diffing 0.17.0 → 0.18.1

package/dist/{cli-agent-qNwkSjxK.mjs → cli-agent-Cf6SAnH4.mjs}

@@ -1,13 +1,13 @@
-import { f as getProjectStorageDir } from "./git-BGj31GX-.mjs";
+import { f as getProjectStorageDir, h as getRepoRoot } from "./git-BGj31GX-.mjs";
 import { i as loadSettings, n as formatModeLabel, s as saveSettings } from "./settings-DkPDB_hS.mjs";
-import { t as formatComments } from "./comment-format-B85NHZnG.mjs";
-import { n as formatPlanReview } from "./plan-format-BwJh5JSE.mjs";
+import { f as slugifyScreenId, r as formatPlanReview, t as formatMockupReview } from "./mockup-format-D4Ln0WxJ.mjs";
+import { t as formatComments } from "./comment-format-D4mCqr7T.mjs";
 import { u as resolveActiveServerLock, x as SESSION_TOKEN_HEADER } from "./server-lock-CdaUNZyX.mjs";
 import { i as reviewSessionUrl, t as appendSessionToken } from "./session-url-B9FOnF3F.mjs";
 import { a as CLI_AWAIT_REVIEW_TIMEOUT_HINT, i as CLI_AWAIT_PLAN_TIMEOUT_HINT, o as CLI_PLAN_SUBMIT_PARK_HINT } from "./handoff-DcShCxWJ.mjs";
-import { join } from "node:path";
+import { basename, join, resolve } from "node:path";
 import { parseArgs } from "node:util";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
 //#region src/cli-agent.ts
 /**
 * Agent-facing `diffing` subcommands. These make the user→agent handoff
@@ -48,6 +48,17 @@ function baseUrl() {
 }
 /** Attach session credentials while preserving ordinary web calls. */
 function apiFetch(input, init = {}) {
+	let target;
+	try {
+		target = new URL(input instanceof Request ? input.url : input instanceof URL ? input.href : input);
+	} catch {
+		return Promise.reject(/* @__PURE__ */ new Error("Invalid diffing API URL"));
+	}
+	if (![
+		"127.0.0.1",
+		"localhost",
+		"::1"
+	].includes(target.hostname)) throw new Error(`Refusing non-loopback diffing API URL: ${target.origin}`);
 	const headers = new Headers(init.headers);
 	if (activeCapability) headers.set("X-Diffing-Capability", activeCapability);
 	if (activeAuthToken) headers.set(SESSION_TOKEN_HEADER, activeAuthToken);
@@ -379,7 +390,7 @@ async function comments(args) {
 	}
 	if (values.json || format === "json") process.stdout.write(JSON.stringify(selected, null, 2) + "\n");
 	else if (format === "markdown" || format === "md") {
-		const { formatCommentsMarkdown } = await import("./review-export-GW4KNsGN.mjs");
+		const { formatCommentsMarkdown } = await import("./review-export-DoST2oPt.mjs");
 		process.stdout.write(formatCommentsMarkdown(selected) + "\n");
 	} else process.stdout.write(formatComments(selected) + "\n");
 	return EXIT_OK;
@@ -623,7 +634,7 @@ async function planShow(args) {
 		return 1;
 	}
 	const plan = await res.json();
-	const requestedVersion = values.version !== void 0 ? Number(values.version) : void 0;
+	const requestedVersion = values.version === void 0 ? void 0 : Number(values.version);
 	if (requestedVersion !== void 0 && (!Number.isFinite(requestedVersion) || requestedVersion < 1)) {
 		console.error(`--version must be a positive integer.`);
 		return EXIT_USAGE;
@@ -645,7 +656,7 @@ async function planVersions(args) {
 		allowPositionals: true
 	});
 	const base = baseUrl();
-	let planId = positionals[0];
+	const planId = positionals[0];
 	if (!planId) {
 		console.error("Usage: diffing plan versions <id> [--json]");
 		return EXIT_USAGE;
@@ -833,7 +844,7 @@ See docs/getting-started.md for the full walkthrough.`);
 		console.error(`Unknown setup action: ${action}`);
 		return EXIT_USAGE;
 	}
-	const { runSetup } = await import("./setup-BnS_rSxK.mjs");
