lavish-axi 0.1.82 → 0.1.84

package/README.md

@@ -211,7 +211,9 @@ pnpm link
   In the annotation card, Enter queues the annotation, Shift+Enter inserts a newline, and Ctrl+Enter (Cmd+Enter on macOS) queues it and sends all queued prompts immediately. Escape closes the card, same as Cancel, but only while it is empty (no text, no attachment); with unsent text or an attachment present, Escape does nothing rather than risk discarding it.
   While editing a queued note, Enter saves it, Shift+Enter inserts a newline, and Escape discards the edit.
   Cmd+I or Ctrl+I toggles between annotate and explore mode from either the browser chrome or the artifact iframe, including while focus is in a textarea or control.
+  In annotate mode a plain click on a link annotates it; Ctrl+click (Cmd+click on macOS) follows the link instead, opening it in a new tab as the browser normally would, without leaving annotate mode.
 - **Agent presence** - The browser shows when no agent is listening, keeps queued feedback for the next successful `lavish-axi poll` send even across reloads, and keeps human feedback actions available while the agent is working because the server queues them for the next poll. An agent reply concludes delivered work and returns presence to waiting (see the CLI Reference for reply and poll commands). A supervisor-owned process listener is shown as an external listener rather than an idle captain turn.
+- **Delivery receipts** - Every note you have sent carries three emoji under it that light up in turn: 👀 **Seen** when a `lavish-axi poll` takes the note, 🛠️ **Working** when the artifact file changes after that, and ✅ **Done** when the agent replies. A step that has not happened yet is the same emoji greyed out. All three come from what the server observes; the agent does nothing extra. Until 👀 lights, the row says why: no agent is listening, or the agent is busy and the note is delivered on its next poll. A note answered without touching the artifact goes Seen to Done with Working still grey. A reply marks every note the agent has seen as Done, not notes still waiting for a poll. Each emoji names its step and time on hover and to screen readers. Notes sent before receipts existed show no receipt row.
   In a Herdr-managed pane, set `LAVISH_AXI_HERDR_CHIME=1` to show a Herdr request notification and play its chime once an indefinite poll enters the waiting state. Immediate queued feedback and timed debug polls do not trigger a notification. The integration is off unless both `LAVISH_AXI_HERDR_CHIME` and Herdr's `HERDR_ENV` session marker equal `1`; leaving either unset or using any other value opts out. Notification delivery runs without blocking feedback: if Herdr is unavailable, rejects the notification, stalls, or fails, the poll continues unchanged.
   Closing the last review tab while a poll is active starts a 10-second reconnect grace period. A reload or quick reconnect keeps an active poll waiting; if every review stays disconnected, the poll returns `browser_disconnected` without ending the resumable session, and the agent asks whether to reopen or end it instead of acting uninvited.
   The no-timeout poll always writes an immediate stderr banner so it is visibly not hung; it adds the periodic stderr wait ticks only in an interactive terminal, so when stderr is piped (as under agent harnesses) the captured output carries no tick noise. Stdout always stays reserved for the final response; if the poll is interrupted or times out before feedback arrives, re-run it because feedback remains queued until delivery. Poll delivery consumes the response, so read the complete response before truncating or filtering it.
@@ -296,7 +298,7 @@ For flows, architecture, state, or sequence diagrams, open the diagram playbook
 | `lavish-axi share`       | `--token <t>`               | Attach an optional bearer token (`LAVISH_AXI_HTML_APP_TOKEN`) when creating a page; never required, and rejected on a republish or `--unpublish`, where the `update_key` is the credential.                                                                                                                                   |
 | `lavish-axi poll`        | `--owner <label>`           | Identify the process listening for this session; the non-empty label appears in the home session listing. `none` is reserved for sessions without a listener. A second concurrent poll is refused instead of silently returning `waiting`.                                                                                    |
 | `lavish-axi poll`        | `--takeover`                | Explicitly displace the current poll listener. The displaced poll exits with typed `LISTENER_REPLACED`; without this flag, the new poll fails with typed `LISTENER_ACTIVE`.                                                                                                                                                   |
-| `lavish-axi poll`        | `--agent-reply "..."`       | Show a concise agent reply in the existing browser chat, conclude delivered work, and return presence to waiting before polling again. Keep replies concise by default.                                                                                                                                                       |
+| `lavish-axi poll`        | `--agent-reply "..."`       | Show a concise agent reply in the existing browser chat, conclude delivered work (every note the agent has seen is marked Done), and return presence to waiting before polling again. Keep replies concise by default.                                                                                                        |
 | `lavish-axi poll`        | `--agent-reply-file <path>` | When a longer reply is genuinely necessary, read Markdown from a file (`-` for stdin) so newlines survive quoting. Use blank-line paragraphs, `- ` / `1. ` lists, and `## ` headings so the Conversation panel renders it scannably. The Markdown subset is under Feedback controls. Cannot be combined with `--agent-reply`. |
 | `lavish-axi poll`        | `--timeout-ms <ms>`         | Test/debug escape hatch only; agents should normally omit it and leave the long poll running.                                                                                                                                                                                                                                 |
 | `lavish-axi reply`       | `--agent-reply "..."`       | Concise reply text. Required unless `--agent-reply-file` is set. The command exits 0 only after the server accepts it. Empty text is refused. Prefer this over `poll --agent-reply` when you are not about to long-poll.                                                                                                      |

package/dist/chrome-client.js

@@ -912,10 +912,75 @@ function chatBubbleHtml(entry) {
     "<small>You</small>" +
     anchorHtml(entry.anchor) +
     userBubbleTextHtml(entry, entry.text) +
-    bubbleAttachmentsHtml(entry)
+    bubbleAttachmentsHtml(entry) +
+    receiptHtml(entry)
   );
 }
 
