getgloss 0.5.0 → 0.6.0

package/dist/server/daemon.js

@@ -1,13 +1,6 @@
 // src/server/daemon.ts
 import { serve } from "@hono/node-server";
 
-// src/cli/lifecycle.ts
-import { spawn } from "child_process";
-import { existsSync, openSync } from "fs";
-import { readFile, rm, writeFile } from "fs/promises";
-import { fileURLToPath } from "url";
-import getPort from "get-port";
-
 // src/shared/paths.ts
 import { mkdir } from "fs/promises";
 import { homedir } from "os";
@@ -16,7 +9,7 @@ import path from "path";
 // package.json
 var package_default = {
   name: "getgloss",
-  version: "0.5.0",
+  version: "0.6.0",
   description: "Local browser-based diff review for coding-agent loops.",
   type: "module",
   packageManager: "pnpm@10.33.2",
@@ -46,31 +39,31 @@ var package_default = {
     node: ">=20"
   },
   dependencies: {
-    "@hono/node-server": "^1.14.4",
-    "@pierre/diffs": "^1.2.1",
-    "@tailwindcss/vite": "^4.1.7",
-    commander: "^14.0.0",
-    execa: "^9.5.3",
-    "get-port": "^7.1.0",
-    hono: "^4.7.10",
-    "lucide-react": "^1.16.0",
-    open: "^10.1.2",
-    react: "^19.1.0",
-    "react-dom": "^19.1.0",
-    ulid: "^3.0.0",
-    zustand: "^5.0.5"
+    "@hono/node-server": "1.19.14",
+    "@tailwindcss/vite": "4.3.0",
+    commander: "14.0.3",
+    execa: "9.6.1",
+    "get-port": "7.2.0",
+    hono: "4.12.21",
+    "lucide-react": "1.16.0",
+    open: "10.2.0",
+    react: "19.2.6",
+    "react-dom": "19.2.6",
+    ulid: "3.0.2",
+    zustand: "5.0.13"
   },
   devDependencies: {
-    "@biomejs/biome": "^2.0.6",
-    "@types/node": "^24.0.1",
-    "@types/react": "^19.1.6",
-    "@types/react-dom": "^19.1.5",
-    "@vitejs/plugin-react": "^4.5.2",
-    tsup: "^8.5.0",
-    tsx: "^4.20.3",
-    typescript: "^5.8.3",
-    vite: "^6.3.5",
-    vitest: "^3.2.3"
+    "@biomejs/biome": "2.4.15",
+    "@types/node": "24.12.4",
+    "@types/react": "19.2.15",
+    "@types/react-dom": "19.2.3",
+    "@vitejs/plugin-react": "4.7.0",
+    tailwindcss: "4.3.0",
+    tsup: "8.5.1",
+    tsx: "4.22.3",
+    typescript: "5.9.3",
+    vite: "6.4.2",
+    vitest: "3.2.4"
   },
   keywords: [
     "diff",
@@ -134,32 +127,195 @@ async function ensureDir(dir) {
   await mkdir(dir, { recursive: true });
 }
 
-// src/cli/lifecycle.ts
+// src/shared/server-info.ts
+import { readFile } from "fs/promises";
+
+// src/shared/json.ts
+import { writeFile } from "fs/promises";
+function serializeJson(value) {
+  return `${JSON.stringify(value, null, 2)}
+`;
+}
+async function writeJsonFile(filePath, value) {
+  await writeFile(filePath, serializeJson(value));
+}
+
+// src/shared/validation.ts
+var reviewStatuses = ["pending", "submitted", "cancelled", "resolved"];
+var resolutionStatuses = ["partial", "resolved"];
+var sides = ["L", "R"];
+var diffLineTypes = ["context", "add", "delete"];
+var diffScopeModes = ["working", "branch", "explicit"];
+var diffFallbackReasons = ["working-tree-clean", "missing-branch-base"];
+function parseJson(raw, guard, label) {
+  const parsed = JSON.parse(raw);
+  return parseJsonValue(parsed, guard, label);
+}
+function parseJsonValue(value, guard, label) {
+  if (!guard(value)) {
+    throw new Error(`Invalid ${label}`);
+  }
+  return value;
+}
+function isSubmitReviewRequest(value) {
+  return isRecord(value) && isArrayOf(value.comments, isComment);
+}
+function isResolutionRequest(value) {
+  return isRecord(value) && isOptionalString(value.summary);
+}
+function isStoredReviewMeta(value) {
