tandem-editor 0.4.0 → 0.6.0

package/dist/server/index.js

@@ -40,7 +40,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/shared/constants.ts
-var DEFAULT_WS_PORT, DEFAULT_MCP_PORT, SUPPORTED_EXTENSIONS, MAX_FILE_SIZE, MAX_WS_PAYLOAD, IDLE_TIMEOUT, SESSION_MAX_AGE, TANDEM_MODE_DEFAULT, SELECTION_DWELL_DEFAULT_MS, SELECTION_DWELL_MIN_MS, SELECTION_DWELL_MAX_MS, CHARS_PER_PAGE, LARGE_FILE_PAGE_THRESHOLD, VERY_LARGE_FILE_PAGE_THRESHOLD, CTRL_ROOM, Y_MAP_ANNOTATIONS, Y_MAP_AWARENESS, Y_MAP_USER_AWARENESS, Y_MAP_MODE, Y_MAP_DWELL_MS, Y_MAP_CHAT, Y_MAP_DOCUMENT_META, Y_MAP_SAVED_AT_VERSION, NOTIFICATION_BUFFER_SIZE, TUTORIAL_ANNOTATION_PREFIX, CHANNEL_EVENT_BUFFER_SIZE, CHANNEL_EVENT_BUFFER_AGE_MS, CHANNEL_SSE_KEEPALIVE_MS, TAURI_HOSTNAME;
+var DEFAULT_WS_PORT, DEFAULT_MCP_PORT, SUPPORTED_EXTENSIONS, MAX_FILE_SIZE, MAX_WS_PAYLOAD, IDLE_TIMEOUT, SESSION_MAX_AGE, TANDEM_MODE_DEFAULT, SELECTION_DWELL_DEFAULT_MS, SELECTION_DWELL_MIN_MS, SELECTION_DWELL_MAX_MS, CHARS_PER_PAGE, LARGE_FILE_PAGE_THRESHOLD, VERY_LARGE_FILE_PAGE_THRESHOLD, CTRL_ROOM, Y_MAP_ANNOTATIONS, Y_MAP_AWARENESS, Y_MAP_USER_AWARENESS, Y_MAP_MODE, Y_MAP_DWELL_MS, Y_MAP_CHAT, Y_MAP_DOCUMENT_META, Y_MAP_ANNOTATION_REPLIES, Y_MAP_SAVED_AT_VERSION, Y_MAP_AUTHORSHIP, NOTIFICATION_BUFFER_SIZE, TUTORIAL_ANNOTATION_PREFIX, CHANNEL_EVENT_BUFFER_SIZE, CHANNEL_EVENT_BUFFER_AGE_MS, CHANNEL_SSE_KEEPALIVE_MS, TAURI_HOSTNAME;
 var init_constants = __esm({
   "src/shared/constants.ts"() {
     "use strict";
@@ -66,7 +66,9 @@ var init_constants = __esm({
     Y_MAP_DWELL_MS = "selectionDwellMs";
     Y_MAP_CHAT = "chat";
     Y_MAP_DOCUMENT_META = "documentMeta";
+    Y_MAP_ANNOTATION_REPLIES = "annotationReplies";
     Y_MAP_SAVED_AT_VERSION = "savedAtVersion";
+    Y_MAP_AUTHORSHIP = "authorship";
     NOTIFICATION_BUFFER_SIZE = 50;
     TUTORIAL_ANNOTATION_PREFIX = "tutorial-";
     CHANNEL_EVENT_BUFFER_SIZE = 200;
@@ -4305,9 +4307,15 @@ function generateMessageId() {
 function generateEventId() {
   return generateId("evt");
 }
+function generateReplyId() {
+  return generateId("rpl");
+}
 function generateNotificationId() {
   return generateId("ntf");
 }
+function generateAuthorshipId(author) {
+  return generateId(author);
+}
 var init_utils = __esm({
   "src/shared/utils.ts"() {
     "use strict";
@@ -8420,13 +8428,13 @@ var require_thenables = __commonJS({
         promise._captureStackTrace();
         if (context) context._popContext();
         var synchronous = true;
-        var result2 = util2.tryCatch(then).call(x, resolve2, reject2);
+        var result2 = util2.tryCatch(then).call(x, resolve3, reject2);
         synchronous = false;
         if (promise && result2 === errorObj2) {
           promise._rejectCallback(result2.e, true, true);
           promise = null;
         }
-        function resolve2(value) {
+        function resolve3(value) {
           if (!promise) return;
           promise._resolveCallback(value);
           promise = null;
@@ -8961,9 +8969,9 @@ var require_debuggability = __commonJS({
         return false;
       }
       Promise2.prototype._fireEvent = defaultFireEvent;
-      Promise2.prototype._execute = function(executor, resolve2, reject2) {
+      Promise2.prototype._execute = function(executor, resolve3, reject2) {
         try {
-          executor(resolve2, reject2);
+          executor(resolve3, reject2);
         } catch (e) {
           return e;
         }
@@ -8986,10 +8994,10 @@ var require_debuggability = __commonJS({
         ;
         ;
       };
-      function cancellationExecute(executor, resolve2, reject2) {
+      function cancellationExecute(executor, resolve3, reject2) {
         var promise = this;
         try {
-          executor(resolve2, reject2, function(onCancel) {
+          executor(resolve3, reject2, function(onCancel) {
             if (typeof onCancel !== "function") {
               throw new TypeError("onCancel must be a function, got: " + util2.toString(onCancel));
             }
@@ -12636,14 +12644,14 @@ var require_promises = __commonJS({
       });
     };
     function defer() {
-      var resolve2;
+      var resolve3;
       var reject2;
       var promise = new bluebird.Promise(function(resolveArg, rejectArg) {
-        resolve2 = resolveArg;
+        resolve3 = resolveArg;
         reject2 = rejectArg;
       });
       return {
-        resolve: resolve2,
+        resolve: resolve3,
         reject: reject2,
         promise
       };
@@ -15317,8 +15325,8 @@ var require_lib2 = __commonJS({
         return this;
       }
       var p = this.constructor;
-      return this.then(resolve3, reject3);
-      function resolve3(value) {
+      return this.then(resolve4, reject3);
+      function resolve4(value) {
         function yes() {
           return value;
         }
@@ -15471,8 +15479,8 @@ var require_lib2 = __commonJS({
       }
       return out;
     }
-    Promise2.resolve = resolve2;
-    function resolve2(value) {
+    Promise2.resolve = resolve3;
+    function resolve3(value) {
       if (value instanceof this) {
         return value;
       }
@@ -16004,10 +16012,10 @@ var require_utils = __commonJS({
       var promise = external.Promise.resolve(inputData).then(function(data) {
         var isBlob = support.blob && (data instanceof Blob || ["[object File]", "[object Blob]"].indexOf(Object.prototype.toString.call(data)) !== -1);
         if (isBlob && typeof FileReader !== "undefined") {
-          return new external.Promise(function(resolve2, reject2) {
+          return new external.Promise(function(resolve3, reject2) {
             var reader = new FileReader();
             reader.onload = function(e) {
-              resolve2(e.target.result);
+              resolve3(e.target.result);
             };
             reader.onerror = function(e) {
               reject2(e.target.error);
@@ -16562,7 +16570,7 @@ var require_StreamHelper = __commonJS({
       }
     }
     function accumulate(helper, updateCallback) {
-      return new external.Promise(function(resolve2, reject2) {
+      return new external.Promise(function(resolve3, reject2) {
         var dataArray = [];
         var chunkType = helper._internalType, resultType = helper._outputType, mimeType = helper._mimeType;
         helper.on("data", function(data, meta2) {
@@ -16576,7 +16584,7 @@ var require_StreamHelper = __commonJS({
         }).on("end", function() {
           try {
             var result2 = transformZipOutput(resultType, concat(chunkType, dataArray), mimeType);
-            resolve2(result2);
+            resolve3(result2);
           } catch (e) {
             reject2(e);
           }
@@ -22689,7 +22697,7 @@ var require_load = __commonJS({
     var Crc32Probe = require_Crc32Probe();
     var nodejsUtils = require_nodejsUtils();
     function checkEntryCRC32(zipEntry) {
-      return new external.Promise(function(resolve2, reject2) {
+      return new external.Promise(function(resolve3, reject2) {
         var worker = zipEntry.decompressed.getContentWorker().pipe(new Crc32Probe());
         worker.on("error", function(e) {
           reject2(e);
@@ -22697,7 +22705,7 @@ var require_load = __commonJS({
           if (worker.streamInfo.crc32 !== zipEntry.decompressed.crc32) {
             reject2(new Error("Corrupted zip : CRC32 mismatch"));
           } else {
-            resolve2();
+            resolve3();
           }
         }).resume();
       });
@@ -32462,10 +32470,10 @@ var require_path_is_absolute = __commonJS({
 var require_files = __commonJS({
   "node_modules/mammoth/lib/docx/files.js"(exports3) {
     "use strict";
-    var fs8 = __require("fs");
+    var fs9 = __require("fs");
     var url = __require("url");
     var os2 = __require("os");
-    var dirname3 = __require("path").dirname;
+    var dirname4 = __require("path").dirname;
     var resolvePath = __require("path").resolve;
     var isAbsolutePath = require_path_is_absolute();
     var promises = require_promises();
@@ -32480,7 +32488,7 @@ var require_files = __commonJS({
           }
         };
       }
-      var base = options.relativeToFile ? dirname3(options.relativeToFile) : null;
+      var base = options.relativeToFile ? dirname4(options.relativeToFile) : null;
       function read(uri, encoding) {
         return resolveUri(uri).then(function(path13) {
           return readFile(path13, encoding).caught(function(error2) {
@@ -32503,7 +32511,7 @@ var require_files = __commonJS({
         read
       };
     }
-    var readFile = promises.promisify(fs8.readFile.bind(fs8));
+    var readFile = promises.promisify(fs9.readFile.bind(fs9));
     function uriToPath(uriString, platform) {
       if (!platform) {
         platform = os2.platform();
@@ -35245,11 +35253,11 @@ var require_options_reader = __commonJS({
 var require_unzip = __commonJS({
   "node_modules/mammoth/lib/unzip.js"(exports3) {
     "use strict";
-    var fs8 = __require("fs");
+    var fs9 = __require("fs");
     var promises = require_promises();
     var zipfile = require_zipfile();
     exports3.openZip = openZip;
-    var readFile = promises.promisify(fs8.readFile);
+    var readFile = promises.promisify(fs9.readFile);
     function openZip(options) {
       if (options.path) {
         return readFile(options.path).then(zipfile.openArrayBuffer);
@@ -36360,14 +36368,14 @@ var callAll, id, isOneOf;
 var init_function = __esm({
   "node_modules/lib0/function.js"() {
     "use strict";
-    callAll = (fs8, args2, i = 0) => {
+    callAll = (fs9, args2, i = 0) => {
       try {
-        for (; i < fs8.length; i++) {
-          fs8[i](...args2);
+        for (; i < fs9.length; i++) {
+          fs9[i](...args2);
         }
       } finally {
-        if (i < fs8.length) {
-          callAll(fs8, args2, i + 1);
+        if (i < fs9.length) {
+          callAll(fs9, args2, i + 1);
         }
       }
     };
@@ -36909,17 +36917,17 @@ var init_yjs = __esm({
         this.isLoaded = false;
         this.isSynced = false;
         this.isDestroyed = false;
-        this.whenLoaded = create5((resolve2) => {
+        this.whenLoaded = create5((resolve3) => {
           this.on("load", () => {
             this.isLoaded = true;
-            resolve2(this);
+            resolve3(this);
           });
         });
-        const provideSyncedPromise = () => create5((resolve2) => {
+        const provideSyncedPromise = () => create5((resolve3) => {
           const eventHandler = (isSynced) => {
             if (isSynced === void 0 || isSynced === true) {
               this.off("sync", eventHandler);
-              resolve2();
+              resolve3();
             }
           };
           this.on("sync", eventHandler);
@@ -38392,15 +38400,15 @@ var init_yjs = __esm({
           sortAndMergeDeleteSet(ds);
           transaction.afterState = getStateVector(transaction.doc.store);
           doc.emit("beforeObserverCalls", [transaction, doc]);
-          const fs8 = [];
+          const fs9 = [];
           transaction.changed.forEach(
-            (subs, itemtype) => fs8.push(() => {
+            (subs, itemtype) => fs9.push(() => {
               if (itemtype._item === null || !itemtype._item.deleted) {
                 itemtype._callObserver(transaction, subs);
               }
             })
           );
-          fs8.push(() => {
+          fs9.push(() => {
             transaction.changedParentTypes.forEach((events, type2) => {
               if (type2._dEH.l.length > 0 && (type2._item === null || !type2._item.deleted)) {
                 events = events.filter(
@@ -38411,19 +38419,19 @@ var init_yjs = __esm({
                   event._path = null;
                 });
                 events.sort((event1, event2) => event1.path.length - event2.path.length);
-                fs8.push(() => {
+                fs9.push(() => {
                   callEventHandlerListeners(type2._dEH, events, transaction);
                 });
               }
             });
-            fs8.push(() => doc.emit("afterTransaction", [transaction, doc]));
-            fs8.push(() => {
+            fs9.push(() => doc.emit("afterTransaction", [transaction, doc]));
+            fs9.push(() => {
               if (transaction._needFormattingCleanup) {
                 cleanupYTextAfterTransaction(transaction);
               }
             });
           });
-          callAll(fs8, []);
+          callAll(fs9, []);
         } finally {
           if (doc.gc) {
             tryGcDeleteSet(ds, store, doc.gcFilter);
@@ -49042,10 +49050,10 @@ function resolveAll(constructs2, events, context) {
   const called = [];
   let index2 = -1;
   while (++index2 < constructs2.length) {
-    const resolve2 = constructs2[index2].resolveAll;
-    if (resolve2 && !called.includes(resolve2)) {
-      events = resolve2(events, context);
-      called.push(resolve2);
+    const resolve3 = constructs2[index2].resolveAll;
+    if (resolve3 && !called.includes(resolve3)) {
+      events = resolve3(events, context);
+      called.push(resolve3);
     }
   }
   return events;
@@ -55676,10 +55684,10 @@ var init_lib21 = __esm({
        * @returns {undefined}
        *   Nothing.
        */
-      set basename(basename) {
-        assertNonEmpty(basename, "basename");
-        assertPart(basename, "basename");
-        this.path = default2.join(this.dirname || "", basename);
+      set basename(basename2) {
+        assertNonEmpty(basename2, "basename");
+        assertPart(basename2, "basename");
+        this.path = default2.join(this.dirname || "", basename2);
       }
       /**
        * Get the parent path (example: `'~'`).
@@ -55700,9 +55708,9 @@ var init_lib21 = __esm({
        * @returns {undefined}
        *   Nothing.
        */
-      set dirname(dirname3) {
+      set dirname(dirname4) {
         assertPath(this.basename, "dirname");
-        this.path = default2.join(dirname3 || "", this.basename);
+        this.path = default2.join(dirname4 || "", this.basename);
       }
       /**
        * Get the extname (including dot) (example: `'.js'`).
@@ -56349,7 +56357,7 @@ var init_lib22 = __esm({
         assertParser("process", this.parser || this.Parser);
         assertCompiler("process", this.compiler || this.Compiler);
         return done ? executor(void 0, done) : new Promise(executor);
-        function executor(resolve2, reject2) {
+        function executor(resolve3, reject2) {
           const realFile = vfile(file);
           const parseTree = (
             /** @type {HeadTree extends undefined ? Node : HeadTree} */
@@ -56380,8 +56388,8 @@ var init_lib22 = __esm({
           function realDone(error2, file2) {
             if (error2 || !file2) {
               reject2(error2);
-            } else if (resolve2) {
-              resolve2(file2);
+            } else if (resolve3) {
+              resolve3(file2);
             } else {
               ok(done, "`done` is defined if `resolve` is not");
               done(void 0, file2);
@@ -56483,7 +56491,7 @@ var init_lib22 = __esm({
           file = void 0;
         }
         return done ? executor(void 0, done) : new Promise(executor);
-        function executor(resolve2, reject2) {
+        function executor(resolve3, reject2) {
           ok(
             typeof file !== "function",
             "`file` can\u2019t be a `done` anymore, we checked"
@@ -56497,8 +56505,8 @@ var init_lib22 = __esm({
             );
             if (error2) {
               reject2(error2);
-            } else if (resolve2) {
-              resolve2(resultingTree);
+            } else if (resolve3) {
+              resolve3(resultingTree);
             } else {
               ok(done, "`done` is defined if `resolve` is not");
               done(void 0, resultingTree, file2);
@@ -60809,8 +60817,8 @@ var require_lib7 = __commonJS({
       if (typeof cb2 !== "function") {
         opts = cb2;
         cb2 = null;
-        deferred = new this.Promise(function(resolve2, reject2) {
-          deferredResolve = resolve2;
+        deferred = new this.Promise(function(resolve3, reject2) {
+          deferredResolve = resolve3;
           deferredReject = reject2;
         });
       }
@@ -60958,17 +60966,17 @@ var require_lib7 = __commonJS({
       if (typeof cb2 === "function") {
         fnx(cb2);
       } else {
-        return new this.Promise(function(resolve2, reject2) {
+        return new this.Promise(function(resolve3, reject2) {
           if (fnx.length === 1) {
             fnx(function(err, ret2) {
               if (err) {
                 reject2(err);
               } else {
-                resolve2(ret2);
+                resolve3(ret2);
               }
             });
           } else {
-            resolve2(fnx());
+            resolve3(fnx());
           }
         });
       }
@@ -66729,7 +66737,7 @@ var init_hocuspocus_server_esm = __esm({
           process.on("SIGQUIT", signalHandler);
           process.on("SIGTERM", signalHandler);
         }
-        return new Promise((resolve2, reject2) => {
+        return new Promise((resolve3, reject2) => {
           var _a;
           (_a = this.server) === null || _a === void 0 ? void 0 : _a.httpServer.listen({
             port: this.configuration.port,
@@ -66745,7 +66753,7 @@ var init_hocuspocus_server_esm = __esm({
             };
             try {
               await this.hooks("onListen", onListenPayload);
-              resolve2(this);
+              resolve3(this);
             } catch (e) {
               reject2(e);
             }
@@ -66829,19 +66837,19 @@ var init_hocuspocus_server_esm = __esm({
        * Destroy the server
        */
       async destroy() {
-        await new Promise(async (resolve2) => {
+        await new Promise(async (resolve3) => {
           var _a, _b, _c, _d;
           (_b = (_a = this.server) === null || _a === void 0 ? void 0 : _a.httpServer) === null || _b === void 0 ? void 0 : _b.close();
           try {
             this.configuration.extensions.push({
               async afterUnloadDocument({ instance }) {
                 if (instance.getDocumentsCount() === 0)
-                  resolve2("");
+                  resolve3("");
               }
             });
             (_d = (_c = this.server) === null || _c === void 0 ? void 0 : _c.webSocketServer) === null || _d === void 0 ? void 0 : _d.close();
             if (this.getDocumentsCount() === 0)
-              resolve2("");
+              resolve3("");
             this.closeConnections();
           } catch (error2) {
             console.error(error2);
@@ -67181,6 +67189,440 @@ var init_provider = __esm({
   }
 });
 
