694 Commits

Author	SHA1	Message	Date
Michael Ramos	93b4a4a070	chore: bump version to 0.17.4	2026-04-08 16:20:24 -07:00
Michael Ramos	70dda029be	feat(sidebar): merge vault browser into files tab + UX polish (#526) ... * fix(annotate): add missing obsidian vault endpoints to annotate servers Both the Bun and Pi annotate servers were missing the three Obsidian reference endpoints (/api/obsidian/vaults, /api/reference/obsidian/files, /api/reference/obsidian/doc), making the vault browser unavailable in annotate mode. Added the handlers to both servers. For provenance purposes, this commit was AI assisted. * feat(sidebar): merge vault browser into files tab Vault is conceptually just another directory — same tree UI, same expand/collapse, same annotation counts. Rather than maintaining a parallel tab and hook, vault now appears as a collapsible section inside the Files tab alongside any other configured directories. Changes: - Add `isVault` flag to `DirState` and `addVaultDir()` to `useFileBrowser` — fetches from the Obsidian endpoint and stamps the dir so downstream code can route to the correct API - Remove `useVaultBrowser` hook and `VaultBrowser` component entirely - Remove `"vault"` from `SidebarTab` type - Update `App.tsx`: drop all parallel vault state; wire vault into the combined file browser fetch effect; update `handleFileBrowserSelect` to pick the right URL builder based on `isVault`; update `handleOpenLinkedDoc` and annotation count derivation to cover vault dirs via the same path - Fix sticky header lane: remove the `!linkedDocHook.isActive` gate that was suppressing sticky headers for linked docs and annotate mode - Remove primary border on linked doc viewer card - Add `ObsidianIcon` (full branded logo) and `ObsidianIconRaw` (compact purple mark) to `packages/ui/components/icons/ObsidianIcons.tsx` - Display `ObsidianIconRaw` in the FileBrowser directory header for vault dirs Net: -334 lines. One Files tab handles all directory types uniformly. For provenance purposes, this commit was AI assisted. * fix(sidebar): fix stale vault dirs and unrecoverable vault load failures Three issues identified in review: 1. Switching vault paths accumulated stale sections — addVaultDir now atomically replaces all existing vault dirs instead of appending, so changing the configured vault never leaves a ghost section behind. 2. Disabling the vault left the old section visible until reload — a new clearVaultDirs() method prunes all isVault entries, called via a dedicated effect that fires whenever vaultPath becomes empty. 3. Vault load failures were unrecoverable in-session — the Retry button only called fetchAll(regularDirs). FileBrowser now accepts an onRetryVaultDir prop and routes vault dir retries to addVaultDir (which re-fetches from the Obsidian endpoint) instead of the regular-dirs-only fetchAll. For provenance purposes, this commit was AI assisted.	2026-04-08 16:07:08 -07:00
Michael Ramos	2b4b556289	feat(themes): add Kanagawa Dragon, Wave, and Bones themes (#524) ... * feat(themes): add Kanagawa Dragon, Wave, and Bones themes Adds all three Kanagawa variants as dark-only themes, mapped from the official Ghostty color palette to the app's CSS variable schema. For provenance purposes, this commit was AI assisted. * fix(themes): sort Kanagawa themes into alphabetical position For provenance purposes, this commit was AI assisted. * feat(themes): replace Kanagawa Bones with Kanagawa Lotus Bones is a community derivative; Lotus is the official third variant from kanagawa.nvim. Light-only theme with yellow-tan paper background mapped from the canonical lotusWhite/lotusInk palette. For provenance purposes, this commit was AI assisted. * style(themes): standardize border radius to 0.625rem Replaces the previous defaults (0.5rem, 0.75rem, 1rem) with 0.625rem across all themes. Intentionally sharp themes preserved: Doom 64 (0px), Terminal (4px), Solar Dusk (0.3rem). For provenance purposes, this commit was AI assisted.	2026-04-08 14:56:40 -07:00
Michael Ramos	667eb12e8a	chore: bump version to 0.17.3 ... For provenance purposes, this commit was AI assisted.	2026-04-08 07:39:12 -07:00
Michael Ramos	9217297d78	fix(plan): hide repo/branch badges in sticky lane row layout ... The sticky header lane's row-layout DocBadges was rendering repo + branch + plan-diff badges. With hasPreviousVersion true, the unwrapped flex content exceeded availableForBar, causing the inline-flex flex-wrap container to snap to max-width and wrap internally — leaving an empty rounded rectangle extending under the right-side action buttons. Gate the repo/branch block on !isRow so the sticky lane only shows the plan-diff badge. Column layout (top-of-doc card) is unchanged. For provenance purposes, this commit was AI assisted.	2026-04-08 07:38:29 -07:00
Michael Ramos	ede9cb77d8	chore: bump version to 0.17.2 ... Includes bun.lock update for @pierre/diffs dep added in #509. For provenance purposes, this commit was AI assisted.	2026-04-08 07:07:41 -07:00
Michael Ramos	b3fc1f724f	fix(ui): render numerals for ordered list items (#520) ... * feat(parser): detect ordered list markers and compute display indices The block parser collapsed `*`, `-`, and `\d+.` markers into a single `list-item` block type, discarding ordered/unordered status. Add `ordered` + `orderedStart` to Block, capture the numeric marker in the list regex, and introduce `computeListIndices()` — a pure helper that walks a list group and assigns each ordered item a CommonMark-correct display number (sequential renumbering, streak break/restart on unordered items, deeper-level state truncation, top-level numbering preserved across nested children). 21 new unit tests cover both the parser changes and the indexing helper, including the tricky cases: `1./2./99.` renumbers as 1,2,3; sub-bullets between ordered items keep the top-level streak alive; nested ordered sublists number independently and reset between siblings; numeric checkboxes set both `ordered` and `checked`. For provenance purposes, this commit was AI assisted. * feat(ui): render numerals for ordered list items Branch the list-item marker span on `block.ordered`: render `${index}.` (with `tabular-nums` and a 1.5rem min-width to keep columns stable across single- and double-digit numerals) when the source marker was numeric, otherwise fall through to the existing `•`/`◦`/`▪` bullet symbols. Indices come from `computeListIndices()` called once per list group; `groupBlocks` is unchanged so mixed nested lists still share a single `data-pinpoint-group="list"` hover wrapper and annotation anchoring is unaffected. Checkbox items still take precedence over numerals. Adds a real-world manual fixture (06-ordered-list-plan.md) whose `## Verification` section exercises a 10-item ordered list, the case that originally surfaced the bug. For provenance purposes, this commit was AI assisted. * fix(parser): merge consecutive blockquote lines into one block Each `>` line was emitted as its own blockquote block, so the renderer's `my-4` margin produced visible gaps between every line of a multi-line quote (the parser had a literal TODO comment: "Check if previous was blockquote, if so, merge? No, separate for now"). Fix: append to the previous block when it's a blockquote and the prior line wasn't blank, mirroring the list-continuation pattern. A blank line still breaks the quote so two `>` runs separated by a blank line stay distinct. Adds 5 unit tests (merge, blank-line break, paragraph boundaries, single-line) and a manual fixture (07-blockquotes.md) covering the bug case, the blank-line-break case, sandwich-between-paragraphs, and inline markdown across merged lines. For provenance purposes, this commit was AI assisted. * fix(ui): address code review — diff view, task lists, blockquote paragraphs Three issues surfaced by PR review #520: 1. **Diff view flattened ordered lists to bullets.** PlanCleanDiffView's SimpleBlockRenderer duplicated Viewer's list-item JSX with hardcoded bullet symbols, so a denied+resubmitted plan with numbered steps showed numerals in the main view but `•` in the diff view — exactly the screen where "which step changed?" matters most. Fixed by threading computeListIndices through MarkdownChunk and sharing the marker rendering via a new ListMarker component used by both renderers, which also removes the root-cause duplication. 2. **Ordered task lists dropped their numbers.** `1. [ ] step` set both `ordered=true` and `checked=false` in the parser, but the renderer's checkbox branch took precedence and the numeral was never shown. GitHub renders `1. [ ]` as numeral + checkbox side by side; we now match that by rendering both glyphs in ListMarker when an ordered task list item appears. 3. **Multi-paragraph blockquotes collapsed.** After the blockquote-merge fix in the previous commit, `> a\n>\n> b` produced content `"a\n\nb"` but the renderer passed it straight to InlineMarkdown, which renders `\n\n` as whitespace — so two quoted paragraphs mashed into one line. Fixed by splitting blockquote content on `/\n\n+/` in both Viewer and PlanCleanDiffView and emitting one `<p>` child per paragraph. Adds one unit test for the multi-paragraph blockquote content shape and a manual fixture (08-ordered-edge-cases.md) covering ordered task lists, multi-paragraph quotes, nested-bullet counter preservation, double-digit alignment, and start-at-N numbering. The fourth review comment — loose ordered lists with intervening non-list blocks restarting numbering — is deferred. It requires parser-level loose-list detection (CommonMark's indented-continuation rule) and the bug only fires when users rely on lazy `1./1./1.` markers across a break. Tracked as a follow-up. For provenance purposes, this commit was AI assisted. * fix(parser): don't merge blockquote lines containing block-level markers Round-two review flagged a regression: `> 1. foo\n> 2. bar\n> 3. baz` was merging into one blockquote whose content was `"1. foo\n2. bar\n3. baz"`. The renderer split on `\n\n+` (paragraph breaks), found none, and emitted a single `<p>` — so `\n` collapsed to whitespace in HTML and the user saw `"1. foo 2. bar 3. baz"` as one run-on line. Worse than the pre-PR behavior (which at least kept each line in its own box). Pragmatic fix: don't merge a `>` line whose stripped content starts with a block-level marker (`*`, `-`, `\d+.`, `#`, `` ``` ``, `>`). Those stay as separate blockquote blocks so each marker line is visually distinct (legible, matching pre-PR behavior for quoted lists). Wrapped prose quotes — the original motivating case — still merge correctly because prose lines don't start with markers. Also check the PREVIOUS block's content for markers so a trailing prose line after a `> 1. item` doesn't glue onto the list-item block. 7 new unit tests cover: quoted ordered list stays separate, quoted unordered list stays separate, quoted heading stays separate, quoted code fence stays separate, nested blockquote stays separate, wrapped prose quote still merges (regression guard), and mixed prose+list where prose merges and list lines stay separate. Adds tests/test-fixtures/09-quoted-list-regression.md as a manual repro. Known follow-ups (tracked separately, not in this PR): - Consecutive separate blockquote blocks still get individual `my-4` margins, so a quoted list shows as stacked boxes with gaps between lines. The proper fix is recursive blockquote parsing (render the content as its own Block[] tree with an actual nested list inside the quote). Deferred — requires `children?: Block[]` on Block, parser rework, and exportAnnotations traversal changes. - Clean diff view renumbers ordered lists from the start of each diff chunk when users rely on CommonMark's lazy `1./1./1.` markers. Same power-user population as the earlier deferred loose-list case. - Pure code-hygiene items from the second review (non-list-block handling in computeListIndices, BULLET_BY_LEVEL modulo cycle, <ListGroup> extraction, CLAUDE.md Block interface drift, splitBlockquoteParagraphs helper) — batch into a follow-up cleanup. For provenance purposes, this commit was AI assisted.	2026-04-08 06:58:58 -07:00
Michael Ramos	c342ffbed7	feat(plan): simplify share/copy + sticky header polish (#519) ... * refactor(ui): simplify Quick Share/Copy to Share/Copy Rename "Quick Copy"/"Quick Share" buttons in AnnotationPanel to plain "Copy"/"Share" and route Share through the existing ExportModal so it benefits from the short-link path for large payloads. The naive clipboard.writeText fallback is gone. For provenance purposes, this commit was AI assisted. * feat(plan): coordinated sticky header label shrinking Replace fixed pixel reserves in the sticky ghost header with measured geometry: a ResizeObserver on the wrapper plus one on the Viewer's action button cluster (tagged with data-sticky-actions) computes the exact space available for the toolstrip + badges. Both sides shrink in coordination so they stay horizontally aligned as long as possible: plan area | right side | ghost bar | layout >= 800 | full labels | active labels | shared lane 680..800 | short labels | active labels | shared lane 500..680 | icons only | active labels | shared lane 340..500 | icons only | icon-only | shared lane < 340 | icons only | icon-only | stacked The label-mode bucket lives in App.tsx state so the tree re-renders at most twice per drag instead of every pixel. Sticky lane measurements snap to a 16px grid for the same reason. Switches the IntersectionObserver scroll root from <main> to the OverlayScrollArea viewport (via useScrollViewport) so the ghost bar actually appears at the right scroll position. AttachmentsButton's "Images" label now also collapses with the cluster. For provenance purposes, this commit was AI assisted. * fix(plan): float collapsed sidebar rail over the grid background Absolutely position the SidebarTabs rail and reclaim its 30px gutter with left padding on the OverlayScrollArea, so the bg-grid pattern paints edge-to-edge under the flags instead of starting to their right. The plan card lands in exactly the same place as before. For provenance purposes, this commit was AI assisted. * fix(plan): address PR review — mobile share, a11y, snap hoist - AnnotationPanel mobile Share was opening ExportModal (z-50) underneath the panel (z-[60]) and its backdrop (z-[59]), creating a dead-end on mobile. Close the panel before opening the share modal. - AttachmentsButton trigger had no accessible name when hideLabel was active and there were no images yet. Add aria-label + title. - Hoist StickyHeaderLane's snap() to module scope so the effects (which use [] deps) can't close over a stale per-render instance. Currently harmless since snap is pure, but removes a footgun. For provenance purposes, this commit was AI assisted. * fix(plan): address PR review round 2 - StickyHeaderLane's [data-sticky-actions] ResizeObserver had [] deps and was attached at mount, but Viewer is keyed by linkedDocHook state and remounts on linked-doc toggle. The observer would stay bound to the now-detached old node and freeze actionsWidth, leaving the bar's geometry permanently wrong. Add a remountToken prop threaded from App.tsx so the effect re-queries against the fresh DOM. - Restore the shareUrl gate on the AnnotationPanel Share action — only pass onShare when a URL has been generated, matching prior behavior. - Hoist StickyHeaderLane's layout constants (LEFT_OFFSET, GAP, WIDE_BAR_WIDTH, MIN_BAR_WIDTH) to module scope alongside snap, for consistency. For provenance purposes, this commit was AI assisted. * fix(plan): address PR review round 3 — polish glitches - snap() uses Math.floor instead of Math.round so the wrapper width undershoots and the actions width overshoots, both pushing toward a more cautious layout. Avoids a one-bucket overlap flash right at the 300/460 thresholds during a slow drag. - Reset actionsWidth to 0 at the top of the [remountToken] effect so the bar falls back to the safe unmeasured path for the one frame between Viewer remounting and the new observer's first callback. - App.tsx switches to useLayoutEffect + a synchronous getBoundingClientRect to set the initial actionsLabelMode bucket before paint. Eliminates the one-frame flash of full labels on narrow viewports during first render. For provenance purposes, this commit was AI assisted.	2026-04-07 23:19:39 -07:00