+  return isRecord(value) && isString(value.id) && isString(value.cwd) && isBaseRef(value.base) && isNullableString(value.branch) && isReviewStatus(value.status) && isString(value.createdAt) && isOptionalString(value.submittedAt) && isOptionalString(value.resolvedAt) && isOptionalString(value.artifactDir) && isOptionalString(value.feedbackPath) && isOptionalString(value.markdownPath);
+}
+function isDiffPayload(value) {
+  return isRecord(value) && isBaseRef(value.base) && isNullableString(value.branch) && isString(value.cwd) && isDiffScope(value.scope) && isDiffStats(value.stats) && isString(value.rawDiff) && isArrayOf(value.files, isDiffFile) && isString(value.capturedAt);
+}
+function isFeedbackBundle(value) {
+  return isRecord(value) && value.version === 1 && isString(value.reviewId) && isString(value.timestamp) && isBaseRef(value.base) && isNullableString(value.branch) && isArrayOf(value.comments, isComment);
+}
+function isResolutionBundle(value) {
+  return isRecord(value) && isString(value.reviewId) && isResolutionStatus(value.status) && isNullableString(value.summary) && isNullableString(value.resolvedAt) && isArrayOf(value.comments, isResolvedComment);
+}
+function isDiffScope(value) {
+  return isRecord(value) && isOneOf(value.mode, diffScopeModes) && isNullableString(value.requestedBase) && isBaseRef(value.base) && isDiffRef(value.comparison) && (value.fallbackReason === null || isOneOf(value.fallbackReason, diffFallbackReasons));
+}
+function isDiffRef(value) {
+  return isRecord(value) && isString(value.ref) && isNullableString(value.sha);
+}
+function isBaseRef(value) {
+  return isRecord(value) && isString(value.ref) && isString(value.sha);
+}
+function isDiffStats(value) {
+  return isRecord(value) && isNumber(value.files) && isNumber(value.additions) && isNumber(value.deletions);
+}
+function isDiffFile(value) {
+  return isRecord(value) && isString(value.path) && isNullableString(value.oldPath) && isNumber(value.additions) && isNumber(value.deletions) && isBoolean(value.isBinary) && isBoolean(value.isDeleted) && isBoolean(value.isNew) && isBoolean(value.isRenamed) && isNullableString(value.language) && isArrayOf(value.hunks, isDiffHunk);
+}
+function isDiffHunk(value) {
+  return isRecord(value) && isNumber(value.oldStart) && isNumber(value.oldLines) && isNumber(value.newStart) && isNumber(value.newLines) && isString(value.header) && isArrayOf(value.lines, isDiffLine);
+}
+function isDiffLine(value) {
+  return isRecord(value) && isOneOf(value.type, diffLineTypes) && isNullableNumber(value.oldLine) && isNullableNumber(value.newLine) && isString(value.content);
+}
+function isComment(value) {
+  return isRecord(value) && isString(value.id) && isString(value.filePath) && isNumber(value.startLine) && isNumber(value.endLine) && isOneOf(value.side, sides) && isString(value.body) && isString(value.originalSnippet) && isString(value.createdAt);
+}
+function isResolvedComment(value) {
+  return isRecord(value) && isString(value.commentId) && value.status === "resolved" && isOptionalString(value.summary) && isString(value.resolvedAt);
+}
+function isReviewStatus(value) {
+  return isOneOf(value, reviewStatuses);
+}
+function isResolutionStatus(value) {
+  return isOneOf(value, resolutionStatuses);
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isArrayOf(value, guard) {
+  return Array.isArray(value) && value.every(guard);
+}
+function isString(value) {
+  return typeof value === "string";
+}
+function isOptionalString(value) {
+  return value === void 0 || isString(value);
+}
+function isNullableString(value) {
+  return value === null || isString(value);
+}
