glassbox 1.0.0 → 1.1.0-beta.1

package/dist/cli.js

@@ -49,148 +49,6 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
-// src/review-notes/types.ts
-function isNoteKind(value) {
-  return NOTE_KINDS.includes(value);
-}
-var NOTE_KINDS, CONFIDENCE_PROPERTY_KEY, ANCHOR_FINGERPRINT_KEY, DEFAULT_PRODUCER, DEFAULT_SHARD_CAP;
-var init_types = __esm({
-  "src/review-notes/types.ts"() {
-    "use strict";
-    NOTE_KINDS = [
-      "rationale",
-      "proof",
-      "assumption",
-      "alternative-considered",
-      "risk",
-      "test-evidence"
-    ];
-    CONFIDENCE_PROPERTY_KEY = "ext-ai-tool-confidence";
-    ANCHOR_FINGERPRINT_KEY = "prNoteAnchor/v1";
-    DEFAULT_PRODUCER = "unknown-ai-tool";
-    DEFAULT_SHARD_CAP = 1e4;
-  }
-});
-
-// src/review-notes/instructions.ts
-function reviewNoteInstructions() {
-  return [
-    "# Emitting AI review notes (`.pr-notes/`)",
-    "",
-    "As you write or change code, leave **line-anchored review notes** that explain",
-    "your reasoning and prove your work \u2014 the rationale a careful reviewer (human or",
-    "the next AI session) would want, anchored to the exact lines it concerns. Notes",
-    "are committed to the repo as tool-neutral SARIF under `.pr-notes/` and shown",
-    "review-comment-style in Glassbox. Write them **while editing**, at the moment of",
-    "richest context \u2014 not reconstructed afterward.",
-    "",
-    "## When to emit a note",
-    "",
-    'Emit one when a future reader would otherwise have to ask "why?". Good triggers:',
-    "",
-    "- A **non-obvious decision** \u2014 why this approach over the obvious one.",
-    "- **Proof** a change is correct \u2014 the reasoning, test output, or invariant that backs it.",
-    "- An **assumption** you relied on that could later be wrong.",
-    "- An **alternative you considered and rejected**, and why.",
-    "- A **risk** or sharp edge a reviewer should scrutinize.",
-    "- **Test evidence** demonstrating the change works.",
-    "",
-    "Do **not** narrate the obvious or restate what the diff already says. One note per",
-    "genuine decision or claim \u2014 not per line.",
-    "",
-    "## How to emit a note",
-    "",
-    "Shell out to the `glassbox note` CLI (it owns the on-disk format, fingerprint,",
-    "and commit provenance \u2014 you never write the SARIF by hand):",
-    "",
-    "```",
-    "glassbox note add \\",
-    "  --file <repo-relative path> \\",
-    "  --lines <A[-B]> \\",
-    `  --kind <${NOTE_KINDS.join("|")}> \\`,
-    '  --body - \\            # body read from stdin (use --body "text" for short notes)',
-    "  [--confidence 0..1] [--rank 0..100] [--ticket <id|url>] \\",
-    "  [--artifact <path>]\u2026 \\  # attach committed proof artifacts (repeatable)",
-    '  [--producer "<your tool/agent name>"] [--producer-version <v>]',
-    "```",
-    "",
-    "Always set `--producer` so the note records who wrote it, and `--ticket` when the",
-    "work traces to a tracked task. Keep the body focused: the claim and its support.",
-    "",
-    "## Proof artifacts \u2014 diagrams, test output, screenshots",
-    "",
-    "When a claim is clearer shown than told, save the evidence under",
-    "`.pr-notes/artifacts/` and attach it with `--artifact <path>` (repeatable):",
-    "",
-    "- **When a diagram is the clearest proof or rationale** \u2014 a state machine, a",
-    "  data/control flow, a sequence of interactions, an architecture relationship \u2014",
-    "  **write it as Mermaid SOURCE** (a `.mmd` file) and attach that. Diagram source",
-    "  stays diffable and reviewable; never attach a rendered diagram image, and",
-    "  never fall back to ASCII art in the note body.",
-    "- **Test output, logs, and measurements** are attached the same way as plain",
-    "  text files.",
-    "- **Screenshots** are for genuinely visual claims only \u2014 downscale and compress",
-    "  (WebP/AVIF; stored via Git LFS automatically).",
-    "",
-    "Prefer text/diagram-source over images, and attach one artifact per *claim*,",
-    "not per step.",
-    "",
-    "## Revise and consolidate",
-    "",
-    "Notes should reflect the **final** state of your change, not an obsolete",
-    "intermediate step:",
-    "",
-    "- `glassbox note add` prints a stable note id (guid).",
-    "- `glassbox note update --id <guid> [--body -|--kind \u2026|--confidence \u2026|--rank \u2026|--ticket \u2026]`",
-    "  to correct a note as the work evolves.",
-    "- `glassbox note remove --id <guid>` to drop one that no longer applies.",
-    "- When the task is done, run `glassbox note coalesce` to drop redundant notes",
-    "  (identical anchor + kind + body, keeping the most recent).",
-    "",
-    "## Final consolidation pass",
-    "",
-    "After the mechanical `coalesce`, do one **cross-cutting pass over all the notes",
-    "you wrote this session** \u2014 the relationships that only become visible once the",
-    "whole change is in front of you, not while editing a single file. `coalesce`",
-    "only catches byte-identical duplicates; this pass is the judgment it cannot make:",
-    "",
-    "- **Merge near-duplicates.** Two notes that make the *same* point in different",
-    "  words (e.g. the same rationale restated on two files) aren't caught by",
-    "  `coalesce`. Keep the clearest one \u2014 `update` it to the best wording, widen its",
-    "  anchor or `--ticket` if helpful \u2014 and `remove` the rest.",
-    "- **Link related notes across files.** When several notes are facets of one",
-    "  decision spanning multiple files, make that explicit: name the related file(s)",
-    '  and the connecting idea in each note body (a short "see also `path/to/file`"',
-    "  line), and give them a shared `--ticket` so a reader can pivot between them.",
-    "  Bodies render as Markdown, so an inline `` `path` `` reference reads cleanly.",
-    "- **Prune what the finished change made obvious.** A note that justified an",
-    "  intermediate step the final diff no longer shows is noise \u2014 `remove` it.",
-    "",
-    "The goal is the smallest set of notes that still proves the work: no restated",
-    "point twice, and every cross-file relationship spelled out where a reviewer will",
-    "see it.",
-    "",
-    "If your tool can't shell out, write the SARIF directly under `.pr-notes/` per the",
-    "format in `docs/20-ai-review-notes.md` \u2014 but prefer the CLI."
-  ].join("\n");
-}
-var init_instructions = __esm({
-  "src/review-notes/instructions.ts"() {
-    "use strict";
-    init_types();
-  }
-});
-
-// src/db/ids.ts
-function generateId() {
-  return Date.now().toString(36) + Math.random().toString(36).slice(2, 10);
-}
-var init_ids = __esm({
-  "src/db/ids.ts"() {
-    "use strict";
-  }
-});
-
 // node_modules/zod/v4/core/core.js
 // @__NO_SIDE_EFFECTS__
 function $constructor(name, initializer3, params) {
@@ -15351,6 +15209,247 @@ var init_zod = __esm({
   }
 });
 
