dsh-diff-approval 0.7.0 → 0.9.0

package/lib/index.js

@@ -1,9 +1,10 @@
 import { randomUUID } from "node:crypto";
 import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
-import { dirname, join, resolve } from "node:path";
+import { dirname, join, resolve, sep } from "node:path";
 import { dshHomePath, expandHomePath } from "@deepseek-ai/dsh-home-paths";
 import { SessionId } from "@deepseek-ai/dsh-session";
 import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
 //#region lib/types/pending.js
 /**
 * In-memory pending-diff store: one entry per (session, path), holding the
@@ -130,6 +131,31 @@ var PendingDiffStore = class {
 		this.entries.set(key, next);
 		return true;
 	}
+	/**
+	* Restore one entry exactly as given (an undo/redo replays a snapshot). The
+	* entry is inserted or replaced by id, and the path index points at it so a
+	* later capture folds into the restored entry. The store keeps one entry per
+	* path: restoring an entry for a path that a DIFFERENT entry currently owns
+	* drops that occupant first, so an undo can never leave two list items for
+	* the same file (e.g. an imported entry and a replayed keep of the same path).
+	* @param sessionId - the owning session.
+	* @param entry - the entry state to restore.
+	* @returns whether the store changed.
+	*/
+	restore(sessionId, entry) {
+		const key = entryKey(sessionId, entry.id);
+		const existing = this.entries.get(key);
+		if (existing !== void 0 && sameEntry(existing, entry)) return false;
+		const pathKey_ = pathKey(sessionId, entry.path);
+		const occupantId = this.pathIndex.get(pathKey_);
+		if (occupantId !== void 0 && occupantId !== entry.id) this.entries.delete(entryKey(sessionId, occupantId));
+		this.entries.set(key, {
+			...entry,
+			sessionId
+		});
+		this.pathIndex.set(pathKey_, entry.id);
+		return true;
+	}
 	/** Total entry count across all sessions. */
 	get size() {
 		return this.entries.size;
@@ -364,6 +390,263 @@ function defaultOpenPath(path, action) {
 	}
 }
 //#endregion
+//#region lib/types/vcs.js
+/**
+* Version-control integration, host half: detect which VCS (git/svn/p4)
+* encloses a workspace by walking up the directory tree, and enumerate the
+* workspace's LOCAL changes for import into the pending list. The workspace
+* is often a subdirectory of the VCS root, so the root is found by walking up
+* from the workspace path and the imported changes are filtered to files
+* inside the workspace. Commands run through the deployment's `ctx.shell`
+* executor (applying its sandbox/policy) with the VCS root as the working
+* directory.
+*
+* Scope of one import (mirrors the panel's preferences):
+* - modified files (git: working tree vs index — "仅未暂存"; svn: vs BASE;
+*   p4: opened edits), imported as `edit` (old = baseline, new = working);
+* - deleted files, imported as `edit` with an empty new side (revert restores);
+* - new/untracked files (git `??`, svn `?`, p4 not-yet-opened files), imported
+*   as `create` ONLY when the untracked preference is on. For p4 that means a
+*   full workspace scan (`p4 status`, which can be slow); with the preference
+*   off only already-opened files are read.
+* @module dsh-diff-approval/vcs
+*/
+/** Cap on one VCS command's runtime; scans (git status, svn status) can be slow
+* on large trees but must not hang the import. */
+const VCS_COMMAND_TIMEOUT_MS = 6e4;
+/** Quote one argument for a POSIX-ish shell, so paths with spaces or special
+* characters survive interpolation into VCS command lines. */
+function shq(value) {
+	return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/** POSIX path-inside check, case-insensitive on Windows. */
+function isPathInside(absolutePath, root) {
+	const folded = (value) => process.platform === "win32" ? value.toLowerCase() : value;
+	const path = folded(resolve(absolutePath));
+	const base = folded(resolve(root));
+	if (path === base) return true;
+	return path.startsWith(base + sep);
+}
+/** The VCS marker of one directory, or undefined when it holds none. */
+function markerOf(directory) {
+	if (existsSync(resolve(directory, ".git"))) return "git";
+	if (existsSync(resolve(directory, ".svn"))) return "svn";
+	if (existsSync(resolve(directory, ".p4config")) || existsSync(resolve(directory, ".p4config.txt"))) return "p4";
+}
+/**
+* Find the VCS enclosing `start` by walking up the directory tree: the first
+* directory (deepest) holding a marker wins, with git > svn > p4 when several
+* markers share one directory. Stops at the filesystem root.
