diffing 0.11.0 → 0.12.0

package/README.md

@@ -110,7 +110,7 @@ Blazing-fast, native fuzzy code search integrated directly into the sidebar sear
 
 - **Fuzzy File Search** (`Files` scope) — Error-tolerant fuzzy matching on workspace paths using a native Rust engine.
 - **Codebase Grep** (`Text` scope) — Instant case-insensitive text search with full **Regular Expression** support.
-- **Syntactic Symbol Search** (`Symbols` scope) — Finds function declarations, class headers, type definitions, and variable assignments across JavaScript, TypeScript, Go, Rust, and Python (17+ language patterns).
+- **Syntactic Symbol Search** (`Symbols` scope) — Finds function declarations, class headers, type definitions, and variable assignments across JavaScript, TypeScript, Go, Rust, Python, and PHP (27 language patterns).
 - **Unified "All" Search** — Concurrent search across files, text, and symbols with automatic deduplication.
 - **Frecency Ranking** — SQLite-backed history database remembers which files you open for specific queries, floating high-value results to the top.
 - **"Changed Only" Filter** — Restricts search scope exclusively to files changed in the active git diff.
@@ -176,18 +176,8 @@ A vim-style status bar at the bottom displays the current mode (NORMAL/INSERT),
 
 ## Native Terminal UI (TUI) — *Experimental*
 
-> [!WARNING]
-> The TUI is **experimental**. The interface, keymap, and on-disk format of
-> `server.json` (`mode: "tui"`) may change in a minor release before
-> stabilisation. The web UI is the supported path for production workflows;
-> please open an issue before depending on the TUI for CI / agent automation.
-> The web review flow, plan review, and PR review are unaffected.
+<img width="1624" height="1061" alt="image" src="https://github.com/user-attachments/assets/2756dbe5-6329-4d70-a8c0-ca61600c2154" />
 
-> [!IMPORTANT]
-> Native binaries are published as optional, platform-specific npm packages
-> for macOS, Windows, and glibc/musl Linux. The main package never compiles Rust
-> during installation and never installs a binary for the wrong platform. A
-> source build and `$PATH` remain supported fallbacks.
 
 `diffing --tui` opens an **opt-in native-Rust terminal interface** that mirrors the local code-review workflow — no browser or Electron. The renderer and headless tools share one sparse diff index. Review sessions publish a capability-scoped loopback API through the per-repository session registry; web and TUI reviews can run concurrently, while `server.json` points agent commands at the selected active session. Read-only viewers do not register a review session.
 

package/dist/{cli-agent-DkwGxuy2.mjs → cli-agent-CWsOHN-j.mjs}

@@ -1,8 +1,8 @@
-import { d as getProjectStorageDir } from "./git-Czo96ymM.mjs";
-import { n as saveSettings, t as loadSettings } from "./settings-yK0GYpbn.mjs";
+import { f as getProjectStorageDir } from "./git-BGj31GX-.mjs";
+import { a as loadSettings, i as reviewSessionUrl, o as saveSettings, t as appendSessionToken } from "./session-url-sr7lXXVc.mjs";
 import { t as formatComments } from "./comment-format-B85NHZnG.mjs";
 import { n as formatPlanReview } from "./plan-format-BwJh5JSE.mjs";
-import { u as resolveActiveServerLock } from "./server-lock-CY0_1mcS.mjs";
+import { h as SESSION_TOKEN_HEADER, u as resolveActiveServerLock } from "./server-lock-BNI8FKV1.mjs";
 import { a as CLI_AWAIT_REVIEW_TIMEOUT_HINT, i as CLI_AWAIT_PLAN_TIMEOUT_HINT, o as CLI_PLAN_SUBMIT_PARK_HINT } from "./handoff-LAFtmnHf.mjs";
 import { join } from "node:path";
 import { parseArgs } from "node:util";
@@ -25,6 +25,7 @@ const EXIT_NO_SERVER = 3;
 const EXIT_NOT_FOUND = 4;
 const EXIT_USAGE = 5;
 let activeCapability;
+let activeAuthToken;