Michael Ramos	ed254cf3bd	Supply-chain hardening: version pinning, SLSA attestations, fix #506 (#512) ... * feat(install): supply-chain hardening (#507) + fix Gemini crash on Windows (#506) Closes #507 items 1-2 and fixes #506. Issue #507 asked for version-pinned installs from a trusted source, immutable releases, and build-provenance attestations. This commit ships: - `--version v0.X.Y` / positional / `-Version` flag across all three installers (bash, PowerShell, cmd) so users can pin to reviewed versions. Default stays `latest` — every existing `curl | bash` / `irm | iex` invocation works unchanged. install.cmd gained `--version` as an alias to its existing positional form for surface-area consistency. - SLSA build provenance attestations via `actions/attest-build-provenance` (SHA-pinned to v4.1.0) in release.yml. Covers all 10 compiled binaries (5 plannotator + 5 paste-service). Top-level workflow permissions tightened from `contents: write` to `contents: read`, with per-job overrides where needed. Attestation step is gated on tag pushes so PR dry-runs don't pollute Sigstore's transparency log. - Opt-in provenance verification in all three installers, resolved via a three-layer precedence ladder: 1. CLI flag `--verify-attestation` / `-VerifyAttestation` 2. Env var `PLANNOTATOR_VERIFY_ATTESTATION=1` 3. Config `~/.plannotator/config.json` → `verifyAttestation: true` 4. Default off Off-by-default matches every major ecosystem installer (rustup, brew, bun, deno, helm) and avoids a UX failure for the majority of users who don't have `gh` installed or authenticated. Security-conscious users get three ergonomic opt-in paths. When enabled, the installer hard-fails if `gh` is missing so opt-in is never silently skipped. - `PlannotatorConfig.verifyAttestation?: boolean` added to `packages/shared/config.ts`. Pure additive schema change; no runtime consumer exists (the field is read only by the install scripts). No UI surface — this is an OS-level power-user knob only. - Documentation rewritten in README.md, apps/hook/README.md, and the marketing install page with both pinned-version examples and a "Verifying your install" section covering manual `gh attestation verify` and offline `cosign verify-blob` paths. - Release skill updated to note that the release pipeline now emits SLSA attestations and (post-merge) GitHub Immutable Releases will be enabled on the repo. Issue #506 (install.cmd crash on Windows when Gemini is present): Root cause was cmd.exe's `setlocal enabledelayedexpansion` eating `!` chars in the embedded `node -e "..."` Gemini settings merge script. Cmd's Phase 2 parser treated `!s.hooks)s.hooks={};if(!` as a variable expansion, corrupting the JS before node saw it. Fixed by rewriting the JS to use the `||` idiom (`s.hooks = s.hooks || {}`) which contains no `!` characters — semantically identical, and sidesteps cmd's parser entirely with no escape gymnastics and no new dependencies. Added regression test in scripts/install.test.ts that asserts the `||` form is present and `if(!s.hooks)` is absent, so re-introducing the bug would fail CI. Test suite expanded from 23 to 29 tests covering: - Gemini #506 regression - Three-layer opt-in wiring assertions for all three installers - install.sh guard check (the executable `gh attestation verify` call must live behind the `verify_attestation -eq 1` gate, so the default path never invokes gh) - PlannotatorConfig schema assertion Out of scope (tracked): - Immutable Releases toggle in repo Settings (one-click, post-merge). - SLSA Build L3 via `slsa-framework/slsa-github-generator` (requires restructuring release.yml around a reusable workflow). - Issue #507 item 3: UI update-cooldown setting. For provenance purposes, this commit was AI assisted. * fix(install): address PR #512 review feedback - docs: drop broken `cosign verify-blob` example. Verified against Sigstore's docs that `cosign verify-blob` requires `--bundle` (or `--signature` + `--certificate`); the shipped command provided neither and could not have worked. Replaced with the canonical `gh attestation verify --repo` flow (gh + auth required, but optional — only needed if a user wants to manually audit provenance) and a link to GitHub's offline-verification docs for advanced workflows. Applied to README.md, apps/hook/README.md, and the marketing install page. - docs: list per-platform binary paths in the manual verification examples. The previous snippets hardcoded `~/.local/bin/plannotator` even though install.ps1 writes to `%LOCALAPPDATA%\plannotator\` and install.cmd writes to `%USERPROFILE%\.local\bin\` — Windows users copying the snippet got file-not-found instead of a verification result. - install.sh: capture and surface `gh attestation verify` stderr on failure instead of redirecting to /dev/null. Diagnosability matches install.ps1, which already prints `$verifyOutput` on failure. The most common failure mode (`gh auth login` not run) is now immediately actionable instead of presenting as a generic "verification failed" error. - install.cmd: reject any unknown dash-prefixed token before the positional fall-through. A typoed `--verify-attesttion` no longer becomes `VERSION=--verify-attesttion` and 404s on a nonsensical download URL — it fails fast with `Unknown option:` and a usage hint. install.sh and install.ps1 already had equivalent guards (case `-*)` arm and PowerShell's strict param block respectively). All 29 install tests still pass. For provenance purposes, this commit was AI assisted. * test(ci): add Windows integration job for install.cmd Address the reviewer gap flagged in PR #512: the unit tests in scripts/install.test.ts only do file-content string matching on Linux and never execute cmd.exe, so the #506 fix (rewriting the embedded `node -e` Gemini merge to use `x = x || {}` instead of `if(!x)x=...`) was shipped without any runtime coverage. The previous CI only had ubuntu-latest runners. New `install-cmd-windows` job on `windows-latest`: 1. Seeds a fake `~/.gemini/settings.json` with a pre-existing non- plannotator hook plus unrelated top-level keys (theme, general). The fixture mirrors the shape of a real Gemini settings.json but uses only obviously-fake values and contains no secrets. 2. Runs `scripts\install.cmd v0.17.1 --skip-attestation` end-to-end through real cmd.exe. This exercises the parser under `enabledelayedexpansion`, the embedded `node -e` merge script, and the full install flow. 3. Parses the post-install settings.json with PowerShell and asserts: - The plannotator hook was added to hooks.BeforeTool. - The pre-existing fixture hook is still present (regression guard for the original #506 bug, where cmd ate the `!` in `if(!s.hooks.BeforeTool)s.hooks.BeforeTool=[]` and wiped existing arrays). - Unrelated top-level keys (`theme`, `general.ciFixtureSentinel`) survived the merge untouched. 4. Separately exercises the new unknown-flag rejection added in the previous commit: invokes `install.cmd --verify-attesttion` (typo) via Start-Process and asserts exit code != 0. Before the review fix this would have silently set `VERSION=--verify-attesttion` and 404'd on the download. The job runs in parallel with the existing ubuntu `test` job (no deps, independent runner). Uses the v0.17.1 release as the binary source — that release is pre-PR, so the test is stable against release drift and is testing install.cmd's CODE, not any specific binary. This closes the CI gap where install.cmd had effectively zero runtime coverage and the original #506 bug could have recurred without anyone noticing until a user reported it. For provenance purposes, this commit was AI assisted. * fix(install.cmd): capture gh stderr on failure (consistency with install.sh) Self-review catch: the PR #512 reviewer flagged install.sh for redirecting `gh attestation verify` output to /dev/null, which swallowed actionable error messages (auth missing, network issue, attestation not yet propagated) behind a generic "verification failed" line. I fixed install.sh in the previous review-fix commit but missed that install.cmd had the exact same pattern: gh attestation verify "!TEMP_FILE!" --repo !REPO! >/dev/null 2>&1 Same bug, same consequence, same fix. cmd doesn't have bash's `$(cmd)` or PowerShell's `& cmd 2>&1` output capture, so we redirect to a temp file and `type` it on failure, then clean up in both branches: gh attestation verify ... > "%TEMP%\gh-output.txt" 2>&1 if !ERRORLEVEL! neq 0 ( type "%TEMP%\gh-output.txt" >&2 del "%TEMP%\gh-output.txt" echo Attestation verification failed! >&2 ... ) del "%TEMP%\gh-output.txt" All three installers now surface gh's actual error message on failure, which makes the most common failure mode (`gh auth login` not run) immediately diagnosable on every platform. Note: this code path is not exercised by the new Windows CI integration job because that job passes `--skip-attestation`, and exercising the gh verify path would require an attestation for v0.17.1 to exist — which it doesn't, since v0.17.1 was released before this PR added the attestation step. The fix will first become CI-testable against the first post-merge release that carries a provenance bundle. For provenance purposes, this commit was AI assisted. * fix(install): address second review pass on PR #512 Five findings, all verified against the actual code: - **AGENTS.md env var table** (reviewer: "CLAUDE.md"; it's a symlink to AGENTS.md) was missing PLANNOTATOR_VERIFY_ATTESTATION. Added with an explicit note that it's read by the install scripts only, not the runtime binary — since every other entry in that table is a runtime env var, the distinction matters. - **install.cmd unknown-flag guard metacharacter injection.** The previous guard ran `echo %~1 | findstr /b "[-]"`, where %~1 is unquoted before the pipe. A user passing `install.cmd "--bad&calc"` would have cmd expand %~1 to `--bad&calc`, see the `&` as a command separator, and execute `calc` as a side effect before the flag check. Not a remote exploit (user already has shell exec), but a defensive coding weakness in supply-chain hardening code. Replaced with a variable-assigned substring test using delayed expansion — `set "CURRENT_ARG=%~1"` preserves metacharacters literally inside the `"..."` set syntax, and `!CURRENT_ARG:~0,1!` extracts the first char without any subprocess. This also fixes the same bug in the error-message echo, which previously echoed the unquoted `%~1` and re-triggered metacharacter interpretation in the error path itself. The echo now uses `"%~1"`. Note: the reviewer's proposed one-liner `if "%~1:~0,1%"=="-"` was syntactically invalid — cmd's `:~start,length` substring modifier does not work on positional parameters, only on regular variables. A variable assignment is necessary. - **install.cmd unquoted --repo argument** in the `gh attestation verify` call. TEMP_FILE was quoted but REPO was not. REPO is hardcoded to `backnotprop/plannotator` so not exploitable, but inconsistent with install.sh (which quotes `"$REPO"`). One-char fix: `--repo "!REPO!"`. - **test.yml intentional-typo drift hazard.** The unknown-flag regression test invokes `install.cmd --verify-attesttion` (missing an `a`). The only assertion was `$p.ExitCode -eq 0`. If a future typo-sweep "fixes" the misspelling to the valid `--verify-attestation`, install.cmd would accept the flag, proceed to download the latest release, run `gh attestation verify` against it, and — because v0.17.1 pre-dates the attestation step — fail with a different non-zero exit. Both paths exit 1, so the test would silently drift from "guard works" to "gh attestation verify fails on pre-PR release" without anyone noticing. Two-part fix: 1. Explicit comment marking the misspelling as intentional ("do not correct during a typo sweep"). 2. Redirect stderr to a temp file and assert it contains "Unknown option:" — the actual discriminator between the guard triggering and any other failure mode that happens to exit non-zero. - **README.md verification block was too long** for the main README. Trimmed from ~33 lines (intro + 3 code blocks + opt-in mechanisms + precedence notes) to a single sentence that links to the canonical marketing installation docs where the full content already lived. Same treatment applied to apps/hook/README.md for consistency. The marketing docs are unchanged and remain the single source of truth for verification workflows. All 29 install tests still pass. The Windows CI integration job's new stderr assertion will exercise the harder guard on the next push. For provenance purposes, this commit was AI assisted. * fix(install): tighten attestation verify with --source-ref and --signer-workflow Addresses PR #512 review cycle 3 finding that repo-scoped verification alone doesn't bind the downloaded binary to the specific tag the user requested. A misattached release asset would pass the old check because the wrong binary would still carry a valid attestation for its own (wrong) commit. GitHub's own docs explicitly recommend both constraints: "The more precisely you specify the identity, the more control you will have over the security guarantees. Ideally, the path of the signer workflow is also validated." — https://cli.github.com/manual/gh_attestation_verify All three installers now pass: --source-ref "refs/tags/<requested-tag>" Enforces that the git ref the attestation was produced from matches the tag the installer asked for. Closes the misattached-asset gap. --signer-workflow backnotprop/plannotator/.github/workflows/release.yml Enforces that the attestation was signed by our release workflow file specifically, not any workflow in the repo. GitHub treats this flag as a regex (see cli/cli#9507) so future refactors can broaden the match without breaking version-pinned installs to historical releases. Also addresses the sibling finding that install.cmd used a fixed %TEMP%\gh-output.txt temp filename while the rest of the script uses %RANDOM% for uniqueness. Renamed to %TEMP%\plannotator-gh-%RANDOM%.txt, matching the established pattern and removing a theoretical race between concurrent invocations. New test in install.test.ts asserts all three installers pass --source-ref and --signer-workflow with the expected values. 