glassbox 0.14.0 → 0.15.0-beta.6

package/dist/cli.js

@@ -52,6 +52,7 @@ var init_schema = __esm({
     content TEXT NOT NULL,
     is_stale BOOLEAN NOT NULL DEFAULT FALSE,
     original_content TEXT,
+    reply_to_note_id TEXT,
     created_at TIMESTAMP NOT NULL DEFAULT NOW(),
     updated_at TIMESTAMP NOT NULL DEFAULT NOW()
   );
@@ -146,6 +147,7 @@ async function initSchema(db2) {
   await addColumnIfMissing(db2, "reviews", "head_commit", "TEXT");
   await addColumnIfMissing(db2, "annotations", "is_stale", "BOOLEAN NOT NULL DEFAULT FALSE");
   await addColumnIfMissing(db2, "annotations", "original_content", "TEXT");
+  await addColumnIfMissing(db2, "annotations", "reply_to_note_id", "TEXT");
   await addColumnIfMissing(db2, "ai_file_scores", "notes", "TEXT");
   await addColumnIfMissing(db2, "ai_analyses", "progress_completed", "INTEGER NOT NULL DEFAULT 0");
   await addColumnIfMissing(db2, "ai_analyses", "progress_total", "INTEGER NOT NULL DEFAULT 0");
@@ -15369,11 +15371,11 @@ function parseRow(schema, row) {
   }
   return result.data;
 }
-function parseJsonColumn(schema, raw) {
-  if (raw === null || raw === void 0) return null;
+function parseJsonColumn(schema, raw2) {
+  if (raw2 === null || raw2 === void 0) return null;
   let parsed;
   try {
-    parsed = JSON.parse(raw);
+    parsed = JSON.parse(raw2);
   } catch {
     return null;
   }
@@ -15421,6 +15423,10 @@ var init_schemas3 = __esm({
       content: external_exports.string(),
       is_stale: external_exports.boolean(),
       original_content: external_exports.string().nullable(),
+      // The SARIF guid of the AI review note this annotation replies to (doc 20
+      // threading), or null for a normal annotation. `.default(null)` tolerates
+      // rows written before the column existed.
+      reply_to_note_id: external_exports.string().nullable().default(null),
       created_at: TimestampSchema,
       updated_at: TimestampSchema
     });
@@ -15592,13 +15598,13 @@ async function deleteReviewFile(id) {
   await db2.query("DELETE FROM annotations WHERE review_file_id = $1", [id]);
   await db2.query("DELETE FROM review_files WHERE id = $1", [id]);
 }
-async function addAnnotation(reviewFileId, lineNumber, side, category, content) {
+async function addAnnotation(reviewFileId, lineNumber, side, category, content, replyToNoteId) {
   const db2 = await getDb();
   const id = generateId();
   const result = await db2.query(
-    `INSERT INTO annotations (id, review_file_id, line_number, side, category, content)
-     VALUES ($1, $2, $3, $4, $5, $6) RETURNING *`,
-    [id, reviewFileId, lineNumber, side, category, content]
+    `INSERT INTO annotations (id, review_file_id, line_number, side, category, content, reply_to_note_id)
+     VALUES ($1, $2, $3, $4, $5, $6, $7) RETURNING *`,
+    [id, reviewFileId, lineNumber, side, category, content, replyToNoteId ?? null]
   );
   const annotation = parseRow(AnnotationSchema, result.rows[0]);
   if (annotation === void 0) throw new Error("addAnnotation: INSERT did not return a row");
@@ -15719,6 +15725,450 @@ var init_queries = __esm({
   }
 });
 
+// src/review-notes/types.ts
+function isNoteKind(value) {
+  return NOTE_KINDS.includes(value);
+}
+var NOTE_KINDS, CONFIDENCE_PROPERTY_KEY, ANCHOR_FINGERPRINT_KEY, DEFAULT_PRODUCER, DEFAULT_SHARD_CAP;
+var init_types = __esm({
+  "src/review-notes/types.ts"() {
+    "use strict";
+    NOTE_KINDS = [
+      "rationale",
+      "proof",
+      "assumption",
+      "alternative-considered",
+      "risk",
+      "test-evidence"
+    ];
+    CONFIDENCE_PROPERTY_KEY = "ext-ai-tool-confidence";
+    ANCHOR_FINGERPRINT_KEY = "prNoteAnchor/v1";
+    DEFAULT_PRODUCER = "unknown-ai-tool";
+    DEFAULT_SHARD_CAP = 1e4;
+  }
+});
+
+// src/review-notes/sarif.ts
+function emptyLog(producer, opts = {}) {
+  return { $schema: SARIF_SCHEMA_URL, version: "2.1.0", runs: [newRun(producer, opts)] };
+}
+function newRun(producer, opts = {}) {
+  const run = {
+    tool: {
+      driver: {
+        name: producer,
+        ...opts.producerVersion !== void 0 ? { version: opts.producerVersion } : {},
+        rules: [{
+          id: REVIEW_NOTE_RULE_ID,
+          name: "ReviewNote",
+          shortDescription: { text: "AI-authored, line-anchored review note." }
+        }]
+      }
+    },
+    results: []
+  };
+  if (opts.revisionId !== void 0 || opts.branch !== void 0 || opts.repositoryUri !== void 0) {
+    const vcs = {};
+    if (opts.repositoryUri !== void 0) vcs.repositoryUri = opts.repositoryUri;
+    if (opts.revisionId !== void 0) vcs.revisionId = opts.revisionId;
+    if (opts.branch !== void 0) vcs.branch = opts.branch;
+    run.versionControlProvenance = [vcs];
+  }
+  return run;
+}
+function buildResult(input, meta3) {
+  const region = { startLine: input.startLine, endLine: input.endLine };
+  if (meta3.snippet !== void 0) region.snippet = { text: meta3.snippet };
+  const properties = { tags: [input.kind] };
+  if (input.confidence !== void 0) properties[CONFIDENCE_PROPERTY_KEY] = input.confidence;
+  const result = {
+    ruleId: REVIEW_NOTE_RULE_ID,
+    ruleIndex: 0,
+    kind: "informational",
+    level: input.kind === "risk" ? "warning" : "none",
+    guid: meta3.guid,
+    message: { text: input.body, markdown: input.body },
+    locations: [{
+      physicalLocation: {
+        artifactLocation: { uri: input.file },
+        region
+      }
+    }],
+    properties
+  };
+  if (input.rank !== void 0) result.rank = input.rank;
+  if (input.ticket !== void 0 && input.ticket !== "") result.workItemUris = [input.ticket];
+  if (meta3.fingerprint !== void 0) result.partialFingerprints = { [ANCHOR_FINGERPRINT_KEY]: meta3.fingerprint };
+  if (input.artifacts !== void 0 && input.artifacts.length > 0) {
+    result.attachments = input.artifacts.map((uri) => {
+      const artifactLocation = { uri };
+      const hash2 = meta3.artifactHashes?.[uri];
+      if (hash2 !== void 0) artifactLocation.properties = { "ext-sha256": hash2 };
+      return { artifactLocation };
+    });
+  }
+  return result;
+}
+var SARIF_SCHEMA_URL, REVIEW_NOTE_RULE_ID, SarifLogShapeSchema;
+var init_sarif = __esm({
+  "src/review-notes/sarif.ts"() {
+    "use strict";
+    init_zod();
+    init_types();
+    SARIF_SCHEMA_URL = "https://json.schemastore.org/sarif-2.1.0.json";
+    REVIEW_NOTE_RULE_ID = "review-note";
+    SarifLogShapeSchema = external_exports.object({
+      version: external_exports.string(),
+      runs: external_exports.array(external_exports.object({
+        tool: external_exports.object({ driver: external_exports.object({ name: external_exports.string() }).loose() }).loose(),
+        versionControlProvenance: external_exports.array(external_exports.object({ revisionId: external_exports.string().optional() }).loose()).optional(),
+        results: external_exports.array(external_exports.unknown())
+      }).loose())
+    }).loose();
+  }
+});
+
+// src/review-notes/view.ts
+var REVIEW_NOTE_LABELS, IMAGE_ARTIFACT_RE;
+var init_view = __esm({
+  "src/review-notes/view.ts"() {
+    "use strict";
+    REVIEW_NOTE_LABELS = {
+      rationale: "Rationale",
+      proof: "Proof",
+      assumption: "Assumption",
+      "alternative-considered": "Alternative",
+      risk: "Risk",
+      "test-evidence": "Test"
+    };
+    IMAGE_ARTIFACT_RE = /\.(png|webp|avif|gif|jpe?g|svg)$/i;
+  }
+});
+
+// src/review-notes/store.ts
+import { spawnSync as spawnSync5 } from "child_process";
+import { createHash } from "crypto";
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, readdirSync, readFileSync as readFileSync5, statSync as statSync2, unlinkSync, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname3, join as join6 } from "path";
+function sanitizeRel(file2) {
+  const rel = file2.replace(/\\/g, "/").replace(/^\/+/, "").replace(/(^|\/)\.\.(?=\/|$)/g, "$1_");
+  return rel === "" ? "file" : rel;
+}
+function shardPath(repoRoot, safeRel, index) {
+  return join6(repoRoot, NOTES_SUBDIR, `${safeRel}.${String(index).padStart(6, "0")}.sarif`);
+}
+function listShardIndices(repoRoot, safeRel) {
+  const dir = join6(repoRoot, NOTES_SUBDIR, dirname3(safeRel));
+  if (!existsSync5(dir)) return [];
+  const base = safeRel.split("/").pop() ?? safeRel;
+  const indices = [];
+  for (const entry of readdirSync(dir)) {
+    if (!entry.startsWith(base + ".")) continue;
+    const m = SHARD_RE.exec(entry);
+    if (m !== null && entry === `${base}.${m[1]}.sarif`) indices.push(parseInt(m[1], 10));
+  }
+  return indices.sort((a, b) => a - b);
+}
+function totalResults(log) {
+  return log.runs.reduce((sum, run) => sum + run.results.length, 0);
+}
+function readLog(path) {
+  const raw2 = JSON.parse(readFileSync5(path, "utf-8"));
+  const parsed = SarifLogShapeSchema.safeParse(raw2);
+  if (!parsed.success) {
+    throw new Error(`existing notes shard is not a SARIF log we recognize, refusing to overwrite: ${path}`);
+  }
+  return raw2;
+}
+function findOrAddRun(log, producer, producerVersion, vcs) {
+  const existing = log.runs.find((run2) => run2.tool.driver.name === producer && run2.tool.driver.version === producerVersion && (run2.versionControlProvenance?.[0]?.revisionId ?? void 0) === vcs.revisionId);
+  if (existing !== void 0) return existing;
+  const run = newRun(producer, { producerVersion, ...vcs });
+  log.runs.push(run);
+  return run;
+}
+function gitValue(repoRoot, args) {
+  try {
+    const res = spawnSync5("git", args, { cwd: repoRoot, encoding: "utf-8" });
+    if (res.status !== 0) return void 0;
+    const out = res.stdout.trim();
+    return out === "" ? void 0 : out;
+  } catch {
+    return void 0;
+  }
+}
+function anchorSnippet(repoRoot, safeRel, startLine, endLine) {
+  try {
+    const lines = readFileSync5(join6(repoRoot, safeRel), "utf-8").split("\n");
+    const slice = lines.slice(Math.max(0, startLine - 1), Math.max(startLine, endLine));
+    if (slice.length === 0) return {};
+    const snippet = slice.join("\n");
+    const normalized = slice.map((l) => l.trim().replace(/\s+/g, " ")).join("\n");
+    const fingerprint = createHash("sha256").update(normalized).digest("hex").slice(0, 32);
+    return { snippet, fingerprint };
+  } catch {
+    return {};
+  }
+}
+function warnIfPrNotesIgnored(repoRoot) {
+  try {
+    const res = spawnSync5("git", ["check-ignore", ".pr-notes"], { cwd: repoRoot, encoding: "utf-8" });
+    if (res.status === 0) {
+      console.error("Warning: .pr-notes/ appears to be gitignored. Review notes must be committed to be useful \u2014 remove it from .gitignore.");
+    }
+  } catch {
+  }
+}
+function writeReviewNote(repoRoot, input, opts = {}) {
+  const cap = opts.cap ?? DEFAULT_SHARD_CAP;
+  const safeRel = sanitizeRel(input.file);
+  const producer = input.producer ?? DEFAULT_PRODUCER;
+  const vcs = {
+    revisionId: gitValue(repoRoot, ["rev-parse", "HEAD"]),
+    branch: gitValue(repoRoot, ["rev-parse", "--abbrev-ref", "HEAD"]),
+    repositoryUri: gitValue(repoRoot, ["config", "--get", "remote.origin.url"])
+  };
+  const { snippet, fingerprint } = anchorSnippet(repoRoot, safeRel, input.startLine, input.endLine);
+  const guid3 = generateId();
+  const artifactHashes = hashArtifacts(repoRoot, input.artifacts ?? []);
+  const result = buildResult({ ...input, file: safeRel }, { guid: guid3, snippet, fingerprint, artifactHashes });
+  if ((input.artifacts ?? []).some((a) => IMAGE_ARTIFACT_RE.test(a))) ensureArtifactLfsFilter(repoRoot);
+  const indices = listShardIndices(repoRoot, safeRel);
+  let index = indices.length > 0 ? indices[indices.length - 1] : 0;
+  let path = shardPath(repoRoot, safeRel, index);
+  let log;
+  if (existsSync5(path)) {
+    log = readLog(path);
+    if (totalResults(log) >= cap) {
+      index += 1;
+      path = shardPath(repoRoot, safeRel, index);
+      log = emptyLog(producer, { producerVersion: input.producerVersion, ...vcs });
+    }
+  } else {
+    log = emptyLog(producer, { producerVersion: input.producerVersion, ...vcs });
+  }
+  findOrAddRun(log, producer, input.producerVersion, vcs).results.push(result);
+  mkdirSync4(dirname3(path), { recursive: true });
+  writeFileSync5(path, JSON.stringify(log, null, 2) + "\n", "utf-8");
+  return { path, guid: guid3 };
+}
+function writeLog(path, log) {
+  writeFileSync5(path, JSON.stringify(log, null, 2) + "\n", "utf-8");
+}
+function hashArtifacts(repoRoot, artifacts) {
+  const out = {};
+  for (const uri of artifacts) {
+    const safe = uri.replace(/\\/g, "/").replace(/^\/+/, "");
+    if (/(^|\/)\.\.(\/|$)/.test(safe)) continue;
+    try {
+      const abs = join6(repoRoot, safe);
+      const stat = statSync2(abs);
+      if (!stat.isFile() || stat.size > ARTIFACT_HASH_MAX_BYTES) continue;
+      out[uri] = createHash("sha256").update(readFileSync5(abs)).digest("hex");
+    } catch {
+    }
+  }
+  return out;
+}
+function ensureArtifactLfsFilter(repoRoot) {
+  const path = join6(repoRoot, ".gitattributes");
+  try {
+    const existing = existsSync5(path) ? readFileSync5(path, "utf-8") : "";
+    if (existing.includes(".pr-notes/artifacts/**")) return;
+    const prefix = existing === "" || existing.endsWith("\n") ? "" : "\n";
+    writeFileSync5(path, `${existing}${prefix}${LFS_FILTER_LINE}
+`, "utf-8");
+  } catch {
+  }
+}
+function listShardPaths(repoRoot, safeRel) {
+  return listShardIndices(repoRoot, safeRel).map((i) => shardPath(repoRoot, safeRel, i));
+}
+function allShardPaths(repoRoot) {
+  const root = join6(repoRoot, NOTES_SUBDIR);
+  if (!existsSync5(root)) return [];
+  const entries = readdirSync(root, { recursive: true });
+  return entries.filter((e) => SHARD_RE.test(e)).map((e) => join6(root, e));
+}
+function persistOrDelete(path, log) {
+  log.runs = log.runs.filter((run) => run.results.length > 0);
+  if (log.runs.length === 0) {
+    if (existsSync5(path)) unlinkSync(path);
+  } else {
+    writeLog(path, log);
+  }
+}
+function removeNote(repoRoot, guid3, file2) {
+  const paths = file2 !== void 0 ? listShardPaths(repoRoot, sanitizeRel(file2)) : allShardPaths(repoRoot);
+  for (const path of paths) {
+    const log = readLog(path);
+    for (const run of log.runs) {
+      const idx = run.results.findIndex((r) => r.guid === guid3);
+      if (idx !== -1) {
+        run.results.splice(idx, 1);
+        persistOrDelete(path, log);
+        return true;
+      }
+    }
+  }
+  return false;
+}
+function updateNote(repoRoot, guid3, patch, file2) {
+  const paths = file2 !== void 0 ? listShardPaths(repoRoot, sanitizeRel(file2)) : allShardPaths(repoRoot);
+  for (const path of paths) {
+    const log = readLog(path);
+    for (const run of log.runs) {
+      const result = run.results.find((r) => r.guid === guid3);
+      if (result !== void 0) {
+        if (patch.body !== void 0) result.message = { text: patch.body, markdown: patch.body };
+        if (patch.kind !== void 0) {
+          result.properties = { ...result.properties, tags: [patch.kind] };
+          result.level = patch.kind === "risk" ? "warning" : "none";
+        }
+        if (patch.confidence !== void 0) {
+          result.properties = { ...result.properties, [CONFIDENCE_PROPERTY_KEY]: patch.confidence };
+        }
+        if (patch.rank !== void 0) result.rank = patch.rank;
+        if (patch.ticket !== void 0) result.workItemUris = patch.ticket === "" ? void 0 : [patch.ticket];
+        writeLog(path, log);
+        return true;
+      }
+    }
+  }
+  return false;
+}
+function noteKey(r) {
+  const loc = r.locations?.[0]?.physicalLocation;
+  return JSON.stringify([
+    loc?.artifactLocation?.uri,
+    loc?.region?.startLine,
+    loc?.region?.endLine,
+    r.properties?.tags,
+    r.message?.text
+  ]);
+}
+function coalesceFile(repoRoot, file2) {
+  const paths = listShardPaths(repoRoot, sanitizeRel(file2));
+  const logs = paths.map((path) => ({ path, log: readLog(path) }));
+  const refs = [];
+  logs.forEach((entry, logIdx) => {
+    entry.log.runs.forEach((run, runIdx) => {
+      run.results.forEach((r, resultIdx) => {
+        refs.push({ logIdx, runIdx, resultIdx, key: noteKey(r) });
+      });
+    });
+  });
+  const lastIndexForKey = /* @__PURE__ */ new Map();
+  refs.forEach((ref, i) => lastIndexForKey.set(ref.key, i));
+  const toRemove = refs.filter((ref, i) => lastIndexForKey.get(ref.key) !== i);
+  if (toRemove.length === 0) return 0;
+  const touched = /* @__PURE__ */ new Set();
+  const byRun = /* @__PURE__ */ new Map();
+  for (const ref of toRemove) {
+    const k = `${String(ref.logIdx)}:${String(ref.runIdx)}`;
+    const arr = byRun.get(k) ?? [];
+    arr.push(ref.resultIdx);
+    byRun.set(k, arr);
+    touched.add(ref.logIdx);
+  }
+  for (const [k, idxs] of byRun) {
+    const [logIdx, runIdx] = k.split(":").map(Number);
+    const results = logs[logIdx].log.runs[runIdx].results;
+    for (const idx of idxs.sort((a, b) => b - a)) results.splice(idx, 1);
+  }
+  for (const logIdx of touched) persistOrDelete(logs[logIdx].path, logs[logIdx].log);
+  return toRemove.length;
+}
+function coalesceAll(repoRoot) {
+  const root = join6(repoRoot, NOTES_SUBDIR);
+  if (!existsSync5(root)) return 0;
+  const sources = /* @__PURE__ */ new Set();
+  for (const entry of readdirSync(root, { recursive: true })) {
+    const m = SHARD_RE.exec(entry);
+    if (m !== null) sources.add(entry.replace(SHARD_RE, "").replace(/\\/g, "/"));
+  }
+  let total = 0;
+  for (const src of sources) total += coalesceFile(repoRoot, src);
+  return total;
+}
+function readArtifactText(repoRoot, uri) {
+  const safe = uri.replace(/\\/g, "/").replace(/^\/+/, "");
+  if (/(^|\/)\.\.(\/|$)/.test(safe)) return void 0;
+  try {
+    const abs = join6(repoRoot, safe);
+    const stat = statSync2(abs);
+    if (!stat.isFile() || stat.size > ARTIFACT_MAX_BYTES) return void 0;
+    const buf = readFileSync5(abs);
+    if (buf.includes(0)) return void 0;
+    return buf.toString("utf-8");
+  } catch {
+    return void 0;
+  }
+}
+function readArtifacts(repoRoot, result) {
+  const out = [];
+  for (const att of result.attachments ?? []) {
+    const uri = att.artifactLocation?.uri;
+    if (typeof uri !== "string" || uri === "") continue;
+    if (IMAGE_ARTIFACT_RE.test(uri)) {
+      out.push({ uri, isImage: true });
+    } else {
+      out.push({ uri, content: readArtifactText(repoRoot, uri) });
+    }
+  }
+  return out.length > 0 ? out : void 0;
+}
+function loadReviewNotesForFile(repoRoot, file2) {
+  const safeRel = sanitizeRel(file2);
+  const out = [];
+  for (const path of listShardPaths(repoRoot, safeRel)) {
+    let log;
+    try {
+      log = readLog(path);
+    } catch {
+      continue;
+    }
+    for (const run of log.runs) {
+      const producer = run.tool.driver.name;
+      for (const raw2 of run.results) {
+        const r = raw2;
+        const region = r.locations?.[0]?.physicalLocation?.region;
+        const startLine = region?.startLine;
+        const kind = r.properties?.tags?.[0];
+        if (startLine === void 0 || kind === void 0 || !isNoteKind(kind)) continue;
+        const confidence = r.properties?.[CONFIDENCE_PROPERTY_KEY];
+        out.push({
+          guid: r.guid,
+          line: startLine,
+          side: "new",
+          kind,
+          body: r.message?.text ?? "",
+          confidence: typeof confidence === "number" ? confidence : void 0,
+          producer: producer === "" ? void 0 : producer,
+          snippet: region?.snippet?.text,
+          artifacts: readArtifacts(repoRoot, r)
+        });
+      }
+    }
+  }
+  return out;
+}
+var NOTES_SUBDIR, SHARD_RE, ARTIFACT_HASH_MAX_BYTES, LFS_FILTER_LINE, ARTIFACT_MAX_BYTES;
+var init_store = __esm({
+  "src/review-notes/store.ts"() {
+    "use strict";
+    init_ids();
+    init_sarif();
+    init_types();
+    init_view();
+    NOTES_SUBDIR = join6(".pr-notes", "notes");
+    SHARD_RE = /\.(\d{6})\.sarif$/;
+    ARTIFACT_HASH_MAX_BYTES = 5e7;
+    LFS_FILTER_LINE = ".pr-notes/artifacts/** filter=lfs diff=lfs merge=lfs -text";
+    ARTIFACT_MAX_BYTES = 2e4;
+  }
+});
+
 // src/difftool/blob-store.ts
 var blob_store_exports = {};
 __export(blob_store_exports, {
@@ -15726,10 +16176,10 @@ __export(blob_store_exports, {
   readDifftoolBlob: () => readDifftoolBlob,
   writeDifftoolBlob: () => writeDifftoolBlob
 });
-import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync6, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync7, rmSync as rmSync4, writeFileSync as writeFileSync7 } from "fs";
+import { join as join9 } from "path";
 function blobDir(dataDir) {
-  return join7(dataDir, "difftool-blobs");
+  return join9(dataDir, "difftool-blobs");
 }
 function blobName(fileId, side) {
   return `${fileId.replace(/[^a-z0-9]/gi, "")}-${side}`;
@@ -15737,14 +16187,14 @@ function blobName(fileId, side) {
 function writeDifftoolBlob(dataDir, fileId, side, bytes) {
   if (bytes.length === 0) return;
   const dir = blobDir(dataDir);
-  mkdirSync5(dir, { recursive: true });
-  writeFileSync6(join7(dir, blobName(fileId, side)), bytes);
+  mkdirSync6(dir, { recursive: true });
+  writeFileSync7(join9(dir, blobName(fileId, side)), bytes);
 }
 function readDifftoolBlob(dataDir, fileId, side) {
-  const path = join7(blobDir(dataDir), blobName(fileId, side));
-  if (!existsSync6(path)) return null;
+  const path = join9(blobDir(dataDir), blobName(fileId, side));
+  if (!existsSync8(path)) return null;
   try {
-    return readFileSync6(path);
+    return readFileSync7(path);
   } catch {
     return null;
   }
@@ -15850,9 +16300,9 @@ __export(difftool_exports, {
   registerDifftool: () => registerDifftool,
   unregisterDifftool: () => unregisterDifftool
 });
-import { spawnSync as spawnSync9 } from "child_process";
+import { spawnSync as spawnSync10 } from "child_process";
 function git2(args, cwd) {
-  const r = spawnSync9("git", args, { encoding: "utf-8", cwd });
+  const r = spawnSync10("git", args, { encoding: "utf-8", cwd });
   if (r.error !== void 0) {
     const code = r.error.code ?? "UNKNOWN";
     return { status: -1, stdout: "", stderr: `spawn git failed (${code}): ${r.error.message}` };
@@ -15918,6 +16368,340 @@ var init_difftool = __esm({
   }
 });
 