 /** Resolve the running server's base URL from the lockfile, or exit cleanly. */
 function baseUrl() {
 	const lock = resolveActiveServerLock();
@@ -34,17 +35,41 @@ function baseUrl() {
 	}
 	const host = lock.host === "0.0.0.0" || lock.host === "::" ? "127.0.0.1" : lock.host;
 	activeCapability = lock.mode === "tui" ? lock.capability : void 0;
+	activeAuthToken = lock.authToken;
 	return `http://${host}:${lock.port}`;
 }
-/** Attach the per-session TUI capability while preserving ordinary web calls. */
+/** Attach session credentials while preserving ordinary web calls. */
 function apiFetch(input, init = {}) {
 	const headers = new Headers(init.headers);
 	if (activeCapability) headers.set("X-Diffing-Capability", activeCapability);
+	if (activeAuthToken) headers.set(SESSION_TOKEN_HEADER, activeAuthToken);
 	return fetch(input, {
 		...init,
 		headers
 	});
 }
+function connectionErrorMessage(err) {
+	if (err instanceof Error) return err.message;
+	return String(err);
+}
+/** apiFetch wrapper that logs connection failures and returns null instead of throwing. */
+async function tryApiFetch(input, init) {
+	try {
+		return await apiFetch(input, init);
+	} catch (err) {
+		console.error(`Failed to reach diffing server: ${connectionErrorMessage(err)}`);
+		return null;
+	}
+}
+function parseTimeoutSeconds(raw, flag = "--timeout") {
+	if (raw === void 0) return 570;
+	const t = Number(raw);
+	if (!Number.isFinite(t) || t <= 0) {
+		console.error(`${flag} must be a positive number of seconds.`);
+		return null;
+	}
+	return t;
+}
 async function readStdin() {
 	const chunks = [];
 	for await (const chunk of process.stdin) chunks.push(chunk);
@@ -68,7 +93,9 @@ async function awaitReview(args) {
 		},
 		allowPositionals: false
 	});
-	const totalBudgetMs = (values.timeout ? Number(values.timeout) : 570) * 1e3;
+	const timeoutSeconds = parseTimeoutSeconds(values.timeout);
+	if (timeoutSeconds === null) return EXIT_USAGE;
+	const totalBudgetMs = timeoutSeconds * 1e3;
 	const base = baseUrl();
 	let agentId = typeof values["agent-id"] === "string" ? values["agent-id"] : void 0;
 	try {
@@ -84,9 +111,8 @@ async function awaitReview(args) {
 		if (reg.ok) agentId = (await reg.json()).agentId ?? agentId;
 	} catch {}
 	let sinceRound = 0;
-	try {
-		sinceRound = (await apiFetch(`${base}/api/review/status`).then((r) => r.json())).round ?? 0;
-	} catch {}
+	const statusRes = await tryApiFetch(`${base}/api/review/status`);
+	if (statusRes?.ok) sinceRound = (await statusRes.json()).round ?? 0;
 	const unregister = async () => {
 		if (!agentId) return;
 		try {
@@ -100,10 +126,15 @@ async function awaitReview(args) {
 			res = await apiFetch(`${base}/api/review/await?timeoutMs=25000&sinceRound=${sinceRound}`, { signal: AbortSignal.timeout(3e4) });
 		} catch (err) {
 			if (err?.name === "TimeoutError") continue;
-			console.error(`Failed to reach diffing server: ${err?.message ?? err}`);
+			console.error(`Failed to reach diffing server: ${connectionErrorMessage(err)}`);
 			await unregister();
 			return EXIT_NO_SERVER;
 		}
+		if (!res.ok) {
+			console.error(`Failed to await review: HTTP ${res.status}`);
+			await unregister();
+			return 1;
+		}
 		const result = await res.json();
 		if (result.status === "released") {
 			process.stdout.write(result.payload.commentXml + "\n");
@@ -139,12 +170,18 @@ async function reply(args) {
 		return EXIT_USAGE;
 	}
 	let body = values.body;
-	if (body === "-" || body === void 0) body = (await readStdin()).trim();
+	if (body === void 0) {
+		if (process.stdin.isTTY) {
+			console.error("Usage: diffing reply <commentId> --body <text> [--model <name>]");
+			return EXIT_USAGE;
+		}
+		body = (await readStdin()).trim();