30 tests pass. For provenance purposes, this commit was AI assisted. * fix(install): address PR #512 review cycle 4 (parser edges, ps1 stream, docs) Five findings, all verified against actual code. One bonus fix in install.sh for a sibling bug the reviewer flagged only in install.cmd. install.ps1: `Write-Host $verifyOutput` on attestation failure wrote gh's diagnostic to PowerShell's Information stream (stream 6), which is silently dropped when CI pipelines capture stderr. Replaced with `[Console]::Error.WriteLine($verifyOutput)` — direct stderr handle, matches the behavior of `echo ... >&2` in install.sh and `type ... >&2` in install.cmd. install.sh + install.cmd: `--version --some-other-flag` used to set VERSION to the flag name (e.g. VERSION=--verify-attestation), which then tried to download tag `v--verify-attestation` and 404'd. The empty-check on `$2`/`%~2` didn't catch dash-prefixed values. Added an explicit dash-prefix check that returns a clean "--version requires a tag value, got flag: X" error instead of degrading into a cryptic download failure. install.sh + install.cmd: mixing `--version v1.0.0 stray` used to silently overwrite VERSION with "stray" because the positional branch unconditionally assigned VERSION=$1. Added a VERSION_EXPLICIT sentinel that's set to 1 when --version is seen, and the positional branch now errors with "Unexpected positional argument: X (version already set)" when it sees a token while the sentinel is set. Same sentinel is also set by the positional branch itself, so passing two positional version tokens also errors out cleanly. Note: the reviewer flagged the positional-overwrite bug only in install.cmd, but install.sh had the identical issue (same unconditional `VERSION="$1"` in the `*)` arm) and the same dash- check gap in both its `--version <val>` and `--version=<val>` branches. Fixing both installers symmetrically — inconsistency here would just trigger another review round. marketing/installation.md: the "Verifying your install" prose promised a "cryptographic link to the exact commit and workflow run," but the example commands only passed `--repo`, which just proves the artifact came from some workflow in our repository. The installer now constrains with `--source-ref` and `--signer-workflow` after review cycle 3, so the docs were out of sync with the actual installer behavior. Updated all three platform examples (bash, pwsh, cmd) to include the tighter flags with a placeholder (`vX.Y.Z`) and a sentence explaining what the extra flags actually buy the user. README.md and apps/hook/README.md are already link-only after cycle 2 and don't need changes. install.test.ts: two new tests. - Regression guard asserts install.sh and install.cmd contain the VERSION_EXPLICIT sentinel, the dash-prefix error message, and the "Unexpected positional argument" guard. Anyone removing any of these in a future cleanup would fail CI. - Regression guard asserts install.ps1 uses [Console]::Error.WriteLine and does NOT use Write-Host for verifyOutput. 32 tests pass (was 30). Smoke-tested install.sh with `--version --verify-attestation` and `--version v1.0.0 stray` — both now exit 1 with clean usage errors instead of silent download failures. For provenance purposes, this commit was AI assisted. * fix(install): address PR #512 review cycle 5 Five code/doc fixes, all verified against actual code. Finding 1 from the review (opt-in verification unusable until a post-merge release is cut) is correct but not actionable — it's inherent to how SLSA attestations work and the only "fix" is timing + release cadence. install.ps1: `[Console]::Error.WriteLine($verifyOutput)` silently converted multi-line gh output to the literal string "System.Object[]" — the opposite of what cycle 4's Write-Host fix was supposed to do. `& gh ... 2>&1` captures multi-line output as an object[] array; passing the array directly to [Console]::Error.WriteLine binds to the WriteLine(object) overload and calls ToString() on the array. Fixed by piping through Out-String first (and TrimEnd to drop the trailing newline it adds). Confirmed against Sigstore/PowerShell docs and the Delft Stack array-to-string guide. install.cmd: replaced `echo !TAG! | findstr /b "v"` with a substring test `if not "!TAG:~0,1!"=="v"`. Same metacharacter-injection class as the parser bug fixed in cycle 2 — piping an unquoted expanded variable re-exposes cmd's & | > < operators in the value before the pipe runs. Inconsistent to leave this one instance using the unsafe pattern when every other comparable check in the script uses the substring idiom. install.cmd: randomized the two remaining deterministic temp file paths — %TEMP%\release.json and %TEMP%\plannotator-<tag>.exe — to match the %RANDOM% pattern already used by GH_OUTPUT. Closes two gaps at once: concurrent-invocation collisions (real for automated upgrade tooling) and same-user symlink pre-placement (the SHA256 check passes on authentic content, but a symlink at the predictable path would redirect where curl writes the binary before the install move runs). All three installers: reject --verify-attestation and --skip-attestation together as mutually exclusive instead of trying to guess which the user meant. Previously install.sh/cmd took last- on-command-line wins and install.ps1 took a fixed-priority Skip- always-wins (documented but inconsistent with the other two). No sane user passes both flags — fast-failing with a clear "mutually exclusive" error is better than silently picking one and hoping it matches intent. Guards live inline in both arms of the bash/cmd parsers and right after the PowerShell param block. test.yml: added a comment block on the install.cmd v0.17.1 pin explaining why that version was chosen, why `latest` isn't used, what the prerequisites are for bumping it, and what failure mode to expect if the pinned release is ever removed. No behavior change — the existing pin stays. Addresses the reviewer's concern that the dependency was undocumented. install.test.ts: four new regression guards. - Asserts install.ps1 uses Out-String (not bare [Console] call on raw $verifyOutput) for multi-line gh output - Asserts all three installers reject the --verify+--skip combo with a "mutually exclusive" error and install.ps1 has the `$VerifyAttestation -and $SkipAttestation` guard - Asserts install.cmd uses randomized temp paths for release.json and the binary download, and that the old deterministic paths are gone - Asserts install.cmd uses the substring test for v-prefix normalization and does not pipe echo|findstr for that check 35 install tests pass (was 32). Smoke-tested the bash mutex guard in both orders — both fail fast with "mutually exclusive" and exit 1 regardless of which flag appears first. For provenance purposes, this commit was AI assisted. * fix(install.cmd): randomize checksum temp path + tighten test assertions Self-review catch on top of the cycle 5 commit: - `%TEMP%\checksum.txt` (lines 164/172/174) was still a fixed predictable path. Same concurrency + symlink-pre-placement class as release.json and TEMP_FILE that cycle 5 fixed. Inconsistent to fix two of three and leave the third. Renamed to `%TEMP%\plannotator-checksum-%RANDOM%.txt` matching the established pattern. The reviewer didn't flag this one — I missed it during the cycle 5 sweep. - Tightened the Out-String regression test from a weak "Out-String appears somewhere in the file" check to a regex matching the specific `$verifyOutput | Out-String` wiring. Previous assertion would have passed even if some future bug accidentally wrapped the mutex-guard string literal in Out-String while leaving $verifyOutput unprotected. - Expanded the randomized-temp-paths test to cover all four curl download targets (release.json, binary, checksum sidecar, gh output capture) rather than the two originally in scope, and to assert the old fixed paths (including checksum.txt) are gone. 35 tests still pass. For provenance purposes, this commit was AI assisted. * fix(install.cmd): escape ! in Claude Code slash command files Pre-existing bug flagged in PR #512 review cycle 6. install.cmd writes the three Claude Code slash command files (plannotator-review.md, plannotator-annotate.md, plannotator-last.md) via `echo` lines inside `setlocal enabledelayedexpansion`. cmd.exe's Phase 2 parser strips unmatched `!` characters — so lines like: echo !`plannotator review $ARGUMENTS` ended up in the written file as: `plannotator review $ARGUMENTS` without the leading `!`. The `!` prefix is what tells Claude Code to execute the backtick block as a shell command; without it, Claude Code renders the line as inline markdown code and the slash command is a silent no-op. The install appeared to succeed, but every Windows cmd user got three broken slash command files. install.sh (single-quoted heredocs) and install.ps1 (single-quoted here-strings) write the `!` correctly because their respective literal-string idioms bypass shell expansion entirely. install.cmd has no single-quote-literal equivalent — its escape hatch is `^!`. The Gemini section of install.cmd (lines 482, 495) already uses `^!` correctly; the Claude Code section didn't until now. Fix: three characters — `echo !` → `echo ^!` on lines 334, 351, 368. Brings install.cmd into parity with the other two installers. No divergence introduced; existing divergence removed. Two regression guards added: - Unit test in install.test.ts asserts install.cmd contains the escaped form for all three command files and does not contain the unescaped form. - New step in the Windows CI integration job reads back each generated .md file from %USERPROFILE%\.claude\commands\ and asserts it contains the literal `!`\`plannotator` prefix. Catches the bug at the actual file-write level on a real Windows runner, not just via source-code grep. 36 install tests pass (was 35). Note: the broader architectural issue — all three installers carry hand-typed duplicates of command content that already lives at apps/hook/commands/*.md — is deferred to a follow-up issue. The cmd bug is the visibly-broken symptom; the deduplication is the long-term fix. For provenance purposes, this commit was AI assisted. * fix(install.cmd): double-caret escape for ! in slash command echoes The previous fix used `echo ^!` for the three Claude Code slash command files. The Windows CI integration job's new file-readback assertion proved this is wrong: the generated plannotator-review.md still landed with no `!` prefix, making the slash command a silent no-op as before. Root cause: cmd has two escape phases under enabledelayedexpansion. Phase 1 (parse time): `^` escapes the next char. `^!` → `!`. The caret is consumed. Phase 2 (delayed expansion): the remaining bare `!` is an unmatched variable reference and gets stripped. Single `^!` dies in Phase 2 because Phase 1 already ate the caret. Double `^^!` survives: Phase 1 reduces `^^` to `^` (leaving `^!`), Phase 2 treats the caret as an escape for `!` and emits a literal. Cycle 6's fix got the direction right but the arithmetic wrong. The new file-readback assertion in test.yml caught it on the first real CI run, which is exactly why that assertion was added. Also fixes the Gemini slash command echoes (lines 482, 495) which used the identical incorrect `^!` pattern. The review comment flagged Gemini as "correct" based on source-reading alone; there was never any CI coverage for the Gemini file contents, and the Gemini section was silently broken for the same reason. Both sections now use `^^!`. Unit test updated to assert the double-caret form on all five echo lines (three Claude Code, two Gemini) and reject both the unescaped and single-caret variants. For provenance purposes, this commit was AI assisted. * fix(install.ps1): fall back to x64 on ARM64 Windows instead of 404ing Pre-existing bug surfaced in PR #512 review cycle 7. install.ps1 detected ARM64 correctly and set $arch=arm64, constructing a URL for plannotator-win32-arm64.exe — which doesn't exist in any release. The release pipeline only builds bun-windows-x64 (release.yml line 88), so there is no native ARM64 Windows binary to download. With $ErrorActionPreference=Stop set at the top of the script, the resulting 404 on Invoke-WebRequest threw a terminating error and the install aborted with a stack trace. ARM64 Windows PowerShell users could not install plannotator at all. Meanwhile install.cmd, which hardcodes PLATFORM=win32-x64 and lets ARM64 hosts pass the arch check, silently installs the x64 binary and relies on Windows 11's x86-64 emulation layer to run it. This is accidentally the useful behavior — imperfect, but the user gets a working install instead of a hard failure. This commit brings install.ps1 into parity with install.cmd's (accidentally correct) behavior: - On 64-bit Windows, $arch is unconditionally "x64" — no more branch for arm64 that would download a nonexistent binary. - When PROCESSOR_ARCHITECTURE == ARM64, Write-Host prints a notice telling the user they're getting the x64 binary via Windows emulation so the behavior isn't silent. - 32-bit Windows still errors out (unchanged). Both Windows installer paths now produce a working install on both x64 and ARM64 hosts. No release pipeline changes. No new binaries. The test `detects ARM64 architecture` used to be a weak string- presence check that passed whether the ARM64 branch selected arm64 or x64. Rewrote it to assert the actual new contract: ARM64 is detected (for the notice), $arch is hardcoded to "x64", and the previous `{ "arm64" }` branch is gone so the regression can't silently return. Native ARM64 Windows builds tracked as a follow-up — requires verifying Bun's Windows ARM64 target support and adding bun-windows-arm64 to the release matrix. For provenance purposes, this commit was AI assisted. * fix(install): pre-flight MIN_ATTESTED_VERSION guard + placeholder docs PR #512 cycle 7 review surfaced that opt-in provenance verification was dead-on-arrival for the window between this PR merging and the first post-merge release: - The docs showed `--version v0.17.1` as the pinned example. v0.17.1 was cut before this PR added attestation generation to release.yml, so any user copy-pasting the example AND enabling verification would hit a cryptic `gh: no attestations found` error and a hard install failure. - Default installs with verification enabled (via flag, env var, or config file) resolve `latest` to v0.17.1 and hit the same failure with no user-visible pinned version to "blame." Medium fix (better error message) was dismissed as lipstick — the install still fails, just with nicer wording. This is the maximum fix that actually prevents the failure path by checking the resolved tag against a hardcoded floor BEFORE downloading. ## Changes `scripts/install.sh`: - New `MIN_ATTESTED_VERSION="v0.18.0"` constant near the top - New `version_ge` helper using `sort -V` (handles v0.9.0 vs v0.10.0) - Moved