+// Delivery receipt (docs/delivery-acks.md): the per-note view of what the server observed. Seen,
+// Working, and Done are stamps on the entry, so the row is derived from it on every render and
+// never tracked here. Before Seen, the row says why, from the presence the live stream reports.
+// The three steps are the emoji of the Telegram ack protocol the receipt mirrors (seen, working,
+// done); a step that has not happened is the same glyph dimmed, and every step carries its label
+// and time as `title` and `aria-label`, so hover and screen readers both say the word.
+const RECEIPT_EMOJI = { Seen: "\u{1F440}", Working: "\u{1F6E0}️", Done: "✅" };
+
+function receiptTime(at) {
+  const date = new Date(String(at));
+  return Number.isNaN(date.getTime())
+    ? String(at)
+    : date.toLocaleTimeString([], { hour: "2-digit", minute: "2-digit" });
+}
+
+function receiptStepHtml(label, at) {
+  const ticked = Boolean(at);
+  const text = ticked ? label + " " + receiptTime(at) : label + ": not yet";
+  return (
+    '<span class="receipt-step' +
+    (ticked ? " is-done" : "") +
+    '" role="img" aria-label="' +
+    escapeHtml(text) +
+    '" title="' +
+    escapeHtml(text) +
+    '">' +
+    RECEIPT_EMOJI[label] +
+    "</span>"
+  );
+}
+
+// Every branch must be true where it is shown: `waiting` is no poll at all, `listening` is a poll
+// that will take the note within milliseconds, and `working` or an external listener is an agent
+// whose next poll will take it.
+function receiptNoteText() {
+  if (agentPresence === "waiting") return "No agent is listening";
+  if (agentPresence === "listening") return "Delivering";
+  return "Agent is busy; delivered on its next poll";
+}
+
+// A transcript entry from before receipts existed (`receipt: "none"`, marked by the server once at
+// load) gets no row: nothing was ever observed about it, and an empty row would read as "never seen".
+function hasReceipt(entry) {
+  return Boolean(entry) && entry.receipt !== "none";
+}
+
+function receiptHtml(entry) {
+  if (!hasReceipt(entry)) return "";
+  return (
+    '<div class="receipt">' +
+    receiptStepHtml("Seen", entry.delivered_at) +
+    receiptStepHtml("Working", entry.working_at) +
+    receiptStepHtml("Done", entry.done_at) +
+    (entry.delivered_at ? "" : '<span class="receipt-note">' + escapeHtml(receiptNoteText()) + "</span>") +
+    "</div>"
+  );
+}
+
+// Only the pre-Seen line names the live presence, so a presence change rewrites that line alone.
+// Rebuilding the bubble would also rebuild its thumbnails and undo an "Image expired" placeholder.
+function refreshUnseenReceipts() {
+  for (const note of chatLog.querySelectorAll(".receipt-note")) note.textContent = receiptNoteText();
+}
+
 function addChat(entry, shouldScroll = true) {
   if (!entry || typeof entry !== "object") return;
   const role = entry.role === "agent" ? "agent" : "user";
@@ -1067,6 +1132,7 @@ function setAgentPresence(state) {
   agentPresence = state === "listening" || state === "external" || state === "working" ? state : "waiting";
   updateSendState();
   renderSheetSummary();
+  refreshUnseenReceipts();
   if (presenceBanner) presenceBanner.hidden = ended || agentPresence !== "waiting";
 
   // A supervisor-owned process-only listener is busy on the agent's behalf. It must not make the

package/dist/chrome.css

@@ -1301,6 +1301,38 @@ body.lavish {
   border-radius: 3px;
   padding: 0 3px;
 }
+/* Delivery receipt: the per-note view of agent presence (docs/delivery-acks.md). Three emoji
+   (seen, working, done) that light up as the server observes each step; a step that has not
+   happened is the same glyph greyed and dimmed, so the row always shows what is still to come. */
+.receipt {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  justify-content: flex-end;
+  gap: 4px 8px;
+  margin-top: 6px;
+  font-size: 13px;
+  line-height: 1.3;
+  color: var(--fg-faint);
+}
+.receipt-step {
+  display: inline-block;
+  filter: grayscale(1);
+  opacity: 0.3;
+  transition:
+    opacity 0.3s ease,
+    filter 0.3s ease;
+}
+.receipt-step.is-done {
+  filter: none;
+  opacity: 1;
+}
+.receipt-note {
+  font-size: 11px;
+  flex-basis: 100%;
+  text-align: right;
+  font-style: italic;
+}
 .bubble-attachments {
   display: flex;
   flex-wrap: wrap;

package/dist/cli.mjs

@@ -21,7 +21,7 @@ import { access, readFile as readFile6, writeFile as writeFile4 } from "node:fs/
 import { get as httpGet2 } from "node:http";
 import { isIP as isIP4 } from "node:net";
 import os4 from "node:os";
-import path8 from "node:path";
+import path9 from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { AxiError, installSessionStartHooks, RESERVED_COMMANDS, runAxiCli } from "axi-sdk-js";
 