+	const { runSetup } = await import("./setup-BwWZ9Fzq.mjs");
 	return runSetup({
 		yes,
 		check,
@@ -869,7 +880,7 @@ async function completion(args) {
 		console.error("Usage: diffing completion <bash|zsh|fish>");
 		return EXIT_USAGE;
 	}
-	const { completionFor } = await import("./completions-5rtfoxB9.mjs");
+	const { completionFor } = await import("./completions-CYa5usLb.mjs");
 	const script = completionFor(shell);
 	if (!script) {
 		console.error(`Unknown shell: ${shell}. Use bash, zsh, or fish.`);
@@ -1021,7 +1032,7 @@ async function progress(args) {
 			model: values.model,
 			agentId: values["agent-id"],
 			commentId: values["comment-id"],
-			pct: values.pct != null ? Number(values.pct) : void 0
+			pct: values.pct == null ? void 0 : Number(values.pct)
 		})
 	});
 	if (!res) return EXIT_NO_SERVER;
@@ -1032,6 +1043,720 @@ async function progress(args) {
 	}
 	return EXIT_OK;
 }
+const CLI_MOCKUP_SUBMIT_PARK_HINT = "Async handoff: share the URL above. Use --wait / `diffing mockup await` only when the human is reviewing now or asked you to block.";
+async function pollMockupDecision(base, timeoutMs, sinceRound = 0) {
+	const deadline = Date.now() + timeoutMs;
+	while (Date.now() < deadline) {
+		const remaining = Math.max(deadline - Date.now(), 0);
+		const res = await tryApiFetch(`${base}/api/mockup-review/await?sinceRound=${sinceRound}&timeoutMs=${Math.min(remaining, 25e3)}`);
+		if (!res) return EXIT_NO_SERVER;
+		if (!res.ok) {
+			console.error(`Failed to await mockup review: HTTP ${res.status}`);
+			return 1;
+		}
+		const result = await res.json();
+		if (result.status === "released" && result.payload) {
+			if (result.payload.reviewXml) process.stdout.write(result.payload.reviewXml + "\n");
+			console.error(`DIFFING_MOCKUP_DECISION=${result.payload.decision}`);
+			console.error(`DIFFING_MOCKUP_ROUND=${result.payload.round}`);
+			return EXIT_OK;
+		}
+		sinceRound = result.round ?? sinceRound;
+	}
+	console.error("DIFFING_MOCKUP_AWAIT_TIMEOUT");
+	return EXIT_AWAIT_TIMEOUT;
+}
+async function screensFromCli(file, screenFlags) {
+	if (screenFlags && screenFlags.length > 0) {
+		const screens = [];
+		for (const flag of screenFlags) {
+			const eq = flag.indexOf("=");
+			if (eq <= 0) return { error: `--screen must be id=path (got ${flag})` };
+			const id = slugifyScreenId(flag.slice(0, eq));
+			if (!id) return { error: `Invalid screen id in ${flag}` };
+			const path = resolve(flag.slice(eq + 1));
+			try {
+				const html = (await readFile(path, "utf-8")).replace(/\r\n/g, "\n");
+				screens.push({
+					id,
+					html
+				});
+			} catch (err) {
+				return { error: `Failed to read ${path}: ${err?.message ?? err}` };
+			}
+		}
+		return { screens };
+	}
+	if (!file || file === "-") {
+		const html = (await readStdin()).replace(/\r\n/g, "\n");
+		if (!html.trim()) return { error: "A mockup HTML body is required (file, dir, --screen, or stdin)." };
+		return { html };
+	}
+	const abs = resolve(file);
+	let st;
+	try {
+		st = await stat(abs);
+	} catch (err) {
+		return { error: `Failed to read ${file}: ${err?.message ?? err}` };
+	}
+	if (st.isDirectory()) {
+		const names = (await readdir(abs)).filter((n) => /\.html?$/i.test(n));
+		names.sort((a, b) => {
+			if (a.toLowerCase() === "index.html") return -1;
+			if (b.toLowerCase() === "index.html") return 1;
+			return a.localeCompare(b);
+		});
+		if (names.length === 0) return { error: `No HTML files in ${abs}` };
+		const screens = [];
+		for (const name of names) {
+			const id = slugifyScreenId(name);