+// src/app-version.ts
+import { readFileSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+function getCurrentVersion() {
+  try {
+    const dir = dirname(fileURLToPath(import.meta.url));
+    const raw2 = JSON.parse(readFileSync(join(dir, "..", "package.json"), "utf-8"));
+    return VersionPayloadSchema.parse(raw2).version;
+  } catch {
+    return "0.0.0";
+  }
+}
+var VersionPayloadSchema;
+var init_app_version = __esm({
+  "src/app-version.ts"() {
+    "use strict";
+    init_zod();
+    VersionPayloadSchema = external_exports.object({ version: external_exports.string() });
+  }
+});
+
+// src/review-notes/types.ts
+function isNoteKind(value) {
+  return NOTE_KINDS.includes(value);
+}
+var NOTE_KINDS, CONFIDENCE_PROPERTY_KEY, ANCHOR_FINGERPRINT_KEY, DEFAULT_PRODUCER, DEFAULT_SHARD_CAP;
+var init_types = __esm({
+  "src/review-notes/types.ts"() {
+    "use strict";
+    NOTE_KINDS = [
+      "rationale",
+      "proof",
+      "assumption",
+      "alternative-considered",
+      "risk",
+      "test-evidence"
+    ];
+    CONFIDENCE_PROPERTY_KEY = "ext-ai-tool-confidence";
+    ANCHOR_FINGERPRINT_KEY = "prNoteAnchor/v1";
+    DEFAULT_PRODUCER = "unknown-ai-tool";
+    DEFAULT_SHARD_CAP = 1e4;
+  }
+});
+
+// src/review-notes/instructions.ts
+function reviewNoteInstructions() {
+  return [
+    "# Emitting AI review notes (`.pr-notes/`)",
+    "",
+    "As you write or change code, leave **line-anchored review notes** that explain",
+    "your reasoning and prove your work \u2014 the rationale a careful reviewer (human or",
+    "the next AI session) would want, anchored to the exact lines it concerns. Notes",
+    "are committed to the repo as tool-neutral SARIF under `.pr-notes/` and shown",
+    "review-comment-style in Glassbox. Write them **while editing**, at the moment of",
+    "richest context \u2014 not reconstructed afterward.",
+    "",
+    "## When to emit a note",
+    "",
+    'Emit one when a future reader would otherwise have to ask "why?". Good triggers:',
+    "",
+    "- A **non-obvious decision** \u2014 why this approach over the obvious one.",
+    "- **Proof** a change is correct \u2014 the reasoning, test output, or invariant that backs it.",
+    "- An **assumption** you relied on that could later be wrong.",
+    "- An **alternative you considered and rejected**, and why.",
+    "- A **risk** or sharp edge a reviewer should scrutinize.",
+    "- **Test evidence** demonstrating the change works.",
+    "",
+    "Do **not** narrate the obvious or restate what the diff already says. One note per",
+    "genuine decision or claim \u2014 not per line.",
+    "",
+    "## How to emit a note",
+    "",
+    "Shell out to the `glassbox note` CLI (it owns the on-disk format, fingerprint,",
+    "and commit provenance \u2014 you never write the SARIF by hand):",
+    "",
+    "```",
+    "glassbox note add \\",
+    "  --file <repo-relative path> \\",
+    "  --lines <A[-B]> \\",
+    `  --kind <${NOTE_KINDS.join("|")}> \\`,
+    '  --body - \\            # body read from stdin (use --body "text" for short notes)',
+    "  [--confidence 0..1] [--rank 0..100] [--ticket <id|url>] \\",
+    "  [--artifact <path>]\u2026 \\  # attach committed proof artifacts (repeatable)",
+    "  [--related <file:line>]\u2026 \\  # code locations the body links to (repeatable)",
+    '  [--producer "<your tool/agent name>"] [--producer-version <v>]',
+    "```",
+    "",
+    "Always set `--producer` so the note records who wrote it, and `--ticket` when the",
+    "work traces to a tracked task. Keep the body focused: the claim and its support.",
+    "",
+    "## Writing the body",
+    "",
+    "**Lead with a one-sentence summary.** The body's first sentence is what a reader",
+    "sees where space is tight \u2014 the export folds each note into a list item, and a",
+    "viewer may show only the opening. Make it stand alone, then expand beneath it.",
+    "",
+    "Bodies are **markdown** and may span multiple lines. Glassbox renders:",
+    "",
+    "- Headings (`### Root cause`), paragraphs, and thematic breaks (`---`)",
+    "- Unordered and ordered lists, including nested ones",
+    "- Fenced code blocks (```` ``` ```` or `~~~`) \u2014 use these for snippets and",
+    "  command output; indented code blocks are **not** rendered as code",
+    "- Blockquotes (`> \u2026`)",
+    "- Inline `` `code` ``, **bold**, _italic_, and http(s)/mailto links",
+    "",
+    "**Link to other code instead of describing it.** Pass `--related <file:line>`",
+    "(repeatable) and reference the Nth one from the body as `[text](N)`, 0-based \u2014",
+    "it renders as a click-to-jump link to that line. Prefer this over spelling out",
+    '"see src/foo.ts line 120" in prose.',
+    "",
+    "Not rendered: tables, reference-style links, and raw HTML (a body is escaped",
+    "before formatting, so any HTML shows as literal text). A single newline inside a",
+    "paragraph renders as a visible line break, so short line-oriented prose reads the",
+    "way you wrote it.",
+    "",
+    "## Proof artifacts \u2014 diagrams, test output, screenshots",
+    "",
+    "When a claim is clearer shown than told, save the evidence under",
+    "`.pr-notes/artifacts/` and attach it with `--artifact <path>` (repeatable):",
+    "",
+    "- **When a diagram is the clearest proof or rationale** \u2014 a state machine, a",
+    "  data/control flow, a sequence of interactions, an architecture relationship \u2014",
+    "  **write it as Mermaid SOURCE** (a `.mmd` file) and attach that. Diagram source",
+    "  stays diffable and reviewable; never attach a rendered diagram image, and",
+    "  never fall back to ASCII art in the note body.",
+    "- **Test output, logs, and measurements** are attached the same way as plain",
+    "  text files.",
+    "- **Screenshots** are for genuinely visual claims only \u2014 downscale and compress",
+    "  (WebP/AVIF; stored via Git LFS automatically).",
+    "",
+    "Prefer text/diagram-source over images, and attach one artifact per *claim*,",
+    "not per step.",
+    "",
+    "## Revise and consolidate",
+    "",
+    "Notes should reflect the **final** state of your change, not an obsolete",
+    "intermediate step:",
+    "",
+    "- `glassbox note add` prints a stable note id (guid).",
+    "- `glassbox note update --id <guid> [--body -|--kind \u2026|--confidence \u2026|--rank \u2026|--ticket \u2026]`",
+    "  to correct a note as the work evolves.",
+    "- `glassbox note remove --id <guid>` to drop one that no longer applies.",
+    "- When the task is done, run `glassbox note coalesce` to drop redundant notes",
+    "  (identical anchor + kind + body, keeping the most recent).",
+    "",
+    "## Final consolidation pass",
+    "",
+    "After the mechanical `coalesce`, do one **cross-cutting pass over all the notes",
+    "you wrote this session** \u2014 the relationships that only become visible once the",
+    "whole change is in front of you, not while editing a single file. `coalesce`",
+    "only catches byte-identical duplicates; this pass is the judgment it cannot make:",
+    "",
+    "- **Merge near-duplicates.** Two notes that make the *same* point in different",
+    "  words (e.g. the same rationale restated on two files) aren't caught by",
+    "  `coalesce`. Keep the clearest one \u2014 `update` it to the best wording, widen its",
+    "  anchor or `--ticket` if helpful \u2014 and `remove` the rest.",
+    "- **Link related notes across files.** When several notes are facets of one",
+    "  decision spanning multiple files, make that explicit: name the related file(s)",
+    '  and the connecting idea in each note body (a short "see also `path/to/file`"',
+    "  line), and give them a shared `--ticket` so a reader can pivot between them.",
+    "  Bodies render as Markdown, so an inline `` `path` `` reference reads cleanly.",
+    "- **Prune what the finished change made obvious.** A note that justified an",
+    "  intermediate step the final diff no longer shows is noise \u2014 `remove` it.",
+    "",
+    "The goal is the smallest set of notes that still proves the work: no restated",
+    "point twice, and every cross-file relationship spelled out where a reviewer will",
+    "see it.",
+    "",
+    "If your tool can't shell out, write the SARIF directly under `.pr-notes/` per the",
+    "format in `docs/20-ai-review-notes.md` \u2014 but prefer the CLI."
+  ].join("\n");
+}
+var init_instructions = __esm({
+  "src/review-notes/instructions.ts"() {
+    "use strict";
+    init_types();
+  }
+});
+
+// src/db/ids.ts
+function generateId() {
+  return Date.now().toString(36) + Math.random().toString(36).slice(2, 10);
+}
+var init_ids = __esm({
+  "src/db/ids.ts"() {
+    "use strict";
+  }
+});
+
+// src/utils/lfs.ts
+function isLfsPointer(data) {
+  const length = typeof data === "string" ? data.length : data.byteLength;
+  if (length === 0 || length > MAX_POINTER_BYTES) return false;
+  const head = typeof data === "string" ? data.slice(0, VERSION_LINE.length) : data.subarray(0, VERSION_LINE.length).toString("latin1");
+  if (head !== VERSION_LINE) return false;
+  const text = typeof data === "string" ? data : data.toString("utf-8");
+  return OID_RE.test(text) && SIZE_RE.test(text);
+}
+var MAX_POINTER_BYTES, VERSION_LINE, OID_RE, SIZE_RE;
+var init_lfs = __esm({
+  "src/utils/lfs.ts"() {
+    "use strict";
+    MAX_POINTER_BYTES = 1024;
+    VERSION_LINE = "version https://git-lfs.github.com/spec/v1";
+    OID_RE = /(^|\n)oid sha256:[0-9a-f]{64}(\r?\n|$)/;
+    SIZE_RE = /(^|\n)size \d+(\r?\n|$)/;
+  }
+});
+
+// src/utils/flattenMarkdown.ts
+function stripInline(line) {
+  return line.replace(/`([^`]+)`/g, "$1").replace(/\[([^\]]+)\]\(([^)\s]+)\)/g, "$1 ($2)").replace(/\*\*([^*]+)\*\*/g, "$1").replace(/(^|[^*])\*([^*\s][^*]*)\*/g, "$1$2").replace(/(^|[^_])_([^_\s][^_]*)_/g, "$1$2");
+}
+function flattenMarkdown(body) {
+  const out = [];
+  let inFence = false;
+  for (const line of body.split("\n")) {
+    if (FENCE_RE.test(line)) {
+      inFence = !inFence;
+      continue;
+    }
+    if (inFence) {
+      out.push(line);
+      continue;
+    }
+    const heading = HEADING_RE.exec(line);
+    const text = heading !== null ? heading[1].replace(/\s+#+\s*$/, "") : line;
+    out.push(stripInline(text));
+  }
+  return out.join("\n");
+}
+var FENCE_RE, HEADING_RE;
+var init_flattenMarkdown = __esm({
+  "src/utils/flattenMarkdown.ts"() {
+    "use strict";
+    FENCE_RE = /^ {0,3}(?:`{3,}|~{3,})/;
+    HEADING_RE = /^ {0,3}#{1,6}\s+(.*)$/;
+  }
+});
+
 // src/review-notes/sarif.ts
 function emptyLog(producer, opts = {}) {
   return { $schema: SARIF_SCHEMA_URL, version: "2.1.0", runs: [newRun(producer, opts)] };
@@ -15379,6 +15478,10 @@ function newRun(producer, opts = {}) {
   }
   return run;
 }
+function noteMessage(body) {
+  const flat = flattenMarkdown(body);
+  return { text: flat === "" ? body : flat, markdown: body };
+}
 function buildResult(input, meta3) {
   const region = { startLine: input.startLine, endLine: input.endLine };
   if (meta3.snippet !== void 0) region.snippet = { text: meta3.snippet };
@@ -15390,7 +15493,7 @@ function buildResult(input, meta3) {
     kind: "informational",
     level: input.kind === "risk" ? "warning" : "none",
     guid: meta3.guid,
-    message: { text: input.body, markdown: input.body },
+    message: noteMessage(input.body),
     locations: [{
       physicalLocation: {
         artifactLocation: { uri: input.file },
@@ -15399,6 +15502,15 @@ function buildResult(input, meta3) {
     }],
     properties
   };
+  if (input.related !== void 0 && input.related.length > 0) {
+    result.relatedLocations = input.related.map((loc, index) => ({
+      id: index,
+      physicalLocation: {
+        artifactLocation: { uri: loc.uri },
+        region: { startLine: loc.line }
+      }
+    }));
+  }
   if (input.rank !== void 0) result.rank = input.rank;
   if (input.ticket !== void 0 && input.ticket !== "") result.workItemUris = [input.ticket];
   if (meta3.fingerprint !== void 0) result.partialFingerprints = { [ANCHOR_FINGERPRINT_KEY]: meta3.fingerprint };
@@ -15417,6 +15529,7 @@ var init_sarif = __esm({
   "src/review-notes/sarif.ts"() {
     "use strict";
     init_zod();
+    init_flattenMarkdown();
     init_types();
     SARIF_SCHEMA_URL = "https://json.schemastore.org/sarif-2.1.0.json";
     REVIEW_NOTE_RULE_ID = "review-note";
@@ -15451,17 +15564,17 @@ var init_view = __esm({
 // src/review-notes/store.ts
 import { spawnSync } from "child_process";
 import { createHash } from "crypto";
-import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, unlinkSync, writeFileSync } from "fs";
-import { dirname, join } from "path";
+import { existsSync, mkdirSync, readdirSync, readFileSync as readFileSync2, statSync, unlinkSync, writeFileSync } from "fs";
+import { dirname as dirname2, join as join2 } from "path";
 function sanitizeRel(file2) {
   const rel = file2.replace(/\\/g, "/").replace(/^\/+/, "").replace(/(^|\/)\.\.(?=\/|$)/g, "$1_");
   return rel === "" ? "file" : rel;
 }
 function shardPath(repoRoot, safeRel, index) {
-  return join(repoRoot, NOTES_SUBDIR, `${safeRel}.${String(index).padStart(6, "0")}.sarif`);
+  return join2(repoRoot, NOTES_SUBDIR, `${safeRel}.${String(index).padStart(6, "0")}.sarif`);
 }
 function listShardIndices(repoRoot, safeRel) {
-  const dir = join(repoRoot, NOTES_SUBDIR, dirname(safeRel));
+  const dir = join2(repoRoot, NOTES_SUBDIR, dirname2(safeRel));
   if (!existsSync(dir)) return [];
   const base = safeRel.split("/").pop() ?? safeRel;
   const indices = [];
@@ -15476,7 +15589,7 @@ function totalResults(log) {
   return log.runs.reduce((sum, run) => sum + run.results.length, 0);
 }
 function readLog(path) {
-  const raw2 = JSON.parse(readFileSync(path, "utf-8"));
+  const raw2 = JSON.parse(readFileSync2(path, "utf-8"));
   const parsed = SarifLogShapeSchema.safeParse(raw2);
   if (!parsed.success) {
     throw new Error(`existing notes shard is not a SARIF log we recognize, refusing to overwrite: ${path}`);
@@ -15502,7 +15615,7 @@ function gitValue(repoRoot, args) {
 }
 function anchorSnippet(repoRoot, safeRel, startLine, endLine) {
   try {
-    const lines = readFileSync(join(repoRoot, safeRel), "utf-8").split("\n");
+    const lines = readFileSync2(join2(repoRoot, safeRel), "utf-8").split("\n");
     const slice = lines.slice(Math.max(0, startLine - 1), Math.max(startLine, endLine));
     if (slice.length === 0) return {};
     const snippet = slice.join("\n");
@@ -15551,10 +15664,13 @@ function writeReviewNote(repoRoot, input, opts = {}) {
     log = emptyLog(producer, { producerVersion: input.producerVersion, ...vcs });
   }
   findOrAddRun(log, producer, input.producerVersion, vcs).results.push(result);
-  mkdirSync(dirname(path), { recursive: true });
+  mkdirSync(dirname2(path), { recursive: true });
   writeFileSync(path, JSON.stringify(log, null, 2) + "\n", "utf-8");
   return { path, guid: guid3 };
 }
+function noteBody(r) {
+  return r.message?.markdown ?? r.message?.text ?? "";
+}
 function writeLog(path, log) {
   writeFileSync(path, JSON.stringify(log, null, 2) + "\n", "utf-8");
 }
@@ -15564,19 +15680,19 @@ function hashArtifacts(repoRoot, artifacts) {
     const safe = uri.replace(/\\/g, "/").replace(/^\/+/, "");
     if (/(^|\/)\.\.(\/|$)/.test(safe)) continue;
     try {
-      const abs = join(repoRoot, safe);
+      const abs = join2(repoRoot, safe);
       const stat = statSync(abs);
       if (!stat.isFile() || stat.size > ARTIFACT_HASH_MAX_BYTES) continue;
-      out[uri] = createHash("sha256").update(readFileSync(abs)).digest("hex");
+      out[uri] = createHash("sha256").update(readFileSync2(abs)).digest("hex");
     } catch {
     }
   }
   return out;
 }
 function ensureArtifactLfsFilter(repoRoot) {
-  const path = join(repoRoot, ".gitattributes");
+  const path = join2(repoRoot, ".gitattributes");
   try {
-    const existing = existsSync(path) ? readFileSync(path, "utf-8") : "";
+    const existing = existsSync(path) ? readFileSync2(path, "utf-8") : "";
     if (existing.includes(".pr-notes/artifacts/**")) return;
     const prefix = existing === "" || existing.endsWith("\n") ? "" : "\n";
     writeFileSync(path, `${existing}${prefix}${LFS_FILTER_LINE}
@@ -15588,10 +15704,10 @@ function listShardPaths(repoRoot, safeRel) {
   return listShardIndices(repoRoot, safeRel).map((i) => shardPath(repoRoot, safeRel, i));
 }
 function allShardPaths(repoRoot) {
-  const root = join(repoRoot, NOTES_SUBDIR);
+  const root = join2(repoRoot, NOTES_SUBDIR);
   if (!existsSync(root)) return [];
   const entries = readdirSync(root, { recursive: true });
-  return entries.filter((e) => SHARD_RE.test(e)).map((e) => join(root, e));
+  return entries.filter((e) => SHARD_RE.test(e)).map((e) => join2(root, e));
 }
 function persistOrDelete(path, log) {
   log.runs = log.runs.filter((run) => run.results.length > 0);
@@ -15623,7 +15739,7 @@ function updateNote(repoRoot, guid3, patch, file2) {
     for (const run of log.runs) {
       const result = run.results.find((r) => r.guid === guid3);
       if (result !== void 0) {
-        if (patch.body !== void 0) result.message = { text: patch.body, markdown: patch.body };
+        if (patch.body !== void 0) result.message = noteMessage(patch.body);
         if (patch.kind !== void 0) {
           result.properties = { ...result.properties, tags: [patch.kind] };
           result.level = patch.kind === "risk" ? "warning" : "none";
@@ -15647,7 +15763,7 @@ function noteKey(r) {
     loc?.region?.startLine,
     loc?.region?.endLine,
     r.properties?.tags,
-    r.message?.text
+    noteBody(r)
   ]);
 }
 function coalesceFile(repoRoot, file2) {
@@ -15683,7 +15799,7 @@ function coalesceFile(repoRoot, file2) {
   return toRemove.length;
 }
 function coalesceAll(repoRoot) {
-  const root = join(repoRoot, NOTES_SUBDIR);
+  const root = join2(repoRoot, NOTES_SUBDIR);
   if (!existsSync(root)) return 0;
   const sources = /* @__PURE__ */ new Set();
   for (const entry of readdirSync(root, { recursive: true })) {
@@ -15698,16 +15814,27 @@ function readArtifactText(repoRoot, uri) {
   const safe = uri.replace(/\\/g, "/").replace(/^\/+/, "");
   if (/(^|\/)\.\.(\/|$)/.test(safe)) return void 0;
   try {
-    const abs = join(repoRoot, safe);
+    const abs = join2(repoRoot, safe);
     const stat = statSync(abs);
     if (!stat.isFile() || stat.size > ARTIFACT_MAX_BYTES) return void 0;
-    const buf = readFileSync(abs);
+    const buf = readFileSync2(abs);
     if (buf.includes(0)) return void 0;
+    if (isLfsPointer(buf)) return void 0;
     return buf.toString("utf-8");
   } catch {
     return void 0;
   }
 }
+function readRelated(result) {
+  const raw2 = result.relatedLocations;
+  if (raw2 === void 0 || raw2.length === 0) return void 0;
+  return raw2.map((entry) => {
+    const uri = entry.physicalLocation?.artifactLocation?.uri;
+    const line = entry.physicalLocation?.region?.startLine;
+    if (typeof uri !== "string" || uri === "" || typeof line !== "number") return { uri: "", line: 0 };
+    return { uri, line };
+  });
+}
 function readArtifacts(repoRoot, result) {
   const out = [];
   for (const att of result.attachments ?? []) {
@@ -15745,10 +15872,11 @@ function loadReviewNotesForFile(repoRoot, file2) {
           line: startLine,
           side: "new",
           kind,
-          body: r.message?.text ?? "",
+          body: noteBody(r),
           confidence: typeof confidence === "number" ? confidence : void 0,
           producer: producer === "" ? void 0 : producer,
           snippet: region?.snippet?.text,
+          related: readRelated(r),
           artifacts: readArtifacts(repoRoot, r)
         });
       }
@@ -15761,10 +15889,11 @@ var init_store = __esm({
   "src/review-notes/store.ts"() {
     "use strict";
     init_ids();
+    init_lfs();
     init_sarif();
     init_types();
     init_view();
-    NOTES_SUBDIR = join(".pr-notes", "notes");
+    NOTES_SUBDIR = join2(".pr-notes", "notes");
     SHARD_RE = /\.(\d{6})\.sarif$/;
     ARTIFACT_HASH_MAX_BYTES = 5e7;
     LFS_FILTER_LINE = ".pr-notes/artifacts/** filter=lfs diff=lfs merge=lfs -text";
@@ -15775,17 +15904,22 @@ var init_store = __esm({
 // src/review-notes/cli.ts
 var cli_exports = {};
 __export(cli_exports, {
+  UnknownFlagError: () => UnknownFlagError,
   parseNoteAdd: () => parseNoteAdd,
   runNoteCli: () => runNoteCli
 });
 import { spawnSync as spawnSync2 } from "child_process";
 import { relative, resolve } from "path";
-function parseFlags(args) {
+function parseFlags(args, sub) {
+  const known = KNOWN_FLAGS[sub];
   const flags = /* @__PURE__ */ new Map();
   for (let i = 0; i < args.length; i++) {
     const a = args[i];
     if (!a.startsWith("--")) throw new Error(`unexpected argument: ${a}`);
     const key = a.slice(2);
+    if (!known.includes(key)) {
+      throw new UnknownFlagError(`unknown flag --${key} for 'glassbox note ${sub}' (accepted: ${known.map((f) => `--${f}`).join(", ")})`);
+    }
     const next = args.at(i + 1);
     if (next === void 0 || next.startsWith("--")) throw new Error(`missing value for --${key}`);
     flags.set(key, next);
@@ -15827,11 +15961,21 @@ add \u2014 options:
   --producer-version <v>
   --artifact <path>     Attach a committed proof artifact (test output, log,
                         diagram source); repeatable, repo-relative path
+  --related <file:line> A code location the body links to; repeatable. Reference
+                        the Nth one from the body as [text](N), 0-based \u2014 SARIF's
+                        embedded-link syntax, rendered as a jump-to-line link
 