+* @param start - the workspace directory to start from.
+* @returns the detected root, or undefined when no VCS marker is found.
+*/
+function detectVcsRoot(start) {
+	let directory = resolve(start);
+	for (;;) {
+		const kind = markerOf(directory);
+		if (kind !== void 0) return {
+			kind,
+			root: directory
+		};
+		const parent = dirname(directory);
+		if (parent === directory) return void 0;
+		directory = parent;
+	}
+}
+/** Run one command through the shell executor; a non-zero exit throws. */
+async function runShell(shell, command, workdir, signal) {
+	const spec = shell.resolve({
+		command,
+		workdir,
+		timeoutMs: VCS_COMMAND_TIMEOUT_MS,
+		signal
+	});
+	const result = await shell.run(spec);
+	if (result.exitCode !== 0) {
+		const detail = (result.stderr.text || result.stdout.text).trim();
+		throw new Error(`command failed (exit ${String(result.exitCode)}): ${detail || command}`);
+	}
+	return result.stdout.text;
+}
+/** Parse `git status --porcelain=v1 -z` output into (XY, repo-relative path)
+* records. Rename/copy records carry a trailing destination field, which is
+* consumed and skipped. */
+function parseGitPorcelainZ(output) {
+	const records = [];
+	let index = 0;
+	while (index < output.length) {
+		const end = output.indexOf("\0", index);
+		if (end === -1) break;
+		const field = output.slice(index, end);
+		index = end + 1;
+		if (field.length < 3) continue;
+		const xy = field.slice(0, 2);
+		const rel = field.slice(3);
+		if (xy[0] === "R" || xy[0] === "C") {
+			const destEnd = output.indexOf("\0", index);
+			if (destEnd === -1) break;
+			index = destEnd + 1;
+			continue;
+		}
+		records.push({
+			xy,
+			rel
+		});
+	}
+	return records;
+}
+/** Enumerate the workspace's local changes in a git checkout. */
+async function gitChanges(input) {
+	const { root, workspaceRoot, includeUntracked, shell, readText, signal } = input;
+	const stdout = await runShell(shell, "git -c status.renames=false status --porcelain=v1 -z --untracked-files=all", root, signal);
+	const changes = [];
+	for (const { xy, rel } of parseGitPorcelainZ(stdout)) {
+		const absolute = resolve(root, rel);
+		if (!isPathInside(absolute, workspaceRoot)) continue;
+		if (xy === "??") {
+			if (!includeUntracked) continue;
+			const newText = await readText(absolute) ?? "";
+			changes.push({
+				path: absolute,
+				kind: "create",
+				oldText: "",
+				newText
+			});
+			continue;
+		}
+		const worktree = xy[1] ?? " ";
+		if (worktree !== "M" && worktree !== "D") continue;
+		let oldText = "";
+		try {
+			oldText = await runShell(shell, `git show :0:${shq(rel)}`, root, signal);
+		} catch {
+			oldText = "";
+		}
+		const newText = worktree === "D" ? "" : await readText(absolute) ?? "";
+		if (oldText === "" && newText === "") continue;
+		changes.push({
+			path: absolute,
+			kind: "edit",
+			oldText,
+			newText
+		});
+	}
+	return changes;
+}
+/** Unescape the XML entities `svn status --xml` writes into paths. */
+function xmlUnescape(value) {
+	return value.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, "\"").replace(/&apos;/g, "'").replace(/&amp;/g, "&");
+}
+/** Enumerate the workspace's local changes in an svn working copy. */
+async function svnChanges(input) {
+	const { root, workspaceRoot, includeUntracked, shell, readText, signal } = input;
+	const stdout = await runShell(shell, "svn status --xml", root, signal);
+	const changes = [];
+	const entryPattern = /<entry[^>]*path="([^"]*)"[^>]*>\s*<wc-status[^>]*item="([^"]*)"/g;