+			if (!id) continue;
+			const html = (await readFile(join(abs, name), "utf-8")).replace(/\r\n/g, "\n");
+			screens.push({
+				id,
+				html
+			});
+		}
+		if (screens.length === 0) return { error: `No valid screen ids in ${abs}` };
+		return {
+			screens,
+			source: abs
+		};
+	}
+	const html = (await readFile(abs, "utf-8")).replace(/\r\n/g, "\n");
+	if (!html.trim()) return { error: `Empty HTML file ${file}` };
+	return {
+		html,
+		source: abs
+	};
+}
+function warnMockupPathsInRepo(paths) {
+	let root;
+	try {
+		root = getRepoRoot();
+	} catch {
+		return;
+	}
+	const storage = getProjectStorageDir();
+	const rootPrefix = root.endsWith("/") ? root : `${root}/`;
+	const storagePrefix = storage.endsWith("/") ? storage : `${storage}/`;
+	for (const raw of paths) {
+		const abs = resolve(raw);
+		if (abs === storage || abs.startsWith(storagePrefix)) continue;
+		if (abs === root || abs.startsWith(rootPrefix)) console.error(`Warning: ${abs} is inside the consumer repo. Never write diffing mockups into the working tree. Submit HTML via stdin or MCP submit_mockup({ html }), or stage files under ${storage}/mockup-sources/.`);
+	}
+}
+async function mockupSubmit(args) {
+	const { values, positionals } = parseArgs({
+		args,
+		options: {
+			title: { type: "string" },
+			source: {
+				type: "string",
+				short: "s"
+			},
+			model: {
+				type: "string",
+				short: "m"
+			},
+			id: { type: "string" },
+			wait: {
+				type: "boolean",
+				short: "w"
+			},
+			timeout: {
+				type: "string",
+				short: "t"
+			},
+			screen: {
+				type: "string",
+				multiple: true
+			}
+		},
+		allowPositionals: true
+	});
+	warnMockupPathsInRepo([...positionals[0] && positionals[0] !== "-" ? [positionals[0]] : [], ...(values.screen ?? []).map((flag) => {
+		const eq = flag.indexOf("=");
+		return eq > 0 ? flag.slice(eq + 1) : "";
+	}).filter(Boolean)]);
+	const parsed = await screensFromCli(positionals[0], values.screen);
+	if (parsed.error) {
+		console.error(parsed.error);
+		return EXIT_USAGE;
+	}
+	const title = values.title || (positionals[0] && positionals[0] !== "-" ? basename(positionals[0]).replace(/\.html?$/i, "") : "Untitled mockup");
+	const base = baseUrl();
+	let sinceRound = 0;
+	if (values.wait) {
+		const statusRes = await tryApiFetch(`${base}/api/mockup-review/status`);
+		if (statusRes?.ok) sinceRound = (await statusRes.json()).round ?? 0;
+	}
+	const submitRes = await tryApiFetch(`${base}/api/mockups`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({
+			id: values.id,
+			title,
+			html: parsed.html,
+			screens: parsed.screens,
+			source: values.source || parsed.source,
+			model: values.model
+		})
+	});
+	if (!submitRes) return EXIT_NO_SERVER;
+	if (!submitRes.ok) {
+		const err = await submitRes.json().catch(() => ({ error: `HTTP ${submitRes.status}` }));
+		console.error(`Failed to submit mockup: ${err.error ?? `HTTP ${submitRes.status}`}`);
+		return 1;
+	}
+	const mockup = await submitRes.json();
+	console.error(`Submitted mockup ${mockup.id} (v${mockup.version}) — review at ${appendSessionToken(`${base}/mockup/${mockup.id}`, activeAuthToken)}`);
+	if (mockup.sourcePath) console.error(`Source path: ${mockup.sourcePath}`);
+	if (!values.wait) {
+		console.error(CLI_MOCKUP_SUBMIT_PARK_HINT);
+		process.stdout.write(mockup.id + "\n");
+		return EXIT_OK;
+	}
+	const timeoutSeconds = parseTimeoutSeconds(values.timeout);
+	if (timeoutSeconds === null) return EXIT_USAGE;
+	return pollMockupDecision(base, timeoutSeconds * 1e3, sinceRound);
+}