three-layer verification resolution (config → env → flag) to before the download so $verify_attestation is known in time to gate network work - New pre-flight check: if verification is requested and the resolved tag is older than MIN_ATTESTED_VERSION, fail fast with a clean message listing recovery options (pin to newer version, --skip-attestation, or unset the env var / config). No binary download, no wasted SHA256 check. - Late `gh attestation verify` block now only handles the gh call itself — resolution and pre-flight moved upstream. `scripts/install.ps1`: - New `$minAttestedVersion = "v0.18.0"` constant - Pre-flight guard in the verification branch using PowerShell's [version] class for proper numeric comparison - Same error message content as install.sh `scripts/install.cmd`: - New `set "MIN_ATTESTED_VERSION=v0.18.0"` near REPO setup - Pre-flight guard shells out to PowerShell for semver comparison — Windows 10+ ships `powershell.exe` always, so no new runtime dependency. Hand-parsing semver in cmd was tried and rejected as too fragile for prerelease tags and non-numeric components. `apps/marketing/.../installation.md`, `apps/hook/README.md`, `README.md`, `scripts/install.sh --help`: - Replaced every user-facing `v0.17.1` example with `vX.Y.Z` placeholder. The placeholder pattern already exists in the "Verifying your install" section, so this is just consistency. - install.sh --help adds a link to the releases page so users know where to find actual tag values. `.agents/skills/release/SKILL.md`: - New Phase 4 checklist step: before shipping the first attested release, verify MIN_ATTESTED_VERSION in all three installers matches the tag being cut. The constant is bumped ONCE and never again — it's a permanent floor, not a moving target. If the first post-merge release is not v0.18.0, the skill updates the constant in the same commit as the version bump so the installers served from plannotator.ai activate the new floor at the same moment the first attested release becomes fetchable. `scripts/install.test.ts`: - New test asserts all three installers hardcode MIN_ATTESTED_VERSION, use appropriate version comparison for their dialect, and contain the "predates" error message - New test asserts install.sh and --help text no longer contain `v0.17.1` as a pinned example 38 install tests pass (was 36). Smoke-tested install.sh end-to-end: - `--version v0.17.1 --verify-attestation` → pre-flight rejects cleanly, no download attempted, exit 1 with actionable error - `--version v0.18.0 --verify-attestation` → pre-flight passes, script proceeds to download (404 as expected since v0.18.0 is not yet released) - `--version v0.17.1` (no verify) → pre-flight skipped, normal download path For provenance purposes, this commit was AI assisted. * fix(install): close PS injection + move Windows pre-flight before download PR #512 review cycle 8 raised three related findings, all verified against actual code. ## Critical: PowerShell command injection in install.cmd (Finding 2) Line 228 of the previous install.cmd passed the version comparison to PowerShell by interpolating delayed-expansion variables directly into the command string between single-quoted literals: for /f "delims=" %%i in ('powershell -NoProfile -Command "try { if ([version]'!TAG_NUM!' -ge [version]'!MIN_NUM!') { 'yes' } } catch {}"') do set "VERSION_OK=%%i" The arg parser rejected leading-dash values but not quotes or semicolons, so a user passing install.cmd --version "0.18.0'; calc; '0.18.0" produced the PowerShell command try { if ([version]'0.18.0'; calc; '0.18.0' -ge [version]'0.18.0') { 'yes' } } catch {} PowerShell permits statement sequences inside `if` condition parentheses — the last value is used — so `calc` executed as a side effect during the first evaluation phase. Attacker-controlled --version from a CI/CD wrapper (PR titles, external tag sources, etc.) equals arbitrary code execution as the invoking user. Fixed by passing the version strings via environment variables ($env:TAG_NUM, $env:MIN_NUM) instead of interpolating them into the PowerShell command string. PowerShell reads $env: values as raw strings and never parses them as code. The [version] cast throws on invalid input, catch {} swallows it, VERSION_OK stays empty, and the guard rejects — safe fail with a slightly less helpful but correct error message. ## Structural: Windows pre-flight ran post-download (Findings 1 & 3) install.sh was already restructured in the previous commit to run the three-layer resolution + MIN_ATTESTED_VERSION guard BEFORE the binary download, so users hit the "predates attestation support" error without wasting bandwidth. install.ps1 and install.cmd drifted — their resolution and pre-flight blocks stayed in their original post-SHA256 positions, meaning the binary was always downloaded and SHA256-verified even when the requested tag was doomed to fail provenance verification. The "Pre-flight: reject the verification request before downloading" comments were lies copied from install.sh. This commit moves both Windows installers' resolution + pre-flight blocks upstream of the download: install.ps1: resolution + pre-flight now run immediately after `Write-Host "Installing plannotator $latestTag..."`, before $tmpFile is created or Invoke-WebRequest runs. The late gh-call block keeps only the gh attestation verify call itself. install.cmd: same restructure. The late block keeps only the where-gh check and gh invocation. The `del "!TEMP_FILE!"` calls inside the rejection branch are gone (TEMP_FILE doesn't exist yet when the guard runs). ## Tests Added two new regression guards to scripts/install.test.ts: 1. Order-aware check for all three installers: the resolution block's opening line must appear textually BEFORE the curl / Invoke-WebRequest download line. Uses indexOf to compare positions. Catches any future regression that drifts the pre-flight back after download. 2. Injection-safe pattern check for install.cmd: asserts the PowerShell command references $env:TAG_NUM / $env:MIN_NUM and does NOT interpolate !TAG_NUM! / !MIN_NUM! between single quotes in any [version] cast. 40 install tests pass (was 38). Smoke-tested install.sh with --version v0.17.1 --verify-attestation — rejects cleanly with no download, same as before. For provenance purposes, this commit was AI assisted. * fix(install): close cycle-9 gaps — CI coverage, v-strip, prerelease handling PR #512 cycle 9 review surfaced three real findings, all verified. ## Finding 1 (important): Windows CI never exercised the attestation path The Windows integration job ran `install.cmd v0.17.1 --skip-attestation`, which bypasses every bit of logic this PR shipped: three-layer opt-in resolution, MIN_ATTESTED_VERSION pre-flight, $env:-based PowerShell version comparison, and the gh attestation verify call. A runtime bug in any of those paths would not be caught by CI. `--skip-attestation` was passed intentionally because v0.17.1 predates attestation support — running without it hits the pre-flight and rejects. But that's the point: the REJECTION path is a real, valid end state we can assert against. The previous test conflated "install should succeed" with "test should pass"; the fix is to assert the correct behavior for an old version. Added a new CI step that runs `install.cmd v0.17.1 --verify-attestation` via Start-Process with stderr redirection to a temp file, then asserts: - exit code != 0 (pre-flight rejected) - stderr contains "predates" (rejection came from our guard, not some other failure mode like a network error or gh missing) This exercises on a real cmd.exe: - setlocal enabledelayedexpansion parser under the guard - three-layer resolution reaching the CLI flag layer - the :~1 substring (instead of the previous :v= global substitution) - the pre-release tag detection (negative path for stable tags) - the PowerShell shell-out with $env:TAG_NUM / $env:MIN_NUM - the [version] -ge comparison returning false - the "predates" error message block Can't test the success path (valid attested release) until the first post-merge release exists. Tracked for follow-up. ## Finding 2 (nit): !TAG:v=! is a global substitution, not anchored cmd's delayed-expansion string-substitution syntax `!VAR:str=repl!` replaces every occurrence of `str` globally. For all current semver tags (vX.Y.Z) this happens to strip exactly one `v` by coincidence. A hypothetical future tag like v1.0.0-rev2 would become 1.0.0-re2, which [System.Version] can't parse, silently misclassifying the failure as "predates attestation support" (see Finding 3). install.ps1 line 121 uses `-replace '^v', ''` which is properly regex-anchored. install.cmd had no anchored equivalent. Fixed by using `!TAG:~1!` — substring from index 1 — which drops exactly the first character. Safe because TAG is guaranteed to start with `v` by the normalization step upstream (line ~141). ## Finding 3 (nit): Pre-release tags misdiagnosed on Windows [System.Version] doesn't support semver prerelease or build-metadata suffixes (e.g. v0.18.0-rc1). It throws on any `-` in the version string. The catch blocks in both Windows installers handled the throw but surfaced wrong/confusing errors: install.sh: handles prereleases correctly via `sort -V` (POSIX version sort is semver-aware) — no issue. install.ps1: caught and printed "Could not parse version tags for provenance check" — accurate but doesn't explain WHY. install.cmd: swallowed silently, VERSION_OK stayed empty, printed "predates attestation support" — actively wrong, the problem isn't the version's age. Fixed in both Windows installers by detecting `-` in the tag BEFORE attempting the [version] cast: install.ps1: `if ($latestTag -match '-')` → dedicated error install.cmd: `if not "!TAG_NUM!"=="!TAG_NUM:-=!"` (native substitution check, no subshell, no metacharacter risk) Both emit a clear "pre-release tags aren't currently supported for provenance verification on Windows" message pointing users at --skip-attestation or a stable tag. Windows has no built-in semver comparator; adopting one would require NuGet or a custom parser. Explicit rejection with honest diagnosis is the pragmatic choice. ## Tests Three new regression guards in install.test.ts: 1. `install.cmd strips leading v via substring, not global substitution` — asserts `!TAG:~1!` is present and `!TAG:v=!` is gone. 2. `both Windows installers reject pre-release tags with a dedicated error` — asserts both scripts contain the "Pre-release tags" error message and the appropriate detection pattern for their dialect. 3. The new test.yml CI step doubles as a runtime regression guard — any break in the cmd pre-flight path that no longer matches "predates" in stderr, or returns 0, fails CI. 42 install tests pass (was 40). Windows CI will now exercise the pre-flight rejection path end-to-end for the first time. For provenance purposes, this commit was AI assisted. * fix: cycle-10 review — split attest job, assert binary preservation, misc PR #512 cycle 10 raised four findings, all verified. ## Finding 1: id-token/attestations permissions granted to build on PRs The build job in release.yml had `id-token: write` and `attestations: write` at the job level with no conditional guard. On PR triggers, those permissions were live for every build step (checkout, bun install, bun build, compile) even though the attestation step itself was gated by `if: startsWith(github.ref, 'refs/tags/')`. Narrow-but-real attack surface: a trusted contributor's malicious PR injecting code into a build step could mint an OIDC token authenticating as the repo identity. Fork PRs are automatically protected (GitHub suppresses OIDC tokens on forks), but same-repo contributor compromise is a realistic risk in a project with external contributors. Fixed by splitting attestation into its own job: build: contents: read only. Runs on all triggers. Compiles binaries and uploads them as the `binaries` artifact. No OIDC capability anywhere in the job. attest: needs: build, if: tag push only. contents: read + id-token: write + attestations: write. Downloads the binaries artifact and runs attest-build-provenance. Permissions are only live when we're actually producing an attestation — never on PR dry-runs. release: needs: attest (was: needs: build). Still tag-only. The dependency chain guarantees the attestation exists in the GitHub attestation store before the release's binaries are published, closing the race window where a user could pull the binary and gh attestation verify would fail because the bundle hadn't propagated yet. npm-publish: unchanged. Still needs: build. Still has id-token: write for `npm publish --provenance`. The reviewer flagged only the build job; npm-publish's id-token grant is scoped to that one job and is actually used by the provenance flag. ## Finding 2: CI test promised a binary-preservation check but didn't do one The `Attestation pre-flight rejects v0.17.1` step contained a multi-line comment promising to verify the rejected run didn't overwrite the previously-installed binary. No assertion code followed — just a Write-Host success line. The test claimed more than it delivered. Added actual baseline capture + comparison: - Before running the rejection test, capture the binary's SHA256 and LastWriteTime from the prior Gemini-merge step. - After the rejection, recompute both and assert they match. - Any drift throws: catches future regressions that re-introduce the post-download pre-flight pattern (the pre-flight correctly rejects but only after downloading and overwriting the file). ## Finding 3: install.ps1 dead-code comment about flag precedence Line 111 read "-SkipAttestation beats -VerifyAttestation if both passed" but the upfront mutex guard (lines 13-16) exits 1 if both flags are present. The "beats" scenario is unreachable. The comment misleads a future reader into thinking the late ordering handles the mutual exclusion and is safe to remove the early guard — which would be backwards. Replaced with a comment that explicitly notes the mutex guard at the top of the script makes the two branches mutually exclusive by construction. ## Finding 4: install.sh `cd` inside `&&` condition leaked CWD on failure The skills-install block chained `git clone ... && cd ... && git sparse-checkout set ...`. If clone succeeded but sparse-checkout failed, the short-circuit skipped the `cd -` and `rm -rf "$skills_tmp"` later ran with the shell's CWD still inside the to-be-deleted directory. On Linux/macOS this silently "works" — the inode is unlinked but the process keeps its cwd reference — so nothing visibly breaks (all downstream code uses absolute paths). But it's structurally wrong: install.ps1 and install.cmd both use Push-Location/pushd for the same logic. Restructured to run the entire clone → sparse-checkout → verify → copy sequence inside a single `(...)` subshell, with `cd`s scoped to the subshell. The parent shell's CWD is unchanged regardless of which step fails, so the subsequent `rm -rf` always runs from a stable location. Any failure in the chain short-circuits to the else branch with a clean skip message. Also merged the two `[ -d ]` / `[ ls -A ]` guards into the chain so the "apps/skills empty" case is now reported in the skip message rather than being silently suppressed. 