+	} else if (body === "-") body = (await readStdin()).trim();
 	if (!body) {
 		console.error("A reply body is required (--body <text> or pipe via stdin).");
 		return EXIT_USAGE;
 	}
-	const res = await apiFetch(`${baseUrl()}/api/comments/${commentId}/replies`, {
+	const res = await tryApiFetch(`${baseUrl()}/api/comments/${commentId}/replies`, {
 		method: "POST",
 		headers: { "Content-Type": "application/json" },
 		body: JSON.stringify({
@@ -153,6 +190,7 @@ async function reply(args) {
 			model: values.model
 		})
 	});
+	if (!res) return EXIT_NO_SERVER;
 	if (res.status === 404) {
 		console.error(`Comment ${commentId} not found.`);
 		return EXIT_NOT_FOUND;
@@ -175,11 +213,12 @@ async function resolve$1(args) {
 		console.error("Usage: diffing resolve <commentId>");
 		return EXIT_USAGE;
 	}
-	const res = await apiFetch(`${baseUrl()}/api/comments/${commentId}`, {
+	const res = await tryApiFetch(`${baseUrl()}/api/comments/${commentId}`, {
 		method: "PUT",
 		headers: { "Content-Type": "application/json" },
 		body: JSON.stringify({ status: "resolved" })
 	});
+	if (!res) return EXIT_NO_SERVER;
 	if (res.status === 404) {
 		console.error(`Comment ${commentId} not found.`);
 		return EXIT_NOT_FOUND;
@@ -202,11 +241,12 @@ async function unresolve(args) {
 		console.error("Usage: diffing unresolve <commentId>");
 		return EXIT_USAGE;
 	}
-	const res = await apiFetch(`${baseUrl()}/api/comments/${commentId}`, {
+	const res = await tryApiFetch(`${baseUrl()}/api/comments/${commentId}`, {
 		method: "PUT",
 		headers: { "Content-Type": "application/json" },
 		body: JSON.stringify({ status: "open" })
 	});
+	if (!res) return EXIT_NO_SERVER;
 	if (res.status === 404) {
 		console.error(`Comment ${commentId} not found.`);
 		return EXIT_NOT_FOUND;
@@ -233,16 +273,23 @@ async function commentEdit(args) {
 		return EXIT_USAGE;
 	}
 	let body = values.body;
-	if (body === "-" || body === void 0) body = (await readStdin()).trim();
+	if (body === void 0) {
+		if (process.stdin.isTTY) {
+			console.error("Usage: diffing comment edit <commentId> --body <text>");
+			return EXIT_USAGE;
+		}
+		body = (await readStdin()).trim();
+	} else if (body === "-") body = (await readStdin()).trim();
 	if (!body) {
 		console.error("A body is required (--body <text> or stdin).");
 		return EXIT_USAGE;
 	}
-	const res = await apiFetch(`${baseUrl()}/api/comments/${commentId}`, {
+	const res = await tryApiFetch(`${baseUrl()}/api/comments/${commentId}`, {
 		method: "PUT",
 		headers: { "Content-Type": "application/json" },
 		body: JSON.stringify({ body })
 	});
+	if (!res) return EXIT_NO_SERVER;
 	if (res.status === 404) {
 		console.error(`Comment ${commentId} not found.`);
 		return EXIT_NOT_FOUND;
@@ -265,7 +312,8 @@ async function commentDelete(args) {
 		console.error("Usage: diffing comment delete <commentId>");
 		return EXIT_USAGE;
 	}
-	const res = await apiFetch(`${baseUrl()}/api/comments/${commentId}`, { method: "DELETE" });
+	const res = await tryApiFetch(`${baseUrl()}/api/comments/${commentId}`, { method: "DELETE" });
+	if (!res) return EXIT_NO_SERVER;
 	if (res.status === 404) {
 		console.error(`Comment ${commentId} not found.`);
 		return EXIT_NOT_FOUND;
@@ -289,7 +337,13 @@ async function commentCmd(args) {
 	}
 }
 async function url() {
-	process.stdout.write(baseUrl() + "\n");
+	const lock = resolveActiveServerLock();
+	if (!lock) {
+		console.error("No diffing server running for this repo. Start one with `diffing`.");
+		process.exit(EXIT_NO_SERVER);
+	}
+	const printed = reviewSessionUrl(lock) ?? baseUrl();
+	process.stdout.write(`${printed}\n`);
 	return EXIT_OK;
 }
 async function comments(args) {
@@ -302,9 +356,19 @@ async function comments(args) {
 		},
 		allowPositionals: false
 	});