+async function mockupAwait(args) {
+	const { values } = parseArgs({
+		args,
+		options: { timeout: {
+			type: "string",
+			short: "t"
+		} },
+		allowPositionals: false
+	});
+	const timeoutSeconds = parseTimeoutSeconds(values.timeout);
+	if (timeoutSeconds === null) return EXIT_USAGE;
+	return pollMockupDecision(baseUrl(), timeoutSeconds * 1e3);
+}
+async function mockupList(args) {
+	const { values } = parseArgs({
+		args,
+		options: { json: { type: "boolean" } },
+		allowPositionals: false
+	});
+	const res = await tryApiFetch(`${baseUrl()}/api/mockups`);
+	if (!res) return EXIT_NO_SERVER;
+	if (!res.ok) {
+		console.error(`Failed to list mockups: HTTP ${res.status}`);
+		return 1;
+	}
+	const all = await res.json();
+	if (values.json) {
+		process.stdout.write(JSON.stringify(all, null, 2) + "\n");
+		return EXIT_OK;
+	}
+	if (all.length === 0) {
+		console.error("No mockups submitted yet.");
+		return EXIT_OK;
+	}
+	for (const m of all) {
+		const open = (m.comments ?? []).filter((c) => c.status === "open").length;
+		process.stdout.write(`${m.id}\t[${m.decision}]\tv${m.version}\t${m.screens.length} screen(s)\t${open} open\t${m.title}\n`);
+	}
+	return EXIT_OK;
+}
+async function mockupShow(args) {
+	const { values, positionals } = parseArgs({
+		args,
+		options: {
+			json: { type: "boolean" },
+			version: { type: "string" }
+		},
+		allowPositionals: true
+	});
+	const base = baseUrl();
+	let mockupId = positionals[0];
+	if (!mockupId) {
+		const listRes = await tryApiFetch(`${base}/api/mockups`);
+		if (!listRes) return EXIT_NO_SERVER;
+		const all = listRes.ok ? await listRes.json() : [];
+		if (all.length === 0) {
+			console.error("No mockups submitted yet.");
+			return EXIT_NOT_FOUND;
+		}
+		mockupId = all[all.length - 1].id;
+	}
+	const res = await tryApiFetch(`${base}/api/mockups/${mockupId}`);
+	if (!res) return EXIT_NO_SERVER;
+	if (res.status === 404) {
+		console.error(`Mockup ${mockupId} not found.`);
+		return EXIT_NOT_FOUND;
+	}
+	if (!res.ok) {
+		console.error(`Failed to load mockup: HTTP ${res.status}`);
+		return 1;
+	}
+	const mockup = await res.json();
+	const requestedVersion = values.version === void 0 ? void 0 : Number(values.version);
+	if (requestedVersion !== void 0 && (!Number.isFinite(requestedVersion) || requestedVersion < 1)) {
+		console.error(`--version must be a positive integer.`);
+		return EXIT_USAGE;
+	}
+	if (values.json) process.stdout.write(JSON.stringify(mockup, null, 2) + "\n");
+	else process.stdout.write(formatMockupReview(mockup, { viewingVersion: requestedVersion }) + "\n");
+	return EXIT_OK;
+}
+async function mockupVersions(args) {
+	const { values, positionals } = parseArgs({
+		args,
+		options: { json: { type: "boolean" } },
+		allowPositionals: true
+	});
+	const id = positionals[0];
+	if (!id) {
+		console.error("Usage: diffing mockup versions <id>");
+		return EXIT_USAGE;
+	}
+	const res = await tryApiFetch(`${baseUrl()}/api/mockups/${id}/versions`);
+	if (!res) return EXIT_NO_SERVER;
+	if (res.status === 404) {
+		console.error(`Mockup ${id} not found.`);
+		return EXIT_NOT_FOUND;
+	}
+	if (!res.ok) {
+		console.error(`Failed to list versions: HTTP ${res.status}`);
+		return 1;
+	}
+	const versions = await res.json();
+	if (values.json) {
+		process.stdout.write(JSON.stringify(versions, null, 2) + "\n");
+		return EXIT_OK;
+	}
+	for (const v of versions) process.stdout.write(`v${v.version}\t${v.title}\n`);
+	return EXIT_OK;
+}
+async function mockupReply(args) {
+	const { values, positionals } = parseArgs({
+		args,