+	let match;
+	while ((match = entryPattern.exec(stdout)) !== null) {
+		const rel = xmlUnescape(match[1]);
+		const item = match[2];
+		const absolute = resolve(root, rel);
+		if (!isPathInside(absolute, workspaceRoot)) continue;
+		if (item === "modified" || item === "deleted") {
+			let oldText = "";
+			try {
+				oldText = await runShell(shell, `svn cat -r BASE ${shq(rel)}`, root, signal);
+			} catch {
+				oldText = "";
+			}
+			const newText = item === "deleted" ? "" : await readText(absolute) ?? "";
+			if (oldText === "" && newText === "") continue;
+			changes.push({
+				path: absolute,
+				kind: "edit",
+				oldText,
+				newText
+			});
+		} else if (item === "added") {
+			const newText = await readText(absolute) ?? "";
+			changes.push({
+				path: absolute,
+				kind: "create",
+				oldText: "",
+				newText
+			});
+		} else if (item === "unversioned" && includeUntracked) {
+			const newText = await readText(absolute) ?? "";
+			changes.push({
+				path: absolute,
+				kind: "create",
+				oldText: "",
+				newText
+			});
+		}
+	}
+	return changes;
+}
+/** One changed-file line from `p4 opened`/`p4 status`: the depot path and the
+* action. The action keyword is found anywhere on the line, so both the
+* `- edit`/`- add` and the `opened for edit`/`opened for add` wordings parse. */
+function p4ChangeOf(line) {
+	const trimmed = line.trim();
+	if (trimmed === "") return void 0;
+	const depot = trimmed.split(/\s+/, 1)[0];
+	if (depot === void 0 || !depot.startsWith("//")) return void 0;
+	const action = /(move\/delete|move\/add|delete|integrate|branch|add|edit)/.exec(trimmed)?.[1] ?? "edit";
+	return {
+		depot: depot.replace(/#.*$/, ""),
+		action
+	};
+}
+/** Enumerate the workspace's locally changed files in a p4 client. With the
+* untracked preference on a full workspace scan (`p4 status`) catches files
+* not yet opened for add; off keeps to already-opened files (`p4 opened`) so
+* the scan — which can be slow — is skipped. */
+async function p4Changes(input) {
+	const { root, workspaceRoot, includeUntracked, shell, readText, signal } = input;
+	const stdout = await runShell(shell, includeUntracked ? "p4 status" : "p4 opened", root, signal);
+	const changes = [];
+	for (const line of stdout.split("\n")) {
+		const opened = p4ChangeOf(line);
+		if (opened === void 0) continue;
+		const local = (await runShell(shell, `p4 where ${shq(opened.depot)}`, root, signal)).trim().split(/\s+/).pop();
+		if (local === void 0 || local.length === 0) continue;
+		const absolute = resolve(local);
+		if (!isPathInside(absolute, workspaceRoot)) continue;
+		const deleted = opened.action === "delete" || opened.action === "move/delete";
+		const created = opened.action === "add" || opened.action === "move/add";
+		const newText = deleted ? "" : await readText(absolute) ?? "";
+		let oldText = "";
+		if (!created) try {
+			oldText = await runShell(shell, `p4 print -q ${shq(opened.depot)}#have`, root, signal);
+		} catch {
+			oldText = "";
+		}
+		if (oldText === "" && newText === "") continue;
+		changes.push({
+			path: absolute,
+			kind: created ? "create" : "edit",
+			oldText,
+			newText
+		});
+	}
+	return changes;
+}
+/**
+* Enumerate the workspace's local changes for one VCS. Runs the VCS read-only
+* commands and returns one {@link VcsChange} per changed file inside the
+* workspace.
+* @param input - the VCS, its root, the workspace root, and the reading tools.
+* @returns the changes; an absent/unusable VCS surfaces as a thrown error.