+// src/review-notes/instructions.ts
+function reviewNoteInstructions() {
+  return [
+    "# Emitting AI review notes (`.pr-notes/`)",
+    "",
+    "As you write or change code, leave **line-anchored review notes** that explain",
+    "your reasoning and prove your work \u2014 the rationale a careful reviewer (human or",
+    "the next AI session) would want, anchored to the exact lines it concerns. Notes",
+    "are committed to the repo as tool-neutral SARIF under `.pr-notes/` and shown",
+    "review-comment-style in Glassbox. Write them **while editing**, at the moment of",
+    "richest context \u2014 not reconstructed afterward.",
+    "",
+    "## When to emit a note",
+    "",
+    'Emit one when a future reader would otherwise have to ask "why?". Good triggers:',
+    "",
+    "- A **non-obvious decision** \u2014 why this approach over the obvious one.",
+    "- **Proof** a change is correct \u2014 the reasoning, test output, or invariant that backs it.",
+    "- An **assumption** you relied on that could later be wrong.",
+    "- An **alternative you considered and rejected**, and why.",
+    "- A **risk** or sharp edge a reviewer should scrutinize.",
+    "- **Test evidence** demonstrating the change works.",
+    "",
+    "Do **not** narrate the obvious or restate what the diff already says. One note per",
+    "genuine decision or claim \u2014 not per line.",
+    "",
+    "## How to emit a note",
+    "",
+    "Shell out to the `glassbox note` CLI (it owns the on-disk format, fingerprint,",
+    "and commit provenance \u2014 you never write the SARIF by hand):",
+    "",
+    "```",
+    "glassbox note add \\",
+    "  --file <repo-relative path> \\",
+    "  --lines <A[-B]> \\",
+    `  --kind <${NOTE_KINDS.join("|")}> \\`,
+    '  --body - \\            # body read from stdin (use --body "text" for short notes)',
+    "  [--confidence 0..1] [--rank 0..100] [--ticket <id|url>] \\",
+    '  [--producer "<your tool/agent name>"] [--producer-version <v>]',
+    "```",
+    "",
+    "Always set `--producer` so the note records who wrote it, and `--ticket` when the",
+    "work traces to a tracked task. Keep the body focused: the claim and its support.",
+    "",
+    "## Revise and consolidate",
+    "",
+    "Notes should reflect the **final** state of your change, not an obsolete",
+    "intermediate step:",
+    "",
+    "- `glassbox note add` prints a stable note id (guid).",
+    "- `glassbox note update --id <guid> [--body -|--kind \u2026|--confidence \u2026|--rank \u2026|--ticket \u2026]`",
+    "  to correct a note as the work evolves.",
+    "- `glassbox note remove --id <guid>` to drop one that no longer applies.",
+    "- When the task is done, run `glassbox note coalesce` to drop redundant notes",
+    "  (identical anchor + kind + body, keeping the most recent).",
+    "",
+    "## Final consolidation pass",
+    "",
+    "After the mechanical `coalesce`, do one **cross-cutting pass over all the notes",
+    "you wrote this session** \u2014 the relationships that only become visible once the",
+    "whole change is in front of you, not while editing a single file. `coalesce`",
+    "only catches byte-identical duplicates; this pass is the judgment it cannot make:",
+    "",
+    "- **Merge near-duplicates.** Two notes that make the *same* point in different",
+    "  words (e.g. the same rationale restated on two files) aren't caught by",
+    "  `coalesce`. Keep the clearest one \u2014 `update` it to the best wording, widen its",
+    "  anchor or `--ticket` if helpful \u2014 and `remove` the rest.",
+    "- **Link related notes across files.** When several notes are facets of one",
+    "  decision spanning multiple files, make that explicit: name the related file(s)",
+    '  and the connecting idea in each note body (a short "see also `path/to/file`"',
+    "  line), and give them a shared `--ticket` so a reader can pivot between them.",
+    "  Bodies render as Markdown, so an inline `` `path` `` reference reads cleanly.",
+    "- **Prune what the finished change made obvious.** A note that justified an",
+    "  intermediate step the final diff no longer shows is noise \u2014 `remove` it.",
+    "",
+    "The goal is the smallest set of notes that still proves the work: no restated",
+    "point twice, and every cross-file relationship spelled out where a reviewer will",
+    "see it.",
+    "",
+    "If your tool can't shell out, write the SARIF directly under `.pr-notes/` per the",
+    "format in `docs/20-ai-review-notes.md` \u2014 but prefer the CLI."
+  ].join("\n");
+}
+var init_instructions = __esm({
+  "src/review-notes/instructions.ts"() {
+    "use strict";
+    init_types();
+  }
+});
+
+// src/review-notes/cli.ts
+var cli_exports = {};
+__export(cli_exports, {
+  parseNoteAdd: () => parseNoteAdd,
+  runNoteCli: () => runNoteCli
+});
+import { spawnSync as spawnSync11 } from "child_process";
+import { relative as relative2, resolve as resolve9 } from "path";
+function parseFlags(args) {
+  const flags = /* @__PURE__ */ new Map();
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (!a.startsWith("--")) throw new Error(`unexpected argument: ${a}`);
+    const key = a.slice(2);
+    const next = args.at(i + 1);
+    if (next === void 0 || next.startsWith("--")) throw new Error(`missing value for --${key}`);
+    flags.set(key, next);
+    i++;
+  }
+  return flags;
+}
+function collectRepeatable(args, name) {
+  const out = [];
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === `--${name}`) {
+      const v = args.at(i + 1);
+      if (v !== void 0 && !v.startsWith("--")) out.push(v);
+    }
+  }
+  return out;
+}
+function noteUsage() {
+  return `glassbox note \u2014 AI-authored, line-anchored review notes (docs/20)
+
+Usage:
+  glassbox note add      --file <path> --lines <A[-B]> --kind <kind> --body <text|-> [options]
+  glassbox note update   --id <guid> [--file <path>] [--body <text|->] [--kind <kind>] [--confidence <0..1>] [--rank <0..100>] [--ticket <id>]
+  glassbox note remove   --id <guid> [--file <path>]
+  glassbox note coalesce [--file <path>]
+  glassbox note instructions   Print the inbound AI-instructions contract (for orchestrators to inject)
+
+add \u2014 required:
+  --file <path>     Source file the note anchors to (relative to cwd or absolute)
+  --lines <A[-B]>   1-based line or line range (e.g. 42 or 42-50)
+  --kind <kind>     One of: ${NOTE_KINDS.join(", ")}
+  --body <text|->   Markdown body; pass - to read the body from stdin
+
+add \u2014 options:
+  --confidence <0..1>   Author confidence
+  --rank <0..100>       Importance
+  --ticket <id|url>     Linked ticket
+  --producer <name>     Producing tool/agent (e.g. "Claude Code", "Hot Sheet")
+  --producer-version <v>
+  --artifact <path>     Attach a committed proof artifact (test output, log,
+                        diagram source); repeatable, repo-relative path
+
+update/remove use the guid returned by 'add' (--file scopes the search; omit to search all notes).
+coalesce drops redundant notes (identical anchor + kind + body), keeping the most recent.
+`;
+}
+function parseInteger(label, value) {
+  const n = Number(value);
+  if (!Number.isInteger(n)) throw new Error(`${label} must be an integer, got "${value}"`);
+  return n;
+}
+function parseNoteAdd(args) {
+  const flags = parseFlags(args);
+  const file2 = flags.get("file");
+  const lines = flags.get("lines");
+  const kindRaw = flags.get("kind");
+  if (file2 === void 0) throw new Error("--file is required");
+  if (lines === void 0) throw new Error("--lines is required");
+  if (kindRaw === void 0) throw new Error("--kind is required");
+  if (!isNoteKind(kindRaw)) throw new Error(`--kind must be one of: ${NOTE_KINDS.join(", ")}`);
+  const lineMatch = /^(\d+)(?:-(\d+))?$/.exec(lines);
+  if (lineMatch === null) throw new Error(`--lines must be A or A-B (e.g. 42 or 42-50), got "${lines}"`);
+  const startLine = parseInteger("--lines start", lineMatch[1]);
+  const endRaw = lineMatch.at(2);
+  const endLine = endRaw !== void 0 ? parseInteger("--lines end", endRaw) : startLine;
+  if (startLine < 1 || endLine < startLine) throw new Error("--lines must be 1-based with start <= end");
+  const parsed = { file: file2, startLine, endLine, kind: kindRaw, artifacts: collectRepeatable(args, "artifact"), bodyStdin: false };
+  const confidence = flags.get("confidence");
+  if (confidence !== void 0) {
+    const c = Number(confidence);
+    if (Number.isNaN(c) || c < 0 || c > 1) throw new Error("--confidence must be between 0 and 1");
+    parsed.confidence = c;
+  }
+  const rank = flags.get("rank");
+  if (rank !== void 0) {
+    const r = Number(rank);
+    if (!Number.isInteger(r) || r < 0 || r > 100) throw new Error("--rank must be an integer 0..100");
+    parsed.rank = r;
+  }
+  if (flags.has("ticket")) parsed.ticket = flags.get("ticket");
+  if (flags.has("producer")) parsed.producer = flags.get("producer");
+  if (flags.has("producer-version")) parsed.producerVersion = flags.get("producer-version");
+  const body = flags.get("body");
+  if (body === void 0) throw new Error("--body is required (text, or - to read stdin)");
+  if (body === "-") parsed.bodyStdin = true;
+  else parsed.body = body;
+  return parsed;
+}
+function readStdin() {
+  return new Promise((res, rej) => {
+    let data = "";
+    process.stdin.setEncoding("utf-8");
+    process.stdin.on("data", (chunk) => {
+      data += String(chunk);
+    });
+    process.stdin.on("end", () => {
+      res(data);
+    });
+    process.stdin.on("error", rej);
+  });
+}
+function findRepoRoot(cwd) {
+  try {
+    const res = spawnSync11("git", ["rev-parse", "--show-toplevel"], { cwd, encoding: "utf-8" });
+    if (res.status === 0) {
+      const top = res.stdout.trim();
+      if (top !== "") return top;
+    }
+  } catch {
+  }
+  return cwd;
+}
+function toRepoRelative(repoRoot, cwd, file2) {
+  const abs = resolve9(cwd, file2);
+  const rel = relative2(repoRoot, abs).replace(/\\/g, "/");
+  if (rel === "" || rel.startsWith("../")) {
+    throw new Error(`--file must be inside the repository: ${file2}`);
+  }
+  return rel;
+}
+async function runAdd(args, cwd) {
+  const parsed = parseNoteAdd(args);
+  const body = parsed.bodyStdin ? await readStdin() : parsed.body;
+  if (body === void 0 || body.trim() === "") throw new Error("note body is empty");
+  const repoRoot = findRepoRoot(cwd);
+  const input = {
+    file: toRepoRelative(repoRoot, cwd, parsed.file),
+    startLine: parsed.startLine,
+    endLine: parsed.endLine,
+    body,
+    kind: parsed.kind,
+    confidence: parsed.confidence,
+    rank: parsed.rank,
+    ticket: parsed.ticket,
+    producer: parsed.producer,
+    producerVersion: parsed.producerVersion,
+    artifacts: parsed.artifacts.length > 0 ? parsed.artifacts : void 0
+  };
+  warnIfPrNotesIgnored(repoRoot);
+  const { path, guid: guid3 } = writeReviewNote(repoRoot, input);
+  console.log(`Wrote review note ${guid3} -> ${relative2(repoRoot, path)}`);
+}
+function scopedFile(flags, repoRoot, cwd) {
+  const file2 = flags.get("file");
+  return file2 === void 0 ? void 0 : toRepoRelative(repoRoot, cwd, file2);
+}
+function runRemove(args, cwd) {
+  const flags = parseFlags(args);
+  const id = flags.get("id");
+  if (id === void 0) throw new Error("--id <guid> is required");
+  const repoRoot = findRepoRoot(cwd);
+  const removed = removeNote(repoRoot, id, scopedFile(flags, repoRoot, cwd));
+  if (!removed) throw new Error(`no review note found with id ${id}`);
+  console.log(`Removed review note ${id}`);
+}
+async function runUpdate(args, cwd) {
+  const flags = parseFlags(args);
+  const id = flags.get("id");
+  if (id === void 0) throw new Error("--id <guid> is required");
+  const patch = {};
+  const bodyFlag = flags.get("body");
+  if (bodyFlag !== void 0) patch.body = bodyFlag === "-" ? await readStdin() : bodyFlag;
+  const kind = flags.get("kind");
+  if (kind !== void 0) {
+    if (!isNoteKind(kind)) throw new Error(`--kind must be one of: ${NOTE_KINDS.join(", ")}`);
+    patch.kind = kind;
+  }
+  const confidence = flags.get("confidence");
+  if (confidence !== void 0) {
+    const c = Number(confidence);
+    if (Number.isNaN(c) || c < 0 || c > 1) throw new Error("--confidence must be between 0 and 1");
+    patch.confidence = c;
+  }
+  const rank = flags.get("rank");
+  if (rank !== void 0) {
+    const r = Number(rank);
+    if (!Number.isInteger(r) || r < 0 || r > 100) throw new Error("--rank must be an integer 0..100");
+    patch.rank = r;
+  }
+  if (flags.has("ticket")) patch.ticket = flags.get("ticket");
+  if (Object.keys(patch).length === 0) throw new Error("nothing to update \u2014 pass at least one of --body/--kind/--confidence/--rank/--ticket");
+  const repoRoot = findRepoRoot(cwd);
+  const updated = updateNote(repoRoot, id, patch, scopedFile(flags, repoRoot, cwd));
+  if (!updated) throw new Error(`no review note found with id ${id}`);
+  console.log(`Updated review note ${id}`);
+}
+function runCoalesce(args, cwd) {
+  const flags = parseFlags(args);
+  const repoRoot = findRepoRoot(cwd);
+  const file2 = flags.get("file");
+  const removed = file2 !== void 0 ? coalesceFile(repoRoot, toRepoRelative(repoRoot, cwd, file2)) : coalesceAll(repoRoot);
+  console.log(`Coalesced review notes \u2014 removed ${String(removed)} redundant note(s)`);
+}
+async function runNoteCli(args, ctx = {}) {
+  const cwd = ctx.cwd ?? process.cwd();
+  const sub = args.at(0);
+  if (sub === void 0 || sub === "help" || sub === "--help" || sub === "-h") {
+    console.log(noteUsage());
+    return;
+  }
+  const rest = args.slice(1);
+  switch (sub) {
+    case "add":
+      await runAdd(rest, cwd);
+      return;
+    case "remove":
+      runRemove(rest, cwd);
+      return;
+    case "update":
+      await runUpdate(rest, cwd);
+      return;
+    case "coalesce":
+      runCoalesce(rest, cwd);
+      return;
+    case "instructions":
+      console.log(reviewNoteInstructions());
+      return;
+    default:
+      throw new Error(`unknown 'note' subcommand: ${sub} (expected add/update/remove/coalesce/instructions)`);
+  }
+}
+var init_cli = __esm({
+  "src/review-notes/cli.ts"() {
+    "use strict";
+    init_instructions();
+    init_store();
+    init_types();
+  }
+});
+
 // src/git/difftool-discovery.ts
 var difftool_discovery_exports = {};
 __export(difftool_discovery_exports, {
@@ -15931,22 +16715,22 @@ __export(difftool_discovery_exports, {
   tryAcquireStartingLock: () => tryAcquireStartingLock,
   writeDiscovery: () => writeDiscovery
 });
-import { existsSync as existsSync13, mkdirSync as mkdirSync11, readFileSync as readFileSync16, rmSync as rmSync5, statSync as statSync2, writeFileSync as writeFileSync11 } from "fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync12, readFileSync as readFileSync18, rmSync as rmSync5, statSync as statSync4, writeFileSync as writeFileSync12 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join16 } from "path";
+import { join as join18 } from "path";
 function difftoolHome() {
-  return join16(homedir4(), ".glassbox");
+  return join18(homedir4(), ".glassbox");
 }
 function discoveryPath(home = difftoolHome()) {
-  return join16(home, "difftool.lock");
+  return join18(home, "difftool.lock");
 }
 function startingLockPath(home = difftoolHome()) {
-  return join16(home, "difftool-starting.lock");
+  return join18(home, "difftool-starting.lock");
 }
-function parseDiscovery(raw) {
+function parseDiscovery(raw2) {
   let parsed;
   try {
-    parsed = JSON.parse(raw);
+    parsed = JSON.parse(raw2);
   } catch {
     return null;
   }
@@ -15955,16 +16739,16 @@ function parseDiscovery(raw) {
 }
 function readDiscovery(home = difftoolHome()) {
   const path = discoveryPath(home);
-  if (!existsSync13(path)) return null;
+  if (!existsSync15(path)) return null;
   try {
-    return parseDiscovery(readFileSync16(path, "utf-8"));
+    return parseDiscovery(readFileSync18(path, "utf-8"));
   } catch {
     return null;
   }
 }
 function writeDiscovery(port, home = difftoolHome()) {
-  mkdirSync11(home, { recursive: true });
-  writeFileSync11(discoveryPath(home), JSON.stringify({ port, pid: process.pid }));
+  mkdirSync12(home, { recursive: true });
+  writeFileSync12(discoveryPath(home), JSON.stringify({ port, pid: process.pid }));
 }
 function clearDiscovery(home = difftoolHome()) {
   try {
@@ -15973,17 +16757,17 @@ function clearDiscovery(home = difftoolHome()) {
   }
 }
 function tryAcquireStartingLock(home = difftoolHome()) {
-  mkdirSync11(home, { recursive: true });
+  mkdirSync12(home, { recursive: true });
   const path = startingLockPath(home);
   try {
-    writeFileSync11(path, String(process.pid), { flag: "wx" });
+    writeFileSync12(path, String(process.pid), { flag: "wx" });
     return true;
   } catch {
     try {
-      const ageMs = Date.now() - statSync2(path).mtimeMs;
+      const ageMs = Date.now() - statSync4(path).mtimeMs;
       if (ageMs > STARTING_LOCK_STALE_MS) {
         rmSync5(path, { force: true });
-        writeFileSync11(path, String(process.pid), { flag: "wx" });
+        writeFileSync12(path, String(process.pid), { flag: "wx" });
         return true;
       }
     } catch {
@@ -16013,9 +16797,9 @@ var init_difftool_discovery = __esm({
 // src/cli.ts
 init_connection();
 init_queries();
-import { existsSync as existsSync14, mkdirSync as mkdirSync12, realpathSync, statSync as statSync3 } from "fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync13, realpathSync, statSync as statSync5 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { basename as basename2, join as join17, resolve as resolve8 } from "path";
+import { basename as basename2, join as join19, resolve as resolve10 } from "path";
 
