `git ${args2[0]} exited ${result.code}`
+    };
+  }
+  log.info(
+    "reviewApply",
+    `git ${args2[0]} ${relInRepo} in ${repoRoot} \u2014 ok`
+  );
+  return { ok: true, action, filePath, repoRoot };
+}
+function runGit3(cwd, args2) {
+  return new Promise((resolve5) => {
+    let proc;
+    try {
+      proc = (0, import_child_process12.spawn)("git", args2, { cwd, env: process.env });
+    } catch (err) {
+      resolve5({ ok: false, code: -1, stdout: "", stderr: err.message });
+      return;
+    }
+    let stdout = "";
+    let stderr = "";
+    proc.stdout?.on("data", (c2) => {
+      stdout += c2.toString();
+    });
+    proc.stderr?.on("data", (c2) => {
+      stderr += c2.toString();
+    });
+    proc.on(
+      "error",
+      (err) => resolve5({ ok: false, code: -1, stdout, stderr: stderr + err.message })
+    );
+    proc.on(
+      "close",
+      (code) => resolve5({ ok: code === 0, code: code ?? -1, stdout, stderr })
+    );
+  });
+}
+function findGitRoot2(startDir) {
+  let dir = path31.resolve(startDir);
+  const seen = /* @__PURE__ */ new Set();
+  for (let i = 0; i < 256; i++) {
+    if (seen.has(dir)) return null;
+    seen.add(dir);
+    try {
+      const stat3 = fs25.statSync(path31.join(dir, ".git"), { throwIfNoEntry: false });
+      if (stat3 && (stat3.isDirectory() || stat3.isFile())) return dir;
+    } catch {
+    }
+    const parent = path31.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+  return null;
+}
+
 // src/commands/start/handlers.ts
 var pendingAttachmentFiles = /* @__PURE__ */ new Set();
 function cleanupAttachmentTempFiles() {
   for (const p2 of pendingAttachmentFiles) {
     try {
-      fs24.unlinkSync(p2);
+      fs26.unlinkSync(p2);
     } catch {
     }
   }
@@ -14089,8 +14667,8 @@ function cleanupAttachmentTempFiles() {
 function saveFilesTemp(files) {
   return files.filter(({ base64 }) => base64 && base64.length > 0).map(({ filename, base64 }) => {
     const safeName = filename.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 80);
-    const tmpPath = path29.join(os23.tmpdir(), `codeam-${(0, import_crypto4.randomUUID)()}-${safeName}`);
-    fs24.writeFileSync(tmpPath, Buffer.from(base64, "base64"));
+    const tmpPath = path32.join(os23.tmpdir(), `codeam-${(0, import_crypto5.randomUUID)()}-${safeName}`);
+    fs26.writeFileSync(tmpPath, Buffer.from(base64, "base64"));
     pendingAttachmentFiles.add(tmpPath);
     return tmpPath;
   });
@@ -14110,7 +14688,7 @@ var startTask = (ctx, _cmd, parsed) => {
     setTimeout(() => {
       for (const p2 of paths) {
         try {
-          fs24.unlinkSync(p2);
+          fs26.unlinkSync(p2);
         } catch {
         }
         pendingAttachmentFiles.delete(p2);
@@ -14223,7 +14801,7 @@ var sessionTerminated = (ctx) => {
   } catch {
   }
   try {
-    const proc = (0, import_child_process11.spawn)("bash", ["-lc", "pm2 delete codeam-pair >/dev/null 2>&1 || true"], {
+    const proc = (0, import_child_process13.spawn)("bash", ["-lc", "pm2 delete codeam-pair >/dev/null 2>&1 || true"], {
       detached: true,
       stdio: "ignore"
     });
@@ -14245,7 +14823,7 @@ var shutdownSession = async (ctx, cmd) => {
   }
   if (ctx.keepAliveCtx.inCodespace && ctx.keepAliveCtx.codespaceName) {
     try {
-      const stopProc = (0, import_child_process11.spawn)(
+      const stopProc = (0, import_child_process13.spawn)(
         "bash",
         ["-lc", `sleep 1; gh codespace stop -c ${JSON.stringify(ctx.keepAliveCtx.codespaceName)} >/dev/null 2>&1 || true`],
         { detached: true, stdio: "ignore" }
@@ -14255,7 +14833,7 @@ var shutdownSession = async (ctx, cmd) => {
     }
   }
   try {
-    const proc = (0, import_child_process11.spawn)("bash", ["-lc", "pm2 delete codeam-pair >/dev/null 2>&1 || true"], {
+    const proc = (0, import_child_process13.spawn)("bash", ["-lc", "pm2 delete codeam-pair >/dev/null 2>&1 || true"], {
       detached: true,
       stdio: "ignore"
     });
@@ -14266,7 +14844,7 @@ var shutdownSession = async (ctx, cmd) => {
   ctx.relay.stop();
   process.exit(0);
 };
-var readFile3 = async (ctx, cmd, parsed) => {
+var readFile4 = async (ctx, cmd, parsed) => {
   if (!parsed.path) {
     await ctx.relay.sendResult(cmd.id, "failed", { error: "Missing path" });
     return;
@@ -14274,7 +14852,7 @@ var readFile3 = async (ctx, cmd, parsed) => {
   const result = await readProjectFile(parsed.path);
   await ctx.relay.sendResult(cmd.id, "completed", result);
 };
-var writeFile2 = async (ctx, cmd, parsed) => {
+var writeFile3 = async (ctx, cmd, parsed) => {
   if (!parsed.path || typeof parsed.content !== "string") {
     await ctx.relay.sendResult(cmd.id, "failed", { error: "Missing path or content" });
     return;
@@ -14378,6 +14956,24 @@ var gitResolveH = async (ctx, cmd, parsed) => {
   const result = await gitResolve(parsed.path, parsed.side);
   await ctx.relay.sendResult(cmd.id, "completed", result);
 };
+var applyFileReviewH = async (ctx, cmd, parsed) => {
+  if (!parsed.filePath || !parsed.action) {