+*/
+async function listVcsChanges(input) {
+	switch (input.kind) {
+		case "git": return gitChanges(input);
+		case "svn": return svnChanges(input);
+		case "p4": return p4Changes(input);
+	}
+}
+//#endregion
 //#region lib/types/index.js
 /**
 * Pending-edit review, host half. Captures every successful `edit` and `write`
@@ -406,7 +689,8 @@ const name = "diff-approval";
 const inject = [
 	"fs",
 	"connection",
-	"workspaceRegistry"
+	"workspaceRegistry",
+	"sessions"
 ];
 /** The connection RPC channel this plugin serves. */
 const DIFF_APPROVAL_CHANNEL = "/diff-approval";
@@ -580,9 +864,16 @@ function apply(ctx, config) {
 		await ensureLoaded(sessionId);
 		if (store.fold(entry)) await persistSession(sessionId);
 	}
+	/** The stable `FsError.code`, when the thrown value carries one. */
+	function fsErrorCodeOf(error) {
+		if (typeof error !== "object" || error === null) return void 0;
+		const code = error.code;
+		return typeof code === "string" ? code : void 0;
+	}
 	/**
-	* Read one path's live state: present content, an unresolvable (missing)
-	* path, or a resolved-but-unreadable file.
+	* Read one path's live state. The only existence test is `stat`: it returns
+	* `undefined` for an absent target (gone), so a deleted file never falls into
+	* the unreadable bucket. A file that exists but cannot be read is `unavailable`.
 	* @param path - backend display path to probe through `ctx.fs`.
 	* @returns the live state.
 	*/
@@ -590,22 +881,23 @@ function apply(ctx, config) {
 		let target;
 		try {
 			target = await ctx.fs.resolve(path, {});
-		} catch {
-			return {
-				present: false,
-				kind: "missing"
-			};
+		} catch (error) {
+			return fsErrorCodeOf(error) === "FS_NOT_FOUND" ? { kind: "deleted" } : { kind: "unavailable" };
 		}
+		let info;
+		try {
+			info = await ctx.fs.stat(target, void 0);
+		} catch (error) {
+			return fsErrorCodeOf(error) === "FS_NOT_FOUND" ? { kind: "deleted" } : { kind: "unavailable" };
+		}
+		if (info === void 0) return { kind: "deleted" };
 		try {
 			return {
-				present: true,
+				kind: "present",
 				content: await ctx.fs.readText(target, void 0)
 			};
-		} catch {
-			return {
-				present: false,
-				kind: "unreadable"
-			};
+		} catch (error) {
+			return fsErrorCodeOf(error) === "FS_NOT_FOUND" ? { kind: "deleted" } : { kind: "unavailable" };
 		}
 	}
 	/**
@@ -614,7 +906,32 @@ function apply(ctx, config) {
 	* @param entries - the store's entries for one session.
 	* @returns entries with `missing` and `diverged` set from the live file.
 	*/
-	async function listWithState(entries) {
+	/** Drop every undo/redo pair that belongs to a removed entry, so the LIFO
+	* queue stays traversable without ever trying to restore an unreadable file. */
+	function purgeForEntry(sessionId, entryId, path) {
+		const key = String(sessionId);
+		for (const stacks of [undoStacks, redoStacks]) {
+			const stack = stacks.get(key);
+			if (stack === void 0) continue;
+			stacks.set(key, stack.filter((pair) => {
+				const touches = (state) => state.id === entryId || state.path === path;
+				const batch = pair.before.batch ?? pair.after.batch;
+				if (batch !== void 0) return !batch.some((item) => item.id === entryId || item.path === path);
+				return !touches(pair.before) && !touches(pair.after);
+			}));
+		}
+	}
+	/**
+	* Settle each listed entry against its live file. Existence is decided by the
+	* live state alone: a deleted file leaves the list as an undoable checkpoint
+	* (Ctrl+Z recreates it and restores the entry), an unavailable one leaves the
+	* list and has its undo/redo records dropped, and externally changed content
+	* is adopted as the new baseline with its own checkpoint.
+	* @param sessionId - the session being listed.
+	* @param entries - the store's entries for one session.
+	* @returns the listed entries plus whether an external change cleared redo.