 // src/debug.ts
 var debugEnabled = false;
@@ -16054,13 +16838,18 @@ import { chmodSync, existsSync, mkdirSync as mkdirSync2, readFileSync, writeFile
 import { homedir } from "os";
 import { join as join2 } from "path";
 var GlobalConfigSchema = external_exports.record(external_exports.string(), external_exports.unknown());
-var GLOBAL_CONFIG_DIR = join2(homedir(), ".glassbox");
+function resolveGlobalConfigDir() {
+  const override = process.env.GLASSBOX_CONFIG_DIR;
+  if (override !== void 0 && override.trim() !== "") return override;
+  return join2(homedir(), ".glassbox");
+}
+var GLOBAL_CONFIG_DIR = resolveGlobalConfigDir();
 var GLOBAL_CONFIG_PATH = join2(GLOBAL_CONFIG_DIR, "config.json");
 function readGlobalConfig() {
   try {
     if (existsSync(GLOBAL_CONFIG_PATH)) {
-      const raw = JSON.parse(readFileSync(GLOBAL_CONFIG_PATH, "utf-8"));
-      const parsed = GlobalConfigSchema.safeParse(raw);
+      const raw2 = JSON.parse(readFileSync(GLOBAL_CONFIG_PATH, "utf-8"));
+      const parsed = GlobalConfigSchema.safeParse(raw2);
       if (parsed.success) return parsed.data;
     }
   } catch {
@@ -16187,12 +16976,17 @@ var AIModelSchema = external_exports.object({
   contextWindow: external_exports.number(),
   isDefault: external_exports.boolean()
 });
-var AIPlatformSchema = external_exports.enum(["anthropic", "openai", "google"]);
+var AIPlatformSchema = external_exports.enum(["anthropic", "openai", "google", "local", "apple"]);
+var KEYLESS_PLATFORMS = /* @__PURE__ */ new Set(["local", "apple"]);
 var PLATFORMS = {
   anthropic: "Anthropic",
   openai: "OpenAI",
-  google: "Google"
+  google: "Google",
+  local: "Local",
+  apple: "Apple"
 };
+var APPLE_ON_DEVICE_MODEL_ID = "apple-on-device";
+var APPLE_FM_ANALYSIS_ENABLED = true;
 var MODELS = {
   anthropic: [
     { id: "claude-opus-4-8", name: "Claude Opus 4.8", contextWindow: 1e6, isDefault: false },
@@ -16206,12 +17000,28 @@ var MODELS = {
   google: [
     { id: "gemini-2.5-flash", name: "Gemini 2.5 Flash", contextWindow: 1e6, isDefault: true },
     { id: "gemini-2.5-pro", name: "Gemini 2.5 Pro", contextWindow: 1e6, isDefault: false }
+  ],
+  // Local models are server-specific and discovered live from the configured
+  // endpoint; this is only the fallback default when discovery is unavailable.
+  local: [
+    { id: "llama3.1", name: "Llama 3.1", contextWindow: 8192, isDefault: true }
+  ],
+  // On-device Apple Foundation Models — a single fixed entry (no discovery).
+  // The on-device model has a small context window, so batch conservatively.
+  apple: [
+    { id: APPLE_ON_DEVICE_MODEL_ID, name: "Apple On-Device", contextWindow: 4096, isDefault: true }
   ]
 };
 var ENV_KEY_NAMES = {
   anthropic: "ANTHROPIC_API_KEY",
   openai: "OPENAI_API_KEY",
-  google: "GEMINI_API_KEY"
+  google: "GEMINI_API_KEY",
+  // Optional — most local servers (Ollama) need no key; some do.
+  local: "GLASSBOX_LOCAL_API_KEY",
+  // Apple Foundation Models are keyless (on-device). This name is never read
+  // for auth — `apple` is in KEYLESS_PLATFORMS — but the record requires an
+  // entry per platform.
+  apple: "GLASSBOX_APPLE_API_KEY"
 };
 function getDefaultModel(platform) {
   const models = MODELS[platform];
@@ -16220,7 +17030,10 @@ function getDefaultModel(platform) {
 }
 function getModelContextWindow(platform, modelId) {
   const model = MODELS[platform].find((m) => m.id === modelId);
-  return model ? model.contextWindow : 128e3;
+  if (model) return model.contextWindow;
+  if (platform === "local") return 8192;
+  if (platform === "apple") return 4096;
+  return 128e3;
 }
 function modelFamily(id) {
   const lower = id.toLowerCase();
@@ -16273,8 +17086,8 @@ function saveAPIKey(platform, key, storage) {
   if (storage === "keychain") {
     saveKeyToKeychain(platform, key);
   } else {
-    updateGlobalConfig((raw) => {
-      const parsed = ConfigFileSchema.safeParse(raw);
+    updateGlobalConfig((raw2) => {
+      const parsed = ConfigFileSchema.safeParse(raw2);
       const cfg = parsed.success ? parsed.data : {};
       cfg.ai ??= {};
       cfg.ai.keys ??= {};
@@ -16298,8 +17111,8 @@ function deleteAPIKey(platform) {
   } catch {
   }
   if (readConfigFile().ai?.keys === void 0) return;
-  updateGlobalConfig((raw) => {
-    const parsed = ConfigFileSchema.safeParse(raw);
+  updateGlobalConfig((raw2) => {
+    const parsed = ConfigFileSchema.safeParse(raw2);
     const cfg = parsed.success ? parsed.data : {};
     if (cfg.ai?.keys !== void 0) {
       cfg.ai.keys[platform] = "";
@@ -16320,11 +17133,21 @@ function detectAvailablePlatforms() {
 }
 
 // src/ai/config.ts
+var DEFAULT_LOCAL_ENDPOINT = "http://localhost:11434/v1";
+function resolveLocalEndpoint() {
+  const configured = readConfigFile().ai?.localEndpoint?.trim();
+  const base = configured !== void 0 && configured !== "" ? configured : DEFAULT_LOCAL_ENDPOINT;
+  return base.replace(/\/+$/, "");
+}
 var ConfigFileSchema = external_exports.object({
   ai: external_exports.object({
     platform: external_exports.string().optional(),
     model: external_exports.string().optional(),
-    keys: external_exports.record(external_exports.string(), external_exports.string()).optional()
+    keys: external_exports.record(external_exports.string(), external_exports.string()).optional(),
+    localEndpoint: external_exports.string().optional(),
+    // Secondary model used when the primary (Apple FM) fails a batch.
+    fallbackPlatform: external_exports.string().optional(),
+    fallbackModel: external_exports.string().optional()
   }).optional(),
   guidedReview: external_exports.object({
     enabled: external_exports.boolean().optional(),
@@ -16332,25 +17155,60 @@ var ConfigFileSchema = external_exports.object({
   }).optional()
 }).loose();
 function readConfigFile() {
-  const raw = readGlobalConfig();
-  const parsed = ConfigFileSchema.safeParse(raw);
+  const raw2 = readGlobalConfig();
+  const parsed = ConfigFileSchema.safeParse(raw2);
   return parsed.success ? parsed.data : {};
 }
+function resolvePlatformConfig(platform, rawModelOrUndefined) {
+  const rawModel = rawModelOrUndefined ?? getDefaultModel(platform);
+  const model = KEYLESS_PLATFORMS.has(platform) ? rawModel : resolveModelId(platform, rawModel);
+  const { key, source } = resolveAPIKey(platform);
+  const baseUrl = platform === "local" ? resolveLocalEndpoint() : void 0;
+  return { platform, model, apiKey: key, keySource: source, baseUrl };
+}
 function loadAIConfig() {
   const config2 = readConfigFile();
   const platformRaw = config2.ai?.platform ?? "anthropic";
-  const platform = AIPlatformSchema.safeParse(platformRaw).success ? AIPlatformSchema.parse(platformRaw) : "anthropic";
-  const model = resolveModelId(platform, config2.ai?.model ?? getDefaultModel(platform));
-  const { key, source } = resolveAPIKey(platform);
-  return { platform, model, apiKey: key, keySource: source };
-}
-function saveAIConfigPreferences(platform, model) {
+  let platform = AIPlatformSchema.safeParse(platformRaw).success ? AIPlatformSchema.parse(platformRaw) : "anthropic";
+  if (platform === "apple" && !APPLE_FM_ANALYSIS_ENABLED) platform = "anthropic";
+  const primary = resolvePlatformConfig(platform, config2.ai?.model);
+  if (platform === "apple") {
+    const fallback = resolveFallbackConfig(config2);
+    if (fallback !== null) primary.fallback = fallback;
+  }
+  return primary;
+}
+function fallbackSelectionFrom(config2) {
+  const raw2 = config2.ai?.fallbackPlatform;
+  if (raw2 === void 0 || raw2 === "") return null;
+  const parsed = AIPlatformSchema.safeParse(raw2);
+  if (!parsed.success || parsed.data === "apple") return null;
+  return { platform: parsed.data, model: config2.ai?.fallbackModel ?? getDefaultModel(parsed.data) };
+}
+function loadFallbackSelection() {
+  return fallbackSelectionFrom(readConfigFile());
+}
+function resolveFallbackConfig(config2) {
+  const sel = fallbackSelectionFrom(config2);
+  return sel === null ? null : resolvePlatformConfig(sel.platform, sel.model);
+}
+function saveAIConfigPreferences(platform, model, opts = {}) {
   updateGlobalConfig((config2) => {
     const parsed = ConfigFileSchema.safeParse(config2);
     const cfg = parsed.success ? parsed.data : {};
     cfg.ai ??= {};
     cfg.ai.platform = platform;
     cfg.ai.model = model;
+    if (opts.localEndpoint !== void 0) {
+      const trimmed = opts.localEndpoint.trim();
+      cfg.ai.localEndpoint = trimmed === "" ? void 0 : trimmed;
+    }
+    if (opts.fallbackPlatform !== void 0) {
+      const fp = opts.fallbackPlatform.trim();
+      const fm = opts.fallbackModel?.trim();
+      cfg.ai.fallbackPlatform = fp === "" ? void 0 : fp;
+      cfg.ai.fallbackModel = fp === "" || fm === void 0 || fm === "" ? void 0 : fm;
+    }
     return cfg;
   });
 }
@@ -16495,14 +17353,14 @@ async function getUserPreferences() {
     last_image_mode: "metadata"
   };
   if (result.rows.length === 0) return defaults;
-  const raw = result.rows[0];
+  const raw2 = result.rows[0];
   const merged = {
-    sort_mode: typeof raw.sort_mode === "string" ? raw.sort_mode : defaults.sort_mode,
-    risk_sort_dimension: typeof raw.risk_sort_dimension === "string" ? raw.risk_sort_dimension : defaults.risk_sort_dimension,
-    show_risk_scores: typeof raw.show_risk_scores === "boolean" ? raw.show_risk_scores : defaults.show_risk_scores,
-    ignore_whitespace: typeof raw.ignore_whitespace === "boolean" ? raw.ignore_whitespace : defaults.ignore_whitespace,
-    svg_view_mode: typeof raw.svg_view_mode === "string" ? raw.svg_view_mode : defaults.svg_view_mode,
-    last_image_mode: typeof raw.last_image_mode === "string" ? raw.last_image_mode : defaults.last_image_mode
+    sort_mode: typeof raw2.sort_mode === "string" ? raw2.sort_mode : defaults.sort_mode,
+    risk_sort_dimension: typeof raw2.risk_sort_dimension === "string" ? raw2.risk_sort_dimension : defaults.risk_sort_dimension,
+    show_risk_scores: typeof raw2.show_risk_scores === "boolean" ? raw2.show_risk_scores : defaults.show_risk_scores,
+    ignore_whitespace: typeof raw2.ignore_whitespace === "boolean" ? raw2.ignore_whitespace : defaults.ignore_whitespace,
+    svg_view_mode: typeof raw2.svg_view_mode === "string" ? raw2.svg_view_mode : defaults.svg_view_mode,
+    last_image_mode: typeof raw2.last_image_mode === "string" ? raw2.last_image_mode : defaults.last_image_mode
   };
   return UserPreferencesSchema.parse(merged);
 }
@@ -16526,6 +17384,17 @@ async function saveUserPreferences(prefs) {
 