+    await ctx.relay.sendResult(cmd.id, "failed", {
+      error: "Missing filePath or action"
+    });
+    return;
+  }
+  const result = await applyFileReview(
+    process.cwd(),
+    parsed.filePath,
+    parsed.action
+  );
+  await ctx.relay.sendResult(
+    cmd.id,
+    result.ok ? "completed" : "failed",
+    result
+  );
+};
 var handlers = {
   start_task: startTask,
   provide_input: provideInput,
@@ -14393,8 +14989,8 @@ var handlers = {
   set_keep_alive: setKeepAlive,
   session_terminated: sessionTerminated,
   shutdown_session: shutdownSession,
-  read_file: readFile3,
-  write_file: writeFile2,
+  read_file: readFile4,
+  write_file: writeFile3,
   list_files: listFiles,
   search_files: searchFilesH,
   terminal_open: terminalOpenH,
@@ -14408,7 +15004,8 @@ var handlers = {
   git_commit: gitCommitH,
   git_push: gitPushH,
   git_pull: gitPullH,
-  git_resolve: gitResolveH
+  git_resolve: gitResolveH,
+  apply_file_review: applyFileReviewH
 };
 async function dispatchCommand(ctx, cmd) {
   const parsed = parsePayload2(startCommandSchema, cmd.payload);
@@ -14480,6 +15077,8 @@ async function start(requestedAgent) {
         historySvc.uploadDelta().catch(() => {
         });
       }, 400);
+      turnFiles?.flushTurn().catch(() => {
+      });
     },
     () => {
       const prevCount = historySvc.getCurrentMessageCount();
@@ -14488,11 +15087,20 @@ async function start(requestedAgent) {
     session.pluginAuthToken,
     runtime
   );
+  const dirtyTracker = session.pluginAuthToken ? new RepoDirtyTracker() : null;
   const fileWatcher = session.pluginAuthToken ? new FileWatcherService({
     workingDir: cwd,
     sessionId: session.id,
     pluginId,
-    pluginAuthToken: session.pluginAuthToken
+    pluginAuthToken: session.pluginAuthToken,
+    onRepoDirty: dirtyTracker ? (repoRoot) => dirtyTracker.markDirty(repoRoot) : void 0
+  }) : null;
+  const turnFiles = session.pluginAuthToken ? new TurnFileAggregator({
+    workingDir: cwd,
+    sessionId: session.id,
+    pluginId,
+    pluginAuthToken: session.pluginAuthToken,
+    dirtyTracker: dirtyTracker ?? void 0
   }) : null;
   let streamingEmitter = null;
   const agent = new AgentService(
@@ -14510,6 +15118,7 @@ async function start(requestedAgent) {
         outputSvc.dispose();
         relay.stop();
         void fileWatcher?.stop();
+        turnFiles?.stop();
         void streamingEmitter?.stop();
         closeAllTerminals();
         cleanupAttachmentTempFiles();
@@ -14577,7 +15186,7 @@ async function start(requestedAgent) {
 }
 
 // src/commands/pair.ts
-var import_crypto5 = require("crypto");
+var import_crypto6 = require("crypto");
 var import_picocolors3 = __toESM(require("picocolors"));
 
 // src/ui/prompts.ts
@@ -14641,7 +15250,7 @@ async function pair(args2 = []) {
   const flagAgent = parseAgentFlag(args2);
   const agentId = dryRun ? flagAgent ?? config.preferredAgent ?? "claude" : flagAgent ?? await promptForAgent(config.preferredAgent ?? "claude");
   showIntro();
-  const pluginId = (0, import_crypto5.randomUUID)();
+  const pluginId = (0, import_crypto6.randomUUID)();
   capture("pair_started", { agentId, pluginId, dryRun });
   const spin = dist_exports.spinner();
   spin.start("Requesting pairing code...");
@@ -14676,7 +15285,7 @@ async function pair(args2 = []) {
     waitSpin.message(waitMessage());
   }, 1e3);
   countdownInterval.unref?.();
-  await new Promise((resolve4) => {
+  await new Promise((resolve5) => {
     let stopPolling = null;
     function sigintHandler() {
       clearInterval(countdownInterval);
@@ -14716,7 +15325,7 @@ async function pair(args2 = []) {
         });
         showSuccess(`Paired with ${info.userName} (${info.plan})`);
         console.log("");
-        resolve4();
+        resolve5();
       },
       () => {
         clearInterval(countdownInterval);
@@ -14732,10 +15341,10 @@ async function pair(args2 = []) {
 }
 
 // src/commands/pair-auto.ts
-var fs25 = __toESM(require("fs"));
+var fs27 = __toESM(require("fs"));
 var os24 = __toESM(require("os"));
-var import_crypto6 = require("crypto");
-var API_BASE7 = resolveApiBaseUrl();
+var import_crypto7 = require("crypto");
+var API_BASE8 = resolveApiBaseUrl();
 function fail(msg) {
   console.error(`
   ${msg}
@@ -14750,12 +15359,12 @@ function readTokenFromArgs(args2) {
   }
   const fileFlag = args2.find((a) => a.startsWith("--token-file="));
   if (fileFlag) {
-    const path37 = fileFlag.slice("--token-file=".length);
+    const path40 = fileFlag.slice("--token-file=".length);
     try {
-      const content = fs25.readFileSync(path37, "utf8").trim();
-      if (content.length === 0) fail(`--token-file ${path37} is empty`);
+      const content = fs27.readFileSync(path40, "utf8").trim();
+      if (content.length === 0) fail(`--token-file ${path40} is empty`);
       try {
-        fs25.unlinkSync(path37);
+        fs27.unlinkSync(path40);
       } catch {
       }
       return content;
@@ -14775,7 +15384,7 @@ function networkError(msg, cause) {