@@ -4427,7 +4427,7 @@ function htmlAppRequestError(message, details = {}) {
   if (status !== void 0) Object.defineProperty(error, "status", { value: status, enumerable: true });
   return error;
 }
-async function requestHtmlApp({ method, path: path9, body, bearer, options, env, action = "publish" }) {
+async function requestHtmlApp({ method, path: path10, body, bearer, options, env, action = "publish" }) {
   const apiUrl = (options.apiUrl ? String(options.apiUrl).replace(/\/+$/, "") : "") || htmlAppApiUrl(env);
   const fetchImpl = options.fetch || fetch;
   const headers = { "content-type": "application/json", "user-agent": "lavish-axi" };
@@ -4437,7 +4437,7 @@ async function requestHtmlApp({ method, path: path9, body, bearer, options, env,
   let response;
   let text;
   try {
-    response = await fetchImpl(`${apiUrl}${path9}`, {
+    response = await fetchImpl(`${apiUrl}${path10}`, {
       method,
       headers,
       body: JSON.stringify(body),
@@ -4704,10 +4704,10 @@ function writeTextFileAtomically(file, content, operations = {}) {
   const rename3 = operations.renameSync || renameSync;
   const remove = operations.rmSync || rmSync;
   const chmod2 = operations.chmodSync || chmodSync;
-  const stat3 = operations.statSync || statSync;
+  const stat4 = operations.statSync || statSync;
   let mode;
   try {
-    mode = stat3(file).mode & 511;
+    mode = stat4(file).mode & 511;
   } catch {
   }
   try {
@@ -4829,11 +4829,11 @@ function attrValue(attrs, name) {
 import crypto6 from "node:crypto";
 import { EventEmitter } from "node:events";
 import { existsSync as existsSync2 } from "node:fs";
-import { readFile as readFile5, realpath as realpath3 } from "node:fs/promises";
+import { readFile as readFile5, realpath as realpath4 } from "node:fs/promises";
 import { createServer, get as httpGet } from "node:http";
 import { isIP as isIP3 } from "node:net";
 import { homedir } from "node:os";
-import path7 from "node:path";
+import path8 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import chokidar from "chokidar";
 import express from "express";
@@ -5925,15 +5925,15 @@ function createArtifactSdk(deriveQueueKey, isNativeInteractive = isNativeInterac
     return node.parentElement || document.body;
   }
   function nodePath(node, root) {
-    const path9 = [];
+    const path10 = [];
     let current = node;
     while (current && current !== root) {
       const parentNode = current.parentNode;
       if (!parentNode) break;
-      path9.unshift([...parentNode.childNodes].indexOf(current));
+      path10.unshift([...parentNode.childNodes].indexOf(current));
       current = parentNode;
     }
-    return path9;
+    return path10;
   }
   function rangeBoundary(node, offset) {
     const el = closestElement(node);
@@ -7146,6 +7146,11 @@ function createArtifactSdk(deriveQueueKey, isNativeInteractive = isNativeInterac
     (event) => {
       if (!annotationMode || isLavishUi(event.target) || isLavishAction(event.target) || isInteractiveControl(event.target))
         return;
+      if ((event.ctrlKey || event.metaKey) && /** @type {Element} */
+      event.target?.closest?.("a[href]")) {
+        ignoreNextClick = false;
+        return;
+      }
       event.preventDefault();
       event.stopPropagation();
       if (ignoreNextClick) {
@@ -8276,6 +8281,62 @@ function serializeChatSync(session) {
     chat_revision: Number.isSafeInteger(revision) && revision >= 0 ? revision : 0
   };
 }
+var RECEIPT_NONE = "none";
+function isUserEntry(entry) {
+  return Boolean(entry) && typeof entry === "object" && entry.role === "user" && entry.receipt !== RECEIPT_NONE;
+}
+function markPreReceipt(chat) {
+  let changed = false;
+  for (const entry of Array.isArray(chat) ? chat : []) {
+    if (!entry || typeof entry !== "object" || entry.role !== "user" || entry.receipt === RECEIPT_NONE) continue;
+    entry.receipt = RECEIPT_NONE;
+    changed = true;
+  }
+  return changed;
+}
+function stampDelivered(chat, seq, at) {
+  let changed = false;
+  for (const entry of Array.isArray(chat) ? chat : []) {
+    if (!isUserEntry(entry) || entry.delivered_at) continue;
+    entry.delivered_at = String(at);
+    entry.delivered_seq = seq;
+    changed = true;
+  }
+  return changed;
+}
+function unstampDelivery(chat, seq) {
+  let changed = false;
+  for (const entry of Array.isArray(chat) ? chat : []) {
+    if (!isUserEntry(entry) || entry.delivered_seq !== seq) continue;
+    delete entry.delivered_at;
+    delete entry.delivered_seq;
+    delete entry.working_at;
+    delete entry.done_at;
+    changed = true;
+  }
+  return changed;
+}
+function isOpenDelivery(entry, closedSeq) {
+  return isUserEntry(entry) && Boolean(entry.delivered_at) && !entry.done_at && entry.delivered_seq > closedSeq;
+}
+function stampWorking(chat, at, closedSeq = 0) {
+  let changed = false;
+  for (const entry of Array.isArray(chat) ? chat : []) {
+    if (!isOpenDelivery(entry, closedSeq) || entry.working_at) continue;
+    entry.working_at = String(at);
+    changed = true;
+  }
+  return changed;
+}
+function stampDone(chat, at, closedSeq = 0) {
+  let changed = false;
+  for (const entry of Array.isArray(chat) ? chat : []) {
+    if (!isOpenDelivery(entry, closedSeq)) continue;
+    entry.done_at = String(at);
+    changed = true;
+  }
+  return changed;
+}
 
 // src/server-log.js
 function formatServerLogLine(line, now = /* @__PURE__ */ new Date()) {
@@ -8398,10 +8459,53 @@ function isIncompleteRunningTailscaleStatus(raw) {
   return addresses.some((address) => typeof address === "string" && isIP2(address.trim()) === 4);
 }
 
+// src/artifact-path.js
+import { realpath as realpath2, stat as stat2 } from "node:fs/promises";
+import path5 from "node:path";
+var ARTIFACT_HTML_ERROR = "Lavish Editor expects an HTML file";
+function isHtmlPath(file) {
+  const lower = String(file || "").toLowerCase();
+  return lower.endsWith(".html") || lower.endsWith(".htm");
+}
+function artifactTreeRoot(file) {
+  return path5.dirname(file);
+}
+var ArtifactPathError = class extends Error {
+  /** @type {"VALIDATION_ERROR"} */
+  code = "VALIDATION_ERROR";
+  /** @type {400} */
+  statusCode = 400;
+  /**
+   * @param {string} [message]
+   */
+  constructor(message = ARTIFACT_HTML_ERROR) {
+    super(message);
+    this.name = "ArtifactPathError";
+  }
+};
+function isArtifactPathError(error) {
+  return error instanceof Error && error.name === "ArtifactPathError";
+}
+async function resolveAllowedArtifactFile(file) {
+  const requested = typeof file === "string" ? file : "";
+  if (!isHtmlPath(requested)) {
+    throw new ArtifactPathError();
+  }
+  const canonical = await realpath2(path5.resolve(requested));
+  if (!isHtmlPath(canonical)) {
+    throw new ArtifactPathError();
+  }
+  const info = await stat2(canonical);
+  if (!info.isFile()) {
+    throw new ArtifactPathError();
+  }
+  return canonical;
+}
+
 // src/session-store.js
 import crypto4 from "node:crypto";
-import { readFile as readFile3, realpath as realpath2, writeFile as writeFile2 } from "node:fs/promises";
-import path5 from "node:path";
+import { readFile as readFile3, realpath as realpath3, writeFile as writeFile2 } from "node:fs/promises";
+import path6 from "node:path";
 