 // src/demo.ts
 init_queries();
+function demoReviewNotes(filePath) {
+  if (filePath !== "src/auth/session.ts") return [];
+  return [
+    { guid: "demo-note-rationale", line: 14, side: "new", kind: "rationale", body: "`createSession` is **async** now because session state moved from an in-process `Map` to Redis; callers must `await` it.", confidence: 0.9, producer: "Claude Code" },
+    { guid: "demo-note-proof", line: 23, side: "new", kind: "proof", body: "The TTL is written atomically with the value via the EX option, so a session can never be stored without an expiry.", producer: "Claude Code", artifacts: [{ uri: ".pr-notes/artifacts/session-ttl.test.txt", content: "PASS  session.test.ts\n  \u2713 createSession writes value and TTL atomically (4 ms)\n  \u2713 a session always has an expiry (2 ms)\n\nTests: 2 passed, 2 total" }] },
+    { guid: "demo-note-risk", line: 31, side: "new", kind: "risk", body: "expiresAt round-trips through JSON as a string and is re-wrapped in Date() \u2014 verify the comparison holds in your runtime.", confidence: 0.6, producer: "Claude Code", artifacts: [{ uri: "assets/demo-annotations.png", isImage: true }] },
+    // Re-anchoring showcase (P3): authored against a 16-byte id, but the code
+    // now uses 32 bytes, so the note no longer matches and renders as stale.
+    { guid: "demo-note-stale", line: 15, side: "new", kind: "assumption", body: "Assumed a 16-byte token id here \u2014 the implementation has since changed, so this note is out of date.", producer: "Claude Code", snippet: "  const id = randomBytes(16).toString('hex');" }
+  ];
+}
 var DEMO_SCENARIOS = [
   { id: 1, label: "Main UI with guided review notes" },
   { id: 2, label: "Risk mode with inline risk notes" },
@@ -16922,6 +17791,9 @@ var NARRATIVE_ORDER = [
   { path: "tests/auth.test.ts", position: 7, rationale: "Tests \u2014 read last to verify the changes work correctly.", notes: { overview: "Tests for the session management changes. Read these last to confirm the new async API works as expected.", lines: [] } }
 ];
 var ANNOTATIONS = [
+  // A reviewer reply to the line-31 risk review note (doc 20 threading) —
+  // renders nested beneath that note.
+  { filePath: "src/auth/session.ts", line: 31, side: "new", category: "note", content: "Confirmed \u2014 the JSON value is an ISO string, so new Date() parses it and the comparison holds.", replyToNoteId: "demo-note-risk" },
   { filePath: "src/auth/session.ts", line: 23, side: "new", category: "bug", content: "Redis key should be sanitized \u2014 if a session ID contains a colon, it will conflict with the key namespace." },
   { filePath: "src/auth/session.ts", line: 30, side: "new", category: "fix", content: "Wrap JSON.parse in try/catch to handle corrupted Redis data gracefully instead of crashing." },
   { filePath: "src/auth/session.ts", line: 12, side: "new", category: "pattern-follow", content: "Good use of a named constant instead of a magic number. This makes the TTL self-documenting." },
@@ -17034,7 +17906,7 @@ async function setupAnnotations(fileIdMap) {
   for (const ann of ANNOTATIONS) {
     const fileId = fileIdMap.get(ann.filePath);
     if (fileId !== void 0) {
-      await addAnnotation(fileId, ann.line, ann.side, ann.category, ann.content);
+      await addAnnotation(fileId, ann.line, ann.side, ann.category, ann.content, ann.replyToNoteId);
     }
   }
 }
@@ -17120,11 +17992,11 @@ function emptyFileDiff(filePath = "") {
     isBinary: false
   };
 }
-function parseDiffData(raw) {
-  if (raw === null || raw === void 0 || raw === "") return null;
+function parseDiffData(raw2) {
+  if (raw2 === null || raw2 === void 0 || raw2 === "") return null;
   let parsed;
   try {
-    parsed = JSON.parse(raw);
+    parsed = JSON.parse(raw2);
   } catch {
     return null;
   }
@@ -17286,9 +18158,9 @@ function createNewFileDiff(filePath, repoRoot) {
     isBinary: false
   };
 }
-function parseDiff(raw) {
+function parseDiff(raw2) {
   const files = [];
-  const fileChunks = raw.split(/^diff --git /m).filter(Boolean);
+  const fileChunks = raw2.split(/^diff --git /m).filter(Boolean);
   for (const chunk of fileChunks) {
     const headerEnd = chunk.indexOf("@@");
     const header = headerEnd === -1 ? chunk : chunk.slice(0, headerEnd);
@@ -17323,12 +18195,12 @@ function parseDiff(raw) {
   }
   return files;
 }
-function parseHunks(raw) {
+function parseHunks(raw2) {
   const hunks = [];
   const hunkRegex = /^@@\s+-(\d+)(?:,(\d+))?\s+\+(\d+)(?:,(\d+))?\s+@@(.*)/gm;
   let match;
   const hunkStarts = [];
-  while ((match = hunkRegex.exec(raw)) !== null) {
+  while ((match = hunkRegex.exec(raw2)) !== null) {
     const groups = match;
     hunkStarts.push({
       index: match.index + match[0].length,
@@ -17340,8 +18212,8 @@ function parseHunks(raw) {
   }
   for (let i = 0; i < hunkStarts.length; i++) {
     const start = hunkStarts[i];
-    const end = i + 1 < hunkStarts.length ? raw.lastIndexOf("\n@@", hunkStarts[i + 1].index) : raw.length;
-    const body = raw.slice(start.index, end);
+    const end = i + 1 < hunkStarts.length ? raw2.lastIndexOf("\n@@", hunkStarts[i + 1].index) : raw2.length;
+    const body = raw2.slice(start.index, end);
     const lines = [];
     let oldNum = start.oldStart;
     let newNum = start.newStart;
@@ -17494,8 +18366,8 @@ function acquireLock(dataDir) {
   lockPath = join4(dataDir, "glassbox.lock");
   if (existsSync3(lockPath)) {
     try {
-      const raw = JSON.parse(readFileSync3(lockPath, "utf-8"));
-      const contents = LockFileSchema.parse(raw);
+      const raw2 = JSON.parse(readFileSync3(lockPath, "utf-8"));
+      const contents = LockFileSchema.parse(raw2);
       const pid = contents.pid;
       try {
         process.kill(pid, 0);
@@ -17643,9 +18515,9 @@ async function updateReviewDiffs(reviewId, newDiffs, headCommit) {
 
 // src/server.ts
 import { serve } from "@hono/node-server";
-import { existsSync as existsSync10, readFileSync as readFileSync13 } from "fs";
-import { Hono as Hono18 } from "hono";
-import { dirname as dirname3, join as join13 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync15 } from "fs";
+import { Hono as Hono19 } from "hono";
+import { dirname as dirname4, join as join15 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/channel-config.ts
@@ -17680,8 +18552,8 @@ function registerChannel(dataDir) {
   let config2 = {};
   if (existsSync4(mcpPath)) {
     try {
-      const raw = JSON.parse(readFileSync4(mcpPath, "utf-8"));
-      const parsed = McpConfigSchema.safeParse(raw);
+      const raw2 = JSON.parse(readFileSync4(mcpPath, "utf-8"));
+      const parsed = McpConfigSchema.safeParse(raw2);
       if (parsed.success) config2 = parsed.data;
     } catch {
     }
@@ -17698,8 +18570,8 @@ function unregisterChannel(dataDir) {
   const mcpPath = join5(root, ".mcp.json");
   if (!existsSync4(mcpPath)) return;
   try {
-    const raw = JSON.parse(readFileSync4(mcpPath, "utf-8"));
-    const parsed = McpConfigSchema.safeParse(raw);
+    const raw2 = JSON.parse(readFileSync4(mcpPath, "utf-8"));
+    const parsed = McpConfigSchema.safeParse(raw2);
     if (!parsed.success) return;
     const config2 = parsed.data;
     if (config2.mcpServers?.[MCP_SERVER_KEY] !== void 0) {
@@ -17725,8 +18597,8 @@ async function isChannelAlive(dataDir) {
   if (port === null) return false;
   try {
     const res = await fetch(`http://127.0.0.1:${port}/health`);
-    const raw = await res.json();
-    const parsed = HealthResponseSchema.safeParse(raw);
+    const raw2 = await res.json();
+    const parsed = HealthResponseSchema.safeParse(raw2);
     return parsed.success && parsed.data.ok;
   } catch {
     return false;
@@ -17759,8 +18631,120 @@ init_zod();
 // src/ai/shared.ts
 init_zod();
 
+// src/review-notes/format.ts
+init_store();
+init_view();
+function notesByFile(repoRoot, filePaths) {
+  const out = [];
+  for (const file2 of filePaths) {
+    const notes = loadReviewNotesForFile(repoRoot, file2);
+    if (notes.length > 0) out.push({ file: file2, notes });
+  }
+  return out;
+}
+function reviewNotesPromptSection(repoRoot, filePaths) {
+  const grouped = notesByFile(repoRoot, filePaths);
+  if (grouped.length === 0) return "";
+  const lines = [
+    "=== Author review notes ===",
+    "The author (an AI tool) left line-anchored notes explaining these changes. Use them to inform your analysis \u2014 weight their stated risks and assumptions.",
+    ""
+  ];
+  for (const { file: file2, notes } of grouped) {
+    lines.push(`${file2}:`);
+    for (const n of notes) {
+      lines.push(`- [${REVIEW_NOTE_LABELS[n.kind] ?? n.kind}, L${String(n.line)}] ${n.body}`);
+    }
+    lines.push("");
+  }
+  return lines.join("\n").trimEnd();
+}
+function reviewNotesExportSection(repoRoot, filePaths) {
+  const grouped = notesByFile(repoRoot, filePaths);
+  if (grouped.length === 0) return [];
+  const lines = [
+    "## AI Review Notes",
+    "",
+    "> Line-anchored notes the generating AI left explaining its changes (from `.pr-notes/`). Read these for the rationale and proof behind the code.",
+    ""
+  ];
+  for (const { file: file2, notes } of grouped) {
+    lines.push(`### ${file2}`);
+    lines.push("");
+    for (const n of notes) {
+      const who = n.producer !== void 0 ? ` _(${n.producer})_` : "";
+      lines.push(`- **Line ${String(n.line)}** [${n.kind}]: ${n.body}${who}`);
+    }
+    lines.push("");
+  }
+  return lines;
+}
+
 // src/ai/client.ts
 init_zod();
+
+// src/ai/apple-foundation.ts
+init_zod();
+import { spawn } from "child_process";
+import { existsSync as existsSync6 } from "fs";
+import { join as join7 } from "path";
+var defaultRunner = (bin, args, stdin) => new Promise((resolve11, reject) => {
+  const child = spawn(bin, args, { stdio: ["pipe", "pipe", "ignore"] });
+  let stdout = "";
+  child.stdout.setEncoding("utf-8");
+  child.stdout.on("data", (chunk) => {
+    stdout += chunk;
+  });
+  child.on("error", reject);
+  child.on("close", (code) => {
+    resolve11({ stdout, code: code ?? 0 });
+  });
+  child.stdin.end(stdin);
+});
+var runner = defaultRunner;
+var isDarwin = process.platform === "darwin";
+var availabilityCache = null;
+function appleFmBinPath() {
+  const env = process.env.GLASSBOX_APPLE_FM_BIN;
+  if (env !== void 0 && env !== "" && existsSync6(env)) return env;
+  const fallback = join7(process.cwd(), "apple-fm-helper");
+  if (existsSync6(fallback)) return fallback;
+  return null;
+}
+async function isAppleFoundationAvailable() {
+  if (availabilityCache !== null) return availabilityCache;
+  availabilityCache = await probeAvailability();
+  return availabilityCache;
+}
+async function probeAvailability() {
+  if (!isDarwin) return false;
+  const bin = appleFmBinPath();
+  if (bin === null) return false;
+  try {
+    const { stdout, code } = await runner(bin, ["--probe"], "");
+    return code === 0 && stdout.trim().toLowerCase().startsWith("available");
+  } catch {
+    return false;
+  }
+}
+var InferOutputSchema = external_exports.object({ content: external_exports.string() });
+async function runAppleFoundationInfer(system, messages) {
+  const bin = appleFmBinPath();
+  if (bin === null) throw new Error("Apple Foundation Models helper not found");
+  const { stdout, code } = await runner(bin, ["--infer"], JSON.stringify({ system, messages }));
+  if (code !== 0) throw new Error(`Apple Foundation Models helper exited with code ${String(code)}`);
+  let raw2;
+  try {
+    raw2 = JSON.parse(stdout);
+  } catch {
+    throw new Error("Apple Foundation Models helper returned non-JSON output");
+  }
+  const parsed = InferOutputSchema.safeParse(raw2);
+  if (!parsed.success) throw new Error("Apple Foundation Models helper returned an unexpected payload");
+  return parsed.data.content;
+}
+
+// src/ai/client.ts
 var AnthropicResponseSchema = external_exports.object({
   content: external_exports.array(external_exports.object({ type: external_exports.string(), text: external_exports.string().optional() }).loose()),
   usage: external_exports.object({ input_tokens: external_exports.number(), output_tokens: external_exports.number() }).loose()
@@ -17771,6 +18755,12 @@ var OpenAIResponseSchema = external_exports.object({
   }).loose()).min(1),
   usage: external_exports.object({ prompt_tokens: external_exports.number(), completion_tokens: external_exports.number() }).loose()
 }).loose();
+var LocalResponseSchema = external_exports.object({
+  choices: external_exports.array(external_exports.object({
+    message: external_exports.object({ content: external_exports.string() }).loose()
+  }).loose()).min(1),
+  usage: external_exports.object({ prompt_tokens: external_exports.number(), completion_tokens: external_exports.number() }).loose().optional()
+}).loose();
 var GoogleResponseSchema = external_exports.object({
   candidates: external_exports.array(external_exports.object({
     content: external_exports.object({
@@ -17782,23 +18772,35 @@ var GoogleResponseSchema = external_exports.object({
     candidatesTokenCount: external_exports.number()
   }).loose().optional()
 }).loose();
-async function sendAIRequest(config2, systemPrompt, messages) {
+function requireKey(config2) {
   if (config2.apiKey === null) {
     throw new Error(`No API key configured for ${config2.platform}`);
   }
+  return config2.apiKey;
+}
+async function sendAIRequest(config2, systemPrompt, messages) {
+  if (config2.apiKey === null && !KEYLESS_PLATFORMS.has(config2.platform)) {
+    throw new Error(`No API key configured for ${config2.platform}`);
+  }
   const totalChars = messages.reduce((sum, m) => sum + m.content.length, 0) + systemPrompt.length;
   debugLog(`AI request \u2192 ${config2.platform}/${config2.model} | ${String(messages.length)} message(s) | ~${String(Math.ceil(totalChars / 3))} estimated tokens`);
   const start = Date.now();
   let response;
   switch (config2.platform) {
     case "anthropic":
-      response = await sendAnthropicRequest(config2.apiKey, config2.model, systemPrompt, messages);
+      response = await sendAnthropicRequest(requireKey(config2), config2.model, systemPrompt, messages);
       break;
     case "openai":
-      response = await sendOpenAIRequest(config2.apiKey, config2.model, systemPrompt, messages);
+      response = await sendOpenAIRequest(requireKey(config2), config2.model, systemPrompt, messages);
       break;
     case "google":
-      response = await sendGoogleRequest(config2.apiKey, config2.model, systemPrompt, messages);
+      response = await sendGoogleRequest(requireKey(config2), config2.model, systemPrompt, messages);
+      break;
+    case "local":
+      response = await sendLocalRequest(config2.baseUrl ?? DEFAULT_LOCAL_ENDPOINT, config2.apiKey, config2.model, systemPrompt, messages);
+      break;
+    case "apple":
+      response = await sendAppleRequest(systemPrompt, messages);
       break;
   }
   const elapsed = ((Date.now() - start) / 1e3).toFixed(1);
@@ -17827,8 +18829,8 @@ async function sendAnthropicRequest(apiKey, model, systemPrompt, messages) {
     const errorText = await response.text();
     throw new Error(`Anthropic API error (${String(response.status)}): ${errorText}`);
   }
-  const raw = await response.json();
-  const data = AnthropicResponseSchema.parse(raw);
+  const raw2 = await response.json();
+  const data = AnthropicResponseSchema.parse(raw2);
   const text = data.content.filter((c) => c.type === "text").map((c) => c.text ?? "").join("");
   return {
     content: text,
@@ -17857,14 +18859,42 @@ async function sendOpenAIRequest(apiKey, model, systemPrompt, messages) {
     const errorText = await response.text();
     throw new Error(`OpenAI API error (${String(response.status)}): ${errorText}`);
   }
-  const raw = await response.json();
-  const data = OpenAIResponseSchema.parse(raw);
+  const raw2 = await response.json();
+  const data = OpenAIResponseSchema.parse(raw2);
   return {
     content: data.choices[0].message.content,
     inputTokens: data.usage.prompt_tokens,
     outputTokens: data.usage.completion_tokens
   };
 }
+async function sendLocalRequest(baseUrl, apiKey, model, systemPrompt, messages) {
+  const oaiMessages = [
+    { role: "system", content: systemPrompt },
+    ...messages.map((m) => ({ role: m.role, content: m.content }))
+  ];
+  const headers = { "Content-Type": "application/json" };
+  if (apiKey !== null && apiKey !== "") headers.Authorization = `Bearer ${apiKey}`;
+  const response = await fetch(`${baseUrl}/chat/completions`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify({ model, messages: oaiMessages, max_tokens: 8192, stream: false })
+  });
+  if (!response.ok) {
+    const errorText = await response.text();
+    throw new Error(`Local model error (${String(response.status)}): ${errorText}`);
+  }
+  const raw2 = await response.json();
+  const data = LocalResponseSchema.parse(raw2);
+  return {
+    content: data.choices[0].message.content,
+    inputTokens: data.usage?.prompt_tokens ?? 0,
+    outputTokens: data.usage?.completion_tokens ?? 0
+  };
+}
+async function sendAppleRequest(systemPrompt, messages) {
+  const content = await runAppleFoundationInfer(systemPrompt, messages);
+  return { content, inputTokens: 0, outputTokens: 0 };
+}
 async function sendGoogleRequest(apiKey, model, systemPrompt, messages) {
   const contents = messages.map((m) => ({
     role: m.role === "assistant" ? "model" : "user",
@@ -17889,8 +18919,8 @@ async function sendGoogleRequest(apiKey, model, systemPrompt, messages) {
     const errorText = await response.text();
     throw new Error(`Google AI API error (${String(response.status)}): ${errorText}`);
   }
-  const raw = await response.json();
-  const data = GoogleResponseSchema.parse(raw);
+  const raw2 = await response.json();
+  const data = GoogleResponseSchema.parse(raw2);
   const text = data.candidates[0].content.parts.map((p) => p.text).join("");
   return {
     content: text,
@@ -18014,14 +19044,26 @@ function extractJSON(text) {
   throw new Error(`Could not extract JSON from AI response: ${text.slice(0, 300)}`);
 }
 async function runAnalysisBatch(files, config2, repoRoot, options) {
+  try {
+    return await runAnalysisBatchOnce(files, config2, repoRoot, options);
+  } catch (err) {
+    if (config2.fallback === void 0) throw err;
+    const msg = err instanceof Error ? err.message : String(err);
+    debugLog(`[${options.analysisName}] primary platform '${config2.platform}' failed for batch (${msg.slice(0, 160)}); retrying with fallback '${config2.fallback.platform}'`);
+    return runAnalysisBatchOnce(files, config2.fallback, repoRoot, options);
+  }
+}
+async function runAnalysisBatchOnce(files, config2, repoRoot, options) {
   const contextWindow = getModelContextWindow(config2.platform, config2.model);
   const charBudget = Math.floor(contextWindow * 0.7 * 3);
   const contexts = buildFileContexts(files, charBudget);
   const validPaths = new Set(files.map((f) => f.file_path));
+  const notesSection = reviewNotesPromptSection(repoRoot, files.map((f) => f.file_path));
   const initialPrompt = [
     options.initialPromptHeader(files.length),
     "",
-    formatContextsForPrompt(contexts)
+    formatContextsForPrompt(contexts),
+    ...notesSection === "" ? [] : ["", notesSection]
   ].join("\n");
   const messages = [{ role: "user", content: initialPrompt }];
   for (let round = 0; round < 3; round++) {
@@ -18045,7 +19087,8 @@ ${formatAdditionalContext(fileContents)}`
       });
       continue;
     }
-    const arrayResult = external_exports.array(options.itemSchema).safeParse(parsed);
+    const candidate = Array.isArray(parsed) ? parsed : [parsed];
+    const arrayResult = external_exports.array(options.itemSchema).safeParse(candidate);
     if (!arrayResult.success) {
       const summary = arrayResult.error.issues.slice(0, 3).map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
       throw new Error(`Expected an array of ${options.resultLabel} from AI \u2014 ${summary}`);
@@ -18486,8 +19529,8 @@ function isRetriable(err) {
   return msg.includes("429") || msg.includes("500") || msg.includes("502") || msg.includes("503") || msg.includes("504") || msg.includes("rate_limit");
 }
 function sleep(ms) {
-  return new Promise((resolve9) => {
-    setTimeout(resolve9, ms);
+  return new Promise((resolve11) => {
+    setTimeout(resolve11, ms);
   });
 }
 