+// node_modules/is-safe-filename/index.js
+function isSafeFilename(filename) {
+  if (typeof filename !== "string") {
+    return false;
+  }
+  const trimmed = filename.trim();
+  return trimmed !== "" && trimmed !== "." && trimmed !== ".." && !filename.includes("/") && !filename.includes("\\") && !filename.includes("\0");
+}
+function assertSafeFilename(filename) {
+  if (typeof filename !== "string") {
+    throw new TypeError("Expected a string");
+  }
+  if (!isSafeFilename(filename)) {
+    throw new Error(`Unsafe filename: ${JSON.stringify(filename)}`);
+  }
+}
+var unsafeFilenameFixtures;
+var init_is_safe_filename = __esm({
+  "node_modules/is-safe-filename/index.js"() {
+    "use strict";
+    unsafeFilenameFixtures = Object.freeze([
+      "",
+      "   ",
+      ".",
+      "..",
+      " .",
+      ". ",
+      " ..",
+      ".. ",
+      "../",
+      "../foo",
+      "foo/../bar",
+      "foo/bar",
+      "foo\\bar",
+      "foo\0bar"
+    ]);
+  }
+});
+
+// node_modules/env-paths/index.js
+import path3 from "path";
+import os from "os";
+import process2 from "process";
+function envPaths(name2, { suffix = "nodejs" } = {}) {
+  assertSafeFilename(name2);
+  if (suffix) {
+    name2 += `-${suffix}`;
+  }
+  assertSafeFilename(name2);
+  if (process2.platform === "darwin") {
+    return macos(name2);
+  }
+  if (process2.platform === "win32") {
+    return windows(name2);
+  }
+  return linux(name2);
+}
+var homedir, tmpdir, env2, macos, windows, linux;
+var init_env_paths = __esm({
+  "node_modules/env-paths/index.js"() {
+    "use strict";
+    init_is_safe_filename();
+    homedir = os.homedir();
+    tmpdir = os.tmpdir();
+    ({ env: env2 } = process2);
+    macos = (name2) => {
+      const library = path3.join(homedir, "Library");
+      return {
+        data: path3.join(library, "Application Support", name2),
+        config: path3.join(library, "Preferences", name2),
+        cache: path3.join(library, "Caches", name2),
+        log: path3.join(library, "Logs", name2),
+        temp: path3.join(tmpdir, name2)
+      };
+    };
+    windows = (name2) => {
+      const appData = env2.APPDATA || path3.join(homedir, "AppData", "Roaming");
+      const localAppData = env2.LOCALAPPDATA || path3.join(homedir, "AppData", "Local");
+      return {
+        // Data/config/cache/log are invented by me as Windows isn't opinionated about this
+        data: path3.join(localAppData, name2, "Data"),
+        config: path3.join(appData, name2, "Config"),
+        cache: path3.join(localAppData, name2, "Cache"),
+        log: path3.join(localAppData, name2, "Log"),
+        temp: path3.join(tmpdir, name2)
+      };
+    };
+    linux = (name2) => {
+      const username = path3.basename(homedir);
+      return {
+        data: path3.join(env2.XDG_DATA_HOME || path3.join(homedir, ".local", "share"), name2),
+        config: path3.join(env2.XDG_CONFIG_HOME || path3.join(homedir, ".config"), name2),
+        cache: path3.join(env2.XDG_CACHE_HOME || path3.join(homedir, ".cache"), name2),
+        // https://wiki.debian.org/XDGBaseDirectorySpecification#state
+        log: path3.join(env2.XDG_STATE_HOME || path3.join(homedir, ".local", "state"), name2),
+        temp: path3.join(tmpdir, username, name2)
+      };
+    };
+  }
+});
+
+// src/server/platform.ts
+import { execSync } from "child_process";
+import net from "net";
+import path4 from "path";
+function freePort(port) {
+  try {
+    if (process.platform === "win32") {
+      freePortWindows(port);
+    } else {
+      freePortUnix(port);
+    }
+  } catch (err) {
+    console.error(`[Tandem] freePort(${port}): ${err instanceof Error ? err.message : err}`);
+  }
+}
+async function waitForPort(port, timeoutMs = 5e3) {
+  const start = Date.now();
+  while (Date.now() - start < timeoutMs) {
+    if (await tryBind(port)) return;
+    await new Promise((r) => setTimeout(r, 200));
+  }
+  throw new Error(`Port ${port} still not available after ${timeoutMs}ms`);
+}
+function tryBind(port) {
+  return new Promise((resolve3, reject2) => {
+    const srv = net.createServer();
+    srv.once("error", (err) => {
+      srv.close(() => {
+        if (err.code === "EADDRINUSE") {
+          resolve3(false);
+        } else {
+          reject2(err);
+        }
+      });
+    });
+    srv.listen(port, "127.0.0.1", () => {
+      srv.close(() => resolve3(true));
+    });
+  });
+}
+function parseLsofPids(output) {
+  return output.trim().split("\n").map((line) => parseInt(line.trim(), 10)).filter((pid) => Number.isFinite(pid) && pid > 0);
+}
+function parseSsPid(output) {
+  const match = output.match(/pid=(\d+)/);
+  return match ? parseInt(match[1], 10) : null;
+}
+function freePortWindows(port) {
+  const out = execSync(`netstat -ano | findstr ":${port}.*LISTENING"`, {
+    encoding: "utf-8",
+    stdio: ["pipe", "pipe", "ignore"]
+  });
+  const pid = out.trim().split(/\s+/).at(-1);
+  if (pid && /^\d+$/.test(pid)) {
+    execSync(`taskkill /PID ${pid} /F`, { stdio: "ignore" });
+    console.error(`[Tandem] Killed stale PID ${pid} holding port ${port}`);
+  }
+}
+function freePortUnix(port) {
+  let pids = [];
+  try {
+    const out = execSync(`lsof -ti TCP:${port} -sTCP:LISTEN`, {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "ignore"]
+    });
+    pids = parseLsofPids(out);
+  } catch {
+    try {
+      const out = execSync(`ss -tlnp sport = :${port}`, {
+        encoding: "utf-8",
+        stdio: ["pipe", "pipe", "ignore"]
+      });
+      const pid = parseSsPid(out);
+      if (pid) pids = [pid];
+    } catch {
+    }
+  }
+  for (const pid of pids) {
+    try {
+      process.kill(pid, "SIGKILL");
+      console.error(`[Tandem] Killed stale PID ${pid} holding port ${port}`);
+    } catch {
+    }
+  }
+}
+var paths, SESSION_DIR, LAST_SEEN_VERSION_FILE;
+var init_platform = __esm({
+  "src/server/platform.ts"() {
+    "use strict";
+    init_env_paths();
+    paths = envPaths("tandem", { suffix: "" });
+    SESSION_DIR = path4.join(paths.data, "sessions");
+    LAST_SEEN_VERSION_FILE = path4.join(paths.data, "last-seen-version");
+  }
+});
+
+// src/server/session/manager.ts
+import fs from "fs/promises";
+import path5 from "path";
+async function atomicWrite(sessionPath, content3) {
+  const tmpPath = `${sessionPath}.tmp`;
+  await fs.writeFile(tmpPath, content3, "utf-8");
+  for (let attempt = 0; attempt < RENAME_MAX_RETRIES; attempt++) {
+    try {
+      await fs.rename(tmpPath, sessionPath);
+      return;
+    } catch (err) {
+      const code3 = err.code;
+      if ((code3 === "EPERM" || code3 === "EACCES") && attempt < RENAME_MAX_RETRIES - 1) {
+        await new Promise((r) => setTimeout(r, RENAME_RETRY_BASE_MS * 2 ** attempt));
+        continue;
+      }
+      await fs.unlink(tmpPath).catch(() => {
+      });
+      throw err;
+    }
+  }
+}
+function sessionKey(filePath) {
+  return encodeURIComponent(filePath.replace(/\\/g, "/"));
+}
+async function saveSession(filePath, format, doc) {
+  const key = sessionKey(filePath);
+  let sourceFileMtime = 0;
+  if (!filePath.startsWith("upload://")) {
+    try {
+      const stat = await fs.stat(filePath);
+      sourceFileMtime = stat.mtimeMs;
+    } catch {
+    }
+  }
+  const state = encodeStateAsUpdate(doc);
+  const ydocState = Buffer.from(state).toString("base64");
+  const data = {
+    filePath,
+    format,
+    ydocState,
+    sourceFileMtime,
+    lastAccessed: Date.now()
+  };
+  if (!sessionDirReady) {
+    await fs.mkdir(SESSION_DIR, { recursive: true });
+    sessionDirReady = true;
+  }
+  const sessionPath = path5.join(SESSION_DIR, `${key}.json`);
+  await atomicWrite(sessionPath, JSON.stringify(data));
+}
+async function loadSession(filePath) {
+  const key = sessionKey(filePath);
+  const sessionPath = path5.join(SESSION_DIR, `${key}.json`);
+  try {
+    const content3 = await fs.readFile(sessionPath, "utf-8");
+    return JSON.parse(content3);
+  } catch (err) {
+    const code3 = err.code;
+    if (code3 === "ENOENT") return null;
+    if (err instanceof SyntaxError) {
+      console.error(`[Tandem] Corrupted session file ${sessionPath}, removing:`, err.message);
+      await fs.unlink(sessionPath).catch((unlinkErr) => {
+        console.error(`[Tandem] Failed to remove corrupted session ${sessionPath}:`, unlinkErr);
+      });
+      return null;
+    }
+    console.error(`[Tandem] Failed to read session ${sessionPath}:`, err);
+    return null;
+  }
+}
+function restoreYDoc(doc, session) {
+  const state = Buffer.from(session.ydocState, "base64");
+  applyUpdate(doc, new Uint8Array(state));
+}
+async function sourceFileChanged(session) {
+  if (session.filePath.startsWith("upload://")) return false;
+  try {
+    const stat = await fs.stat(session.filePath);
+    return stat.mtimeMs !== session.sourceFileMtime;
+  } catch {
+    return true;
+  }
+}
+async function deleteSession(filePath) {
+  const key = sessionKey(filePath);
+  const sessionPath = path5.join(SESSION_DIR, `${key}.json`);
+  try {
+    await fs.unlink(sessionPath);
+  } catch (err) {
+    const code3 = err.code;
+    if (code3 !== "ENOENT") {
+      console.error(`[Tandem] deleteSession: failed to delete ${sessionPath}:`, err);
+    }
+  }
+}
+async function saveCtrlSession(doc) {
+  if (!sessionDirReady) {
+    await fs.mkdir(SESSION_DIR, { recursive: true });
+    sessionDirReady = true;
+  }
+  const chatMap = doc.getMap(Y_MAP_CHAT);
+  const entries = [];
+  chatMap.forEach((value, key) => {
+    const msg = value;
+    entries.push({ id: key, timestamp: msg.timestamp });
+  });
+  if (entries.length > 200) {
+    entries.sort((a, b) => a.timestamp - b.timestamp);
+    const toDelete = entries.slice(0, entries.length - 200);
+    doc.transact(() => {
+      for (const entry of toDelete) {
+        chatMap.delete(entry.id);
+      }
+    }, MCP_ORIGIN);
+  }
+  const state = encodeStateAsUpdate(doc);
+  const ydocState = Buffer.from(state).toString("base64");
+  const data = { ydocState, lastAccessed: Date.now() };
+  const sessionPath = path5.join(SESSION_DIR, `${CTRL_SESSION_KEY}.json`);
+  await atomicWrite(sessionPath, JSON.stringify(data));
+}
+async function loadCtrlSession() {
+  const sessionPath = path5.join(SESSION_DIR, `${CTRL_SESSION_KEY}.json`);
+  try {
+    const content3 = await fs.readFile(sessionPath, "utf-8");
+    const data = JSON.parse(content3);
+    return data.ydocState ?? null;
+  } catch (err) {
+    const code3 = err.code;
+    if (code3 === "ENOENT") return null;
+    if (err instanceof SyntaxError) {
+      console.error(`[Tandem] Corrupted ctrl session ${sessionPath}, removing:`, err.message);
+      await fs.unlink(sessionPath).catch((unlinkErr) => {
+        console.error(
+          `[Tandem] Failed to remove corrupted ctrl session ${sessionPath}:`,
+          unlinkErr
+        );
+      });
+      return null;
+    }
+    console.error(`[Tandem] Failed to read ctrl session:`, err);
+    return null;
+  }
+}
+function restoreCtrlDoc(doc, base64State) {
+  const state = Buffer.from(base64State, "base64");
+  applyUpdate(doc, new Uint8Array(state));
+}
+async function listSessionFilePaths() {
+  try {
+    await fs.mkdir(SESSION_DIR, { recursive: true });
+    const files2 = await fs.readdir(SESSION_DIR);
+    const results = [];
+    for (const file of files2) {
+      if (!file.endsWith(".json")) continue;
+      if (file === `${encodeURIComponent(CTRL_ROOM)}.json`) continue;
+      try {
+        const raw = await fs.readFile(path5.join(SESSION_DIR, file), "utf-8");
+        const data = JSON.parse(raw);
+        if (!data.filePath || data.filePath.startsWith("upload://")) continue;
+        results.push({ filePath: data.filePath, lastAccessed: data.lastAccessed ?? 0 });
+      } catch (err) {
+        console.error(`[Tandem] Skipping unreadable session file ${file}:`, err);
+      }
+    }
+    results.sort((a, b) => b.lastAccessed - a.lastAccessed);
+    return results;
+  } catch (err) {
+    console.error("[Tandem] Failed to read session directory:", err);
+    return [];
+  }
+}
+async function cleanupSessions() {
+  let cleaned = 0;
+  let files2;
+  try {
+    files2 = await fs.readdir(SESSION_DIR);
+  } catch (err) {
+    if (err.code === "ENOENT") return 0;
+    console.error("[Tandem] Failed to read session directory:", err);
+    return 0;
+  }
+  const now = Date.now();
+  for (const file of files2) {
+    try {
+      const filePath = path5.join(SESSION_DIR, file);
+      const stat = await fs.stat(filePath);
+      if (now - stat.mtimeMs > SESSION_MAX_AGE) {
+        await fs.unlink(filePath);
+        cleaned++;
+      }
+    } catch (err) {
+      console.error(`[Tandem] cleanupSessions: failed to process ${file}:`, err);
+    }
+  }
+  return cleaned;
+}
+function isAutoSaveRunning() {
+  return autoSaveTimer !== null;
+}
+function startAutoSave(callback) {
+  stopAutoSave();
+  autoSaveCallback = callback;
+  autoSaveTimer = setInterval(async () => {
+    try {
+      await autoSaveCallback?.();
+    } catch (err) {
+      console.error("[Tandem] Auto-save failed:", err);
+    }
+  }, AUTO_SAVE_INTERVAL);
+}
+function stopAutoSave() {
+  if (autoSaveTimer) {
+    clearInterval(autoSaveTimer);
+    autoSaveTimer = null;
+  }
+  autoSaveCallback = null;
+}
+var AUTO_SAVE_INTERVAL, RENAME_MAX_RETRIES, RENAME_RETRY_BASE_MS, sessionDirReady, CTRL_SESSION_KEY, autoSaveTimer, autoSaveCallback;
+var init_manager = __esm({
+  "src/server/session/manager.ts"() {
+    "use strict";
+    init_yjs();
+    init_constants();
+    init_queue();
+    init_platform();
+    AUTO_SAVE_INTERVAL = 60 * 1e3;
+    RENAME_MAX_RETRIES = 3;
+    RENAME_RETRY_BASE_MS = 50;
+    sessionDirReady = false;
+    CTRL_SESSION_KEY = CTRL_ROOM;
+    autoSaveTimer = null;
+    autoSaveCallback = null;
+  }
+});
+
 // src/server/file-io/docx-walker.ts
 function isElement3(node2) {
   return node2.type === "tag";
@@ -67960,23 +68402,23 @@ var init_docx_apply = __esm({
 });
 