-	const all = await apiFetch(`${baseUrl()}/api/comments`).then((r) => r.json());
+	const res = await tryApiFetch(`${baseUrl()}/api/comments`);
+	if (!res) return EXIT_NO_SERVER;
+	if (!res.ok) {
+		console.error(`Failed to fetch comments: HTTP ${res.status}`);
+		return 1;
+	}
+	const all = await res.json();
 	const selected = values.open ? all.filter((c) => c.status === "open") : all;
 	const format = values.format?.toLowerCase();
+	if (format && format !== "xml" && format !== "json" && format !== "md" && format !== "markdown") {
+		console.error("Unknown --format. Use xml, json, md, or markdown.");
+		return EXIT_USAGE;
+	}
 	if (values.json || format === "json") process.stdout.write(JSON.stringify(selected, null, 2) + "\n");
 	else if (format === "markdown" || format === "md") {
 		const { formatCommentsMarkdown } = await import("./review-export-B63eRAVa.mjs");
@@ -349,9 +413,10 @@ function deriveTitle(body) {
 /** Long-poll the plan-review handoff until a decision arrives or time runs out. */
 async function pollPlanDecision(base, totalBudgetMs, seedSince) {
 	let sinceRound = seedSince ?? 0;
-	if (seedSince === void 0) try {
-		sinceRound = (await apiFetch(`${base}/api/plan-review/status`).then((r) => r.json())).round ?? 0;
-	} catch {}
+	if (seedSince === void 0) {
+		const statusRes = await tryApiFetch(`${base}/api/plan-review/status`);
+		if (statusRes?.ok) sinceRound = (await statusRes.json()).round ?? 0;
+	}
 	const deadline = Date.now() + totalBudgetMs;
 	while (Date.now() < deadline) {
 		let res;
@@ -359,9 +424,13 @@ async function pollPlanDecision(base, totalBudgetMs, seedSince) {
 			res = await apiFetch(`${base}/api/plan-review/await?timeoutMs=25000&sinceRound=${sinceRound}`, { signal: AbortSignal.timeout(3e4) });
 		} catch (err) {
 			if (err?.name === "TimeoutError") continue;
-			console.error(`Failed to reach diffing server: ${err?.message ?? err}`);
+			console.error(`Failed to reach diffing server: ${connectionErrorMessage(err)}`);
 			return EXIT_NO_SERVER;
 		}
+		if (!res.ok) {
+			console.error(`Failed to await plan review: HTTP ${res.status}`);
+			return 1;
+		}
 		const result = await res.json();
 		if (result.status === "released") {
 			process.stdout.write(result.payload.reviewXml + "\n");
@@ -428,10 +497,11 @@ async function planSubmit(args) {
 		source = file;
 	}
 	let sinceRound = 0;
-	if (values.wait) try {
-		sinceRound = (await apiFetch(`${base}/api/plan-review/status`).then((r) => r.json())).round ?? 0;
-	} catch {}
-	const res = await apiFetch(`${base}/api/plans`, {
+	if (values.wait) {
+		const statusRes = await tryApiFetch(`${base}/api/plan-review/status`);
+		if (statusRes?.ok) sinceRound = (await statusRes.json()).round ?? 0;
+	}
+	const submitRes = await tryApiFetch(`${base}/api/plans`, {
 		method: "POST",
 		headers: { "Content-Type": "application/json" },
 		body: JSON.stringify({
@@ -442,12 +512,13 @@ async function planSubmit(args) {
 			model: values.model
 		})
 	});
-	if (!res.ok) {
-		console.error(`Failed to submit plan: HTTP ${res.status}`);
+	if (!submitRes) return EXIT_NO_SERVER;
+	if (!submitRes.ok) {
+		console.error(`Failed to submit plan: HTTP ${submitRes.status}`);
 		return 1;
 	}
-	const plan = await res.json();
-	console.error(`Submitted plan ${plan.id} (v${plan.version}) — review at ${base}/plan/${plan.id}`);
+	const plan = await submitRes.json();
+	console.error(`Submitted plan ${plan.id} (v${plan.version}) — review at ${appendSessionToken(`${base}/plan/${plan.id}`, activeAuthToken)}`);
 	if (plan.sourcePath) console.error(`Source path: ${plan.sourcePath}`);
 	if (!values.wait) console.error(CLI_PLAN_SUBMIT_PARK_HINT);
 	if (values.saveSource) try {
@@ -463,7 +534,9 @@ async function planSubmit(args) {