@@ -18531,8 +19574,8 @@ function randomLines(count) {
   return lines.sort((a, b) => a.line - b.line);
 }
 function sleep2(ms) {
-  return new Promise((resolve9) => {
-    setTimeout(resolve9, ms);
+  return new Promise((resolve11) => {
+    setTimeout(resolve11, ms);
   });
 }
 async function mockRiskAnalysisBatch(files) {
@@ -18699,17 +19742,32 @@ var AIConfigRespSchema = external_exports.object({
   model: external_exports.string(),
   keyConfigured: external_exports.boolean(),
   keySource: KeySourceSchema,
-  guidedReview: GuidedReviewConfigShapeSchema
+  /** Base URL for the `local` (OpenAI-compatible) platform. */
+  localEndpoint: external_exports.string(),
+  guidedReview: GuidedReviewConfigShapeSchema,
+  /** Secondary model used when the primary (Apple FM) fails a batch. `null`
+   *  when none is configured. */
+  fallbackPlatform: AIPlatformSchema.nullable(),
+  fallbackModel: external_exports.string().nullable()
 });
 var SaveAIConfigReqSchema = external_exports.object({
   platform: AIPlatformSchema,
   model: external_exports.string().min(1),
-  guidedReview: GuidedReviewConfigShapeSchema.optional()
+  localEndpoint: external_exports.string().optional(),
+  guidedReview: GuidedReviewConfigShapeSchema.optional(),
+  /** Apple-FM fallback selection. An empty `fallbackPlatform` clears it. */
+  fallbackPlatform: external_exports.string().optional(),
+  fallbackModel: external_exports.string().optional()
 });
 var SaveAIConfigRespSchema = OkResponseSchema;
 var ListAIModelsRespSchema = external_exports.object({
   platforms: external_exports.record(AIPlatformSchema, external_exports.string()),
-  models: external_exports.record(AIPlatformSchema, external_exports.array(AIModelSchema))
+  models: external_exports.record(AIPlatformSchema, external_exports.array(AIModelSchema)),
+  // Whether the on-device Apple Foundation Models helper is available right now
+  // (macOS 26 + Apple Intelligence + bundled helper). The picker uses this to
+  // show/hide the Apple platform; the `platforms`/`models` records always carry
+  // every platform key (the record schema over the platform enum is exhaustive).
+  appleAvailable: external_exports.boolean()
 });
 var AIKeyStatusEntrySchema = external_exports.object({
   configured: external_exports.boolean(),
@@ -18892,7 +19950,9 @@ var CreateAnnotationReqSchema = external_exports.object({
   lineNumber: external_exports.number().int().min(1),
   side: AnnotationSideSchema,
   category: AnnotationCategorySchema,
-  content: external_exports.string().min(1)
+  content: external_exports.string().min(1),
+  /** SARIF guid of the AI review note this annotation replies to (doc 20 threading). */
+  replyToNoteId: external_exports.string().optional()
 });
 var CreateAnnotationRespSchema = AnnotationSchema;
 var UpdateAnnotationReqSchema = external_exports.object({
@@ -19954,6 +21014,19 @@ var DifftoolPollRespSchema = external_exports.object({
 });
 var DifftoolEndRespSchema = external_exports.object({ ok: external_exports.literal(true) });
 
+// src/api/review-notes.ts
+init_zod();
+var DiscardReviewNoteReqSchema = external_exports.object({
+  guid: external_exports.string().min(1),
+  /** Repo-relative source file the note is on (scopes the shard search). */
+  file: external_exports.string().min(1)
+});
+var DiscardReviewNoteRespSchema = external_exports.object({
+  ok: external_exports.boolean(),
+  /** Whether a note was actually removed (false if it wasn't on disk, e.g. demo). */
+  removed: external_exports.boolean()
+});
+
 // src/api/index.ts
 var apis = {
   ...ai_exports,
@@ -19977,13 +21050,13 @@ init_schemas3();
 
 // src/utils/parseBody.ts
 async function parseBody(c, schema) {
-  let raw;
+  let raw2;
   try {
-    raw = await c.req.json();
+    raw2 = await c.req.json();
   } catch {
     return { ok: false, response: c.json({ error: "Body must be valid JSON" }, 400) };
   }
-  const result = schema.safeParse(raw);
+  const result = schema.safeParse(raw2);
   if (!result.success) {
     const summary = result.error.issues.map((i) => `${i.path.join(".") || "<root>"}: ${i.message}`).join("; ");
     return { ok: false, response: c.json({ error: summary }, 400) };
@@ -19991,8 +21064,8 @@ async function parseBody(c, schema) {
   return { ok: true, data: result.data };
 }
 function parseQuery(c, schema) {
-  const raw = c.req.query();
-  const result = schema.safeParse(raw);
+  const raw2 = c.req.query();
+  const result = schema.safeParse(raw2);
   if (!result.success) {
     const summary = result.error.issues.map((i) => `${i.path.join(".") || "<root>"}: ${i.message}`).join("; ");
     return { ok: false, response: c.json({ error: summary }, 400) };
@@ -20042,7 +21115,7 @@ aiAnalysisRoutes.post("/analyze", async (c) => {
   debugLog(`POST /analyze: type=${analysisType}, reviewId=${reviewId}`);
   const testMode = isAIServiceTest();
   const config2 = loadAIConfig();
-  if (config2.apiKey === null && !testMode) {
+  if (config2.apiKey === null && !testMode && !KEYLESS_PLATFORMS.has(config2.platform)) {
     debugLog("POST /analyze: no API key configured");
     return c.json({ error: "No API key configured" }, 400);
   }
@@ -20443,11 +21516,11 @@ function anthropicContextWindow(id) {
   return id.toLowerCase().includes("haiku") ? 2e5 : 1e6;
 }
 async function fetchAnthropic(apiKey) {
-  const raw = await getJson("https://api.anthropic.com/v1/models?limit=1000", {
+  const raw2 = await getJson("https://api.anthropic.com/v1/models?limit=1000", {
     "x-api-key": apiKey,
     "anthropic-version": "2023-06-01"
   });
-  const parsed = AnthropicListSchema.safeParse(raw);
+  const parsed = AnthropicListSchema.safeParse(raw2);
   if (!parsed.success) return null;
   return parsed.data.data.map((m) => ({
     id: m.id,
@@ -20466,13 +21539,21 @@ function isOpenAIChatModel(id) {
   return isChat && !isNonChat;
 }
 async function fetchOpenAI(apiKey) {
-  const raw = await getJson("https://api.openai.com/v1/models", {
+  const raw2 = await getJson("https://api.openai.com/v1/models", {
     Authorization: `Bearer ${apiKey}`
   });
-  const parsed = OpenAIListSchema.safeParse(raw);
+  const parsed = OpenAIListSchema.safeParse(raw2);
   if (!parsed.success) return null;
   return parsed.data.data.filter((m) => isOpenAIChatModel(m.id)).map((m) => ({ id: m.id, name: m.id, contextWindow: 128e3, isDefault: false }));
 }
+async function fetchLocal(baseUrl, apiKey) {
+  const headers = {};
+  if (apiKey !== "") headers.Authorization = `Bearer ${apiKey}`;
+  const raw2 = await getJson(`${baseUrl}/models`, headers);
+  const parsed = OpenAIListSchema.safeParse(raw2);
+  if (!parsed.success) return null;
+  return parsed.data.data.map((m) => ({ id: m.id, name: m.id, contextWindow: 8192, isDefault: false }));
+}
 var GoogleListSchema = external_exports.object({
   models: external_exports.array(external_exports.object({
     name: external_exports.string(),
@@ -20482,11 +21563,11 @@ var GoogleListSchema = external_exports.object({
   }))
 });
 async function fetchGoogle(apiKey) {
-  const raw = await getJson(
+  const raw2 = await getJson(
     `https://generativelanguage.googleapis.com/v1beta/models?pageSize=1000&key=${encodeURIComponent(apiKey)}`,
     {}
   );
-  const parsed = GoogleListSchema.safeParse(raw);
+  const parsed = GoogleListSchema.safeParse(raw2);
   if (!parsed.success) return null;
   return parsed.data.models.filter((m) => (m.supportedGenerationMethods ?? []).includes("generateContent")).map((m) => ({
     id: m.name.replace(/^models\//, ""),
@@ -20495,10 +21576,11 @@ async function fetchGoogle(apiKey) {
     isDefault: false
   }));
 }
-async function fetchAvailableModels(platform, apiKey) {
+async function fetchAvailableModels(platform, apiKey, opts = {}) {
   let models;
   if (platform === "anthropic") models = await fetchAnthropic(apiKey);
   else if (platform === "openai") models = await fetchOpenAI(apiKey);
+  else if (platform === "local") models = await fetchLocal(opts.baseUrl ?? "", apiKey);
   else models = await fetchGoogle(apiKey);
   if (models === null || models.length === 0) return null;
   const defaultId = getDefaultModel(platform);
@@ -20511,21 +21593,32 @@ async function fetchAvailableModels(platform, apiKey) {
 
 // src/routes/ai-config.ts
 var aiConfigRoutes = new Hono2();
-aiConfigRoutes.get("/config", (c) => {
+aiConfigRoutes.get("/config", async (c) => {
   const config2 = loadAIConfig();
+  const appleReady = APPLE_FM_ANALYSIS_ENABLED && config2.platform === "apple" && await isAppleFoundationAvailable();
+  const fallbackSelection = loadFallbackSelection();
   return c.json({
     platform: config2.platform,
     model: config2.model,
-    keyConfigured: config2.apiKey !== null || isAIServiceTest() || getDemoMode() !== null,
+    keyConfigured: config2.apiKey !== null || config2.platform === "local" || appleReady || isAIServiceTest() || getDemoMode() !== null,
     keySource: config2.keySource,
-    guidedReview: loadGuidedReviewConfig()
+    localEndpoint: resolveLocalEndpoint(),
+    guidedReview: loadGuidedReviewConfig(),
+    // Apple-FM fallback selection as stored, regardless of the current primary
+    // platform, so the settings dialog can show/preserve it; `null` when unset.
+    fallbackPlatform: fallbackSelection?.platform ?? null,
+    fallbackModel: fallbackSelection?.model ?? null
   });
 });
 aiConfigRoutes.post("/config", async (c) => {
   const parsed = await parseBody(c, SaveAIConfigReqSchema);
   if (!parsed.ok) return parsed.response;
   const body = parsed.data;
-  saveAIConfigPreferences(body.platform, body.model);
+  saveAIConfigPreferences(body.platform, body.model, {
+    localEndpoint: body.localEndpoint,
+    fallbackPlatform: body.fallbackPlatform,
+    fallbackModel: body.fallbackModel
+  });
   if (body.guidedReview !== void 0) {
     saveGuidedReviewConfig(body.guidedReview);
   }
@@ -20533,7 +21626,13 @@ aiConfigRoutes.post("/config", async (c) => {
 });
 aiConfigRoutes.get("/models", async (c) => {
   const platforms = ["anthropic", "openai", "google"];
-  const models = { anthropic: MODELS.anthropic, openai: MODELS.openai, google: MODELS.google };
+  const models = {
+    anthropic: MODELS.anthropic,
+    openai: MODELS.openai,
+    google: MODELS.google,
+    local: MODELS.local,
+    apple: MODELS.apple
+  };
   if (!isAIServiceTest() && getDemoMode() === null) {
     await Promise.all(platforms.map(async (platform) => {
       const { key } = resolveAPIKey(platform);
@@ -20541,11 +21640,15 @@ aiConfigRoutes.get("/models", async (c) => {
       const live = await fetchAvailableModels(platform, key);
       if (live !== null && live.length > 0) models[platform] = live;
     }));
+    const { key: localKey } = resolveAPIKey("local");
+    const localLive = await fetchAvailableModels("local", localKey ?? "", { baseUrl: resolveLocalEndpoint() });
+    if (localLive !== null && localLive.length > 0) models.local = localLive;
   }
-  return c.json({ platforms: PLATFORMS, models });
+  const appleAvailable = APPLE_FM_ANALYSIS_ENABLED && (isAIServiceTest() || await isAppleFoundationAvailable());
+  return c.json({ platforms: PLATFORMS, models, appleAvailable });
 });
 aiConfigRoutes.get("/key-status", (c) => {
-  const platforms = ["anthropic", "openai", "google"];
+  const platforms = ["anthropic", "openai", "google", "local", "apple"];
   const status = {};
   for (const platform of platforms) {
     const { source } = resolveAPIKey(platform);
@@ -20569,7 +21672,7 @@ aiConfigRoutes.delete("/key", (c) => {
   const platform = c.req.query("platform") ?? "anthropic";
   const parsed = AIPlatformSchema.safeParse(platform);
   if (!parsed.success) {
-    return errorResponse(c, `platform must be one of: anthropic, openai, google`);
+    return errorResponse(c, `platform must be one of: ${Object.keys(PLATFORMS).join(", ")}`);
   }
   deleteAPIKey(parsed.data);
   return c.json({ ok: true });
@@ -20581,7 +21684,7 @@ aiApiRoutes.route("/", aiConfigRoutes);
 aiApiRoutes.route("/", aiAnalysisRoutes);
 
 // src/routes/api.ts
-import { Hono as Hono13 } from "hono";
+import { Hono as Hono14 } from "hono";
 
 // src/routes/api/annotations.ts
 import { Hono as Hono4 } from "hono";
@@ -20590,28 +21693,28 @@ init_queries();
 // src/export/generate.ts
 init_zod();
 init_queries();
-import { spawnSync as spawnSync5 } from "child_process";
-import { appendFileSync, existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync5, unlinkSync, writeFileSync as writeFileSync5 } from "fs";
+import { spawnSync as spawnSync6 } from "child_process";
+import { appendFileSync, existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync6, unlinkSync as unlinkSync2, writeFileSync as writeFileSync6 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join6 } from "path";
-var DISMISS_FILE = join6(homedir2(), ".glassbox", "gitignore-dismissed.json");
+import { join as join8 } from "path";
+var DISMISS_FILE = join8(homedir2(), ".glassbox", "gitignore-dismissed.json");
 var DISMISS_DAYS = 30;
 var DismissalsSchema = external_exports.record(external_exports.string(), external_exports.number());
 function loadDismissals() {
   try {
-    const parsed = DismissalsSchema.safeParse(JSON.parse(readFileSync5(DISMISS_FILE, "utf-8")));
+    const parsed = DismissalsSchema.safeParse(JSON.parse(readFileSync6(DISMISS_FILE, "utf-8")));
     return parsed.success ? parsed.data : {};
   } catch {
     return {};
   }
 }
 function saveDismissals(data) {
-  const dir = join6(homedir2(), ".glassbox");
-  mkdirSync4(dir, { recursive: true });
-  writeFileSync5(DISMISS_FILE, JSON.stringify(data), "utf-8");
+  const dir = join8(homedir2(), ".glassbox");
+  mkdirSync5(dir, { recursive: true });
+  writeFileSync6(DISMISS_FILE, JSON.stringify(data), "utf-8");
 }
 function isGlassboxGitignored(repoRoot) {
-  const result = spawnSync5("git", ["check-ignore", "-q", ".glassbox"], { cwd: repoRoot, stdio: "pipe" });
+  const result = spawnSync6("git", ["check-ignore", "-q", ".glassbox"], { cwd: repoRoot, stdio: "pipe" });
   return result.status === 0;
 }
 function shouldPromptGitignore(repoRoot) {
@@ -20626,16 +21729,16 @@ function shouldPromptGitignore(repoRoot) {
   return true;
 }
 function addGlassboxToGitignore(repoRoot) {
-  const gitignorePath = join6(repoRoot, ".gitignore");
-  if (existsSync5(gitignorePath)) {
-    const content = readFileSync5(gitignorePath, "utf-8");
+  const gitignorePath = join8(repoRoot, ".gitignore");
+  if (existsSync7(gitignorePath)) {
+    const content = readFileSync6(gitignorePath, "utf-8");
     if (!content.endsWith("\n")) {
       appendFileSync(gitignorePath, "\n.glassbox/\n", "utf-8");
     } else {
       appendFileSync(gitignorePath, ".glassbox/\n", "utf-8");
     }
   } else {
-    writeFileSync5(gitignorePath, ".glassbox/\n", "utf-8");
+    writeFileSync6(gitignorePath, ".glassbox/\n", "utf-8");
   }
 }
 function dismissGitignorePrompt2(repoRoot) {
@@ -20644,17 +21747,17 @@ function dismissGitignorePrompt2(repoRoot) {
   saveDismissals(dismissals);
 }
 function deleteReviewExport(reviewId, repoRoot) {
-  const exportDir = join6(repoRoot, ".glassbox");
-  const archivePath = join6(exportDir, `review-${reviewId}.md`);
-  if (existsSync5(archivePath)) unlinkSync(archivePath);
+  const exportDir = join8(repoRoot, ".glassbox");
+  const archivePath = join8(exportDir, `review-${reviewId}.md`);
+  if (existsSync7(archivePath)) unlinkSync2(archivePath);
 }
 async function generateReviewExport(reviewId, repoRoot, isCurrent) {
   const review = await getReview(reviewId);
   if (!review) throw new Error("Review not found");
   const files = await getReviewFiles(reviewId);
   const annotations = await getAnnotationsForReview(reviewId);
-  const exportDir = join6(repoRoot, ".glassbox");
-  mkdirSync4(exportDir, { recursive: true });
+  const exportDir = join8(repoRoot, ".glassbox");
+  mkdirSync5(exportDir, { recursive: true });
   const byFile = {};
   for (const a of annotations) {
     if (!(a.file_path in byFile)) byFile[a.file_path] = [];
@@ -20705,6 +21808,8 @@ async function generateReviewExport(reviewId, repoRoot, isCurrent) {
     }
     lines.push("");
   }
+  const reviewNoteLines = reviewNotesExportSection(repoRoot, files.map((f) => f.file_path));
+  if (reviewNoteLines.length > 0) lines.push(...reviewNoteLines);
   lines.push("---");
   lines.push("");
   lines.push("## Instructions for AI Tools");
@@ -20719,11 +21824,11 @@ async function generateReviewExport(reviewId, repoRoot, isCurrent) {
   lines.push("6. **note** annotations are informational context. Consider them but they may not require code changes.");
   lines.push("");
   const content = lines.join("\n");
-  const archivePath = join6(exportDir, `review-${review.id}.md`);
-  writeFileSync5(archivePath, content, "utf-8");
+  const archivePath = join8(exportDir, `review-${review.id}.md`);
+  writeFileSync6(archivePath, content, "utf-8");
   if (isCurrent) {
-    const latestPath = join6(exportDir, "latest-review.md");
-    writeFileSync5(latestPath, content, "utf-8");
+    const latestPath = join8(exportDir, "latest-review.md");
+    writeFileSync6(latestPath, content, "utf-8");
     return latestPath;
   }
   return archivePath;
@@ -20754,7 +21859,8 @@ annotationsRoutes.post("/annotations", async (c) => {
     body.lineNumber,
     body.side,
     body.category,
-    body.content
+    body.content,
+    body.replyToNoteId
   );
   autoExport(c);
   return c.json(annotation, 201);
@@ -20841,7 +21947,7 @@ import { resolve as resolve4 } from "path";
 init_queries();
 
