codex-overleaf-link 2.5.0 → 2.5.1

package/extension/src/page/treeOperations.js

@@ -1564,15 +1564,6 @@
       };
     }
 
-    function fileTreeMethodNames(type) {
-      return {
-        create: ['createDoc', 'createFile', 'addDoc', 'addFile'],
-        rename: ['renameEntity', 'renameFile', 'renameDoc'],
-        move: ['moveEntity', 'moveFile', 'moveDoc'],
-        delete: ['deleteEntity', 'deleteFile', 'deleteDoc', 'removeEntity']
-      }[type] || [];
-    }
-
     function resolveTimeoutMs(options = {}, fallback) {
       const value = Number(options.timeoutMs);
       return Number.isFinite(value) && value >= 0 ? value : fallback;
@@ -1615,5 +1606,11 @@
     return text;
   }
 
-  return { create };
+  function fileTreeMethodNames(type) {
+    return {
+      create: ['createDoc', 'createFile', 'addDoc', 'addFile'], rename: ['renameEntity', 'renameFile', 'renameDoc'],
+      move: ['moveEntity', 'moveFile', 'moveDoc'], delete: ['deleteEntity', 'deleteFile', 'deleteDoc', 'removeEntity']
+    }[type] || [];
+  }
+  return { create, fileTreeMethodNames };
 });

package/extension/src/page/updateSafetyProbe.js

@@ -0,0 +1,41 @@
+(function installUpdateSafetyProbe(root) {
+  'use strict';
+  if (root.CodexOverleafUpdateSafetyProbe?.revision === '1') return;
+  const identities = new WeakMap();
+  function identity(value) {
+    if (!identities.has(value)) identities.set(value, crypto.randomUUID());
+    return identities.get(value);
+  }
+  // The same full CodeMirror document sources used by pageBridge. No DOM
+  // viewport text is eligible for the quiet-save fallback.
+  function editorView() {
+    const store = root.overleaf?.unstable?.store || root.Overleaf?.unstable?.store;
+    const get = key => { try { return store?.get?.(key) || {}; } catch (_) { return {}; } };
+    return [get('editor.view'), get('editor.view.camel'), get('editor').view,
+      root.overleaf?.unstable?.editorView, root.Overleaf?.editorView, root._ide?.editorView]
+      .find(value => value && typeof value.dispatch === 'function' && value.state?.doc
+        && typeof value.state.doc.toString === 'function') || null;
+  }
+  function fileIdentity() {
+    const store = root.overleaf?.unstable?.store || root.Overleaf?.unstable?.store;
+    const get = key => { try { return store?.get?.(key); } catch (_) { return ''; } };
+    const selected = document.querySelector('[role="treeitem"][aria-selected="true"] [data-file-id]');
+    return [get('editor.open_doc_id'), get('editor.openDocId'), root._ide?.editor?.open_doc_id,
+      root._ide?.editor?.openDocId, selected?.getAttribute('data-file-id'),
+      get('editor.open_doc_name'), get('editor.openDocName')].find(value => typeof value === 'string' && value) || '';
+  }
+  async function probe(expectedUrl) {
+    const view = editorView(), doc = view?.state?.doc, file = fileIdentity();
+    if (location.href !== expectedUrl || !file || !root.CodexOverleafSaveState) return { ok: false, state: 'unavailable' };
+    const save = root.CodexOverleafSaveState.create({ window: root, document,
+      delay: ms => new Promise(resolve => setTimeout(resolve, ms)),
+      detectEditor: () => ({ ok: Boolean(view && editorView() === view && view.state.doc === doc) }),
+      getActiveFilePath: () => doc ? identity(doc) : '', readActiveEditorText: () => view?.state.doc.toString() || '' });
+    const result = await save.waitForSaveState({ deadlineMs: 1500, pollIntervalMs: 100,
+      requirePositiveSignal: true, allowQuietEditorFallback: Boolean(doc), quietFallbackMs: 1000 });
+    if (location.href !== expectedUrl || fileIdentity() !== file || editorView() !== view
+      || (view && view.state.doc !== doc)) return { ok: false, state: 'unavailable' };
+    return { ok: result.ok === true, state: result.state, identity: file + ':' + (doc ? identity(doc) : 'positive-save-signal') };
+  }
+  root.CodexOverleafUpdateSafetyProbe = Object.freeze({ revision: '1', probe });
+})(globalThis);