 // src/async-mutex.js
 var AsyncMutex = class {
@@ -8504,6 +8608,14 @@ var SessionStore = class {
       // Compact prompt_id acks for bubbles evicted by the stored-chat byte bound. Reopening
       // must keep them: they are the settlement/dedup source once the visible entry is gone.
       chat_ack_ids: Array.isArray(existing.chat_ack_ids) ? existing.chat_ack_ids : [],
+      // Counts the takes that stamped Seen on chat entries (docs/delivery-acks.md). Reset on reopen
+      // and a later restore could un-stamp an older take's entries, so it is carried like chat.
+      delivery_seq: normalizeRevision(existing.delivery_seq),
+      // The last take of the rounds that have ended. Reopening starts a new round: a note an ended
+      // round left at Seen stays Seen, because a later round's edit or reply is not about it.
+      closed_delivery_seq: normalizeRevision(
+        existing.status === "ended" ? existing.delivery_seq : existing.closed_delivery_seq
+      ),
       updated_at: (/* @__PURE__ */ new Date()).toISOString()
     };
     state.sessions[key] = session;
@@ -8558,7 +8670,11 @@ var SessionStore = class {
         else delete prompt.attachments;
       }
     }
+    const deliverySeq = restoring ? normalizeRevision(payload.delivery_seq) : 0;
+    const unstamped = deliverySeq > 0 && unstampDelivery(session.chat, deliverySeq);
+    if (unstamped) session.chat_revision = normalizeRevision(session.chat_revision) + 1;
     if (rejected.length) {
+      if (unstamped) await this.writeState(state);
       return {
         rejected: rejected.slice(0, MAX_REPORTED_ATTACHMENT_REJECTIONS),
         caps: {
@@ -8885,12 +9001,14 @@ var SessionStore = class {
       if (prompts.length === 0 && artifactFailures.length === 0) {
         return alreadyEnded ? { status: "ended", ended_by: session.ended_by } : { status: "waiting" };
       }
+      const deliverySeq = normalizeRevision(session.delivery_seq) + 1;
       const result = {
         status: "feedback",
         dom_snapshot: session.dom_snapshot || "",
         prompts,
         ...artifactFailures.length > 0 ? { artifact_failures: artifactFailures } : {},
-        ...alreadyEnded ? { session_ended: true, ended_by: session.ended_by } : {}
+        ...alreadyEnded ? { session_ended: true, ended_by: session.ended_by } : {},
+        ...prompts.length > 0 ? { delivery_seq: deliverySeq } : {}
       };
       const deliveredNow = Date.now();
       const deliveredIds = /* @__PURE__ */ new Set();
@@ -8905,6 +9023,12 @@ var SessionStore = class {
       const current = [...deliveredIds].map((id) => ({ id, at: deliveredNow }));
       const historyRoom = Math.max(0, MAX_DELIVERED_ATTACHMENTS - current.length);
       session.delivered_attachments = [...carried.slice(-historyRoom), ...current];
+      if (prompts.length > 0) {
+        session.delivery_seq = deliverySeq;
+        if (stampDelivered(session.chat, deliverySeq, new Date(deliveredNow).toISOString())) {
+          session.chat_revision = normalizeRevision(session.chat_revision) + 1;
+        }
+      }
       session.prompts = [];
       session.artifact_failures = [];
       session.pending_prompts = 0;
@@ -8945,6 +9069,7 @@ var SessionStore = class {
       }
       if (requireOpen && session.status === "ended") return session;
       const at = (/* @__PURE__ */ new Date()).toISOString();
+      stampDone(session.chat, at, normalizeRevision(session.closed_delivery_seq));
       session.chat = [...session.chat || [], { role: "agent", text: String(text || ""), at }];
       applyTranscriptBound(session);
       session.chat_revision = normalizeRevision(session.chat_revision) + 1;
@@ -8953,6 +9078,22 @@ var SessionStore = class {
       return session;
     });
   }
+  // Working (docs/delivery-acks.md): the artifact changed after a delivery, so the agent is acting on
+  // what it was handed. Returns the session when a stamp landed and null when there was nothing to
+  // stamp, in which case state.json is not rewritten - the watcher fires on every save.
+  async markWorking(key) {
+    return this.runExclusive(async () => {
+      const state = await this.readState();
+      const session = state.sessions[key];
+      if (!session) return null;
+      const at = (/* @__PURE__ */ new Date()).toISOString();
+      if (!stampWorking(session.chat, at, normalizeRevision(session.closed_delivery_seq))) return null;
+      session.chat_revision = normalizeRevision(session.chat_revision) + 1;
+      session.updated_at = at;
+      await this.writeState(state);
+      return session;
+    });
+  }
   /**
    * @template T
    * @param {() => Promise<T>} operation
@@ -8995,7 +9136,13 @@ var SessionStore = class {
       const state = { sessions: parsed.sessions || {} };
       let changed = false;
       for (const session of Object.values(state.sessions)) {
-        if (!session || typeof session !== "object" || !applyTranscriptBound(session)) continue;
+        if (!session || typeof session !== "object") continue;
+        if (!("delivery_seq" in session)) {
+          session.delivery_seq = 0;
+          markPreReceipt(session.chat);
+          changed = true;
+        }
+        if (!applyTranscriptBound(session)) continue;
         session.chat_revision = normalizeRevision(session.chat_revision) + 1;
         changed = true;
       }
@@ -9014,8 +9161,8 @@ var SessionStore = class {
   }
 };
 async function canonicalFile(file) {
-  const absolute = path5.resolve(file);
-  return realpath2(absolute);
+  const absolute = path6.resolve(file);
+  return realpath3(absolute);
 }
 function sessionKey(file) {
   return crypto4.createHash("sha256").update(file).digest("hex").slice(0, 16);
@@ -9255,8 +9402,8 @@ function generateSharePassword() {
 