 // src/utils/openOS.ts
-import { execFileSync, spawn } from "child_process";
+import { execFileSync, spawn as spawn2 } from "child_process";
 import { resolve as resolve3 } from "path";
 function openOS(target, mode) {
   if (mode === "edit") {
@@ -20873,7 +21979,7 @@ function openOS(target, mode) {
   }
 }
 function launchDetached(command, args) {
-  const child = spawn(command, args, { detached: true, stdio: "ignore" });
+  const child = spawn2(command, args, { detached: true, stdio: "ignore" });
   child.on("error", (err) => {
     debugLog(`launchDetached(${command}) failed: ${err.message}`);
   });
@@ -20951,9 +22057,9 @@ init_blob_store();
 import { Hono as Hono7 } from "hono";
 
 // src/git/image.ts
-import { spawnSync as spawnSync6 } from "child_process";
-import { readFileSync as readFileSync7 } from "fs";
-import { join as join8, resolve as resolve5 } from "path";
+import { spawnSync as spawnSync7 } from "child_process";
+import { readFileSync as readFileSync8 } from "fs";
+import { join as join10, resolve as resolve5 } from "path";
 
 // src/git/image-metadata.ts
 var IMAGE_EXTENSIONS = /* @__PURE__ */ new Set([".png", ".jpg", ".jpeg", ".gif", ".webp", ".svg"]);
@@ -21221,20 +22327,20 @@ function getNewRef(mode) {
 }
 function gitShowFile(ref, filePath, repoRoot) {
   const spec = ref === ":" ? `:${filePath}` : `${ref}:${filePath}`;
-  const result = spawnSync6("git", ["show", spec], { cwd: repoRoot, maxBuffer: 50 * 1024 * 1024, env: scrubbedGitEnv() });
+  const result = spawnSync7("git", ["show", spec], { cwd: repoRoot, maxBuffer: 50 * 1024 * 1024, env: scrubbedGitEnv() });
   if (result.status !== 0 || result.stdout.length === 0) return null;
   return result.stdout;
 }
 function readWorkingFile(filePath, repoRoot) {
   try {
-    return readFileSync7(resolve5(repoRoot, filePath));
+    return readFileSync8(resolve5(repoRoot, filePath));
   } catch {
     return null;
   }
 }
 function readDiskImage(absPath) {
   try {
-    const data = readFileSync7(absPath);
+    const data = readFileSync8(absPath);
     return { data, size: data.length };
   } catch {
     return null;
@@ -21242,7 +22348,7 @@ function readDiskImage(absPath) {
 }
 function getOldImage(mode, filePath, oldPath, repoRoot) {
   if (mode.type === "diff") {
-    return readDiskImage(join8(directComparisonRoots(mode).rootA, oldPath ?? filePath));
+    return readDiskImage(join10(directComparisonRoots(mode).rootA, oldPath ?? filePath));
   }
   const ref = getOldRef(mode);
   const path = oldPath ?? filePath;
@@ -21258,7 +22364,7 @@ function getOldImage(mode, filePath, oldPath, repoRoot) {
 }
 function getNewImage(mode, filePath, repoRoot) {
   if (mode.type === "diff") {
-    return readDiskImage(join8(directComparisonRoots(mode).rootB, filePath));
+    return readDiskImage(join10(directComparisonRoots(mode).rootB, filePath));
   }
   const ref = getNewRef(mode);
   if (ref === null) {
@@ -21280,9 +22386,9 @@ function getNewImage(mode, filePath, repoRoot) {
 import { Worker } from "worker_threads";
 
 // src/git/svg-rasterize-render.ts
-import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync9 } from "fs";
 import { createRequire } from "module";
-import { join as join9 } from "path";
+import { join as join11 } from "path";
 var initialized = false;
 var ResvgClass;
 var fontBuffers = [];
@@ -21291,7 +22397,7 @@ async function ensureRenderInit() {
   const require2 = createRequire(import.meta.url);
   const resvgPath = require2.resolve("@resvg/resvg-wasm");
   const wasmPath = resvgPath.replace(/index\.(js|mjs)$/, "index_bg.wasm");
-  const wasmBuffer = readFileSync8(wasmPath);
+  const wasmBuffer = readFileSync9(wasmPath);
   const mod = await import("@resvg/resvg-wasm");
   await mod.initWasm(wasmBuffer);
   ResvgClass = mod.Resvg;
@@ -21302,9 +22408,9 @@ function loadSystemFonts() {
   const buffers = [];
   const candidates = getFontCandidates();
   for (const path of candidates) {
-    if (!existsSync7(path)) continue;
+    if (!existsSync9(path)) continue;
     try {
-      buffers.push(readFileSync8(path));
+      buffers.push(readFileSync9(path));
     } catch {
     }
   }
@@ -21317,24 +22423,24 @@ function getFontCandidates() {
     const sup = "/System/Library/Fonts/Supplemental";
     return [
       // Core system fonts (serif, sans-serif, monospace)
-      join9(sys, "Helvetica.ttc"),
-      join9(sys, "Times.ttc"),
-      join9(sys, "Courier.ttc"),
-      join9(sys, "Menlo.ttc"),
-      join9(sys, "SFPro.ttf"),
-      join9(sys, "SFNS.ttf"),
-      join9(sys, "SFNSMono.ttf"),
+      join11(sys, "Helvetica.ttc"),
+      join11(sys, "Times.ttc"),
+      join11(sys, "Courier.ttc"),
+      join11(sys, "Menlo.ttc"),
+      join11(sys, "SFPro.ttf"),
+      join11(sys, "SFNS.ttf"),
+      join11(sys, "SFNSMono.ttf"),
       // Supplemental (common named fonts in SVGs)
-      join9(sup, "Arial.ttf"),
-      join9(sup, "Arial Bold.ttf"),
-      join9(sup, "Georgia.ttf"),
-      join9(sup, "Verdana.ttf"),
-      join9(sup, "Tahoma.ttf"),
-      join9(sup, "Trebuchet MS.ttf"),
-      join9(sup, "Impact.ttf"),
-      join9(sup, "Comic Sans MS.ttf"),
-      join9(sup, "Courier New.ttf"),
-      join9(sup, "Times New Roman.ttf")
+      join11(sup, "Arial.ttf"),
+      join11(sup, "Arial Bold.ttf"),
+      join11(sup, "Georgia.ttf"),
+      join11(sup, "Verdana.ttf"),
+      join11(sup, "Tahoma.ttf"),
+      join11(sup, "Trebuchet MS.ttf"),
+      join11(sup, "Impact.ttf"),
+      join11(sup, "Comic Sans MS.ttf"),
+      join11(sup, "Courier New.ttf"),
+      join11(sup, "Times New Roman.ttf")
     ];
   }
   if (os === "linux") {
@@ -21353,17 +22459,17 @@ function getFontCandidates() {
     ];
   }
   if (os === "win32") {
-    const winFonts = join9(process.env.WINDIR ?? "C:\\Windows", "Fonts");
+    const winFonts = join11(process.env.WINDIR ?? "C:\\Windows", "Fonts");
     return [
-      join9(winFonts, "arial.ttf"),
-      join9(winFonts, "arialbd.ttf"),
-      join9(winFonts, "times.ttf"),
-      join9(winFonts, "cour.ttf"),
-      join9(winFonts, "verdana.ttf"),
-      join9(winFonts, "tahoma.ttf"),
-      join9(winFonts, "georgia.ttf"),
-      join9(winFonts, "consola.ttf"),
-      join9(winFonts, "segoeui.ttf")
+      join11(winFonts, "arial.ttf"),
+      join11(winFonts, "arialbd.ttf"),
+      join11(winFonts, "times.ttf"),
+      join11(winFonts, "cour.ttf"),
+      join11(winFonts, "verdana.ttf"),
+      join11(winFonts, "tahoma.ttf"),
+      join11(winFonts, "georgia.ttf"),
+      join11(winFonts, "consola.ttf"),
+      join11(winFonts, "segoeui.ttf")
     ];
   }
   return [];
@@ -21512,8 +22618,8 @@ function submit(job) {
 }
 async function rasterizeSvg(svgData) {
   const svg = svgData.toString("utf-8");
-  return new Promise((resolve9, reject) => {
-    submit({ svg, resolve: resolve9, reject });
+  return new Promise((resolve11, reject) => {
+    submit({ svg, resolve: resolve11, reject });
   });
 }
 
@@ -21581,8 +22687,8 @@ imageRoutes.get("/image/:fileId/:side", async (c) => {
 
 // src/routes/api/outline.ts
 init_queries();
-import { spawnSync as spawnSync7 } from "child_process";
-import { readFileSync as readFileSync9 } from "fs";
+import { spawnSync as spawnSync8 } from "child_process";
+import { readFileSync as readFileSync10 } from "fs";
 import { Hono as Hono8 } from "hono";
 import { resolve as resolve6 } from "path";
 
@@ -21948,7 +23054,7 @@ outlineRoutes.get("/symbol-definition", async (c) => {
   }
   if (definitions.length === 0) {
     try {
-      const allFiles = spawnSync7("git", ["ls-files"], { cwd: repoRoot, encoding: "utf-8" }).stdout.trim().split("\n").filter(Boolean);
+      const allFiles = spawnSync8("git", ["ls-files"], { cwd: repoRoot, encoding: "utf-8" }).stdout.trim().split("\n").filter(Boolean);
       let scanned = 0;
       for (const filePath of allFiles) {
         if (searchedPaths.has(filePath)) continue;
@@ -21960,7 +23066,7 @@ outlineRoutes.get("/symbol-definition", async (c) => {
         }
         let content = "";
         try {
-          content = readFileSync9(resolve6(repoRoot, filePath), "utf-8");
+          content = readFileSync10(resolve6(repoRoot, filePath), "utf-8");
         } catch {
           continue;
         }
@@ -21996,16 +23102,16 @@ function collectDefinitions(symbols, targetName, fileId, filePath, out) {
 }
 
 // src/routes/api/project-settings.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync10, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync7, readFileSync as readFileSync11, writeFileSync as writeFileSync8 } from "fs";
 import { Hono as Hono9 } from "hono";
-import { join as join10 } from "path";
+import { join as join12 } from "path";
 var projectSettingsRoutes = new Hono9();
 function readProjectSettings(repoRoot) {
-  const settingsPath = join10(repoRoot, ".glassbox", "settings.json");
+  const settingsPath = join12(repoRoot, ".glassbox", "settings.json");
   try {
-    if (existsSync8(settingsPath)) {
-      const raw = JSON.parse(readFileSync10(settingsPath, "utf-8"));
-      const parsed = ProjectSettingsSchema.safeParse(raw);
+    if (existsSync10(settingsPath)) {
+      const raw2 = JSON.parse(readFileSync11(settingsPath, "utf-8"));
+      const parsed = ProjectSettingsSchema.safeParse(raw2);
       if (parsed.success) return parsed.data;
     }
   } catch {
@@ -22013,9 +23119,9 @@ function readProjectSettings(repoRoot) {
   return {};
 }
 function writeProjectSettings(repoRoot, settings) {
-  const dir = join10(repoRoot, ".glassbox");
-  mkdirSync6(dir, { recursive: true });
-  writeFileSync7(join10(dir, "settings.json"), JSON.stringify(settings, null, 2), "utf-8");
+  const dir = join12(repoRoot, ".glassbox");
+  mkdirSync7(dir, { recursive: true });
+  writeFileSync8(join12(dir, "settings.json"), JSON.stringify(settings, null, 2), "utf-8");
 }
 projectSettingsRoutes.get("/project-settings", (c) => {
   const repoRoot = c.get("repoRoot");
@@ -22031,10 +23137,54 @@ projectSettingsRoutes.patch("/project-settings", async (c) => {
   return c.json(current);
 });
 
+// src/routes/api/review-notes.ts
+init_store();
+import { readFileSync as readFileSync12, statSync as statSync3 } from "fs";
+import { Hono as Hono10 } from "hono";
+import { extname, relative, resolve as resolve7 } from "path";
+var reviewNotesRoutes = new Hono10();
+var ARTIFACT_SERVE_MAX_BYTES = 1e7;
+var IMAGE_CONTENT_TYPES = {
+  ".png": "image/png",
+  ".webp": "image/webp",
+  ".avif": "image/avif",
+  ".gif": "image/gif",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".svg": "image/svg+xml"
+};
+reviewNotesRoutes.get("/review-notes/artifact", (c) => {
+  const file2 = c.req.query("file");
+  if (file2 === void 0 || file2 === "") return c.text("Missing file", 400);
+  const repoRoot = c.get("repoRoot");
+  const abs = resolve7(repoRoot, file2);
+  const rel = relative(repoRoot, abs);
+  if (rel === "" || rel.startsWith("..") || rel.startsWith("/")) return c.text("Forbidden", 403);
+  const ext = extname(abs).toLowerCase();
+  if (!(ext in IMAGE_CONTENT_TYPES)) return c.text("Unsupported artifact type", 415);
+  const contentType = IMAGE_CONTENT_TYPES[ext];
+  try {
+    const stat = statSync3(abs);
+    if (!stat.isFile() || stat.size > ARTIFACT_SERVE_MAX_BYTES) return c.text("Not found", 404);
+    const body = readFileSync12(abs);
+    return c.body(body, 200, { "Content-Type": contentType });
+  } catch {
+    return c.text("Not found", 404);
+  }
+});
+reviewNotesRoutes.delete("/review-notes/:guid", (c) => {
+  const guid3 = requirePathParam(c, "guid");
+  if (!guid3.ok) return guid3.response;
+  const repoRoot = c.get("repoRoot");
+  const file2 = c.req.query("file");
+  const removed = removeNote(repoRoot, guid3.data, file2);
+  return c.json({ ok: true, removed });
+});
+
 // src/routes/api/reviews.ts
 init_queries();
-import { Hono as Hono10 } from "hono";
-var reviewsRoutes = new Hono10();
+import { Hono as Hono11 } from "hono";
+var reviewsRoutes = new Hono11();
 reviewsRoutes.get("/reviews", async (c) => {
   const repoRoot = c.get("repoRoot");
   const reviews = await listReviews(repoRoot);
@@ -22124,8 +23274,8 @@ reviewsRoutes.post("/reviews/delete-all", async (c) => {
 
 // src/routes/api/share-prompt.ts
 init_zod();
-import { Hono as Hono11 } from "hono";
-var sharePromptRoutes = new Hono11();
+import { Hono as Hono12 } from "hono";
+var sharePromptRoutes = new Hono12();
 var SharePromptShapeSchema = external_exports.object({
   dismissedAt: external_exports.number().nullable().optional(),
   totalOpenMs: external_exports.number().optional()
@@ -22164,8 +23314,8 @@ sharePromptRoutes.post("/share-prompt/tick", async (c) => {
 });
 
 // src/routes/api/system.ts
-import { Hono as Hono12 } from "hono";
-var systemRoutes = new Hono12();
+import { Hono as Hono13 } from "hono";
+var systemRoutes = new Hono13();
 systemRoutes.post("/open-external", async (c) => {
   const parsed = await parseBody(c, OpenExternalReqSchema);
   if (!parsed.ok) return parsed.response;
@@ -22177,7 +23327,7 @@ systemRoutes.post("/open-external", async (c) => {
 });
 
 // src/routes/api.ts
-var apiRoutes = new Hono13();
+var apiRoutes = new Hono14();
 apiRoutes.route("/", reviewsRoutes);
 apiRoutes.route("/", filesRoutes);
 apiRoutes.route("/", annotationsRoutes);
@@ -22185,20 +23335,21 @@ apiRoutes.route("/", outlineRoutes);
 apiRoutes.route("/", contextRoutes);
 apiRoutes.route("/", projectSettingsRoutes);
 apiRoutes.route("/", imageRoutes);
+apiRoutes.route("/", reviewNotesRoutes);
 apiRoutes.route("/", sharePromptRoutes);
 apiRoutes.route("/", systemRoutes);
 
 // src/routes/channel-api.ts
-import { spawnSync as spawnSync8 } from "child_process";
-import { mkdirSync as mkdirSync7 } from "fs";
-import { Hono as Hono14 } from "hono";
-import { join as join11 } from "path";
-var channelApiRoutes = new Hono14();
+import { spawnSync as spawnSync9 } from "child_process";
+import { mkdirSync as mkdirSync8 } from "fs";
+import { Hono as Hono15 } from "hono";
+import { join as join13 } from "path";
+var channelApiRoutes = new Hono15();
 channelApiRoutes.get("/status", async (c) => {
   const config2 = readGlobalConfig();
   const enabled = config2.channelEnabled === true;
   const repoRoot = c.get("repoRoot");
-  const dataDir = join11(repoRoot, ".glassbox");
+  const dataDir = join13(repoRoot, ".glassbox");
   const connected = enabled ? await isChannelAlive(dataDir) : false;
   return c.json({ enabled, connected });
 });
@@ -22207,8 +23358,8 @@ channelApiRoutes.post("/enable", (c) => {
     config2.channelEnabled = true;
   });
   const repoRoot = c.get("repoRoot");
-  const dataDir = join11(repoRoot, ".glassbox");
-  mkdirSync7(dataDir, { recursive: true });
+  const dataDir = join13(repoRoot, ".glassbox");
+  mkdirSync8(dataDir, { recursive: true });
   registerChannel(dataDir);
   return c.json({ ok: true });
 });
@@ -22217,7 +23368,7 @@ channelApiRoutes.post("/disable", (c) => {
     config2.channelEnabled = false;
   });
   const repoRoot = c.get("repoRoot");
-  const dataDir = join11(repoRoot, ".glassbox");
+  const dataDir = join13(repoRoot, ".glassbox");
   unregisterChannel(dataDir);
   return c.json({ ok: true });
 });
@@ -22225,7 +23376,7 @@ channelApiRoutes.post("/trigger", async (c) => {
   const parsed = await parseBody(c, TriggerChannelReqSchema);
   if (!parsed.ok) return parsed.response;
   const repoRoot = c.get("repoRoot");
-  const dataDir = join11(repoRoot, ".glassbox");
+  const dataDir = join13(repoRoot, ".glassbox");
   const sent = await triggerChannel(dataDir, parsed.data.message);
   if (!sent) {
     return c.json({ error: "Channel not connected" }, 503);
@@ -22234,7 +23385,7 @@ channelApiRoutes.post("/trigger", async (c) => {
 });
 channelApiRoutes.get("/claude-check", (c) => {
   try {
-    const result = spawnSync8("claude", ["--version"], { encoding: "utf-8", timeout: 5e3 });
+    const result = spawnSync9("claude", ["--version"], { encoding: "utf-8", timeout: 5e3 });
     if (result.status !== 0) {
       return c.json({ installed: false, version: null, meetsMinimum: false });
     }
@@ -22253,13 +23404,13 @@ channelApiRoutes.get("/claude-check", (c) => {
 });
 
