glimmervoid 0.32.0 → 0.32.1

package/dist/chunks/{main-DSbpYn2Y.js → main-BG6iHwoY.js}

@@ -2,7 +2,7 @@ import { i as sanitizeOneLine, n as requireExecutableSpawnHelper, r as firstLine
 import { a as isMissingFileError, i as errorText$1, r as errorMessage, t as errorCode } from "./text-DoirglWV.js";
 import { a as isPathInside, c as sanitizeWorktreeName, n as caseFoldedPathKey, o as isSameDirectoryPath, r as comparableDirectoryPath, s as safePathSegment, t as canonicalizePath } from "./paths-CeJl2Vcg.js";
 import { a as packageRoot, n as cliPath, o as relayPath, r as clientDir, s as resolvePackageBin, t as bundled } from "./runtime-paths-BPoxENmK.js";
-import { C as MERGEABLE_LIVE_STATES, S as KILLABLE_STATES, T as STATES, _ as TaskTitle, a as AgentDispatchRequest, c as ORCHESTRATOR_AGENT_VERBS, g as TASK_TITLE_CONTROL_CHARACTERS, n as AGENT_URL_ENV, p as RefinedTaskTitle, r as ASK_USER_QUESTION_TOOL_NAME, s as AgentTicketRequest, v as isSamePromptQuestion, w as RESTARTABLE_STATES, x as toolDetailLine } from "./session-B8fJb_Or.js";
+import { D as MERGEABLE_LIVE_STATES, E as KILLABLE_STATES, O as RESTARTABLE_STATES, S as isSamePromptQuestion, T as toolDetailLine, a as AgentDispatchRequest, b as TASK_TITLE_CONTROL_CHARACTERS, c as AgentTicketRequest, h as SESSION_DOC_BODY_CAP_BYTES, k as STATES, l as ORCHESTRATOR_AGENT_VERBS, m as RefinedTaskTitle, n as AGENT_URL_ENV, r as ASK_USER_QUESTION_TOOL_NAME, x as TaskTitle } from "./session-Dtkp9o3r.js";
 import { n as execFileAsync, o as spawn, r as execFileSync, t as execFile } from "./child-process-safe-DDELk9XC.js";
 import { n as glimmervoidHomeDir } from "./config-path-core-DFt-TemS.js";
 import { n as checkSandboxDependencies, t as allowSandboxedSpawn } from "./sandbox-deps-DuaNFq7n.js";
@@ -16,15 +16,15 @@ import { i as SANE_YOLO_FILES } from "./rtk-hook-core-BmEz2aq9.js";
 import { _ as lineStartOffsets, a as projectForUri, b as replacedSpanOfWholeTextChange, c as visionsLaneReloadSignature, d as applyDidOpen, f as createDocStore, g as lineOfOffset, h as getDoc, i as isUriInProjects, l as applyDidChange, m as formatRange, n as applyEditorNotification, o as resolveVisionsScopeProjects, p as detectBlankLineBoundary, r as createEditorState, s as scopePathsOf, t as ACTIVITY_METHOD, u as applyDidClose, v as listDocs, x as uriOfParams, y as offsetOfPosition } from "./ingest-editor-core-vR6Wv6bP.js";
 import { n as DEFAULT_MAX_MS, r as nextBackoffMs, t as DEFAULT_BASE_MS } from "./backoff-DjVpfHk7.js";
 import { n as unrefTimer, t as DEFAULT_TIMER_FNS } from "./timer-deps-u2DAQLok.js";
-import { a as decideTicketAction, i as decideSpawnAllowance, l as isOrchestratorAgentVerb, n as REFUSAL_REASON, o as deriveChildSessionName, r as decideAgentRequest, s as describePushLanding, t as PUSH_UNAVAILABLE_REASON, u as parseAgentVerb } from "./agent-api-core-B3YI8SYs.js";
-import { s as GLIMMERVOID_SECRET_KEYS } from "./grok-C4lzPFEg.js";
+import { a as decideTicketAction, i as decideSpawnAllowance, l as isOrchestratorAgentVerb, n as REFUSAL_REASON, o as deriveChildSessionName, r as decideAgentRequest, s as describePushLanding, t as PUSH_UNAVAILABLE_REASON, u as parseAgentVerb } from "./agent-api-core-DUiWHSHg.js";
+import { s as GLIMMERVOID_SECRET_KEYS } from "./grok-7Z5KcgcY.js";
 import { _ as isQueueAdmissionTimeout, a as jsonStateLoadError, c as loadedJsonValue, d as writeJsonAtomicSync, f as writeTextAtomic, g as createSpawnGate, h as createSerialQueue, i as createJsonStateWriter, m as createKeyedSerialQueue, n as appendJsonLines, o as loadJsonStateFile, p as writeTextAtomicSync, r as createJsonStateStore, s as loadJsonStateFileSync, t as appendJsonLine, u as writeJsonAtomic } from "./json-file-oEH9vt-0.js";
-import { $ as TeamReviewCompareFiles, A as MyPrSearchResponse, At as CoherenceWorkInspect, B as PostingPlan, C as MyPrMergeMethod, Ct as KEEP_MERGEABLE_TIMEOUT_MINUTES_RANGE, D as MyPrMergeWhenReadyRequest, E as MyPrMergeStateResponse, F as CommitSha, G as ReviewDraft, H as QueuedReview, I as DECIDING_REVIEW_STATES, J as ReviewThreadId, K as ReviewFinding, L as FindingSeverity, M as MyPrThreadsResponse, N as MyPrsState, Ot as CoherenceTicketCreated, P as MyPrsStatus, R as GithubReviewDecision, Tt as CoherenceOrient, U as ReviewChecksState, V as PrDetail, W as ReviewComment, X as SearchedPr, Y as ReviewVerdict, Z as TeamReviewActionRequest, _ as WorkflowSearchNode, a as ConfigUpdate, at as TeamReviewThreadsRepository, b as MyPrAutoRebase, bt as USAGE_COST_MODES, c as TASK_TITLE_SOURCE_PRIORITY, ct as hasStandingViewerApproval, d as BRANCH_GC_CONTROL_NUMERIC_KEYS, dt as shortSha$1, et as TeamReviewResolveResponse, ft as GH_SEGMENT, g as WorkflowLabelName, h as WorkflowCommentBody, ht as repoParts, it as TeamReviewThreadResult, j as MyPrThreadNode, k as MyPrSearchNode, kt as CoherenceWorkCreated, l as configIssueMessage, lt as FULL_SHA_RE, m as DEFAULT_FACTORY_PROTECTED_PATHS, mt as REPO_SLUG_RE, nt as TeamReviewStatus, o as PersistedTaskTitle, ot as canApproveAfterComment, p as DEFAULT_FACTORY_CHECKS, pt as NODE_ID_RE, q as ReviewResult, r as BrowserConfig, rt as TeamReviewThreadCommentsResponse, s as RUNTIME_CONFIG_SCALAR_KEYS, st as decisionAsIfApprovalRequired, tt as TeamReviewStateEntry, u as BRANCH_GC_CONTROL_BOOLEAN_KEYS, ut as HEX_SHA_RE, v as WorkflowsSettings, w as MyPrMergeRequest, wt as USAGE_INTEGER_RANGES, x as MyPrKeepMergeableRequest, xt as USAGE_VENDOR_KEYS, y as WorkflowsState, yt as USAGE_BUDGET_KEYS, z as GithubReviewState } from "./config-CZ4H51D0.js";
-import { $ as sessionIdFromBranch, A as snapshotEvents, B as classifySessionExit, C as createIngestStore, D as resolveIngestConfig, E as publishEvent, F as adapterBucket, G as nodeMajorVersion, H as decideRemoteTelemetryState, I as buildAiGenerationEvents, J as stableConfigKey, K as parsePosthogReleaseId, L as buildBrowserExceptionProperties, M as FIRST_RUN_NOTICE, N as TELEMETRY_BATCH_URL, O as ringStats, P as TELEMETRY_FLAGS_URL, Q as planWorktreeGc, R as buildExceptionProperties, S as buildContextDigest, T as latestSeq, U as decideTelemetryConsent, V as decideIsDevInstall, W as exceptionFingerprint, X as matchedPrefix, Y as DEFAULT_BRANCH_GC_PREFIXES, Z as planBranchGc, _ as INGEST_SPEC, a as ensureProjectIds, b as DEFAULT_DIGEST_BUDGET_CHARS, d as assetForPlatform, et as usablePrefixes, f as decideRtkInstall, g as verifyDigest, h as isRtkBinaryName, i as createConfigStore, j as localDayKey, k as scrubText, m as installTargetPath, n as DEFAULT_CONFIG, o as generateProjectId, p as findEscapingArchiveMember, q as resolveProjectToken, s as glimmervoidHomeDir$1, t as ABORT_CONFIG_SAVE, tt as worktreeIntegrationTips, v as mergeSettingsBlock, w as enabledSourceNames, x as SOURCE_DEFAULTS, y as validateSettingsBlock, z as buildFactoryDecisionEvent } from "./config-store-BVtdHkDK.js";
-import { $ as FactoryHarnessVerdict, A as BenchmarkActionRequest, B as PrCheckoutCaseInput, C as IssueKey, D as IssuesStatus, E as IssuesState, F as BenchmarkStatus, G as TelemetryState, H as PendingCrashReport, I as BenchmarkSuite, J as FACTORY_ERROR_MAX_CHARS, K as FACTORY_DECISION_OUTPUT_MAX_BYTES, L as CommitComparison, M as BenchmarkId, N as BenchmarkJudgement, O as ChangeMap, P as BenchmarkRun, Q as FactoryHarnessStateLine, R as MergedPrListing, S as GithubIssueResponse, T as IssuesSearchResponse, U as TELEMETRY_EVENT_SCHEMAS, X as FactoryConsequences, Y as FACTORY_PROTECTED_PATH_FLOOR, Z as FactoryControlRequest, _ as PlanDecision, a as ClientMessage, at as FactoryQueueIntentRequest, b as planTitle, c as UpdateJournal, ct as FactoryWorkerEvent, d as TraceRecord, et as FactoryHogQLResponse, f as PLAN_BODY_CAP_BYTES, g as PLAN_TOOL_NAME, h as PLAN_RESULT_HOOK_EVENT, i as CONTROL_FRAME_MAX_BYTES, it as FactoryProjectState, j as BenchmarkCase, k as changeMapFactId, l as MAX_RAW_LINE_CHARS, lt as isSingleFactoryPathSegment, m as PLAN_HOOK_OUTPUT_MAX_CHARS, n as HookEnvelope, nt as FactoryIssueQueryRow, o as DIFF_ANNOTATION_NOTE_MAX_CHARS, ot as FactoryReviewVerdict, p as PLAN_HOOK_EVENT, q as FactoryDecisionLogLine, r as parseDataClientMessage, rt as FactoryLaneState, s as InstallFlavor, st as FactoryReviewerOutput, t as HTTP_URL_RE, tt as FactoryIssue, u as TraceCheckpoint, v as PlanRevision, w as IssueUpdate, x as GithubIssuePullRequestsRepository, y as parseExitPlanModeHookPayload, z as MinedPrReviewData } from "./contracts-DXujp-Zn.js";