 // src/server/file-io/index.ts
-import fs from "fs/promises";
-import path3 from "path";
+import fs2 from "fs/promises";
+import path6 from "path";
 function getAdapter(format) {
   return adapters[format] ?? plaintextAdapter;
 }
-async function atomicWrite(filePath, content3) {
-  const tempPath = path3.join(path3.dirname(filePath), `.tandem-tmp-${Date.now()}`);
-  await fs.writeFile(tempPath, content3, "utf-8");
-  await fs.rename(tempPath, filePath);
+async function atomicWrite2(filePath, content3) {
+  const tempPath = path6.join(path6.dirname(filePath), `.tandem-tmp-${Date.now()}`);
+  await fs2.writeFile(tempPath, content3, "utf-8");
+  await fs2.rename(tempPath, filePath);
 }
 async function atomicWriteBuffer(filePath, content3) {
-  const tempPath = path3.join(path3.dirname(filePath), `.tandem-tmp-${Date.now()}`);
-  await fs.writeFile(tempPath, content3);
+  const tempPath = path6.join(path6.dirname(filePath), `.tandem-tmp-${Date.now()}`);
+  await fs2.writeFile(tempPath, content3);
   try {
-    await fs.rename(tempPath, filePath);
+    await fs2.rename(tempPath, filePath);
   } catch (err) {
-    await fs.unlink(tempPath).catch(() => {
+    await fs2.unlink(tempPath).catch(() => {
     });
     throw err;
   }
@@ -68040,12 +68482,12 @@ var init_file_io = __esm({
 });
 
 // src/server/file-watcher.ts
-import fs2 from "fs";
+import fs3 from "fs";
 function watchFile(filePath, onChanged) {
   if (watched.has(filePath)) return;
   let watcher;
   try {
-    watcher = fs2.watch(filePath, (eventType) => {
+    watcher = fs3.watch(filePath, (eventType) => {
       if (eventType !== "change") return;
       const entry = watched.get(filePath);
       if (!entry) return;
@@ -68107,440 +68549,6 @@ var init_file_watcher = __esm({
   }
 });
 