+	*/
+	async function listWithState(sessionId, entries) {
 		const byPath = /* @__PURE__ */ new Map();
 		for (const entry of entries) {
 			const group = byPath.get(entry.path);
@@ -622,23 +939,76 @@ function apply(ctx, config) {
 			else group.push(entry);
 		}
 		const listed = [];
+		let redoCleared = false;
 		for (const group of byPath.values()) {
 			const newest = group[group.length - 1];
 			if (newest === void 0) continue;
 			const live = await liveStateOf(newest.path);
-			const state = live.present ? {
+			if (live.kind === "deleted") {
+				store.remove(sessionId, newest.id);
+				pushUndo(sessionId, {
+					id: newest.id,
+					path: newest.path,
+					entry: newest,
+					fileText: newest.newText
+				}, {
+					id: newest.id,
+					path: newest.path,
+					entry: void 0,
+					fileText: void 0
+				});
+				await persistSession(sessionId);
+				continue;
+			}
+			if (live.kind === "unavailable") {
+				store.remove(sessionId, newest.id);
+				purgeForEntry(sessionId, newest.id, newest.path);
+				await persistSession(sessionId);
+				continue;
+			}
+			const content = live.content;
+			let adopted = newest.newText;
+			const hasContent = typeof content === "string";
+			if (hasContent && content !== newest.newText) {
+				adopted = content;
+				const beforeText = newest.newText;
+				const redoWasPresent = redoStacks.has(String(sessionId));
+				store.update(sessionId, newest.id, { newText: content });
+				pushUndo(sessionId, {
+					id: newest.id,
+					path: newest.path,
+					entry: newest,
+					fileText: beforeText
+				}, {
+					id: newest.id,
+					path: newest.path,
+					entry: {
+						...newest,
+						newText: content,
+						updatedAt: Date.now()
+					},
+					fileText: content
+				});
+				await persistSession(sessionId);
+				if (redoWasPresent) redoCleared = true;
+			}
+			const state = {
 				missing: false,
-				diverged: live.content !== newest.newText
-			} : {
-				missing: live.kind === "missing",
-				diverged: live.kind === "unreadable"
+				diverged: hasContent ? content !== adopted : true
 			};
-			for (const entry of group) listed.push({
+			for (const entry of group) listed.push(entry.id === newest.id ? {
+				...entry,
+				newText: adopted,
+				...state
+			} : {
 				...entry,
 				...state
 			});
 		}
-		return listed;
+		return {
+			files: listed,
+			redoCleared
+		};
 	}
 	/**
 	* The workspace whose session account holds `sessionId`. Web sessions are
@@ -651,6 +1021,79 @@ function apply(ctx, config) {
 		for (const workspace of ctx.workspaceRegistry.list()) if (workspace.sessionIds.includes(sessionId)) return workspace;
 	}
 	/**
+	* Resolve the file-sandbox policy for one session's Revert write, or
+	* undefined when no confining backend is mounted. A live session carries
+	* its workspace root through `ctx.sessions`; a persisted entry from a
+	* session not live in this process falls back to the session's workspace
+	* path (else the deployment default). Without this the sandbox fences the
+	* write against the process cwd and denies it with "file access denied
+	* under workspace-write mode".
+	*/
+	function sandboxPolicyOf(sessionId) {
+		const policy = ctx.get("sandboxPolicy");
+		if (policy === void 0) return void 0;
+		const session = ctx.sessions.get(sessionId);
+		if (session !== void 0) return policy.resolve({ session });
+		const workspace = workspaceOf(sessionId);
+		return workspace === void 0 ? policy.resolve({}) : {
+			mode: policy.defaultMode,
+			workspaceRoot: workspace.path
+		};
+	}
+	/**
+	* Write a Revert through `ctx.fs`, carrying the session's sandbox policy
+	* only when a confining backend is mounted (so the plain 4-arg call shape is
+	* preserved for the unsandboxed composition).
+	* @param target - the resolved target to write.
+	* @param content - the restored file content.
+	* @param sessionId - the entry's session, for the per-session policy.
+	* @param signal - aborts before atomic publication takes effect.
+	* @returns the write outcome.
+	*/
+	async function writeRevert(target, content, sessionId, signal) {
+		const policy = sandboxPolicyOf(sessionId);
+		return policy === void 0 ? ctx.fs.writeText(target, content, void 0, signal) : ctx.fs.writeText(target, content, void 0, signal, policy);
+	}
+	const undoStacks = /* @__PURE__ */ new Map();
+	const redoStacks = /* @__PURE__ */ new Map();
+	function pushUndo(sessionId, before, after) {
+		const key = String(sessionId);
+		const stack = undoStacks.get(key) ?? [];
+		stack.push({
+			sessionId,
+			before,
+			after
+		});
+		undoStacks.set(key, stack);
+		redoStacks.delete(key);
+	}
+	/**
+	* Restore one snapshot (the before/after side of an undo pair). File writes
+	* carry the session sandbox policy; a divergence guard refuses to overwrite
+	* a file an outside writer has since changed. The store change is applied
+	* only after the write succeeds, keeping the restore all-or-nothing.