+		options: {
+			body: {
+				type: "string",
+				short: "b"
+			},
+			model: {
+				type: "string",
+				short: "m"
+			}
+		},
+		allowPositionals: true
+	});
+	const commentId = positionals[0];
+	if (!commentId) {
+		console.error("Usage: diffing mockup reply <comment-id> --body \"...\"");
+		return EXIT_USAGE;
+	}
+	let body = values.body;
+	if (!body) body = await readStdin();
+	if (!body?.trim()) {
+		console.error("A reply body is required (--body or stdin).");
+		return EXIT_USAGE;
+	}
+	const listRes = await tryApiFetch(`${baseUrl()}/api/mockups?include=comments`);
+	if (!listRes) return EXIT_NO_SERVER;
+	const mockup = (listRes.ok ? await listRes.json() : []).find((m) => (m.comments ?? []).some((c) => c.id === commentId));
+	if (!mockup) {
+		console.error(`Comment ${commentId} not found.`);
+		return EXIT_NOT_FOUND;
+	}
+	const res = await tryApiFetch(`${baseUrl()}/api/mockups/${mockup.id}/comments/${commentId}/replies`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({
+			body,
+			model: values.model,
+			role: "agent"
+		})
+	});
+	if (!res) return EXIT_NO_SERVER;
+	if (!res.ok) {
+		console.error(`Failed to reply: HTTP ${res.status}`);
+		return 1;
+	}
+	return EXIT_OK;
+}
+async function mockupResolve(args) {
+	const { positionals } = parseArgs({
+		args,
+		allowPositionals: true
+	});
+	const commentId = positionals[0];
+	if (!commentId) {
+		console.error("Usage: diffing mockup resolve <comment-id>");
+		return EXIT_USAGE;
+	}
+	const listRes = await tryApiFetch(`${baseUrl()}/api/mockups?include=comments`);
+	if (!listRes) return EXIT_NO_SERVER;
+	const mockup = (listRes.ok ? await listRes.json() : []).find((m) => (m.comments ?? []).some((c) => c.id === commentId));
+	if (!mockup) {
+		console.error(`Comment ${commentId} not found.`);
+		return EXIT_NOT_FOUND;
+	}
+	const res = await tryApiFetch(`${baseUrl()}/api/mockups/${mockup.id}/comments/${commentId}`, {
+		method: "PUT",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({ status: "resolved" })
+	});
+	if (!res) return EXIT_NO_SERVER;
+	if (!res.ok) {
+		console.error(`Failed to resolve: HTTP ${res.status}`);
+		return 1;
+	}
+	return EXIT_OK;
+}
+async function latestMockupId(base) {
+	const listRes = await tryApiFetch(`${base}/api/mockups`);
+	if (!listRes || !listRes.ok) return null;
+	const all = await listRes.json();
+	if (all.length === 0) return null;
+	return all[all.length - 1].id;
+}
+async function mockupOpErrorMessage(res) {
+	const body = await res.json().catch(() => ({}));
+	if (body.code === "version-mismatch") return `Mockup version mismatch: current v${body.currentVersion}, expected v${body.expectedVersion}. Retry with --expected-version ${body.currentVersion}.`;
+	return body.error ?? `HTTP ${res.status}`;
+}
+async function mockupInspect(args) {
+	const { values, positionals } = parseArgs({
+		args,
+		options: {
+			status: { type: "string" },
+			screen: { type: "string" },
+			viewport: { type: "string" },
+			version: { type: "string" },
+			id: { type: "string" },
+			cursor: { type: "string" },
+			limit: { type: "string" },
+			context: { type: "string" },
+			pretty: { type: "boolean" }
+		},
+		allowPositionals: true
+	});
+	const [view, mockupArg, ...extra] = positionals;
+	if (!view || ![
+		"summary",
+		"comments",
+		"comment",
+		"screen"
+	].includes(view) || extra.length > 0) {
+		console.error(`Usage: diffing mockup inspect <summary|comments|comment|screen> [mockup-id] [options]
+
+Read bounded mockup data as compact JSON (add --pretty for indented output).