-import { a as describeAgentResolvability, c as isKnownAgentId, d as setCustomAgents, f as claudeCode, i as customAgentFingerprint, l as listAgentIds, n as cachedAgentResolvability, o as getAdapter, r as commandFor, s as hookProfileOf, t as DEFAULT_AGENT_ID, u as resolveAdapter } from "./adapters-CoC18rdt.js";
+import { $ as TeamReviewCompareFiles, A as MyPrSearchResponse, At as CoherenceWorkInspect, B as PostingPlan, C as MyPrMergeMethod, Ct as KEEP_MERGEABLE_TIMEOUT_MINUTES_RANGE, D as MyPrMergeWhenReadyRequest, E as MyPrMergeStateResponse, F as CommitSha, G as ReviewDraft, H as QueuedReview, I as DECIDING_REVIEW_STATES, J as ReviewThreadId, K as ReviewFinding, L as FindingSeverity, M as MyPrThreadsResponse, N as MyPrsState, Ot as CoherenceTicketCreated, P as MyPrsStatus, R as GithubReviewDecision, Tt as CoherenceOrient, U as ReviewChecksState, V as PrDetail, W as ReviewComment, X as SearchedPr, Y as ReviewVerdict, Z as TeamReviewActionRequest, _ as WorkflowSearchNode, a as ConfigUpdate, at as TeamReviewThreadsRepository, b as MyPrAutoRebase, bt as USAGE_COST_MODES, c as TASK_TITLE_SOURCE_PRIORITY, ct as hasStandingViewerApproval, d as BRANCH_GC_CONTROL_NUMERIC_KEYS, dt as shortSha$1, et as TeamReviewResolveResponse, ft as GH_SEGMENT, g as WorkflowLabelName, h as WorkflowCommentBody, ht as repoParts, it as TeamReviewThreadResult, j as MyPrThreadNode, k as MyPrSearchNode, kt as CoherenceWorkCreated, l as configIssueMessage, lt as FULL_SHA_RE, m as DEFAULT_FACTORY_PROTECTED_PATHS, mt as REPO_SLUG_RE, nt as TeamReviewStatus, o as PersistedTaskTitle, ot as canApproveAfterComment, p as DEFAULT_FACTORY_CHECKS, pt as NODE_ID_RE, q as ReviewResult, r as BrowserConfig, rt as TeamReviewThreadCommentsResponse, s as RUNTIME_CONFIG_SCALAR_KEYS, st as decisionAsIfApprovalRequired, tt as TeamReviewStateEntry, u as BRANCH_GC_CONTROL_BOOLEAN_KEYS, ut as HEX_SHA_RE, v as WorkflowsSettings, w as MyPrMergeRequest, wt as USAGE_INTEGER_RANGES, x as MyPrKeepMergeableRequest, xt as USAGE_VENDOR_KEYS, y as WorkflowsState, yt as USAGE_BUDGET_KEYS, z as GithubReviewState } from "./config-B6BkTOcE.js";
+import { $ as sessionIdFromBranch, A as snapshotEvents, B as classifySessionExit, C as createIngestStore, D as resolveIngestConfig, E as publishEvent, F as adapterBucket, G as nodeMajorVersion, H as decideRemoteTelemetryState, I as buildAiGenerationEvents, J as stableConfigKey, K as parsePosthogReleaseId, L as buildBrowserExceptionProperties, M as FIRST_RUN_NOTICE, N as TELEMETRY_BATCH_URL, O as ringStats, P as TELEMETRY_FLAGS_URL, Q as planWorktreeGc, R as buildExceptionProperties, S as buildContextDigest, T as latestSeq, U as decideTelemetryConsent, V as decideIsDevInstall, W as exceptionFingerprint, X as matchedPrefix, Y as DEFAULT_BRANCH_GC_PREFIXES, Z as planBranchGc, _ as INGEST_SPEC, a as ensureProjectIds, b as DEFAULT_DIGEST_BUDGET_CHARS, d as assetForPlatform, et as usablePrefixes, f as decideRtkInstall, g as verifyDigest, h as isRtkBinaryName, i as createConfigStore, j as localDayKey, k as scrubText, m as installTargetPath, n as DEFAULT_CONFIG, o as generateProjectId, p as findEscapingArchiveMember, q as resolveProjectToken, s as glimmervoidHomeDir$1, t as ABORT_CONFIG_SAVE, tt as worktreeIntegrationTips, v as mergeSettingsBlock, w as enabledSourceNames, x as SOURCE_DEFAULTS, y as validateSettingsBlock, z as buildFactoryDecisionEvent } from "./config-store-aZpWeX92.js";
+import { $ as FactoryHarnessVerdict, A as BenchmarkActionRequest, B as PrCheckoutCaseInput, C as IssueKey, D as IssuesStatus, E as IssuesState, F as BenchmarkStatus, G as TelemetryState, H as PendingCrashReport, I as BenchmarkSuite, J as FACTORY_ERROR_MAX_CHARS, K as FACTORY_DECISION_OUTPUT_MAX_BYTES, L as CommitComparison, M as BenchmarkId, N as BenchmarkJudgement, O as ChangeMap, P as BenchmarkRun, Q as FactoryHarnessStateLine, R as MergedPrListing, S as GithubIssueResponse, T as IssuesSearchResponse, U as TELEMETRY_EVENT_SCHEMAS, X as FactoryConsequences, Y as FACTORY_PROTECTED_PATH_FLOOR, Z as FactoryControlRequest, _ as PlanDecision, a as ClientMessage, at as FactoryQueueIntentRequest, b as planTitle, c as UpdateJournal, ct as FactoryWorkerEvent, d as TraceRecord, et as FactoryHogQLResponse, f as PLAN_BODY_CAP_BYTES, g as PLAN_TOOL_NAME, h as PLAN_RESULT_HOOK_EVENT, i as CONTROL_FRAME_MAX_BYTES, it as FactoryProjectState, j as BenchmarkCase, k as changeMapFactId, l as MAX_RAW_LINE_CHARS, lt as isSingleFactoryPathSegment, m as PLAN_HOOK_OUTPUT_MAX_CHARS, n as HookEnvelope, nt as FactoryIssueQueryRow, o as DIFF_ANNOTATION_NOTE_MAX_CHARS, ot as FactoryReviewVerdict, p as PLAN_HOOK_EVENT, q as FactoryDecisionLogLine, r as parseDataClientMessage, rt as FactoryLaneState, s as InstallFlavor, st as FactoryReviewerOutput, t as HTTP_URL_RE, tt as FactoryIssue, u as TraceCheckpoint, v as PlanRevision, w as IssueUpdate, x as GithubIssuePullRequestsRepository, y as parseExitPlanModeHookPayload, z as MinedPrReviewData } from "./contracts-DzDg-Z9I.js";
+import { a as describeAgentResolvability, c as isKnownAgentId, d as setCustomAgents, f as claudeCode, i as customAgentFingerprint, l as listAgentIds, n as cachedAgentResolvability, o as getAdapter, r as commandFor, s as hookProfileOf, t as DEFAULT_AGENT_ID, u as resolveAdapter } from "./adapters-BS_7o8fj.js";
 import { t as HOOK_TOOLS } from "./hook-tools-UX2fmt81.js";
-import { a as configSiblingPath, c as defaultPairingsPath, d as decideDeviceAuth, f as deviceNameFromUserAgent, l as defaultSeenPath, n as normalizeRemoteConfig, o as createPairingsStore, p as hashSecret, r as validateRemoteConfig, s as createSeenStore, t as decideBindHost, u as DEFAULT_DEVICE_MAX_AGE_MS } from "./remote-config-DP44Ybt9.js";
+import { a as configSiblingPath, c as defaultPairingsPath, d as decideDeviceAuth, f as deviceNameFromUserAgent, l as defaultSeenPath, n as normalizeRemoteConfig, o as createPairingsStore, p as hashSecret, r as validateRemoteConfig, s as createSeenStore, t as decideBindHost, u as DEFAULT_DEVICE_MAX_AGE_MS } from "./remote-config-Da4C7tMG.js";
 import { _ as escapeMarkup, g as createLaneLog, n as createVisionsSetup } from "./visions-setup-CfgNHiG3.js";
 import { t as getRtkPath } from "./rtk-resolver-jJxy_Mrt.js";
 import { createRequire } from "node:module";
@@ -2019,7 +2019,7 @@ function judgeRole({ vendor, cwd, hookPort, readablePaths, agentSessionId }) {
 		readableWithinDenied: [...readablePaths]
 	};
 }
-function workRole({ vendor, cwd, checkout, readablePaths, agentSessionId }) {
+function workRole({ vendor, cwd, checkout, readablePaths, writablePaths = [], agentSessionId }) {
 	return {
 		vendors: [vendor],
 		vendorHome: {
@@ -2028,7 +2028,7 @@ function workRole({ vendor, cwd, checkout, readablePaths, agentSessionId }) {
 			agentSessionId
 		},
 		network: { access: "open" },
-		writableRoots: [],
+		writableRoots: [...writablePaths],
 		lockedCheckouts: [checkout],
 		commitCheckouts: [],
 		readDenied: [],
@@ -2218,7 +2218,7 @@ function registerEphemeralSession({ map, id, sess, closeSessionDataClients, logP
 //#region server/agent-api-wiring.ts
 var AGENT_LANE_TAG = "agent-spawn";
 var SPAWN_FAILED_MESSAGE = "could not spawn the session";
-function createAgentApiWiring({ config, agentSessions, listAllSessions, listBoardSessions, makeSession, wireSessionEvents, closeSessionDataClients, broadcastControl, spawnGate, recordLane = null, logger = console }) {
+function createAgentApiWiring({ config, agentSessions, listAllSessions, listBoardSessions, makeSession, wireSessionEvents, closeSessionDataClients, broadcastControl, spawnGate, sessionDocs, recordLane = null, logger = console }) {
 	async function spawn(parent, request) {
 		const budget = parent.agentSpawnBudget();
 		const allowance = decideSpawnAllowance(budget);
@@ -2364,6 +2364,21 @@ function createAgentApiWiring({ config, agentSessions, listAllSessions, listBoar
 				body: reply
 			};
 		}
+		if (parsed.verb === "edit") {
+			const reply = await sessionDocs.surface(session, parsed.request);
+			if (!reply.ok) return {
+				status: 400,
+				body: reply
+			};
+			return {
+				status: 200,
+				body: {
+					ok: true,
+					path: reply.doc.path,
+					name: reply.doc.name
+				}
+			};
+		}
 		const outcome = await spawn(session, parsed.request);
 		if (!outcome.ok) return {
 			status: outcome.status,