+function isNumber(value) {
+  return typeof value === "number" && Number.isFinite(value);
+}
+function isNullableNumber(value) {
+  return value === null || isNumber(value);
+}
+function isBoolean(value) {
+  return typeof value === "boolean";
+}
+function isOneOf(value, options) {
+  return typeof value === "string" && options.includes(value);
+}
+
+// src/shared/server-info.ts
 async function writeServerInfo(info) {
   await ensureDir(globalStateDir());
-  await writeFile(globalServerFile(), `${JSON.stringify(info, null, 2)}
-`);
+  await writeJsonFile(globalServerFile(), info);
 }
 
 // src/server/index.ts
 import { readFile as readFile3 } from "fs/promises";
-import path2 from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import path3 from "path";
+import { fileURLToPath } from "url";
 import { Hono } from "hono";
 import { streamSSE } from "hono/streaming";
 
+// src/shared/comments.ts
+function compareCommentsByLocation(a, b) {
+  return a.filePath.localeCompare(b.filePath) || a.startLine - b.startLine || a.endLine - b.endLine || a.side.localeCompare(b.side);
+}
+function countCommentFiles(comments) {
+  return new Set(comments.map((comment) => comment.filePath)).size;
+}
+function formatLineRange(range, options = {}) {
+  const startLine = Math.min(range.startLine, range.endLine);
+  const endLine = Math.max(range.startLine, range.endLine);
+  if (startLine === endLine) {
+    return `${range.side}${startLine}`;
+  }
+  const endPrefix = options.repeatSideOnEnd === false ? "" : range.side;
+  return `${range.side}${startLine}-${endPrefix}${endLine}`;
+}
+function resolutionCounts(feedback, resolvedComments = []) {
+  const comments = feedback?.comments ?? [];
+  const resolvedIds = new Set(resolvedComments.map((comment) => comment.commentId));
+  const resolved = comments.filter((comment) => resolvedIds.has(comment.id)).length;
+  return {
+    total: comments.length,
+    resolved,
+    open: comments.length - resolved
+  };
+}
+
+// src/shared/reviews.ts
+function isResolvableReviewStatus(status) {
+  return status === "submitted" || status === "resolved";
+}
+
 // src/server/store.ts
-import { readdir, readFile as readFile2, rm as rm2, writeFile as writeFile2 } from "fs/promises";
+import { readdir, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
 import { ulid } from "ulid";
 
-// src/shared/markdown.ts
-function formatLineRange(comment) {
-  const prefix = comment.side;
-  if (comment.startLine === comment.endLine) {
-    return `${prefix}${comment.startLine}`;
+// src/shared/language.ts
+import path2 from "path";
+var languageByExtension = {
+  cjs: "js",
+  css: "css",
+  go: "go",
+  html: "html",
+  js: "js",
+  json: "json",
+  jsx: "jsx",
+  md: "markdown",
+  mjs: "js",
+  py: "python",
+  rb: "ruby",
+  rs: "rust",
+  sh: "bash",
+  swift: "swift",
+  ts: "ts",
+  tsx: "tsx",
+  yaml: "yaml",
+  yml: "yaml"
+};
+function languageForPath(filePath) {
+  const ext = path2.extname(filePath).slice(1).toLowerCase();
+  if (!ext) {
+    return null;
   }
-  return `${prefix}${comment.startLine}-${prefix}${comment.endLine}`;
+  return languageByExtension[ext] ?? ext;
 }
+
+// src/shared/markdown.ts
 function fenceFor(snippet) {
   let fence = "```";
   while (snippet.includes(fence)) {
@@ -167,40 +323,13 @@ function fenceFor(snippet) {
   }
   return fence;
 }
-function languageForPath(filePath) {
-  const ext = filePath.split(".").pop()?.toLowerCase();
-  const map = {
-    cjs: "js",
-    css: "css",
-    go: "go",
-    html: "html",
-    js: "js",
-    json: "json",
-    jsx: "jsx",