-// node_modules/is-safe-filename/index.js
-function isSafeFilename(filename) {
-  if (typeof filename !== "string") {
-    return false;
-  }
-  const trimmed = filename.trim();
-  return trimmed !== "" && trimmed !== "." && trimmed !== ".." && !filename.includes("/") && !filename.includes("\\") && !filename.includes("\0");
-}
-function assertSafeFilename(filename) {
-  if (typeof filename !== "string") {
-    throw new TypeError("Expected a string");
-  }
-  if (!isSafeFilename(filename)) {
-    throw new Error(`Unsafe filename: ${JSON.stringify(filename)}`);
-  }
-}
-var unsafeFilenameFixtures;
-var init_is_safe_filename = __esm({
-  "node_modules/is-safe-filename/index.js"() {
-    "use strict";
-    unsafeFilenameFixtures = Object.freeze([
-      "",
-      "   ",
-      ".",
-      "..",
-      " .",
-      ". ",
-      " ..",
-      ".. ",
-      "../",
-      "../foo",
-      "foo/../bar",
-      "foo/bar",
-      "foo\\bar",
-      "foo\0bar"
-    ]);
-  }
-});
-
-// node_modules/env-paths/index.js
-import path4 from "path";
-import os from "os";
-import process2 from "process";
-function envPaths(name2, { suffix = "nodejs" } = {}) {
-  assertSafeFilename(name2);
-  if (suffix) {
-    name2 += `-${suffix}`;
-  }
-  assertSafeFilename(name2);
-  if (process2.platform === "darwin") {
-    return macos(name2);
-  }
-  if (process2.platform === "win32") {
-    return windows(name2);
-  }
-  return linux(name2);
-}
-var homedir, tmpdir, env2, macos, windows, linux;
-var init_env_paths = __esm({
-  "node_modules/env-paths/index.js"() {
-    "use strict";
-    init_is_safe_filename();
-    homedir = os.homedir();
-    tmpdir = os.tmpdir();
-    ({ env: env2 } = process2);
-    macos = (name2) => {
-      const library = path4.join(homedir, "Library");
-      return {
-        data: path4.join(library, "Application Support", name2),
-        config: path4.join(library, "Preferences", name2),
-        cache: path4.join(library, "Caches", name2),
-        log: path4.join(library, "Logs", name2),
-        temp: path4.join(tmpdir, name2)
-      };
-    };
-    windows = (name2) => {
-      const appData = env2.APPDATA || path4.join(homedir, "AppData", "Roaming");
-      const localAppData = env2.LOCALAPPDATA || path4.join(homedir, "AppData", "Local");
-      return {
-        // Data/config/cache/log are invented by me as Windows isn't opinionated about this
-        data: path4.join(localAppData, name2, "Data"),
-        config: path4.join(appData, name2, "Config"),
-        cache: path4.join(localAppData, name2, "Cache"),
-        log: path4.join(localAppData, name2, "Log"),
-        temp: path4.join(tmpdir, name2)
-      };
-    };
-    linux = (name2) => {
-      const username = path4.basename(homedir);
-      return {
-        data: path4.join(env2.XDG_DATA_HOME || path4.join(homedir, ".local", "share"), name2),
-        config: path4.join(env2.XDG_CONFIG_HOME || path4.join(homedir, ".config"), name2),
-        cache: path4.join(env2.XDG_CACHE_HOME || path4.join(homedir, ".cache"), name2),
-        // https://wiki.debian.org/XDGBaseDirectorySpecification#state
-        log: path4.join(env2.XDG_STATE_HOME || path4.join(homedir, ".local", "state"), name2),
-        temp: path4.join(tmpdir, username, name2)
-      };
-    };
-  }
-});
-
-// src/server/platform.ts
-import { execSync } from "child_process";
-import net from "net";
-import path5 from "path";
-function freePort(port) {
-  try {
-    if (process.platform === "win32") {
-      freePortWindows(port);
-    } else {
-      freePortUnix(port);
-    }
-  } catch (err) {
-    console.error(`[Tandem] freePort(${port}): ${err instanceof Error ? err.message : err}`);
-  }
-}
-async function waitForPort(port, timeoutMs = 5e3) {
-  const start = Date.now();
-  while (Date.now() - start < timeoutMs) {
-    if (await tryBind(port)) return;
-    await new Promise((r) => setTimeout(r, 200));
-  }
-  throw new Error(`Port ${port} still not available after ${timeoutMs}ms`);
-}
-function tryBind(port) {
-  return new Promise((resolve2, reject2) => {
-    const srv = net.createServer();
-    srv.once("error", (err) => {
-      srv.close(() => {
-        if (err.code === "EADDRINUSE") {
-          resolve2(false);
-        } else {
-          reject2(err);
-        }
-      });
-    });
-    srv.listen(port, "127.0.0.1", () => {
-      srv.close(() => resolve2(true));
-    });
-  });
-}
-function parseLsofPids(output) {
-  return output.trim().split("\n").map((line) => parseInt(line.trim(), 10)).filter((pid) => Number.isFinite(pid) && pid > 0);
-}
-function parseSsPid(output) {
-  const match = output.match(/pid=(\d+)/);
-  return match ? parseInt(match[1], 10) : null;
-}
-function freePortWindows(port) {
-  const out = execSync(`netstat -ano | findstr ":${port}.*LISTENING"`, {
-    encoding: "utf-8",
-    stdio: ["pipe", "pipe", "ignore"]
-  });
-  const pid = out.trim().split(/\s+/).at(-1);
-  if (pid && /^\d+$/.test(pid)) {
-    execSync(`taskkill /PID ${pid} /F`, { stdio: "ignore" });
-    console.error(`[Tandem] Killed stale PID ${pid} holding port ${port}`);
-  }
-}
-function freePortUnix(port) {
-  let pids = [];
-  try {
-    const out = execSync(`lsof -ti TCP:${port} -sTCP:LISTEN`, {
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "ignore"]
-    });
-    pids = parseLsofPids(out);
-  } catch {
-    try {
-      const out = execSync(`ss -tlnp sport = :${port}`, {
-        encoding: "utf-8",
-        stdio: ["pipe", "pipe", "ignore"]
-      });
-      const pid = parseSsPid(out);
-      if (pid) pids = [pid];
-    } catch {
-    }
-  }
-  for (const pid of pids) {
-    try {
-      process.kill(pid, "SIGKILL");
-      console.error(`[Tandem] Killed stale PID ${pid} holding port ${port}`);
-    } catch {
-    }
-  }
-}
-var paths, SESSION_DIR, LAST_SEEN_VERSION_FILE;
-var init_platform = __esm({
-  "src/server/platform.ts"() {
-    "use strict";
-    init_env_paths();
-    paths = envPaths("tandem", { suffix: "" });
-    SESSION_DIR = path5.join(paths.data, "sessions");
-    LAST_SEEN_VERSION_FILE = path5.join(paths.data, "last-seen-version");
-  }
-});
-
-// src/server/session/manager.ts
-import fs3 from "fs/promises";
-import path6 from "path";
-async function atomicWrite2(sessionPath, content3) {
-  const tmpPath = `${sessionPath}.tmp`;
-  await fs3.writeFile(tmpPath, content3, "utf-8");
-  for (let attempt = 0; attempt < RENAME_MAX_RETRIES; attempt++) {
-    try {
-      await fs3.rename(tmpPath, sessionPath);
-      return;
-    } catch (err) {
-      const code3 = err.code;
-      if ((code3 === "EPERM" || code3 === "EACCES") && attempt < RENAME_MAX_RETRIES - 1) {
-        await new Promise((r) => setTimeout(r, RENAME_RETRY_BASE_MS * 2 ** attempt));
-        continue;
-      }
-      await fs3.unlink(tmpPath).catch(() => {
-      });
-      throw err;
-    }
-  }
-}
-function sessionKey(filePath) {
-  return encodeURIComponent(filePath.replace(/\\/g, "/"));
-}
-async function saveSession(filePath, format, doc) {
-  const key = sessionKey(filePath);
-  let sourceFileMtime = 0;
-  if (!filePath.startsWith("upload://")) {
-    try {
-      const stat = await fs3.stat(filePath);
-      sourceFileMtime = stat.mtimeMs;
-    } catch {
-    }
-  }
-  const state = encodeStateAsUpdate(doc);
-  const ydocState = Buffer.from(state).toString("base64");
-  const data = {
-    filePath,
-    format,
-    ydocState,
-    sourceFileMtime,
-    lastAccessed: Date.now()
-  };
-  if (!sessionDirReady) {
-    await fs3.mkdir(SESSION_DIR, { recursive: true });
-    sessionDirReady = true;
-  }
-  const sessionPath = path6.join(SESSION_DIR, `${key}.json`);
-  await atomicWrite2(sessionPath, JSON.stringify(data));
-}
-async function loadSession(filePath) {
-  const key = sessionKey(filePath);
-  const sessionPath = path6.join(SESSION_DIR, `${key}.json`);
-  try {
-    const content3 = await fs3.readFile(sessionPath, "utf-8");
-    return JSON.parse(content3);
-  } catch (err) {
-    const code3 = err.code;
-    if (code3 === "ENOENT") return null;
-    if (err instanceof SyntaxError) {
-      console.error(`[Tandem] Corrupted session file ${sessionPath}, removing:`, err.message);
-      await fs3.unlink(sessionPath).catch((unlinkErr) => {
-        console.error(`[Tandem] Failed to remove corrupted session ${sessionPath}:`, unlinkErr);
-      });
-      return null;
-    }
-    console.error(`[Tandem] Failed to read session ${sessionPath}:`, err);
-    return null;
-  }
-}
-function restoreYDoc(doc, session) {
-  const state = Buffer.from(session.ydocState, "base64");
-  applyUpdate(doc, new Uint8Array(state));
-}
-async function sourceFileChanged(session) {
-  if (session.filePath.startsWith("upload://")) return false;
-  try {
-    const stat = await fs3.stat(session.filePath);
-    return stat.mtimeMs !== session.sourceFileMtime;
-  } catch {
-    return true;
-  }
-}
-async function deleteSession(filePath) {
-  const key = sessionKey(filePath);
-  const sessionPath = path6.join(SESSION_DIR, `${key}.json`);
-  try {
-    await fs3.unlink(sessionPath);
-  } catch (err) {
-    const code3 = err.code;
-    if (code3 !== "ENOENT") {
-      console.error(`[Tandem] deleteSession: failed to delete ${sessionPath}:`, err);
-    }
-  }
-}
-async function saveCtrlSession(doc) {
-  if (!sessionDirReady) {
-    await fs3.mkdir(SESSION_DIR, { recursive: true });
-    sessionDirReady = true;
-  }
-  const chatMap = doc.getMap(Y_MAP_CHAT);
-  const entries = [];
-  chatMap.forEach((value, key) => {
-    const msg = value;
-    entries.push({ id: key, timestamp: msg.timestamp });
-  });
-  if (entries.length > 200) {
-    entries.sort((a, b) => a.timestamp - b.timestamp);
-    const toDelete = entries.slice(0, entries.length - 200);
-    doc.transact(() => {
-      for (const entry of toDelete) {
-        chatMap.delete(entry.id);
-      }
-    }, MCP_ORIGIN);
-  }
-  const state = encodeStateAsUpdate(doc);
-  const ydocState = Buffer.from(state).toString("base64");
-  const data = { ydocState, lastAccessed: Date.now() };
-  const sessionPath = path6.join(SESSION_DIR, `${CTRL_SESSION_KEY}.json`);
-  await atomicWrite2(sessionPath, JSON.stringify(data));
-}
-async function loadCtrlSession() {
-  const sessionPath = path6.join(SESSION_DIR, `${CTRL_SESSION_KEY}.json`);
-  try {
-    const content3 = await fs3.readFile(sessionPath, "utf-8");
-    const data = JSON.parse(content3);
-    return data.ydocState ?? null;
-  } catch (err) {
-    const code3 = err.code;
-    if (code3 === "ENOENT") return null;
-    if (err instanceof SyntaxError) {
-      console.error(`[Tandem] Corrupted ctrl session ${sessionPath}, removing:`, err.message);
-      await fs3.unlink(sessionPath).catch((unlinkErr) => {
-        console.error(
-          `[Tandem] Failed to remove corrupted ctrl session ${sessionPath}:`,
-          unlinkErr
-        );
-      });
-      return null;
-    }
-    console.error(`[Tandem] Failed to read ctrl session:`, err);
-    return null;
-  }
-}
-function restoreCtrlDoc(doc, base64State) {
-  const state = Buffer.from(base64State, "base64");
-  applyUpdate(doc, new Uint8Array(state));
-}
-async function listSessionFilePaths() {
-  try {
-    await fs3.mkdir(SESSION_DIR, { recursive: true });
-    const files2 = await fs3.readdir(SESSION_DIR);
-    const results = [];
-    for (const file of files2) {
-      if (!file.endsWith(".json")) continue;
-      if (file === `${encodeURIComponent(CTRL_ROOM)}.json`) continue;
-      try {
-        const raw = await fs3.readFile(path6.join(SESSION_DIR, file), "utf-8");
-        const data = JSON.parse(raw);
-        if (!data.filePath || data.filePath.startsWith("upload://")) continue;
-        results.push({ filePath: data.filePath, lastAccessed: data.lastAccessed ?? 0 });
-      } catch (err) {
-        console.error(`[Tandem] Skipping unreadable session file ${file}:`, err);
-      }
-    }
-    results.sort((a, b) => b.lastAccessed - a.lastAccessed);
-    return results;
-  } catch (err) {
-    console.error("[Tandem] Failed to read session directory:", err);
-    return [];
-  }
-}
-async function cleanupSessions() {
-  let cleaned = 0;
-  let files2;
-  try {
-    files2 = await fs3.readdir(SESSION_DIR);
-  } catch (err) {
-    if (err.code === "ENOENT") return 0;
-    console.error("[Tandem] Failed to read session directory:", err);
-    return 0;
-  }
-  const now = Date.now();
-  for (const file of files2) {
-    try {
-      const filePath = path6.join(SESSION_DIR, file);
-      const stat = await fs3.stat(filePath);
-      if (now - stat.mtimeMs > SESSION_MAX_AGE) {
-        await fs3.unlink(filePath);
-        cleaned++;
-      }
-    } catch (err) {
-      console.error(`[Tandem] cleanupSessions: failed to process ${file}:`, err);
-    }
-  }
-  return cleaned;
-}
-function isAutoSaveRunning() {
-  return autoSaveTimer !== null;
-}
-function startAutoSave(callback) {
-  stopAutoSave();
-  autoSaveCallback = callback;
-  autoSaveTimer = setInterval(async () => {
-    try {
-      await autoSaveCallback?.();
-    } catch (err) {
-      console.error("[Tandem] Auto-save failed:", err);
-    }
-  }, AUTO_SAVE_INTERVAL);
-}
-function stopAutoSave() {
-  if (autoSaveTimer) {
-    clearInterval(autoSaveTimer);
-    autoSaveTimer = null;
-  }
-  autoSaveCallback = null;
-}
-var AUTO_SAVE_INTERVAL, RENAME_MAX_RETRIES, RENAME_RETRY_BASE_MS, sessionDirReady, CTRL_SESSION_KEY, autoSaveTimer, autoSaveCallback;
-var init_manager = __esm({
-  "src/server/session/manager.ts"() {
-    "use strict";
-    init_yjs();
-    init_constants();
-    init_queue();
-    init_platform();
-    AUTO_SAVE_INTERVAL = 60 * 1e3;
-    RENAME_MAX_RETRIES = 3;
-    RENAME_RETRY_BASE_MS = 50;
-    sessionDirReady = false;
-    CTRL_SESSION_KEY = CTRL_ROOM;
-    autoSaveTimer = null;
-    autoSaveCallback = null;
-  }
-});
-
 // src/server/mcp/file-opener.ts
 var file_opener_exports = {};
 __export(file_opener_exports, {
@@ -68654,7 +68662,7 @@ async function openFileByPath(filePath, options) {
   addDoc(id2, { id: id2, filePath: resolved, format, readOnly, source: "file" });
   setActiveDocId(id2);
   writeDocMeta(doc, id2, fileName, format, readOnly);
-  initSavedBaseline(doc);
+  await initSavedBaseline(doc, resolved);
   broadcastOpenDocs();
   ensureAutoSave();
   if (format !== "docx") {
@@ -68697,7 +68705,7 @@ async function openFileFromContent(fileName, content3) {
   addDoc(id2, { id: id2, filePath: syntheticPath, format, readOnly, source: "upload" });
   setActiveDocId(id2);
   writeDocMeta(doc, id2, fileName, format, readOnly);
-  initSavedBaseline(doc);
+  await initSavedBaseline(doc);
   broadcastOpenDocs();
   ensureAutoSave();
   return buildResult(doc, {
@@ -68735,6 +68743,8 @@ async function clearAndReload(id2, doc, filePath, format, existing) {
     doc.transact(() => {
       const annotations = doc.getMap(Y_MAP_ANNOTATIONS);
       annotations.forEach((_3, k) => annotations.delete(k));
+      const annotationReplies = doc.getMap(Y_MAP_ANNOTATION_REPLIES);
+      annotationReplies.forEach((_3, k) => annotationReplies.delete(k));
       const awareness = doc.getMap(Y_MAP_AWARENESS);
       awareness.forEach((_3, k) => awareness.delete(k));
       const userAwareness = doc.getMap(Y_MAP_USER_AWARENESS);
@@ -68769,9 +68779,14 @@ async function clearAndReload(id2, doc, filePath, format, existing) {
   });
   console.error(`[Tandem] clearAndReload: complete for ${id2}`);
 }
-function initSavedBaseline(doc) {
+async function initSavedBaseline(doc, filePath) {
+  let baseline = Date.now();
+  if (filePath) {
+    const stat = await fs4.stat(filePath).catch(() => null);
+    if (stat) baseline = stat.mtimeMs;
+  }
   const meta2 = doc.getMap(Y_MAP_DOCUMENT_META);
-  doc.transact(() => meta2.set(Y_MAP_SAVED_AT_VERSION, Date.now()), MCP_ORIGIN);
+  doc.transact(() => meta2.set(Y_MAP_SAVED_AT_VERSION, baseline), MCP_ORIGIN);
 }
 function writeDocMeta(doc, id2, fileName, format, readOnly) {
   const meta2 = doc.getMap(Y_MAP_DOCUMENT_META);
@@ -68894,6 +68909,7 @@ function ensureAutoSave() {
       const d = getOrCreateDocument(docId);
       await saveSession(state.filePath, state.format, d);
     }
+    await autoSaveAllToDisk();
   });
 }
 var reloadInProgress;
@@ -68922,6 +68938,7 @@ var init_file_opener = __esm({
 
 // src/server/mcp/document-service.ts
 import { randomUUID as randomUUID3 } from "crypto";
+import fs5 from "fs/promises";
 import path8 from "path";
 function getOpenDocs() {
   return openDocs;
@@ -68960,6 +68977,86 @@ function requireDocument(documentId) {
     docId: current.id
   };
 }
+async function saveDocumentToDisk(docId, source = "auto-save") {
+  const docState = openDocs.get(docId);
+  if (!docState) return { status: "skipped", reason: "Document not open" };
+  if (docState.source === "upload") {
+    return { status: "skipped", reason: "Upload-only document" };
+  }
+  if (docState.readOnly) {
+    return { status: "skipped", reason: "Read-only document" };
+  }
+  if (!AUTO_SAVE_FORMATS.has(docState.format)) {
+    return { status: "skipped", reason: `Format '${docState.format}' not eligible for disk save` };
+  }
+  const adapter = getAdapter(docState.format);
+  if (!adapter.canSave) {
+    return { status: "skipped", reason: "Adapter cannot save" };
+  }
+  if (savingDocs.has(docId)) {
+    return { status: "skipped", reason: "Save already in progress" };
+  }
+  savingDocs.add(docId);
+  try {
+    try {
+      const stat = await fs5.stat(docState.filePath);
+      const meta3 = getOrCreateDocument(docId).getMap(Y_MAP_DOCUMENT_META);
+      const lastSavedAt = meta3.get(Y_MAP_SAVED_AT_VERSION);
+      if (lastSavedAt && stat.mtimeMs > lastSavedAt + 1e3) {
+        return { status: "skipped", reason: "File modified externally" };
+      }
+    } catch (err) {
+      const code3 = err.code;
+      if (code3 === "ENOENT") {
+        return { status: "skipped", reason: "Source file no longer exists" };
+      }
+      console.error(`[AutoSave] Unexpected stat error for ${docState.filePath}:`, err);
+      return { status: "skipped", reason: `Cannot verify file state: ${code3}` };
+    }
+    const doc = getOrCreateDocument(docId);
+    const output = adapter.save(doc);
+    if (output == null) {
+      return { status: "skipped", reason: "Adapter returned null" };
+    }
+    suppressNextChange(docState.filePath);
+    await atomicWrite2(docState.filePath, output);
+    await saveSession(docState.filePath, docState.format, doc);
+    const meta2 = doc.getMap(Y_MAP_DOCUMENT_META);
+    doc.transact(() => meta2.set(Y_MAP_SAVED_AT_VERSION, Date.now()), MCP_ORIGIN);
+    return { status: "saved" };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    const errCode = err.code ?? "UNKNOWN";
+    pushNotification({
+      id: generateNotificationId(),
+      type: "save-error",
+      severity: "error",
+      message: `Save failed for ${path8.basename(docState.filePath)}: ${msg}`,
+      toolName: source,
+      errorCode: errCode,
+      documentId: docId,
+      dedupKey: `${source}:${docId}`,
+      timestamp: Date.now()
+    });
+    return { status: "error", reason: msg, errorCode: err.code };
+  } finally {
+    savingDocs.delete(docId);
+  }
+}
+async function autoSaveAllToDisk() {
+  for (const [docId, state] of openDocs) {
+    if (state.source === "upload" || state.readOnly) continue;
+    if (!AUTO_SAVE_FORMATS.has(state.format)) continue;
+    try {
+      const result2 = await saveDocumentToDisk(docId);
+      if (result2.status === "saved") {
+        console.error(`[AutoSave] Saved ${path8.basename(state.filePath)} to disk`);
+      }
+    } catch (err) {
+      console.error(`[AutoSave] Unexpected error saving ${state.filePath}:`, err);
+    }
+  }
+}
 function toDocListEntry(d) {
   return {
     id: d.id,
@@ -69002,13 +69099,13 @@ async function closeDocumentById(id2) {
   }
   const closedPath = docState.filePath;
   unwatchFile(docState.filePath);
+  savingDocs.delete(id2);
+  removeDoc(id2);
   try {
-    const doc = getOrCreateDocument(id2);
-    await saveSession(docState.filePath, docState.format, doc);
+    await deleteSession(docState.filePath);
   } catch (err) {
-    console.error(`[Tandem] Failed to save session before closing ${id2}:`, err);
+    console.error(`[Tandem] Failed to delete session for ${id2}:`, err);
   }
-  removeDoc(id2);
   if (getActiveDocId() === id2) {
     const remaining = Array.from(openDocs.keys());
     setActiveDocId(remaining.length > 0 ? remaining[0] : null);
@@ -69078,23 +69175,28 @@ async function restoreOpenDocuments(previousActiveDocId) {
   }
   return restoredCount;
 }
-var openDocs, activeDocId;
+var openDocs, activeDocId, savingDocs, AUTO_SAVE_FORMATS;
 var init_document_service = __esm({
   "src/server/mcp/document-service.ts"() {
     "use strict";
     init_constants();
+    init_utils();
     init_queue();
+    init_file_io();
     init_file_watcher();
+    init_notifications();
     init_manager();
     init_provider();
     openDocs = /* @__PURE__ */ new Map();
     setShouldKeepDocument((name2) => openDocs.has(name2) || name2 === CTRL_ROOM);
     activeDocId = null;
+    savingDocs = /* @__PURE__ */ new Set();
+    AUTO_SAVE_FORMATS = /* @__PURE__ */ new Set(["md", "txt"]);
   }
 });
 