@@ -4965,12 +4980,6 @@ var FINDING_HEADER_SOURCE = String.raw`\*\*(?:\[([^\]\n]+)\]\s+)?(${SEVERITY_ALT
 function findingHeader$1(reviewer, severity) {
 	return `**[${reviewer}] ${severity}**`;
 }
-function findingSeveritiesIn(body) {
-	return [...body.matchAll(new RegExp(FINDING_HEADER_SOURCE, "g"))].flatMap((match) => {
-		const severity = FindingSeverity.safeParse(match[2]);
-		return severity.success ? [severity.data] : [];
-	});
-}
 function parseLeadingFindingHeader(body) {
 	const match = new RegExp(String.raw`^${FINDING_HEADER_SOURCE}\s*(?:\r?\n|$)`).exec(body);
 	if (!match) return null;
@@ -7085,10 +7094,49 @@ function isCommentable(comment, commentable) {
 	if (commentable === null) return true;
 	return isLineCommentable(commentable, comment.path, comment.side, comment.line);
 }
-function renderPostingPlan(plan, commentable) {
+function locationKey$1(location) {
+	return `${location.path}:${location.line}:${location.side}`;
+}
+function lineKey(location) {
+	return `${location.path}:${location.line}`;
+}
+function keepStrongestFinding(strongestByLocation, location, finding) {
+	const strongest = strongestByLocation.get(location);
+	if (strongest && FindingSeverity.options.indexOf(strongest.severity) <= FindingSeverity.options.indexOf(finding.severity)) return;
+	strongestByLocation.set(location, finding);
+}
+function strongestFindingByLocation(findings) {
+	const strongestByLocation = /* @__PURE__ */ new Map();
+	for (const finding of findings) {
+		if (finding.line === null) continue;
+		keepStrongestFinding(strongestByLocation, locationKey$1({
+			path: finding.path,
+			line: finding.line,
+			side: finding.side
+		}), finding);
+		keepStrongestFinding(strongestByLocation, lineKey({
+			path: finding.path,
+			line: finding.line
+		}), finding);
+	}
+	return strongestByLocation;
+}
+function labeledComment(comment, finding) {
+	if (!finding) return comment;
+	const content = withoutAutomatedNote(comment.body);
+	const agentHeader = parseLeadingFindingHeader(content);
+	const commentText = agentHeader ? content.slice(agentHeader.length).trim() : content;
+	return {
+		...comment,
+		body: `${findingHeader(finding)}\n\n${commentText}`
+	};
+}
+function renderPostingPlan(plan, findings, commentable) {
 	const comments = [];
 	const foldedSections = [];
-	for (const comment of plan.comments) {
+	const findingAtLocation = strongestFindingByLocation(findings);
+	for (const plannedComment of plan.comments) {
+		const comment = labeledComment(plannedComment, findingAtLocation.get(locationKey$1(plannedComment)) ?? findingAtLocation.get(lineKey(plannedComment)));
 		if (isCommentable(comment, commentable)) {
 			comments.push({
 				...comment,
@@ -7104,23 +7152,7 @@ function renderPostingPlan(plan, commentable) {
 	};
 }
 function readyDraft({ candidate, tier, reasons, result, reviewedBase, commentable = null, posting = null }) {
-	const rendered = posting ? renderPostingPlan(posting, commentable) : renderReview(result, commentable);
-	const severityByLocation = /* @__PURE__ */ new Map();
-	for (const finding of result.findings) {
-		if (finding.line === null) continue;
-		const location = `${finding.path}:${finding.line}:${finding.side}`;
-		const previousSeverity = severityByLocation.get(location);
-		if (previousSeverity && FindingSeverity.options.indexOf(previousSeverity) <= FindingSeverity.options.indexOf(finding.severity)) continue;
-		severityByLocation.set(location, finding.severity);
-	}
-	const comments = rendered.comments.map((comment) => {
-		if (findingSeveritiesIn(comment.body).length > 0) return comment;
-		const severity = severityByLocation.get(`${comment.path}:${comment.line}:${comment.side}`);
-		return severity ? {
-			...comment,
-			severity
-		} : comment;
-	});
+	const rendered = posting ? renderPostingPlan(posting, result.findings, commentable) : renderReview(result, commentable);
 	return {
 		...draftBase(candidate, tier, reasons, result.head),
 		...reviewedBase ? { reviewedBase } : {},
@@ -7128,7 +7160,7 @@ function readyDraft({ candidate, tier, reasons, result, reviewedBase, commentabl
 		summary: result.summary,
 		...result.assessment ? { assessment: result.assessment } : {},
 		body: rendered.body,
-		comments,
+		comments: rendered.comments,
 		status: "ready"
 	};
 }
@@ -7295,10 +7327,13 @@ function buildReviewPrompt({ candidate, detail, tier, reasons, checkoutPath, rep
 		`- commit_id must be exactly ${head}.`,
 		"- comments holds one entry per finding anchored to a line of the diff; each path is non-empty, each line is a",
 		`  positive integer on that side of the diff, side is one of ${sides}, and each body is non-empty.`,
-		"- body holds only the findings that cannot anchor to a diff line, one short bullet each: `path:line`, the problem,",
-		"  the fix. Nothing else: no summary, no recap of the change, no praise, no verdict or its reasoning, no follow-up",
-		"  preamble, no list of what was checked or could not be run. With every finding inline, body is the empty string.",
-		"- Keep each comment to the problem and the fix, in a few sentences. Glimmervoid marks the review as automated itself.",
+		"- body holds only the findings that cannot anchor to a diff line, one short bullet each, in the form",
+		"  - **[<reviewer>] <severity>** `path:line`: the problem and the fix",
+		"  with the reviewer and severity that finding has in the report.",
+		"  Nothing else: no summary, no recap of the change, no praise, no verdict or its reasoning, no follow-up preamble,",
+		"  no list of what was checked or could not be run. With every finding inline, body is the empty string.",
+		"- Keep each comment to the problem and the fix, in a few sentences, with no label or heading. Glimmervoid marks the",
+		"  review as automated and labels each comment with its finding's reviewer and severity itself.",
 		"If this file is missing or invalid, Glimmervoid renders the draft from the report findings instead.",
 		"",
 		"Untrusted data:",
@@ -11847,9 +11882,358 @@ function createSessionOutput(options) {
 	};
 }
 //#endregion
+//#region server/core/ingest-shell-core.ts
+var SOURCE$4 = "shellHistory";
+var SHELLS = Object.freeze([
+	"powershell",
+	"fish",
+	"bash",
+	"zsh"
+]);
+var ZERO_SETUP_SHELLS = Object.freeze(["powershell", "fish"]);
+var ZERO_SETUP_SHELLS_ON_MACOS = Object.freeze(["zsh", "fish"]);
+var PSREADLINE_SUFFIX = "_history.txt";
+var MAX_COMMAND_CHARS = 4e3;
+var TRIVIAL_COMMANDS = /* @__PURE__ */ new Set([
+	"",
+	"l",
+	"ls",
+	"ll",
+	"la",
+	"dir",
+	"cd",
+	"cd ..",
+	"cd -",
+	"cd ~",
+	"cd /",
+	"pwd",
+	"cls",
+	"clear",
+	"exit",
+	"q",
+	"history"
+]);
+function defaultShellsFor(platform) {
+	return platform === "darwin" ? ZERO_SETUP_SHELLS_ON_MACOS : ZERO_SETUP_SHELLS;
+}
+function normalizeShells(raw, platform) {
+	if (!Array.isArray(raw) || raw.length === 0) return {
+		shells: [...defaultShellsFor(platform)],
+		rejected: []
+	};
+	const shells = [];
+	const rejected = [];
+	for (const entry of raw) {
+		const name = typeof entry === "string" ? entry.trim().toLowerCase() : "";
+		const shell = name === "pwsh" || name === "powershell.exe" ? "powershell" : name;
+		if (SHELLS.includes(shell)) {
+			if (!shells.includes(shell)) shells.push(shell);
+			continue;
+		}
+		const label = typeof entry === "string" ? entry.trim() : String(entry);
+		if (rejected.includes(label)) continue;
+		rejected.push(label);
+	}
+	return {
+		shells,
+		rejected
+	};
+}
+function resolveHomeDir(env, homeDir) {
+	return rawTextOr(env?.HOME, null) || rawTextOr(env?.USERPROFILE, null) || homeDir;
+}
+function dataHome(env, homeDir) {
+	return rawTextOr(env?.XDG_DATA_HOME, null) || path.join(resolveHomeDir(env, homeDir), ".local", "share");
+}
+function configHome(env, homeDir) {
+	return rawTextOr(env?.XDG_CONFIG_HOME, null) || path.join(resolveHomeDir(env, homeDir), ".config");
+}
+function powershellLocations(env, platform, homeDir) {
+	if (platform === "win32") {
+		const appData = rawTextOr(env?.APPDATA, null) || path.join(resolveHomeDir(env, homeDir), "AppData", "Roaming");
+		return [{
+			shell: "powershell",
+			dir: path.join(appData, "Microsoft", "Windows", "PowerShell", "PSReadLine"),
+			suffix: PSREADLINE_SUFFIX,
+			name: null
+		}];
+	}
+	return [{
+		shell: "powershell",
+		dir: path.join(dataHome(env, homeDir), "powershell", "PSReadLine"),