-    md: "markdown",
-    mjs: "js",
-    py: "python",
-    rb: "ruby",
-    rs: "rust",
-    sh: "bash",
-    swift: "swift",
-    ts: "ts",
-    tsx: "tsx",
-    yaml: "yaml",
-    yml: "yaml"
-  };
-  return ext ? map[ext] ?? ext : "";
-}
 function languageForSnippet(filePath, snippet) {
   const lines = snippet.split("\n").filter((line) => line.length > 0);
   const looksLikeUnifiedDiff = lines.length > 0 && lines.some((line) => line.startsWith("+") || line.startsWith("-")) && lines.every((line) => line.startsWith("+") || line.startsWith("-") || line.startsWith(" "));
-  return looksLikeUnifiedDiff ? "diff" : languageForPath(filePath);
-}
-function byFileThenLine(a, b) {
-  return a.filePath.localeCompare(b.filePath) || a.startLine - b.startLine || a.endLine - b.endLine || a.side.localeCompare(b.side);
+  return looksLikeUnifiedDiff ? "diff" : languageForPath(filePath) ?? "";
 }
 function serializeFeedbackMarkdown(bundle) {
-  const comments = [...bundle.comments].sort(byFileThenLine);
+  const comments = [...bundle.comments].sort(compareCommentsByLocation);
   const files = [...new Set(comments.map((comment) => comment.filePath))];
   const lines = [
     `# Gloss feedback - ${bundle.timestamp}`,
@@ -270,9 +399,7 @@ var ReviewStore = class {
       timestamp,
       base: record.diff.base,
       branch: record.diff.branch,
-      comments: [...comments].sort(
-        (a, b) => a.filePath.localeCompare(b.filePath) || a.startLine - b.startLine || a.endLine - b.endLine || a.side.localeCompare(b.side)
-      )
+      comments: [...comments].sort(compareCommentsByLocation)
     };
     record.feedback = feedback;
     record.meta = { ...record.meta, status: "submitted", submittedAt: timestamp };
@@ -288,17 +415,15 @@ var ReviewStore = class {
     };
     await ensureDir(artifactDir);
     await Promise.all([
-      writeFile2(globalReviewMetaFile(id), `${JSON.stringify(record.meta, null, 2)}
-`),
-      writeFile2(feedbackPath, `${JSON.stringify(feedback, null, 2)}
-`),
+      writeJsonFile(globalReviewMetaFile(id), record.meta),
+      writeJsonFile(feedbackPath, feedback),
       writeFile2(markdownPath, serializeFeedbackMarkdown(feedback))
     ]);
     this.emit({
       type: "review.submitted",
       reviewId: id,
       counts: {
-        files: new Set(feedback.comments.map((comment) => comment.filePath)).size,
+        files: countCommentFiles(feedback.comments),
         comments: feedback.comments.length
       }
     });
@@ -360,7 +485,7 @@ var ReviewStore = class {
       ],
       record
     );
-    const counts = this.resolutionCounts(record, comments);
+    const counts = resolutionCounts(record.feedback, comments);
     const fullyResolved = counts.total === counts.resolved;
     const resolution = {
       reviewId: id,
@@ -383,7 +508,7 @@ var ReviewStore = class {
       (record.resolution?.comments ?? []).filter((comment) => comment.commentId !== commentId),
       record
     );
-    const counts = this.resolutionCounts(record, comments);
+    const counts = resolutionCounts(record.feedback, comments);
     const fullyResolved = counts.total > 0 && counts.total === counts.resolved;
     const resolvedAt = fullyResolved ? (/* @__PURE__ */ new Date()).toISOString() : null;
     const resolution = {
@@ -416,10 +541,8 @@ var ReviewStore = class {
     const dir = globalReviewDir(record.meta.id);
     await ensureDir(dir);
     await Promise.all([
-      writeFile2(globalReviewMetaFile(record.meta.id), `${JSON.stringify(record.meta, null, 2)}
-`),