 		process.stdout.write(plan.id + "\n");
 		return EXIT_OK;
 	}
-	return pollPlanDecision(base, (values.timeout ? Number(values.timeout) : 570) * 1e3, sinceRound);
+	const timeoutSeconds = parseTimeoutSeconds(values.timeout);
+	if (timeoutSeconds === null) return EXIT_USAGE;
+	return pollPlanDecision(base, timeoutSeconds * 1e3, sinceRound);
 }
 async function planAwait(args) {
 	const { values } = parseArgs({
@@ -474,8 +547,9 @@ async function planAwait(args) {
 		} },
 		allowPositionals: false
 	});
-	const totalBudgetMs = (values.timeout ? Number(values.timeout) : 570) * 1e3;
-	return pollPlanDecision(baseUrl(), totalBudgetMs);
+	const timeoutSeconds = parseTimeoutSeconds(values.timeout);
+	if (timeoutSeconds === null) return EXIT_USAGE;
+	return pollPlanDecision(baseUrl(), timeoutSeconds * 1e3);
 }
 async function planList(args) {
 	const { values } = parseArgs({
@@ -483,7 +557,13 @@ async function planList(args) {
 		options: { json: { type: "boolean" } },
 		allowPositionals: false
 	});
-	const all = await apiFetch(`${baseUrl()}/api/plans`).then((r) => r.json());
+	const res = await tryApiFetch(`${baseUrl()}/api/plans`);
+	if (!res) return EXIT_NO_SERVER;
+	if (!res.ok) {
+		console.error(`Failed to list plans: HTTP ${res.status}`);
+		return 1;
+	}
+	const all = await res.json();
 	if (values.json) {
 		process.stdout.write(JSON.stringify(all, null, 2) + "\n");
 		return EXIT_OK;
@@ -510,18 +590,29 @@ async function planShow(args) {
 	const base = baseUrl();
 	let planId = positionals[0];
 	if (!planId) {
-		const all = await apiFetch(`${base}/api/plans`).then((r) => r.json());
+		const listRes = await tryApiFetch(`${base}/api/plans`);
+		if (!listRes) return EXIT_NO_SERVER;
+		if (!listRes.ok) {
+			console.error(`Failed to list plans: HTTP ${listRes.status}`);
+			return 1;
+		}
+		const all = await listRes.json();
 		if (all.length === 0) {
 			console.error("No plans submitted yet.");
 			return EXIT_NOT_FOUND;
 		}
 		planId = all[all.length - 1].id;
 	}
-	const res = await apiFetch(`${base}/api/plans/${planId}`);
+	const res = await tryApiFetch(`${base}/api/plans/${planId}`);
+	if (!res) return EXIT_NO_SERVER;
 	if (res.status === 404) {
 		console.error(`Plan ${planId} not found.`);
 		return EXIT_NOT_FOUND;
 	}
+	if (!res.ok) {
+		console.error(`Failed to load plan: HTTP ${res.status}`);
+		return 1;
+	}
 	const plan = await res.json();
 	const requestedVersion = values.version !== void 0 ? Number(values.version) : void 0;
 	if (requestedVersion !== void 0 && (!Number.isFinite(requestedVersion) || requestedVersion < 1)) {
@@ -550,11 +641,16 @@ async function planVersions(args) {
 		console.error("Usage: diffing plan versions <id> [--json]");
 		return EXIT_USAGE;
 	}
-	const planRes = await apiFetch(`${base}/api/plans/${planId}`);
+	const planRes = await tryApiFetch(`${base}/api/plans/${planId}`);
+	if (!planRes) return EXIT_NO_SERVER;
 	if (planRes.status === 404) {
 		console.error(`Plan ${planId} not found.`);
 		return EXIT_NOT_FOUND;
 	}
+	if (!planRes.ok) {
+		console.error(`Failed to load plan: HTTP ${planRes.status}`);
+		return 1;
+	}
 	const plan = await planRes.json();
 	const versions = plan.versions ?? [];
 	if (values.json) {
@@ -574,7 +670,9 @@ async function planVersions(args) {
 }
 /** Locate which plan owns a given comment id (comment ids are globally unique). */
 async function findCommentPlan(base, commentId) {
-	return (await apiFetch(`${base}/api/plans`).then((r) => r.json())).find((p) => (p.comments ?? []).some((c) => c.id === commentId)) ?? null;
+	const res = await tryApiFetch(`${base}/api/plans`);
+	if (!res?.ok) return null;
+	return (await res.json()).find((p) => (p.comments ?? []).some((c) => c.id === commentId)) ?? null;
 }