+		suffix: PSREADLINE_SUFFIX,
+		name: null
+	}];
+}
+function fishLocations(env, homeDir) {
+	return [{
+		shell: "fish",
+		dir: path.join(dataHome(env, homeDir), "fish"),
+		suffix: null,
+		name: "fish_history"
+	}, {
+		shell: "fish",
+		dir: path.join(configHome(env, homeDir), "fish"),
+		suffix: null,
+		name: "fish_history"
+	}];
+}
+function fileLocation(shell, filePath) {
+	return {
+		shell,
+		dir: path.dirname(filePath),
+		suffix: null,
+		name: path.basename(filePath)
+	};
+}
+function histFileLocation(wanted, env) {
+	const posixShells = wanted.filter((shell) => shell === "bash" || shell === "zsh");
+	if (posixShells.length !== 1) return [];
+	const histFile = rawTextOr(env?.HISTFILE, null);
+	if (!histFile) return [];
+	return [fileLocation(posixShells[0], histFile)];
+}
+function defaultHistFiles(shell, env, homeDir) {
+	const home = resolveHomeDir(env, homeDir);
+	if (shell === "bash") return [fileLocation("bash", path.join(home, ".bash_history"))];
+	return [fileLocation("zsh", path.join(home, ".zsh_history")), fileLocation("zsh", path.join(home, ".histfile"))];
+}
+function locationKey(location) {
+	return `${path.resolve(location.dir)}|${location.name || location.suffix}`;
+}
+function historyLocations({ shells = null, env = {}, platform = process.platform, homeDir = null } = {}) {
+	const wanted = normalizeShells(shells, platform).shells;
+	const locations = [...histFileLocation(wanted, env)];
+	for (const shell of wanted) {
+		if (shell === "powershell") locations.push(...powershellLocations(env, platform, homeDir));
+		if (shell === "fish") locations.push(...fishLocations(env, homeDir));
+		if (shell === "bash" || shell === "zsh") locations.push(...defaultHistFiles(shell, env, homeDir));
+	}
+	const seen = /* @__PURE__ */ new Set();
+	const deduped = [];
+	for (const location of locations) {
+		const key = locationKey(location);
+		if (seen.has(key)) continue;
+		seen.add(key);
+		deduped.push(location);
+	}
+	return deduped;
+}
+function matchesLocation(location, filename) {
+	if (typeof filename !== "string" || !filename) return false;
+	if (location?.name) return filename === location.name;
+	const suffix = location?.suffix;
+	if (!suffix) return false;
+	if (filename.length <= suffix.length) return false;
+	return filename.toLowerCase().endsWith(suffix.toLowerCase());
+}
+function createParseState() {
+	return {
+		pending: [],
+		pendingTs: null,
+		entry: null
+	};
+}
+function withinContinuationBounds(pending) {
+	if (pending.length >= 64) return false;
+	let chars = 0;
+	for (const line of pending) chars += line.length + 1;
+	return chars < MAX_COMMAND_CHARS;
+}
+function parsePowershell(lines, state) {
+	const commands = [];
+	let pending = state.pending;
+	for (const line of lines) {
+		const continued = line.endsWith("`");
+		pending = [...pending, continued ? line.slice(0, -1) : line];
+		if (continued && withinContinuationBounds(pending)) continue;
+		commands.push({
+			text: pending.join("\n"),
+			ts: null
+		});
+		pending = [];
+	}
+	return {
+		commands,
+		state: {
+			...state,
+			pending
+		}
+	};
+}
+var FISH_ENTRY = /^- cmd:\s?([\s\S]*)$/;
+var FISH_WHEN = /^\s+when:\s*(\d+)/;
+function unescapeFish(text) {
+	let out = "";
+	for (let index = 0; index < text.length; index += 1) {
+		const char = text[index];
+		if (char !== "\\") {
+			out += char;
+			continue;
+		}
+		const next = text[index + 1];
+		if (next === "n") {
+			out += "\n";
+			index += 1;
+			continue;
+		}
+		if (next === "\\") {
+			out += "\\";
+			index += 1;
+			continue;
+		}
+		out += char;
+	}
+	return out;
+}
+function parseFish(lines, state) {
+	const commands = [];
+	let entry = state.entry;
+	for (const line of lines) {
+		const started = FISH_ENTRY.exec(line);
+		if (started) {
+			if (entry) commands.push(entry);
+			entry = {
+				text: unescapeFish(started[1]),
+				ts: null
+			};
+			continue;
+		}
+		if (!entry) continue;
+		const when = FISH_WHEN.exec(line);
+		if (!when) continue;
+		commands.push({
+			text: entry.text,
+			ts: Number(when[1]) * 1e3
+		});
+		entry = null;
+	}
+	return {
+		commands,
+		state: {
+			...state,
+			entry
+		}
+	};
+}
+var BASH_TIMESTAMP = /^#(\d{9,})\s*$/;
+function parseBash(lines, state) {
+	const commands = [];
+	let pendingTs = state.pendingTs;
+	for (const line of lines) {
+		const stamped = BASH_TIMESTAMP.exec(line);
+		if (stamped) {
+			pendingTs = Number(stamped[1]) * 1e3;
+			continue;
+		}
+		if (!line.trim()) continue;
+		commands.push({
+			text: line,
+			ts: pendingTs
+		});
+		pendingTs = null;
+	}
+	return {
+		commands,
+		state: {
+			...state,
+			pendingTs
+		}
+	};
+}
+var ZSH_EXTENDED = /^:\s(\d+):(\d+);([\s\S]*)$/;
+function parseZsh(lines, state) {
+	const commands = [];
+	let pending = state.pending;
+	let pendingTs = state.pendingTs;
+	for (const line of lines) {
+		const starting = pending.length === 0;
+		const extended = starting ? ZSH_EXTENDED.exec(line) : null;
+		if (starting) pendingTs = extended ? Number(extended[1]) * 1e3 : null;
+		const text = extended ? extended[3] : line;
+		const continued = text.endsWith("\\");
+		pending = [...pending, continued ? text.slice(0, -1) : text];
+		if (continued && withinContinuationBounds(pending)) continue;
+		const joined = pending.join("\n");
+		pending = [];
+		if (joined.trim()) commands.push({
+			text: joined,
+			ts: pendingTs
+		});
+		pendingTs = null;
+	}
+	return {
+		commands,
+		state: {
+			...state,
+			pending,
+			pendingTs
+		}
+	};
+}
+var PARSERS = Object.freeze({
+	powershell: parsePowershell,
+	fish: parseFish,
+	bash: parseBash,
+	zsh: parseZsh
+});
+function parseHistoryLines({ shell, lines = [], state = null } = {}) {
+	const current = state || createParseState();
+	const parser = shell ? PARSERS[shell] : void 0;
+	if (!parser || !Array.isArray(lines) || lines.length === 0) return {
+		commands: [],
+		state: current
+	};
+	return parser(lines, current);
+}
+function foldForCompare(text) {
+	return String(text == null ? "" : text).replace(/\s+/g, " ").trim();
+}
+function isTrivialCommand(text) {
+	if (typeof text !== "string") return true;
+	return TRIVIAL_COMMANDS.has(text.trim().toLowerCase());
+}
+function decideCommandEvent({ shell = "", command = null, previous = null, now = 0 } = {}) {
+	const text = typeof command?.text === "string" ? command.text : "";
+	const compared = foldForCompare(text);
+	if (!compared) return {
+		event: null,
+		previous
+	};
+	if (isTrivialCommand(compared)) return {
+		event: null,
+		previous: compared
+	};
+	if (compared === previous) return {
+		event: null,
+		previous: compared
+	};
+	const stamped = Number(command?.ts);
+	const lineCount = text.split("\n").length;
+	return {
+		event: {
+			source: SOURCE$4,
+			kind: "command",
+			ts: Number.isFinite(stamped) && stamped > 0 ? Math.floor(stamped) : now,
+			scope: {
+				root: null,
+				sessionId: null
+			},
+			summary: `${shell}: ${text}`,
+			detail: lineCount > 1 ? {
+				shell,
+				lines: lineCount
+			} : { shell }
+		},
+		previous: compared
+	};
+}
+//#endregion
 //#region server/hook-tools.ts
 var writtenHomes = /* @__PURE__ */ new Set();
 var warnedTools = /* @__PURE__ */ new Set();
+var ensuredDataDirs = /* @__PURE__ */ new Set();
+var RTK_DATA_FOLDER = "rtk";
 function saneYoloHomeDir() {
 	return path.join(glimmervoidHomeDir(os.homedir(), process.env), "sane-yolo");
 }
@@ -11872,6 +12256,37 @@ function writeSaneYoloPolicy(homeDir) {
 	}
 	writtenHomes.add(homeDir);
 }
+function rtkDataDir(platform = process.platform, env = process.env, homeDir = os.homedir()) {
+	if (platform === "darwin") return path.join(homeDir, "Library", "Application Support", RTK_DATA_FOLDER);
+	if (platform !== "linux") return null;
+	const dataHomeDir = dataHome(env, homeDir);
+	return path.isAbsolute(dataHomeDir) ? path.join(dataHomeDir, RTK_DATA_FOLDER) : null;
+}
+function ensureDataDir(dataDir) {
+	if (dataDir === null || ensuredDataDirs.has(dataDir)) return dataDir;
+	fs.mkdirSync(dataDir, { recursive: true });
+	ensuredDataDirs.add(dataDir);
+	return dataDir;
+}
+function rtkHookTool(binPath, warn) {
+	try {
+		const dataDir = ensureDataDir(rtkDataDir());
+		return dataDir === null ? {
+			id: "rtk",
+			binPath
+		} : {
+			id: "rtk",
+			binPath,
+			dataDir
+		};
+	} catch (error) {