-      writeFile2(globalReviewDiffFile(record.meta.id), `${JSON.stringify(record.diff, null, 2)}
-`)
+      writeJsonFile(globalReviewMetaFile(record.meta.id), record.meta),
+      writeJsonFile(globalReviewDiffFile(record.meta.id), record.diff)
     ]);
   }
   async loadKnownReview(id) {
@@ -433,56 +556,65 @@ var ReviewStore = class {
     let entries;
     try {
       entries = await readdir(globalReviewsDir(), { withFileTypes: true });
-    } catch {
-      return;
+    } catch (error) {
+      if (isFileNotFound(error)) {
+        return;
+      }
+      throw new Error(
+        `Could not read reviews directory at ${globalReviewsDir()}: ${formatError(error)}`,
+        {
+          cause: error
+        }
+      );
     }
     await Promise.all(
       entries.filter((entry) => entry.isDirectory()).map((entry) => this.loadReview(entry.name))
     );
   }
   async loadReview(id) {
+    const metaPath = globalReviewMetaFile(id);
+    const diffPath = globalReviewDiffFile(id);
+    let metaRaw;
+    let diffRaw;
     try {
-      const [metaRaw, diffRaw] = await Promise.all([
-        readFile2(globalReviewMetaFile(id), "utf8"),
-        readFile2(globalReviewDiffFile(id), "utf8")
+      [metaRaw, diffRaw] = await Promise.all([
+        readFile2(metaPath, "utf8"),
+        readFile2(diffPath, "utf8")
       ]);
-      const meta = JSON.parse(metaRaw);
-      const diff = JSON.parse(diffRaw);
-      let feedback;
-      let resolution;
-      try {
-        feedback = JSON.parse(
-          await readFile2(globalReviewFeedbackFile(id), "utf8")
-        );
-      } catch {
-        feedback = void 0;
-      }
-      try {
-        resolution = JSON.parse(
-          await readFile2(globalReviewResolvedFile(id), "utf8")
-        );
-      } catch {
-        resolution = void 0;
+    } catch (error) {
+      if (isFileNotFound(error)) {
+        return null;
       }
-      const record = {
-        meta: {
-          ...meta,
-          artifactDir: meta.artifactDir ?? globalReviewDir(id),
-          feedbackPath: meta.feedbackPath ?? (feedback ? globalReviewFeedbackFile(id) : void 0),
-          markdownPath: meta.markdownPath ?? (feedback ? globalReviewMarkdownFile(id) : void 0)
-        },
-        diff,
-        feedback,
-        resolution
-      };
-      this.reviews.set(id, record);
-      return record;
-    } catch {
-      return null;
+      throw new Error(`Could not load review ${id}: ${formatError(error)}`, { cause: error });
     }
+    const meta = parseJsonFile(metaRaw, isStoredReviewMeta, "review metadata", metaPath);
+    const diff = parseJsonFile(diffRaw, isDiffPayload, "review diff", diffPath);
+    const feedback = await readOptionalJsonFile(
+      globalReviewFeedbackFile(id),
+      isFeedbackBundle,
+      "review feedback"
+    );
+    const resolution = await readOptionalJsonFile(
+      globalReviewResolvedFile(id),
+      isResolutionBundle,
+      "review resolution"
+    );
+    const record = {
+      meta: {
+        ...meta,
+        artifactDir: meta.artifactDir ?? globalReviewDir(id),
+        feedbackPath: meta.feedbackPath ?? (feedback ? globalReviewFeedbackFile(id) : void 0),
+        markdownPath: meta.markdownPath ?? (feedback ? globalReviewMarkdownFile(id) : void 0)
+      },
+      diff,
+      feedback,
+      resolution
+    };
+    this.reviews.set(id, record);
+    return record;
   }
   assertResolvable(record, id) {
-    if (record.meta.status !== "submitted" && record.meta.status !== "resolved") {
+    if (!isResolvableReviewStatus(record.meta.status)) {