 update/remove use the guid returned by 'add' (--file scopes the search; omit to search all notes).
 coalesce drops redundant notes (identical anchor + kind + body), keeping the most recent.
 `;
 }
+function parseRelated(value) {
+  const match = /^(.+):(\d+)$/.exec(value);
+  if (match === null) throw new Error(`--related must be <file:line> (e.g. src/a.ts:42), got "${value}"`);
+  const line = parseInteger("--related line", match[2]);
+  if (line < 1) throw new Error("--related line must be 1-based");
+  return { uri: match[1], line };
+}
 function parseInteger(label, value) {
   const n = Number(value);
   if (!Number.isInteger(n)) throw new Error(`${label} must be an integer, got "${value}"`);
@@ -15854,7 +15998,7 @@ function parseConfidenceRank(flags) {
   return out;
 }
 function parseNoteAdd(args) {
-  const flags = parseFlags(args);
+  const flags = parseFlags(args, "add");
   const file2 = flags.get("file");
   const lines = flags.get("lines");
   const kindRaw = flags.get("kind");
@@ -15868,7 +16012,15 @@ function parseNoteAdd(args) {
   const endRaw = lineMatch.at(2);
   const endLine = endRaw !== void 0 ? parseInteger("--lines end", endRaw) : startLine;
   if (startLine < 1 || endLine < startLine) throw new Error("--lines must be 1-based with start <= end");
-  const parsed = { file: file2, startLine, endLine, kind: kindRaw, artifacts: collectRepeatable(args, "artifact"), bodyStdin: false };
+  const parsed = {
+    file: file2,
+    startLine,
+    endLine,
+    kind: kindRaw,
+    artifacts: collectRepeatable(args, "artifact"),
+    related: collectRepeatable(args, "related").map(parseRelated),
+    bodyStdin: false
+  };
   Object.assign(parsed, parseConfidenceRank(flags));
   if (flags.has("ticket")) parsed.ticket = flags.get("ticket");
   if (flags.has("producer")) parsed.producer = flags.get("producer");
@@ -15927,7 +16079,8 @@ async function runAdd(args, cwd) {
     ticket: parsed.ticket,
     producer: parsed.producer,
     producerVersion: parsed.producerVersion,
-    artifacts: parsed.artifacts.length > 0 ? parsed.artifacts : void 0
+    artifacts: parsed.artifacts.length > 0 ? parsed.artifacts : void 0,
+    related: parsed.related.length > 0 ? parsed.related : void 0
   };
   warnIfPrNotesIgnored(repoRoot);
   const { path, guid: guid3 } = writeReviewNote(repoRoot, input);
@@ -15938,7 +16091,7 @@ function scopedFile(flags, repoRoot, cwd) {
   return file2 === void 0 ? void 0 : toRepoRelative(repoRoot, cwd, file2);
 }
 function runRemove(args, cwd) {
-  const flags = parseFlags(args);
+  const flags = parseFlags(args, "remove");
   const id = flags.get("id");
   if (id === void 0) throw new Error("--id <guid> is required");
   const repoRoot = findRepoRoot(cwd);
@@ -15947,7 +16100,7 @@ function runRemove(args, cwd) {
   console.log(`Removed review note ${id}`);
 }
 async function runUpdate(args, cwd) {
-  const flags = parseFlags(args);
+  const flags = parseFlags(args, "update");
   const id = flags.get("id");
   if (id === void 0) throw new Error("--id <guid> is required");
   const patch = {};
@@ -15967,7 +16120,7 @@ async function runUpdate(args, cwd) {
   console.log(`Updated review note ${id}`);
 }
 function runCoalesce(args, cwd) {
-  const flags = parseFlags(args);
+  const flags = parseFlags(args, "coalesce");
   const repoRoot = findRepoRoot(cwd);
   const file2 = flags.get("file");
   const removed = file2 !== void 0 ? coalesceFile(repoRoot, toRepoRelative(repoRoot, cwd, file2)) : coalesceAll(repoRoot);
@@ -15981,32 +16134,50 @@ async function runNoteCli(args, ctx = {}) {
     return;
   }
   const rest = args.slice(1);
-  switch (sub) {
-    case "add":
-      await runAdd(rest, cwd);
-      return;
-    case "remove":
-      runRemove(rest, cwd);
-      return;
-    case "update":
-      await runUpdate(rest, cwd);
-      return;
-    case "coalesce":
-      runCoalesce(rest, cwd);
-      return;
-    case "instructions":
-      console.log(reviewNoteInstructions());
-      return;
-    default:
-      throw new Error(`unknown 'note' subcommand: ${sub} (expected add/update/remove/coalesce/instructions)`);
+  try {
+    switch (sub) {
+      case "add":
+        await runAdd(rest, cwd);
+        return;
+      case "remove":
+        runRemove(rest, cwd);
+        return;
+      case "update":
+        await runUpdate(rest, cwd);
+        return;
+      case "coalesce":
+        runCoalesce(rest, cwd);
+        return;
+      case "instructions":
+        console.log(reviewNoteInstructions());
+        return;
+      default:
+        throw new Error(`unknown 'note' subcommand: ${sub} (expected add/update/remove/coalesce/instructions)`);
+    }
+  } catch (err) {
+    if (err instanceof UnknownFlagError) {
+      throw new UnknownFlagError(`${err.message}
+This is glassbox ${getCurrentVersion()} \u2014 a flag added in a newer release is not recognized here.`);
+    }
+    throw err;
   }
 }
+var UnknownFlagError, KNOWN_FLAGS;
 var init_cli = __esm({
   "src/review-notes/cli.ts"() {
     "use strict";
+    init_app_version();
     init_instructions();
     init_store();
     init_types();
+    UnknownFlagError = class extends Error {
+    };
+    KNOWN_FLAGS = {
+      add: ["file", "lines", "kind", "body", "confidence", "rank", "ticket", "producer", "producer-version", "artifact", "related"],
+      update: ["id", "file", "body", "kind", "confidence", "rank", "ticket"],
+      remove: ["id", "file"],
+      coalesce: ["file"]
+    };
   }
 });
 
@@ -16240,12 +16411,12 @@ __export(manifest_exports, {
   GroundTruthSetSchema: () => GroundTruthSetSchema,
   loadGroundTruthManifest: () => loadGroundTruthManifest
 });
-import { readFileSync as readFileSync2 } from "fs";
-import { basename, dirname as dirname2, isAbsolute, resolve as resolve2 } from "path";
+import { readFileSync as readFileSync3 } from "fs";
+import { basename, dirname as dirname3, isAbsolute, resolve as resolve2 } from "path";
 function loadGroundTruthManifest(manifestPath) {
   let raw2;
   try {
-    raw2 = readFileSync2(manifestPath, "utf-8");
+    raw2 = readFileSync3(manifestPath, "utf-8");
   } catch {
     throw new Error(`Cannot read ground-truth manifest: ${manifestPath}`);
   }
@@ -16268,7 +16439,7 @@ function loadGroundTruthManifest(manifestPath) {
     const detail = parsed.error.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ");
     throw new Error(`Ground-truth manifest is invalid (${manifestPath}): ${detail}`);
   }
-  const baseDir = dirname2(resolve2(manifestPath));
+  const baseDir = dirname3(resolve2(manifestPath));
   const resolvePath = (p) => isAbsolute(p) ? p : resolve2(baseDir, p);
   const used = /* @__PURE__ */ new Set();
   const dedupe = (key) => {
@@ -16363,7 +16534,7 @@ __export(promote_exports, {
   promoteGroundTruthBaselines: () => promoteGroundTruthBaselines
 });
 import { copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
-import { dirname as dirname3 } from "path";
+import { dirname as dirname4 } from "path";
 function promoteGroundTruthBaselines(manifestPath) {
   const entries = loadGroundTruthManifest(manifestPath);
   const result = { promoted: [], skipped: [] };
@@ -16379,7 +16550,7 @@ function promoteGroundTruthBaselines(manifestPath) {
       result.skipped.push({ key: entry.key, reason: `actual image not found: ${entry.actualPath}` });
       continue;
     }
-    mkdirSync2(dirname3(entry.expectedPath), { recursive: true });
+    mkdirSync2(dirname4(entry.expectedPath), { recursive: true });
     copyFileSync(entry.actualPath, entry.expectedPath);
     result.promoted.push({ key: entry.key, from: entry.actualPath, to: entry.expectedPath });
   }
@@ -16612,12 +16783,12 @@ var init_ddl = __esm({
 // src/db/connection.ts
 import { PGlite } from "@electric-sql/pglite";
 import { mkdirSync as mkdirSync3, rmSync } from "fs";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 function setDataDir(dataDir) {
   currentDataDir = dataDir;
-  const dbDir = join2(dataDir, "data");
+  const dbDir = join3(dataDir, "data");
   mkdirSync3(dbDir, { recursive: true });
-  currentDbPath = join2(dbDir, "reviews");
+  currentDbPath = join3(dbDir, "reviews");
 }
 function getDataDir() {
   return currentDataDir;
@@ -16692,10 +16863,10 @@ var init_connection = __esm({
 // src/attachments/store.ts
 import { createHash as createHash2 } from "crypto";
 import { existsSync as existsSync3, mkdirSync as mkdirSync4, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
-import { basename as basename2, join as join3 } from "path";
+import { basename as basename2, join as join4 } from "path";
 function attachmentsDir() {
   const dataDir = getDataDir();
-  return dataDir === null ? null : join3(dataDir, "attachments");
+  return dataDir === null ? null : join4(dataDir, "attachments");
 }
 function sanitizeFilename(name) {
   const base = basename2(name.replace(/\\/g, "/"));
@@ -16706,7 +16877,7 @@ function writeAttachmentFile(id, originalFilename, bytes) {
   const dir = attachmentsDir();
   if (dir === null) throw new Error("No data directory for attachments");
   mkdirSync4(dir, { recursive: true });
-  const storedPath = join3(dir, `${id}-${sanitizeFilename(originalFilename)}`);
+  const storedPath = join4(dir, `${id}-${sanitizeFilename(originalFilename)}`);
   writeFileSync2(storedPath, bytes);
   const sha256 = createHash2("sha256").update(bytes).digest("hex");
   return { storedPath, size: bytes.length, sha256 };
@@ -17213,18 +17384,18 @@ var init_queries = __esm({
 });
 