+		warnOnce("rtkDataDir", `[rtk] The rtk data folder could not be created: ${String(error)}. Sandboxed sessions will run rtk without savings tracking.`, warn);
+		return {
+			id: "rtk",
+			binPath
+		};
+	}
+}
 function warnOnce(toolId, message, warn) {
 	if (warnedTools.has(toolId)) return;
 	warnedTools.add(toolId);
@@ -11881,10 +12296,7 @@ function resolveHookTools(config, { skipPermissions, warn = console.warn }) {
 	const hookTools = [];
 	if (config.rtk) {
 		const rtkPath = getRtkPath();
-		if (rtkPath) hookTools.push({
-			id: "rtk",
-			binPath: rtkPath
-		});
+		if (rtkPath) hookTools.push(rtkHookTool(rtkPath, warn));
 		if (!rtkPath) warnOnce("rtk", "[rtk] config.rtk is true, but no rtk binary was found. Sessions will spawn without rtk hooks.", warn);
 	}
 	if (config.saneYolo === false || !skipPermissions) return hookTools;
@@ -11940,6 +12352,10 @@ function createSessionHookLifecycle(options) {
 			...isSaneYoloActive ? [saneYoloHomeDir()] : []
 		];
 	}
+	function injectedWritablePaths(isSaneYoloActive) {
+		if (token === null) return [];
+		return injectedHookTools(isSaneYoloActive).flatMap((tool) => tool.dataDir === void 0 ? [] : [tool.dataDir]);
+	}
 	function cleanup() {
 		if (!token && !settingsHandle) return;
 		if (options.hookRouter) try {
@@ -12140,7 +12556,8 @@ function createSessionHookLifecycle(options) {
 		hasInjection: () => token !== null,
 		hasSettings: () => settingsHandle !== null,
 		isRequiredSandboxMissing: () => options.settingsSandbox !== null && settingsHandle === null,
-		injectedReadablePaths
+		injectedReadablePaths,
+		injectedWritablePaths
 	};
 }
 //#endregion
@@ -19618,13 +20035,14 @@ var Session = class extends EventEmitter {
 			cwd: this.effectiveCwd(),
 			hookPort: this._hooks.hasInjection() ? this._hooks.listenerPort() : null,
 			readablePaths: this._hooks.injectedReadablePaths(this._isSaneYoloActive),
+			writablePaths: this._hooks.injectedWritablePaths(this._isSaneYoloActive),
 			agentSessionId
 		});
 		if (!prepared.ok) throw new Error(prepared.reason);
 		this._disposeSandboxLaunch(this._sandboxLaunch);
 		this._sandboxLaunch = prepared.launch;
 		return {
-			...await prepared.launch.wrap(command.file, command.args),
+			...await prepared.launch.wrap(command.file, command.args, { hasTerminal: true }),
 			env: prepared.launch.env,
 			cwd: prepared.launch.cwd
 		};
@@ -20395,10 +20813,13 @@ async function prepareSandboxLaunch({ role, launchId, tempDir, enterDir }) {
 		return {
 			ok: true,
 			launch: {
-				wrap: async (file, args) => {
+				wrap: async (file, args, { hasTerminal }) => {
 					const rebuilt = await buildPlanFromCurrentDisk();
 					if (!rebuilt.ok) throw new Error(rebuilt.reason);
-					await writeJsonAtomic(policyPath, rebuilt.plan.policy);
+					await writeJsonAtomic(policyPath, {
+						...rebuilt.plan.policy,
+						allowPty: hasTerminal && rebuilt.plan.launcher === "open-network"
+					});
 					placeholderPathsAbsentAtWrap = await absentPaths(sandboxPlaceholderPaths(realRole));
 					await createMissingMountPoints(lockedClaudeMountPoints(realRole));
 					return {
@@ -23821,7 +24242,7 @@ var prepareSandboxedCheckRunner = async ({ scratchParent, writablePaths, readabl
 	const runCheck = async (argv, { timeout, signal, ...execOptions }) => {
 		const [checkCommand, ...checkArgs] = argv;
 		if (checkCommand === void 0) throw new Error("Factory check command is empty");
-		const wrapped = await launch.wrap(checkCommand, checkArgs);
+		const wrapped = await launch.wrap(checkCommand, checkArgs, { hasTerminal: false });
 		const timeoutSignal = AbortSignal.timeout(timeout);
 		try {
 			return await execFileAsync(wrapped.file, wrapped.args, {
@@ -25250,8 +25671,11 @@ async function existingRealPath(candidate) {
 		return null;
 	}
 }
-async function readableToolFolders(homeDir) {
-	return (await Promise.all(LANE_READABLE_HOME_FOLDERS.map((folder) => existingRealPath(path.join(homeDir, folder))))).filter((folder) => folder !== null);
+async function existingRealPaths(candidates) {
+	return (await Promise.all(candidates.filter((candidate) => path.isAbsolute(candidate)).map(existingRealPath))).filter((realPath) => realPath !== null);
+}
+function readableToolFolders(homeDir) {
+	return existingRealPaths(LANE_READABLE_HOME_FOLDERS.map((folder) => path.join(homeDir, folder)));
 }
 async function readLaneCommonGitDir(cwd) {
 	const { stdout } = await runHardenedGit([
@@ -25329,7 +25753,8 @@ async function resolveWorkLane(input, { hookToolConfig = {}, resolveSaneYoloHook
 					cwd: facts.cwd,
 					checkout,
 					agentSessionId: facts.agentSessionId,
-					readablePaths: [...facts.readablePaths, ...toolFolders]
+					readablePaths: [...facts.readablePaths, ...toolFolders],
+					writablePaths: await existingRealPaths(facts.writablePaths)
 				}),
 				launchId: facts.launchId
 			});
@@ -29948,7 +30373,7 @@ function pickStaleByMtime(entriesByKey, { maxTracked = 256 } = {}) {
 }
 //#endregion
 //#region server/core/ingest-agent-core.ts
-var SOURCE$3 = "agentLogs";
+var SOURCE$2 = "agentLogs";
 var MAX_RAW_CHARS = 4e3;
 var TOOL_TARGET_KEYS = Object.freeze([
 	"file_path",
@@ -30015,7 +30440,7 @@ function turnEvent({ ts, root, sessionId, vendor, text }) {
 	const summary = boundRaw(text).trim();
 	if (!summary) return null;
 	return {
-		source: SOURCE$3,
+		source: SOURCE$2,
 		kind: "agent-turn",
 		ts,
 		scope: {
@@ -30030,7 +30455,7 @@ function toolEvent({ ts, root, sessionId, vendor, name, target }) {
 	const tool = boundRaw(textOr(name, null) || "tool");
 	const suffix = target ? ` ${target}` : "";
 	return {
-		source: SOURCE$3,
+		source: SOURCE$2,
 		kind: "agent-tool",
 		ts,
 		scope: {
@@ -31824,353 +32249,6 @@ function createGitIngest({ publish, sourceConfig = {}, reposProvider = null, log
 	};
 }
 //#endregion
-//#region server/core/ingest-shell-core.ts
-var SOURCE$1 = "shellHistory";
-var SHELLS = Object.freeze([
-	"powershell",
-	"fish",
-	"bash",
-	"zsh"
-]);
-var ZERO_SETUP_SHELLS = Object.freeze(["powershell", "fish"]);
-var ZERO_SETUP_SHELLS_ON_MACOS = Object.freeze(["zsh", "fish"]);
-var PSREADLINE_SUFFIX = "_history.txt";
-var MAX_COMMAND_CHARS = 4e3;
-var TRIVIAL_COMMANDS = /* @__PURE__ */ new Set([
-	"",
-	"l",
-	"ls",
-	"ll",
-	"la",
-	"dir",
-	"cd",
-	"cd ..",
-	"cd -",
-	"cd ~",
-	"cd /",
-	"pwd",
-	"cls",
-	"clear",
-	"exit",
-	"q",
-	"history"
-]);
-function defaultShellsFor(platform) {
-	return platform === "darwin" ? ZERO_SETUP_SHELLS_ON_MACOS : ZERO_SETUP_SHELLS;
-}
-function normalizeShells(raw, platform) {
-	if (!Array.isArray(raw) || raw.length === 0) return {
-		shells: [...defaultShellsFor(platform)],
-		rejected: []
-	};
-	const shells = [];
-	const rejected = [];
-	for (const entry of raw) {
-		const name = typeof entry === "string" ? entry.trim().toLowerCase() : "";
-		const shell = name === "pwsh" || name === "powershell.exe" ? "powershell" : name;
-		if (SHELLS.includes(shell)) {
-			if (!shells.includes(shell)) shells.push(shell);
-			continue;
-		}
-		const label = typeof entry === "string" ? entry.trim() : String(entry);
-		if (rejected.includes(label)) continue;
-		rejected.push(label);
-	}
-	return {
-		shells,
-		rejected
-	};
-}
-function resolveHomeDir(env, homeDir) {
-	return rawTextOr(env?.HOME, null) || rawTextOr(env?.USERPROFILE, null) || homeDir;
-}
-function dataHome(env, homeDir) {
-	return rawTextOr(env?.XDG_DATA_HOME, null) || path.join(resolveHomeDir(env, homeDir), ".local", "share");
-}
-function configHome(env, homeDir) {
-	return rawTextOr(env?.XDG_CONFIG_HOME, null) || path.join(resolveHomeDir(env, homeDir), ".config");
-}
-function powershellLocations(env, platform, homeDir) {
-	if (platform === "win32") {
-		const appData = rawTextOr(env?.APPDATA, null) || path.join(resolveHomeDir(env, homeDir), "AppData", "Roaming");
-		return [{
-			shell: "powershell",
-			dir: path.join(appData, "Microsoft", "Windows", "PowerShell", "PSReadLine"),
-			suffix: PSREADLINE_SUFFIX,
-			name: null
-		}];
-	}
-	return [{
-		shell: "powershell",
-		dir: path.join(dataHome(env, homeDir), "powershell", "PSReadLine"),
-		suffix: PSREADLINE_SUFFIX,
-		name: null
-	}];
-}
-function fishLocations(env, homeDir) {
-	return [{
-		shell: "fish",
-		dir: path.join(dataHome(env, homeDir), "fish"),
-		suffix: null,
-		name: "fish_history"
-	}, {
-		shell: "fish",
-		dir: path.join(configHome(env, homeDir), "fish"),
-		suffix: null,
-		name: "fish_history"
-	}];
-}