 // src/server/mcp/convert.ts
-import fs5 from "fs/promises";
+import fs6 from "fs/promises";
 import path9 from "path";
 async function findAvailablePath(basePath) {
   const dir = path9.dirname(basePath);
@@ -69105,7 +69207,7 @@ async function findAvailablePath(basePath) {
   let counter = 0;
   while (counter <= MAX_ATTEMPTS) {
     try {
-      await fs5.access(candidate);
+      await fs6.access(candidate);
       counter++;
       candidate = path9.join(dir, `${name2}-${counter}${ext}`);
     } catch (err) {
@@ -69154,7 +69256,7 @@ async function convertToMarkdown(documentId, outputPath) {
       });
     }
     try {
-      const stat = await fs5.stat(resolvedOutput);
+      const stat = await fs6.stat(resolvedOutput);
       if (stat.isDirectory()) {
         const baseName = path9.basename(docState.filePath, path9.extname(docState.filePath));
         resolvedOutput = path9.join(resolvedOutput, `${baseName}.md`);
@@ -69168,7 +69270,7 @@ async function convertToMarkdown(documentId, outputPath) {
     resolvedOutput = path9.join(sourceDir, `${baseName}.md`);
   }
   resolvedOutput = await findAvailablePath(resolvedOutput);
-  await atomicWrite(resolvedOutput, markdown);
+  await atomicWrite2(resolvedOutput, markdown);
   try {
     const openResult = await openFileByPath(resolvedOutput);
     return {
@@ -69463,6 +69565,25 @@ function registerDocumentTools(server) {
             }
           }, MCP_ORIGIN);
         }
+        if (newText.length > 0) {
+          const newFrom = from3;
+          const newTo = toFlatOffset(newFrom + newText.length);
+          const anchored = anchoredRange(r.doc, newFrom, newTo);
+          if (anchored.ok) {
+            const authorshipMap = r.doc.getMap(Y_MAP_AUTHORSHIP);
+            const rangeId = generateAuthorshipId("claude");
+            const entry = {
+              id: rangeId,
+              author: "claude",
+              range: anchored.range,
+              relRange: anchored.fullyAnchored ? anchored.relRange : void 0,
+              timestamp: Date.now()
+            };
+            r.doc.transact(() => {
+              authorshipMap.set(rangeId, entry);
+            }, MCP_ORIGIN);
+          }
+        }
         return mcpSuccess({ edited: true, from: from3, to, newTextLength: newText.length });
       }
     )
@@ -69476,55 +69597,44 @@ function registerDocumentTools(server) {
     withErrorBoundary("tandem_save", async ({ documentId }) => {
       const r = requireDocument(documentId);
       if (!r) return noDocumentError();
-      try {
-        const docState = getCurrentDoc(documentId);
-        const format = docState?.format ?? "txt";
-        const readOnly = docState?.readOnly ?? false;
-        if (docState?.source === "upload") {
-          await saveSession(r.filePath, format, r.doc);
-          return mcpSuccess({
-            saved: true,
-            sessionOnly: true,
-            filePath: r.filePath,
-            message: "Session saved (annotations preserved). This file was uploaded \u2014 no disk path to save to."
-          });
-        }
-        const adapter = getAdapter(format);
-        if (readOnly || !adapter.canSave) {
-          await saveSession(r.filePath, format, r.doc);
-          return mcpSuccess({
-            saved: true,
-            sessionOnly: true,
-            filePath: r.filePath,
-            message: "Session saved (annotations preserved). Source file unchanged \u2014 document is read-only."
-          });
-        }
-        const output = adapter.save(r.doc);
-        suppressNextChange(r.filePath);
-        await atomicWrite(r.filePath, output);
+      const docState = getCurrentDoc(documentId);
+      const format = docState?.format ?? "txt";
+      const readOnly = docState?.readOnly ?? false;
+      if (docState?.source === "upload") {
         await saveSession(r.filePath, format, r.doc);
-        const meta2 = r.doc.getMap(Y_MAP_DOCUMENT_META);
-        r.doc.transact(() => meta2.set(Y_MAP_SAVED_AT_VERSION, Date.now()), MCP_ORIGIN);
+        return mcpSuccess({
+          saved: true,
+          sessionOnly: true,
+          filePath: r.filePath,
+          message: "Session saved (annotations preserved). This file was uploaded \u2014 no disk path to save to."
+        });
+      }
+      if (readOnly) {
+        await saveSession(r.filePath, format, r.doc);
+        return mcpSuccess({
+          saved: true,
+          sessionOnly: true,
+          filePath: r.filePath,
+          message: "Session saved (annotations preserved). Source file unchanged \u2014 document is read-only."
+        });
+      }
+      const result2 = await saveDocumentToDisk(r.docId, "mcp");
+      if (result2.status === "saved") {
         return mcpSuccess({ saved: true, filePath: r.filePath });
-      } catch (err) {
-        const errCode = err.code;
-        const msg = getErrorMessage(err);
-        pushNotification({
-          id: generateNotificationId(),
-          type: "save-error",
-          severity: "error",
-          message: `Save failed: ${msg}`,
-          toolName: "tandem_save",
-          errorCode: errCode ?? "UNKNOWN",
-          documentId: r.docId,
-          dedupKey: `save:${r.docId}`,
-          timestamp: Date.now()
+      }
+      if (result2.status === "skipped") {
+        await saveSession(r.filePath, format, r.doc);
+        return mcpSuccess({
+          saved: true,
+          sessionOnly: true,
+          filePath: r.filePath,
+          message: `Session saved. Disk save skipped: ${result2.reason}`
         });
-        if (errCode === "EACCES" || errCode === "EPERM") {
-          return mcpError("FILE_LOCKED", msg);
-        }
-        return mcpError("FORMAT_ERROR", `Save failed: ${msg}`);
       }
+      if (result2.errorCode === "EACCES" || result2.errorCode === "EPERM") {
+        return mcpError("FILE_LOCKED", result2.reason ?? "Save failed");
+      }
+      return mcpError("FORMAT_ERROR", result2.reason ?? "Save failed");
     })
   );
   server.tool(
@@ -69640,9 +69750,6 @@ var init_document2 = __esm({
     init_types3();
     init_utils();
     init_queue();
-    init_file_io();
-    init_file_watcher();
-    init_notifications();
     init_positions2();
     init_manager();
     init_provider();
@@ -69665,6 +69772,47 @@ function getDocAndAnnotations(documentId) {
   const ydoc = getOrCreateDocument(doc.docName);
   return { ydoc, map: ydoc.getMap(Y_MAP_ANNOTATIONS) };
 }
+function getRepliesMap(ydoc) {
+  return ydoc.getMap(Y_MAP_ANNOTATION_REPLIES);
+}
+function collectRepliesForAnnotation(repliesMap, annotationId) {
+  const replies = [];
+  repliesMap.forEach((value) => {
+    const reply = value;
+    if (reply && typeof reply === "object" && reply.annotationId === annotationId) {
+      replies.push(reply);
+    }
+  });
+  replies.sort((a, b) => a.timestamp - b.timestamp);
+  return replies;
+}
+function addReplyToAnnotation(ydoc, annotationsMap, annotationId, text5, author, origin) {
+  const raw = annotationsMap.get(annotationId);
+  if (!raw) return { ok: false, error: `Annotation ${annotationId} not found`, code: "NOT_FOUND" };
+  const ann = sanitizeAnnotation(raw);
+  if (ann.status !== "pending") {
+    return {
+      ok: false,
+      error: `Cannot reply to a ${ann.status} annotation`,
+      code: "ANNOTATION_RESOLVED"
+    };
+  }
+  const replyId = generateReplyId();
+  const reply = {
+    id: replyId,
+    annotationId,
+    author,
+    text: text5,
+    timestamp: Date.now()
+  };
+  const repliesMap = getRepliesMap(ydoc);
+  if (origin) {
+    ydoc.transact(() => repliesMap.set(replyId, reply), origin);
+  } else {
+    ydoc.transact(() => repliesMap.set(replyId, reply));
+  }
+  return { ok: true, replyId };
+}
 function rangeFailureMessage(result2) {
   if (result2.code === "RANGE_GONE") return "Target text no longer exists in the document.";
   if (result2.code === "RANGE_MOVED") return "Target text has moved.";
@@ -69906,7 +70054,15 @@ function registerAnnotationTools(server) {
       if (author) results = results.filter((a) => a.author === author);
       if (type2) results = results.filter((a) => a.type === type2);
       if (status) results = results.filter((a) => a.status === status);
-      return mcpSuccess({ annotations: results, count: results.length });
+      const repliesMap = getRepliesMap(da.ydoc);
+      const annotationsWithReplies = results.map((ann) => ({
+        ...ann,
+        replies: collectRepliesForAnnotation(repliesMap, ann.id)
+      }));
+      return mcpSuccess({
+        annotations: annotationsWithReplies,
+        count: annotationsWithReplies.length
+      });
     })
   );
   server.tool(
@@ -69942,7 +70098,16 @@ function registerAnnotationTools(server) {
       const da = getDocAndAnnotations(documentId);
       if (!da) return noDocumentError();
       if (!da.map.has(id2)) return mcpError("INVALID_RANGE", `Annotation ${id2} not found`);
-      da.ydoc.transact(() => da.map.delete(id2), MCP_ORIGIN);
+      da.ydoc.transact(() => {
+        da.map.delete(id2);
+        const repliesMap = getRepliesMap(da.ydoc);
+        const toDelete = [];
+        repliesMap.forEach((value, key) => {
+          const reply = value;
+          if (reply && reply.annotationId === id2) toDelete.push(key);
+        });
+        for (const key of toDelete) repliesMap.delete(key);
+      }, MCP_ORIGIN);
       return mcpSuccess({ removed: true, id: id2 });
     })
   );
@@ -70008,10 +70173,12 @@ function registerAnnotationTools(server) {
       if (!da) return noDocumentError();
       const annotations = refreshAllRanges(collectAnnotations(da.map), da.ydoc, da.map);
       const { ydoc } = da;
+      const repliesMap = getRepliesMap(ydoc);
       if (format === "json") {
         const fullText = extractText(ydoc);
         const enriched = annotations.map((ann) => ({
           ...ann,
+          replies: collectRepliesForAnnotation(repliesMap, ann.id),
           textSnippet: fullText.slice(
             Math.max(0, ann.range.from),
             Math.min(fullText.length, ann.range.to)
@@ -70023,6 +70190,32 @@ function registerAnnotationTools(server) {
       return mcpSuccess({ markdown, count: annotations.length });
     })
   );
+  server.tool(
+    "tandem_annotationReply",
+    "Reply to an annotation thread. Only works on pending annotations.",
+    {
+      annotationId: external_exports.string().describe("The annotation ID to reply to"),
+      text: external_exports.string().describe("Reply text"),
+      documentId: external_exports.string().optional().describe("Target document ID (defaults to active document)")
+    },
+    withErrorBoundary("tandem_annotationReply", async ({ annotationId, text: text5, documentId }) => {
+      const da = getDocAndAnnotations(documentId);
+      if (!da) return noDocumentError();
+      const result2 = addReplyToAnnotation(
+        da.ydoc,
+        da.map,
+        annotationId,
+        text5,
+        "claude",
+        MCP_ORIGIN
+      );
+      if (!result2.ok) {
+        const code3 = result2.code === "NOT_FOUND" ? "NOT_FOUND" : result2.code === "ANNOTATION_RESOLVED" ? "ANNOTATION_RESOLVED" : "INVALID_RANGE";
+        return mcpError(code3, result2.error);
+      }
+      return mcpSuccess({ replyId: result2.replyId, annotationId });
+    })
+  );
 }
 var SNAPSHOT_CAP;
 var init_annotations = __esm({
@@ -70074,6 +70267,8 @@ function getTrackableId(event) {
     case "annotation:accepted":
     case "annotation:dismissed":
       return event.payload.annotationId;
+    case "annotation:reply":
+      return event.payload.replyId;
     case "chat:message":
       return event.payload.messageId;
     default:
@@ -70182,6 +70377,32 @@ function attachObservers(docName, doc) {
   };
   annotationsMap.observe(annotationsObs);
   cleanups.push(() => annotationsMap.unobserve(annotationsObs));
+  const repliesMap = doc.getMap(Y_MAP_ANNOTATION_REPLIES);
+  const repliesObs = (event, txn) => {
+    if (txn.origin === MCP_ORIGIN) return;
+    for (const [key, change] of event.changes.keys) {
+      if (change.action !== "add") continue;
+      const reply = repliesMap.get(key);
+      if (!reply || reply.author !== "user") continue;
+      const parentAnn = annotationsMap.get(reply.annotationId);
+      const textSnippet = parentAnn?.textSnapshot ?? "";
+      pushEvent({
+        id: generateEventId(),
+        type: "annotation:reply",
+        timestamp: Date.now(),
+        documentId: docName,
+        payload: {
+          annotationId: reply.annotationId,
+          replyId: reply.id,
+          replyText: reply.text,
+          replyAuthor: reply.author,
+          textSnippet
+        }
+      });
+    }
+  };
+  repliesMap.observe(repliesObs);
+  cleanups.push(() => repliesMap.unobserve(repliesObs));
   const userAwareness = doc.getMap(Y_MAP_USER_AWARENESS);
   let selectionDwellTimer = null;
   const awarenessObs = (event, txn) => {
@@ -70192,19 +70413,16 @@ function attachObservers(docName, doc) {
         clearTimeout(selectionDwellTimer);
         selectionDwellTimer = null;
       }
-      if (!selection || selection.from === selection.to) return;
+      if (!selection || selection.from === selection.to) {
+        selectionBuffer.delete(docName);
+        return;
+      }
       selectionDwellTimer = setTimeout(() => {
         selectionDwellTimer = null;
-        pushEvent({
-          id: generateEventId(),
-          type: "selection:changed",
-          timestamp: Date.now(),
-          documentId: docName,
-          payload: {
-            from: selection.from,
-            to: selection.to,
-            selectedText: selection.selectedText ?? ""
-          }
+        selectionBuffer.set(docName, {
+          from: selection.from,
+          to: selection.to,