package/extension/src/page/writebackReceiptJournal.js

@@ -87,8 +87,10 @@
         return applyOperations(params.operations || [], {
           baseFiles: params.baseFiles || null,
           reviewingPolicy: params.reviewingPolicy || '',
+          ...(params.reviewOwnerToken ? { reviewOwnerToken: params.reviewOwnerToken } : {}),
           requireReviewing: params.requireReviewing === true,
           requireEditing: params.requireEditing === true,
+          retryCreates: params.retryCreates === true,
           runProjectId: projectId,
           ...(params.deadlineAt == null ? {} : { deadlineAt: params.deadlineAt }),
           onOperationResult

package/extension/src/page/writebackRouter.js

@@ -1,11 +1,12 @@
 (function initCodexOverleafWritebackRouter(root, factory) {
   if (typeof module === 'object' && module.exports) {
-    module.exports = factory();
+    module.exports = factory(require('./treeOperations'));
   } else {
-    root.CodexOverleafWritebackRouter = factory();
+    root.CodexOverleafWritebackRouter = factory(root.CodexOverleafTreeOperations);
   }
-})(typeof window !== 'undefined' ? window : globalThis, function writebackRouterFactory() {
+})(typeof window !== 'undefined' ? window : globalThis, function writebackRouterFactory(TreeOperations) {
   'use strict';
+  const { fileTreeMethodNames } = TreeOperations;
 
   function create(deps = {}) {
     const window = deps.window || (typeof globalThis !== 'undefined' ? globalThis : {});
@@ -358,7 +359,9 @@
 
   async function applyOperations(operations, options = {}) {
     if (options.reviewingPolicy === 'no-trace-undo') {
-      return applyOperationsWithNoTraceUndo(operations, options);
+      const Context = window.CodexOverleafReviewContext || (typeof module === 'object' && module.exports ? require('./reviewContext') : null);
+      return Context.create({ window, now, readWriteCancellationSequence, getProjectId: () => treeOperations.getProjectId?.() }, options).run(
+        (scoped, input) => applyOperationsWithNoTraceUndo(operations, { ...input, reviewGuard: scoped.reviewGuard, reviewAwait: scoped.reviewAwait }));
     }
     const hasOperations = (operations || []).length > 0;
     const trackReviewingChanges = options.requireReviewing === true && hasOperations;
@@ -388,6 +391,7 @@
     }
     const result = await applyOperationsCore(operations, {
       ...options,
+      noTraceUndo: false,
       trackReviewingChanges
     });
     return reviewingPolicy
@@ -398,10 +402,12 @@
       : result;
   }
 
-  async function confirmNoTraceUndoEditing() {
+  async function confirmNoTraceUndoEditing(options = {}) {
     let changed = false;
     let toggle = { ok: true, changed: false, enabled: false };
     for (let attempt = 0; attempt < 2; attempt++) {
+      const blocked = options.reviewGuard?.();
+      if (blocked) return blocked;
       if (!isEditingConfirmedForNoTraceUndo(getReviewingState({}))) {
         toggle = await setReviewingEnabled(false, { waitMs: 1800 });
         if (!toggle.ok && (!['editing_not_confirmed', 'reviewing_disable_failed'].includes(toggle.code)
@@ -418,8 +424,13 @@
       reason: 'Overleaf Editing mode did not remain confirmed before undo; no undo write was started.' };
   }
 