-function fileLocation(shell, filePath) {
-	return {
-		shell,
-		dir: path.dirname(filePath),
-		suffix: null,
-		name: path.basename(filePath)
-	};
-}
-function histFileLocation(wanted, env) {
-	const posixShells = wanted.filter((shell) => shell === "bash" || shell === "zsh");
-	if (posixShells.length !== 1) return [];
-	const histFile = rawTextOr(env?.HISTFILE, null);
-	if (!histFile) return [];
-	return [fileLocation(posixShells[0], histFile)];
-}
-function defaultHistFiles(shell, env, homeDir) {
-	const home = resolveHomeDir(env, homeDir);
-	if (shell === "bash") return [fileLocation("bash", path.join(home, ".bash_history"))];
-	return [fileLocation("zsh", path.join(home, ".zsh_history")), fileLocation("zsh", path.join(home, ".histfile"))];
-}
-function locationKey(location) {
-	return `${path.resolve(location.dir)}|${location.name || location.suffix}`;
-}
-function historyLocations({ shells = null, env = {}, platform = process.platform, homeDir = null } = {}) {
-	const wanted = normalizeShells(shells, platform).shells;
-	const locations = [...histFileLocation(wanted, env)];
-	for (const shell of wanted) {
-		if (shell === "powershell") locations.push(...powershellLocations(env, platform, homeDir));
-		if (shell === "fish") locations.push(...fishLocations(env, homeDir));
-		if (shell === "bash" || shell === "zsh") locations.push(...defaultHistFiles(shell, env, homeDir));
-	}
-	const seen = /* @__PURE__ */ new Set();
-	const deduped = [];
-	for (const location of locations) {
-		const key = locationKey(location);
-		if (seen.has(key)) continue;
-		seen.add(key);
-		deduped.push(location);
-	}
-	return deduped;
-}
-function matchesLocation(location, filename) {
-	if (typeof filename !== "string" || !filename) return false;
-	if (location?.name) return filename === location.name;
-	const suffix = location?.suffix;
-	if (!suffix) return false;
-	if (filename.length <= suffix.length) return false;
-	return filename.toLowerCase().endsWith(suffix.toLowerCase());
-}
-function createParseState() {
-	return {
-		pending: [],
-		pendingTs: null,
-		entry: null
-	};
-}
-function withinContinuationBounds(pending) {
-	if (pending.length >= 64) return false;
-	let chars = 0;
-	for (const line of pending) chars += line.length + 1;
-	return chars < MAX_COMMAND_CHARS;
-}
-function parsePowershell(lines, state) {
-	const commands = [];
-	let pending = state.pending;
-	for (const line of lines) {
-		const continued = line.endsWith("`");
-		pending = [...pending, continued ? line.slice(0, -1) : line];
-		if (continued && withinContinuationBounds(pending)) continue;
-		commands.push({
-			text: pending.join("\n"),
-			ts: null
-		});
-		pending = [];
-	}
-	return {
-		commands,
-		state: {
-			...state,
-			pending
-		}
-	};
-}
-var FISH_ENTRY = /^- cmd:\s?([\s\S]*)$/;
-var FISH_WHEN = /^\s+when:\s*(\d+)/;
-function unescapeFish(text) {
-	let out = "";
-	for (let index = 0; index < text.length; index += 1) {
-		const char = text[index];
-		if (char !== "\\") {
-			out += char;
-			continue;
-		}
-		const next = text[index + 1];
-		if (next === "n") {
-			out += "\n";
-			index += 1;
-			continue;
-		}
-		if (next === "\\") {
-			out += "\\";
-			index += 1;
-			continue;
-		}
-		out += char;
-	}
-	return out;
-}
-function parseFish(lines, state) {
-	const commands = [];
-	let entry = state.entry;
-	for (const line of lines) {
-		const started = FISH_ENTRY.exec(line);
-		if (started) {
-			if (entry) commands.push(entry);
-			entry = {
-				text: unescapeFish(started[1]),
-				ts: null
-			};
-			continue;
-		}
-		if (!entry) continue;
-		const when = FISH_WHEN.exec(line);
-		if (!when) continue;
-		commands.push({
-			text: entry.text,
-			ts: Number(when[1]) * 1e3
-		});
-		entry = null;
-	}
-	return {
-		commands,
-		state: {
-			...state,
-			entry
-		}
-	};
-}
-var BASH_TIMESTAMP = /^#(\d{9,})\s*$/;
-function parseBash(lines, state) {
-	const commands = [];
-	let pendingTs = state.pendingTs;
-	for (const line of lines) {
-		const stamped = BASH_TIMESTAMP.exec(line);
-		if (stamped) {
-			pendingTs = Number(stamped[1]) * 1e3;
-			continue;
-		}
-		if (!line.trim()) continue;
-		commands.push({
-			text: line,
-			ts: pendingTs
-		});
-		pendingTs = null;
-	}
-	return {
-		commands,
-		state: {
-			...state,
-			pendingTs
-		}
-	};
-}
-var ZSH_EXTENDED = /^:\s(\d+):(\d+);([\s\S]*)$/;
-function parseZsh(lines, state) {
-	const commands = [];
-	let pending = state.pending;
-	let pendingTs = state.pendingTs;
-	for (const line of lines) {
-		const starting = pending.length === 0;
-		const extended = starting ? ZSH_EXTENDED.exec(line) : null;
-		if (starting) pendingTs = extended ? Number(extended[1]) * 1e3 : null;
-		const text = extended ? extended[3] : line;
-		const continued = text.endsWith("\\");
-		pending = [...pending, continued ? text.slice(0, -1) : text];
-		if (continued && withinContinuationBounds(pending)) continue;
-		const joined = pending.join("\n");
-		pending = [];
-		if (joined.trim()) commands.push({
-			text: joined,
-			ts: pendingTs
-		});
-		pendingTs = null;
-	}
-	return {
-		commands,
-		state: {
-			...state,
-			pending,
-			pendingTs
-		}
-	};
-}
-var PARSERS = Object.freeze({
-	powershell: parsePowershell,
-	fish: parseFish,
-	bash: parseBash,
-	zsh: parseZsh
-});
-function parseHistoryLines({ shell, lines = [], state = null } = {}) {
-	const current = state || createParseState();
-	const parser = shell ? PARSERS[shell] : void 0;
-	if (!parser || !Array.isArray(lines) || lines.length === 0) return {
-		commands: [],
-		state: current
-	};
-	return parser(lines, current);
-}
-function foldForCompare(text) {
-	return String(text == null ? "" : text).replace(/\s+/g, " ").trim();
-}
-function isTrivialCommand(text) {
-	if (typeof text !== "string") return true;
-	return TRIVIAL_COMMANDS.has(text.trim().toLowerCase());
-}
-function decideCommandEvent({ shell = "", command = null, previous = null, now = 0 } = {}) {
-	const text = typeof command?.text === "string" ? command.text : "";
-	const compared = foldForCompare(text);
-	if (!compared) return {
-		event: null,
-		previous
-	};
-	if (isTrivialCommand(compared)) return {
-		event: null,
-		previous: compared
-	};
-	if (compared === previous) return {
-		event: null,
-		previous: compared
-	};
-	const stamped = Number(command?.ts);
-	const lineCount = text.split("\n").length;
-	return {
-		event: {
-			source: SOURCE$1,
-			kind: "command",
-			ts: Number.isFinite(stamped) && stamped > 0 ? Math.floor(stamped) : now,
-			scope: {
-				root: null,
-				sessionId: null
-			},
-			summary: `${shell}: ${text}`,
-			detail: lineCount > 1 ? {
-				shell,
-				lines: lineCount
-			} : { shell }
-		},
-		previous: compared
-	};
-}
-//#endregion
 //#region server/ingest-shell-history.ts
 var DEFAULT_POLL_MS = 2e3;
 var DEFAULT_DISCOVER_MS = 3e4;
@@ -34117,7 +34195,7 @@ async function containedPathForMissingFile(candidate, realRoot) {
 		};
 	}
 }
-async function openContainedFile(candidate, root, allowsMissingFile = false) {
+async function openContainedFile(candidate, root, allowsMissingFile = false, opensForWriting = false) {
 	let realRoot;
 	try {
 		realRoot = await fs.promises.realpath(root);
@@ -34144,7 +34222,8 @@ async function openContainedFile(candidate, root, allowsMissingFile = false) {
 	};
 	let handle = null;
 	try {
-		handle = await fs.promises.open(realCandidate, fs.constants.O_RDONLY | fs.constants.O_NONBLOCK);
+		const accessFlag = opensForWriting ? fs.constants.O_RDWR : fs.constants.O_RDONLY;
+		handle = await fs.promises.open(realCandidate, accessFlag | fs.constants.O_NONBLOCK);
 		const stat = await handle.stat();
 		if (stat.isFile()) return {
 			ok: true,
@@ -47445,6 +47524,22 @@ function requestValidationErrorReply(msg, message) {
 			requestId,
 			ok: false,
 			error: message
+		}),
+		"session-doc-read": () => ({
+			type: "session-doc-response",
+			requestId,
+			id: typeof msg?.id === "string" ? msg.id : "",
+			path: typeof msg?.path === "string" ? msg.path : "",
+			ok: false,
+			error: message
+		}),
+		"session-doc-save": () => ({
+			type: "session-doc-save-result",
+			requestId,
+			id: typeof msg?.id === "string" ? msg.id : "",
+			path: typeof msg?.path === "string" ? msg.path : "",
+			ok: false,
+			error: message
 		})
 	};
 	const requestType = typeof msg?.type === "string" ? msg.type : "";