   return err;
 }
 async function claimOnce(token, pluginId) {
-  const url = `${API_BASE7}/api/pairing/claim-auto-token`;
+  const url = `${API_BASE8}/api/pairing/claim-auto-token`;
   const body = {
     token,
     pluginId,
@@ -14839,7 +15448,7 @@ async function claim(token, pluginId) {
 }
 async function pairAuto(args2) {
   const token = readTokenFromArgs(args2);
-  const pluginId = (0, import_crypto6.randomUUID)();
+  const pluginId = (0, import_crypto7.randomUUID)();
   capture("pair_auto_started", { pluginId });
   console.log("  Claiming pairing token\u2026");
   const claimed = await claim(token, pluginId);
@@ -14965,7 +15574,7 @@ function status() {
 
 // src/commands/logout.ts
 var import_picocolors6 = __toESM(require("picocolors"));
-var API_BASE8 = resolveApiBaseUrl();
+var API_BASE9 = resolveApiBaseUrl();
 async function notifyBackendOffline() {
   const cfg = loadCliConfig();
   const pluginIds = /* @__PURE__ */ new Set([
@@ -14977,7 +15586,7 @@ async function notifyBackendOffline() {
   try {
     await Promise.all(
       Array.from(pluginIds).map(
-        (pluginId) => _postJson(`${API_BASE8}/api/plugin/heartbeat`, {
+        (pluginId) => _postJson(`${API_BASE9}/api/plugin/heartbeat`, {
           pluginId,
           online: false
         }).catch((err) => {
@@ -15005,11 +15614,11 @@ async function logout() {
 var import_picocolors9 = __toESM(require("picocolors"));
 
 // src/services/providers/github-codespaces.ts
-var import_child_process12 = require("child_process");
+var import_child_process14 = require("child_process");
 var import_util3 = require("util");
 var import_picocolors7 = __toESM(require("picocolors"));
-var path30 = __toESM(require("path"));
-var execFileP4 = (0, import_util3.promisify)(import_child_process12.execFile);
+var path33 = __toESM(require("path"));
+var execFileP4 = (0, import_util3.promisify)(import_child_process14.execFile);
 var MAX_BUFFER = 8 * 1024 * 1024;
 function resetStdinForChild() {
   if (process.stdin.isTTY) {
@@ -15052,12 +15661,12 @@ var GitHubCodespacesProvider = class {
     }
     if (!isAuthed) {
       resetStdinForChild();
-      await new Promise((resolve4, reject) => {
-        const proc = (0, import_child_process12.spawn)("gh", ["auth", "login", "-s", "codespace,repo,read:user"], {
+      await new Promise((resolve5, reject) => {
+        const proc = (0, import_child_process14.spawn)("gh", ["auth", "login", "-s", "codespace,repo,read:user"], {
           stdio: "inherit"
         });
         proc.on("exit", (code) => {
-          if (code === 0) resolve4();
+          if (code === 0) resolve5();
           else reject(new Error("gh auth login failed."));
         });
         proc.on("error", reject);
@@ -15086,13 +15695,13 @@ var GitHubCodespacesProvider = class {
       }
       wt(noteLines.join("\n"), "One more permission needed");
       resetStdinForChild();
-      const refreshCode = await new Promise((resolve4, reject) => {
-        const proc = (0, import_child_process12.spawn)(
+      const refreshCode = await new Promise((resolve5, reject) => {
+        const proc = (0, import_child_process14.spawn)(
           "gh",
           ["auth", "refresh", "-h", "github.com", "-s", "codespace"],
           { stdio: "inherit" }
         );
-        proc.on("exit", (code) => resolve4(code ?? 1));
+        proc.on("exit", (code) => resolve5(code ?? 1));
         proc.on("error", reject);
       });
       if (refreshCode !== 0) {
@@ -15236,10 +15845,10 @@ var GitHubCodespacesProvider = class {
     if (q(proceed) || !proceed) return;
     O2.step(`Installing gh via ${installCmd.describe}\u2026`);
     resetStdinForChild();
-    const ok = await new Promise((resolve4) => {
-      const proc = (0, import_child_process12.spawn)(installCmd.exe, installCmd.args, { stdio: "inherit" });
-      proc.on("exit", (code) => resolve4(code === 0));
-      proc.on("error", () => resolve4(false));
+    const ok = await new Promise((resolve5) => {
+      const proc = (0, import_child_process14.spawn)(installCmd.exe, installCmd.args, { stdio: "inherit" });
+      proc.on("exit", (code) => resolve5(code === 0));
+      proc.on("error", () => resolve5(false));
     });
     if (ok) O2.success("gh installed");
     else O2.error("gh install failed");
@@ -15263,14 +15872,14 @@ var GitHubCodespacesProvider = class {
       "Expanding GitHub scopes"
     );
     resetStdinForChild();
-    await new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process12.spawn)(
+    await new Promise((resolve5, reject) => {
+      const proc = (0, import_child_process14.spawn)(
         "gh",
         ["auth", "refresh", "-h", "github.com", "-s", "repo,read:org"],
         { stdio: "inherit" }
       );
       proc.on("exit", (code) => {
-        if (code === 0) resolve4();
+        if (code === 0) resolve5();
         else reject(new Error(
           "gh auth refresh failed. Re-run `gh auth refresh -h github.com -s repo,read:org` manually."