42 install tests pass. For provenance purposes, this commit was AI assisted. * fix(install): set MIN_ATTESTED_VERSION to v0.17.2, remove skill bump note Earlier cycles hardcoded MIN_ATTESTED_VERSION="v0.18.0" across the three installers as a best-guess for the first post-merge release, and I added a one-time bump instruction to the release skill as insurance in case the guess was wrong. The guess was wrong — the next release is v0.17.2 (patch bump, not a minor bump). Updated the constant in all three installers and the matching test assertions. No other version references in the shipped error messages need changing because they read MIN_ATTESTED_VERSION from the variable at runtime. Also removed the "⚠️ One-time MIN_ATTESTED_VERSION bump" section from .agents/skills/release/SKILL.md entirely. With the constant now set to the actual next release tag, there's nothing for the release agent to bump at release time — the constant is already correct. Baking a one-time action into a recurring release skill was the wrong place for it; every future release agent would read the warning, confirm it's already set, and move on. Noise in a workflow that's supposed to be tight. If the next release version ever differs from v0.17.2 (e.g. we decide to skip to v0.18.0 or go straight to v1.0.0), the PR cutting that release will need to update MIN_ATTESTED_VERSION in the three installers. That's an ad-hoc fix, not a recurring skill concern. Smoke test with the new value: - install.sh --version v0.17.1 --verify-attestation → rejects with "first attested release is v0.17.2" - install.sh --version v0.17.2 --verify-attestation → passes pre-flight, proceeds to download (404 as expected since v0.17.2 is not yet released) 42 install tests pass. For provenance purposes, this commit was AI assisted. * feat(release): ship native ARM64 Windows binaries Bun v1.3.10 (February 2025) promoted bun-windows-arm64 from preview to a stable cross-compile target, which makes native ARM64 Windows builds a 15-line change instead of a project. Adopted immediately so ARM64 Windows users get native-speed binaries instead of the x86-64 emulation tax. Earlier cycles of this PR shipped two temporary workarounds for the absence of a native ARM64 binary: - install.ps1 detected ARM64 and fell back to $arch="x64" with a Write-Host notice that the user was running via emulation. - install.cmd hardcoded PLATFORM=win32-x64 and let ARM64 hosts pass the arch check without differentiation. Both are now obsolete and have been replaced with real architecture detection that selects the native binary. ## Changes release.yml: Added `bun-windows-arm64` to the compile matrix for both apps/hook/server/index.ts and apps/paste-service/targets/bun.ts. Output files are plannotator-win32-arm64.exe and plannotator-paste-win32-arm64.exe with matching .sha256 sidecars. Upload-artifact already globs `plannotator-*` so no change there. release.yml attest step: Added the two new ARM64 binaries to subject-path so they're covered by the SLSA build provenance attestation alongside the x64 builds. Both binaries sign with the same Sigstore bundle as the rest of the matrix. install.ps1: Restored the proper ARM64 detection that the earlier fallback replaced. On 64-bit Windows, $arch is "arm64" when PROCESSOR_ARCHITECTURE equals "ARM64", otherwise "x64". The emulation-fallback Write-Host notice is gone — users now get native binaries and don't need to be told about emulation. install.cmd: Replaced the unconditional `set "PLATFORM=win32-x64"` with a set of conditional assignments keyed off PROCESSOR_ARCHITECTURE and PROCESSOR_ARCHITEW6432 (the latter covers the edge case of a 32-bit tool launching install.cmd on an ARM64 machine via WoW64). PLATFORM is left empty if neither variable indicates AMD64 or ARM64, which triggers the "does not support 32-bit Windows" error path. The :arch_valid label and its gotos are gone — the new logic is linear and doesn't need a label. install.test.ts: Updated the install.ps1 ARM64 test to assert the native arm64 branch (no more "runs via emulation" text) and added a new install.cmd test verifying both PLATFORM branches are present. 43 install tests pass (was 42). ## CI coverage caveat windows-latest is x86-64, so the Windows integration job still exercises install.cmd against the x64 binary path. ARM64 has no CI runner coverage yet — we're shipping ARM64 binaries on trust that Bun's cross-compile produces working executables. That's the same trust we extend to linux-arm64 builds (also x-compiled from an ubuntu-latest runner). GitHub Actions does offer a windows-11-arm runner that could be added later; tracked as follow-up since it has availability and pricing implications. Closes #517. For provenance purposes, this commit was AI assisted. * fix(install.ps1): detect ARM64 host through WoW64 too, matching install.cmd Self-review catch on top of the ARM64 support commit. My install.ps1 architecture detection only checked \$env:PROCESSOR_ARCHITECTURE, which reports the architecture the CURRENT PowerShell process is running under — not the host architecture. On ARM64 Windows, a 32-bit PowerShell process (rare, but possible) would see PROCESSOR_ARCHITECTURE=X86, miss the "ARM64" branch, fall through to \$arch = "x64", and download the emulated x64 binary instead of the new native arm64 build. install.cmd already handles this correctly via PROCESSOR_ARCHITEW6432, which is set only in 32-bit WoW64 processes and holds the host architecture. install.ps1 was the odd one out. Fixed by checking PROCESSOR_ARCHITEW6432 first and falling back to PROCESSOR_ARCHITECTURE. Now both Windows installers follow the same detection logic regardless of process bitness. Also added an explicit error branch for unrecognized architectures (anything that isn't AMD64 or ARM64) instead of silently assuming x64. Test updated to assert both env vars are referenced. For provenance purposes, this commit was AI assisted. * fix(install): cycle-12 review — consistency test, dead code, finally, docs Four findings addressed. Two findings rejected. ## Finding 1 (nit): MIN_ATTESTED_VERSION triplicated without CI consistency Added a cross-file consistency test in install.test.ts that extracts the version literal from each of install.sh, install.ps1, install.cmd via regex and asserts all three match. A future bump that updates only one or two files now fails CI loudly. The per-file tests still exist (they check each file contains the current literal), but the new test catches drift where each file is internally consistent with itself but differs from the others. ## Finding 4 (nit): Write-Error + exit 1 dead code in install.ps1 Verified against the actual file: $ErrorActionPreference = "Stop" is set at line 8 and never modified. All six Write-Error sites are dead- end paths — five outside any try/catch, one inside a catch block (line 147) where Write-Error raises a new terminating error that propagates past the catch and exits the script with code 1 (PowerShell default). The `exit 1` lines that followed were never reachable. Dropped the six unreachable `exit 1` lines. Added a comment at the first occurrence explaining the Stop + Write-Error semantics so future maintainers don't re-add them. Behavior is unchanged at runtime — every error path still exits with code 1 via PowerShell's default unhandled-terminating-error handling. ## Finding 5 (nit): Pop-Location not in finally block Verified the reviewer's claim in install.ps1 lines 384-403. The skills install wraps git clone, Push-Location, and Copy-Item calls in a single try block, with Pop-Location on the success path. If Copy-Item throws under ErrorActionPreference=Stop, catch runs without popping, and the subsequent Remove-Item deletes a directory the PowerShell location stack still points into. A naive `finally { Pop-Location }` would introduce a new bug: Pop-Location throws on an empty stack, which happens when git clone silently fails and Push-Location is never reached. Used a nested-try pattern instead: try { git clone ... # native, no throw if (Test-Path "$skillsTmp\repo") { # guard against clone failure Push-Location "$skillsTmp\repo" try { ...operations... } finally { Pop-Location # always runs IF pushed } } } catch { Write-Host "Skipping..." } Traced all four failure modes: - clone fails silently → repo dir missing → skip inner block → no push, no pop → clean exit - clone succeeds → push succeeds → operations fail → finally pops → outer catch fires - clone + push + operations all succeed → finally pops cleanly - push itself throws (permissions) → outer catch fires, nothing to pop ## Finding 6 (P1): CMD/ps1 ARM64 breaks pinned pre-v0.17.2 tags The original plan was a runtime x64-fallback on 404, but the simpler product-level framing is: v0.17.2 is the first fully-supported version for pinning. Pre-v0.17.2 tags predate native ARM64 Windows (no win32-arm64 asset exists) and predate attestation support (pre-flight rejects). Users pinning to older tags are outside the supported matrix; the failure modes are explicit (404 / clean rejection), not silent corruption. Documented in the three install docs: - apps/marketing/.../installation.md: full "Supported versions" paragraph explaining the floor, what fails, and recovery paths - README.md: one-line note folded into the existing provenance sentence ("Version pinning, native ARM64 Windows, and SLSA provenance are supported from v0.17.2 onwards — see installation docs for details") - apps/hook/README.md: same tight one-liner pattern README.md and apps/hook/README.md stay bloat-free; the canonical explanation lives in the marketing docs. ## Findings rejected - **Finding 2 (P3, sort -V misorders prereleases):** plannotator doesn't ship prerelease tags. A user pinning to a hypothetical vX.Y.Z-rc1 would 404 at the download step before the sort -V misordering matters. Moot in practice. - **Finding 3 (important, sort -V is GNU-only):** FALSE POSITIVE. Tested on macOS 26.3.1 running sort 2.3-Apple (197) — both -V and --version-sort are supported and work correctly, including for prerelease suffixes. Apple forked BSD sort and added -V years ago. The reviewer's claim cites outdated reference material about historical BSD sort. 44 install tests pass (was 43). For provenance purposes, this commit was AI assisted. * test: anchor MIN_ATTESTED_VERSION consistency regexes to line start Self-review catch: the cross-file consistency test added in the prior commit matched the assignment form anywhere in each file. No current comment triggers a false positive, but a future comment like `# Example: MIN_ATTESTED_VERSION="v0.17.0"` would match first and shadow the real assignment, causing the test to report the wrong value or pass when it shouldn't. Hardened by adding /m flag and ^ anchor. The real assignments in all three installers are flush-left at the top of their files, so requiring line-start is both safe (won't reject current code) and stricter (future comments with leading whitespace or other prefixes are ignored). 44 tests still pass. For provenance purposes, this commit was AI assisted. * fix: cycle-13 review — checksum cleanup leak + Gemini CI coverage Two findings addressed. Two pre-existing findings flagged but not in scope. ## Finding 3 (nit): CHECKSUM_FILE leak on download failure install.cmd's checksum download error path deleted TEMP_FILE but omitted CHECKSUM_FILE. curl -o creates the output file before it receives data, so a network failure or HTTP error leaves a 0-byte or partial file in %TEMP% that the script never cleans up. The symmetric cleanup for TEMP_FILE elsewhere in the script makes this an accidental omission, not an intentional design choice. Added `if exist "!CHECKSUM_FILE!" del "!CHECKSUM_FILE!"` inside the error block, matching the existing cleanup discipline. ## Finding 1 (nit): Windows CI readback misses Gemini .toml files The `Verify Claude Code slash command files contain the shell- invocation prefix` step in the Windows integration job verified the three `.md` files at %USERPROFILE%\.claude\commands\ but not the two `.toml` files at %USERPROFILE%\.gemini\commands\. Both sets of files use the `^^!` cmd escape pattern that this PR added, and a future regression that drops a `^` from the Gemini echoes would slip past CI even though install.test.ts catches it statically. Extended the readback step to also verify plannotator-review.toml and plannotator-annotate.toml contain the `!{plannotator ...}` invocation form. Same regression class, same guard, same runner — the earlier Gemini-merge fixture step already seeds ~/.gemini/settings.json, which causes install.cmd's Gemini block to fire and write the .toml files alongside the Claude Code ones, so no additional setup is required. ## Findings rejected (out of scope, pre-existing) - **install.cmd vs install.ps1 install location divergence:** cmd installs to %USERPROFILE%\.local\bin while ps1 installs to %LOCALAPPDATA%\plannotator. A user who switches between the two Windows installers ends up with hooks.json pointing at one location and an orphan binary at the other. Pre-existing structural divergence, requires picking a canonical location and migrating users on whichever installer changes. Out of scope for this PR. - **install.sh Gemini merge throws on user's malformed JSON:** if ~/.gemini/settings.json is invalid JSON, the embedded `node -e` call exits non-zero, set -e propagates, and the install aborts mid-run after the binary is in place but before slash commands are written. Pre-existing — the Gemini block predates this PR. Worth a follow-up but not in scope here. 44 install tests pass. For provenance purposes, this commit was AI assisted. * docs: update stale v0.17.1 references in script comments to vX.Y.Z Two cosmetic comment fixes flagged during the cycle-13 self-review. The user-facing examples and docs were updated to vX.Y.Z in cycle 5, but two inline code comments still referenced the old concrete version: - scripts/install.sh:129 — "Positional form: install.sh v0.17.1 (matches install.cmd interface)" - scripts/install.cmd:71 — "Positional form: install.cmd v0.17.1 (legacy interface)" Both updated to vX.Y.Z so the in-code comments match the rest of the documentation. No behavior change. 44 install tests pass. For provenance purposes, this commit was AI assisted. * docs(skill): update release skill platform/binary counts for ARM64 Windows Two stale references in .agents/skills/release/SKILL.md after the ARM64 Windows binaries were added: - "5 platforms (macOS ARM64/x64, Linux x64/ARM64, Windows x64)" → "6 platforms (macOS ARM64/x64, Linux x64/ARM64, Windows x64/ARM64)" - "Compiles paste service binaries (same 5 platforms)" → "Compiles paste service binaries (same 6 platforms)" - "Generates SLSA build provenance attestations for all 10 binaries" → "Generates SLSA build provenance attestations for all 12 binaries" The first two predate this PR; the third was added in the cycle-1 commit and not bumped when the ARM64 Windows targets landed in the ARM64 commit. All three corrected together so the release agent sees an internally-consistent description of what the pipeline actually does. Verified against release.yml — 12 entries in the attest job's subject-path list, 12 compile commands in the build job, all six platforms (macOS arm64/x64, Linux x64/arm64, Windows x64/arm64) for both plannotator and paste-service. For provenance purposes, this commit was AI assisted.	2026-04-07 20:35:16 -07:00