@@ -47475,7 +47570,7 @@ function parseSinceParam(url) {
 	return Number.isFinite(n) ? n : null;
 }
 function registerControlHandlers(controlWss, deps) {
-	const { sessions, agentSessions = /* @__PURE__ */ new Map(), config, configStore, broadcastControl, generateProjectId, applyConfigReload, applySettingsReload, requestShutdown, requestRestart, handleClientFocus, buildHealthSnapshot, getUpdateStatus, getUpdateJournal = null, checkNow = null, applyUpdate = null, isStaging = null, noteRestartRequested = null, getPosthogStatus, posthogReportsDir = null, posthogSetIssueStatus = null, posthogArchiveInvestigation = null, getTeamReviewStatus = null, getMyPrsStatus = null, getIssuesStatus = null, issues = null, teamReview = null, myPrs = null, getBenchmarkStatus = null, getFactoryState = null, benchmarks = null, factory = null, createGithubClient = createPrGh, issueProjectRepos = null, serverBuild = () => null, getUsageSessions = null, getUsageReport = null, requestUsageReport = null, getPlanLimits = null, controlReplayLog = null, getRtkInstallStatus = () => null, resolveRtkPath = () => getRtkPath(), conversationFs = fs, conversationGit = runGitForConversationHistory, conversationProjectsDir = claudeProjectsDir(process.env, os.homedir()), readTracePage = null, readPlanRevision = null, decidePlanReview = null, changeMapNarrator = null } = deps;
+	const { sessions, agentSessions = /* @__PURE__ */ new Map(), config, configStore, broadcastControl, generateProjectId, applyConfigReload, applySettingsReload, requestShutdown, requestRestart, handleClientFocus, buildHealthSnapshot, getUpdateStatus, getUpdateJournal = null, checkNow = null, applyUpdate = null, isStaging = null, noteRestartRequested = null, getPosthogStatus, posthogReportsDir = null, posthogSetIssueStatus = null, posthogArchiveInvestigation = null, getTeamReviewStatus = null, getMyPrsStatus = null, getIssuesStatus = null, issues = null, teamReview = null, myPrs = null, getBenchmarkStatus = null, getFactoryState = null, benchmarks = null, factory = null, createGithubClient = createPrGh, issueProjectRepos = null, serverBuild = () => null, getUsageSessions = null, getUsageReport = null, requestUsageReport = null, getPlanLimits = null, controlReplayLog = null, getRtkInstallStatus = () => null, resolveRtkPath = () => getRtkPath(), conversationFs = fs, conversationGit = runGitForConversationHistory, conversationProjectsDir = claudeProjectsDir(process.env, os.homedir()), readTracePage = null, readPlanRevision = null, decidePlanReview = null, sessionDocs = null, changeMapNarrator = null } = deps;
 	const changeMaps = createChangeMapService({
 		sessions,
 		narrator: changeMapNarrator,
@@ -48801,6 +48896,58 @@ function registerControlHandlers(controlWss, deps) {
 				message: refusal
 			}));
 		},
+		"session-doc-read": async (message, ws) => {
+			const reply = {
+				type: "session-doc-response",
+				requestId: message.requestId ?? null,
+				id: message.id,
+				path: message.path
+			};
+			const session = findSession(message);
+			if (!sessionDocs || !session) return ws.send(JSON.stringify({
+				...reply,
+				ok: false,
+				error: "Session not found"
+			}));
+			try {
+				ws.send(JSON.stringify({
+					...reply,
+					...await sessionDocs.read(session, message.path)
+				}));
+			} catch (error) {
+				ws.send(JSON.stringify({
+					...reply,
+					ok: false,
+					error: `Read failed: ${errorMessage(error)}`
+				}));
+			}
+		},
+		"session-doc-save": async (message, ws) => {
+			const reply = {
+				type: "session-doc-save-result",
+				requestId: message.requestId ?? null,
+				id: message.id,
+				path: message.path
+			};
+			const session = findSession(message);
+			if (!sessionDocs || !session) return ws.send(JSON.stringify({
+				...reply,
+				ok: false,
+				error: "Session not found"
+			}));
+			try {
+				ws.send(JSON.stringify({
+					...reply,
+					...await sessionDocs.save(session, message.path, message.text, message.baseHash)
+				}));
+			} catch (error) {
+				ws.send(JSON.stringify({
+					...reply,
+					ok: false,
+					error: `Save failed: ${errorMessage(error)}`
+				}));
+			}
+		},
 		"shutdown": handleShutdown,
 		"restart-server": handleRestart,
 		"update-check": handleUpdateCheck,
@@ -48950,6 +49097,7 @@ function createBackendControl(dependencies) {
 		readTracePage: dependencies.readTracePage,
 		readPlanRevision: dependencies.readPlanRevision,
 		decidePlanReview: dependencies.decidePlanReview,
+		sessionDocs: dependencies.sessionDocs,
 		changeMapNarrator: dependencies.changeMapNarrator
 	});
 	const sendLaneSnapshotOnConnect = (laneName, readLane, refuseRemote) => {
@@ -48967,6 +49115,7 @@ function createBackendControl(dependencies) {
 	};
 	sendLaneSnapshotOnConnect("visions", laneAssembly.currentVisions, false);
 	sendLaneSnapshotOnConnect("ingest", laneAssembly.currentIngest, true);
+	sendLaneSnapshotOnConnect("session-docs", () => dependencies.sessionDocs, false);
 }
 //#endregion
 //#region server/core/update-apply-core.ts
@@ -50706,9 +50855,6 @@ async function sharedFoldersOf({ checkout, gitDir }, worktreeShare) {
 	const sharedEntries = worktreeShare.filter((entry) => !UNSHARED_WORKTREE_ENTRIES.includes(entry));
 	return (await Promise.all(sharedEntries.map((entry) => sharedFolderBehind(path.join(checkout, entry), path.resolve(path.join(repositoryRoot, entry)))))).filter((sharedFolder) => sharedFolder !== null);
 }
-async function existingRealPaths(candidates) {
-	return (await Promise.all(candidates.filter((candidate) => path.isAbsolute(candidate)).map(existingRealPath))).filter((realPath) => realPath !== null);
-}
 function createSessionSandbox({ getSettings, uploadsRoot, sandboxRefusal = allowSandboxedSpawn, prepareSandbox = prepareSandboxLaunch, trustClaudeFolder, platform = process.platform, homeDir = os.homedir(), env = process.env, readGithubToken = () => readGithubCliToken(env), log = console }) {
 	const expandHome = (candidates) => candidates.map((candidate) => expandTilde(candidate.trim(), env, homeDir)).filter(Boolean);
 	const githubCliConfigDir = () => rawTextOr(env.GH_CONFIG_DIR, null) ?? path.join(rawTextOr(env.XDG_CONFIG_HOME, null) ?? path.join(homeDir, ".config"), "gh");
@@ -50728,7 +50874,7 @@ function createSessionSandbox({ getSettings, uploadsRoot, sandboxRefusal = allow
 				writableRoots: [
 					...startFolderRoots,
 					...sharedFolders,
-					...await existingRealPaths(expandHome(settings.writablePaths))
+					...await existingRealPaths([...expandHome(settings.writablePaths), ...facts.writablePaths])
 				],
 				readDenied: expandHome(settings.unreadablePaths).filter((unreadablePath) => path.isAbsolute(unreadablePath)),
 				readablePaths: [...facts.readablePaths, ...await existingRealPaths([sessionUploads, githubCliConfigDir()])]
@@ -51811,6 +51957,281 @@ function createTelemetry(options) {
 	};
 }
 //#endregion
+//#region server/core/session-docs-core.ts
+var NUL_CHARACTER = String.fromCharCode(0);
+var DOC_REFUSAL_COPY = Object.freeze({
+	missing: "no file exists at that path, so write it first and surface it again",
+	unreadable: "the file cannot be read",
+	"outside-root": "the path is outside this session's checkout",
+	"not-a-regular-file": "the path is not a regular file",
+	"root-unresolvable": "this session's checkout cannot be resolved",
+	"too-large": `the file is over ${SESSION_DOC_BODY_CAP_BYTES / 1024} KiB`,
+	binary: "the file is not UTF-8 text",
+	"not-surfaced": "that file was not surfaced by this session",
+	"changed-on-disk": "the file changed on disk since it was opened, so reload it before saving",
+	"hard-linked": "the file has other hard links, so it may live outside this session's checkout"
+});
+function describeDocRefusal(reason) {
+	return DOC_REFUSAL_COPY[reason];
+}
+function hashDocBytes(bytes) {
+	return crypto.createHash("sha256").update(bytes).digest("hex");
+}
+function countOccurrences(text, needle) {
+	return text.split(needle).length - 1;
+}
+function decodeDocBytes(bytes) {
+	if (bytes.byteLength > 262144) return {
+		ok: false,
+		reason: "too-large"
+	};
+	let text;
+	try {
+		text = new TextDecoder("utf-8", {
+			fatal: true,
+			ignoreBOM: true
+		}).decode(bytes);
+	} catch {
+		return {
+			ok: false,
+			reason: "binary"
+		};
+	}
+	if (text.includes(NUL_CHARACTER)) return {
+		ok: false,
+		reason: "binary"
+	};
+	const crlfCount = countOccurrences(text, "\r\n");