+          selectedText: selection.selectedText ?? ""
         });
       }, getDwellMs());
     }
@@ -70213,6 +70431,7 @@ function attachObservers(docName, doc) {
   cleanups.push(() => {
     userAwareness.unobserve(awarenessObs);
     if (selectionDwellTimer) clearTimeout(selectionDwellTimer);
+    selectionBuffer.delete(docName);
   });
   docObservers.set(docName, cleanups);
   console.error(`[EventQueue] Attached observers for document: ${docName}`);
@@ -70239,6 +70458,32 @@ function attachCtrlObservers() {
       if (change.action !== "add") continue;
       const msg = chatMap.get(key);
       if (!msg || msg.author !== "user") continue;
+      let selection;
+      if (msg.documentId) {
+        const buffered = selectionBuffer.get(msg.documentId);
+        if (buffered) {
+          selectionBuffer.delete(msg.documentId);
+          try {
+            const doc = getOrCreateDocument(msg.documentId);
+            const validation = validateRange(
+              doc,
+              buffered.from,
+              buffered.to
+            );
+            if (validation.ok) {
+              selection = buffered;
+            } else {
+              selection = { selectedText: buffered.selectedText };
+            }
+          } catch (err) {
+            console.warn(
+              `[EventQueue] Failed to validate buffered selection for doc=${msg.documentId}:`,
+              err
+            );
+            selection = { selectedText: buffered.selectedText };
+          }
+        }
+      }
       pushEvent({
         id: generateEventId(),
         type: "chat:message",
@@ -70248,7 +70493,8 @@ function attachCtrlObservers() {
           messageId: msg.id,
           text: msg.text,
           replyTo: msg.replyTo ?? null,
-          anchor: msg.anchor ?? null
+          anchor: msg.anchor ?? null,
+          ...selection ? { selection } : {}
         }
       });
     }
@@ -70317,17 +70563,19 @@ function attachCtrlObservers() {
 function reattachCtrlObservers() {
   attachCtrlObservers();
 }
-var MCP_ORIGIN, docObservers, emittedPayloadIds, buffer2, subscribers2, ctrlCleanups;
+var MCP_ORIGIN, docObservers, selectionBuffer, emittedPayloadIds, buffer2, subscribers2, ctrlCleanups;
 var init_queue = __esm({
   "src/server/events/queue.ts"() {
     "use strict";
     init_constants();
     init_annotations();
     init_document_service();
+    init_positions2();
     init_provider();
     init_types4();
     MCP_ORIGIN = "mcp";
     docObservers = /* @__PURE__ */ new Map();
+    selectionBuffer = /* @__PURE__ */ new Map();
     emittedPayloadIds = /* @__PURE__ */ new Map();
     buffer2 = [];
     subscribers2 = /* @__PURE__ */ new Set();
@@ -75722,10 +75970,10 @@ var require_raw_body = __commonJS({
       if (done) {
         return readStream(stream, encoding, length3, limit, wrap3(done));
       }
-      return new Promise(function executor(resolve2, reject2) {
+      return new Promise(function executor(resolve3, reject2) {
         readStream(stream, encoding, length3, limit, function onRead(err, buf) {
           if (err) return reject2(err);
-          resolve2(buf);
+          resolve3(buf);
         });
       });
     }
@@ -89060,12 +89308,12 @@ var require_view = __commonJS({
     "use strict";
     var debug = require_src()("express:view");
     var path13 = __require("path");
-    var fs8 = __require("fs");
-    var dirname3 = path13.dirname;
-    var basename = path13.basename;
+    var fs9 = __require("fs");
+    var dirname4 = path13.dirname;
+    var basename2 = path13.basename;
     var extname = path13.extname;
     var join4 = path13.join;
-    var resolve2 = path13.resolve;
+    var resolve3 = path13.resolve;
     module3.exports = View;
     function View(name2, options) {
       var opts = options || {};
@@ -89099,9 +89347,9 @@ var require_view = __commonJS({
       debug('lookup "%s"', name2);
       for (var i = 0; i < roots.length && !path14; i++) {
         var root3 = roots[i];
-        var loc = resolve2(root3, name2);
-        var dir = dirname3(loc);
-        var file = basename(loc);
+        var loc = resolve3(root3, name2);
+        var dir = dirname4(loc);
+        var file = basename2(loc);
         path14 = this.resolve(dir, file);
       }
       return path14;
@@ -89124,14 +89372,14 @@ var require_view = __commonJS({
       });
       sync = false;
     };
-    View.prototype.resolve = function resolve3(dir, file) {
+    View.prototype.resolve = function resolve4(dir, file) {
       var ext = this.ext;
       var path14 = join4(dir, file);
       var stat = tryStat(path14);
       if (stat && stat.isFile()) {
         return path14;
       }
-      path14 = join4(dir, basename(file, ext), "index" + ext);
+      path14 = join4(dir, basename2(file, ext), "index" + ext);
       stat = tryStat(path14);
       if (stat && stat.isFile()) {
         return path14;
@@ -89140,7 +89388,7 @@ var require_view = __commonJS({
     function tryStat(path14) {
       debug('stat "%s"', path14);
       try {
-        return fs8.statSync(path14);
+        return fs9.statSync(path14);
       } catch (e) {
         return void 0;
       }
@@ -91307,7 +91555,7 @@ var require_application = __commonJS({
     var compileETag = require_utils4().compileETag;
     var compileQueryParser = require_utils4().compileQueryParser;
     var compileTrust = require_utils4().compileTrust;
-    var resolve2 = __require("path").resolve;
+    var resolve3 = __require("path").resolve;
     var once = require_once();
     var Router = require_router();
     var slice2 = Array.prototype.slice;
@@ -91361,7 +91609,7 @@ var require_application = __commonJS({
       this.mountpath = "/";
       this.locals.settings = this.settings;
       this.set("view", View);
-      this.set("views", resolve2("views"));
+      this.set("views", resolve3("views"));
       this.set("jsonp callback name", "callback");
       if (env3 === "production") {
         this.enable("view cache");
@@ -92457,7 +92705,7 @@ var require_content_disposition = __commonJS({
     "use strict";
     module3.exports = contentDisposition;
     module3.exports.parse = parse4;
-    var basename = __require("path").basename;
+    var basename2 = __require("path").basename;
     var ENCODE_URL_ATTR_CHAR_REGEXP = /[\x00-\x20"'()*,/:;<=>?@[\\\]{}\x7f]/g;
     var HEX_ESCAPE_REGEXP = /%[0-9A-Fa-f]{2}/;
     var HEX_ESCAPE_REPLACE_REGEXP = /%([0-9A-Fa-f]{2})/g;
@@ -92492,9 +92740,9 @@ var require_content_disposition = __commonJS({
       if (typeof fallback === "string" && NON_LATIN1_REGEXP.test(fallback)) {
         throw new TypeError("fallback must be ISO-8859-1 string");
       }
-      var name2 = basename(filename);
+      var name2 = basename2(filename);
       var isQuotedString = TEXT_REGEXP.test(name2);
-      var fallbackName = typeof fallback !== "string" ? fallback && getlatin1(name2) : basename(fallback);
+      var fallbackName = typeof fallback !== "string" ? fallback && getlatin1(name2) : basename2(fallback);
       var hasFallback = typeof fallbackName === "string" && fallbackName !== name2;
       if (hasFallback || !isQuotedString || HEX_ESCAPE_REGEXP.test(name2)) {
         params2["filename*"] = name2;
@@ -92809,7 +93057,7 @@ var require_send = __commonJS({
     var escapeHtml = require_escape_html();
     var etag = require_etag();
     var fresh = require_fresh();
-    var fs8 = __require("fs");
+    var fs9 = __require("fs");
     var mime = require_mime_types();
     var ms = require_ms();
     var onFinished = require_on_finished();
@@ -92821,7 +93069,7 @@ var require_send = __commonJS({
     var extname = path13.extname;
     var join4 = path13.join;
     var normalize = path13.normalize;
-    var resolve2 = path13.resolve;
+    var resolve3 = path13.resolve;
     var sep = path13.sep;
     var BYTES_RANGE_REGEXP = /^ *bytes=/;
     var MAX_MAXAGE = 60 * 60 * 24 * 365 * 1e3;
@@ -92850,7 +93098,7 @@ var require_send = __commonJS({
       this._maxage = opts.maxAge || opts.maxage;
       this._maxage = typeof this._maxage === "string" ? ms(this._maxage) : Number(this._maxage);
       this._maxage = !isNaN(this._maxage) ? Math.min(Math.max(0, this._maxage), MAX_MAXAGE) : 0;
-      this._root = opts.root ? resolve2(opts.root) : null;
+      this._root = opts.root ? resolve3(opts.root) : null;
     }
     util2.inherits(SendStream, Stream);
     SendStream.prototype.error = function error2(status, err) {
@@ -92999,7 +93247,7 @@ var require_send = __commonJS({
           return res;
         }
         parts = normalize(path14).split(sep);
-        path14 = resolve2(path14);
+        path14 = resolve3(path14);
       }
       if (containsDotFile(parts)) {
         debug('%s dotfile "%s"', this._dotfiles, path14);
@@ -93091,7 +93339,7 @@ var require_send = __commonJS({
       var i = 0;
       var self2 = this;
       debug('stat "%s"', path14);
-      fs8.stat(path14, function onstat(err, stat) {
+      fs9.stat(path14, function onstat(err, stat) {
         var pathEndsWithSep = path14[path14.length - 1] === sep;
         if (err && err.code === "ENOENT" && !extname(path14) && !pathEndsWithSep) {
           return next(err);
@@ -93108,7 +93356,7 @@ var require_send = __commonJS({
         }
         var p = path14 + "." + self2._extensions[i++];
         debug('stat "%s"', p);
-        fs8.stat(p, function(err2, stat) {
+        fs9.stat(p, function(err2, stat) {
           if (err2) return next(err2);
           if (stat.isDirectory()) return next();
           self2.emit("file", p, stat);
@@ -93126,7 +93374,7 @@ var require_send = __commonJS({
         }
         var p = join4(path14, self2._index[i]);
         debug('stat "%s"', p);
-        fs8.stat(p, function(err2, stat) {
+        fs9.stat(p, function(err2, stat) {
           if (err2) return next(err2);
           if (stat.isDirectory()) return next();
           self2.emit("file", p, stat);
@@ -93138,7 +93386,7 @@ var require_send = __commonJS({
     SendStream.prototype.stream = function stream(path14, options) {
       var self2 = this;
       var res = this.res;
-      var stream2 = fs8.createReadStream(path14, options);
+      var stream2 = fs9.createReadStream(path14, options);
       this.emit("stream", stream2);
       stream2.pipe(res);
       function cleanup() {
@@ -93377,7 +93625,7 @@ var require_response = __commonJS({
     var cookie = require_cookie();
     var send = require_send();
     var extname = path13.extname;
-    var resolve2 = path13.resolve;
+    var resolve3 = path13.resolve;
     var vary = require_vary();
     var { Buffer: Buffer2 } = __require("buffer");
     var res = Object.create(http.ServerResponse.prototype);
@@ -93583,7 +93831,7 @@ var require_response = __commonJS({
       }
       opts = Object.create(opts);
       opts.headers = headers;
-      var fullPath = !opts.root ? resolve2(path14) : path14;
+      var fullPath = !opts.root ? resolve3(path14) : path14;
       return this.sendFile(fullPath, opts, done);
     };
     res.contentType = res.type = function contentType(type2) {
@@ -93832,7 +94080,7 @@ var require_serve_static = __commonJS({
     var encodeUrl = require_encodeurl();
     var escapeHtml = require_escape_html();
     var parseUrl = require_parseurl();
-    var resolve2 = __require("path").resolve;
+    var resolve3 = __require("path").resolve;
     var send = require_send();
     var url = __require("url");
     module3.exports = serveStatic;
@@ -93851,7 +94099,7 @@ var require_serve_static = __commonJS({
         throw new TypeError("option setHeaders must be function");
       }
       opts.maxage = opts.maxage || opts.maxAge || 0;
-      opts.root = resolve2(root3);
+      opts.root = resolve3(root3);
       var onDirectory = redirect ? createRedirectDirectoryListener() : createNotFoundDirectoryListener();
       return function serveStatic2(req, res, next) {
         if (req.method !== "GET" && req.method !== "HEAD") {
@@ -96928,7 +97176,7 @@ var require_compile = __commonJS({
       const schOrFunc = root3.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve2.call(this, root3, ref);
+      let _sch = resolve3.call(this, root3, ref);
       if (_sch === void 0) {
         const schema = (_a = root3.localRefs) === null || _a === void 0 ? void 0 : _a[ref];
         const { schemaId } = this.opts;
@@ -96955,7 +97203,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve2(root3, ref) {
+    function resolve3(root3, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -97530,7 +97778,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve2(baseURI, relativeURI, options) {
+    function resolve3(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const resolved = resolveComponent(parse4(baseURI, schemelessOptions), parse4(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
@@ -97757,7 +98005,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve2,
+      resolve: resolve3,
       resolveComponent,
       equal,
       serialize: serialize2,
@@ -100733,12 +100981,12 @@ var require_dist3 = __commonJS({
         throw new Error(`Unknown format "${name2}"`);
       return f;
     };
-    function addFormats(ajv, list4, fs8, exportName) {
+    function addFormats(ajv, list4, fs9, exportName) {
       var _a;
       var _b;
       (_a = (_b = ajv.opts.code).formats) !== null && _a !== void 0 ? _a : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list4)
-        ajv.addFormat(f, fs8[f]);
+        ajv.addFormat(f, fs9[f]);
     }
     module3.exports = exports3 = formatsPlugin;
     Object.defineProperty(exports3, "__esModule", { value: true });
@@ -100838,7 +101086,7 @@ var init_launcher = __esm({
 // src/server/index.ts
 init_constants();
 import path12 from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
+import { fileURLToPath as fileURLToPath5 } from "url";
 