+  async function awaitReview(options, work) {
+    try { return options.reviewAwait ? await options.reviewAwait(work) : await work(); }
+    catch (error) { if (error?.reviewFailure) return error.reviewFailure; throw error; }
+  }
+
   async function applyOperationsWithNoTraceUndo(operations, options = {}) {
-    const disabled = await confirmNoTraceUndoEditing();
+    const disabled = await awaitReview(options, () => confirmNoTraceUndoEditing(options));
     if (!disabled.ok) return buildNoTraceUndoBlockedResult(operations, disabled);
     const result = await applyOperationsCore(operations, {
       ...options, noTraceUndo: true, trackReviewingChanges: false
@@ -441,13 +452,7 @@
     const safeBaseFiles = normalizeBaseFilesForSafety(options.baseFiles);
     const baseFileLookup = window.CodexOverleafStaleGuard?.buildBaseFileLookup(safeBaseFiles);
     const baseBinaryFileLookup = buildBaseBinaryFileLookup(safeBaseFiles);
-    // Mid-run project-change guard. The pageBridge wrapper already ran the
-    // writeGuard once at entry, but each per-op step here can take 0.5-5s
-    // (openFileByPath, waitForActiveEditorText, save-state verification),
-    // so a multi-op write can span 10-30 seconds total. If the user SPA-
-    // navigates to a different project mid-flight, the remaining operations
-    // would land in the wrong project. Re-check the editor project before
-    // each op and short-circuit the rest of the queue when it diverges.
+    // Recheck project identity between awaited operations and before each write.
     const runProjectId = typeof options.runProjectId === 'string' ? options.runProjectId : '';
     const writeGuardSurface = window.CodexOverleafWriteGuard?.create({
       window,
@@ -478,13 +483,17 @@
       ? await deps.beginTextCreateBatch(createCandidates, { isCurrent: () =>
         treeOperations.getProjectId?.() === runProjectId && readWriteCancellationSequence() === cancelBaselineSequence }) : null;
     const deferredCreates = [];
+    let haltRemainingOperations = false;
+    const skipTail = (operation, result) => operations.slice(operations.indexOf(operation) + 1)
+      .forEach(tail => skipped.push({ operation: normalizeOperationPaths(tail), result }));
     const reopenQueue = [];
     const deadlineFailure = () => Number.isFinite(options.deadlineAt) && now() >= options.deadlineAt
       ? { ok: false, code: 'writeback_deadline_exceeded', changedDocument: false,
         reason: 'The undo time budget expired before this operation could start.' } : null;
-    const editOptions = () => ({ baseFileLookup, runProjectId,
+    const editOptions = () => ({ baseFileLookup, runProjectId, deadlineAt: options.deadlineAt,
+      reviewGuard: options.reviewGuard, reviewAwait: options.reviewAwait,
       recheckWriteProject: writeGuardSurface ? () => {
-        const expired = deadlineFailure();
+        const expired = options.reviewGuard?.() || deadlineFailure();
         return expired ? { applied: [], skipped: [{ operation: {}, result: expired }] }
           : writeGuardSurface.runWriteGuard({ runProjectId });
       } : null,
@@ -499,13 +508,15 @@
     };
 