+	const usesCrlf = crlfCount > 0 && crlfCount === countOccurrences(text, "\n");
+	if (!usesCrlf) return {
+		ok: true,
+		text,
+		usesCrlf
+	};
+	return {
+		ok: true,
+		text: text.replaceAll("\r\n", "\n"),
+		usesCrlf
+	};
+}
+function encodeDocText(text, usesCrlf) {
+	if (text.includes(NUL_CHARACTER)) return {
+		ok: false,
+		reason: "binary"
+	};
+	const lineFeedText = text.replaceAll("\r\n", "\n");
+	const content = usesCrlf ? lineFeedText.replaceAll("\n", "\r\n") : lineFeedText;
+	if (Buffer.byteLength(content, "utf8") > 262144) return {
+		ok: false,
+		reason: "too-large"
+	};
+	return {
+		ok: true,
+		content
+	};
+}
+function withSurfacedDoc(docs, surfaced, maxDocs) {
+	return [surfaced, ...docs.filter((doc) => doc.path !== surfaced.path)].slice(0, maxDocs);
+}
+//#endregion
+//#region server/session-docs-wiring.ts
+async function readAtMostCapPlusOneByte(handle) {
+	const buffer = Buffer.alloc(SESSION_DOC_BODY_CAP_BYTES + 1);
+	let filledBytes = 0;
+	while (filledBytes < buffer.byteLength) {
+		const { bytesRead } = await handle.read(buffer, filledBytes, buffer.byteLength - filledBytes, filledBytes);
+		if (bytesRead === 0) break;
+		filledBytes += bytesRead;
+	}
+	return buffer.subarray(0, filledBytes);
+}
+async function readOpenedDoc(file) {
+	if (file.stat.size > 262144) return {
+		ok: false,
+		reason: "too-large"
+	};
+	try {
+		return {
+			ok: true,
+			loaded: {
+				file,
+				bytes: await readAtMostCapPlusOneByte(file.handle)
+			}
+		};
+	} catch {
+		return {
+			ok: false,
+			reason: "unreadable"
+		};
+	}
+}
+async function refusalForOpenedInode(file, root) {
+	if (file.stat.nlink > 1) return "hard-linked";
+	const kernelPath = await fs.promises.readlink(`/proc/self/fd/${file.handle.fd}`).catch(() => null);
+	if (kernelPath === null) return null;
+	const realRoot = await fs.promises.realpath(root).catch(() => null);
+	if (realRoot === null) return "root-unresolvable";
+	if (!isPathInside(realRoot, kernelPath, { allowEqual: false })) return "outside-root";
+	return null;
+}
+async function openVerifiedDoc(candidate, root, opensForWriting) {
+	const opened = opensForWriting ? await openContainedFile(candidate, root, false, true) : await openContainedFile(candidate, root);
+	if (!opened.ok) return opened;
+	const refusal = await refusalForOpenedInode(opened.file, root);
+	if (refusal === null) return opened;
+	await opened.file.handle.close().catch(() => {});
+	return {
+		ok: false,
+		reason: refusal
+	};
+}
+async function loadContainedDoc(candidate, root) {
+	const opened = await openVerifiedDoc(candidate, root, false);
+	if (!opened.ok) return opened;
+	try {
+		return await readOpenedDoc(opened.file);
+	} finally {
+		await opened.file.handle.close().catch(() => {});
+	}
+}
+async function overwriteThroughHandle(handle, bytes) {
+	let writtenBytes = 0;
+	while (writtenBytes < bytes.byteLength) {
+		const { bytesWritten } = await handle.write(bytes, writtenBytes, bytes.byteLength - writtenBytes, writtenBytes);
+		writtenBytes += bytesWritten;
+	}
+	await handle.truncate(bytes.byteLength);
+	await handle.sync();
+}
+async function overwriteIfUnchanged(file, text, baseHash) {
+	const outcome = await readOpenedDoc(file);
+	if (!outcome.ok) return {
+		ok: false,
+		error: describeDocRefusal(outcome.reason),
+		conflict: false
+	};
+	if (hashDocBytes(outcome.loaded.bytes) !== baseHash) return {
+		ok: false,
+		error: describeDocRefusal("changed-on-disk"),
+		conflict: true
+	};
+	const current = decodeDocBytes(outcome.loaded.bytes);
+	const encoded = encodeDocText(text, current.ok && current.usesCrlf);
+	if (!encoded.ok) return {
+		ok: false,
+		error: describeDocRefusal(encoded.reason),
+		conflict: false
+	};
+	const encodedBytes = Buffer.from(encoded.content, "utf8");
+	await overwriteThroughHandle(file.handle, encodedBytes);
+	return {
+		ok: true,
+		hash: hashDocBytes(encodedBytes)
+	};
+}
+async function nameWithinRoot(root, realPath) {
+	const realRoot = await fs.promises.realpath(root).catch(() => root);
+	return path.relative(realRoot, realPath);
+}
+function createSessionDocsWiring({ broadcastControl, now = Date.now }) {
+	const docsBySessionId = /* @__PURE__ */ new Map();
+	const saveQueue = createKeyedSerialQueue();
+	function broadcastDocs(sessionId) {
+		broadcastControl({
+			type: "session-docs-changed",
+			id: sessionId,
+			docs: docsBySessionId.get(sessionId) ?? []
+		});
+	}
+	function forgetSession(sessionId) {
+		if (!docsBySessionId.delete(sessionId)) return;
+		broadcastDocs(sessionId);
+	}
+	function isSurfaced(session, docPath) {
+		return (docsBySessionId.get(session.id) ?? []).some((doc) => doc.path === docPath);
+	}
+	async function surface(session, request) {
+		const root = session.effectiveCwd();
+		const outcome = await loadContainedDoc(path.resolve(root, request.path), root);
+		if (!outcome.ok) return {
+			ok: false,
+			error: describeDocRefusal(outcome.reason)
+		};
+		const decoded = decodeDocBytes(outcome.loaded.bytes);
+		if (!decoded.ok) return {
+			ok: false,
+			error: describeDocRefusal(decoded.reason)
+		};
+		const realPath = outcome.loaded.file.realPath;
+		const doc = {
+			path: realPath,
+			name: await nameWithinRoot(root, realPath),
+			surfacedAt: now()
+		};
+		if (!docsBySessionId.has(session.id)) session.once("teardown", () => forgetSession(session.id));
+		docsBySessionId.set(session.id, withSurfacedDoc(docsBySessionId.get(session.id) ?? [], doc, 20));
+		broadcastDocs(session.id);
+		return {
+			ok: true,
+			doc
+		};
+	}
+	async function read(session, docPath) {
+		if (!isSurfaced(session, docPath)) return {
+			ok: false,
+			error: describeDocRefusal("not-surfaced")
+		};
+		const outcome = await loadContainedDoc(docPath, session.effectiveCwd());
+		if (!outcome.ok) return {
+			ok: false,
+			error: describeDocRefusal(outcome.reason)
+		};
+		const decoded = decodeDocBytes(outcome.loaded.bytes);
+		if (!decoded.ok) return {
+			ok: false,
+			error: describeDocRefusal(decoded.reason)
+		};
+		return {
+			ok: true,
+			text: decoded.text,
+			hash: hashDocBytes(outcome.loaded.bytes)
+		};
+	}
+	async function writeIfUnchanged(session, docPath, text, baseHash) {
+		const opened = await openVerifiedDoc(docPath, session.effectiveCwd(), true);
+		if (!opened.ok) return {
+			ok: false,
+			error: describeDocRefusal(opened.reason),
+			conflict: false
+		};
+		try {
+			return await overwriteIfUnchanged(opened.file, text, baseHash);
+		} finally {
+			await opened.file.handle.close().catch(() => {});
+		}
+	}
+	async function save(session, docPath, text, baseHash) {
+		if (!isSurfaced(session, docPath)) return {
+			ok: false,
+			error: describeDocRefusal("not-surfaced"),
+			conflict: false
+		};
+		return saveQueue.run(docPath, () => writeIfUnchanged(session, docPath, text, baseHash));
+	}
+	function snapshotMessage() {
+		return {
+			type: "session-docs-snapshot",
+			sessions: Object.fromEntries(docsBySessionId)
+		};
+	}
+	return {
+		surface,
+		read,
+		save,
+		snapshotMessage
+	};
+}
+//#endregion
 //#region server/backend.ts
 var AGENT_INGRESS_HOST = "127.0.0.1";
 function createBackend(httpServer, options = {}) {
@@ -51916,6 +52337,7 @@ function createBackend(httpServer, options = {}) {
 	});
 	const { controlWss, dataWss, controlReplayLog, sessionDataClients, broadcastControl: broadcastControlFromWebSockets, broadcastLocalControl, closeSessionDataClients } = webSockets;
 	broadcastControl = broadcastControlFromWebSockets;
+	const sessionDocs = createSessionDocsWiring({ broadcastControl: broadcastControlFromWebSockets });
 	const sessions = /* @__PURE__ */ new Map();
 	const agentSessions = /* @__PURE__ */ new Map();
 	const { buildHealthSnapshot, healthInterval } = createBackendHealth({
@@ -51975,6 +52397,7 @@ function createBackend(httpServer, options = {}) {
 		broadcastControl,
 		spawnGate,
 		recordLane,
+		sessionDocs,
 		logger: console
 	});
 	const wireSessionEvents = createSessionEventWiring({
@@ -52157,6 +52580,7 @@ function createBackend(httpServer, options = {}) {
 		readTracePage: traceWiring?.readTracePage ?? null,
 		readPlanRevision: laneAssembly.planReview?.readPlanRevision ?? null,
 		decidePlanReview: laneAssembly.planReview?.decide ?? null,
+		sessionDocs,
 		changeMapNarrator: laneAssembly.changeMapNarrator,
 		serverBuild: () => serverBuild,
 		telemetry,