 // src/routes/difftool-api.ts
-import { Hono as Hono15 } from "hono";
+import { Hono as Hono16 } from "hono";
 init_connection();
 init_queries();
 init_blob_store();
 init_session();
 init_difftool();
-var difftoolApiRoutes = new Hono15();
+var difftoolApiRoutes = new Hono16();
 difftoolApiRoutes.get("/status", (c) => {
   return c.json(getDifftoolStatus("global"));
 });
@@ -22321,9 +23472,9 @@ difftoolApiRoutes.get("/hold", (c) => {
   const session2 = getDifftoolSession();
   if (session2 === null) return c.json({ ended: true });
   noteDifftoolActivity();
-  return new Promise((resolve9) => {
+  return new Promise((resolve11) => {
     addDifftoolHold(() => {
-      resolve9(c.json({ ended: true }));
+      resolve11(c.json({ ended: true }));
     });
     c.req.raw.signal.addEventListener("abort", () => {
       endDifftoolSession();
@@ -22336,9 +23487,12 @@ difftoolApiRoutes.post("/end", (c) => {
 });
 
 // src/routes/pages.tsx
-import { readFileSync as readFileSync12 } from "fs";
-import { Hono as Hono16 } from "hono";
-import { resolve as resolve7 } from "path";
+import { readFileSync as readFileSync14 } from "fs";
+import { Hono as Hono17 } from "hono";
+import { resolve as resolve8 } from "path";
+
+// src/components/diffView.tsx
+import { raw } from "kerfjs";
 
 // src/icons.tsx
 import { jsx, jsxs } from "kerfjs/jsx-runtime";
@@ -22400,6 +23554,9 @@ function IconActualSize() {
   ] });
 }
 
+// src/components/diffView.tsx
+init_view();
+
 // src/utils/charDiff.ts
 var MAX_LINE_LENGTH = 5e3;
 function charDiff(oldStr, newStr) {
@@ -22471,6 +23628,26 @@ function truncateDiffLine(content) {
   };
 }
 
+// src/utils/noteMarkdown.ts
+function escapeHtml(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+var SAFE_URL = /^(https?:\/\/|mailto:)/i;
+function renderInline(escaped) {
+  let out = escaped.replace(/`([^`]+)`/g, "<code>$1</code>");
+  out = out.replace(/\[([^\]]+)\]\(([^)\s]+)\)/g, (match, text, url2) => {
+    if (!SAFE_URL.test(url2)) return match;
+    return `<a href="${url2}" target="_blank" rel="noopener noreferrer">${text}</a>`;
+  });
+  out = out.replace(/\*\*([^*]+)\*\*/g, "<strong>$1</strong>");
+  out = out.replace(/(^|[^*])\*([^*\s][^*]*)\*/g, "$1<em>$2</em>");
+  out = out.replace(/(^|[^_])_([^_\s][^_]*)_/g, "$1<em>$2</em>");
+  return out;
+}
+function renderNoteMarkdown(text) {
+  return escapeHtml(text).split("\n").map(renderInline).join("<br>");
+}
+
 // src/components/imageDiff.tsx
 import { jsx as jsx2, jsxs as jsxs2 } from "kerfjs/jsx-runtime";
 function ImageDiff({ file: file2, diff, fontWarning, baseWidth, baseHeight }) {
@@ -22521,12 +23698,23 @@ function ImageDiff({ file: file2, diff, fontWarning, baseWidth, baseHeight }) {
 
 // src/components/diffView.tsx
 import { Fragment, jsx as jsx3, jsxs as jsxs3 } from "kerfjs/jsx-runtime";
-function DiffView({ file: file2, diff, annotations, mode }) {
+function DiffView({ file: file2, diff, annotations, mode, reviewNotes = [] }) {
+  const loadedNoteGuids = new Set(reviewNotes.map((n) => n.guid).filter((g) => g !== void 0));
+  const repliesByNote = {};
   const annotationsByLine = {};
   for (const a of annotations) {
+    if (a.reply_to_note_id !== null && loadedNoteGuids.has(a.reply_to_note_id)) {
+      (repliesByNote[a.reply_to_note_id] ??= []).push(a);
+      continue;
+    }
     const key = `${a.line_number}:${a.side}`;
-    if (!(key in annotationsByLine)) annotationsByLine[key] = [];
-    annotationsByLine[key].push(a);
+    (annotationsByLine[key] ??= []).push(a);
+  }
+  const reviewNotesByLine = {};
+  for (const n of reviewNotes) {
+    const key = `${n.line}:${n.side}`;
+    if (!(key in reviewNotesByLine)) reviewNotesByLine[key] = [];
+    reviewNotesByLine[key].push(n);
   }
   return /* @__PURE__ */ jsxs3(
     "div",
@@ -22543,7 +23731,7 @@ function DiffView({ file: file2, diff, annotations, mode }) {
           ] }),
           /* @__PURE__ */ jsx3("div", { className: "diff-header-actions", children: /* @__PURE__ */ jsx3("span", { className: `file-status ${diff.status}`, children: diff.status }) })
         ] }),
-        diff.isBinary && isImageFile(diff.filePath) ? /* @__PURE__ */ jsx3(ImageDiff, { file: file2, diff }) : diff.isBinary ? /* @__PURE__ */ jsx3("div", { className: "hunk-separator", children: "Binary file" }) : diff.status === "added" || diff.status === "deleted" || mode === "unified" ? /* @__PURE__ */ jsx3(UnifiedDiff, { hunks: diff.hunks, annotationsByLine }) : /* @__PURE__ */ jsx3(SplitDiff, { hunks: diff.hunks, annotationsByLine })
+        diff.isBinary && isImageFile(diff.filePath) ? /* @__PURE__ */ jsx3(ImageDiff, { file: file2, diff }) : diff.isBinary ? /* @__PURE__ */ jsx3("div", { className: "hunk-separator", children: "Binary file" }) : diff.status === "added" || diff.status === "deleted" || mode === "unified" ? /* @__PURE__ */ jsx3(UnifiedDiff, { hunks: diff.hunks, annotationsByLine, reviewNotesByLine, repliesByNote }) : /* @__PURE__ */ jsx3(SplitDiff, { hunks: diff.hunks, annotationsByLine, reviewNotesByLine, repliesByNote })
       ]
     }
   );
@@ -22553,7 +23741,10 @@ function getAnnotations(pair, annotationsByLine) {
   const rightAnns = pair.right ? annotationsByLine[`${pair.right.newNum}:new`] ?? [] : [];
   return [...leftAnns, ...rightAnns];
 }
-function SplitDiff({ hunks, annotationsByLine }) {
+function getReviewNotes(pair, reviewNotesByLine) {
+  return pair.right ? reviewNotesByLine[`${pair.right.newNum}:new`] ?? [] : [];
+}
+function SplitDiff({ hunks, annotationsByLine, reviewNotesByLine, repliesByNote }) {
   const lastHunk = hunks[hunks.length - 1];
   const tailStart = lastHunk ? lastHunk.newStart + lastHunk.newCount : 1;
   const items = [];
@@ -22565,8 +23756,9 @@ function SplitDiff({ hunks, annotationsByLine }) {
     items.push({ kind: "separator", hunkIdx, hunk, gapStart, gapEnd });
     for (const pair of pairLines(hunk.lines)) {
       const anns = getAnnotations(pair, annotationsByLine);
-      if (anns.length > 0) {
-        items.push({ kind: "annotated", pair, annotations: anns });
+      const notes = getReviewNotes(pair, reviewNotesByLine);
+      if (anns.length > 0 || notes.length > 0) {
+        items.push({ kind: "annotated", pair, annotations: anns, reviewNotes: notes });
       } else {
         items.push({ kind: "pair", pair });
       }
@@ -22581,7 +23773,7 @@ function SplitDiff({ hunks, annotationsByLine }) {
         groups.push({ type: "columns", items: run });
         run = [];
       }
-      groups.push({ type: "annotated", pair: item.pair, annotations: item.annotations });
+      groups.push({ type: "annotated", pair: item.pair, annotations: item.annotations, reviewNotes: item.reviewNotes });
     } else {
       run.push(item);
     }
@@ -22617,7 +23809,8 @@ function SplitDiff({ hunks, annotationsByLine }) {
             }
           )
         ] }),
-        /* @__PURE__ */ jsx3(AnnotationRows, { annotations: group.annotations })
+        group.annotations.length > 0 ? /* @__PURE__ */ jsx3(AnnotationRows, { annotations: group.annotations }) : null,
+        group.reviewNotes.length > 0 ? /* @__PURE__ */ jsx3(ReviewNoteRows, { notes: group.reviewNotes, repliesByNote }) : null
       ] });
     }
     return /* @__PURE__ */ jsxs3("div", { className: "split-columns", children: [
@@ -22783,7 +23976,7 @@ function buildUnifiedCharDiffs(lines) {
   }
   return result;
 }
-function UnifiedDiff({ hunks, annotationsByLine }) {
+function UnifiedDiff({ hunks, annotationsByLine, reviewNotesByLine, repliesByNote }) {
   const lastHunk = hunks[hunks.length - 1];
   const tailStart = lastHunk ? lastHunk.newStart + lastHunk.newCount : 1;
   return /* @__PURE__ */ jsxs3("div", { className: "diff-table-unified", children: [
@@ -22816,6 +24009,7 @@ function UnifiedDiff({ hunks, annotationsByLine }) {
           const lineNum = line.type === "remove" ? line.oldNum : line.newNum;
           const side = line.type === "remove" ? "old" : "new";
           const anns = annotationsByLine[`${lineNum}:${side}`] ?? [];
+          const notes = reviewNotesByLine[`${lineNum}:${side}`] ?? [];
           const segments = charDiffs.get(line);
           return /* @__PURE__ */ jsxs3("div", { children: [
             /* @__PURE__ */ jsxs3(
@@ -22831,7 +24025,8 @@ function UnifiedDiff({ hunks, annotationsByLine }) {
                 ]
               }
             ),
-            anns.length > 0 ? /* @__PURE__ */ jsx3(AnnotationRows, { annotations: anns }) : null
+            anns.length > 0 ? /* @__PURE__ */ jsx3(AnnotationRows, { annotations: anns }) : null,
+            notes.length > 0 ? /* @__PURE__ */ jsx3(ReviewNoteRows, { notes, repliesByNote }) : null
           ] });
         })
       ] });
@@ -22839,8 +24034,61 @@ function UnifiedDiff({ hunks, annotationsByLine }) {
     /* @__PURE__ */ jsx3("div", { className: "hunk-separator hunk-expander-tail", "data-start": tailStart, children: "\u2195 Show remaining lines" })
   ] });
 }
-function AnnotationRows({ annotations }) {
-  return /* @__PURE__ */ jsx3("div", { className: "annotation-row", children: annotations.map((a) => /* @__PURE__ */ jsxs3(
+function ReviewNoteRows({ notes, repliesByNote }) {
+  return /* @__PURE__ */ jsx3(Fragment, { children: notes.map((n) => {
+    const replies = n.guid !== void 0 ? repliesByNote[n.guid] ?? [] : [];
+    return /* @__PURE__ */ jsxs3(Fragment, { children: [
+      /* @__PURE__ */ jsxs3(
+        "div",
+        {
+          className: `ai-note-row ai-note-review${n.stale === true ? " ai-note-stale" : ""}`,
+          "data-kind": n.kind,
+          "data-note-id": n.guid,
+          children: [
+            /* @__PURE__ */ jsxs3("div", { className: "ai-note-item", children: [
+              /* @__PURE__ */ jsx3("span", { className: `ai-note-label ai-note-label-${n.kind}`, children: REVIEW_NOTE_LABELS[n.kind] ?? n.kind }),
+              n.stale === true ? /* @__PURE__ */ jsx3("span", { className: "ai-note-stale-tag", title: "The code this note referred to has changed", children: "outdated" }) : null,
+              /* @__PURE__ */ jsx3("span", { className: "ai-note-text", children: raw(renderNoteMarkdown(n.body)) }),
+              n.producer !== void 0 ? /* @__PURE__ */ jsx3("span", { className: "ai-note-producer", children: n.producer }) : null,
+              n.guid !== void 0 ? /* @__PURE__ */ jsx3("button", { className: "ai-note-reply-btn", "data-line": String(n.line), children: "Reply" }) : null,
+              n.stale === true && n.guid !== void 0 ? /* @__PURE__ */ jsxs3("span", { className: "ai-note-stale-actions", children: [
+                /* @__PURE__ */ jsx3("button", { className: "ai-note-keep-btn", title: "Dismiss the outdated flag for now", children: "Keep" }),
+                /* @__PURE__ */ jsx3("button", { className: "ai-note-discard-btn", title: "Remove this note from .pr-notes/", children: "Discard" })
+              ] }) : null
+            ] }),
+            n.artifacts !== void 0 && n.artifacts.length > 0 ? /* @__PURE__ */ jsx3("div", { className: "ai-note-artifacts", children: n.artifacts.map((a) => a.content !== void 0 ? /* @__PURE__ */ jsxs3("details", { className: "ai-note-artifact", children: [
+              /* @__PURE__ */ jsxs3("summary", { children: [
+                "\u{1F4CE} ",
+                a.uri
+              ] }),
+              /* @__PURE__ */ jsx3("pre", { className: "ai-note-artifact-content", children: /* @__PURE__ */ jsx3("code", { children: a.content }) })
+            ] }) : a.isImage === true ? /* @__PURE__ */ jsxs3("details", { className: "ai-note-artifact", children: [
+              /* @__PURE__ */ jsxs3("summary", { children: [
+                "\u{1F4CE} ",
+                a.uri
+              ] }),
+              /* @__PURE__ */ jsx3(
+                "img",
+                {
+                  className: "ai-note-artifact-img",
+                  loading: "lazy",
+                  alt: a.uri,
+                  src: `/api/review-notes/artifact?file=${encodeURIComponent(a.uri)}`
+                }
+              )
+            ] }) : /* @__PURE__ */ jsxs3("div", { className: "ai-note-artifact ai-note-artifact-ref", children: [
+              "\u{1F4CE} ",
+              a.uri
+            ] })) }) : null
+          ]
+        }
+      ),
+      replies.length > 0 ? /* @__PURE__ */ jsx3("div", { className: "annotation-row ai-note-replies", children: replies.map((a) => /* @__PURE__ */ jsx3(AnnotationItem, { annotation: a })) }) : null
+    ] });
+  }) });
+}
+function AnnotationItem({ annotation: a }) {
+  return /* @__PURE__ */ jsxs3(
     "div",
     {
       className: `annotation-item${a.is_stale ? " annotation-stale" : ""}`,
@@ -22850,6 +24098,7 @@ function AnnotationRows({ annotations }) {
       children: [
         /* @__PURE__ */ jsx3("span", { className: "annotation-drag-handle", draggable: true, title: "Drag to move", children: "\u283F" }),
         /* @__PURE__ */ jsx3("span", { className: `annotation-category category-${a.category}`, "data-action": "reclassify", children: a.category }),
+        a.reply_to_note_id !== null ? /* @__PURE__ */ jsx3("span", { className: "annotation-reply-tag", title: "Reply to an AI review note", children: "\u21B3 reply" }) : null,
         /* @__PURE__ */ jsx3("span", { className: "annotation-text", children: a.content }),
         /* @__PURE__ */ jsxs3("div", { className: "annotation-actions", children: [
           a.is_stale ? /* @__PURE__ */ jsx3("button", { className: "btn btn-xs btn-keep", "data-action": "keep", children: "Keep" }) : null,
@@ -22858,13 +24107,16 @@ function AnnotationRows({ annotations }) {
         ] })
       ]
     }
-  )) });
+  );
+}
+function AnnotationRows({ annotations }) {
+  return /* @__PURE__ */ jsx3("div", { className: "annotation-row", children: annotations.map((a) => /* @__PURE__ */ jsx3(AnnotationItem, { annotation: a })) });
 }
 
 // src/themes/config.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync8, readdirSync, readFileSync as readFileSync11, unlinkSync as unlinkSync2, writeFileSync as writeFileSync8 } from "fs";
-import { join as join12 } from "path";
-var THEMES_DIR = join12(GLOBAL_CONFIG_DIR, "themes");
+import { existsSync as existsSync11, mkdirSync as mkdirSync9, readdirSync as readdirSync2, readFileSync as readFileSync13, unlinkSync as unlinkSync3, writeFileSync as writeFileSync9 } from "fs";
+import { join as join14 } from "path";
+var THEMES_DIR = join14(GLOBAL_CONFIG_DIR, "themes");
 function getActiveThemeId() {
   const config2 = readGlobalConfig();
   const theme = config2.theme;
@@ -22878,13 +24130,13 @@ function setActiveThemeId(id) {
   });
 }
 function loadCustomThemes() {
-  if (!existsSync9(THEMES_DIR)) return [];
+  if (!existsSync11(THEMES_DIR)) return [];
   const themes = [];
   try {
-    const files = readdirSync(THEMES_DIR).filter((f) => f.endsWith(".json"));
+    const files = readdirSync2(THEMES_DIR).filter((f) => f.endsWith(".json"));
     for (const file2 of files) {
       try {
-        const parsed = StoredCustomThemeSchema.safeParse(JSON.parse(readFileSync11(join12(THEMES_DIR, file2), "utf-8")));
+        const parsed = StoredCustomThemeSchema.safeParse(JSON.parse(readFileSync13(join14(THEMES_DIR, file2), "utf-8")));
         if (!parsed.success) continue;
         const d = parsed.data;
         themes.push({ id: d.id, name: d.name, colors: d.colors, builtIn: false, baseTheme: d.baseTheme ?? "" });
@@ -22896,21 +24148,21 @@ function loadCustomThemes() {
   return themes;
 }
 function saveCustomTheme(theme) {
-  mkdirSync8(THEMES_DIR, { recursive: true });
-  const filePath = join12(THEMES_DIR, `${theme.id}.json`);
-  writeFileSync8(filePath, JSON.stringify(theme, null, 2), "utf-8");
+  mkdirSync9(THEMES_DIR, { recursive: true });
+  const filePath = join14(THEMES_DIR, `${theme.id}.json`);
+  writeFileSync9(filePath, JSON.stringify(theme, null, 2), "utf-8");
 }
 function deleteCustomTheme(id) {
-  const filePath = join12(THEMES_DIR, `${id}.json`);
-  if (existsSync9(filePath)) {
-    unlinkSync2(filePath);
+  const filePath = join14(THEMES_DIR, `${id}.json`);
+  if (existsSync11(filePath)) {
+    unlinkSync3(filePath);
   }
 }
 function getCustomTheme(id) {
-  const filePath = join12(THEMES_DIR, `${id}.json`);
-  if (!existsSync9(filePath)) return void 0;
+  const filePath = join14(THEMES_DIR, `${id}.json`);
+  if (!existsSync11(filePath)) return void 0;
   try {
-    const parsed = StoredCustomThemeSchema.safeParse(JSON.parse(readFileSync11(filePath, "utf-8")));
+    const parsed = StoredCustomThemeSchema.safeParse(JSON.parse(readFileSync13(filePath, "utf-8")));
     if (!parsed.success) return void 0;
     const d = parsed.data;
     return { id: d.id, name: d.name, colors: d.colors, builtIn: false, baseTheme: d.baseTheme ?? "" };
@@ -22972,8 +24224,8 @@ function formatReviewMode(mode, modeArgs) {
     return `commit: ${shortenIfSha(argsFor(mode, "commit:", modeArgs))}`;
   }
   if (mode === "range" || mode.startsWith("range:")) {
-    const raw = argsFor(mode, "range:", modeArgs);
-    const [from = "", to = ""] = raw.split("..");
+    const raw2 = argsFor(mode, "range:", modeArgs);
+    const [from = "", to = ""] = raw2.split("..");
     return `range: ${shortenIfSha(from)}..${shortenIfSha(to)}`;
   }
   if (mode === "branch" || mode.startsWith("branch:")) {
@@ -23209,8 +24461,41 @@ function ReviewShell({ reviewId, review, files, annotationCounts, staleCounts, f
 