Michael Ramos	7e8f914904	feat(plan): unified header dropdown + Agent Instructions (#515) ... * feat(plan): unify header settings into combined dropdown Replace the desktop sprawl (ModeToggle, Settings button, Export sub-dropdown) and the separate MobileMenu with a single PlanHeaderMenu modeled on ReviewHeaderMenu — one ActionMenu rendered at all breakpoints. Move version + release notes into the dropdown footer, drop the origin/agent badge, and stub an "Agent Instructions" item that copies the current plan plus an /api/external-annotations URL for external agents (real protocol body lands in a follow-up). Also fix the annotate-folder Send button: it was hidden whenever a file was opened via linkedDoc, so users in `plannotator annotate ./` couldn't submit feedback. Gate now allows linked-doc state through in annotate mode. Settings is always mounted instead of skipping when a linked doc is active, so the dropdown's Settings item works in every state. For provenance purposes, this commit was AI assisted. * feat(plan): real Agent Instructions clipboard payload Replace the placeholder string in handleCopyAgentInstructions with a real, contract-accurate markdown payload that teaches an external agent (Claude Code, Codex, custom scripts) how to: - read the current plan via GET /api/plan - POST single or batch annotations to /api/external-annotations - choose COMMENT vs DELETION vs GLOBAL_COMMENT and use originalText for inline highlighting (or skip it for sidebar-only) - list, delete-by-id, and delete-by-source for cleanup before reposting The payload lives in packages/ui/utils/planAgentInstructions.ts as buildPlanAgentInstructions(origin) — a single pure function that takes the base URL and returns the markdown. Plan and code-review modes have different annotation shapes, so each owns its own instructions module; the review counterpart will live alongside this file when it's added. For provenance purposes, this commit was AI assisted. * docs: list planAgentInstructions.ts in AGENTS.md utils enumeration For provenance purposes, this commit was AI assisted. * fix(plan): restore 'system' theme option in header dropdown The unified header dropdown only exposed light/dark, dropping the 'system' (follow OS) option that the previous ModeToggle and MobileMenu both supported. Clicking either explicit mode would silently overwrite a prior 'system' setting. Add it back as a third segmented control, matching the old MobileMenu's three-way layout. For provenance purposes, this commit was AI assisted. * refactor(ui): extract shared theme-mode icons PlanHeaderMenu and ThemeTab each inlined their own Sun/Moon/System SVGs (and the deleted MobileMenu had its own copy too). Pull them into a shared icons/themeIcons.tsx module so the iconography stays consistent across the dropdown and the settings tab. Use the cleaner Heroicons paths from ThemeTab as the canonical art. ReviewHeaderMenu still inlines its own copies — left alone for this PR since the broader review/plan menu unification is a separate follow-up. For provenance purposes, this commit was AI assisted. * fix(plan): use ReviewAgentsIcon for Agent Instructions menu item Reuse the magnifying-glass-with-cog icon already used for the Review Agents tab so the same visual marker identifies agent-related affordances across plan and review modes. For provenance purposes, this commit was AI assisted. * fix(plan): drop DELETION + unanchored COMMENT from agent instructions Plannotator's existing render and export pipeline only handles two shapes well: an anchored COMMENT with originalText, and a GLOBAL_COMMENT with no anchor. The previous instructions also documented: - COMMENT without originalText — sidebar shows an empty quote bubble ("") and the export header reads `Feedback on: ""`. The text survives but the framing is broken. - DELETION with explanatory text — the text is invisible in the sidebar and silently dropped on export, replaced by a generic template. Real information loss. Rather than expand the export pipeline to honor those edge cases, narrow the documented surface to the two shapes that work today: inline COMMENT (requires originalText) and GLOBAL_COMMENT (no anchor). DELETION is omitted entirely; agents that need to suggest a removal can post an inline COMMENT pointing at the phrase. For provenance purposes, this commit was AI assisted. * fix(plan): clear current new-settings hints, surface pulse on menu trigger The new-settings indicator infrastructure (hasNewSettings / version constant / markNewSettingsSeen) stays — it's the scaffolding for future hint flagging — but every current marker is removed: - Drop the four inline 'new' badges in Settings.tsx (Plan Width row, Quick Labels row, mobile + desktop tab navigators). - Drop the dead pulse on the standalone gear button — that button now lives inside <div className="hidden"> after the header refactor, so the pulse was unreachable anyway. Surface the pulse on the new PlanHeaderMenu trigger instead. App.tsx seeds local hasNewSettingsHints state from hasNewSettings(), passes it to the menu, and clears it (plus calls markNewSettingsSeen) when the user opens Settings from the dropdown. For provenance purposes, this commit was AI assisted. * docs: list icons/ subdirectory in AGENTS.md components tree For provenance purposes, this commit was AI assisted. * fix(server): require originalText for plan COMMENT annotations The plan-mode external-annotation contract documents that COMMENT annotations must carry an originalText anchor; sidebar-only feedback uses GLOBAL_COMMENT instead. transformPlanInput already enforced this for DELETION but silently defaulted COMMENT's originalText to "" when missing — producing a broken render (empty quote bubble in the sidebar, exported as `Feedback on: ""`). Reject COMMENT without a non-empty originalText and steer the caller toward GLOBAL_COMMENT in the error message so the fix is self-evident to misbehaving agents. For provenance purposes, this commit was AI assisted. * chore: drop dead new-hints scaffolding leftovers After clearing the four current inline hint markers, two pieces of support code were unreachable: - The destructured setShowNewHints setter in Settings.tsx — the state itself stays as a stable mount-time snapshot for any future hint markers, but the setter has no callers. Drop it and add a comment explaining why the useState wrapper is intentional scaffolding. - The settings-ping keyframe in editor/index.css — only the deleted gear-button pulse referenced it; the new pulse on PlanHeaderMenu's trigger uses Tailwind's built-in animate-ping instead. For provenance purposes, this commit was AI assisted.	2026-04-07 15:03:30 -07:00
Michael Ramos	57495ec816	feat: Zed-style overlay scrollbars (#509) ... * feat(ui): Zed-style overlay scrollbars for plan mode Wide, translucent, full-length overlay scrollbars replacing the 6px WebKit rail that users couldn't reliably grab. Click the track to page-animate toward the click, drag the thumb, no layout shift, Firefox parity. Wraps plan-mode scroll containers (main viewer, annotation panel, sidebar, settings, export modal) in a new <OverlayScrollArea> component backed by overlayscrollbars-react. The library handles pointer capture, click-to-jump, hover reveal, auto-hide, RTL, touch, momentum, and cross-browser consistency. ClickScrollPlugin registered explicitly so `clickScroll: true` actually pages (otherwise it silently no-ops). Plumbing: - New ScrollViewportContext + useScrollViewport() hook so descendants (TableOfContents, PinpointOverlay, Viewer sticky observer) can reach the real scrolling element instead of document.querySelector('main'), which no longer returns the scroll node after wrapping. - New useOverlayViewport() hook — canonical ref+state+callback pattern bridging the library viewport into components that need both imperative access and effect re-runs when the viewport mounts. - useActiveSection gains an optional scrollElement arg so its IntersectionObserver root re-attaches when the viewport becomes available (ref mutations don't retrigger effects). Theme: - New .os-theme-plannotator tokens sourced from existing theme CSS variables (translucent muted-foreground for handle, transparent track at rest). 10px at rest, 14px on hover. Color + width transitions only — deliberately does not reintroduce transform/opacity in global transitions, preserving the abc952f scroll-jank fix. - Firefox `scrollbar-width: thin` + `scrollbar-color` fallback for unwrapped surfaces (micro-scrollers, future dockview). - print.css hides .os-scrollbar during print. ResizeHandle (#354 regression guard): - `side="right"` touch area retuned from `-right-3 left-0` to `-right-3 left-3` to clear the 14px hover scrollbar. Load-bearing comment added explicitly warning against simplification because #354 has already regressed twice. Intentionally left native: max-h-24 inline scrollers (EditorAnnotationCard, AgentsTab, ThemeTab), dropdown menus — a 14px overlay scrollbar would dominate those UI elements. Fixes #354 Follow-up to #359, #465 (both fixed #354, which kept regressing) Preserves #253 bidirectional annotation scroll Preserves #452 file-switch reset (plan mode portion) For provenance purposes, this commit was AI assisted. * feat(review): overlay scrollbars for file tree, sidebar, and PR panels Wrap the trivial code-review scroll containers in <OverlayScrollArea>: FileTree, ReviewSidebar content area, AITab chat history, PRCommentsTab timeline, and the ReviewPRSummary / ReviewPRChecks dock panels. None of these components read scrollTop / scrollHeight / scrollLeft directly — all descendant queries use containerRef.current.querySelector and all scroll-to-target calls use element.scrollIntoView, which walks up to the nearest scrollable ancestor (now the library viewport). No plumbing changes required. AITab was originally scoped to Commit B but an audit of its scroll effects (jump-to-question + auto-scroll-to-bottom) confirmed it only uses descendant scrollIntoView, so it ships here. DiffViewer and LiveLogViewer follow in a separate commit — they programmatically read/write scrollTop and need explicit viewport plumbing via useOverlayViewport. For provenance purposes, this commit was AI assisted. * feat(review): overlay scrollbars for diff viewer and live logs Wrap DiffViewer's main scroll container and LiveLogViewer's log pane in <OverlayScrollArea>, plumbing containerRef through useOverlayViewport so imperative scroll reads/writes and IntersectionObserver roots land on the real library viewport, not the OverlayScrollArea host. DiffViewer: - `previousScrollFilePathRef` guard added: the file-switch reset (#452) now only advances the tracking ref once the scroll actually executed, closing a race where a file switch landing before the library viewport attached would leave the ref stale while the scrollTo silently no-oped. - `viewport` added to every effect dep that reads containerRef.current (file-switch reset, annotation scroll, search-highlight apply + swap, scroll-to-match) so they re-run when the viewport mounts. Without this they'd silently no-op on first paint. - Split-view sync via @pierre/diffs unaffected — its ScrollSyncManager attaches scroll listeners to its own internal codeDeletions / codeAdditions elements inside the content, not the outer scroller. LiveLogViewer: - React onScroll replaced with a native addEventListener('scroll', ...) inside a useEffect keyed on `viewport` because React's onScroll doesn't bubble across the library's wrapper layers. - Follow-tail heuristic (`scrollHeight - scrollTop - clientHeight < 40`) and the auto-scroll-to-bottom assignment both preserved verbatim — only the ref target changed from the raw div to the library viewport. Preserves #452 file-switch reset Preserves #253 bidirectional annotation scroll (diff side) For provenance purposes, this commit was AI assisted. * fix(ui): address PR #509 review — viewport delivery and resize handle Two P1 bugs from the review, plus four correctness/cleanup items. P1: OverlayScrollbars viewport was never delivered to consumers. handleOsRef was reading osInstance() synchronously from the React ref callback, but `defer: true` queues the library's initialization for a later frame — at ref-callback time, the internal instance ref is still null. With a stable useCallback the ref never re-fires, so onViewportReady was never called with a real viewport. Every consumer of useOverlayViewport/useScrollViewport stayed permanently null: useActiveSection, TableOfContents.handleNavigate, Viewer sticky detection, PinpointOverlay, DiffViewer file-switch reset, LiveLogViewer follow-tail — all silently no-ops. Fix: deliver the viewport via the library's own `events.initialized` and `events.destroyed` callbacks, which fire exactly when elements are ready and when they're torn down. `getViewport()` prefers the tracked viewport ref over the imperative osInstance() path so late callers still work. P1: right-side ResizeHandle touch area was 0px wide. Touch area is an absolute-positioned child of a w-0 parent, so actual width = parent - left - right. With side='right' I'd set `left-3 -right-3`, which evaluates to `0 - 12 - (-12) = 0`. The annotation panel resize handle in plan mode and both right handles in code review had no draggable region. The visible 4px track has no event handlers, so the only affordance was cursor-style feedback — drag did nothing. Fix: revert to `left-0 -right-3` (12px wide, entirely right of the boundary, no left encroachment into the adjacent scrollbar zone — which was the original correct value before this branch). Rewrote the comment to explain the geometry trap instead of protecting the value that broke it. Additional fixes: - OverlayScrollArea: prefers-reduced-motion now reactive via useSyncExternalStore — OS toggle mid-session propagates to mounted instances instead of staying frozen at mount-time snapshot. - OverlayScrollArea: `ref as never` replaced with a narrow cast to `React.RefCallback<OverlayScrollbarsComponentRef<'div'>>` so future signature changes get type feedback. - PinpointOverlay: window resize listener moved above the scroll viewport guard so it attaches unconditionally. Scroll listener still requires the viewport (correct). Old code always registered resize on window; new code was accidentally skipping it when viewport was null. - TableOfContents: `className || default` changed to `className ?? default`. An explicit empty string from a caller (SidebarContainer passing className="" now that it wraps us in an OverlayScrollArea) should mean "no container styling", not "use the default". The old || operator treated "" as falsy and applied the default, leaving dead overflow-y-auto and unintended backdrop-blur on the nav. - useOverlayViewport: removed redundant