 // src/global-config.ts
-import { chmodSync, existsSync as existsSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { chmodSync, existsSync as existsSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
 import { homedir } from "os";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 function resolveGlobalConfigDir() {
   const override = process.env.GLASSBOX_CONFIG_DIR;
   if (override !== void 0 && override.trim() !== "") return override;
-  return join4(homedir(), ".glassbox");
+  return join5(homedir(), ".glassbox");
 }
 function readGlobalConfig() {
   try {
     if (existsSync4(GLOBAL_CONFIG_PATH)) {
-      const raw2 = JSON.parse(readFileSync3(GLOBAL_CONFIG_PATH, "utf-8"));
+      const raw2 = JSON.parse(readFileSync4(GLOBAL_CONFIG_PATH, "utf-8"));
       const parsed = GlobalConfigSchema.safeParse(raw2);
       if (parsed.success) return parsed.data;
     }
@@ -17252,7 +17423,7 @@ var init_global_config = __esm({
     init_zod();
     GlobalConfigSchema = external_exports.record(external_exports.string(), external_exports.unknown());
     GLOBAL_CONFIG_DIR = resolveGlobalConfigDir();
-    GLOBAL_CONFIG_PATH = join4(GLOBAL_CONFIG_DIR, "config.json");
+    GLOBAL_CONFIG_PATH = join5(GLOBAL_CONFIG_DIR, "config.json");
   }
 });
 
@@ -17391,10 +17562,10 @@ __export(image_blobs_exports, {
   readImageBlob: () => readImageBlob,
   writeImageBlob: () => writeImageBlob
 });
-import { existsSync as existsSync5, mkdirSync as mkdirSync6, readFileSync as readFileSync4, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
-import { join as join5 } from "path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync6, readFileSync as readFileSync5, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
+import { join as join6 } from "path";
 function blobDir(dataDir) {
-  return join5(dataDir, "image-blobs");
+  return join6(dataDir, "image-blobs");
 }
 function blobName(fileId, side) {
   return `${fileId.replace(/[^a-z0-9]/gi, "")}-${side}`;
@@ -17403,13 +17574,13 @@ function writeImageBlob(dataDir, fileId, side, bytes) {
   if (bytes.length === 0) return;
   const dir = blobDir(dataDir);
   mkdirSync6(dir, { recursive: true });
-  writeFileSync4(join5(dir, blobName(fileId, side)), bytes);
+  writeFileSync4(join6(dir, blobName(fileId, side)), bytes);
 }
 function readImageBlob(dataDir, fileId, side) {
-  const path = join5(blobDir(dataDir), blobName(fileId, side));
+  const path = join6(blobDir(dataDir), blobName(fileId, side));
   if (!existsSync5(path)) return null;
   try {
-    return readFileSync4(path);
+    return readFileSync5(path);
   } catch {
     return null;
   }
@@ -17509,16 +17680,16 @@ var init_project_settings = __esm({
 });
 
 // src/project-settings-store.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync8, readFileSync as readFileSync9, writeFileSync as writeFileSync9 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync8, readFileSync as readFileSync10, writeFileSync as writeFileSync9 } from "fs";
+import { join as join11 } from "path";
 function settingsPath(repoRoot) {
-  return join10(repoRoot, ".glassbox", "settings.json");
+  return join11(repoRoot, ".glassbox", "settings.json");
 }
 function readProjectSettings(repoRoot) {
   try {
     const path = settingsPath(repoRoot);
     if (existsSync10(path)) {
-      const raw2 = JSON.parse(readFileSync9(path, "utf-8"));
+      const raw2 = JSON.parse(readFileSync10(path, "utf-8"));
       const parsed = ProjectSettingsSchema.safeParse(raw2);
       if (parsed.success) return parsed.data;
     }
@@ -17530,9 +17701,9 @@ function updateProjectSettings2(repoRoot, mutator) {
   const current = readProjectSettings(repoRoot);
   const result = mutator(current);
   const next = result === void 0 ? current : result;
-  const dir = join10(repoRoot, ".glassbox");
+  const dir = join11(repoRoot, ".glassbox");
   mkdirSync8(dir, { recursive: true });
-  writeFileSync9(join10(dir, "settings.json"), JSON.stringify(next, null, 2), "utf-8");
+  writeFileSync9(join11(dir, "settings.json"), JSON.stringify(next, null, 2), "utf-8");
 }
 var init_project_settings_store = __esm({
   "src/project-settings-store.ts"() {
@@ -17886,8 +18057,8 @@ var init_settings = __esm({
 });
 
 // src/plugins/loader.ts
-import { existsSync as existsSync11, readdirSync as readdirSync2, readFileSync as readFileSync10, statSync as statSync3 } from "fs";
-import { join as join11 } from "path";
+import { existsSync as existsSync11, readdirSync as readdirSync2, readFileSync as readFileSync11, statSync as statSync3 } from "fs";
+import { join as join12 } from "path";
 import { pathToFileURL } from "url";
 function getConfigLabelOverride(pluginId, labelId) {
   return configLabelOverrides.get(`${pluginId}:${labelId}`);
@@ -17908,7 +18079,7 @@ function clearAllPluginUIElements() {
   pluginUIElements.clear();
 }
 function pluginsDir() {
-  return join11(GLOBAL_CONFIG_DIR, "plugins");
+  return join12(GLOBAL_CONFIG_DIR, "plugins");
 }
 function discoverPluginDirs(root = pluginsDir()) {
   if (!existsSync11(root)) return [];
@@ -17921,7 +18092,7 @@ function discoverPluginDirs(root = pluginsDir()) {
   const out = [];
   for (const name of entries) {
     if (name.startsWith(".")) continue;
-    const dir = join11(root, name);
+    const dir = join12(root, name);
     try {
       if (statSync3(dir).isDirectory()) out.push(dir);
     } catch {
@@ -17930,18 +18101,18 @@ function discoverPluginDirs(root = pluginsDir()) {
   return out.sort();
 }
 function readManifest(dir) {
-  const manifestPath = join11(dir, "manifest.json");
+  const manifestPath = join12(dir, "manifest.json");
   if (existsSync11(manifestPath)) {
     try {
-      return parseManifest(JSON.parse(readFileSync10(manifestPath, "utf-8")));
+      return parseManifest(JSON.parse(readFileSync11(manifestPath, "utf-8")));
     } catch {
       return null;
     }
   }
-  const pkgPath = join11(dir, "package.json");
+  const pkgPath = join12(dir, "package.json");
   if (existsSync11(pkgPath)) {
     try {
-      const pkg = JSON.parse(readFileSync10(pkgPath, "utf-8"));
+      const pkg = JSON.parse(readFileSync11(pkgPath, "utf-8"));
       const gb = pkg.glassbox;
       if (gb !== null && typeof gb === "object") {
         return parseManifest({ id: pkg.name, version: pkg.version, entry: pkg.main, ...gb });
@@ -17984,7 +18155,7 @@ async function loadPluginDir(dir, registry3, isEnabled = ALWAYS_ENABLED, repoRoo
     return { id: manifest.id, dir, manifest, status: "disabled", disabledScope: enablement.scope };
   }
   try {
-    const entry = join11(dir, manifest.entry ?? "index.js");
+    const entry = join12(dir, manifest.entry ?? "index.js");
     if (!existsSync11(entry)) throw new Error(`entry not found: ${manifest.entry ?? "index.js"}`);
     const mod = await import(pathToFileURL(entry).href);
     const plugin = mod.default ?? (typeof mod.activate === "function" ? { activate: mod.activate, onAction: mod.onAction } : void 0);
@@ -18029,18 +18200,18 @@ var init_loader = __esm({
 
 // src/plugins/install.ts
 import { createHash as createHash3 } from "crypto";
-import { cpSync, existsSync as existsSync12, mkdirSync as mkdirSync9, readdirSync as readdirSync3, readFileSync as readFileSync11, rmSync as rmSync6, statSync as statSync4, symlinkSync, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname7, join as join12 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { cpSync, existsSync as existsSync12, mkdirSync as mkdirSync9, readdirSync as readdirSync3, readFileSync as readFileSync12, rmSync as rmSync6, statSync as statSync4, symlinkSync, writeFileSync as writeFileSync10 } from "fs";
+import { dirname as dirname8, join as join13 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
 function dismissedPathFor(userDir) {
-  return join12(dirname7(userDir), DISMISSED_FILE);
+  return join13(dirname8(userDir), DISMISSED_FILE);
 }
 function bundledPluginsDir() {
   const override = process.env.GLASSBOX_BUNDLED_PLUGINS_DIR;
   if (override !== void 0 && override.trim() !== "") return override;
-  const sibling = join12(dirname7(fileURLToPath2(import.meta.url)), "plugins");
+  const sibling = join13(dirname8(fileURLToPath3(import.meta.url)), "plugins");
   if (existsSync12(sibling)) return sibling;
-  return join12(process.cwd(), "dist", "plugins");
+  return join13(process.cwd(), "dist", "plugins");
 }
 function discoverBundledPlugins(bundledDir = bundledPluginsDir()) {
   if (!existsSync12(bundledDir)) return [];
@@ -18052,7 +18223,7 @@ function discoverBundledPlugins(bundledDir = bundledPluginsDir()) {
   }
   const out = [];
   for (const name of entries.sort()) {
-    const dir = join12(bundledDir, name);
+    const dir = join13(bundledDir, name);
     try {
       if (!statSync4(dir).isDirectory()) continue;
       const manifest = readManifest(dir);
@@ -18064,7 +18235,7 @@ function discoverBundledPlugins(bundledDir = bundledPluginsDir()) {
 }
 function readDismissed(userDir = pluginsDir()) {
   try {
-    const raw2 = JSON.parse(readFileSync11(dismissedPathFor(userDir), "utf-8"));
+    const raw2 = JSON.parse(readFileSync12(dismissedPathFor(userDir), "utf-8"));
     return Array.isArray(raw2) ? raw2.filter((x) => typeof x === "string") : [];
   } catch {
     return [];
@@ -18072,19 +18243,19 @@ function readDismissed(userDir = pluginsDir()) {
 }
 function writeDismissed(ids, userDir) {
   const path = dismissedPathFor(userDir);
-  mkdirSync9(dirname7(path), { recursive: true });
+  mkdirSync9(dirname8(path), { recursive: true });
   writeFileSync10(path, JSON.stringify([...new Set(ids)], null, 2), "utf-8");
 }
 function hashPluginDir(dir) {
   const h = createHash3("sha1");
   const walk = (d, rel) => {
     for (const name of readdirSync3(d).sort()) {
-      const abs = join12(d, name);
+      const abs = join13(d, name);
       const r = rel === "" ? name : `${rel}/${name}`;
       if (statSync4(abs).isDirectory()) walk(abs, r);
       else {
         h.update(r);
-        h.update(readFileSync11(abs));
+        h.update(readFileSync12(abs));
       }
     }
   };
@@ -18116,13 +18287,13 @@ function installBundledPlugins(opts) {
     return;
   }
   for (const name of entries) {
-    const src = join12(bundledDir, name);
+    const src = join13(bundledDir, name);
     try {
       if (!statSync4(src).isDirectory()) continue;
       const manifest = readManifest(src);
       if (manifest === null || dismissed.has(manifest.id)) continue;
       if (manifest.autoInstall === false) continue;
-      const dest = join12(userDir, manifest.id);
+      const dest = join13(userDir, manifest.id);
       if (!shouldInstall(src, dest, manifest.version)) continue;
       mkdirSync9(userDir, { recursive: true });
       rmSync6(dest, { recursive: true, force: true });
@@ -18136,7 +18307,7 @@ function installPluginFromDisk(sourceDir, opts) {
   if (manifest === null) throw new Error("The selected folder is not a Glassbox plugin (no manifest.json).");
   const userDir = opts?.userDir ?? pluginsDir();
   mkdirSync9(userDir, { recursive: true });
-  const dest = join12(userDir, manifest.id);
+  const dest = join13(userDir, manifest.id);
   rmSync6(dest, { recursive: true, force: true });
   try {
     symlinkSync(sourceDir, dest, "dir");
@@ -18151,7 +18322,7 @@ function undismissPlugin(id, userDir = pluginsDir()) {
 }
 function uninstallPlugin(id, opts) {
   const userDir = opts?.userDir ?? pluginsDir();
-  rmSync6(join12(userDir, id), { recursive: true, force: true });
+  rmSync6(join13(userDir, id), { recursive: true, force: true });
   writeDismissed([...readDismissed(userDir), id], userDir);
 }
 var DISMISSED_FILE;
@@ -18566,17 +18737,17 @@ __export(difftool_discovery_exports, {
   tryAcquireStartingLock: () => tryAcquireStartingLock,
   writeDiscovery: () => writeDiscovery
 });
-import { existsSync as existsSync19, mkdirSync as mkdirSync16, readFileSync as readFileSync22, rmSync as rmSync7, statSync as statSync7, writeFileSync as writeFileSync16 } from "fs";
+import { existsSync as existsSync19, mkdirSync as mkdirSync16, readFileSync as readFileSync23, rmSync as rmSync7, statSync as statSync7, writeFileSync as writeFileSync16 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 function difftoolHome() {
-  return join23(homedir3(), ".glassbox");
+  return join24(homedir3(), ".glassbox");
 }
 function discoveryPath(home = difftoolHome()) {
-  return join23(home, "difftool.lock");
+  return join24(home, "difftool.lock");
 }
 function startingLockPath(home = difftoolHome()) {
-  return join23(home, "difftool-starting.lock");
+  return join24(home, "difftool-starting.lock");
 }
 function parseDiscovery(raw2) {
   let parsed;
@@ -18592,7 +18763,7 @@ function readDiscovery(home = difftoolHome()) {
   const path = discoveryPath(home);
   if (!existsSync19(path)) return null;
   try {
-    return parseDiscovery(readFileSync22(path, "utf-8"));
+    return parseDiscovery(readFileSync23(path, "utf-8"));
   } catch {
     return null;
   }
@@ -23083,12 +23254,12 @@ __export(perceptual_diff_exports, {
   decodeImage: () => decodeImage,
   isIdentical: () => isIdentical
 });
-import { readFileSync as readFileSync23 } from "fs";
+import { readFileSync as readFileSync24 } from "fs";
 import { extname as extname3 } from "path";
 function decodeImage(path) {
   let buf;
   try {
-    buf = readFileSync23(path);
+    buf = readFileSync24(path);
   } catch {
     return null;
   }
@@ -23112,7 +23283,7 @@ async function decodeWithFallback(path, pluginDecode) {
   if (core !== null) return core;
   let buf;
   try {
-    buf = readFileSync23(path);
+    buf = readFileSync24(path);
   } catch {
     return null;
   }
@@ -23163,7 +23334,7 @@ var init_perceptual_diff = __esm({
 // src/cli.ts
 import { existsSync as existsSync20, mkdirSync as mkdirSync17, realpathSync, statSync as statSync8 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { basename as basename5, join as join24, resolve as resolve12 } from "path";
+import { basename as basename5, join as join25, resolve as resolve12 } from "path";
 