+	* @param sessionId - the owning session.
+	* @param state - the snapshot to restore.
+	* @param expectedFile - the other side's file content, checked before a write.
+	* @param signal - aborts before atomic publication takes effect.
+	*/
+	async function restoreState(sessionId, state, expectedFile, signal) {
+		if (state.fileText !== void 0) {
+			const resolved = await ctx.fs.resolve(state.path, { signal });
+			if (expectedFile?.fileText !== void 0) {
+				if (await ctx.fs.readText(resolved, void 0) !== expectedFile.fileText) throw new Error("the file changed outside the review after the action; undo is unavailable");
+			}
+			await writeRevert(resolved, state.fileText, sessionId, signal);
+		}
+		if (state.batch !== void 0) {
+			for (const item of state.batch) if (item.entry !== void 0) store.restore(sessionId, item.entry);
+			else store.remove(sessionId, item.id);
+			return;
+		}
+		if (state.entry !== void 0) store.restore(sessionId, state.entry);
+		else store.remove(sessionId, state.id);
+	}
+	/**
 	* Record one session in its workspace's account. Every path that touches a
 	* session registers it, so the list merges all of a workspace's sessions'
 	* entries — a fresh session after restart still sees the workspace's
@@ -780,11 +1223,13 @@ function apply(ctx, config) {
 			case "list": {
 				const sessionId = sessionOf(payload);
 				if (sessionId === void 0) return rpcError("sessionId must be a non-empty string");
+				const { files, redoCleared } = await listWithState(sessionId, await workspaceEntries(sessionId));
 				return {
 					ok: true,
 					value: {
-						files: await listWithState(await workspaceEntries(sessionId)),
-						workspacePath: workspaceOf(sessionId)?.path
+						files,
+						workspacePath: workspaceOf(sessionId)?.path,
+						redoCleared: redoCleared || void 0
 					}
 				};
 			}
@@ -792,11 +1237,27 @@ function apply(ctx, config) {
 				const target = targetOf(payload);
 				if (target === void 0) return rpcError("sessionId and id must be non-empty strings");
 				await ensureLoaded(target.sessionId);
-				const removed = store.remove(target.sessionId, target.id);
-				if (removed) await persistSession(target.sessionId);
+				const entry = store.get(target.sessionId, target.id);
+				if (entry === void 0) return {
+					ok: true,
+					value: { outcome: "missing" }
+				};
+				store.remove(target.sessionId, target.id);
+				pushUndo(target.sessionId, {
+					id: entry.id,
+					path: entry.path,
+					entry,
+					fileText: void 0
+				}, {
+					id: entry.id,
+					path: entry.path,
+					entry: void 0,
+					fileText: void 0
+				});
+				await persistSession(target.sessionId);
 				return {
 					ok: true,
-					value: { outcome: removed ? "kept" : "missing" }
+					value: { outcome: "kept" }
 				};
 			}
 			case "revert": {
@@ -808,14 +1269,33 @@ function apply(ctx, config) {
 					ok: true,
 					value: { outcome: "missing" }
 				};
+				let undo;
 				try {
 					const resolved = await ctx.fs.resolve(entry.path, { signal });
 					if (entry.kind === "create") await rm(ctx.fs.processPath(resolved), { force: true });
-					else await ctx.fs.writeText(resolved, entry.oldText, void 0, signal);
+					else {
+						const preWrite = await ctx.fs.readText(resolved, void 0) ?? entry.newText;
+						await writeRevert(resolved, entry.oldText, target.sessionId, signal);
+						undo = {
+							before: {
+								id: entry.id,
+								path: entry.path,
+								entry,
+								fileText: preWrite
+							},
+							after: {
+								id: entry.id,
+								path: entry.path,
+								entry: void 0,
+								fileText: entry.oldText
+							}
+						};
+					}
 				} catch (error) {
 					return rpcError(`revert failed: ${errorMessage(error)}`);
 				}
 				store.remove(target.sessionId, target.id);