double cast and `?? null` no-op in the ref setter. For provenance purposes, this commit was AI assisted. * fix(ui): print clipping with overlay scrollbar wrappers When <main> is wrapped in OverlayScrollArea, the library adds its own attribute-selector CSS rules: `[data-overlayscrollbars~="host"]` gets `overflow: hidden !important` and `[data-overlayscrollbars-viewport]` gets `overflow-x/y: hidden` (or scroll) with fixed viewport heights. These beat our existing `main { overflow: visible !important }` print override on specificity — attribute selectors outrank tag selectors even when both use `!important`. Result: long plans printed only the currently-visible viewport instead of flowing across pages. Fix: add a print-scoped override that targets the library's attribute selectors directly, setting overflow:visible, height:auto, max-height:none, and display:block to defeat both the overflow clip and the flex layout the library applies to host/padding wrappers. Verified by printing a multi-page plan in the dev server. For provenance purposes, this commit was AI assisted. * fix(ui): persistent overlay scrollbar, remove dead reduced-motion rule Switch autoHide from 'leave' to 'never'. The previous behavior faded the scrollbar 800ms after the pointer left the scroll host, which felt broken in a common interaction pattern: click a TOC entry (pointer in the sidebar) → trackpad-scroll (pointer still in sidebar) → 800ms idle → scrollbar disappears. User had to hover the right edge to bring it back on every interaction. Persistent visibility matches the pattern used by every editor-class technical app (VS Code, Zed, JetBrains, Xcode, Sublime) where the scrollbar is both a position indicator and a targeting surface for click-to-jump. Overlay scrollbars cost zero layout space, so "always visible" has no downside. Also removes the dead `.os-theme-plannotator .os-scrollbar` selector from the reduced-motion block. The library applies the theme class directly to the .os-scrollbar element itself (verified in the library runtime source, not just CSS), so a descendant selector with a space matches nothing. The track and handle selectors in the same block work correctly (they really are descendants) and are preserved. The component's own prefers-reduced-motion hook and helpers are now unused (autoHide is unconditionally 'never') and removed. Reduced motion is still honored for the hover color + width transitions on track/handle via the CSS @media (prefers-reduced-motion: reduce) block in theme.css, which the browser evaluates independently. For provenance purposes, this commit was AI assisted. * docs(ui): update OverlayScrollArea jsdoc to match persistent-scrollbar behavior The component header still described the old autoHide:'leave' behavior and implied the reduced-motion branch was in the component itself. Neither is true after cf137bf. Rewrite the jsdoc to describe the current behavior: always visible, no fade, reduced-motion handled via a CSS media query in theme.css rather than a React branch. For provenance purposes, this commit was AI assisted. * fix(ui): recompute scrollbar on content resize (pierre/diffs expand-lines) When pierre/diffs expanded context lines on a file whose diff previously fit inside the viewport, the scrollbar stayed hidden until the user manually scrolled or dragged the split-ratio handle to force a layout recalculation. Root cause: OverlayScrollbars' internal content observer doesn't see the mutation because pierre/diffs renders inside a shadow DOM, and MutationObserver does not pierce shadow DOM by default. The library's own host-level size observer doesn't help either — the host (our <main> / flex-1 container) has a fixed layout size that doesn't change when content grows. Fix: track the OverlayScrollbars instance in state and attach a ResizeObserver to the viewport's first element child in a useEffect. When the content's layout box grows — which happens even when the growth originates inside a shadow tree, because layout size propagates from shadow content to the shadow host — the observer fires and calls `instance.update(true)` to recompute scrollbar visibility. The call is debounced through requestAnimationFrame so the browser commits the new layout before OverlayScrollbars reads dimensions. Verified manually in the compiled binary against PR #509 itself: opening a small file, clicking pierre's expand-lines control, now reveals the scrollbar immediately. No regression observed in normal scroll / click-to-jump / file-switch / annotation-click paths. For provenance purposes, this commit was AI assisted. * docs(ui): document ResizeObserver content-resize mechanism Add the content-resize auto-recompute behavior to OverlayScrollArea's jsdoc header so the "what does this component do" summary is complete. The inline comment on the effect already explains the mechanism; this just surfaces it at the top. For provenance purposes, this commit was AI assisted.	2026-04-07 14:17:32 -07:00
Michael Ramos	1e8a60ba93	feat(plan): complete sticky actions — pin toolstrip + badges on scroll (#510) ... * feat(plan): complete sticky actions — pin toolstrip + badges on scroll The sticky actions setting previously only pinned the action button cluster on the right side of the plan card. The annotation toolstrip (selection mode + editor mode toggles) and the left-side badges (repo / branch / plan-diff) scrolled away, forcing users to scroll back to the top of long plans to switch modes or jump into diff view. Adds a ghost sticky header lane that pins the toolstrip and badges on the same horizontal plane as the already-sticky action buttons once the user scrolls past the top of the document. Top-of-document rendering is unchanged. - Extract the badge cluster into a reusable `DocBadges` component with `column` / `row` layouts so the card's absolute cluster and the ghost bar share the same markup. - Add a `compact` prop to `AnnotationToolstrip` that disables hover expansion (only the active button shows its label) and hides the help link, for use inside the ghost bar. - Introduce `StickyHeaderLane`: a zero-height sticky wrapper with an absolute-positioned bar that fades + slides in via IntersectionObserver on a sentinel. Uses a 72px top rootMargin so the bar only materializes after the real toolstrip has scrolled off. - Hidden in plan-diff, archive, and linked-doc modes, and gated by the existing `stickyActionsEnabled` preference. For provenance purposes, this commit was AI assisted. * fix(plan): mobile sticky lane, keyboard a11y, action button overlap Iteration on the sticky header lane addressing review feedback and in-browser testing across viewport sizes: - Mobile (<640px): the bar now drops to its own full-width row at top: 52px, directly below the action buttons row. Two stacked horizontal lanes — no horizontal collision possible. The toolstrip switches to icon-only on mobile so the diff badges fit alongside. - sm-md (640-1023px): bar shares the top: 12px lane with action buttons, capped at `max-w-[calc(100%-340px)]` to clear the short- label action button cluster (Attachments + Comment + Copy ≈ 320px). - lg+ (1024px+): same shared-lane behavior, cap raised to 400px to clear the full-label cluster. - Bar is `inline-flex` (content-width), not flex (full bounding-box width), so the chrome wraps tightly to the toolstrip + badges and doesn't extend visually past where it needs to. - Add `inert` to the bar when not stuck — removes the hidden subtree from the tab order entirely so keyboard users don't land on invisible duplicate controls before reaching the real toolstrip. - Add `iconOnly` prop to AnnotationToolstrip; passed via JS-driven matchMedia('(max-width: 639px)') in StickyHeaderLane. Active button expansion is preserved on sm+ so users still see the current mode label there. - Bump action button label breakpoint md → lg in Viewer so "Comment" and "Copy" stay short labels until 1024px, giving the action button cluster more breathing room on tablet/laptop widths. For provenance purposes, this commit was AI assisted.	2026-04-07 12:30:10 -07:00
Michael Ramos	91f57ad7a2	feat(ui): highlight external SSE annotations inline on plan text (#511) ... * feat(ui): highlight external SSE annotations inline on plan text External annotations posted via /api/external-annotations previously appeared in the sidebar only. They now highlight the matching `originalText` span in the rendered plan, giving tools (linters, agents) an optional way to attach feedback to specific phrases — while `GLOBAL_COMMENT` (or any annotation without `originalText`) still degrades to sidebar-only. Implementation is a new focused hook that drives the Viewer's existing imperative `applySharedAnnotations` / `removeHighlight` API, reusing the same DOM text-search path that share-URL restoration uses. No protocol change, no schema change to `transformPlanInput`, and App.tsx gains only a single hook call. The hook tracks applied ids with a type+originalText fingerprint so SSE updates correctly remove+reapply, clears its bookkeeping only on plan markdown change (where blocks re-render), and early-returns (preserving state) while diff view or a linked doc overlay is active so SSE removals arriving under those conditions still reconcile when the hook re-enables. For provenance purposes, this commit was AI assisted. * fix(ui): repaint external SSE highlights after share import, clean dead code Addresses three review findings on the external annotation highlight hook: - Share-import wipe: `importFromShareUrl` merges annotations without changing `markdown`, so our `planKey` stayed stable. The share-apply effect in App.tsx calls `clearAllHighlights()` to reset the DOM before applying imported annotations — which also wiped live external SSE highlights. The hook believed they were still painted and never re-drove them, leaving sidebar entries with no visible highlight until the next SSE event. Fix: hook now exposes a `reset()` that clears its applied-set and re-runs the main effect via a counter; App.tsx calls it right after `clearAllHighlights()` in the share-apply path. - Removed a dead `nextIds.has(a.id)` guard inside the apply timer callback. `toAdd` is computed as a subset of `eligible`, and `nextIds` was built from `eligible.map(.id)`, so the guard was vacuously always true. - Removed the stable `viewerRef` from the main effect's dep array; React ref objects have stable identity for the component's lifetime so it was noise. Added a comment noting the intentional omission. For provenance purposes, this commit was AI assisted. * docs(ui): note reset() in useExternalAnnotationHighlights header comment For provenance purposes, this commit was AI assisted.	2026-04-07 11:10:23 -07:00
foxytanuki	b7af16a54c	fix: support underscore italics in markdown renderer (#504)	2026-04-07 08:02:41 -07:00
Michael Ramos	dd04e6b1cd	feat: add Conventional Comments support to code review (#501) ... * feat: add Conventional Comments support to code review Add structured label system based on the Conventional Comments spec (conventionalcomments.org) to the code review annotation toolbar. - Label picker with 9 default labels (suggestion, nit, question, issue, praise, thought, note, todo, chore) shown above the comment textarea - Per-label blocking/non-blocking toggle for labels where severity is ambiguous (issue, suggestion, todo, chore) - Labels exported as `**label** (decoration): text` in markdown feedback, naturally readable on GitHub and machine-parseable - Label badges shown on inline annotations and sidebar cards - Settings tab (Comments) with: master on/off toggle, editable label list with add/remove/rename, per-label blocking decorator toggle, educational intro with spec link and example output - Feature is off by default, persisted via config store - Custom labels supported via settings (up to 12) For provenance purposes, this commit was AI assisted. * fix(review): address conventional comments review feedback Fix label clearing bug where editing an annotation to remove its conventional label silently preserved the old value. Fix parseCCLabels accepting 'non-blocking' as a truthy blocking value. Fix duplicate custom label identities when adding multiple labels. Prepend conventional prefix to platform PR/MR inline comments. For provenance purposes, this commit was AI assisted. * fix(server): persist conventionalComments setting to config.json All six server config handlers (bun plan/review/annotate + pi plan/review/annotate) now accept and save the conventionalComments boolean, so the setting survives server restarts. For provenance purposes, this commit was AI assisted. * fix: add conventionalComments to server config round-trip getServerConfig() was not returning the conventionalComments value from config.json, so the setting silently reset to false on cookie clear or new browser sessions. Also adds the field to the PlannotatorConfig interface so saveConfig() is properly typed. For provenance purposes, this commit was AI assisted. * fix: label display, export, and draft persistence for conventional comments - Remove slug derivation from label editing — store display text verbatim so badges and exports show what the user typed - Emit conventional prefix in export even when annotation has no prose text (suggestion-only annotations were losing their label) - Include conventionalLabel in draft save condition so label selection persists across file switches For provenance purposes, this commit was AI assisted. * fix: spec-compliant export format and empty label support - Wrap label + decorations + colon in markdown bold per the Conventional Comments spec examples (was bolding only the label) - Allow users to clear all labels — empty array no longer falls back to defaults in either the picker or the settings parser - Enable blocking decorator on the question label by default; the spec permits blocking questions and they sometimes are critical For provenance purposes, this commit was AI assisted. * fix: server-sync conventionalLabels and small cleanups - Sync conventionalLabels to ~/.plannotator/config.json so custom label configurations survive cookie clears and remote/SSH sessions, matching the persistence story for conventionalComments. Stored as a parsed array on disk; serialized as JSON string in the local config store to match the cookie format. - Remove no-op intermediate variable in handleSubmitAnnotation; pass conventionalLabel/decorations directly with proper coalescing per call path (edit preserves null, add coalesces to undefined). - Use index-prefixed key in the picker label list to avoid React warnings if duplicate labels ever exist. For provenance purposes, this commit was AI assisted.	2026-04-06 22:27:47 -07:00
l10veu602	719fd96cad	fix(review): show P4 added files in code review (#494) ... P4 added files (p4 add) were not appearing in the review UI on Windows. The root cause was \r\n line endings from P4 command output — splitting on \n left \r in file paths, causing Bun.file() to fail silently. - Normalize \r\n to \n in runP4() stdout for all P4 commands - Strip \r\n from file content in getNewFileDiff() - Replace fragile index-based p4 where parsing with -ztag structured output, which is also more robust for stream depots and overlays Co-authored-by: yslee <yslee@abutton.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-06 22:20:12 -07:00