 // src/cli-subcommands.ts
 import { resolve as resolve3 } from "path";
@@ -24133,12 +24304,17 @@ function seedSvgBlobs(fileId, diff) {
 function demoReviewNotes(filePath) {
   if (filePath !== "src/auth/session.ts") return [];
   return [
-    { guid: "demo-note-rationale", line: 14, side: "new", kind: "rationale", body: "`createSession` is **async** now because session state moved from an in-process `Map` to Redis; callers must `await` it.", confidence: 0.9, producer: "Claude Code" },
+    // The body carries a SARIF embedded link — `[text](0)` indexes `related` —
+    // which renders as a jump-to-line link into the other changed file (doc 20
+    // §20.6).
+    { guid: "demo-note-rationale", line: 14, side: "new", kind: "rationale", body: "`createSession` is **async** now because session state moved from an in-process `Map` to [the Redis client](0); callers must `await` it.", confidence: 0.9, producer: "Claude Code", related: [{ uri: "src/db/redis.ts", line: 1 }] },
     // The proof note carries two artifacts: mocked test output (always a code
     // block) and a Mermaid sequence diagram — with the mermaid content plugin
     // installed it renders inline as a diagram (doc 29); without it, the
     // fail-soft code block still tells the story.
-    { guid: "demo-note-proof", line: 23, side: "new", kind: "proof", body: "The TTL is written atomically with the value via the EX option, so a session can never be stored without an expiry.", producer: "Claude Code", artifacts: [
+    // Body deliberately uses block markdown (paragraph + list) to showcase the
+    // renderer's block support (doc 20 §20.6).
+    { guid: "demo-note-proof", line: 23, side: "new", kind: "proof", body: "The TTL is written atomically with the value via the EX option, so a session can never be stored without an expiry.\n\n- `SET` carries `EX 3600` in a single round trip\n- No window exists where a session is stored without one", producer: "Claude Code", artifacts: [
       { uri: ".pr-notes/artifacts/session-ttl.test.txt", content: "PASS  session.test.ts\n  \u2713 createSession writes value and TTL atomically (4 ms)\n  \u2713 a session always has an expiry (2 ms)\n\nTests: 2 passed, 2 total" },
       { uri: ".pr-notes/artifacts/session-flow.mmd", content: "sequenceDiagram\n    participant C as Caller\n    participant S as createSession\n    participant R as Redis\n    C->>S: createSession(userId)\n    S->>S: id = randomUUID()\n    S->>R: SET session:id {userId} EX 3600\n    Note over R: value + TTL written atomically\n    R-->>S: OK\n    S-->>C: id" }
     ] },
@@ -24279,11 +24455,12 @@ async function setupReviewNoteReply(fileIdMap) {
 
 // src/git/diff.ts
 init_zod();
-import { existsSync as existsSync6, mkdirSync as mkdirSync7, mkdtempSync, readFileSync as readFileSync5, rmSync as rmSync4, statSync as statSync2, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync7, mkdtempSync, readFileSync as readFileSync6, rmSync as rmSync4, statSync as statSync2, writeFileSync as writeFileSync5 } from "fs";
 import { tmpdir } from "os";
-import { basename as basename3, dirname as dirname4, join as join6, resolve as resolve4 } from "path";
+import { basename as basename3, dirname as dirname5, join as join7, resolve as resolve4 } from "path";
 
 // src/git/parseDiff.ts
+init_lfs();
 function parseDiff(raw2) {
   const files = [];
   const fileChunks = raw2.split(/^diff --git /m).filter(Boolean);
@@ -24317,10 +24494,20 @@ function parseDiff(raw2) {
       continue;
     }
     const hunks = parseHunks(chunk.slice(headerEnd));
+    if (hunksAreLfsPointer(hunks)) {
+      files.push({ filePath, oldPath, status, hunks: [], isBinary: true });
+      continue;
+    }
     files.push({ filePath, oldPath, status, hunks, isBinary: false });
   }
   return files;
 }
+function hunksAreLfsPointer(hunks) {
+  if (hunks.length !== 1) return false;
+  const lines = hunks[0].lines;
+  const side = (types) => lines.filter((l) => types.includes(l.type)).map((l) => l.content).join("\n") + "\n";
+  return isLfsPointer(side(["context", "add"])) || isLfsPointer(side(["context", "remove"]));
+}
 function parseHunks(raw2) {
   const hunks = [];
   const hunkRegex = /^@@\s+-(\d+)(?:,(\d+))?\s+\+(\d+)(?:,(\d+))?\s+@@(.*)/gm;
@@ -24501,9 +24688,9 @@ function getDiffArgs(mode) {
 function directComparisonRoots(mode) {
   const rootOf = (p) => {
     try {
-      return statSync2(p).isDirectory() ? p : dirname4(p);
+      return statSync2(p).isDirectory() ? p : dirname5(p);
     } catch {
-      return dirname4(p);
+      return dirname5(p);
     }
   };
   return { rootA: rootOf(mode.pathA), rootB: rootOf(mode.pathB) };
@@ -24531,14 +24718,14 @@ function getDirectComparisonFiles(mode, cwd) {
 function diffRawContent(displayPath, oldContent, newContent) {
   const rel = displayPath.replace(/\\/g, "/").replace(/^\/+/, "").replace(/(^|\/)\.\.(?=\/|$)/g, "$1_");
   const safeRel = rel === "" ? "file" : rel;
-  const work = mkdtempSync(join6(tmpdir(), "glassbox-difftool-append-"));
-  const rootA = join6(work, "a");
-  const rootB = join6(work, "b");
-  const oldAbs = join6(rootA, safeRel);
-  const newAbs = join6(rootB, safeRel);
+  const work = mkdtempSync(join7(tmpdir(), "glassbox-difftool-append-"));
+  const rootA = join7(work, "a");
+  const rootB = join7(work, "b");
+  const oldAbs = join7(rootA, safeRel);
+  const newAbs = join7(rootB, safeRel);
   try {
-    mkdirSync7(dirname4(oldAbs), { recursive: true });
-    mkdirSync7(dirname4(newAbs), { recursive: true });
+    mkdirSync7(dirname5(oldAbs), { recursive: true });
+    mkdirSync7(dirname5(newAbs), { recursive: true });
     writeFileSync5(oldAbs, oldContent);
     writeFileSync5(newAbs, newContent);
     const rawDiff = gitOrEmpty(["diff", "--no-index", "-U3", toGitArg(oldAbs), toGitArg(newAbs)], work);
@@ -24602,7 +24789,7 @@ function getAllFiles(repoRoot) {
 function createNewFileDiff(filePath, repoRoot) {
   let content;
   try {
-    const buf = readFileSync5(resolve4(repoRoot, filePath));
+    const buf = readFileSync6(resolve4(repoRoot, filePath));
     const checkLen = Math.min(buf.length, 8192);
     for (let i = 0; i < checkLen; i++) {
       if (buf[i] === 0) {
@@ -24638,7 +24825,7 @@ function getFileContent(filePath, ref, cwd) {
   const repoRoot = getRepoRoot(cwd);
   try {
     if (ref === "working") {
-      return readFileSync5(resolve4(repoRoot, filePath), "utf-8");
+      return readFileSync6(resolve4(repoRoot, filePath), "utf-8");
     }
     return git(["show", `${ref}:${filePath}`], repoRoot);
   } catch {
@@ -24648,9 +24835,9 @@ function getFileContent(filePath, ref, cwd) {
 function getModeFileContent(mode, filePath, side, cwd) {
   if (mode.type === "diff") {
     const { rootA, rootB } = directComparisonRoots(mode);
-    const abs = join6(side === "old" ? rootA : rootB, filePath);
+    const abs = join7(side === "old" ? rootA : rootB, filePath);
     try {
-      return readFileSync5(abs, "utf-8");
+      return readFileSync6(abs, "utf-8");
     } catch {
       return "";
     }
@@ -24695,8 +24882,8 @@ function getSingleFileDiff(mode, filePath, repoRoot, extraFlags = "") {
   if (mode.type === "ground-truth") return null;
   if (mode.type === "diff") {
     const { rootA, rootB } = directComparisonRoots(mode);
-    const oldAbs = join6(rootA, filePath);
-    const newAbs = join6(rootB, filePath);
+    const oldAbs = join7(rootA, filePath);
+    const newAbs = join7(rootB, filePath);
     if (!existsSync6(oldAbs) || !existsSync6(newAbs)) return null;
     const args2 = ["diff", "--no-index", "-U3"];
     if (extraFlags) args2.push(...extraFlags.split(" ").filter(Boolean));
@@ -24762,8 +24949,8 @@ function getModeArgs(mode) {
 }
 
 // src/git/gitignore.ts
-import { existsSync as existsSync7, readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename4, dirname as dirname5, join as join7 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
+import { basename as basename4, dirname as dirname6, join as join8 } from "path";
 var GLASSBOX_GITIGNORE_LINES = ["/.glassbox/*", "!/.glassbox/settings.json"];
 function isGlassboxPattern(token) {
   const core = token.replace(/^!/, "").replace(/^\//, "").trim();
@@ -24814,10 +25001,10 @@ function computeGitignore(existing) {
 }
 function ensureGlassboxGitignored(glassboxDir) {
   if (basename4(glassboxDir) !== ".glassbox") return { changed: false };
-  const targetDir = dirname5(glassboxDir);
+  const targetDir = dirname6(glassboxDir);
   if (!isGitRepo(targetDir)) return { changed: false };
-  const gitignorePath = join7(targetDir, ".gitignore");
-  const existing = existsSync7(gitignorePath) ? readFileSync6(gitignorePath, "utf-8") : null;
+  const gitignorePath = join8(targetDir, ".gitignore");
+  const existing = existsSync7(gitignorePath) ? readFileSync7(gitignorePath, "utf-8") : null;
   const { changed, content } = computeGitignore(existing);
   if (changed) writeFileSync6(gitignorePath, content, "utf-8");
   return { changed };
@@ -24825,15 +25012,15 @@ function ensureGlassboxGitignored(glassboxDir) {
 
 // src/lock.ts
 init_zod();
-import { existsSync as existsSync8, readFileSync as readFileSync7, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync8, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "fs";
+import { join as join9 } from "path";
 var lockPath = null;
 var LockFileSchema = external_exports.object({ pid: external_exports.number().int() });
 function acquireLock(dataDir) {
-  lockPath = join8(dataDir, "glassbox.lock");
+  lockPath = join9(dataDir, "glassbox.lock");
   if (existsSync8(lockPath)) {
     try {
-      const raw2 = JSON.parse(readFileSync7(lockPath, "utf-8"));
+      const raw2 = JSON.parse(readFileSync8(lockPath, "utf-8"));
       const contents = LockFileSchema.parse(raw2);
       const pid = contents.pid;
       try {
@@ -25003,23 +25190,23 @@ async function updateReviewDiffs(reviewId, newDiffs, headCommit) {
 
 // src/server.ts
 import { serve } from "@hono/node-server";
-import { existsSync as existsSync16, readFileSync as readFileSync19 } from "fs";
+import { existsSync as existsSync16, readFileSync as readFileSync20 } from "fs";
 import { Hono as Hono21 } from "hono";
-import { dirname as dirname8, join as join20 } from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
+import { dirname as dirname9, join as join21 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
 