     for (const rawOperation of operations) {
+      const reviewBlock = options.reviewGuard?.();
+      if (reviewBlock) {
+        skipped.push({ operation: normalizeOperationPaths(rawOperation), result: reviewBlock });
+        skipTail(rawOperation, reviewBlock); break;
+      }
       // Stop undispatched work when cancellation arrives during an awaited operation.
       if (readWriteCancellationSequence() !== cancelBaselineSequence) {
         skipped.push({ operation: normalizeOperationPaths(rawOperation), result: cancelledSkipResult });
-        const remainingForCancel = operations.slice(operations.indexOf(rawOperation) + 1);
-        for (const tailOperation of remainingForCancel) {
-          skipped.push({ operation: normalizeOperationPaths(tailOperation), result: cancelledSkipResult });
-        }
+        skipTail(rawOperation, cancelledSkipResult);
         break;
       }
       // Re-check project ownership before this operation and preserve every skipped tail entry.
@@ -515,10 +526,7 @@
           // Keep the current path and the remaining operations attributable.
           const guardFailure = guardBlock.skipped[0].result;
           skipped.push({ operation: normalizeOperationPaths(rawOperation), result: guardFailure });
-          const remaining = operations.slice(operations.indexOf(rawOperation) + 1);
-          for (const tailOperation of remaining) {
-            skipped.push({ operation: normalizeOperationPaths(tailOperation), result: guardFailure });
-          }
+          skipTail(rawOperation, guardFailure);
           break;
         }
       }
@@ -538,7 +546,7 @@
       } else if (['binary-create', 'overwrite-binary'].includes(operation.type)) {
         result = await applyBinaryAssetOperation(operation, { baseFileLookup, baseBinaryFileLookup });
       } else if (['create', 'rename', 'move', 'delete'].includes(operation.type)) {
-        result = await applyFileTreeOperation(operation, { baseFileLookup, runProjectId, deadlineAt: options.deadlineAt,
+        result = await applyFileTreeOperation(operation, { baseFileLookup, runProjectId, deadlineAt: options.deadlineAt, reviewGuard: options.reviewGuard, noTraceUndo: options.noTraceUndo === true,
           createBatch: createBatch?.targets.has(operation.path) ? createBatch : null,
           retryCreates: options.retryCreates === true });
       } else {
@@ -557,16 +565,21 @@
         continue;
       }
       record(operation, result);
+      if (operation.type === 'move' && operation.moveProof && !result.ok) {
+        haltRemainingOperations = true;
+        skipTail(rawOperation, { ok: false, code: 'file_plan_not_completed', changedDocument: false,
+          reason: 'The file move did not finish; the remaining file plan was not started.' }); break;
+      }
     }
 
     // A file that could not be opened mid-batch usually opens once the
     // previous document has settled: give untouched open failures one pass.
-    if (reopenQueue.length && readWriteCancellationSequence() === cancelBaselineSequence
+    if (!haltRemainingOperations && reopenQueue.length && readWriteCancellationSequence() === cancelBaselineSequence
       && !skipped.some(entry => entry.result?.code === 'aborted_project_changed')) {
       await delay(deps.reopenRetryDelayMs ?? 1200);
     }
     for (const entry of reopenQueue) {
-      const blocked = readWriteCancellationSequence() !== cancelBaselineSequence
+      const blocked = options.reviewGuard?.() || haltRemainingOperations || readWriteCancellationSequence() !== cancelBaselineSequence
         || skipped.some(item => item.result?.code === 'aborted_project_changed')
         || Boolean(runProjectId && writeGuardSurface && await writeGuardSurface.runWriteGuard({ runProjectId }));
       const result = blocked ? entry.result : await applyEditOperation(entry.operation, editOptions());
@@ -589,25 +602,26 @@
       ok: skipped.length === 0,
       applied,
       skipped,
+      ...(haltRemainingOperations ? { haltRemainingOperations: true } : {}),
       trackedChanges: trackedChangeCaptures.some(capture => capture.state !== 'observed') ? [] : mergeTrackedChangeRefs(trackedChanges),
       trackedChangeCaptures
     };
   }
 
-  function isUntouchedOpenFailure(result) {
-    return result?.ok === false && result.failure?.code === 'target_file_open_failed'
-      && result.failure.changedDocument === false;
-  }
+  const isUntouchedOpenFailure = result => result?.ok === false && result.failure?.code === 'target_file_open_failed'
+    && result.failure.changedDocument === false;
 
   async function applyEditOperation(operation, options = {}) {
+    const reviewBlock = options.reviewGuard?.();
+    if (reviewBlock) return reviewBlock;
     const currentPath = getActiveFilePath();
-    const editorReady = await ensureEditorReadyForOperation(operation, options.baseFileLookup, currentPath);
+    const editorReady = await awaitReview(options, () => ensureEditorReadyForOperation(operation, options.baseFileLookup, currentPath));
     if (!editorReady.ok) {
       return editorReady;
     }
 