 // src/server/error-filter.ts
 function isKnownHocuspocusError(err) {
@@ -100866,8 +101114,8 @@ init_file_opener();
 
 // src/server/mcp/server.ts
 import { existsSync as existsSync2 } from "fs";
-import { dirname as dirname2, join as join3 } from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
+import { dirname as dirname3, join as join3 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/server/express.js
 var import_express = __toESM(require_express2(), 1);
@@ -108970,7 +109218,7 @@ var Protocol = class {
           return;
         }
         const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1e3;
-        await new Promise((resolve2) => setTimeout(resolve2, pollInterval));
+        await new Promise((resolve3) => setTimeout(resolve3, pollInterval));
         options?.signal?.throwIfAborted();
       }
     } catch (error2) {
@@ -108987,7 +109235,7 @@ var Protocol = class {
    */
   request(request, resultSchema, options) {
     const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-    return new Promise((resolve2, reject2) => {
+    return new Promise((resolve3, reject2) => {
       const earlyReject = (error2) => {
         reject2(error2);
       };
@@ -109065,7 +109313,7 @@ var Protocol = class {
           if (!parseResult.success) {
             reject2(parseResult.error);
           } else {
-            resolve2(parseResult.data);
+            resolve3(parseResult.data);
           }
         } catch (error2) {
           reject2(error2);
@@ -109326,12 +109574,12 @@ var Protocol = class {
       }
     } catch {
     }
-    return new Promise((resolve2, reject2) => {
+    return new Promise((resolve3, reject2) => {
       if (signal.aborted) {
         reject2(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
         return;
       }
-      const timeoutId = setTimeout(resolve2, interval);
+      const timeoutId = setTimeout(resolve3, interval);
       signal.addEventListener("abort", () => {
         clearTimeout(timeoutId);
         reject2(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -110432,7 +110680,7 @@ var McpServer = class {
     let task = createTaskResult.task;
     const pollInterval = task.pollInterval ?? 5e3;
     while (task.status !== "completed" && task.status !== "failed" && task.status !== "cancelled") {
-      await new Promise((resolve2) => setTimeout(resolve2, pollInterval));
+      await new Promise((resolve3) => setTimeout(resolve3, pollInterval));
       const updatedTask = await extra.taskStore.getTask(taskId);
       if (!updatedTask) {
         throw new McpError(ErrorCode.InternalError, `Task ${taskId} not found during polling`);
@@ -111075,12 +111323,12 @@ var StdioServerTransport = class {
     this.onclose?.();
   }
   send(message) {
-    return new Promise((resolve2) => {
+    return new Promise((resolve3) => {
       const json = serializeMessage(message);
       if (this._stdout.write(json)) {
-        resolve2();
+        resolve3();
       } else {
-        this._stdout.once("drain", resolve2);
+        this._stdout.once("drain", resolve3);
       }
     });
   }
@@ -111557,7 +111805,7 @@ var responseViaResponseObject = async (res, outgoing, options = {}) => {
         });
         if (!chunk2) {
           if (i === 1) {
-            await new Promise((resolve2) => setTimeout(resolve2));
+            await new Promise((resolve3) => setTimeout(resolve3));
             maxReadCount = 3;
             continue;
           }
@@ -112057,9 +112305,9 @@ data:
       const initRequest = messages.find((m) => isInitializeRequest(m));
       const clientProtocolVersion = initRequest ? initRequest.params.protocolVersion : req.headers.get("mcp-protocol-version") ?? DEFAULT_NEGOTIATED_PROTOCOL_VERSION;
       if (this._enableJsonResponse) {
-        return new Promise((resolve2) => {
+        return new Promise((resolve3) => {
           this._streamMapping.set(streamId, {
-            resolveJson: resolve2,
+            resolveJson: resolve3,
             cleanup: () => {
               this._streamMapping.delete(streamId);
             }
@@ -112422,124 +112670,37 @@ init_annotations();
 // src/cli/setup.ts
 init_constants();
 import { randomUUID as randomUUID4 } from "crypto";
-import { existsSync, readFileSync } from "fs";
+import { existsSync, readFileSync as readFileSync2 } from "fs";
 import { copyFile, mkdir, rename, unlink, writeFile } from "fs/promises";
 import { homedir as homedir2 } from "os";
-import { dirname, join as join2, resolve } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { basename, dirname as dirname2, join as join2, resolve as resolve2 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
 
 // src/cli/skill-content.ts
-var SKILL_CONTENT = `---
-name: tandem
-description: >
-  Use when tandem_* MCP tools are available, the user asks about Tandem
-  document editing, or collaborative document review. Provides workflow
-  guidance, annotation strategy, and tool usage patterns for the Tandem
-  collaborative editor.
----
-
-# Tandem \u2014 Collaborative Document Editor
-
-Tandem lets you annotate and edit documents alongside the user in real time. The user sees your changes in a browser editor; you interact via the tandem_* MCP tool suite.
-
-## Hard Rules
-
-These prevent the most common failures. Follow them always.
-
-1. **Resolve before mutating.** Call \`tandem_resolveRange\` (or \`tandem_search\`) to get offsets before calling \`tandem_edit\`, \`tandem_highlight\`, \`tandem_comment\`, \`tandem_suggest\`, or \`tandem_flag\`. Never compute offsets by counting characters in previously-read text \u2014 they go stale when the user edits.
-2. **Pass \`textSnapshot\`.** Include the matched text as \`textSnapshot\` on mutations and annotations. If the text moved, the server returns \`RANGE_MOVED\` with relocated coordinates instead of corrupting the document.
-3. **Use \`tandem_getTextContent\`, not \`tandem_getContent\`.** \`getContent\` returns ProseMirror JSON and burns tokens. Use \`getTextContent({ section: "Section Name" })\` for targeted reads. The \`section\` parameter is case-insensitive.
-4. **\`tandem_edit\` cannot create paragraphs.** Newlines become literal characters. For multi-paragraph changes, use multiple \`tandem_edit\` calls or \`tandem_suggest\`.
-5. **\`.docx\` files are read-only.** Use annotations instead of \`tandem_edit\`. Offer \`tandem_convertToMarkdown\` if the user wants an editable copy.
-
-## Workflow
-
-Standard review sequence:
-
-1. \`tandem_status\` \u2014 check for already-open documents (sessions restore automatically)
-2. \`tandem_getOutline\` \u2014 understand document structure
-3. \`tandem_setStatus("Reviewing [section]...", { focusParagraph: N })\` \u2014 show progress (use \`index\` from outline)
-4. \`tandem_getTextContent({ section: "..." })\` \u2014 read one section at a time
-5. Annotate findings (see annotation guide below)
-6. \`tandem_checkInbox\` \u2014 check for user messages and actions
-7. Repeat steps 3-6 for each section
-8. \`tandem_save\` \u2014 persist edits to disk when done
-
-## Annotation Guide
-
-Choose the right type for each finding:
-
-- **\`tandem_highlight\`** \u2014 Visual marker with a short note. Colors: green (verified/good), red (problem), yellow (needs attention). Use when the finding is self-evident from the color and a brief note.
-- **\`tandem_comment\`** \u2014 Observation requiring explanation. Use when you need more than one sentence to convey reasoning.
-- **\`tandem_suggest\`** \u2014 Specific text replacement. **Prefer over comment when you can provide replacement text** \u2014 the user gets one-click accept/reject. Cannot create new paragraphs.
-- **\`tandem_flag\`** \u2014 Factual errors, compliance risks, missing required content. Signals a blocking issue the user must address before the document ships.
-
-**User-created types:** \`question\` annotation is created by users, not Claude. When you see a \`question\` in \`tandem_checkInbox\` or \`tandem_getAnnotations\`, respond with a \`tandem_comment\` on the same range or \`tandem_reply\` for conversational answers.
-
-## Collaboration Mode
-
-Check \`mode\` from \`tandem_status\` or \`tandem_checkInbox\` and adapt:
-
-- **Tandem** (\`"tandem"\`, default) \u2014 Full collaboration. Annotate freely and react to selections and document changes.
-- **Solo** (\`"solo"\`) \u2014 The user wants to write undisturbed. Only respond when the user sends a chat message. Do not proactively annotate or react to document activity.
-
-## Reacting to Document Events
-
-Selection events can reach you two ways. Over the real-time channel they arrive as notifications with \`meta.respond_via = "tandem_reply"\`. When polling via \`tandem_checkInbox\`, the current selection shows up under \`activity.selectedText\` (no \`meta\` field \u2014 that only exists on channel pushes). Either way, when the user holds a selection, briefly acknowledge what they highlighted via \`tandem_reply\` \u2014 don't annotate unless asked. Use \`tandem_reply\` for any document-context reaction (chat messages, selections, question annotations); reserve terminal output for non-document work the user explicitly requests. In Solo mode, hold reactions until the user sends a chat message.
-
-## Collaboration Etiquette
-
-- Check \`tandem_getActivity()\` before annotating near the user's cursor. If \`isTyping\` is true, wait for typing to stop before annotating that area.
-- Use \`tandem_setStatus\` to show what you're working on \u2014 the user sees it in the browser status bar.
-- **Call \`tandem_checkInbox\` every 2-3 tool calls**, not just at the end of a task. The real-time channel is often not connected; polling is the reliable path.
-- Reply to chat messages with \`tandem_reply\`, not annotations.
-
-## .docx Review Workflow
-
-1. \`tandem_open\` \u2014 opens in read-only mode (\`readOnly: true\`)
-2. \`tandem_getAnnotations({ author: "import" })\` \u2014 check for imported Word comments; read and act on them
-3. Annotate with findings (highlight, comment, suggest, flag)
-4. \`tandem_exportAnnotations\` \u2014 generate a review summary the user can share
-5. If the user wants editable text, offer \`tandem_convertToMarkdown\`
-
-## Error Recovery
-
-- **\`RANGE_MOVED\`** \u2014 Text shifted since you read it. The response includes \`resolvedFrom\`/\`resolvedTo\` \u2014 use those coordinates for your next call.
-- **\`RANGE_GONE\`** \u2014 The text was deleted. Re-read the section with \`tandem_getTextContent\` and re-assess.
-- **\`INVALID_RANGE\`** \u2014 You hit heading markup (e.g., \`## \`). Target text content only, not the heading prefix.
-- **\`FORMAT_ERROR\`** \u2014 Attempted \`tandem_edit\` on a read-only \`.docx\`. Use annotations instead.
-
-## Session Handoff
-
-When starting a new Claude session with Tandem already running:
-
-1. \`tandem_status()\` \u2014 check \`openDocuments\` array for restored sessions
-2. \`tandem_listDocuments()\` \u2014 see all open docs with details
-3. \`tandem_getOutline()\` \u2014 orient on the active document
-4. \`tandem_getAnnotations()\` \u2014 see what was already reviewed
-5. Continue where the previous session left off
-
-## Multi-Document
-
-When multiple documents are open, always pass \`documentId\` explicitly \u2014 omitting it targets the active document, which may have changed since your last call. Use \`tandem_listDocuments\` to see what's available. Cross-reference by reading both docs via \`tandem_getTextContent({ documentId: "..." })\` and annotating the relevant one.
-`;
+import { readFileSync } from "fs";
+import { dirname, resolve } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+var __dirname = dirname(fileURLToPath2(import.meta.url));
+var SKILL_PATH = resolve(__dirname, "../../skills/tandem/SKILL.md");
+var SKILL_CONTENT = readFileSync(SKILL_PATH, "utf-8");
 
 // src/cli/setup.ts
-var __dirname = dirname(fileURLToPath2(import.meta.url));
-var CHANNEL_DIST = resolve(__dirname, "../channel/index.js");
+var __dirname2 = dirname2(fileURLToPath3(import.meta.url));
+var PACKAGE_ROOT = resolve2(__dirname2, "../..");
+var CHANNEL_DIST = resolve2(PACKAGE_ROOT, "dist/channel/index.js");
 var MCP_URL = `http://localhost:${DEFAULT_MCP_PORT}`;
-function buildMcpEntries(channelPath, nodeBinary = "node") {
-  return {
-    tandem: {
-      type: "http",
-      url: `${MCP_URL}/mcp`
-    },
-    "tandem-channel": {
-      command: nodeBinary,
+function buildMcpEntries(channelPath, opts = {}) {
+  const entries = {
+    tandem: { type: "http", url: `${MCP_URL}/mcp` }
+  };
+  if (opts.withChannelShim) {
+    entries["tandem-channel"] = {
+      command: opts.nodeBinary ?? "node",
       args: [channelPath],
       env: { TANDEM_URL: MCP_URL }
-    }
-  };
+    };
+  }
+  return entries;
 }
 function detectTargets(opts = {}) {
   const home = opts.homeOverride ?? homedir2();
@@ -112570,7 +112731,7 @@ function detectTargets(opts = {}) {
   return targets;
 }
 async function atomicWrite3(content3, dest) {
-  const tmp = join2(dirname(dest), `.tandem-setup-${randomUUID4()}.tmp`);
+  const tmp = join2(dirname2(dest), `.tandem-setup-${randomUUID4()}.tmp`);
   await writeFile(tmp, content3, "utf-8");
   try {
     await rename(tmp, dest);
@@ -112591,14 +112752,23 @@ async function atomicWrite3(content3, dest) {
 async function applyConfig(configPath, entries) {
   let existing = {};
   try {
-    existing = JSON.parse(readFileSync(configPath, "utf-8"));
+    existing = JSON.parse(readFileSync2(configPath, "utf-8"));
   } catch (err) {
     const code3 = err.code;
     if (code3 === "ENOENT") {
     } else if (err instanceof SyntaxError) {
-      console.error(
-        `  Warning: ${configPath} contains malformed JSON \u2014 replacing with fresh config`
-      );
+      const backupPath = `${configPath}.broken-${Date.now()}`;
+      try {
+        await copyFile(configPath, backupPath);
+        console.error(
+          `  Warning: ${configPath} contains malformed JSON \u2014 backed up to ${basename(backupPath)}, replacing with fresh config`
+        );
+      } catch (copyErr) {
+        console.error(
+          `  Warning: ${configPath} contains malformed JSON and backup failed (${copyErr instanceof Error ? copyErr.message : copyErr}) \u2014 refusing to overwrite. Fix the JSON manually and rerun 'tandem setup'.`
+        );
+        throw copyErr;
+      }
     } else {
       throw err;
     }
@@ -112610,22 +112780,25 @@ async function applyConfig(configPath, entries) {
       ...entries
     }
   };
-  await mkdir(dirname(configPath), { recursive: true });
+  await mkdir(dirname2(configPath), { recursive: true });
   await atomicWrite3(JSON.stringify(updated, null, 2) + "\n", configPath);
 }
 async function installSkill(opts = {}) {
   const home = opts.homeOverride ?? homedir2();
   const skillPath = join2(home, ".claude", "skills", "tandem", "SKILL.md");
-  await mkdir(dirname(skillPath), { recursive: true });
+  await mkdir(dirname2(skillPath), { recursive: true });
   await atomicWrite3(SKILL_CONTENT, skillPath);
 }
 