+  summary  [mockup-id]                          — headline stats + screen list
+  comments [mockup-id] [--status open|resolved] [--screen S] [--viewport desktop|tablet|mobile] [--version N] [--cursor N] [--limit N] [--context none|anchor|source]
+  comment  [mockup-id] --id <comment-id> [--context none|anchor|source]
+  screen   [mockup-id] [--cursor N] [--limit N]
+
+context: none = metadata only; anchor = + locator fields (default); source = + contextHtml.`);
+		return EXIT_USAGE;
+	}
+	const base = baseUrl();
+	let mockupId = mockupArg;
+	if (!mockupId) {
+		mockupId = await latestMockupId(base) ?? "";
+		if (!mockupId) {
+			console.error("No mockups submitted yet.");
+			return EXIT_NOT_FOUND;
+		}
+	}
+	const params = new URLSearchParams();
+	params.set("view", view);
+	const numeric = (flag, name) => {
+		const value = values[flag];
+		if (typeof value !== "string") return true;
+		if (!/^\d+$/.test(value)) {
+			console.error(`--${name} must be a non-negative integer`);
+			return false;
+		}
+		params.set(name, value);
+		return true;
+	};
+	if (!numeric("cursor", "cursor")) return EXIT_USAGE;
+	if (!numeric("limit", "limit")) return EXIT_USAGE;
+	if (!numeric("version", "version")) return EXIT_USAGE;
+	const str = (flag, name) => {
+		const value = values[flag];
+		if (typeof value === "string") params.set(name, value);
+	};
+	str("status", "status");
+	str("screen", "screen");
+	str("viewport", "viewport");
+	str("id", "id");
+	str("context", "context");
+	const res = await tryApiFetch(`${base}/api/mockups/${encodeURIComponent(mockupId)}/inspect?${params.toString()}`);
+	if (!res) return EXIT_NO_SERVER;
+	if (res.status === 404) {
+		console.error(`Mockup ${mockupId} not found.`);
+		return EXIT_NOT_FOUND;
+	}
+	if (!res.ok) {
+		const err = await res.json().catch(() => ({}));
+		console.error(err.error ?? `HTTP ${res.status}`);
+		return 1;
+	}
+	const data = await res.json();
+	process.stdout.write(JSON.stringify(data, null, values.pretty ? 2 : void 0) + "\n");
+	return EXIT_OK;
+}
+async function mockupScreenCmd(args) {
+	const { values, positionals } = parseArgs({
+		args,
+		options: {
+			file: { type: "string" },
+			text: { type: "string" },
+			replacement: { type: "string" },
+			label: { type: "string" },
+			"expected-version": { type: "string" }
+		},
+		allowPositionals: true
+	});
+	const [action, mockupId, screenId, ...extra] = positionals;
+	if (!action || ![
+		"upsert",
+		"remove",
+		"patch"
+	].includes(action) || !mockupId || !screenId || extra.length > 0) {
+		console.error(`Usage: diffing mockup screen <upsert|remove|patch> <mockup-id> <screen-id> [options]
+
+One-screen revision. Version bumps on success; an --expected-version guard aborts with
+409 (no change) when the mockup moved on.
+  upsert <id> <screen-id> --file <path> [--label L] [--expected-version N]   # --file - = stdin
+  remove <id> <screen-id> [--expected-version N]
+  patch  <id> <screen-id> --text <exact-text> --replacement <new-text> [--expected-version N]`);
+		return EXIT_USAGE;
+	}
+	let expectedVersion;
+	if (values["expected-version"] !== void 0) {
+		if (!/^\d+$/.test(values["expected-version"])) {
+			console.error("--expected-version must be a positive integer");
+			return EXIT_USAGE;
+		}
+		expectedVersion = Number(values["expected-version"]);
+	}
+	const base = baseUrl();
+	if (action === "upsert") {
+		let html;
+		const file = values.file;
+		if (!file || file === "-") html = (await readStdin()).replace(/\r\n/g, "\n");
+		else try {
+			html = (await readFile(resolve(file), "utf-8")).replace(/\r\n/g, "\n");
+		} catch (err) {
+			console.error(`Failed to read ${file}: ${err?.message ?? err}`);
+			return EXIT_USAGE;
+		}
+		if (!html.trim()) {
+			console.error("Screen html is required (--file <path> or stdin).");
+			return EXIT_USAGE;
+		}
+		const res = await tryApiFetch(`${base}/api/mockups/${encodeURIComponent(mockupId)}/screens/${encodeURIComponent(screenId)}`, {
+			method: "PUT",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				html,
+				label: values.label,
+				expectedVersion
+			})
+		});
+		if (!res) return EXIT_NO_SERVER;
+		if (!res.ok) {
+			console.error(await mockupOpErrorMessage(res));
+			return res.status === 404 ? EXIT_NOT_FOUND : 1;
+		}
+		const mockup = await res.json();
+		console.error(`Upserted screen ${screenId} on ${mockupId} → v${mockup.version} (${mockup.screens.length} screens).`);
+		return EXIT_OK;
+	}
+	if (action === "remove") {
+		const qs = expectedVersion === void 0 ? "" : `?expectedVersion=${expectedVersion}`;
+		const res = await tryApiFetch(`${base}/api/mockups/${encodeURIComponent(mockupId)}/screens/${encodeURIComponent(screenId)}${qs}`, { method: "DELETE" });
+		if (!res) return EXIT_NO_SERVER;
+		if (!res.ok) {
+			console.error(await mockupOpErrorMessage(res));