     if (options.noTraceUndo === true) {
-      const editing = await confirmNoTraceUndoEditing();
+      const editing = await awaitReview(options, () => confirmNoTraceUndoEditing(options));
       if (!editing.ok) return buildNoTraceUndoBlockedResult([operation], editing).skipped[0].result;
     }
     const trackReviewingChanges = options.trackReviewingChanges === true;
@@ -625,7 +639,8 @@
       options.baseFileLookup
     ) || { ok: true };
     if (!freshness.ok) {
-      const ready = await waitForFreshEditorTextForOperation(operation, options.baseFileLookup, 1500);
+      const ready = await awaitReview(options, () => waitForFreshEditorTextForOperation(operation, options.baseFileLookup, 1500));
+      if (options.reviewGuard?.()) return options.reviewGuard();
       if (!ready.ok) {
         const decorated = attachWritebackDebug(freshness, 'stale_guard', operation, options.baseFileLookup, current, {
           initialActivePath: currentPath,
@@ -665,8 +680,11 @@
     }
 
     let nextContent = null;
+    let preparedPatches;
     if (Array.isArray(operation.patches) && operation.patches.length) {
-      const patched = applyTextPatches(current, operation.patches);
+      preparedPatches = window.CodexOverleafStaleGuard?.prepareOperationPatches(operation, current, options.baseFileLookup)
+        || { ok: true, patches: operation.patches };
+      const patched = preparedPatches.ok ? applyTextPatches(current, preparedPatches.patches) : preparedPatches;
       if (!patched.ok) {
         const decorated = attachWritebackDebug(patched, 'apply_text_patches', operation, options.baseFileLookup, current, {
           initialActivePath: currentPath,
@@ -729,14 +747,18 @@
           reason: 'Overleaf left Editing mode before the undo write.' }).skipped[0].result;
     }
 
+    const finalReviewBlock = options.reviewGuard?.();
+    if (finalReviewBlock) return finalReviewBlock;
     const result = Array.isArray(operation.patches) && operation.patches.length
-      ? replaceActiveEditorPatches(operation.patches, nextContent)
+      ? replaceActiveEditorPatches(preparedPatches.patches, nextContent)
       : replaceActiveEditorText(nextContent);
     if (!result.ok) {
       return result;
     }
 
-    const verified = await verifyActiveEditorText(nextContent, operation.path, deps.writeVerifyWaitMs ?? 2500, current);
+    const verifyWaitMs = Math.min(deps.writeVerifyWaitMs ?? 2500, Number.isFinite(options.deadlineAt)
+      ? Math.max(0, options.deadlineAt - now()) : Infinity);
+    const verified = await verifyActiveEditorText(nextContent, operation.path, verifyWaitMs, current);
     if (!verified.ok) {
       const decorated = attachWritebackDebug(verified, 'write_verification', operation, options.baseFileLookup, readActiveEditorText(), {
         initialActivePath: currentPath,
@@ -776,7 +798,7 @@
       // Slow batches are covered by request receipts; Accept replay retains
       // its independent safety window proving that no new tracking was added.
       const trackedDiff = trackReviewingChanges
-        ? await captureTrackedWrite({ trackedBefore, captureBaseline, operation, beforeContent: current,
+        ? await captureTrackedWrite({ trackedBefore, captureBaseline, operation: { ...operation, patches: preparedPatches?.patches }, beforeContent: current,
           postContent: nextContent, runProjectId: options.runProjectId, waitMs: deps.trackCaptureWaitMs ?? 35000 })
         : await waitForTrackedChangeDiff(trackedBefore, operationPaths, {
           waitMs: 3600, intervalMs: 180, stopOnFirst: true
@@ -812,7 +834,7 @@
     window.CodexOverleafStaleGuard?.updateExpectedFileContent(
       options.baseFileLookup,
       operation.path,
-      nextContent
+      preparedPatches?.sourceContent ?? nextContent
     );
     return {
       ...result,
@@ -823,7 +845,6 @@
     };
   }
 
-
   async function verifyActiveEditorText(expected, filePath, waitMs = 1000, before) {
     const deadline = Date.now() + waitMs;
     let actual = readActiveEditorText();
@@ -1149,7 +1170,6 @@
     };
   }
 