         ));
@@ -15441,13 +16050,13 @@ var GitHubCodespacesProvider = class {
   }
   async streamCommand(workspaceId, command2) {
     resetStdinForChild();
-    return new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process12.spawn)(
+    return new Promise((resolve5, reject) => {
+      const proc = (0, import_child_process14.spawn)(
         "gh",
         ["codespace", "ssh", "-c", workspaceId, "--", "-tt", command2],
         { stdio: "inherit" }
       );
-      proc.on("exit", (code) => resolve4({ code: code ?? 0 }));
+      proc.on("exit", (code) => resolve5({ code: code ?? 0 }));
       proc.on("error", reject);
     });
   }
@@ -15468,12 +16077,12 @@ var GitHubCodespacesProvider = class {
       "--",
       `mkdir -p ${shellQuote(remoteDir)} && tar -xzf - -C ${shellQuote(remoteDir)}`
     ];
-    await new Promise((resolve4, reject) => {
-      const tar = (0, import_child_process12.spawn)("tar", tarArgs, {
+    await new Promise((resolve5, reject) => {
+      const tar = (0, import_child_process14.spawn)("tar", tarArgs, {
         stdio: ["ignore", "pipe", "pipe"],
         env: tarEnv
       });
-      const ssh = (0, import_child_process12.spawn)("gh", sshArgs, {
+      const ssh = (0, import_child_process14.spawn)("gh", sshArgs, {
         stdio: [tar.stdout, "pipe", "pipe"]
       });
       let tarErr = "";
@@ -15488,7 +16097,7 @@ var GitHubCodespacesProvider = class {
       ssh.on("error", reject);
       ssh.on("exit", (code) => {
         if (code === 0) {
-          resolve4();
+          resolve5();
         } else {
           const reason = (sshErr || tarErr || `exit ${code}`).trim().slice(0, 500);
           reject(new Error(`Remote tar failed: ${reason}`));
@@ -15497,7 +16106,7 @@ var GitHubCodespacesProvider = class {
     });
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
-    const remoteDir = path30.posix.dirname(remotePath);
+    const remoteDir = path33.posix.dirname(remotePath);
     const parts = [
       `mkdir -p ${shellQuote(remoteDir)}`,
       `cat > ${shellQuote(remotePath)}`
@@ -15506,8 +16115,8 @@ var GitHubCodespacesProvider = class {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote(remotePath)}`);
     }
     const cmd = parts.join(" && ");
-    await new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process12.spawn)(
+    await new Promise((resolve5, reject) => {
+      const proc = (0, import_child_process14.spawn)(
         "gh",
         ["codespace", "ssh", "-c", workspaceId, "--", cmd],
         { stdio: ["pipe", "pipe", "pipe"] }
@@ -15518,7 +16127,7 @@ var GitHubCodespacesProvider = class {
       });
       proc.on("error", reject);
       proc.on("exit", (code) => {
-        if (code === 0) resolve4();
+        if (code === 0) resolve5();
         else reject(new Error(`Remote write failed: ${(stderr || `exit ${code}`).trim().slice(0, 500)}`));
       });
       proc.stdin?.write(contents);
@@ -15565,11 +16174,11 @@ function shellQuote(s) {
 }
 
 // src/services/providers/gitpod.ts
-var import_child_process13 = require("child_process");
+var import_child_process15 = require("child_process");
 var import_util4 = require("util");
-var path31 = __toESM(require("path"));
+var path34 = __toESM(require("path"));
 var import_picocolors8 = __toESM(require("picocolors"));
-var execFileP5 = (0, import_util4.promisify)(import_child_process13.execFile);
+var execFileP5 = (0, import_util4.promisify)(import_child_process15.execFile);
 var MAX_BUFFER2 = 8 * 1024 * 1024;
 function resetStdinForChild2() {
   if (process.stdin.isTTY) {
@@ -15608,10 +16217,10 @@ var GitpodProvider = class {
       "Authenticating Gitpod"
     );
     resetStdinForChild2();
-    await new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process13.spawn)("gitpod", ["login"], { stdio: "inherit" });
+    await new Promise((resolve5, reject) => {
+      const proc = (0, import_child_process15.spawn)("gitpod", ["login"], { stdio: "inherit" });
       proc.on("exit", (code) => {
-        if (code === 0) resolve4();
+        if (code === 0) resolve5();
         else reject(new Error("gitpod login failed."));
       });
       proc.on("error", reject);
@@ -15760,13 +16369,13 @@ var GitpodProvider = class {
   }
   async streamCommand(workspaceId, command2) {
     resetStdinForChild2();
-    return new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process13.spawn)(
+    return new Promise((resolve5, reject) => {
+      const proc = (0, import_child_process15.spawn)(
         "gitpod",
         ["workspace", "ssh", workspaceId, "--", "-tt", command2],
         { stdio: "inherit" }
       );
-      proc.on("exit", (code) => resolve4({ code: code ?? 0 }));
+      proc.on("exit", (code) => resolve5({ code: code ?? 0 }));