 // src/channel-config.ts
 init_zod();
-import { existsSync as existsSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync8 } from "fs";
-import { dirname as dirname6, join as join9, resolve as resolve5 } from "path";
-import { fileURLToPath } from "url";
+import { existsSync as existsSync9, readFileSync as readFileSync9, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname7, join as join10, resolve as resolve5 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 var MCP_SERVER_KEY = "glassbox-channel";
 var McpConfigSchema = external_exports.object({
   mcpServers: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
 }).loose();
 var HealthResponseSchema = external_exports.object({ ok: external_exports.boolean() });
 function getChannelServerPath() {
-  const thisDir = dirname6(fileURLToPath(import.meta.url));
+  const thisDir = dirname7(fileURLToPath2(import.meta.url));
   const distPath = resolve5(thisDir, "channel.js");
   if (existsSync9(distPath)) {
     return { command: process.execPath, args: [distPath] };
@@ -25035,12 +25222,12 @@ function projectRoot(dataDir) {
 }
 function registerChannel(dataDir) {
   const root = projectRoot(dataDir);
-  const mcpPath = join9(root, ".mcp.json");
+  const mcpPath = join10(root, ".mcp.json");
   const { command, args } = getChannelServerPath();
   let config2 = {};
   if (existsSync9(mcpPath)) {
     try {
-      const raw2 = JSON.parse(readFileSync8(mcpPath, "utf-8"));
+      const raw2 = JSON.parse(readFileSync9(mcpPath, "utf-8"));
       const parsed = McpConfigSchema.safeParse(raw2);
       if (parsed.success) config2 = parsed.data;
     } catch {
@@ -25055,10 +25242,10 @@ function registerChannel(dataDir) {
 }
 function unregisterChannel(dataDir) {
   const root = projectRoot(dataDir);
-  const mcpPath = join9(root, ".mcp.json");
+  const mcpPath = join10(root, ".mcp.json");
   if (!existsSync9(mcpPath)) return;
   try {
-    const raw2 = JSON.parse(readFileSync8(mcpPath, "utf-8"));
+    const raw2 = JSON.parse(readFileSync9(mcpPath, "utf-8"));
     const parsed = McpConfigSchema.safeParse(raw2);
     if (!parsed.success) return;
     const config2 = parsed.data;
@@ -25073,7 +25260,7 @@ function unregisterChannel(dataDir) {
 }
 function getChannelPort(dataDir) {
   try {
-    const portStr = readFileSync8(join9(dataDir, "channel-port"), "utf-8").trim();
+    const portStr = readFileSync9(join10(dataDir, "channel-port"), "utf-8").trim();
     const port = parseInt(portStr, 10);
     return isNaN(port) ? null : port;
   } catch {
@@ -25094,7 +25281,7 @@ async function isChannelAlive(dataDir) {
 }
 function getChannelSecret(dataDir) {
   try {
-    const secret = readFileSync8(join9(dataDir, "channel-secret"), "utf-8").trim();
+    const secret = readFileSync9(join10(dataDir, "channel-secret"), "utf-8").trim();
     return secret === "" ? null : secret;
   } catch {
     return null;
@@ -25203,6 +25390,42 @@ init_zod();
 // src/review-notes/format.ts
 init_store();
 init_view();
+var EXPORT_MIN_HEADING = 4;
+var ITEM_INDENT = "  ";
+var FENCE_RE2 = /^\s*(?:```|~~~)/;
+var ATX_RE = /^( {0,3})(#{1,6})(\s)/;
+function indentLines(text, indent) {
+  return text.split("\n").map((line) => line.trim() === "" ? "" : indent + line);
+}
+function demoteHeadings(body, minLevel) {
+  const lines = body.split("\n");
+  const levels = [];
+  let inFence = false;
+  for (const line of lines) {
+    if (FENCE_RE2.test(line)) inFence = !inFence;
+    else if (!inFence) {
+      const m = ATX_RE.exec(line);
+      if (m !== null) levels.push(m[2].length);
+    }
+  }
+  if (levels.length === 0) return body;
+  const shift = minLevel - Math.min(...levels);
+  if (shift <= 0) return body;
+  inFence = false;
+  return lines.map((line) => {
+    if (FENCE_RE2.test(line)) {
+      inFence = !inFence;
+      return line;
+    }
+    if (inFence) return line;
+    return line.replace(ATX_RE, (_m, pad, hashes, space) => `${pad}${"#".repeat(Math.min(6, hashes.length + shift))}${space}`);
+  }).join("\n");
+}
+function noteListItem(label, body) {
+  const trimmed = body.replace(/\s+$/, "");
+  if (!trimmed.includes("\n")) return [`- ${label}: ${trimmed}`];
+  return [`- ${label}`, "", ...indentLines(trimmed, ITEM_INDENT), ""];
+}
 function notesByFile(repoRoot, filePaths) {
   const out = [];
   for (const file2 of filePaths) {
@@ -25222,7 +25445,7 @@ function reviewNotesPromptSection(repoRoot, filePaths) {
   for (const { file: file2, notes } of grouped) {
     lines.push(`${file2}:`);
     for (const n of notes) {
-      lines.push(`- [${REVIEW_NOTE_LABELS[n.kind] ?? n.kind}, L${String(n.line)}] ${n.body}`);
+      lines.push(...noteListItem(`[${REVIEW_NOTE_LABELS[n.kind] ?? n.kind}, L${String(n.line)}]`, n.body));
     }
     lines.push("");
   }
@@ -25242,7 +25465,7 @@ function reviewNotesExportSection(repoRoot, filePaths) {
     lines.push("");
     for (const n of notes) {
       const who = n.producer !== void 0 ? ` _(${n.producer})_` : "";
-      lines.push(`- **Line ${String(n.line)}** [${n.kind}]: ${n.body}${who}`);
+      lines.push(...noteListItem(`**Line ${String(n.line)}** [${n.kind}]${who}`, demoteHeadings(n.body, EXPORT_MIN_HEADING)));
     }
     lines.push("");
   }
@@ -28295,8 +28518,8 @@ init_queries();
 init_attachment_queries();
 init_queries();
 init_schemas3();
-import { existsSync as existsSync13, mkdirSync as mkdirSync10, readFileSync as readFileSync12, unlinkSync as unlinkSync2, writeFileSync as writeFileSync11 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync10, readFileSync as readFileSync13, unlinkSync as unlinkSync2, writeFileSync as writeFileSync11 } from "fs";
+import { join as join14 } from "path";
 init_image_metadata();
 
 // src/utils/formatReviewMode.ts
@@ -28591,9 +28814,9 @@ function buildReviewMarkdown(args) {
 
 // src/export/generate.ts
 function deleteReviewExport(reviewId, repoRoot) {
-  const exportDir = join13(repoRoot, ".glassbox");
+  const exportDir = join14(repoRoot, ".glassbox");
   for (const ext of ["md", "json"]) {
-    const archivePath = join13(exportDir, `review-${reviewId}.${ext}`);
+    const archivePath = join14(exportDir, `review-${reviewId}.${ext}`);
     if (existsSync13(archivePath)) unlinkSync2(archivePath);
   }
 }
@@ -28621,7 +28844,7 @@ async function generateReviewExport(reviewId, repoRoot, isCurrent) {
   if (!review) throw new Error("Review not found");
   const files = await getReviewFiles(reviewId);
   const annotations = await getAnnotationsForReview(reviewId);
-  const exportDir = join13(repoRoot, ".glassbox");
+  const exportDir = join14(repoRoot, ".glassbox");
   mkdirSync10(exportDir, { recursive: true });
   const modeLabel = formatReviewMode(review.mode, review.mode_args);
   const exportDate = (/* @__PURE__ */ new Date()).toISOString();
@@ -28654,20 +28877,20 @@ async function generateReviewExport(reviewId, repoRoot, isCurrent) {
     resolveDims: resolveImageDims
   });
   const json2 = JSON.stringify(exportData, null, 2);
-  const archivePath = join13(exportDir, `review-${review.id}.md`);
+  const archivePath = join14(exportDir, `review-${review.id}.md`);
   writeFileSync11(archivePath, content, "utf-8");
-  writeFileSync11(join13(exportDir, `review-${review.id}.json`), json2, "utf-8");
+  writeFileSync11(join14(exportDir, `review-${review.id}.json`), json2, "utf-8");
   if (isCurrent) {
-    const latestPath = join13(exportDir, "latest-review.md");
+    const latestPath = join14(exportDir, "latest-review.md");
     writeFileSync11(latestPath, content, "utf-8");
-    writeFileSync11(join13(exportDir, "latest-review.json"), json2, "utf-8");
+    writeFileSync11(join14(exportDir, "latest-review.json"), json2, "utf-8");
     return latestPath;
   }
   return archivePath;
 }
 function resolveImageDims(absPath) {
   try {
-    const meta3 = extractMetadata(readFileSync12(absPath), absPath);
+    const meta3 = extractMetadata(readFileSync13(absPath), absPath);
     if (meta3.width !== null && meta3.height !== null) {
       return { width: meta3.width, height: meta3.height };
     }
@@ -28775,7 +28998,7 @@ init_store2();
 init_attachment_queries();
 init_ids();
 init_queries();
-import { readFileSync as readFileSync13, statSync as statSync5 } from "fs";
+import { readFileSync as readFileSync14, statSync as statSync5 } from "fs";
 import { Hono as Hono5 } from "hono";
 
 // src/utils/mime.ts
@@ -28940,7 +29163,7 @@ attachmentsRoutes.get("/attachments/:id/raw", async (c) => {
   try {
     const stat = statSync5(attachment.stored_path);
     if (!stat.isFile()) return c.text("Not found", 404);
-    const bytes = readFileSync13(attachment.stored_path);
+    const bytes = readFileSync14(attachment.stored_path);
     const asciiName = attachment.original_filename.replace(/[^\x20-\x7E]/g, "_").replace(/["\\]/g, "_");
     const utf8Name = encodeURIComponent(attachment.original_filename);
     return new Response(new Uint8Array(bytes), {
@@ -29151,9 +29374,10 @@ init_queries();
 import { Hono as Hono8 } from "hono";
 
 // src/git/image.ts
+init_lfs();
 import { spawnSync as spawnSync8 } from "child_process";
-import { readFileSync as readFileSync14 } from "fs";
-import { join as join14, resolve as resolve8 } from "path";
+import { readFileSync as readFileSync15 } from "fs";
+import { join as join15, resolve as resolve8 } from "path";
 init_image_metadata();
 function getOldRef(mode) {
   switch (mode.type) {
@@ -29213,18 +29437,26 @@ function gitShowFile(ref, filePath, repoRoot) {
   const spec = ref === ":" ? `:${filePath}` : `${ref}:${filePath}`;
   const result = spawnSync8("git", ["show", spec], { cwd: repoRoot, maxBuffer: 50 * 1024 * 1024, env: scrubbedGitEnv() });
   if (result.status !== 0 || result.stdout.length === 0) return null;
+  if (isLfsPointer(result.stdout)) {
+    const smudged = spawnSync8("git", ["cat-file", "--filters", spec], { cwd: repoRoot, maxBuffer: 50 * 1024 * 1024, env: scrubbedGitEnv() });
+    if (smudged.status === 0 && smudged.stdout.length > 0 && !isLfsPointer(smudged.stdout)) {
+      return smudged.stdout;
+    }
+    return null;
+  }
   return result.stdout;
 }
 function readWorkingFile(filePath, repoRoot) {
   try {
-    return readFileSync14(resolve8(repoRoot, filePath));
+    const data = readFileSync15(resolve8(repoRoot, filePath));
+    return isLfsPointer(data) ? null : data;
   } catch {
     return null;
   }
 }
 function readDiskImage(absPath) {
   try {
-    const data = readFileSync14(absPath);
+    const data = readFileSync15(absPath);
     return { data, size: data.length };
   } catch {
     return null;
@@ -29235,7 +29467,7 @@ function groundTruthEntry(mode, filePath) {
 }
 function getOldImage(mode, filePath, oldPath, repoRoot) {
   if (mode.type === "diff") {
-    return readDiskImage(join14(directComparisonRoots(mode).rootA, oldPath ?? filePath));
+    return readDiskImage(join15(directComparisonRoots(mode).rootA, oldPath ?? filePath));
   }
   if (mode.type === "ground-truth") {
     const entry = groundTruthEntry(mode, filePath);
@@ -29255,7 +29487,7 @@ function getOldImage(mode, filePath, oldPath, repoRoot) {
 }
 function getNewImage(mode, filePath, repoRoot) {
   if (mode.type === "diff") {
-    return readDiskImage(join14(directComparisonRoots(mode).rootB, filePath));
+    return readDiskImage(join15(directComparisonRoots(mode).rootB, filePath));
   }
   if (mode.type === "ground-truth") {
     const entry = groundTruthEntry(mode, filePath);
@@ -29356,7 +29588,7 @@ imageRoutes.get("/image/:fileId/:side", async (c) => {
 // src/routes/api/outline.ts
 init_queries();
 import { spawnSync as spawnSync9 } from "child_process";
-import { readFileSync as readFileSync15 } from "fs";
+import { readFileSync as readFileSync16 } from "fs";
 import { Hono as Hono9 } from "hono";
 import { resolve as resolve9 } from "path";
 
@@ -29734,7 +29966,7 @@ outlineRoutes.get("/symbol-definition", async (c) => {
         }
         let content = "";
         try {
-          content = readFileSync15(resolve9(repoRoot, filePath), "utf-8");
+          content = readFileSync16(resolve9(repoRoot, filePath), "utf-8");
         } catch {
           continue;
         }
@@ -29776,7 +30008,7 @@ import { Hono as Hono10 } from "hono";
 init_install();
 init_loader();
 import { existsSync as existsSync14 } from "fs";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 
 // src/plugins/readiness.ts
 import { spawnSync as spawnSync10 } from "child_process";
@@ -29832,7 +30064,7 @@ function listAvailablePlugins(opts) {
   const out = [];
   for (const { manifest } of discoverBundledPlugins(bundledDir)) {
     if (manifest.autoInstall !== false) continue;
-    if (existsSync14(join15(userDir, manifest.id))) continue;
+    if (existsSync14(join16(userDir, manifest.id))) continue;
     out.push(describeAvailablePlugin(manifest, opts?.runProbe));
   }
   return out.sort((a, b) => a.name.localeCompare(b.name));
@@ -29849,7 +30081,7 @@ init_loader();
 import { spawnSync as spawnSync11 } from "child_process";
 import { createHash as createHash4 } from "crypto";
 import { cpSync as cpSync2, mkdirSync as mkdirSync11, writeFileSync as writeFileSync12 } from "fs";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 var defaultFetchBytes = async (url2) => {
   const res = await fetch(url2);
   if (!res.ok) throw new Error(`HTTP ${String(res.status)}`);
@@ -29872,7 +30104,7 @@ async function runProvisionStep(step, installDir, requirements, deps) {
           return { step: label2, ok: false, skipped: false, detail: `checksum mismatch (expected ${step.sha256})` };
         }
       }
-      writeFileSync12(join16(installDir, step.dest), bytes);
+      writeFileSync12(join17(installDir, step.dest), bytes);
       return { step: label2, ok: true, skipped: false, detail: `saved ${step.dest}` };
     } catch (e) {
       return { step: label2, ok: false, skipped: false, detail: e instanceof Error ? e.message : "download failed" };
@@ -29907,7 +30139,7 @@ async function installAvailablePlugin(id, deps = {}) {
     return { id, installed: false, status: "error", requirements: [], provisioned: [], instructions: [], error: "Not a bundled plugin available to install." };
   }
   const manifest = bundled.manifest;
-  const dest = join16(userDir, id);
+  const dest = join17(userDir, id);
   try {
     mkdirSync11(userDir, { recursive: true });
     cpSync2(bundled.dir, dest, { recursive: true });
@@ -30027,7 +30259,8 @@ projectSettingsRoutes.patch("/project-settings", async (c) => {
 