+				if (undo !== void 0) pushUndo(target.sessionId, undo.before, undo.after);
 				await persistSession(target.sessionId);
 				return {
 					ok: true,
@@ -833,8 +1313,29 @@ function apply(ctx, config) {
 				};
 				const accepted = contentRangeOf(entry.newText, blockTarget.block.newStart, blockTarget.block.newEnd);
 				const updatedOld = replaceContentLines(entry.oldText, blockTarget.block.oldStart, blockTarget.block.oldEnd, accepted);
-				if (updatedOld === entry.newText) store.remove(blockTarget.sessionId, blockTarget.id);
-				else store.update(blockTarget.sessionId, blockTarget.id, { oldText: updatedOld });
+				let afterEntry;
+				if (updatedOld === entry.newText) {
+					store.remove(blockTarget.sessionId, blockTarget.id);
+					afterEntry = void 0;
+				} else {
+					store.update(blockTarget.sessionId, blockTarget.id, { oldText: updatedOld });
+					afterEntry = {
+						...entry,
+						oldText: updatedOld,
+						updatedAt: Date.now()
+					};
+				}
+				pushUndo(blockTarget.sessionId, {
+					id: entry.id,
+					path: entry.path,
+					entry,
+					fileText: void 0
+				}, {
+					id: entry.id,
+					path: entry.path,
+					entry: afterEntry,
+					fileText: void 0
+				});
 				await persistSession(blockTarget.sessionId);
 				return {
 					ok: true,
@@ -852,21 +1353,200 @@ function apply(ctx, config) {
 				};
 				const restored = contentRangeOf(entry.oldText, blockTarget.block.oldStart, blockTarget.block.oldEnd);
 				const updatedNew = replaceContentLines(entry.newText, blockTarget.block.newStart, blockTarget.block.newEnd, restored);
+				let afterEntry;
+				if (updatedNew === entry.oldText) {
+					store.remove(blockTarget.sessionId, blockTarget.id);
+					afterEntry = void 0;
+				} else {
+					store.update(blockTarget.sessionId, blockTarget.id, { newText: updatedNew });
+					afterEntry = {
+						...entry,
+						newText: updatedNew,
+						updatedAt: Date.now()
+					};
+				}
+				let undo;
 				try {
 					const resolved = await ctx.fs.resolve(entry.path, { signal });
 					if (entry.kind === "create" && updatedNew === "") await rm(ctx.fs.processPath(resolved), { force: true });
-					else await ctx.fs.writeText(resolved, updatedNew, void 0, signal);
+					else {
+						const preWrite = await ctx.fs.readText(resolved, void 0) ?? entry.newText;
+						await writeRevert(resolved, updatedNew, blockTarget.sessionId, signal);
+						undo = {
+							before: {
+								id: entry.id,
+								path: entry.path,
+								entry,
+								fileText: preWrite
+							},
+							after: {
+								id: entry.id,
+								path: entry.path,
+								entry: afterEntry,
+								fileText: updatedNew
+							}
+						};
+					}
 				} catch (error) {
 					return rpcError(`block revert failed: ${errorMessage(error)}`);
 				}
-				if (updatedNew === entry.oldText) store.remove(blockTarget.sessionId, blockTarget.id);
-				else store.update(blockTarget.sessionId, blockTarget.id, { newText: updatedNew });
+				if (undo !== void 0) pushUndo(blockTarget.sessionId, undo.before, undo.after);
 				await persistSession(blockTarget.sessionId);
 				return {
 					ok: true,
 					value: { outcome: "reverted" }
 				};
 			}
+			case "undo": {
+				const sessionId = sessionOf(payload);
+				if (sessionId === void 0) return rpcError("sessionId must be a non-empty string");
+				const key = String(sessionId);
+				const stack = undoStacks.get(key) ?? [];
+				const pair = stack.pop();
+				if (pair === void 0) return {
+					ok: true,
+					value: { outcome: "nothing" }
+				};
+				try {
+					await restoreState(sessionId, pair.before, pair.after, signal);
+				} catch (error) {
+					stack.push(pair);
+					return rpcError(`undo failed: ${errorMessage(error)}`);
+				}
+				const redoStack = redoStacks.get(key) ?? [];
+				redoStack.push(pair);
+				redoStacks.set(key, redoStack);