       proc.on("error", reject);
     });
   }
@@ -15780,12 +16389,12 @@ var GitpodProvider = class {
     tarArgs.push(".");
     const tarEnv = { ...process.env, COPYFILE_DISABLE: "1" };
     const remoteCmd = `mkdir -p ${shellQuote2(remoteDir)} && tar -xzf - -C ${shellQuote2(remoteDir)}`;
-    await new Promise((resolve4, reject) => {
-      const tar = (0, import_child_process13.spawn)("tar", tarArgs, {
+    await new Promise((resolve5, reject) => {
+      const tar = (0, import_child_process15.spawn)("tar", tarArgs, {
         stdio: ["ignore", "pipe", "pipe"],
         env: tarEnv
       });
-      const ssh = (0, import_child_process13.spawn)(
+      const ssh = (0, import_child_process15.spawn)(
         "gitpod",
         ["workspace", "ssh", workspaceId, "--", remoteCmd],
         { stdio: [tar.stdout, "pipe", "pipe"] }
@@ -15801,13 +16410,13 @@ var GitpodProvider = class {
       tar.on("error", reject);
       ssh.on("error", reject);
       ssh.on("exit", (code) => {
-        if (code === 0) resolve4();
+        if (code === 0) resolve5();
         else reject(new Error(`Remote tar failed: ${(sshErr || tarErr || `exit ${code}`).trim().slice(0, 500)}`));
       });
     });
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
-    const remoteDir = path31.posix.dirname(remotePath);
+    const remoteDir = path34.posix.dirname(remotePath);
     const parts = [
       `mkdir -p ${shellQuote2(remoteDir)}`,
       `cat > ${shellQuote2(remotePath)}`
@@ -15816,8 +16425,8 @@ var GitpodProvider = class {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote2(remotePath)}`);
     }
     const cmd = parts.join(" && ");
-    await new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process13.spawn)(
+    await new Promise((resolve5, reject) => {
+      const proc = (0, import_child_process15.spawn)(
         "gitpod",
         ["workspace", "ssh", workspaceId, "--", cmd],
         { stdio: ["pipe", "pipe", "pipe"] }
@@ -15828,7 +16437,7 @@ var GitpodProvider = class {
       });
       proc.on("error", reject);
       proc.on("exit", (code) => {
-        if (code === 0) resolve4();
+        if (code === 0) resolve5();
         else reject(new Error(`Remote write failed: ${(stderr || `exit ${code}`).trim().slice(0, 500)}`));
       });
       proc.stdin?.write(contents);
@@ -15841,10 +16450,10 @@ function shellQuote2(s) {
 }
 
 // src/services/providers/gitlab-workspaces.ts
-var import_child_process14 = require("child_process");
+var import_child_process16 = require("child_process");
 var import_util5 = require("util");
-var path32 = __toESM(require("path"));
-var execFileP6 = (0, import_util5.promisify)(import_child_process14.execFile);
+var path35 = __toESM(require("path"));
+var execFileP6 = (0, import_util5.promisify)(import_child_process16.execFile);
 var MAX_BUFFER3 = 8 * 1024 * 1024;
 var GITLAB_API_BASE = process.env.CODEAM_GITLAB_API_URL ?? "https://gitlab.com/api/v4";
 function resetStdinForChild3() {
@@ -15885,14 +16494,14 @@ var GitLabWorkspacesProvider = class {
       "Authenticating GitLab"
     );
     resetStdinForChild3();
-    await new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process14.spawn)(
+    await new Promise((resolve5, reject) => {
+      const proc = (0, import_child_process16.spawn)(
         "glab",
         ["auth", "login", "--scopes", "api,read_user,read_repository"],
         { stdio: "inherit" }
       );
       proc.on("exit", (code) => {
-        if (code === 0) resolve4();
+        if (code === 0) resolve5();
         else reject(new Error("glab auth login failed."));
       });
       proc.on("error", reject);
@@ -16057,13 +16666,13 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
   async streamCommand(workspaceId, command2) {
     const sshHost = process.env.CODEAM_GITLAB_SSH_HOST ?? "workspaces.gitlab.com";
     resetStdinForChild3();
-    return new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process14.spawn)(
+    return new Promise((resolve5, reject) => {
+      const proc = (0, import_child_process16.spawn)(
         "ssh",
         ["-tt", "-o", "StrictHostKeyChecking=accept-new", `${workspaceId}@${sshHost}`, command2],
         { stdio: "inherit" }
       );
-      proc.on("exit", (code) => resolve4({ code: code ?? 0 }));
+      proc.on("exit", (code) => resolve5({ code: code ?? 0 }));
       proc.on("error", reject);
     });
   }
@@ -16078,9 +16687,9 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
     tarArgs.push(".");
     const tarEnv = { ...process.env, COPYFILE_DISABLE: "1" };
     const remoteCmd = `mkdir -p ${shellQuote3(remoteDir)} && tar -xzf - -C ${shellQuote3(remoteDir)}`;
-    await new Promise((resolve4, reject) => {