-
   async function applyBinaryAssetOperation(operation, options = {}) {
     const freshness = await checkBinaryAssetFreshness(operation, options);
     if (!freshness.ok) {
@@ -1319,9 +1339,7 @@
     return baseFile.size == null || currentSize == null || baseFile.size === currentSize;
   }
 
-  function normalizeBase64(value) {
-    return String(value || '').replace(/\s+/g, '');
-  }
+  const normalizeBase64 = value => String(value || '').replace(/\s+/g, '');
 
   function decodeBase64Bytes(contentBase64) {
     try {
@@ -1372,6 +1390,17 @@
     }
     const initialProjectId = treeOperations.getProjectId?.();
     const initialCancellationSequence = readWriteCancellationSequence();
+    if (operation.type === 'move' && operation.moveProof) {
+      if (options.noTraceUndo !== true) return { ok: false, code: 'file_tree_controls_unavailable', changedDocument: false,
+        reason: 'Native file moves are available only to undo a previously recorded move.' };
+      if (typeof deps.moveFile !== 'function') return { ok: false, code: 'file_move_unavailable', changedDocument: false,
+        reason: 'Verified native file moves are unavailable. Reload the extension and Overleaf.' };
+      const result = await deps.moveFile(operation, { noTraceUndo: true, runProjectId: options.runProjectId, deadlineAt: options.deadlineAt,
+        isCurrent: () => treeOperations.getProjectId?.() === initialProjectId
+          && readWriteCancellationSequence() === initialCancellationSequence && !options.reviewGuard?.() });
+      if (result.ok) recordFileTreeOperationSuccess(operation, options.baseFileLookup);
+      return result;
+    }
     if (operation.type === 'create' && options.createBatch && typeof deps.createTextFile === 'function') {
       if (options.baseFileLookup?.has(operation.path) && options.retryCreates !== true) {
         return checkFileTreeOperationFreshness(operation, options.baseFileLookup);
@@ -1379,13 +1408,14 @@
       return deps.createTextFile(operation, { batch: options.createBatch,
         allowExistingMatches: options.retryCreates === true,
         isCurrent: () => treeOperations.getProjectId?.() === initialProjectId
-          && readWriteCancellationSequence() === initialCancellationSequence });
+          && readWriteCancellationSequence() === initialCancellationSequence && !options.reviewGuard?.() });
     }
     const freshness = await checkFileTreeOperationFreshness(operation, options.baseFileLookup);
     if (!freshness.ok) {
       return freshness;
     }
 
+    const ownerBlocked = options.reviewGuard?.(); if (ownerBlocked) return ownerBlocked;
     const manager = findFileTreeManager();
     const methodNames = fileTreeMethodNames(operation.type);
 
@@ -1432,7 +1462,7 @@
     const nativeOperation = { create: deps.createTextFile, delete: deps.deleteTextFile }[operation.type];
     if (typeof nativeOperation === 'function' && (operation.type === 'delete' || typeof operation.content === 'string')) {
       const isCurrent = () => Boolean(initialProjectId) && treeOperations.getProjectId?.() === initialProjectId
-        && readWriteCancellationSequence() === initialCancellationSequence;
+        && readWriteCancellationSequence() === initialCancellationSequence && !options.reviewGuard?.();
       const created = await nativeOperation(operation, { isCurrent, expectedContent: options.baseFileLookup?.get(operation.path) });
       if (!created.ok) return created;
       if (!isCurrent() || created.verified !== true || created.verification !== 'overleaf-zip') {
@@ -1456,7 +1486,7 @@
     const text = proof?.v === 1 && proof.kind === 'text' && typeof expected === 'string';
     const binary = proof?.v === 1 && proof.kind === 'binary' && /^[a-f0-9]{64}$/i.test(proof.sha256 || '');
     const isCurrent = () => Boolean(projectId) && projectId === options.runProjectId
-      && treeOperations.getProjectId?.() === projectId && readWriteCancellationSequence() === cancellation;
+      && treeOperations.getProjectId?.() === projectId && readWriteCancellationSequence() === cancellation && !options.reviewGuard?.();
     if (!isCurrent() || (!text && !binary) || typeof deps.deleteTextFile !== 'function') {
       return { ok: false, code: 'undo_operation_failed', changedDocument: false,
         reason: 'Verified created-file deletion is unavailable for this run.' };
@@ -1653,15 +1683,6 @@
     }
   }
 