 // src/routes/api/review-notes.ts
 init_store();
-import { readFileSync as readFileSync16, statSync as statSync6 } from "fs";
+init_lfs();
+import { readFileSync as readFileSync17, statSync as statSync6 } from "fs";
 import { Hono as Hono12 } from "hono";
 import { extname as extname2, relative as relative2, resolve as resolve10 } from "path";
 var reviewNotesRoutes = new Hono12();
@@ -30054,7 +30287,8 @@ reviewNotesRoutes.get("/review-notes/artifact", (c) => {
   try {
     const stat = statSync6(abs);
     if (!stat.isFile() || stat.size > ARTIFACT_SERVE_MAX_BYTES) return c.text("Not found", 404);
-    const body = readFileSync16(abs);
+    const body = readFileSync17(abs);
+    if (isLfsPointer(body)) return c.text("Not found", 404);
     return c.body(body, 200, { "Content-Type": contentType });
   } catch {
     return c.text("Not found", 404);
@@ -30076,12 +30310,12 @@ import { Hono as Hono13 } from "hono";
 // src/export/on-complete-hook.ts
 import { spawn as spawn2 } from "child_process";
 import { appendFileSync } from "fs";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 function runOnCompleteHook(command, ctx) {
   if (command === null || command.trim() === "") {
     return Promise.resolve({ ran: false, ok: true, exitCode: 0 });
   }
-  const logPath = join17(ctx.repoRoot, ".glassbox", "on-complete.log");
+  const logPath = join18(ctx.repoRoot, ".glassbox", "on-complete.log");
   const log = (s) => {
     try {
       appendFileSync(logPath, s);
@@ -30298,7 +30532,7 @@ apiRoutes.route("/", systemRoutes);
 import { spawnSync as spawnSync12 } from "child_process";
 import { mkdirSync as mkdirSync12 } from "fs";
 import { Hono as Hono17 } from "hono";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 init_global_config();
 init_compareVersions();
 var MIN_CLAUDE_VERSION = "2.1.80";
@@ -30307,7 +30541,7 @@ channelApiRoutes.get("/status", async (c) => {
   const config2 = readGlobalConfig();
   const enabled = config2.channelEnabled === true;
   const repoRoot = c.get("repoRoot");
-  const dataDir = join18(repoRoot, ".glassbox");
+  const dataDir = join19(repoRoot, ".glassbox");
   const connected = enabled ? await isChannelAlive(dataDir) : false;
   return c.json({ enabled, connected });
 });
@@ -30316,7 +30550,7 @@ channelApiRoutes.post("/enable", (c) => {
     config2.channelEnabled = true;
   });
   const repoRoot = c.get("repoRoot");
-  const dataDir = join18(repoRoot, ".glassbox");
+  const dataDir = join19(repoRoot, ".glassbox");
   mkdirSync12(dataDir, { recursive: true });
   registerChannel(dataDir);
   return c.json({ ok: true });
@@ -30326,7 +30560,7 @@ channelApiRoutes.post("/disable", (c) => {
     config2.channelEnabled = false;
   });
   const repoRoot = c.get("repoRoot");
-  const dataDir = join18(repoRoot, ".glassbox");
+  const dataDir = join19(repoRoot, ".glassbox");
   unregisterChannel(dataDir);
   return c.json({ ok: true });
 });
@@ -30334,7 +30568,7 @@ channelApiRoutes.post("/trigger", async (c) => {
   const parsed = await parseBody(c, TriggerChannelReqSchema);
   if (!parsed.ok) return parsed.response;
   const repoRoot = c.get("repoRoot");
-  const dataDir = join18(repoRoot, ".glassbox");
+  const dataDir = join19(repoRoot, ".glassbox");
   const sent = await triggerChannel(dataDir, parsed.data.message);
   if (!sent) {
     return errorResponse(c, "Channel not connected", 503);
@@ -30441,7 +30675,7 @@ difftoolApiRoutes.post("/end", (c) => {
 });
 
 // src/routes/pages.tsx
-import { readFileSync as readFileSync18 } from "fs";
+import { readFileSync as readFileSync19 } from "fs";
 import { Hono as Hono19 } from "hono";
 import { relative as relative3, resolve as resolve11 } from "path";
 
@@ -30636,12 +30870,23 @@ function truncateDiffLine(content) {
 function escapeHtml(str) {
   return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
+function escapeAttr(str) {
+  return str.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/'/g, "&#39;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
 
 // src/utils/noteMarkdown.ts
 var SAFE_URL = /^(https?:\/\/|mailto:)/i;
-function renderInline(escaped) {
+function renderEmbeddedLink(text, destination, ctx) {
+  if (!/^\d+$/.test(destination)) return null;
+  const target = ctx.related.at(Number(destination));
+  if (target === void 0 || target.uri === "" || target.line < 1) return null;
+  return `<a class="ai-note-loclink" data-loc-file="${escapeAttr(target.uri)}" data-loc-line="${String(target.line)}" title="${escapeAttr(`${target.uri}:${String(target.line)}`)}">${text}</a>`;
+}
+function renderInline(escaped, ctx) {
   let out = escaped.replace(/`([^`]+)`/g, "<code>$1</code>");
   out = out.replace(/\[([^\]]+)\]\(([^)\s]+)\)/g, (match, text, url2) => {
+    const embedded = renderEmbeddedLink(text, url2, ctx);
+    if (embedded !== null) return embedded;
     if (!SAFE_URL.test(url2)) return match;
     return `<a href="${url2}" target="_blank" rel="noopener noreferrer">${text}</a>`;
   });
@@ -30650,8 +30895,155 @@ function renderInline(escaped) {
   out = out.replace(/(^|[^_])_([^_\s][^_]*)_/g, "$1<em>$2</em>");
   return out;
 }
-function renderNoteMarkdown(text) {
-  return escapeHtml(text).split("\n").map(renderInline).join("<br>");
+var MAX_BLOCK_DEPTH = 6;
+var HEADING_BASE = 3;
+var FENCE_RE3 = /^ {0,3}(`{3,}|~{3,})\s*(.*)$/;
+var HEADING_RE2 = /^ {0,3}(#{1,6})\s+(.*)$/;
+var HR_RE = /^ {0,3}([-*_])[ \t]*(?:\1[ \t]*){2,}$/;
+var QUOTE_RE = /^ {0,3}&gt;[ \t]?(.*)$/;
+var ITEM_RE = /^(\s*)([-*+]|\d{1,9}[.)])\s+(.*)$/;
+var CONTINUATION_RE = /^\s{2,}\S/;
+function matchItem(line) {
+  const m = ITEM_RE.exec(line);
+  if (m === null) return null;
+  if (HR_RE.test(line)) return null;
+  const ordered = /^\d/.test(m[2]);
+  return {
+    indent: m[1].length,
+    ordered,
+    number: ordered ? parseInt(m[2], 10) : 1,
+    text: m[3]
+  };
+}
+function isBlockStart(line) {
+  return FENCE_RE3.test(line) || HEADING_RE2.test(line) || HR_RE.test(line) || QUOTE_RE.test(line) || matchItem(line) !== null;
+}
+function dedent(lines) {
+  let min = Infinity;
+  for (const line of lines) {
+    if (line.trim() === "") continue;
+    min = Math.min(min, line.length - line.trimStart().length);
+  }
+  if (min === Infinity || min === 0) return lines;
+  return lines.map((line) => line.trim() === "" ? "" : line.slice(min));
+}
+function renderParagraph(lines, ctx) {
+  return `<p>${lines.map((line) => renderInline(line, ctx)).join("<br>")}</p>`;
+}
+function renderCodeBlock(lines) {
+  return `<pre><code>${lines.join("\n")}</code></pre>`;
+}
+function renderList(run, first, depth, ctx) {
+  const base = first.indent;
+  const items = [];
+  for (const line of run) {
+    const m = matchItem(line);
+    if (m !== null && m.indent <= base) {
+      items.push({ lines: [m.text], nested: [] });
+      continue;
+    }
+    const item = items[items.length - 1];
+    if (item.nested.length > 0 || m !== null) item.nested.push(line);
+    else if (line.trim() === "") item.nested.push(line);
+    else item.lines.push(line.trim());
+  }
+  const tag = first.ordered ? "ol" : "ul";
+  const start = first.ordered && first.number !== 1 ? ` start="${String(first.number)}"` : "";
+  const body = items.map((item) => {
+    const text = item.lines.map((line) => renderInline(line, ctx)).join("<br>");
+    const nested = dedent(item.nested).filter((l, i, a) => !(l === "" && i === a.length - 1));
+    const inner = nested.length > 0 ? renderBlocks(nested, depth + 1, ctx) : "";
+    return `<li>${text}${inner}</li>`;
+  }).join("");
+  return `<${tag}${start}>${body}</${tag}>`;
+}
+function renderBlocks(lines, depth, ctx) {
+  if (depth > MAX_BLOCK_DEPTH) {
+    const text = lines.filter((l) => l.trim() !== "");
+    return text.length > 0 ? renderParagraph(text, ctx) : "";
+  }
+  const out = [];
+  let i = 0;
+  while (i < lines.length) {
+    const line = lines[i];
+    if (line.trim() === "") {
+      i++;
+      continue;
+    }
+    const fence = FENCE_RE3.exec(line);
+    if (fence !== null) {
+      const marker = fence[1][0];
+      const body = [];
+      i++;
+      while (i < lines.length) {
+        const close = FENCE_RE3.exec(lines[i]);
+        if (close !== null && close[1][0] === marker && close[2] === "") {
+          i++;
+          break;
+        }
+        body.push(lines[i]);
+        i++;
+      }
+      out.push(renderCodeBlock(body));
+      continue;
+    }
+    const heading = HEADING_RE2.exec(line);
+    if (heading !== null) {
+      const level = Math.min(6, heading[1].length + HEADING_BASE);
+      out.push(`<h${String(level)}>${renderInline(heading[2].replace(/\s+#+\s*$/, ""), ctx)}</h${String(level)}>`);
+      i++;
+      continue;
+    }
+    if (HR_RE.test(line)) {
+      out.push("<hr>");
+      i++;
+      continue;
+    }
+    const quote = QUOTE_RE.exec(line);
+    if (quote !== null) {
+      const inner = [];
+      while (i < lines.length) {
+        const m = QUOTE_RE.exec(lines[i]);
+        if (m === null) break;
+        inner.push(m[1]);
+        i++;
+      }
+      out.push(`<blockquote>${renderBlocks(inner, depth + 1, ctx)}</blockquote>`);
+      continue;
+    }
+    const item = matchItem(line);
+    if (item !== null) {
+      const run = [];
+      while (i < lines.length) {
+        const current = lines[i];
+        if (current.trim() === "") {
+          let k = i;
+          while (k < lines.length && lines[k].trim() === "") k++;
+          if (k < lines.length && (matchItem(lines[k]) !== null || CONTINUATION_RE.test(lines[k]))) {
+            run.push(...lines.slice(i, k));
+            i = k;
+            continue;
+          }
+          break;
+        }
+        if (matchItem(current) === null && !CONTINUATION_RE.test(current)) break;
+        run.push(current);
+        i++;
+      }
+      out.push(renderList(run, item, depth, ctx));
+      continue;
+    }
+    const para = [];
+    while (i < lines.length && lines[i].trim() !== "" && !(para.length > 0 && isBlockStart(lines[i]))) {
+      para.push(lines[i]);
+      i++;
+    }
+    out.push(renderParagraph(para, ctx));
+  }
+  return out.join("");
+}
+function renderNoteMarkdown(text, related = []) {
+  return renderBlocks(escapeHtml(text).split("\n"), 0, { related });
 }
 
 // src/components/imageDiff.tsx
@@ -31225,7 +31617,7 @@ function ReviewNoteRows({ notes, repliesByNote }) {
             /* @__PURE__ */ jsxs4("div", { className: "ai-note-item", children: [
               /* @__PURE__ */ jsx4("span", { className: `ai-note-label ai-note-label-${n.kind}`, children: REVIEW_NOTE_LABELS[n.kind] ?? n.kind }),
               n.stale === true ? /* @__PURE__ */ jsx4("span", { className: "ai-note-stale-tag", title: "The code this note referred to has changed", children: "outdated" }) : null,
-              /* @__PURE__ */ jsx4("span", { className: "ai-note-text", children: raw(renderNoteMarkdown(n.body)) }),
+              /* @__PURE__ */ jsx4("div", { className: "ai-note-text", children: raw(renderNoteMarkdown(n.body, n.related)) }),
               n.producer !== void 0 ? /* @__PURE__ */ jsx4("span", { className: "ai-note-producer", children: n.producer }) : null,
               n.guid !== void 0 ? /* @__PURE__ */ jsx4("button", { className: "ai-note-reply-btn", "data-line": String(n.line), children: "Reply" }) : null,
               n.stale === true && n.guid !== void 0 ? /* @__PURE__ */ jsxs4("span", { className: "ai-note-stale-actions", children: [
@@ -31326,10 +31718,10 @@ function AnnotationRows({ annotations }) {
 