+			return res.status === 404 ? EXIT_NOT_FOUND : 1;
+		}
+		const mockup = await res.json();
+		console.error(`Removed screen ${screenId} from ${mockupId} → v${mockup.version}.`);
+		return EXIT_OK;
+	}
+	const text = values.text;
+	const replacement = values.replacement;
+	if (!text || replacement === void 0) {
+		console.error("patch requires --text <exact-text> and --replacement <new-text>");
+		return EXIT_USAGE;
+	}
+	const res = await tryApiFetch(`${base}/api/mockups/${encodeURIComponent(mockupId)}/screens/${encodeURIComponent(screenId)}`, {
+		method: "PATCH",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({
+			expectedText: text,
+			replacement,
+			expectedVersion
+		})
+	});
+	if (!res) return EXIT_NO_SERVER;
+	if (!res.ok) {
+		console.error(await mockupOpErrorMessage(res));
+		return res.status === 404 ? EXIT_NOT_FOUND : 1;
+	}
+	const data = await res.json();
+	console.error(`Patched ${screenId} on ${mockupId} (${data.occurrences} exact match(es)) → v${data.mockup.version}.`);
+	return EXIT_OK;
+}
+async function mockupThreadsCmd(args) {
+	const { values, positionals } = parseArgs({
+		args,
+		options: {
+			body: {
+				type: "string",
+				short: "b"
+			},
+			model: {
+				type: "string",
+				short: "m"
+			},
+			id: { type: "string" }
+		},
+		allowPositionals: true
+	});
+	const [action, commentId, replyId, ...extra] = positionals;
+	if (!(typeof action === "string" && [
+		"reply",
+		"edit",
+		"delete",
+		"resolve",
+		"unresolve"
+	].includes(action)) || !commentId || extra.length > 0) {
+		console.error(`Usage: diffing mockup threads <reply|edit|delete|resolve|unresolve> ...
+
+Atomic thread ops — each call is validated before apply through the batch endpoint.
+  reply <comment-id> --body "..." [--model M] [--id mockup-id]
+  edit <comment-id> [<reply-id>] --body "..."   # with reply-id: edit the reply; without: edit the comment body
+  delete <comment-id> [<reply-id>]    # with reply-id: delete the reply; without: delete the comment
+  resolve <comment-id>
+  unresolve <comment-id>`);
+		return EXIT_USAGE;
+	}
+	let body = values.body;
+	if (action === "reply" || action === "edit") {
+		if (body === void 0) {
+			if (process.stdin.isTTY) {
+				console.error(`threads ${action}: a body is required (--body <text> or stdin)`);
+				return EXIT_USAGE;
+			}
+			body = (await readStdin()).trim();
+		} else if (body === "-") body = (await readStdin()).trim();
+		if (!body?.trim()) {
+			console.error(`threads ${action}: a body is required (--body <text> or stdin)`);
+			return EXIT_USAGE;
+		}
+	}
+	const base = baseUrl();
+	let mockupId = values.id;
+	if (!mockupId) {
+		const listRes = await tryApiFetch(`${base}/api/mockups?include=comments`);
+		if (!listRes) return EXIT_NO_SERVER;
+		const found = (listRes.ok ? await listRes.json() : []).find((m) => (m.comments ?? []).some((c) => c.id === commentId));
+		if (!found) {
+			console.error(`Comment ${commentId} not found.`);
+			return EXIT_NOT_FOUND;
+		}
+		mockupId = found.id;
+	}
+	const operations = [];
+	if (action === "reply") operations.push({
+		op: action,
+		commentId,
+		body,
+		role: "agent",
+		model: values.model
+	});
+	else if (action === "edit") operations.push(replyId ? {
+		op: action,
+		commentId,
+		replyId,
+		body
+	} : {
+		op: action,
+		commentId,
+		body
+	});
+	else if (action === "delete") operations.push(replyId ? {
+		op: action,
+		commentId,
+		replyId
+	} : {
+		op: action,
+		commentId
+	});
+	else operations.push({
+		op: action,
+		commentId
+	});
+	const res = await tryApiFetch(`${base}/api/mockups/${encodeURIComponent(mockupId)}/threads/batch`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({ operations })
+	});
+	if (!res) return EXIT_NO_SERVER;
+	if (!res.ok) {
+		const err = await res.json().catch(() => ({}));
+		console.error(err.error ?? `HTTP ${res.status}`);
+		return res.status === 404 ? EXIT_NOT_FOUND : 1;
+	}
+	const newReplyId = (await res.json()).results[0]?.replyId;
+	if (action === "reply") console.error(`Replied to ${commentId}${newReplyId ? ` (${newReplyId})` : ""}.`);
+	else if (action === "edit") console.error(replyId ? `Edited reply ${replyId}.` : `Edited comment ${commentId}.`);
+	else if (action === "delete") console.error(replyId ? `Deleted reply ${replyId}.` : `Deleted comment ${commentId}.`);
+	else if (action === "resolve") console.error(`Resolved ${commentId}.`);
+	else console.error(`Re-opened ${commentId}.`);
+	return EXIT_OK;
+}
+async function mockupCommand(args) {
+	const action = args[0];
+	const rest = args.slice(1);
+	if (args.includes("--help") || args.includes("-h") || !action) {
+		console.log(`Usage: diffing mockup <submit|await|list|show|versions|reply|resolve|inspect|screen|threads> [options]
+
+Submit HTML mockups for visual review. Same loop as plan review.