-  function fileTreeMethodNames(type) {
-    return {
-      create: ['createDoc', 'createFile', 'addDoc', 'addFile'],
-      rename: ['renameEntity', 'renameFile', 'renameDoc'],
-      move: ['moveEntity', 'moveFile', 'moveDoc'],
-      delete: ['deleteEntity', 'deleteFile', 'deleteDoc', 'removeEntity']
-    }[type] || [];
-  }
-
   function normalizeOperationPaths(operation) {
     if (!operation || typeof operation !== 'object') {
       return operation;
@@ -1734,10 +1755,6 @@
   }
 
 
-
-
-
-
   function normalizeTrackedChangeRefs(refs = []) {
     const seen = new Set();
     const normalized = [];
@@ -1796,23 +1813,12 @@
 
     async function applyOperationsForBridge(operationsOrOptions, options = {}) {
       if (Array.isArray(operationsOrOptions)) {
-        // Welcome-panel + write-guard: defense-in-depth
-        // also runs on the array-shaped entry. T2 only guarded the
-        // payload-object branch; if any future caller goes straight to the
-        // array entry without `options.runProjectId`, the router would have
-        // silently dispatched. Mirror the same `editor_project_id_unavailable`
-        // failure shape the payload branch and the page-side guard already
-        // emit.
+        // Both public call shapes require the original project identity.
         const writeGuardBlock = checkWritebackRunProjectId(options);
         if (writeGuardBlock) return writeGuardBlock;
         return applyOperations(operationsOrOptions, options);
       }
       const payload = operationsOrOptions || {};
-      // Welcome-panel + write-guard: defense-in-depth.
-      // The pageBridge wrapper already runs the runProjectId guard, but a
-      // future caller could reach the router directly. A missing or empty
-      // `runProjectId` on the payload-shaped call blocks the write with the
-      // same `editor_project_id_unavailable` shape the page-side guard uses.
       const writeGuardBlock = checkWritebackRunProjectId(payload);
       if (writeGuardBlock) return writeGuardBlock;
       return applyOperations(payload.operations || [], payload);
@@ -1821,10 +1827,7 @@
     function checkWritebackRunProjectId(params) {
       const runProjectId = params && typeof params.runProjectId === 'string' ? params.runProjectId : '';
       if (runProjectId) return null;
-      // operation: {} (not null) — batch-level guard fired before any per-op
-      // dispatch; matches the abortDispatchResult shape in pageBridge.js and
-      // avoids crashing downstream audit / transcript code that reads
-      // operation.path without a null guard.
+      // Keep operation.path safe for downstream readers of batch-level failures.
       return {
         ok: false,
         applied: [],
@@ -1916,9 +1919,7 @@
     };
   }
 
-    // Tracked-changes lifecycle — carved to trackedChangesLifecycle.js in
-    // v1.8.0 (structural-debt phase 7, #117). Loaded just before this file
-    // in the manifest's page-script list; the Node test path requires it.
+    // Tracked lifecycle is loaded by the Page script list or required by Node tests.
     const trackedChangesLifecycleModule = (typeof window !== 'undefined' && window.CodexOverleafTrackedChangesLifecycle)
       || (typeof module === 'object' && module.exports ? require('./trackedChangesLifecycle.js') : null)
       || (typeof globalThis !== 'undefined' ? globalThis.CodexOverleafTrackedChangesLifecycle : null);
@@ -1930,7 +1931,7 @@
       captureTrackedWrite, reconcileTrackedChangeCapture,
       waitForTrackedChangeDiff
     } = trackedChangesLifecycleModule.create({
-      window, confirmReviewWriteback: deps.confirmReviewWriteback,
+      window, now, readWriteCancellationSequence, confirmReviewWriteback: deps.confirmReviewWriteback,
       checkWritebackRunProjectId,
       buildNoTraceUndoBlockedResult,
       buildReviewingRequiredBlockedResult,