 async function planReply(args) {
 	const { values, positionals } = parseArgs({
@@ -597,7 +695,13 @@ async function planReply(args) {
 		return EXIT_USAGE;
 	}
 	let body = values.body;
-	if (body === "-" || body === void 0) body = (await readStdin()).trim();
+	if (body === void 0) {
+		if (process.stdin.isTTY) {
+			console.error("Usage: diffing plan reply <commentId> --body <text> [--model <name>]");
+			return EXIT_USAGE;
+		}
+		body = (await readStdin()).trim();
+	} else if (body === "-") body = (await readStdin()).trim();
 	if (!body) {
 		console.error("A reply body is required (--body <text> or pipe via stdin).");
 		return EXIT_USAGE;
@@ -608,7 +712,7 @@ async function planReply(args) {
 		console.error(`Plan comment ${commentId} not found.`);
 		return EXIT_NOT_FOUND;
 	}
-	const res = await apiFetch(`${base}/api/plans/${plan.id}/comments/${commentId}/replies`, {
+	const res = await tryApiFetch(`${base}/api/plans/${plan.id}/comments/${commentId}/replies`, {
 		method: "POST",
 		headers: { "Content-Type": "application/json" },
 		body: JSON.stringify({
@@ -617,6 +721,7 @@ async function planReply(args) {
 			model: values.model
 		})
 	});
+	if (!res) return EXIT_NO_SERVER;
 	if (!res.ok) {
 		console.error(`Failed to reply: HTTP ${res.status}`);
 		return 1;
@@ -641,11 +746,12 @@ async function planResolve(args) {
 		console.error(`Plan comment ${commentId} not found.`);
 		return EXIT_NOT_FOUND;
 	}
-	const res = await apiFetch(`${base}/api/plans/${plan.id}/comments/${commentId}`, {
+	const res = await tryApiFetch(`${base}/api/plans/${plan.id}/comments/${commentId}`, {
 		method: "PUT",
 		headers: { "Content-Type": "application/json" },
 		body: JSON.stringify({ status: "resolved" })
 	});
+	if (!res) return EXIT_NO_SERVER;
 	if (!res.ok) {
 		console.error(`Failed to resolve: HTTP ${res.status}`);
 		return 1;
@@ -670,7 +776,7 @@ async function plan(args) {
 	}
 }
 async function doctor() {
-	const { runDoctor, formatDoctorReport } = await import("./doctor-D0Y3kOY7.mjs");
+	const { runDoctor, formatDoctorReport } = await import("./doctor-Bz9VHuBI.mjs");
 	const report = await runDoctor({
 		cwd: process.cwd(),
 		cliImportMetaUrl: import.meta.url
@@ -679,16 +785,20 @@ async function doctor() {
 	return report.ok ? EXIT_OK : 1;
 }
 async function completion(args) {
-	const shell = args[0];
-	if (!shell || args.includes("--help") || args.includes("-h")) {
+	if (args.includes("--help") || args.includes("-h")) {
 		console.error("Usage: diffing completion <bash|zsh|fish>");
 		console.error("  # Install examples:");
 		console.error("  #   diffing completion bash >> ~/.bashrc");
 		console.error("  #   diffing completion zsh  > ~/.zfunc/_diffing");
 		console.error("  #   diffing completion fish > ~/.config/fish/completions/diffing.fish");
+		return EXIT_OK;
+	}
+	const shell = args[0];
+	if (!shell) {
+		console.error("Usage: diffing completion <bash|zsh|fish>");
 		return EXIT_USAGE;
 	}
-	const { completionFor } = await import("./completions-BO2DUM-8.mjs");
+	const { completionFor } = await import("./completions-DvyV49HY.mjs");
 	const script = completionFor(shell);
 	if (!script) {
 		console.error(`Unknown shell: ${shell}. Use bash, zsh, or fish.`);
@@ -788,11 +898,12 @@ Add --pretty for indented JSON. Compact JSON is the token-efficient default.`);
 		return EXIT_USAGE;
 	}
 	const base = baseUrl();
+	const queryString = params.toString();
 	let response;
 	try {
-		response = await apiFetch(`${base}${endpoint}${params.size ? `?${params}` : ""}`);
+		response = await apiFetch(`${base}${endpoint}${queryString ? `?${queryString}` : ""}`);
 	} catch (error) {
-		console.error(`Failed to reach diffing server: ${error?.message ?? error}`);