 // src/routes/pages.tsx
 init_queries();
+
+// src/review-notes/reanchor.ts
+var MATCH_RADIUS = 50;
+function reanchorReviewNotes(notes, diff) {
+  const byLine = /* @__PURE__ */ new Map();
+  for (const hunk of diff.hunks) {
+    for (const line of hunk.lines) {
+      if (line.newNum !== null) byLine.set(line.newNum, line.content);
+    }
+  }
+  return notes.map((note) => {
+    if (note.snippet === void 0 || note.snippet === "") return note;
+    const anchor = note.snippet.split("\n")[0];
+    const current = byLine.get(note.line);
+    if (current === anchor) return note;
+    let best = null;
+    let bestDistance = Infinity;
+    for (const [lineNum, content] of byLine) {
+      if (content !== anchor) continue;
+      const distance = Math.abs(lineNum - note.line);
+      if (distance < bestDistance && distance <= MATCH_RADIUS) {
+        bestDistance = distance;
+        best = lineNum;
+      }
+    }
+    if (best !== null) return { ...note, line: best, stale: false };
+    if (current !== void 0) return { ...note, stale: true };
+    return note;
+  });
+}
+
+// src/routes/pages.tsx
+init_store();
 import { Fragment as Fragment2, jsx as jsx8, jsxs as jsxs8 } from "kerfjs/jsx-runtime";
-var pageRoutes = new Hono16();
+var pageRoutes = new Hono17();
 pageRoutes.get("/", async (c) => {
   const reviewId = c.get("reviewId");
   const review = await getReview(reviewId);
@@ -23289,7 +24574,9 @@ pageRoutes.get("/file/:fileId", async (c) => {
       }
     }
   }
-  const html = /* @__PURE__ */ jsx8(DiffView, { file: file2, diff: finalDiff, annotations, mode });
+  const rawNotes = getDemoMode() !== null ? demoReviewNotes(file2.file_path) : loadReviewNotesForFile(c.get("repoRoot"), file2.file_path);
+  const reviewNotes = reanchorReviewNotes(rawNotes, finalDiff);
+  const html = /* @__PURE__ */ jsx8(DiffView, { file: file2, diff: finalDiff, annotations, mode, reviewNotes });
   return c.html(html.toString());
 });
 pageRoutes.get("/file-raw", (c) => {
@@ -23298,7 +24585,7 @@ pageRoutes.get("/file-raw", (c) => {
   const repoRoot = c.get("repoRoot");
   let content;
   try {
-    content = readFileSync12(resolve7(repoRoot, filePath), "utf-8");
+    content = readFileSync14(resolve8(repoRoot, filePath), "utf-8");
   } catch {
     return c.text("File not found", 404);
   }
@@ -23354,8 +24641,8 @@ pageRoutes.get("/history", async (c) => {
 });
 
 // src/routes/theme-api.ts
-import { Hono as Hono17 } from "hono";
-var themeApiRoutes = new Hono17();
+import { Hono as Hono18 } from "hono";
+var themeApiRoutes = new Hono18();
 themeApiRoutes.get("/", (c) => {
   const themes = getAllThemes();
   const activeId = getActiveThemeId();
@@ -23469,10 +24756,10 @@ themeApiRoutes.delete("/:id", (c) => {
 
 // src/server.ts
 function tryServe(appFetch, port) {
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve11, reject) => {
     const server = serve({ fetch: appFetch, port, hostname: "127.0.0.1" });
     server.on("listening", () => {
-      resolve9({ port, server });
+      resolve11({ port, server });
     });
     server.on("error", (err) => {
       reject(err);
@@ -23480,25 +24767,25 @@ function tryServe(appFetch, port) {
   });
 }
 async function startServer(port, reviewId, repoRoot, options) {
-  const app = new Hono18();
+  const app = new Hono19();
   app.use("*", async (c, next) => {
     c.set("reviewId", reviewId);
     c.set("currentReviewId", reviewId);
     c.set("repoRoot", repoRoot);
     await next();
   });
-  const selfDir = dirname3(fileURLToPath2(import.meta.url));
-  const distDir = existsSync10(join13(selfDir, "client", "styles.css")) ? join13(selfDir, "client") : join13(selfDir, "..", "dist", "client");
+  const selfDir = dirname4(fileURLToPath2(import.meta.url));
+  const distDir = existsSync12(join15(selfDir, "client", "styles.css")) ? join15(selfDir, "client") : join15(selfDir, "..", "dist", "client");
   app.get("/static/styles.css", (c) => {
-    const css = readFileSync13(join13(distDir, "styles.css"), "utf-8");
+    const css = readFileSync15(join15(distDir, "styles.css"), "utf-8");
     return c.text(css, 200, { "Content-Type": "text/css", "Cache-Control": "no-cache" });
   });
   app.get("/static/app.js", (c) => {
-    const js = readFileSync13(join13(distDir, "app.global.js"), "utf-8");
+    const js = readFileSync15(join15(distDir, "app.global.js"), "utf-8");
     return c.text(js, 200, { "Content-Type": "application/javascript", "Cache-Control": "no-cache" });
   });
   app.get("/static/history.js", (c) => {
-    const js = readFileSync13(join13(distDir, "history.global.js"), "utf-8");
+    const js = readFileSync15(join15(distDir, "history.global.js"), "utf-8");
     return c.text(js, 200, { "Content-Type": "application/javascript", "Cache-Control": "no-cache" });
   });
   app.get("/favicon.ico", (c) => c.body(null, 204));
@@ -23536,7 +24823,7 @@ async function startServer(port, reviewId, repoRoot, options) {
   try {
     const globalConfig2 = readGlobalConfig();
     if (globalConfig2.channelEnabled === true) {
-      const dataDir = join13(repoRoot, ".glassbox");
+      const dataDir = join15(repoRoot, ".glassbox");
       registerChannel(dataDir);
     }
   } catch {
@@ -23551,8 +24838,8 @@ async function startServer(port, reviewId, repoRoot, options) {
 }
 
 // src/skills.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync9, readFileSync as readFileSync14, writeFileSync as writeFileSync9 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync10, readFileSync as readFileSync16, writeFileSync as writeFileSync10 } from "fs";
+import { join as join16 } from "path";
 var SKILL_VERSION = 1;
 function versionHeader() {
   return `<!-- glassbox-skill-version: ${SKILL_VERSION} -->`;
@@ -23563,14 +24850,14 @@ function parseVersionHeader(content) {
   return parseInt(match[1], 10);
 }
 function updateFile(path, content) {
-  if (existsSync11(path)) {
-    const existing = readFileSync14(path, "utf-8");
+  if (existsSync13(path)) {
+    const existing = readFileSync16(path, "utf-8");
     const version2 = parseVersionHeader(existing);
     if (version2 !== null && version2 >= SKILL_VERSION) {
       return false;
     }
   }
-  writeFileSync9(path, content, "utf-8");
+  writeFileSync10(path, content, "utf-8");
   return true;
 }
 function skillBody() {
@@ -23590,8 +24877,8 @@ function skillBody() {
   ].join("\n");
 }
 function ensureClaudeSkills(cwd) {
-  const dir = join14(cwd, ".claude", "skills", "glassbox");
-  mkdirSync9(dir, { recursive: true });
+  const dir = join16(cwd, ".claude", "skills", "glassbox");
+  mkdirSync10(dir, { recursive: true });
   const content = [
     "---",
     "name: glassbox",
@@ -23603,11 +24890,11 @@ function ensureClaudeSkills(cwd) {
     skillBody(),
     ""
   ].join("\n");
-  return updateFile(join14(dir, "SKILL.md"), content);
+  return updateFile(join16(dir, "SKILL.md"), content);
 }
 function ensureCursorRules(cwd) {
-  const rulesDir = join14(cwd, ".cursor", "rules");
-  mkdirSync9(rulesDir, { recursive: true });
+  const rulesDir = join16(cwd, ".cursor", "rules");
+  mkdirSync10(rulesDir, { recursive: true });
   const content = [
     "---",
     "description: Read the latest Glassbox code review and apply all feedback annotations",
@@ -23618,11 +24905,11 @@ function ensureCursorRules(cwd) {
     skillBody(),
     ""
   ].join("\n");
-  return updateFile(join14(rulesDir, "glassbox.mdc"), content);
+  return updateFile(join16(rulesDir, "glassbox.mdc"), content);
 }
 function ensureCopilotPrompts(cwd) {
-  const promptsDir = join14(cwd, ".github", "prompts");
-  mkdirSync9(promptsDir, { recursive: true });
+  const promptsDir = join16(cwd, ".github", "prompts");
+  mkdirSync10(promptsDir, { recursive: true });
   const content = [
     "---",
     "description: Read the latest Glassbox code review and apply all feedback annotations",
@@ -23632,11 +24919,11 @@ function ensureCopilotPrompts(cwd) {
     skillBody(),
     ""
   ].join("\n");
-  return updateFile(join14(promptsDir, "glassbox.prompt.md"), content);
+  return updateFile(join16(promptsDir, "glassbox.prompt.md"), content);
 }
 function ensureWindsurfRules(cwd) {
-  const rulesDir = join14(cwd, ".windsurf", "rules");
-  mkdirSync9(rulesDir, { recursive: true });
+  const rulesDir = join16(cwd, ".windsurf", "rules");
+  mkdirSync10(rulesDir, { recursive: true });
   const content = [
     "---",
     "trigger: manual",
@@ -23647,21 +24934,21 @@ function ensureWindsurfRules(cwd) {
     skillBody(),
     ""
   ].join("\n");
-  return updateFile(join14(rulesDir, "glassbox.md"), content);
+  return updateFile(join16(rulesDir, "glassbox.md"), content);
 }
 function ensureSkills() {
   const cwd = process.cwd();
   const platforms = [];
-  if (existsSync11(join14(cwd, ".claude"))) {
+  if (existsSync13(join16(cwd, ".claude"))) {
     if (ensureClaudeSkills(cwd)) platforms.push("Claude Code");
   }
-  if (existsSync11(join14(cwd, ".cursor"))) {
+  if (existsSync13(join16(cwd, ".cursor"))) {
     if (ensureCursorRules(cwd)) platforms.push("Cursor");
   }
-  if (existsSync11(join14(cwd, ".github", "prompts")) || existsSync11(join14(cwd, ".github", "copilot-instructions.md"))) {
+  if (existsSync13(join16(cwd, ".github", "prompts")) || existsSync13(join16(cwd, ".github", "copilot-instructions.md"))) {
     if (ensureCopilotPrompts(cwd)) platforms.push("GitHub Copilot");
   }
-  if (existsSync11(join14(cwd, ".windsurf"))) {
+  if (existsSync13(join16(cwd, ".windsurf"))) {
     if (ensureWindsurfRules(cwd)) platforms.push("Windsurf");
   }
   return platforms;
@@ -23669,36 +24956,36 @@ function ensureSkills() {
 
 // src/update-check.ts
 init_zod();
-import { existsSync as existsSync12, mkdirSync as mkdirSync10, readFileSync as readFileSync15, writeFileSync as writeFileSync10 } from "fs";
+import { existsSync as existsSync14, mkdirSync as mkdirSync11, readFileSync as readFileSync17, writeFileSync as writeFileSync11 } from "fs";
 import { get } from "https";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname4, join as join15 } from "path";
+import { dirname as dirname5, join as join17 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
-var DATA_DIR = join15(homedir3(), ".glassbox");
-var CHECK_FILE = join15(DATA_DIR, "last-update-check");
+var DATA_DIR = join17(homedir3(), ".glassbox");
+var CHECK_FILE = join17(DATA_DIR, "last-update-check");
 var PACKAGE_NAME = "glassbox";
 var VersionPayloadSchema = external_exports.object({ version: external_exports.string() });
 function getCurrentVersion() {
   try {
-    const dir = dirname4(fileURLToPath3(import.meta.url));
-    const raw = JSON.parse(readFileSync15(join15(dir, "..", "package.json"), "utf-8"));
-    return VersionPayloadSchema.parse(raw).version;
+    const dir = dirname5(fileURLToPath3(import.meta.url));
+    const raw2 = JSON.parse(readFileSync17(join17(dir, "..", "package.json"), "utf-8"));
+    return VersionPayloadSchema.parse(raw2).version;
   } catch {
     return "0.0.0";
   }
 }
 function getLastCheckDate() {
   try {
-    if (existsSync12(CHECK_FILE)) {
-      return readFileSync15(CHECK_FILE, "utf-8").trim();
+    if (existsSync14(CHECK_FILE)) {
+      return readFileSync17(CHECK_FILE, "utf-8").trim();
     }
   } catch {
   }
   return null;
 }
 function saveCheckDate() {
-  mkdirSync10(DATA_DIR, { recursive: true });
-  writeFileSync10(CHECK_FILE, (/* @__PURE__ */ new Date()).toISOString().slice(0, 10), "utf-8");
+  mkdirSync11(DATA_DIR, { recursive: true });
+  writeFileSync11(CHECK_FILE, (/* @__PURE__ */ new Date()).toISOString().slice(0, 10), "utf-8");
 }
 function isFirstUseToday() {
   const last = getLastCheckDate();
@@ -23707,10 +24994,10 @@ function isFirstUseToday() {
   return last !== today;
 }
 function fetchLatestVersion() {
-  return new Promise((resolve9) => {
+  return new Promise((resolve11) => {
     const req = get(`https://registry.npmjs.org/${PACKAGE_NAME}/latest`, { timeout: 5e3 }, (res) => {
       if (res.statusCode !== 200) {
-        resolve9(null);
+        resolve11(null);
         return;
       }
       let data = "";
@@ -23719,19 +25006,19 @@ function fetchLatestVersion() {
       });
       res.on("end", () => {
         try {
-          const raw = JSON.parse(data);
-          resolve9(VersionPayloadSchema.parse(raw).version);
+          const raw2 = JSON.parse(data);
+          resolve11(VersionPayloadSchema.parse(raw2).version);
         } catch {
-          resolve9(null);
+          resolve11(null);
         }
       });
     });
     req.on("error", () => {
-      resolve9(null);
+      resolve11(null);
     });
     req.on("timeout", () => {
       req.destroy();
-      resolve9(null);
+      resolve11(null);
     });
   });
 }
@@ -23881,14 +25168,14 @@ function parseArgs(argv) {
           console.error("--diff requires two paths: --diff <pathA> <pathB>");
           process.exit(1);
         }
-        mode = { type: "diff", pathA: resolve8(args[++i]), pathB: resolve8(args[++i]) };
+        mode = { type: "diff", pathA: resolve10(args[++i]), pathB: resolve10(args[++i]) };
         break;
       }
       case "--port":
         port = parseInt(args[++i], 10);
         break;
       case "--data-dir":
-        dataDir = resolve8(args[++i]);
+        dataDir = resolve10(args[++i]);
         break;
       case "--resume":
         resume = true;
@@ -23946,6 +25233,17 @@ function parseArgs(argv) {
   return { mode, port, dataDir, resume, forceUpdateCheck, debug, aiServiceTest, demo, noOpen, strictPort, projectDir, difftoolAction, difftoolLocal, difftoolForce, difftoolServe };
 }
 async function main() {
+  const rawArgs = process.argv.slice(2);
+  if (rawArgs[0] === "note") {
+    const { runNoteCli: runNoteCli2 } = await Promise.resolve().then(() => (init_cli(), cli_exports));
+    try {
+      await runNoteCli2(rawArgs.slice(1));
+      process.exit(0);
+    } catch (err) {
+      console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+      process.exit(1);
+    }
+  }
   const parsed = parseArgs(process.argv);
   if (!parsed) {
     printUsage();
@@ -23987,19 +25285,19 @@ async function main() {
     console.log("AI service test mode enabled \u2014 using mock AI responses");
   }
   if (debug) {
-    console.log(`[debug] Build timestamp: ${"2026-06-17T13:45:47.895Z"}`);
+    console.log(`[debug] Build timestamp: ${"2026-06-19T07:12:20.944Z"}`);
   }
   if (projectDir !== null) {
     process.chdir(projectDir);
   }
   if (dataDir === null) {
-    dataDir = join17(process.cwd(), ".glassbox");
+    dataDir = join19(process.cwd(), ".glassbox");
   }
   if (difftoolServe) {
     const { initDifftoolSession: initDifftoolSession2 } = await Promise.resolve().then(() => (init_session(), session_exports));
     const { writeDiscovery: writeDiscovery2, clearDiscovery: clearDiscovery2, releaseStartingLock: releaseStartingLock2 } = await Promise.resolve().then(() => (init_difftool_discovery(), difftool_discovery_exports));
     const { clearDifftoolBlobs: clearDifftoolBlobs2 } = await Promise.resolve().then(() => (init_blob_store(), blob_store_exports));
-    mkdirSync12(dataDir, { recursive: true });
+    mkdirSync13(dataDir, { recursive: true });
     setDataDir(dataDir);
     const sessionDataDir = dataDir;
     clearDifftoolBlobs2(sessionDataDir);
@@ -24034,13 +25332,13 @@ async function main() {
       }
       process.exit(1);
     }
-    dataDir = join17(tmpdir2(), `glassbox-demo-${demo}-${Date.now()}`);
+    dataDir = join19(tmpdir2(), `glassbox-demo-${demo}-${Date.now()}`);
     setDemoMode(demo);
     console.log(`
   DEMO MODE: ${scenario.label}
 `);
   }
-  mkdirSync12(dataDir, { recursive: true });
+  mkdirSync13(dataDir, { recursive: true });
   if (demo === null) {
     acquireLock(dataDir);
   }
@@ -24062,12 +25360,12 @@ async function main() {
   if (mode.type === "diff") {
     const { pathA, pathB } = mode;
     for (const p of [pathA, pathB]) {
-      if (!existsSync14(p)) {
+      if (!existsSync16(p)) {
         console.error(`Error: path does not exist: ${p}`);
         process.exit(1);
       }
     }
-    if (statSync3(pathA).isDirectory() !== statSync3(pathB).isDirectory()) {
+    if (statSync5(pathA).isDirectory() !== statSync5(pathB).isDirectory()) {
       console.error("Error: --diff requires two files or two folders, not a mix of both.");
       process.exit(1);
     }