       throw new Error(`Review ${id} is ${record.meta.status} and cannot be resolved`);
     }
     if (!record.feedback) {
@@ -500,17 +632,15 @@ var ReviewStore = class {
     const resolvedPath = globalReviewResolvedFile(record.meta.id);
     await ensureDir(globalReviewDir(record.meta.id));
     await Promise.all([
-      writeFile2(resolvedPath, `${JSON.stringify(resolution, null, 2)}
-`),
-      writeFile2(globalReviewMetaFile(record.meta.id), `${JSON.stringify(record.meta, null, 2)}
-`)
+      writeJsonFile(resolvedPath, resolution),
+      writeJsonFile(globalReviewMetaFile(record.meta.id), record.meta)
     ]);
     const result = {
       ok: true,
       reviewId: record.meta.id,
       status: record.meta.status,
       resolutionStatus: resolution.status,
-      comments: this.resolutionCounts(record, resolution.comments),
+      comments: resolutionCounts(record.feedback, resolution.comments),
       path: resolvedPath,
       resolution
     };
@@ -532,23 +662,38 @@ var ReviewStore = class {
       (a, b) => (feedbackIndex.get(a.commentId) ?? Number.MAX_SAFE_INTEGER) - (feedbackIndex.get(b.commentId) ?? Number.MAX_SAFE_INTEGER)
     );
   }
-  resolutionCounts(record, comments) {
-    const total = record.feedback.comments.length;
-    const resolvedIds = new Set(comments.map((comment) => comment.commentId));
-    const resolved = record.feedback.comments.filter(
-      (comment) => resolvedIds.has(comment.id)
-    ).length;
-    return {
-      total,
-      resolved,
-      open: total - resolved
-    };
-  }
 };
+async function readOptionalJsonFile(filePath, guard, label) {
+  let raw;
+  try {
+    raw = await readFile2(filePath, "utf8");
+  } catch (error) {
+    if (isFileNotFound(error)) {
+      return void 0;
+    }
+    throw new Error(`Could not read ${label} at ${filePath}: ${formatError(error)}`, {
+      cause: error
+    });
+  }
+  return parseJsonFile(raw, guard, label, filePath);
+}
+function parseJsonFile(raw, guard, label, filePath) {
+  try {
+    return parseJson(raw, guard, label);
+  } catch (error) {
+    throw new Error(`Invalid ${label} at ${filePath}: ${formatError(error)}`, { cause: error });
+  }
+}
+function isFileNotFound(error) {
+  return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+function formatError(error) {
+  return error instanceof Error ? error.message : String(error);
+}
 var reviewStore = new ReviewStore();
 
 // src/server/index.ts
-var webRoot = fileURLToPath2(new URL("../web", import.meta.url));
+var webRoot = fileURLToPath(new URL("../web", import.meta.url));
 var eventStreamHeartbeatMs = 15e3;
 var mimeTypes = {
   ".css": "text/css; charset=utf-8",
@@ -564,17 +709,29 @@ function createApp(origin2) {
   const app = new Hono();
   app.get("/api/health", async (c) => {
     const reviews = await reviewStore.list();
-    return c.json({
+    const response = {
       ok: true,
       version: packageVersion,
       activeReviews: reviews.filter((review) => review.status === "pending").length
-    });
+    };
+    return c.json(response);
+  });
+  app.get("/api/reviews", async (c) => {
+    const response = { reviews: await reviewStore.list() };
+    return c.json(response);
   });
-  app.get("/api/reviews", async (c) => c.json({ reviews: await reviewStore.list() }));
   app.post("/api/reviews", async (c) => {
-    const diff = await c.req.json();
+    const parsed = await readJsonBody(c, isDiffPayload, "review diff");
+    if (!parsed.ok) {
+      return parsed.response;
+    }
+    const diff = parsed.body;
     const record = await reviewStore.create(diff);