-      const tar = (0, import_child_process14.spawn)("tar", tarArgs, { stdio: ["ignore", "pipe", "pipe"], env: tarEnv });
-      const ssh = (0, import_child_process14.spawn)(
+    await new Promise((resolve5, reject) => {
+      const tar = (0, import_child_process16.spawn)("tar", tarArgs, { stdio: ["ignore", "pipe", "pipe"], env: tarEnv });
+      const ssh = (0, import_child_process16.spawn)(
         "ssh",
         ["-o", "StrictHostKeyChecking=accept-new", `${workspaceId}@${sshHost}`, remoteCmd],
         { stdio: [tar.stdout, "pipe", "pipe"] }
@@ -16096,21 +16705,21 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
       tar.on("error", reject);
       ssh.on("error", reject);
       ssh.on("exit", (code) => {
-        if (code === 0) resolve4();
+        if (code === 0) resolve5();
         else reject(new Error(`Remote tar failed: ${(sshErr || tarErr || `exit ${code}`).trim().slice(0, 500)}`));
       });
     });
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
     const sshHost = process.env.CODEAM_GITLAB_SSH_HOST ?? "workspaces.gitlab.com";
-    const remoteDir = path32.posix.dirname(remotePath);
+    const remoteDir = path35.posix.dirname(remotePath);
     const parts = [`mkdir -p ${shellQuote3(remoteDir)}`, `cat > ${shellQuote3(remotePath)}`];
     if (options.mode != null) {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote3(remotePath)}`);
     }
     const cmd = parts.join(" && ");
-    await new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process14.spawn)(
+    await new Promise((resolve5, reject) => {
+      const proc = (0, import_child_process16.spawn)(
         "ssh",
         ["-o", "StrictHostKeyChecking=accept-new", `${workspaceId}@${sshHost}`, cmd],
         { stdio: ["pipe", "pipe", "pipe"] }
@@ -16121,7 +16730,7 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
       });
       proc.on("error", reject);
       proc.on("exit", (code) => {
-        if (code === 0) resolve4();
+        if (code === 0) resolve5();
         else reject(new Error(`Remote write failed: ${(stderr || `exit ${code}`).trim().slice(0, 500)}`));
       });
       proc.stdin?.write(contents);
@@ -16169,10 +16778,10 @@ function shellQuote3(s) {
 }
 
 // src/services/providers/railway.ts
-var import_child_process15 = require("child_process");
+var import_child_process17 = require("child_process");
 var import_util6 = require("util");
-var path33 = __toESM(require("path"));
-var execFileP7 = (0, import_util6.promisify)(import_child_process15.execFile);
+var path36 = __toESM(require("path"));
+var execFileP7 = (0, import_util6.promisify)(import_child_process17.execFile);
 var MAX_BUFFER4 = 8 * 1024 * 1024;
 function resetStdinForChild4() {
   if (process.stdin.isTTY) {
@@ -16212,10 +16821,10 @@ var RailwayProvider = class {
       "Authenticating Railway"
     );
     resetStdinForChild4();
-    await new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process15.spawn)("railway", ["login"], { stdio: "inherit" });
+    await new Promise((resolve5, reject) => {
+      const proc = (0, import_child_process17.spawn)("railway", ["login"], { stdio: "inherit" });
       proc.on("exit", (code) => {
-        if (code === 0) resolve4();
+        if (code === 0) resolve5();
         else reject(new Error("railway login failed."));
       });
       proc.on("error", reject);
@@ -16355,13 +16964,13 @@ var RailwayProvider = class {
       throw new Error("Invalid Railway workspace id (expected projectId/serviceId).");
     }
     resetStdinForChild4();
-    return new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process15.spawn)(
+    return new Promise((resolve5, reject) => {
+      const proc = (0, import_child_process17.spawn)(
         "railway",
         ["shell", "--project", projectId, "--service", serviceId, "--command", command2],
         { stdio: "inherit" }
       );
-      proc.on("exit", (code) => resolve4({ code: code ?? 0 }));
+      proc.on("exit", (code) => resolve5({ code: code ?? 0 }));
       proc.on("error", reject);
     });
   }
@@ -16379,9 +16988,9 @@ var RailwayProvider = class {
     tarArgs.push(".");
     const tarEnv = { ...process.env, COPYFILE_DISABLE: "1" };
     const remoteCmd = `mkdir -p ${shellQuote4(remoteDir)} && tar -xzf - -C ${shellQuote4(remoteDir)}`;
-    await new Promise((resolve4, reject) => {
-      const tar = (0, import_child_process15.spawn)("tar", tarArgs, { stdio: ["ignore", "pipe", "pipe"], env: tarEnv });
-      const sh = (0, import_child_process15.spawn)(
+    await new Promise((resolve5, reject) => {
+      const tar = (0, import_child_process17.spawn)("tar", tarArgs, { stdio: ["ignore", "pipe", "pipe"], env: tarEnv });
+      const sh = (0, import_child_process17.spawn)(
         "railway",
         ["shell", "--project", projectId, "--service", serviceId, "--command", remoteCmd],