 // src/attachment-store.js
 import crypto5 from "node:crypto";
-import { chmod, mkdir as mkdir3, readdir, readFile as readFile4, rename as rename2, rm as rm2, stat as stat2, utimes, writeFile as writeFile3 } from "node:fs/promises";
-import path6 from "node:path";
+import { chmod, mkdir as mkdir3, readdir, readFile as readFile4, rename as rename2, rm as rm2, stat as stat3, utimes, writeFile as writeFile3 } from "node:fs/promises";
+import path7 from "node:path";
 var KEY_RE2 = /^[0-9a-f]{16}$/;
 var ID_RE = /^[0-9a-f]{64}\.(png|jpg|webp)$/;
 var MIME_BY_EXT = { png: "image/png", jpg: "image/jpeg", webp: "image/webp" };
@@ -9284,10 +9431,10 @@ function isValidAttachmentId(id) {
   return ID_RE.test(String(id || ""));
 }
 function attachmentsDir(stateDir2, key) {
-  return path6.join(stateDir2, "attachments", String(key));
+  return path7.join(stateDir2, "attachments", String(key));
 }
 function attachmentFile(stateDir2, key, id) {
-  return path6.join(attachmentsDir(stateDir2, key), id);
+  return path7.join(attachmentsDir(stateDir2, key), id);
 }
 function resolveAttachmentConfig(env = process.env) {
   const maxDiskBytes = diskCapEnv(env.LAVISH_AXI_MAX_ATTACHMENT_DISK_MB);
@@ -9422,7 +9569,7 @@ function buildMetadata(id, file, mime, bytes, dims) {
 }
 async function pathExists(file) {
   try {
-    await stat2(file);
+    await stat3(file);
     return true;
   } catch (error) {
     if (error && error.code === "ENOENT") return false;
@@ -9462,7 +9609,7 @@ async function writeFileAtomically2(file, content) {
   }
 }
 async function ensureAttachmentDir(stateDir2, key) {
-  const root = path6.join(stateDir2, "attachments");
+  const root = path7.join(stateDir2, "attachments");
   const dir = attachmentsDir(stateDir2, key);
   await mkdir3(dir, { recursive: true, mode: ATTACHMENT_DIR_MODE });
   for (const target of [root, dir]) {
@@ -9543,7 +9690,7 @@ async function resolveAttachment(stateDir2, key, id) {
   const file = attachmentFile(stateDir2, key, id);
   let info;
   try {
-    info = await stat2(file);
+    info = await stat3(file);
   } catch (error) {
     if (error && error.code === "ENOENT") return null;
     throw error;
@@ -9557,7 +9704,7 @@ async function statAttachmentForServe(stateDir2, key, id) {
   if (!isValidAttachmentKey(key) || !isValidAttachmentId(id)) return null;
   const file = attachmentFile(stateDir2, key, id);
   try {
-    const info = await stat2(file);
+    const info = await stat3(file);
     if (!info.isFile()) return null;
   } catch (error) {
     if (error && error.code === "ENOENT") return null;
@@ -9586,20 +9733,20 @@ async function removeAttachment(stateDir2, key, id) {
   }
 }
 async function listAttachments(stateDir2) {
-  const root = path6.join(stateDir2, "attachments");
+  const root = path7.join(stateDir2, "attachments");
   const sessionDirs = await readdirSafe(root);
   const files = [];
   for (const dirent of sessionDirs) {
     if (!dirent.isDirectory() || !isValidAttachmentKey(dirent.name)) continue;
-    const dir = path6.join(root, dirent.name);
+    const dir = path7.join(root, dirent.name);
     for (const entry of await readdirSafe(dir)) {
       if (!entry.isFile() || !isValidAttachmentId(entry.name)) continue;
-      const filePath = path6.join(dir, entry.name);
+      const filePath = path7.join(dir, entry.name);
       try {
-        const info = await stat2(filePath);
+        const info = await stat3(filePath);
         let sidecarBytes = 0;
         try {
-          sidecarBytes = (await stat2(sidecarPath(filePath))).size;
+          sidecarBytes = (await stat3(sidecarPath(filePath))).size;
         } catch {
         }
         files.push({
@@ -9676,19 +9823,19 @@ async function sweepAttachments(stateDir2, options = {}) {
   const orphans = await reapOrphanFiles(stateDir2, now);
   deleted += orphans.deleted;
   freedBytes += orphans.freedBytes;
-  await pruneEmptyDirs(path6.join(stateDir2, "attachments"));
+  await pruneEmptyDirs(path7.join(stateDir2, "attachments"));
   return { deleted, freedBytes };
 }
 async function committedChargedBytes(stateDir2) {
-  const root = path6.join(stateDir2, "attachments");
+  const root = path7.join(stateDir2, "attachments");
   let total = 0;
   for (const dirent of await readdirSafe(root)) {
     if (!dirent.isDirectory() || !isValidAttachmentKey(dirent.name)) continue;
-    const dir = path6.join(root, dirent.name);
+    const dir = path7.join(root, dirent.name);
     for (const entry of await readdirSafe(dir)) {
       if (!entry.isFile()) continue;
       try {
-        total += allocatedBytes((await stat2(path6.join(dir, entry.name))).size);
+        total += allocatedBytes((await stat3(path7.join(dir, entry.name))).size);
       } catch {
       }
     }
@@ -9696,28 +9843,28 @@ async function committedChargedBytes(stateDir2) {
   return total;
 }
 async function reapOrphanFiles(stateDir2, now) {
-  const root = path6.join(stateDir2, "attachments");
+  const root = path7.join(stateDir2, "attachments");
   let deleted = 0;
   let freedBytes = 0;
   for (const dirent of await readdirSafe(root)) {
     if (!dirent.isDirectory() || !isValidAttachmentKey(dirent.name)) continue;
-    const dir = path6.join(root, dirent.name);
+    const dir = path7.join(root, dirent.name);
     const entries = await readdirSafe(dir);
     const present = new Set(entries.filter((e) => e.isFile()).map((e) => e.name));
     for (const entry of entries) {
       if (!entry.isFile()) continue;
-      const filePath = path6.join(dir, entry.name);
+      const filePath = path7.join(dir, entry.name);
       const sidecarMatch = SIDECAR_ORPHAN_RE.exec(entry.name);
       try {
         if (TEMP_FILE_RE.test(entry.name)) {
-          const info = await stat2(filePath);
+          const info = await stat3(filePath);
           if (now - info.mtimeMs <= ATTACHMENT_TEMP_GRACE_MS) continue;
           if (await removeFile(filePath)) {
             deleted += 1;
             freedBytes += info.size;
           }
         } else if (sidecarMatch && !present.has(sidecarMatch[1])) {
-          const info = await stat2(filePath);
+          const info = await stat3(filePath);
           if (await removeFile(filePath)) {
             deleted += 1;
             freedBytes += info.size;
@@ -9750,7 +9897,7 @@ async function removeFile(file) {
 async function pruneEmptyDirs(root) {
   for (const dirent of await readdirSafe(root)) {
     if (!dirent.isDirectory()) continue;
-    const dir = path6.join(root, dirent.name);
+    const dir = path7.join(root, dirent.name);
     try {
       if ((await readdir(dir)).length === 0) await rm2(dir, { recursive: true, force: true });
     } catch {
@@ -9950,7 +10097,12 @@ async function serve({
       if (clientKey === key) client.sendEvent(type, data);
     }
   }
-  events.on("reload", (key) => broadcastLiveEvent("reload", key));
+  events.on("reload", (key) => {
+    broadcastLiveEvent("reload", key);
+    store.markWorking(key).then((session) => {
+      if (session) events.emit("chat-sync", key, session);
+    }).catch((error) => writeLog(`[lavish] working stamp after reload failed: ${error?.message || error}`));
+  });
   events.on("agent-reply", (key, entry) => broadcastLiveEvent("agent-reply", key, entry));
   events.on("chat-sync", (key, session) => broadcastLiveEvent("chat-sync", key, serializeChatSync(session)));
   events.on(
@@ -10064,6 +10216,21 @@ async function serve({
   function finishFeedbackDelivery(key, result) {
     if (result.status !== "feedback") return;
     markFeedbackDelivered(key, activePolls, deliveredFeedback, events);
+    void publishChatSync(key);
+  }
+  async function publishChatSync(key) {
+    try {
+      const session = await store.findByKey(key);
+      if (session) events.emit("chat-sync", key, session);
+    } catch (error) {
+      writeLog(`[lavish] chat-sync after delivery failed: ${error?.message || error}`);
+    }
+  }
+  function agentFacingFeedback(result) {
+    if (!result || result.status !== "feedback" || !("delivery_seq" in result)) return result;
+    const rest = { ...result };
+    delete rest.delivery_seq;
+    return rest;
   }
   async function restoreClosedFeedback(key, result) {
     if (result.status !== "feedback") return;