+		console.error(`Failed to reach diffing server: ${connectionErrorMessage(error)}`);
 		return EXIT_NO_SERVER;
 	}
 	const body = await response.json().catch(() => ({ error: response.statusText }));
@@ -804,7 +915,7 @@ Add --pretty for indented JSON. Compact JSON is the token-efficient default.`);
 	return EXIT_OK;
 }
 async function progress(args) {
-	const { values } = parseArgs({
+	const { values, positionals } = parseArgs({
 		args,
 		options: {
 			message: {
@@ -818,12 +929,12 @@ async function progress(args) {
 		},
 		allowPositionals: true
 	});
-	const message = values.message || (args.find((a) => !a.startsWith("-")) ?? "");
+	const message = values.message || positionals[0] || "";
 	if (!message) {
 		console.error("Usage: diffing progress --message \"Working on comment…\" [--model M] [--pct N]");
 		return EXIT_USAGE;
 	}
-	const res = await apiFetch(`${baseUrl()}/api/agent/progress`, {
+	const res = await tryApiFetch(`${baseUrl()}/api/agent/progress`, {
 		method: "POST",
 		headers: { "Content-Type": "application/json" },
 		body: JSON.stringify({
@@ -834,6 +945,7 @@ async function progress(args) {
 			pct: values.pct != null ? Number(values.pct) : void 0
 		})
 	});
+	if (!res) return EXIT_NO_SERVER;
 	if (!res.ok) {
 		const err = await res.json().catch(() => ({}));
 		console.error(err.error ?? res.statusText);
@@ -852,10 +964,10 @@ async function runSubcommand(name, args) {
 		case "url": return url();
 		case "plan": return plan(args);
 		case "update":
-			const { runUpdateCommand } = await import("./update-check-Copcz9eb.mjs");
+			const { runUpdateCommand } = await import("./update-check-BUfh4Y6c.mjs");
 			return runUpdateCommand();
 		case "gh":
-			const { runGhSubcommand } = await import("./cli-gh-D0NfKpOp.mjs");
+			const { runGhSubcommand } = await import("./cli-gh-DI69gJGo.mjs");
 			return runGhSubcommand(args);
 		case "doctor": return doctor();
 		case "completion": return completion(args);
@@ -863,7 +975,7 @@ async function runSubcommand(name, args) {
 		case "inspect": return inspect(args);
 		case "mode": return mode(args);
 		case "sessions":
-			const { runSessionsCommand } = await import("./session-manager-CYNchhVA.mjs");
+			const { runSessionsCommand } = await import("./session-manager-BKSZQqDJ.mjs");
 			return runSessionsCommand(args);
 		default:
 			console.error(`Unknown subcommand: ${name}`);

package/dist/{cli-gh-D0NfKpOp.mjs → cli-gh-DI69gJGo.mjs}

@@ -1,5 +1,5 @@
 import { t as formatComments } from "./comment-format-B85NHZnG.mjs";
-import { u as resolveActiveServerLock } from "./server-lock-CY0_1mcS.mjs";
+import { h as SESSION_TOKEN_HEADER, u as resolveActiveServerLock } from "./server-lock-BNI8FKV1.mjs";
 import { parseArgs } from "node:util";
 //#region src/cli-gh.ts
 /**
@@ -20,16 +20,27 @@ const EXIT_OK = 0;
 const EXIT_NO_SERVER = 3;
 const EXIT_NOT_FOUND = 4;
 const EXIT_USAGE = 5;
+let activeAuthToken;
 function baseUrl() {
 	const lock = resolveActiveServerLock();
 	if (!lock) {
 		console.error("No diffing server running for this repo. Start one with `diffing \"gh pr <ref>\"`.");
 		process.exit(EXIT_NO_SERVER);
 	}
-	return `http://${lock.host === "0.0.0.0" || lock.host === "::" ? "127.0.0.1" : lock.host}:${lock.port}`;
+	const host = lock.host === "0.0.0.0" || lock.host === "::" ? "127.0.0.1" : lock.host;
+	activeAuthToken = lock.authToken;
+	return `http://${host}:${lock.port}`;
+}
+function apiFetch(input, init = {}) {
+	const headers = new Headers(init.headers);
+	if (activeAuthToken) headers.set(SESSION_TOKEN_HEADER, activeAuthToken);
+	return fetch(input, {
+		...init,
+		headers
+	});
 }
 async function fetchJson(path) {
-	const res = await fetch(`${baseUrl()}${path}`);
+	const res = await apiFetch(`${baseUrl()}${path}`);
 	if (res.status === 404) return {