 // src/server/mcp/api-routes.ts
 init_constants();
 init_types3();
+init_utils();
 init_notifications();
 init_provider();
+init_annotations();
 init_convert();
+init_document2();
 init_document_model();
 init_document_service();
 
@@ -112638,7 +112811,7 @@ init_annotations();
 init_document_model();
 init_document_service();
 init_response();
-import fs6 from "fs/promises";
+import fs7 from "fs/promises";
 import path10 from "path";
 async function applyChangesCore(documentId, author, backupPath) {
   const r = requireDocument(documentId);
@@ -112714,21 +112887,21 @@ async function applyChangesCore(documentId, author, backupPath) {
     throw Object.assign(new Error("No accepted suggestions to apply."), { code: "NO_SUGGESTIONS" });
   }
   const ydocFlatText = extractText(ydoc);
-  const buffer3 = await fs6.readFile(filePath);
+  const buffer3 = await fs7.readFile(filePath);
   const result2 = await applyTrackedChanges(buffer3, suggestions, {
     author: author ?? "Tandem Review",
     ydocFlatText
   });
   let resolvedBackup = backupPath ?? filePath.replace(/\.docx$/i, ".backup.docx");
   try {
-    await fs6.access(resolvedBackup);
+    await fs7.access(resolvedBackup);
     const ext = path10.extname(resolvedBackup);
     const base = resolvedBackup.slice(0, -ext.length);
     resolvedBackup = `${base}-${Date.now()}${ext}`;
   } catch {
   }
-  await fs6.copyFile(filePath, resolvedBackup);
-  const [origStat, backupStat] = await Promise.all([fs6.stat(filePath), fs6.stat(resolvedBackup)]);
+  await fs7.copyFile(filePath, resolvedBackup);
+  const [origStat, backupStat] = await Promise.all([fs7.stat(filePath), fs7.stat(resolvedBackup)]);
   if (origStat.size !== backupStat.size) {
     throw Object.assign(new Error("Backup verification failed: file sizes do not match."), {
       code: "BACKUP_FAILED"
@@ -112783,17 +112956,17 @@ function registerApplyTools(server) {
       const { filePath } = r;
       const backupPath = filePath.replace(/\.docx$/i, ".backup.docx");
       try {
-        await fs6.access(backupPath);
+        await fs7.access(backupPath);
       } catch (err) {
         if (err.code === "ENOENT") {
           return mcpError("FILE_NOT_FOUND", `No backup file found at ${backupPath}`);
         }
         throw err;
       }
-      await fs6.copyFile(backupPath, filePath);
+      await fs7.copyFile(backupPath, filePath);
       const [backupStat, restoredStat] = await Promise.all([
-        fs6.stat(backupPath),
-        fs6.stat(filePath)
+        fs7.stat(backupPath),
+        fs7.stat(filePath)
       ]);
       if (backupStat.size !== restoredStat.size) {
         throw new Error("Restore verification failed: file sizes do not match.");
@@ -112865,7 +113038,7 @@ async function runSetupHandler(input, homeOverride) {
     };
   }
   const targets = detectTargets({ homeOverride });
-  const entries = buildMcpEntries(channelPath, nodeBinary);
+  const entries = buildMcpEntries(channelPath, { withChannelShim: true, nodeBinary });
   const configured = [];
   const errors = [];
   for (const target of targets) {
@@ -112873,7 +113046,9 @@ async function runSetupHandler(input, homeOverride) {
       await applyConfig(target.configPath, entries);
       configured.push(target.label);
     } catch (err) {
-      errors.push(`${target.label}: ${err instanceof Error ? err.message : String(err)}`);
+      const msg = err instanceof Error ? err.message : String(err);
+      errors.push(`${target.label}: ${msg}`);
+      console.error(`[Setup] target=${target.label} failed: ${msg}`);
     }
   }
   let skillInstalled = false;
@@ -112881,10 +113056,17 @@ async function runSetupHandler(input, homeOverride) {
     await installSkill({ homeOverride });
     skillInstalled = true;
   } catch (err) {
-    errors.push(`Skill install: ${err instanceof Error ? err.message : String(err)}`);
-  }
+    const msg = err instanceof Error ? err.message : String(err);
+    errors.push(`Skill install: ${msg}`);
+    console.error(`[Setup] skill install failed: ${msg}`);
+  }
+  const totalFailed = configured.length === 0 && !skillInstalled;
+  const anyFailed = errors.length > 0;
+  let status = 200;
+  if (totalFailed) status = 500;
+  else if (anyFailed) status = 207;
   return {
-    status: 200,
+    status,
     body: { data: { targets, configured, errors, skillInstalled } }
   };
 }
@@ -113036,6 +113218,25 @@ function registerApiRoutes(app, largeBody) {
       sendApiError(res, err);
     }
   });
+  app.options("/api/save", apiMiddleware);
+  app.post("/api/save", apiMiddleware, largeBody, async (req, res) => {
+    const { documentId } = req.body ?? {};
+    if (documentId !== void 0 && typeof documentId !== "string") {
+      res.status(400).json({ error: "BAD_REQUEST", message: "documentId must be a string" });
+      return;
+    }
+    const targetId = documentId ?? getActiveDocId();
+    if (!targetId) {
+      res.status(404).json({ error: "NOT_FOUND", message: "No document to save." });
+      return;
+    }
+    try {
+      const result2 = await saveDocumentToDisk(targetId, "manual");
+      res.json({ data: result2 });
+    } catch (err) {
+      sendApiError(res, err);
+    }
+  });
   app.options("/api/upload", apiMiddleware);
   app.post("/api/upload", apiMiddleware, largeBody, async (req, res) => {
     const { fileName, content: content3 } = req.body ?? {};
@@ -113126,6 +113327,40 @@ function registerApiRoutes(app, largeBody) {
       });
     }
   });
+  app.options("/api/annotation-reply", apiMiddleware);
+  app.post("/api/annotation-reply", apiMiddleware, largeBody, (req, res) => {
+    const { annotationId, text: text5, documentId } = req.body ?? {};
+    if (!annotationId || typeof annotationId !== "string") {
+      res.status(400).json({ error: "BAD_REQUEST", message: "annotationId is required" });
+      return;
+    }
+    if (!text5 || typeof text5 !== "string") {
+      res.status(400).json({ error: "BAD_REQUEST", message: "text is required" });
+      return;
+    }
+    const doc = getCurrentDoc(typeof documentId === "string" ? documentId : void 0);
+    if (!doc) {
+      res.status(404).json({ error: "NOT_FOUND", message: "No document open" });
+      return;
+    }
+    const ydoc = getOrCreateDocument(doc.docName);
+    const annotationsMap = ydoc.getMap(Y_MAP_ANNOTATIONS);
+    const result2 = addReplyToAnnotation(ydoc, annotationsMap, annotationId, text5, "user");
+    if (!result2.ok) {
+      const status = result2.code === "ANNOTATION_RESOLVED" ? 409 : 404;
+      pushNotification({
+        id: generateNotificationId(),
+        type: "annotation-error",
+        severity: "error",
+        message: `Reply failed: ${result2.error}`,
+        dedupKey: `reply-error:${annotationId}`,
+        timestamp: Date.now()
+      });
+      res.status(status).json({ error: result2.code, message: result2.error });
+      return;
+    }
+    res.json({ data: { replyId: result2.replyId, annotationId } });
+  });
 }
 
 // src/server/mcp/awareness.ts
@@ -113381,7 +113616,7 @@ function registerChannelRoutes(app, apiMiddleware2) {
   app.get("/api/events", apiMiddleware2, sseHandler);
   app.options("/api/channel-awareness", apiMiddleware2);
   app.post("/api/channel-awareness", apiMiddleware2, (req, res) => {
-    const { documentId, status, active, focusParagraph } = req.body ?? {};
+    const { documentId, status, active, focusParagraph, focusOffset } = req.body ?? {};
     if (typeof status !== "string") {
       res.status(400).json({ error: "BAD_REQUEST", message: "status is required" });
       return;
@@ -113394,7 +113629,8 @@ function registerChannelRoutes(app, apiMiddleware2) {
         status,
         timestamp: Date.now(),
         active: active === true,
-        focusParagraph: typeof focusParagraph === "number" ? focusParagraph : null
+        focusParagraph: typeof focusParagraph === "number" ? focusParagraph : null,
+        focusOffset: typeof focusOffset === "number" ? focusOffset : null
       };
       doc.transact(() => awarenessMap.set("claude", state), MCP_ORIGIN);
     }
@@ -113602,29 +113838,34 @@ function registerNavigationTools(server) {
     {
       text: external_exports.string().describe("Status text"),
       focusParagraph: external_exports.number().optional().describe("Index of paragraph Claude is focusing on"),
+      focusOffset: external_exports.number().optional().describe("Flat character offset for precise cursor positioning within the document"),
       documentId: external_exports.string().optional().describe("Target document ID (defaults to active document)")
     },
-    withErrorBoundary("tandem_setStatus", async ({ text: text5, focusParagraph, documentId }) => {
-      const current = getCurrentDoc(documentId);
-      if (!current) {
-        return mcpSuccess({
-          status: text5,
-          warning: "No document open \u2014 status not broadcast to editor."
-        });
+    withErrorBoundary(
+      "tandem_setStatus",
+      async ({ text: text5, focusParagraph, focusOffset, documentId }) => {
+        const current = getCurrentDoc(documentId);
+        if (!current) {
+          return mcpSuccess({
+            status: text5,
+            warning: "No document open \u2014 status not broadcast to editor."
+          });
+        }
+        const doc = getOrCreateDocument(current.docName);
+        const awarenessMap = doc.getMap(Y_MAP_AWARENESS);
+        doc.transact(
+          () => awarenessMap.set("claude", {
+            status: text5,
+            timestamp: Date.now(),
+            active: true,
+            focusParagraph: focusParagraph ?? null,
+            focusOffset: focusOffset ?? null
+          }),
+          MCP_ORIGIN
+        );
+        return mcpSuccess({ status: text5 });
       }
-      const doc = getOrCreateDocument(current.docName);
-      const awarenessMap = doc.getMap(Y_MAP_AWARENESS);
-      doc.transact(
-        () => awarenessMap.set("claude", {
-          status: text5,
-          timestamp: Date.now(),
-          active: true,
-          focusParagraph: focusParagraph ?? null
-        }),
-        MCP_ORIGIN
-      );
-      return mcpSuccess({ status: text5 });
-    })
+    )
   );
   server.tool(
     "tandem_getContext",
@@ -113659,8 +113900,8 @@ try {
     `[Tandem] Could not read version from package.json: ${err instanceof Error ? err.message : err}`
   );
 }
-var __dirname2 = dirname2(fileURLToPath3(import.meta.url));
-var CLIENT_DIST = join3(__dirname2, "../client");
+var __dirname3 = dirname3(fileURLToPath4(import.meta.url));
+var CLIENT_DIST = join3(__dirname3, "../client");
 var mcpServer = null;
 var currentTransport = null;
 var connectingPromise = null;
@@ -113798,7 +114039,7 @@ async function startMcpServerHttp(port, host = "127.0.0.1") {
   } else {
     console.error(`[Tandem] No client dist at ${CLIENT_DIST} \u2014 run 'npm run build' first`);
   }
-  return new Promise((resolve2, reject2) => {
+  return new Promise((resolve3, reject2) => {
     const httpServer2 = app.listen(port, host, () => {
       httpServer2.removeListener("error", reject2);
       httpServer2.on("error", (err) => console.error("[Tandem] HTTP server error:", err));
@@ -113810,7 +114051,7 @@ async function startMcpServerHttp(port, host = "127.0.0.1") {
           console.error("[Tandem] Skipping browser open \u2014 no client assets found");
         }
       }
-      resolve2(httpServer2);
+      resolve3(httpServer2);
     });
     httpServer2.on("error", reject2);
   });
@@ -113899,12 +114140,12 @@ init_platform();
 init_manager();
 
 // src/server/version-check.ts
-import fs7 from "fs/promises";
+import fs8 from "fs/promises";
 import path11 from "path";
 async function checkVersionChange(currentVersion, versionFilePath) {
   let storedVersion = null;
   try {
-    storedVersion = (await fs7.readFile(versionFilePath, "utf-8")).trim();
+    storedVersion = (await fs8.readFile(versionFilePath, "utf-8")).trim();
   } catch (err) {
     if (err.code !== "ENOENT") {
       console.error("[Tandem] Failed to read last-seen-version:", err);
@@ -113912,8 +114153,8 @@ async function checkVersionChange(currentVersion, versionFilePath) {
   }
   const result2 = storedVersion === null ? "first-install" : storedVersion === currentVersion ? "current" : "upgraded";
   if (result2 !== "current") {
-    await fs7.mkdir(path11.dirname(versionFilePath), { recursive: true });
-    await fs7.writeFile(versionFilePath, currentVersion, "utf-8");
+    await fs8.mkdir(path11.dirname(versionFilePath), { recursive: true });
+    await fs8.writeFile(versionFilePath, currentVersion, "utf-8");
   }
   return result2;
 }
@@ -114028,7 +114269,7 @@ async function main2() {
     } catch (err) {
       console.error(`[Tandem] ${err instanceof Error ? err.message : err} \u2014 proceeding anyway`);
     }
-    const projectRoot = path12.resolve(path12.dirname(fileURLToPath4(import.meta.url)), "../..");
+    const projectRoot = path12.resolve(path12.dirname(fileURLToPath5(import.meta.url)), "../..");
     try {
       const versionStatus = await checkVersionChange(APP_VERSION, LAST_SEEN_VERSION_FILE);
       if (versionStatus === "upgraded") {