+				await persistSession(sessionId);
+				return {
+					ok: true,
+					value: {
+						outcome: "undone",
+						id: pair.after.id
+					}
+				};
+			}
+			case "redo": {
+				const sessionId = sessionOf(payload);
+				if (sessionId === void 0) return rpcError("sessionId must be a non-empty string");
+				const key = String(sessionId);
+				const stack = redoStacks.get(key) ?? [];
+				const pair = stack.pop();
+				if (pair === void 0) return {
+					ok: true,
+					value: { outcome: "nothing" }
+				};
+				try {
+					await restoreState(sessionId, pair.after, pair.before, signal);
+				} catch (error) {
+					stack.push(pair);
+					return rpcError(`redo failed: ${errorMessage(error)}`);
+				}
+				const undoStack = undoStacks.get(key) ?? [];
+				undoStack.push(pair);
+				undoStacks.set(key, undoStack);
+				await persistSession(sessionId);
+				return {
+					ok: true,
+					value: {
+						outcome: "redone",
+						id: pair.after.id
+					}
+				};
+			}
+			case "vcs-import": {
+				const sessionId = sessionOf(payload);
+				if (sessionId === void 0) return rpcError("sessionId must be a non-empty string");
+				const workspace = workspaceOf(sessionId);
+				if (workspace === void 0) return rpcError("import unavailable: the session has no workspace");
+				const root = detectVcsRoot(workspace.path);
+				if (root === void 0) return {
+					ok: true,
+					value: {
+						imported: 0,
+						detected: false
+					}
+				};
+				const shell = ctx.get("shell");
+				if (shell === void 0) return rpcError("import unavailable: the deployment has no shell executor");
+				const includeUntracked = payload.includeUntracked === true;
+				const input = {
+					kind: root.kind,
+					root: root.root,
+					workspaceRoot: workspace.path,
+					includeUntracked,
+					shell,
+					readText: (path) => readFile(path, "utf8").catch(() => void 0),
+					signal
+				};
+				let changes;
+				try {
+					changes = await listVcsChanges(input);
+				} catch (error) {
+					return rpcError(`import failed: ${errorMessage(error)}`);
+				}
+				await ensureLoaded(sessionId);
+				const before = new Map(store.list(sessionId).map((entry) => [entry.path, entry]));
+				let imported = 0;
+				const changedPaths = [];
+				for (const change of changes) {
+					const entry = {
+						id: randomUUID(),
+						sessionId,
+						path: change.path,
+						kind: change.kind,
+						oldText: change.oldText,
+						newText: change.newText,
+						updatedAt: Date.now()
+					};
+					if (store.fold(entry)) {
+						imported += 1;
+						changedPaths.push(change.path);
+					}
+				}
+				if (imported > 0) {
+					await persistSession(sessionId);
+					const after = new Map(store.list(sessionId).map((entry) => [entry.path, entry]));
+					const batchBefore = [];
+					const batchAfter = [];
+					for (const path of changedPaths) {
+						const final = after.get(path);
+						if (final === void 0) continue;
+						const pre = before.get(path);
+						batchAfter.push({
+							id: final.id,
+							path,
+							entry: final,
+							fileText: void 0
+						});
+						batchBefore.push({
+							id: final.id,
+							path,
+							entry: pre,
+							fileText: void 0
+						});
+					}
+					if (batchBefore.length > 0) pushUndo(sessionId, {
+						id: batchBefore[0].id,
+						path: batchBefore[0].path,
+						entry: void 0,
+						fileText: void 0,
+						batch: batchBefore
+					}, {
+						id: batchAfter[0].id,
+						path: batchAfter[0].path,
+						entry: void 0,
+						fileText: void 0,
+						batch: batchAfter
+					});
+				}
+				return {
+					ok: true,
+					value: {
+						imported,
+						detected: true
+					}
+				};
+			}
 			case "open": {
 				const target = openTargetOf(payload);
 				if (target === void 0) return rpcError("sessionId, id, and action must be valid");