         { stdio: [tar.stdout, "pipe", "pipe"] }
@@ -16397,7 +17006,7 @@ var RailwayProvider = class {
       tar.on("error", reject);
       sh.on("error", reject);
       sh.on("exit", (code) => {
-        if (code === 0) resolve4();
+        if (code === 0) resolve5();
         else reject(new Error(`Remote tar failed: ${(shErr || tarErr || `exit ${code}`).trim().slice(0, 500)}`));
       });
     });
@@ -16407,14 +17016,14 @@ var RailwayProvider = class {
     if (!projectId || !serviceId) {
       throw new Error("Invalid Railway workspace id (expected projectId/serviceId).");
     }
-    const remoteDir = path33.posix.dirname(remotePath);
+    const remoteDir = path36.posix.dirname(remotePath);
     const parts = [`mkdir -p ${shellQuote4(remoteDir)}`, `cat > ${shellQuote4(remotePath)}`];
     if (options.mode != null) {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote4(remotePath)}`);
     }
     const cmd = parts.join(" && ");
-    await new Promise((resolve4, reject) => {
-      const proc = (0, import_child_process15.spawn)(
+    await new Promise((resolve5, reject) => {
+      const proc = (0, import_child_process17.spawn)(
         "railway",
         ["shell", "--project", projectId, "--service", serviceId, "--command", cmd],
         { stdio: ["pipe", "pipe", "pipe"] }
@@ -16425,7 +17034,7 @@ var RailwayProvider = class {
       });
       proc.on("error", reject);
       proc.on("exit", (code) => {
-        if (code === 0) resolve4();
+        if (code === 0) resolve5();
         else reject(new Error(`Remote write failed: ${(stderr || `exit ${code}`).trim().slice(0, 500)}`));
       });
       proc.stdin?.write(contents);
@@ -16948,8 +17557,8 @@ async function stopWorkspaceFromLocal(target) {
 
 // src/commands/link.ts
 var import_node_crypto4 = require("crypto");
-var fs26 = __toESM(require("fs"));
-var path34 = __toESM(require("path"));
+var fs28 = __toESM(require("fs"));
+var path37 = __toESM(require("path"));
 var import_chokidar = __toESM(require("chokidar"));
 var import_picocolors11 = __toESM(require("picocolors"));
 function buildLinkContext(agentId) {
@@ -16987,7 +17596,7 @@ function parseLinkArgs(args2) {
   if (apiKeyFileArg) {
     const filePath = apiKeyFileArg.slice("--api-key-file=".length);
     try {
-      apiKey = fs26.readFileSync(path34.resolve(filePath), "utf8").trim();
+      apiKey = fs28.readFileSync(path37.resolve(filePath), "utf8").trim();
     } catch (err) {
       throw new Error(`Could not read --api-key-file ${filePath}: ${err.message}`);
     }
@@ -17032,7 +17641,7 @@ async function link(args2 = []) {
   waitSpin.start(waitMsg());
   const countdown = setInterval(() => waitSpin.message(waitMsg()), 1e3);
   countdown.unref?.();
-  const paired = await new Promise((resolve4, reject) => {
+  const paired = await new Promise((resolve5, reject) => {
     let stopPoll = null;
     const sigint = () => {
       clearInterval(countdown);
@@ -17045,7 +17654,7 @@ async function link(args2 = []) {
         process.removeListener("SIGINT", sigint);
         clearInterval(countdown);
         waitSpin.stop("Paired");
-        resolve4(info);
+        resolve5(info);
       },
       () => {
         clearInterval(countdown);
@@ -17081,7 +17690,7 @@ async function link(args2 = []) {
     return;
   }
   if (parsed.tokenFile) {
-    const credential = fs26.readFileSync(path34.resolve(parsed.tokenFile), "utf8").trim();
+    const credential = fs28.readFileSync(path37.resolve(parsed.tokenFile), "utf8").trim();
     if (!credential) {
       showError(`--token-file ${parsed.tokenFile} is empty.`);
       process.exit(1);
@@ -17151,14 +17760,14 @@ async function captureFreshCredentials(ctx) {
     }
   };
   try {
-    const token = await new Promise((resolve4, reject) => {
+    const token = await new Promise((resolve5, reject) => {
       let settled = false;
       const tryExtract = async () => {
         if (settled) return;
         const t2 = await ctx.locator.extract();
         if (t2 && !settled) {
           settled = true;
-          resolve4(t2);
+          resolve5(t2);
         }
       };
       watcher.on("add", () => void tryExtract());
@@ -17270,8 +17879,8 @@ async function linkDryRunPreflight(ctx) {
 var import_node_dns = require("dns");
 var import_node_util4 = require("util");
 var import_node_crypto5 = require("crypto");
-var fs27 = __toESM(require("fs"));
-var path35 = __toESM(require("path"));
+var fs29 = __toESM(require("fs"));
+var path38 = __toESM(require("path"));
 var import_picocolors12 = __toESM(require("picocolors"));
 var dnsResolveP = (0, import_node_util4.promisify)(import_node_dns.resolve);
 async function checkDns(apiBase) {
@@ -17327,13 +17936,13 @@ async function checkHealth(apiBase) {