@@ -10076,7 +10243,9 @@ async function serve({
         {
           dom_snapshot: result.dom_snapshot || "",
           prompts,
-          ...Array.isArray(result.artifact_failures) ? { artifact_failures: result.artifact_failures } : {}
+          ...Array.isArray(result.artifact_failures) ? { artifact_failures: result.artifact_failures } : {},
+          // Lets the store take this take's Seen stamps off again (docs/delivery-acks.md).
+          ...Number.isInteger(result.delivery_seq) ? { delivery_seq: result.delivery_seq } : {}
         },
         {
           restore: true,
@@ -10099,14 +10268,15 @@ async function serve({
         `[lavish] closed poll feedback restore failed; the batch was lost: ${restoreError?.message || restoreError}`
       );
     } else if (persistedNothing) {
-      writeLog("[lavish] closed poll feedback restore was refused; nothing was persisted and the batch was lost");
+      writeLog("[lavish] closed poll feedback restore was refused; nothing was re-queued and the batch was lost");
     } else if (!restoredPrompts || JSON.stringify(restoredPrompts) !== JSON.stringify(prompts) || !failuresRestored) {
       writeLog("[lavish] closed poll feedback restore was incomplete; delivery was not marked");
     }
     const pendingAfterRestore = Array.isArray(restoredPrompts) && restoredPrompts.length > 0 || Array.isArray(restoredFailures) && restoredFailures.length > 0;
     if (pendingAfterRestore) events.emit("feedback", key);
+    await publishChatSync(key);
   }
-  const whiteboardStateRoot = path7.dirname(stateFile2);
+  const whiteboardStateRoot = path8.dirname(stateFile2);
   const allowedHostnames = buildAllowedHostnames({
     host: requestedListenHosts[0],
     hosts: [...requestedListenHosts, ...listenHosts],
@@ -10138,6 +10308,11 @@ async function serve({
       workingUrl: workingUrlFor(req, { includeSessionPath: false })
     });
   }
+  function refuseNonHtmlArtifact(session, res) {
+    if (isHtmlPath(session.file)) return false;
+    res.status(403).send("Forbidden");
+    return true;
+  }
   if (!allowAnyHostname) {
     app.use((req, res, next) => {
       const requestHost = { host: req.headers.host, forwardedHost: req.headers["x-forwarded-host"] };
@@ -10168,7 +10343,7 @@ async function serve({
     next();
   });
   const attachmentConfig = resolveAttachmentConfig();
-  const attachmentStateRoot = path7.dirname(stateFile2);
+  const attachmentStateRoot = path8.dirname(stateFile2);
   const defaultJsonParser = express.json({ limit: "2mb" });
   const whiteboardJsonParser = express.json({ limit: "20mb" });
   app.use((req, res, next) => {
@@ -10191,7 +10366,7 @@ async function serve({
       app: "lavish-axi",
       version,
       state_id: serverStateId,
-      state_dir: path7.dirname(stateFile2),
+      state_dir: path8.dirname(stateFile2),
       // Where this process is listening and every address it was asked to serve (bound or still
       // retrying). The CLI uses both to find one daemon per port whatever host it was configured
       // with, and to tell a same-port daemon at another address apart from this one.
@@ -10219,7 +10394,7 @@ async function serve({
   });
   app.post("/api/sessions", async (req, res, next) => {
     try {
-      const file = await canonicalFile(req.body.file);
+      const file = await resolveAllowedArtifactFile(req.body?.file);
       const key = sessionKey(file);
       const reopen = Boolean(req.body.reopen);
       const existing = await store.findByKey(key);
@@ -10251,6 +10426,14 @@ async function serve({
         ...networkWarningField()
       });
     } catch (error) {
+      if (isArtifactPathError(error)) {
+        res.status(error.statusCode).json({
+          status: "error",
+          code: error.code,
+          error: error.message
+        });
+        return;
+      }
       next(error);
     }
   });
@@ -10374,7 +10557,7 @@ async function serve({
         releasePollListener(holder, activePolls, deliveredFeedback, events);
         if (immediate.session_ended) clearFeedbackDelivery(key, activePolls, deliveredFeedback, events);
         detachRequestClose();
-        res.json(immediate);
+        res.json(agentFacingFeedback(immediate));
         return;
       }
       if (holder.replaced) {
@@ -10453,10 +10636,11 @@ async function serve({
             return;
           }
           finishFeedbackDelivery(key, responseResult);
+          const agentResponse = agentFacingFeedback(responseResult);
           if (streamHeartbeat) {
-            res.end(JSON.stringify(responseResult));
+            res.end(JSON.stringify(agentResponse));
           } else {
-            res.json(responseResult);
+            res.json(agentResponse);
           }
         } finally {
           cleanup();
@@ -10678,8 +10862,9 @@ async function serve({
         res.status(404).json({ error: "session not found" });
         return;
       }
+      if (refuseNonHtmlArtifact(session, res)) return;
       const source = await readFile5(session.file, "utf8");
-      const root = path7.dirname(session.file);
+      const root = path8.dirname(session.file);
       const { html, warnings } = await buildSelfContainedHtml(source, {
         baseDir: root,
         confineDir: root,
@@ -10706,11 +10891,12 @@ async function serve({
         res.status(404).json({ error: "session not found" });
         return;
       }
+      if (refuseNonHtmlArtifact(session, res)) return;
       const body = req.body || {};
       const generatePassword = body.generate_password === true;
       const password = generatePassword ? generateSharePassword() : optionalBodyString(body.password);
       const source = await readFile5(session.file, "utf8");
-      const root = path7.dirname(session.file);
+      const root = path8.dirname(session.file);
       const { html, warnings } = await buildSelfContainedHtml(source, {
         baseDir: root,
         confineDir: root,
@@ -10781,6 +10967,7 @@ async function serve({
         return;
       }
       const session = chromeLoad.session;
+      if (refuseNonHtmlArtifact(session, res)) return;
       await watchSession(session, watchers, events, logEvent, reloadDebounceMs);
       const artifactHtml = await readFile5(session.file, "utf8").catch(() => "");
       const { faviconTag, title } = extractArtifactHead(artifactHtml);
@@ -10858,6 +11045,7 @@ async function serve({
         sendSessionNotFound(req, res);
         return;
       }
+      if (refuseNonHtmlArtifact(beforeRead.session, res)) return;
       if (!beforeRead.valid) {
         res.status(409).type("html").send(
           "<!doctype html><title>Artifact load expired</title><p>This artifact load is no longer current. Reload Lavish to continue.</p>"
@@ -10887,7 +11075,8 @@ async function serve({
         sendSessionNotFound(req, res);
         return;
       }
-      const root = path7.dirname(session.file);
+      if (refuseNonHtmlArtifact(session, res)) return;
+      const root = artifactTreeRoot(session.file);
       const file = await resolveArtifactAsset(root, assetPath);
       if (!file) {
         res.status(403).send("Forbidden");
@@ -10994,6 +11183,7 @@ data: ${JSON.stringify({ reason: "server-restarted" })}
         res.status(404).json({ error: "session not found" });
         return;
       }
+      if (refuseNonHtmlArtifact(session, res)) return;
       const html = await readFile5(session.file, "utf8").catch(() => "");
       const sources = extractMermaidSources(html).map(({ index, source }) => ({
         index,
@@ -11709,14 +11899,14 @@ function optionalBodyString(value) {
   return trimmed || void 0;
 }
 async function resolveArtifactAsset(root, assetPath) {
-  const file = path7.resolve(root, assetPath);
-  const relative = path7.relative(root, file);
-  if (relative.startsWith("..") || path7.isAbsolute(relative)) {
+  const file = path8.resolve(root, assetPath);
+  const relative = path8.relative(root, file);
+  if (relative.startsWith("..") || path8.isAbsolute(relative)) {
     return null;
   }
   let real;
   try {
-    real = await realpath3(file);
+    real = await realpath4(file);
   } catch (error) {
     if (error?.code === "ENOENT" || error?.code === "ENOTDIR") {
       return file;