-    return c.json({ meta: record.meta, url: `${origin2}/review/${record.meta.id}` }, 201);
+    const response = {
+      meta: record.meta,
+      url: `${origin2}/review/${record.meta.id}`
+    };
+    return c.json(response, 201);
   });
   app.get("/api/reviews/:id", async (c) => {
     const record = await reviewStore.get(c.req.param("id"));
@@ -621,9 +778,11 @@ function createApp(origin2) {
       };
       const unsubscribe = reviewStore.subscribe(id, send);
       const heartbeat = setInterval(() => {
-        pending = pending.then(() => stream.write(`: keep-alive ${Date.now()}
+        pending = pending.then(async () => {
+          await stream.write(`: keep-alive ${Date.now()}
 
-`));
+`);
+        });
         void pending.catch(() => close?.());
       }, eventStreamHeartbeatMs);
       cleanup = () => {
@@ -632,12 +791,12 @@ function createApp(origin2) {
       };
       stream.onAbort(() => close?.());
       send({ type: "review.opened", reviewId: id });
-      if ((record.meta.status === "submitted" || record.meta.status === "resolved") && record.feedback) {
+      if (isResolvableReviewStatus(record.meta.status) && record.feedback) {
         send({
           type: "review.submitted",
           reviewId: id,
           counts: {
-            files: new Set(record.feedback.comments.map((comment) => comment.filePath)).size,
+            files: countCommentFiles(record.feedback.comments),
             comments: record.feedback.comments.length
           }
         });
@@ -654,20 +813,22 @@ function createApp(origin2) {
     if (existing.meta.status !== "pending") {
       return c.json({ error: `review is ${existing.meta.status} and cannot be submitted` }, 409);
     }
-    const body = await c.req.json();
-    const { record, feedbackPath, markdownPath } = await reviewStore.submit(
-      id,
-      body.comments ?? []
-    );
-    return c.json({
+    const parsed = await readJsonBody(c, isSubmitReviewRequest, "submit review request");
+    if (!parsed.ok) {
+      return parsed.response;
+    }
+    const body = parsed.body;
+    const { record, feedbackPath, markdownPath } = await reviewStore.submit(id, body.comments);
+    const response = {
       reviewId: id,
       url: `${origin2}/review/${id}`,
       files: record.diff.files.length,
-      comments: body.comments?.length ?? 0,
+      comments: body.comments.length,
       artifactDir: record.meta.artifactDir,
       feedbackPath,
       markdownPath
-    });
+    };
+    return c.json(response);
   });
   app.post("/api/reviews/:id/resolved", async (c) => {
     const id = c.req.param("id");
@@ -675,13 +836,17 @@ function createApp(origin2) {
     if (!existing) {
       return c.json({ error: "review not found" }, 404);
     }
-    if (existing.meta.status !== "submitted" && existing.meta.status !== "resolved") {
+    if (!isResolvableReviewStatus(existing.meta.status)) {
       return c.json({ error: `review is ${existing.meta.status} and cannot be resolved` }, 409);
     }
     if (!existing.feedback) {
       return c.json({ error: "submitted feedback not found" }, 409);
     }
-    const body = await c.req.json().catch(() => ({}));
+    const parsed = await readJsonBody(c, isResolutionRequest, "resolution request");
+    if (!parsed.ok) {
+      return parsed.response;
+    }
+    const body = parsed.body;
     return c.json(await reviewStore.markResolved(id, body.summary));
   });
   app.post("/api/reviews/:id/comments/:commentId/resolved", async (c) => {
@@ -691,13 +856,17 @@ function createApp(origin2) {
     if (!existing) {