 // src/themes/config.ts
 init_zod();
-import { existsSync as existsSync15, mkdirSync as mkdirSync13, readdirSync as readdirSync4, readFileSync as readFileSync17, unlinkSync as unlinkSync3, writeFileSync as writeFileSync13 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync13, readdirSync as readdirSync4, readFileSync as readFileSync18, unlinkSync as unlinkSync3, writeFileSync as writeFileSync13 } from "fs";
+import { join as join20 } from "path";
 init_global_config();
-var THEMES_DIR = join19(GLOBAL_CONFIG_DIR, "themes");
+var THEMES_DIR = join20(GLOBAL_CONFIG_DIR, "themes");
 var ThemeConfigSliceSchema = external_exports.object({ active: external_exports.string().optional() }).loose();
 function getActiveThemeId() {
   const config2 = readGlobalConfig();
@@ -31344,7 +31736,7 @@ function setActiveThemeId(id) {
 }
 function readStoredTheme(filePath) {
   try {
-    const parsed = StoredCustomThemeSchema.safeParse(JSON.parse(readFileSync17(filePath, "utf-8")));
+    const parsed = StoredCustomThemeSchema.safeParse(JSON.parse(readFileSync18(filePath, "utf-8")));
     if (!parsed.success) return void 0;
     const d = parsed.data;
     return { id: d.id, name: d.name, colors: d.colors, builtIn: false, baseTheme: d.baseTheme ?? "" };
@@ -31357,7 +31749,7 @@ function loadCustomThemes() {
   const themes = [];
   try {
     for (const file2 of readdirSync4(THEMES_DIR).filter((f) => f.endsWith(".json"))) {
-      const theme = readStoredTheme(join19(THEMES_DIR, file2));
+      const theme = readStoredTheme(join20(THEMES_DIR, file2));
       if (theme !== void 0) themes.push(theme);
     }
   } catch {
@@ -31366,17 +31758,17 @@ function loadCustomThemes() {
 }
 function saveCustomTheme(theme) {
   mkdirSync13(THEMES_DIR, { recursive: true });
-  const filePath = join19(THEMES_DIR, `${theme.id}.json`);
+  const filePath = join20(THEMES_DIR, `${theme.id}.json`);
   writeFileSync13(filePath, JSON.stringify(theme, null, 2), "utf-8");
 }
 function deleteCustomTheme(id) {
-  const filePath = join19(THEMES_DIR, `${id}.json`);
+  const filePath = join20(THEMES_DIR, `${id}.json`);
   if (existsSync15(filePath)) {
     unlinkSync3(filePath);
   }
 }
 function getCustomTheme(id) {
-  const filePath = join19(THEMES_DIR, `${id}.json`);
+  const filePath = join20(THEMES_DIR, `${id}.json`);
   if (!existsSync15(filePath)) return void 0;
   return readStoredTheme(filePath);
 }
@@ -31855,7 +32247,7 @@ pageRoutes.get("/file-raw", (c) => {
   if (rel === "" || rel.startsWith("..") || rel.startsWith("/")) return c.text("Forbidden", 403);
   let content;
   try {
-    content = readFileSync18(abs, "utf-8");
+    content = readFileSync19(abs, "utf-8");
   } catch {
     return c.text("File not found", 404);
   }
@@ -32043,22 +32435,22 @@ async function startServer(port, reviewId, repoRoot, options) {
     c.set("onCompleteCommand", onCompleteCommand);
     await next();
   });
-  const selfDir = dirname8(fileURLToPath3(import.meta.url));
-  const distDir = existsSync16(join20(selfDir, "client", "styles.css")) ? join20(selfDir, "client") : join20(selfDir, "..", "dist", "client");
+  const selfDir = dirname9(fileURLToPath4(import.meta.url));
+  const distDir = existsSync16(join21(selfDir, "client", "styles.css")) ? join21(selfDir, "client") : join21(selfDir, "..", "dist", "client");
   app.get("/static/styles.css", (c) => {
-    const css = readFileSync19(join20(distDir, "styles.css"), "utf-8");
+    const css = readFileSync20(join21(distDir, "styles.css"), "utf-8");
     return c.text(css, 200, { "Content-Type": "text/css", "Cache-Control": "no-cache" });
   });
   app.get("/static/app.js", (c) => {
-    const js = readFileSync19(join20(distDir, "app.global.js"), "utf-8");
+    const js = readFileSync20(join21(distDir, "app.global.js"), "utf-8");
     return c.text(js, 200, { "Content-Type": "application/javascript", "Cache-Control": "no-cache" });
   });
   app.get("/static/history.js", (c) => {
-    const js = readFileSync19(join20(distDir, "history.global.js"), "utf-8");
+    const js = readFileSync20(join21(distDir, "history.global.js"), "utf-8");
     return c.text(js, 200, { "Content-Type": "application/javascript", "Cache-Control": "no-cache" });
   });
   app.get("/favicon.svg", (c) => {
-    const svg = readFileSync19(join20(distDir, "favicon.svg"), "utf-8");
+    const svg = readFileSync20(join21(distDir, "favicon.svg"), "utf-8");
     return c.body(svg, 200, { "Content-Type": "image/svg+xml", "Cache-Control": "no-cache" });
   });
   app.get("/favicon.ico", (c) => c.body(null, 204));
@@ -32102,7 +32494,7 @@ async function startServer(port, reviewId, repoRoot, options) {
   try {
     const globalConfig2 = readGlobalConfig();
     if (globalConfig2.channelEnabled === true) {
-      const dataDir = join20(repoRoot, ".glassbox");
+      const dataDir = join21(repoRoot, ".glassbox");
       registerChannel(dataDir);
     }
   } catch {
@@ -32117,8 +32509,8 @@ async function startServer(port, reviewId, repoRoot, options) {
 }
 
 // src/skills.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync14, readFileSync as readFileSync20, writeFileSync as writeFileSync14 } from "fs";
-import { join as join21 } from "path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync14, readFileSync as readFileSync21, writeFileSync as writeFileSync14 } from "fs";
+import { join as join22 } from "path";
 var SKILL_VERSION = 1;
 function versionHeader() {
   return `<!-- glassbox-skill-version: ${SKILL_VERSION} -->`;
@@ -32130,7 +32522,7 @@ function parseVersionHeader(content) {
 }
 function updateFile(path, content) {
   if (existsSync17(path)) {
-    const existing = readFileSync20(path, "utf-8");
+    const existing = readFileSync21(path, "utf-8");
     const version2 = parseVersionHeader(existing);
     if (version2 !== null && version2 >= SKILL_VERSION) {
       return false;
@@ -32156,7 +32548,7 @@ function skillBody() {
   ].join("\n");
 }
 function ensureClaudeSkills(cwd) {
-  const dir = join21(cwd, ".claude", "skills", "glassbox");
+  const dir = join22(cwd, ".claude", "skills", "glassbox");
   mkdirSync14(dir, { recursive: true });
   const content = [
     "---",
@@ -32169,10 +32561,10 @@ function ensureClaudeSkills(cwd) {
     skillBody(),
     ""
   ].join("\n");
-  return updateFile(join21(dir, "SKILL.md"), content);
+  return updateFile(join22(dir, "SKILL.md"), content);
 }
 function ensureCursorRules(cwd) {
-  const rulesDir = join21(cwd, ".cursor", "rules");
+  const rulesDir = join22(cwd, ".cursor", "rules");
   mkdirSync14(rulesDir, { recursive: true });
   const content = [
     "---",
@@ -32184,10 +32576,10 @@ function ensureCursorRules(cwd) {
     skillBody(),
     ""
   ].join("\n");
-  return updateFile(join21(rulesDir, "glassbox.mdc"), content);
+  return updateFile(join22(rulesDir, "glassbox.mdc"), content);
 }
 function ensureCopilotPrompts(cwd) {
-  const promptsDir = join21(cwd, ".github", "prompts");
+  const promptsDir = join22(cwd, ".github", "prompts");
   mkdirSync14(promptsDir, { recursive: true });
   const content = [
     "---",
@@ -32198,10 +32590,10 @@ function ensureCopilotPrompts(cwd) {
     skillBody(),
     ""
   ].join("\n");
-  return updateFile(join21(promptsDir, "glassbox.prompt.md"), content);
+  return updateFile(join22(promptsDir, "glassbox.prompt.md"), content);
 }
 function ensureWindsurfRules(cwd) {
-  const rulesDir = join21(cwd, ".windsurf", "rules");
+  const rulesDir = join22(cwd, ".windsurf", "rules");
   mkdirSync14(rulesDir, { recursive: true });
   const content = [
     "---",
@@ -32213,21 +32605,21 @@ function ensureWindsurfRules(cwd) {
     skillBody(),
     ""
   ].join("\n");
-  return updateFile(join21(rulesDir, "glassbox.md"), content);
+  return updateFile(join22(rulesDir, "glassbox.md"), content);
 }
 function ensureSkills() {
   const cwd = process.cwd();
   const platforms = [];
-  if (existsSync17(join21(cwd, ".claude"))) {
+  if (existsSync17(join22(cwd, ".claude"))) {
     if (ensureClaudeSkills(cwd)) platforms.push("Claude Code");
   }
-  if (existsSync17(join21(cwd, ".cursor"))) {
+  if (existsSync17(join22(cwd, ".cursor"))) {
     if (ensureCursorRules(cwd)) platforms.push("Cursor");
   }
-  if (existsSync17(join21(cwd, ".github", "prompts")) || existsSync17(join21(cwd, ".github", "copilot-instructions.md"))) {
+  if (existsSync17(join22(cwd, ".github", "prompts")) || existsSync17(join22(cwd, ".github", "copilot-instructions.md"))) {
     if (ensureCopilotPrompts(cwd)) platforms.push("GitHub Copilot");
   }
-  if (existsSync17(join21(cwd, ".windsurf"))) {
+  if (existsSync17(join22(cwd, ".windsurf"))) {
     if (ensureWindsurfRules(cwd)) platforms.push("Windsurf");
   }
   return platforms;
@@ -32235,29 +32627,20 @@ function ensureSkills() {
 
 // src/update-check.ts
 init_zod();
+init_app_version();
 init_compareVersions();
-import { existsSync as existsSync18, mkdirSync as mkdirSync15, readFileSync as readFileSync21, writeFileSync as writeFileSync15 } from "fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync15, readFileSync as readFileSync22, writeFileSync as writeFileSync15 } from "fs";
 import { get } from "https";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname9, join as join22 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
-var DATA_DIR = join22(homedir2(), ".glassbox");
-var CHECK_FILE = join22(DATA_DIR, "last-update-check");
+import { join as join23 } from "path";
+var DATA_DIR = join23(homedir2(), ".glassbox");
+var CHECK_FILE = join23(DATA_DIR, "last-update-check");
 var PACKAGE_NAME = "glassbox";
-var VersionPayloadSchema = external_exports.object({ version: external_exports.string() });
-function getCurrentVersion() {
-  try {
-    const dir = dirname9(fileURLToPath4(import.meta.url));
-    const raw2 = JSON.parse(readFileSync21(join22(dir, "..", "package.json"), "utf-8"));
-    return VersionPayloadSchema.parse(raw2).version;
-  } catch {
-    return "0.0.0";
-  }
-}
+var VersionPayloadSchema2 = external_exports.object({ version: external_exports.string() });
 function getLastCheckDate() {
   try {
     if (existsSync18(CHECK_FILE)) {
-      return readFileSync21(CHECK_FILE, "utf-8").trim();
+      return readFileSync22(CHECK_FILE, "utf-8").trim();
     }
   } catch {
   }
@@ -32287,7 +32670,7 @@ function fetchLatestVersion() {
       res.on("end", () => {
         try {
           const raw2 = JSON.parse(data);
-          resolve13(VersionPayloadSchema.parse(raw2).version);
+          resolve13(VersionPayloadSchema2.parse(raw2).version);
         } catch {
           resolve13(null);
         }
@@ -32626,7 +33009,7 @@ async function main() {
     console.log("AI service test mode enabled \u2014 using mock AI responses");
   }
   if (debug) {
-    console.log(`[debug] Build timestamp: ${"2026-07-23T02:30:34.669Z"}`);
+    console.log(`[debug] Build timestamp: ${"2026-07-24T02:30:22.046Z"}`);
   }
   if (projectDir !== null) {
     if (!existsSync20(projectDir) || !statSync8(projectDir).isDirectory()) {
@@ -32636,7 +33019,7 @@ async function main() {
     process.chdir(projectDir);
   }
   if (dataDir === null) {
-    dataDir = join24(process.cwd(), ".glassbox");
+    dataDir = join25(process.cwd(), ".glassbox");
   }
   if (difftoolServe) {
     await runDifftoolServe(dataDir, port, { noOpen, strictPort, onComplete });
@@ -32652,7 +33035,7 @@ async function main() {
       }
       process.exit(1);
     }
-    dataDir = join24(tmpdir2(), `glassbox-demo-${demo}-${Date.now()}`);
+    dataDir = join25(tmpdir2(), `glassbox-demo-${demo}-${Date.now()}`);
     setDemoMode(demo);
     console.log(`
   DEMO MODE: ${scenario.label}