 		ok: false,
 		status: 404,
@@ -78,14 +89,14 @@ async function ghOverview(args) {
 	return EXIT_OK;
 }
 async function ghStatus() {
-	const overview = await fetch(`${baseUrl()}/api/gh/overview`);
+	const overview = await apiFetch(`${baseUrl()}/api/gh/overview`);
 	if (overview.ok) {
 		const session = await overview.json();
 		const submitted = session.submittedAt ? `submitted ${new Date(session.submittedAt).toISOString()}` : "not submitted";
 		console.log(`PR #${session.pullNumber} ${session.owner}/${session.repo} [${session.headSha.slice(0, 7)}] — ${session.counts.localDrafts} local draft(s), ${session.counts.unresolvedThreads} unresolved thread(s) — ${submitted}`);
 		return EXIT_OK;
 	}
-	const res = await fetch(`${baseUrl()}/api/gh/session`);
+	const res = await apiFetch(`${baseUrl()}/api/gh/session`);
 	if (res.status === 404) {
 		console.error("No active PR session. Start one with `diffing \"gh pr <ref>\"`.");
 		return EXIT_NOT_FOUND;
@@ -138,7 +149,7 @@ async function ghThreads(args) {
 		return EXIT_USAGE;
 	}
 	params.set("format", format);
-	const res = await fetch(`${baseUrl()}/api/gh/threads?${params}`);
+	const res = await apiFetch(`${baseUrl()}/api/gh/threads?${params}`);
 	if (res.status === 404) {
 		console.error("No active PR session.");
 		return EXIT_NOT_FOUND;
@@ -181,7 +192,7 @@ async function ghReviews(args) {
 		return EXIT_USAGE;
 	}
 	params.set("format", format);
-	const res = await fetch(`${baseUrl()}/api/gh/reviews?${params}`);
+	const res = await apiFetch(`${baseUrl()}/api/gh/reviews?${params}`);
 	if (res.status === 404) {
 		console.error("No active PR session.");
 		return EXIT_NOT_FOUND;
@@ -210,8 +221,8 @@ async function ghPrFetch(args) {
 		return EXIT_USAGE;
 	}
 	const base = baseUrl();
-	let res = await fetch(`${base}/api/gh/pr/refresh`, { method: "POST" });
-	if (res.status === 404) res = await fetch(`${base}/api/gh/pr/init`, {
+	let res = await apiFetch(`${base}/api/gh/pr/refresh`, { method: "POST" });
+	if (res.status === 404) res = await apiFetch(`${base}/api/gh/pr/init`, {
 		method: "POST",
 		headers: { "Content-Type": "application/json" },
 		body: JSON.stringify({ ref })
@@ -221,22 +232,21 @@ async function ghPrFetch(args) {
 		console.error(`Failed to fetch PR: ${err.error ?? res.statusText}`);
 		return 1;
 	}
-	const overviewRes = await fetch(`${base}/api/gh/overview`);
+	const overviewRes = await apiFetch(`${base}/api/gh/overview`);
 	if (overviewRes.ok) {
 		const result = await overviewRes.json();
 		if (values.json) process.stdout.write(JSON.stringify(result, null, 2) + "\n");
 		else console.log(`${result.owner}/${result.repo}#${result.pullNumber}  ${result.url}`);
 		return EXIT_OK;
 	}
-	const sessionRes = await fetch(`${base}/api/gh/session`);
+	const sessionRes = await apiFetch(`${base}/api/gh/session`);
 	const result = sessionRes.ok ? await sessionRes.json() : await res.json();
 	if (values.json) process.stdout.write(JSON.stringify(result, null, 2) + "\n");
 	else console.log(`${result.owner}/${result.repo}#${result.pullNumber}  ${result.url}`);
 	return EXIT_OK;
 }
 async function ghPrListComments() {
-	const base = baseUrl();
-	const res = await fetch(`${base}/api/gh/pr-session/comments`);
+	const res = await apiFetch(`${baseUrl()}/api/gh/pr-session/comments`);
 	if (res.status === 404) {
 		console.error("No active PR session.");
 		return EXIT_NOT_FOUND;
@@ -273,7 +283,7 @@ async function ghPrReview(args) {
 		body: values.body ?? "",
 		dryRun: values["dry-run"] === true
 	};
-	const res = await fetch(`${base}/api/gh/submit`, {
+	const res = await apiFetch(`${base}/api/gh/submit`, {
 		method: "POST",
 		headers: { "Content-Type": "application/json" },
 		body: JSON.stringify(payload)