+Never write mockup HTML into the consumer git tree. Prefer stdin or MCP inline html.
+Staging files, if needed, go under ~/.diffing/<repo>/mockup-sources/ only.
+One state per screen: never tabs/accordions/toggles/modals/JS content-swapping — each variant is a separate screen.
+
+  submit [-] [--title T] [--screen id=path]... [--id ID] [--model M] [--wait]
+         # or a path already under ~/.diffing/.../mockup-sources/
+  await [--timeout N]
+  list [--json]
+  show [<id>] [--json] [--version N]
+  versions <id> [--json]
+  reply <comment-id> --body "..." [--model M]
+  resolve <comment-id>
+  inspect <summary|comments|comment|screen> [<id>] [--status S] [--screen S] [--viewport V] [--version N] [--id C] [--cursor N] [--limit N] [--context none|anchor|source] [--pretty]
+  screen <upsert|remove|patch> <id> <screen-id> [--file P] [--text T] [--replacement R] [--expected-version N]
+  threads <reply|edit|delete|resolve|unresolve> <comment-id> [<reply-id>] [--body "..."] [--model M] [--id mockup-id]
+`);
+		return EXIT_OK;
+	}
+	switch (action) {
+		case "submit": return mockupSubmit(rest);
+		case "await": return mockupAwait(rest);
+		case "list": return mockupList(rest);
+		case "show": return mockupShow(rest);
+		case "versions": return mockupVersions(rest);
+		case "reply": return mockupReply(rest);
+		case "resolve": return mockupResolve(rest);
+		case "inspect": return mockupInspect(rest);
+		case "screen": return mockupScreenCmd(rest);
+		case "threads": return mockupThreadsCmd(rest);
+		default:
+			console.error(`Unknown mockup action: ${action}`);
+			return EXIT_USAGE;
+	}
+}
 async function runSubcommand(name, args) {
 	switch (name) {
 		case "await-review": return awaitReview(args);
@@ -1042,21 +1767,25 @@ async function runSubcommand(name, args) {
 		case "comments": return comments(args);
 		case "url": return url();
 		case "plan": return plan(args);
-		case "update":
+		case "mockup": return mockupCommand(args);
+		case "update": {
 			const { runUpdateCommand } = await import("./update-check-ISaw61qS.mjs");
 			return runUpdateCommand();
-		case "gh":
-			const { runGhSubcommand } = await import("./cli-gh-BvoDabKK.mjs");
+		}
+		case "gh": {
+			const { runGhSubcommand } = await import("./cli-gh-2NEumKQB.mjs");
 			return runGhSubcommand(args);
+		}
 		case "doctor": return doctor();
 		case "setup": return setup(args);
 		case "completion": return completion(args);
 		case "progress": return progress(args);
 		case "inspect": return inspect(args);
 		case "mode": return mode(args);
-		case "sessions":
+		case "sessions": {
 			const { runSessionsCommand } = await import("./session-manager-CUqF8hkP.mjs");
 			return runSessionsCommand(args);
+		}
 		default:
 			console.error(`Unknown subcommand: ${name}`);
 			return EXIT_USAGE;