   }
 }
 function checkConfigDir() {
-  const dir = path35.join(require("os").homedir(), ".codeam");
+  const dir = path38.join(require("os").homedir(), ".codeam");
   try {
-    fs27.mkdirSync(dir, { recursive: true, mode: 448 });
-    const probe = path35.join(dir, ".doctor-probe");
-    fs27.writeFileSync(probe, "ok", { mode: 384 });
-    const read = fs27.readFileSync(probe, "utf8");
-    fs27.unlinkSync(probe);
+    fs29.mkdirSync(dir, { recursive: true, mode: 448 });
+    const probe = path38.join(dir, ".doctor-probe");
+    fs29.writeFileSync(probe, "ok", { mode: 384 });
+    const read = fs29.readFileSync(probe, "utf8");
+    fs29.unlinkSync(probe);
     if (read !== "ok") throw new Error("write/read round-trip mismatch");
     return {
       id: "config-dir",
@@ -17397,7 +18006,7 @@ function checkNodePty() {
       detail: "not required on this platform"
     };
   }
-  const vendoredPath = path35.join(__dirname, "vendor", "node-pty");
+  const vendoredPath = path38.join(__dirname, "vendor", "node-pty");
   for (const target of [vendoredPath, "node-pty"]) {
     try {
       require(target);
@@ -17439,7 +18048,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.20.3" : "0.0.0-dev";
+  const cliVersion = true ? "2.21.1" : "0.0.0-dev";
   const apiBase = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto5.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -17638,7 +18247,7 @@ async function completion(args2) {
 // src/commands/version.ts
 var import_picocolors13 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.20.3" : "unknown";
+  const v = true ? "2.21.1" : "unknown";
   console.log(`${import_picocolors13.default.bold("codeam-cli")} ${import_picocolors13.default.cyan(v)}`);
 }
 
@@ -17766,9 +18375,9 @@ function tryShowSubcommandHelp(cmd, args2) {
 var _subcommandHelpKeys = Object.keys(HELPS);
 
 // src/lib/updateNotifier.ts
-var fs28 = __toESM(require("fs"));
+var fs30 = __toESM(require("fs"));
 var os25 = __toESM(require("os"));
-var path36 = __toESM(require("path"));
+var path39 = __toESM(require("path"));
 var https7 = __toESM(require("https"));
 var import_picocolors16 = __toESM(require("picocolors"));
 var PKG_NAME = "codeam-cli";
@@ -17776,12 +18385,12 @@ var REGISTRY_URL = `https://registry.npmjs.org/${PKG_NAME}/latest`;
 var TTL_MS = 24 * 60 * 60 * 1e3;
 var REQUEST_TIMEOUT_MS = 1500;
 function cachePath() {
-  const dir = path36.join(os25.homedir(), ".codeam");
-  return path36.join(dir, "update-check.json");
+  const dir = path39.join(os25.homedir(), ".codeam");
+  return path39.join(dir, "update-check.json");
 }
 function readCache() {
   try {
-    const raw = fs28.readFileSync(cachePath(), "utf8");
+    const raw = fs30.readFileSync(cachePath(), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.fetchedAt !== "number" || typeof parsed.latest !== "string") return null;
     return parsed;
@@ -17792,10 +18401,10 @@ function readCache() {
 function writeCache(cache) {
   try {
     const file = cachePath();
-    fs28.mkdirSync(path36.dirname(file), { recursive: true });
+    fs30.mkdirSync(path39.dirname(file), { recursive: true });
     const tmp = `${file}.${process.pid}.tmp`;
-    fs28.writeFileSync(tmp, JSON.stringify(cache));
-    fs28.renameSync(tmp, file);
+    fs30.writeFileSync(tmp, JSON.stringify(cache));
+    fs30.renameSync(tmp, file);
   } catch {
   }
 }
@@ -17813,14 +18422,14 @@ function compareSemver(a, b) {
   return 0;
 }
 function fetchLatest() {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const req = https7.get(
       REGISTRY_URL,
       { headers: { Accept: "application/json" }, timeout: REQUEST_TIMEOUT_MS },
       (res) => {
         if (res.statusCode !== 200) {
           res.resume();
-          resolve4(null);
+          resolve5(null);
           return;
         }
         let buf = "";
@@ -17832,21 +18441,21 @@ function fetchLatest() {
           try {
             const json = JSON.parse(buf);
             if (typeof json.version === "string") {
-              resolve4(json.version);
+              resolve5(json.version);
             } else {
-              resolve4(null);
+              resolve5(null);
             }
           } catch {
-            resolve4(null);
+            resolve5(null);
           }
         });
       }
     );
     req.on("timeout", () => {
       req.destroy();
-      resolve4(null);
+      resolve5(null);
     });
-    req.on("error", () => resolve4(null));
+    req.on("error", () => resolve5(null));
   });
 }
 function notifyIfStale(currentVersion, latest) {
@@ -17866,7 +18475,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.20.3" : null;
+  const current = true ? "2.21.1" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;