@@ -11725,12 +11915,12 @@ async function resolveArtifactAsset(root, assetPath) {
   }
   let realRoot;
   try {
-    realRoot = await realpath3(root);
+    realRoot = await realpath4(root);
   } catch {
-    realRoot = path7.resolve(root);
+    realRoot = path8.resolve(root);
   }
-  const relativeReal = path7.relative(realRoot, real);
-  if (relativeReal === ".." || relativeReal.startsWith(`..${path7.sep}`) || path7.isAbsolute(relativeReal)) {
+  const relativeReal = path8.relative(realRoot, real);
+  if (relativeReal === ".." || relativeReal.startsWith(`..${path8.sep}`) || path8.isAbsolute(relativeReal)) {
     return null;
   }
   return real;
@@ -11766,7 +11956,7 @@ async function resolveWatchTarget(session) {
     const html = await readFile5(session.file, "utf8");
     if (hasLiveReloadRootOptIn(html)) {
       return {
-        path: path7.dirname(session.file),
+        path: path8.dirname(session.file),
         scope: "directory",
         options: {
           ...baseOptions,
@@ -12220,9 +12410,9 @@ var HttpTelemetryClient = class {
     if (!trimmed) return;
     this.send(trimmed, eventURL(this.app, trimmed), fields);
   }
-  pageview(path9, fields = {}) {
+  pageview(path10, fields = {}) {
     if (this.closed) return;
-    this.send("", normalizePagePath(path9), fields);
+    this.send("", normalizePagePath(path10), fields);
   }
   async close(timeoutMs = DEFAULT_REQUEST_TIMEOUT_MS) {
     this.closed = true;
@@ -12297,8 +12487,8 @@ function eventURL(app, name) {
   if (!name) return `app://${app}`;
   return `app://${app}/${name.replace(/\./g, "/")}`;
 }
-function normalizePagePath(path9) {
-  const trimmed = String(path9 || "").trim();
+function normalizePagePath(path10) {
+  const trimmed = String(path10 || "").trim();
   if (!trimmed) return "/";
   return trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
 }
@@ -12340,7 +12530,7 @@ var AGENT_REPLY_INPUT_LIMIT_BYTES = AGENT_REPLY_JSON_LIMIT_BYTES - AGENT_REPLY_J
 var AGENT_REPLY_LIMIT_LABEL = "2 MB JSON request limit";
 var POLL_STATE_HEADER = "lavish-poll-state";
 var CODEX_POLL_WAKE_PATH_GUIDANCE = "Codex detected: completed background tasks may not resume Codex automatically, so keep the poll attached to the active turn.";
-var VERSION = "0.1.82";
+var VERSION = "0.1.84";
 function detectInvokingAgent(env = process.env) {
   return ["CODEX_SANDBOX", "CODEX_THREAD_ID"].some((key) => Object.hasOwn(env, key)) ? "codex" : "generic";
 }
@@ -12818,8 +13008,8 @@ async function exportCommand(args) {
   }
   await assertHtmlFile(file);
   const absolute = await canonicalFile(file);
-  const root = path8.dirname(absolute);
-  const output = path8.resolve(flagValue(args, "--out") || path8.join(root, exportFileName(absolute)));
+  const root = path9.dirname(absolute);
+  const output = path9.resolve(flagValue(args, "--out") || path9.join(root, exportFileName(absolute)));
   const source = await readFile6(absolute, "utf8");
   const { html, warnings } = await buildSelfContainedHtml(source, {
     baseDir: root,
@@ -12874,7 +13064,7 @@ async function shareCommand(args) {
   }
   await assertHtmlFile(request.file);
   const absolute = await canonicalFile(request.file);
-  const root = path8.dirname(absolute);
+  const root = path9.dirname(absolute);
   const source = await readFile6(absolute, "utf8");
   const { html, warnings } = await buildSelfContainedHtml(source, {
     baseDir: root,
@@ -13297,7 +13487,7 @@ async function setupPluginCommand() {
   const manifest = readPluginManifest(pluginRoot);
   if (!manifest) {
     throw new AxiError("No plugin.json found in the lavish-axi package", "SERVER_ERROR", [
-      `Expected a manifest at ${path8.join(pluginRoot, "plugin.json")}`,
+      `Expected a manifest at ${path9.join(pluginRoot, "plugin.json")}`,
       "Reinstall lavish-axi, or run `npm run build:plugin` when working from a source checkout"
     ]);
   }
@@ -13321,7 +13511,7 @@ function collapseHome(target) {
 }
 function registerVsCodePlugin(pluginRoot, pluginName) {
   const settingsFile = resolveVsCodeSettingsFile(process.env, resolveHookHomeDir());
-  const settingsDir = path8.dirname(settingsFile);
+  const settingsDir = path9.dirname(settingsFile);
   const hasSettingsFile = existsSync3(settingsFile);
   if (!hasSettingsFile && !existsSync3(settingsDir)) {
     return { client: "vscode", status: "absent", detail: "no VS Code user configuration found" };
@@ -13350,7 +13540,7 @@ function registerVsCodePlugin(pluginRoot, pluginName) {
   return { client: "vscode", status: "registered", detail: collapseHome(settingsFile) };
 }
 function registerCursorPlugin(pluginRoot, pluginName) {
-  const cursorDir = path8.join(resolveHookHomeDir(), ".cursor");
+  const cursorDir = path9.join(resolveHookHomeDir(), ".cursor");
   if (!existsSync3(cursorDir)) {
     return { client: "cursor", status: "absent", detail: "no ~/.cursor directory found" };
   }
@@ -13423,9 +13613,9 @@ function parseCopilotPluginRecords(output) {
   }
 }
 function installedCopilotPluginSourcePath(pluginName) {
-  const configDir = process.env.COPILOT_HOME || path8.join(resolveHookHomeDir(), ".copilot");
+  const configDir = process.env.COPILOT_HOME || path9.join(resolveHookHomeDir(), ".copilot");
   try {
-    const config = JSON.parse(readFileSync2(path8.join(configDir, "config.json"), "utf8"));
+    const config = JSON.parse(readFileSync2(path9.join(configDir, "config.json"), "utf8"));
     const record = Array.isArray(config.installedPlugins) ? config.installedPlugins.find((candidate) => candidate?.name === pluginName) : null;
     return record ? copilotPluginSourcePath(record) : null;
   } catch {
@@ -13450,7 +13640,7 @@ function copilotPluginSourcePath(record) {
         continue;
       }
     }
-    if (path8.isAbsolute(candidate)) return candidate;
+    if (path9.isAbsolute(candidate)) return candidate;
   }
   return null;
 }
@@ -13458,14 +13648,14 @@ function sameResolvedPath(left, right) {
   try {
     return realpathSync2(left) === realpathSync2(right);
   } catch {
-    return path8.resolve(left) === path8.resolve(right);
+    return path9.resolve(left) === path9.resolve(right);
   }
 }
 function resolveHookHomeDir(env = process.env, fallback = os4.homedir()) {
   return env.HOME || fallback;
 }
 function resolveCopilotHookDir(env = process.env, homeDir = resolveHookHomeDir(env)) {
-  return path8.join(env.COPILOT_HOME || path8.join(homeDir, ".copilot"), "hooks");
+  return path9.join(env.COPILOT_HOME || path9.join(homeDir, ".copilot"), "hooks");
 }
 function createCopilotCliAmbientContextScript(command = "lavish-axi") {
   return [
@@ -13514,9 +13704,9 @@ function installCopilotCliSessionStartHook({
   timeoutSec = 10,
   onError = void 0
 } = {}) {
-  const target = path8.join(hookDir, "lavish-axi.json");
+  const target = path9.join(hookDir, "lavish-axi.json");
   try {
-    mkdirSync2(path8.dirname(target), { recursive: true });
+    mkdirSync2(path9.dirname(target), { recursive: true });
     const current = existsSync3(target) ? JSON.parse(readFileSync2(target, "utf8")) : {};
     const [updated, changed] = computeCopilotCliHookUpdate(
       current,
@@ -13579,9 +13769,6 @@ async function assertHtmlFile(file) {
     ]);
   }
 }
-function isHtmlPath(file) {
-  return file.toLowerCase().endsWith(".html") || file.toLowerCase().endsWith(".htm");
-}
 var HEALTH_PROBE_TIMEOUT_MS = 500;
 var DEFAULT_HEALTH_TIMEOUT_MS = 2e3;
 var MAX_HEALTH_BODY_BYTES = 256 * 1024;
@@ -13794,7 +13981,7 @@ function serverReplacementReason(currentVersion, healthBody, forceRestart = fals
 }
 function shouldForceRestartForLocalBuild(executablePath, sourceServerExists = localSourceServerExists()) {
   const localBuildEntry = fileURLToPath4(new URL("../dist/cli.mjs", import.meta.url));
-  return sourceServerExists && path8.resolve(executablePath) === path8.resolve(localBuildEntry);
+  return sourceServerExists && path9.resolve(executablePath) === path9.resolve(localBuildEntry);
 }
 function localSourceServerExists() {
   return existsSync3(fileURLToPath4(new URL("../src/server.js", import.meta.url)));
@@ -14269,7 +14456,7 @@ ${POLL_SEND_AND_END_RULE}
 `,
     reply: `Usage: lavish-axi reply <html-file> (--agent-reply "..." | --agent-reply-file <path>)
 