package/extension/src/pageBridge.js

@@ -63,6 +63,7 @@
     window
   });
   snapshotRouter = requirePageModule('CodexOverleafSnapshotRouter').create({
+    getActiveEditorIdentity,
     normalizePath: normalizeSafeProjectPath,
     readActiveEditorText,
     treeOperations,
@@ -76,12 +77,17 @@
   });
   binaryAssetUploader = requirePageModule('CodexOverleafBinaryAssetUploader').create({
     prepareUploadParent: textFileCreator.prepareUploadParent,
+    cleanupCreatedDirectories: textFileCreator.cleanupCreatedDirectories,
+    isUploadParentCurrent: textFileCreator.isUploadParentCurrent,
     findFolderNode: textFileCreator.findFolderNode,
     document,
     snapshotRouter,
     treeOperations,
     window
   });
+  const fileMover = requirePageModule('CodexOverleafFileMover').create({
+    window, document, treeOperations, snapshotRouter, textFileCreator, normalizeSafeProjectPath
+  });
   writeGuard = requirePageModule('CodexOverleafWriteGuard').create({
     document,
     treeOperations,
@@ -102,6 +108,7 @@
     beginTextCreateBatch: textFileCreator.beginCreateBatch,
     finishTextCreateBatch: textFileCreator.finishCreateBatch,
     deleteTextFile: textFileCreator.deleteFile,
+    moveFile: fileMover.moveFile,
     activeEditorIdentityChanged,
     clickNode,
     collectElements,
@@ -221,7 +228,8 @@
 
   const pageRpcHandlers = {
     probe,
-    cancelActiveWrite() {
+    cancelActiveWrite(params = {}) {
+      if (params.reviewOwnerToken) return { ok: true, cancelled: requirePageModule('CodexOverleafReviewContext').cancelOwner(params.reviewOwnerToken) };
       const sequence = bumpWriteCancellationSequence();
       textFileCreator.cancelVerifications();
       snapshotRouter.cancelWritebackReads();
@@ -690,7 +698,14 @@
     if (to - from > 20000) return { ok: false, code: 'selection_too_large' };
     const source = editorState.doc.toString();
     const text = source.slice(from, to);
-    const digest = await window.crypto.subtle.digest('SHA-256', new TextEncoder().encode(source));
+    // UTF-8 replaces isolated surrogates; exclude them so flank hashes prove exact UTF-16 text.
+    if (/[\uD800-\uDFFF]/u.test(source) || /[\uD800-\uDFFF]/u.test(text)) return { ok: false, code: 'selection_unavailable' };
+    const hashText = async value => Array.from(new Uint8Array(
+      await window.crypto.subtle.digest('SHA-256', new TextEncoder().encode(value))
+    ), byte => byte.toString(16).padStart(2, '0')).join('');
+    const [documentHash, prefixHash, suffixHash] = await Promise.all([
+      hashText(source), hashText(source.slice(0, from)), hashText(source.slice(to))
+    ]);
     if (getProjectId() !== projectId || getActiveFilePath() !== path || getCodeMirrorEditorView() !== view
       || view.state.doc !== editorState.doc || view.state.selection.main.from !== from || view.state.selection.main.to !== to) {
       return { ok: false, code: 'selection_changed' };
@@ -698,7 +713,8 @@
     const captured = { projectId, path, from, to, text,
       lineStart: editorState.doc.lineAt(from).number,
       lineEnd: editorState.doc.lineAt(Math.max(from, to - 1)).number,
-      documentHash: Array.from(new Uint8Array(digest), byte => byte.toString(16).padStart(2, '0')).join(''),
+      documentHash,
+      rebaseEvidence: { v: 1, documentLength: source.length, prefixHash, suffixHash },
       capturedAt: new Date().toISOString() };
     let anchor = null;
     try {