       return c.json({ error: "review not found" }, 404);
     }
-    if (existing.meta.status !== "submitted" && existing.meta.status !== "resolved") {
+    if (!isResolvableReviewStatus(existing.meta.status)) {
       return c.json({ error: `review is ${existing.meta.status} and cannot be resolved` }, 409);
     }
     if (!existing.feedback?.comments.some((comment) => comment.id === commentId)) {
       return c.json({ error: "comment not found" }, 404);
     }
-    const body = await c.req.json().catch(() => ({}));
+    const parsed = await readJsonBody(c, isResolutionRequest, "resolution request");
+    if (!parsed.ok) {
+      return parsed.response;
+    }
+    const body = parsed.body;
     return c.json(await reviewStore.resolveComment(id, commentId, body.summary));
   });
   app.delete("/api/reviews/:id/comments/:commentId/resolved", async (c) => {
@@ -707,7 +876,7 @@ function createApp(origin2) {
     if (!existing) {
       return c.json({ error: "review not found" }, 404);
     }
-    if (existing.meta.status !== "submitted" && existing.meta.status !== "resolved") {
+    if (!isResolvableReviewStatus(existing.meta.status)) {
       return c.json({ error: `review is ${existing.meta.status} and cannot be resolved` }, 409);
     }
     if (!existing.feedback?.comments.some((comment) => comment.id === commentId)) {
@@ -730,13 +899,13 @@ function createApp(origin2) {
 }
 async function serveAsset(c) {
   const requestPath = new URL(c.req.url).pathname.replace(/^\/assets\//, "");
-  const normalized = path2.normalize(requestPath).replace(/^(\.\.(\/|\\|$))+/, "");
-  const assetPath = path2.join(webRoot, "assets", normalized);
+  const normalized = path3.normalize(requestPath).replace(/^(\.\.(\/|\\|$))+/, "");
+  const assetPath = path3.join(webRoot, "assets", normalized);
   try {
     const body = await readFile3(assetPath);
     return new Response(body, {
       headers: {
-        "content-type": mimeTypes[path2.extname(assetPath)] ?? "application/octet-stream"
+        "content-type": mimeTypes[path3.extname(assetPath)] ?? "application/octet-stream"
       }
     });
   } catch {
@@ -745,7 +914,7 @@ async function serveAsset(c) {
 }
 async function serveIndex() {
   try {
-    const body = await readFile3(path2.join(webRoot, "index.html"));
+    const body = await readFile3(path3.join(webRoot, "index.html"));
     return new Response(body, {
       headers: { "content-type": "text/html; charset=utf-8" }
     });
@@ -756,7 +925,7 @@ async function serveIndex() {
 function serveRootFile(fileName, contentType) {
   return async () => {
     try {
-      const body = await readFile3(path2.join(webRoot, fileName));
+      const body = await readFile3(path3.join(webRoot, fileName));
       return new Response(body, {
         headers: { "content-type": contentType }
       });
@@ -765,6 +934,28 @@ function serveRootFile(fileName, contentType) {
     }
   };
 }
+async function readJsonBody(c, guard, label) {
+  let body;
+  try {
+    body = await c.req.json();
+  } catch (error) {
+    return {
+      ok: false,
+      response: c.json({ error: `invalid JSON body: ${formatError2(error)}` }, 400)
+    };
+  }
+  try {
+    return { ok: true, body: parseJsonValue(body, guard, label) };
+  } catch (error) {
+    return {
+      ok: false,
+      response: c.json({ error: formatError2(error) }, 400)
+    };
+  }
+}
+function formatError2(error) {
+  return error instanceof Error ? error.message : String(error);
+}
 
 // src/server/daemon.ts
 var port = Number(process.env.GLOSS_PORT ?? "0");