-Post an agent reply to the open Lavish Editor session and exit once the server confirms it was accepted. Exit 0 only when the server answers that the reply was sent, which is when the board stops showing Working. If that answer does not arrive within ${AGENT_REPLY_RECEIPT_TIMEOUT_MS / 1e3} seconds, exit non-zero with a timeout error. Use this when you are handing a result back and are not about to wait for more feedback.
+Post an agent reply to the open Lavish Editor session and exit once the server confirms it was accepted. Exit 0 only when the server answers that the reply was sent, which is when the board stops showing Working. If that answer does not arrive within ${AGENT_REPLY_RECEIPT_TIMEOUT_MS / 1e3} seconds, exit non-zero with a timeout error. Use this when you are handing a result back and are not about to wait for more feedback. A reply also marks every note the poll delivered to you as Done in the reviewer's panel, so reply once you have handled them.
 
 Use \`lavish-axi poll <html-file> --agent-reply "..."\` instead when the reply should be followed by a long-poll. That command posts the reply and then keeps waiting, so it does not exit when the reply is accepted.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lavish-axi",
-  "version": "0.1.82",
+  "version": "0.1.84",
   "packageManager": "pnpm@11.1.1",
   "description": "HTML is the new markdown. Lavish is the new editor for your HTML artifacts.",
   "type": "module",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "lavish-axi",
-  "version": "0.1.82",
+  "version": "0.1.84",
   "description": "HTML is the new markdown. Lavish is the new editor for your HTML artifacts.",
   "author": {
     "name": "Kun Chen",