Michael Ramos	d710284020	chore: bump version to 0.17.1 ... For provenance purposes, this commit was AI assisted.	2026-04-06 18:14:11 -07:00
Michael Ramos	181d2a10d5	fix(pi): full PR review parity with Bun server (#503) ... ## Summary Full Pi PR review parity with Bun server, plus shared fixes and UI improvements. ### Pi PR Review (new) - Parse PR/MR URLs, authenticate, fetch metadata and diff - Create local worktree (same-repo) or shallow clone (cross-repo) for agent file access - Full server parity: all 27 feature areas audited and aligned ### Shared Fixes (Bun + Pi) - parseRemoteUrl: GitLab subgroup support, SSH+port, HTTPS non-standard port - Cross-repo clone: --hostname replaced with GH_HOST/GITLAB_HOST env vars - Cross-repo clone: shallow fetch depth 50 → 200 - Git Add button disabled in PR review mode (client-side) - DiffViewer: eliminate dark flash on file switch (sync theme init) ### UI - Resolved/Outdated toggle filters in PR comments tab For provenance purposes, this commit was AI assisted.	2026-04-06 18:06:38 -07:00
Michael Ramos	e3f6fc8f45	fix: add mergeBaseSha to GitlabMRMetadata for type union compatibility ... For provenance purposes, this commit was AI assisted.	2026-04-06 13:10:31 -07:00
Michael Ramos	0e1ea9e363	fix(review): use merge-base SHA for PR file contents ... gh pr diff computes diffs against the merge-base (common ancestor), but file contents were fetched at baseSha (base branch tip). When the base branch has moved since the branch point, line counts don't match the diff hunks, causing iterateOverDiff trailing context mismatch crashes. Fetch the merge-base SHA via GitHub's compare API and use it for old file contents. Added try/catch around processFile as a safety net. Fixed in both Bun and Pi servers. For provenance purposes, this commit was AI assisted.	2026-04-06 13:05:30 -07:00
Michael Ramos	566df72f11	chore: bump version to 0.17.0 ... For provenance purposes, this commit was AI assisted.	2026-04-06 12:36:15 -07:00
Michael Ramos	702c87853b	feat(review): token-level code selection for annotations (#500) ... * feat(review): token-level code selection for annotations Add the ability to click individual syntax tokens in the diff viewer to create annotations with precise code context. Uses Pierre v1.1.12's onTokenClick/onTokenEnter/onTokenLeave callbacks. - Click a token → toolbar opens with token text in header - Click same token again → deselects - Gutter line selection still works independently - Token metadata (charStart, charEnd, tokenText) stored on CodeAnnotation - Sidebar shows token badge, export includes token context For provenance purposes, this commit was AI assisted. * fix(review): token draft roundtrip, export precision, truncation alignment - Persist tokenSelection in drafts so token context survives file switches - Include char offsets in exported feedback for duplicate token disambiguation - Escape backticks in token text to prevent broken markdown fences - Align sidebar token truncation to 30 chars (matching toolbar header) For provenance purposes, this commit was AI assisted.	2026-04-06 12:24:33 -07:00
Michael Ramos	b375a804b2	feat(review): AI review agents, local worktree, and UI polish (#491) ... * feat(review): add Codex AI review agent with live logs, --local worktree, and panel UI Hook up Codex as the first AI review agent in the code review system: - Spawn `codex exec` with Codex's native review prompt and output schema - Parse structured findings (ReviewOutputEvent) and push as external annotations - Annotations appear inline in the diff viewer pinned to specific lines - Review verdict (correct/incorrect + confidence + explanation) displayed in panel Agent job infrastructure enhancements: - Server-side command building via `buildCommand` callback (providers don't need frontend commands) - Result ingestion via `onJobComplete` callback (reads output file, transforms findings) - `addAnnotations` method on external annotation handler (bypasses HTTP for server-internal producers) - Live stderr streaming via `job:log` SSE events with 200ms buffer-and-flush - `cwd` and `summary` fields on AgentJobInfo PR review with --local worktree: - `plannotator review <PR_URL> --local` creates a temp git worktree with the PR branch - Agent gets full local file access without touching the user's working tree - Hybrid server mode: both prMetadata (platform features) and gitContext (local access) - Automatic worktree cleanup on session end - Runtime-agnostic worktree primitives in packages/shared/worktree.ts Panel UI redesign: - Findings | Logs tab system with underline-style tabs - LiveLogViewer component with auto-scroll, truncation, and copy - Review verdict card (correct/incorrect with confidence and explanation) - Pending state with labeled "Review Verdict — Pending..." (not skeleton bars) - Job card click opens detail panel directly (removed separate icon button) - Dismissed annotation tracking (deleted annotations persist as "dismissed" in panel) - Copy all annotations as formatted markdown - Worktree badge in header with info dialog showing path - CopyButton extended with inline variant for reuse - ConfirmDialog extended with wide option For provenance purposes, this commit was AI assisted. * style(review): UX polish pass — visual quality improvements across code review UI - VerdictCard: remove AI-template left-border, use background-only tint - Inline annotations: 6px radius, subtle shadow, hover elevation, action button scale - File tree: tighter indentation (4 + depth*10), reduced container padding - Select dropdowns: normalized to 4px border-radius matching pierre diffs - Dockview tabs: close button pushed to far right with margin-left auto, visible at 0.25 opacity - PR icons moved from sidebar to header (next to PR link) - AnnotationRow: translate-x hover feedback - Border-radius normalized to `rounded` (4px) across all components - Type scale consolidated: text-[8px]/[9px] → text-[10px], text-[11px] → text-xs - Sidebar tab hit targets increased (px-2.5 py-1.5, w-4 icons) - Sticky file group headers in annotation sidebar - FileTree controls collapsed (worktree + diff selectors share one row) - Tab micro-animations (transition-all duration-150) - ScrollFade component for gradient indicators on scrollable containers - Prose containment: max-w-2xl + px-6 padding on PR Summary/Comments/Checks panels - MarkdownBody: leading-relaxed for comfortable reading - PR Comments: surface lift (bg-muted/10), hover feedback, author font-semibold - PR Checks: link affordance (text-primary, underline on hover, external link icon) For provenance purposes, this commit was AI assisted. * feat(review): PR comments panel — search, filter, collapse, navigation, and polish Comments panel enhancements: - Search: real-time text filter across author and body, match count display - Keyboard navigation: j/k to move between comments, scroll-to-selected - Sort: toggle between oldest/newest first - Collapsible comments: click header to collapse, collapse/expand all controls - Author exclusion filter: click authors to hide their comments (not inclusion) - Comment actions: hover-reveal "View on GitHub" link + copy button (bottom-right) - Review URLs: PRReview type now includes optional url field, populated from GitHub API PR Summary fixes: - Label contrast: use theme foreground color for label text instead of raw GitHub hex - Linked issues: replaced broken hardcoded SVG with proper GitHub Octicons issue-opened icon Data plumbing: - platformUser exposed through ReviewStateContext for "Mine" filtering - Panel wrapper changed to overflow-hidden for sticky toolbar support - "Commented" review badge hidden (noise — only show Approved/Changes Requested/Dismissed) For provenance purposes, this commit was AI assisted. * feat(review): inline review threads with outdated/resolved state and diff hunk previews PR Review Threads: - Fetch inline code review comments via GitHub GraphQL (reviewThreads query) - PRReviewThread and PRThreadComment types with isResolved, isOutdated, path, line, diffSide - ThreadCard component: file/line context, Outdated/Resolved badges, nested replies - Resolved/outdated threads: gradient fade on body with "Show full comment" expand - GitLab: reviewThreads placeholder (TODO: parse DiffNote positions from notes) DiffHunkPreview: - Renders diff hunks using @pierre/diffs FileDiff component (read-only, compact) - Full theme integration: reads computed CSS vars, injects via unsafeCSS (same as main DiffViewer) - Respects user font settings from ReviewState context - Handles bare GitHub diffHunk format (prepends synthetic file headers for pierre parsing) Comments Panel Polish: - Comment cards: bg-card + subtle shadow for depth and isolation from panel background - Hover: shadow elevation (0_2px_6px) for interactive feedback - Thread cards: dimmed shadow for resolved/outdated, full shadow for active - Prose padding: px-8 (32px) across all dockview panels (Summary, Comments, Checks, Findings) For provenance purposes, this commit was AI assisted. * feat(review): Claude Code agent, cross-repo --local, render fixes Claude Code review agent: - claude-review.ts: prompt (adapted from code-review plugin), command builder (dontAsk + granular allowedTools/disallowedTools), JSONL stream output parser - Prompt sent via stdin (not argv) to avoid quoting/variadic flag conflicts - stream-json --verbose for live JSONL streaming + final structured_output - Same schema as Codex — transformReviewFindings is now provider-agnostic Agent jobs infrastructure: - stdout capture (captureStdout option) for providers that return results on stdout - stdin prompt writing (stdinPrompt option) for providers that read prompt from stdin - cwd override in buildCommand return for providers without -C flag - await stdoutDone before onJobComplete to prevent drain race condition - job.prompt field for transparent prompt display in detail panel Cross-repo --local: - Detect same-repo vs cross-repo via parseRemoteUrl comparison - Cross-repo: shallow clone via gh/glab repo clone (--depth 1 --no-checkout + targeted fetch) - Cross-repo uses platform diff (gh pr diff) for display, clone for agent file access - Same-repo: existing worktree path unchanged - Cleanup: rmSync for clones, worktree remove for same-repo Performance: jobLogs context split - Separate JobLogsContext to prevent high-frequency log SSE from re-rendering all panels - Only ReviewAgentJobDetailPanel subscribes to JobLogsProvider - Standard React pattern: split contexts by update frequency Image error handling: - SafeHtmlBlock component wraps dangerouslySetInnerHTML with img onerror handlers - Broken images (expired GitHub JWTs) hide on first 404 instead of flickering - Prevents console 404 flood from re-render retry loops For provenance purposes, this commit was AI assisted. * fix(review): decontaminate --local from diff pipeline, fix worktree setup, default local for PRs The --local flag was setting gitContext from the worktree, which contaminated the diff rendering pipeline — causing pierre "trailing context mismatch" errors because /api/file-content read worktree files instead of using the GitHub API. Root cause: gitContext serves two purposes — diff pipeline (file contents, diff switching, staging) and agent sandbox (cwd for agent processes). These are now properly separated via a new agentCwd option on ReviewServerOptions. Changes: - Add agentCwd to ReviewServerOptions, independent of gitContext - Agent handler (getCwd, buildCommand, onJobComplete) prefers agentCwd - Stop setting gitContext in --local PR path — diff pipeline untouched - Revert band-aid !isPRMode guards (no longer needed) - Fix same-repo worktree: fetch origin/<baseBranch> so agents see correct diff - Fix cross-repo clone: create local branch at baseSha for git diff accuracy - Fix FETCH_HEAD ordering: fetch base branch before PR head (createWorktree needs PR tip) - Fix macOS path mismatch: realpathSync(tmpdir()) so agent paths strip correctly - Change buildCodexReviewUserMessage signature from GitContext to focused options - Make --local the default for PR/MR reviews (--no-local to opt out) - Pass agentCwd to client for worktree badge display For provenance purposes, this commit was AI assisted. * style(review): unify panel headers, responsive buttons, dockview polish - Unify all panel headers at 33px via --panel-header-h CSS variable - FileHeader now uses shared variable instead of hardcoded 30px - Dockview tab bar height, font size, and padding aligned with sidebars - FileTree header uses fixed height instead of padding-based sizing - Consistent border opacity (border-border/50) across all panels - Consistent font weight (font-semibold) on all header labels - Remove dockview tab focus outline (::after pseudo-element) - Dockview tab close button pushed to right edge - Tab bar void area uses muted background - Top app header compacted from h-12 to py-1 - Sidebar footer: copy button and diff stats side by side - FeedbackButton responsive labels (Send/Post at md, full labels at lg) - Move ReviewAgentsIcon to packages/ui for shared use - Agent empty state uses shared ReviewAgentsIcon instead of hardcoded SVG - Sidebar header label truncates when narrow (tabs never clip) - Detail panel prompt disclosures get proper spacing - React.memo on PR tab components (PRSummaryTab, PRCommentsTab) - Inline onerror on img tags for broken GitHub image handling For provenance purposes, this commit was AI assisted. * fix: type assertion for Bun stdin FileSink Bun's proc.stdin is typed as `number | FileSink` but we need to call .write() and .end() on it. Cast to FileSink to satisfy tsc --noEmit. For provenance purposes, this commit was AI assisted. * fix(review): XSS in sanitizeHtml, git flag injection, cross-repo ref mismatch Security: - Remove `onerror` from DOMPurify ALLOWED_ATTR — was allowing arbitrary JS execution via PR descriptions containing `<img onerror="...">`. Replace with SafeHtml component that attaches error handlers via useEffect + ref. - Add `--` end-of-options separator to git fetch and git branch calls to prevent flag injection via crafted branch names from API responses. Bug fix: - Cross-repo clones now create both local branch AND remote-tracking ref (`refs/remotes/origin/<baseBranch>`) at baseSha, so agents can use either `git diff main...HEAD` or `git diff origin/main...HEAD`. Polish: - Add copy button to verdict card in agent detail panel - Remove hover:translate-x animation from finding rows - Reduce file tree indent per level, remove extra file offset - Add pr-action endpoint logging for debugging submit failures For provenance purposes, this commit was AI assisted. * chore: upgrade @pierre/diffs from 1.1.0-beta.19 to ^1.1.12 The beta pin was needed for processFile() API (expandable diff context), which shipped in 1.1.0 stable on March 14. We were 13 releases behind. Notable fixes in the upgrade path: - 1.1.5: Fix diffAcceptRejectHunk with partial FileDiffMetadata - 1.1.6: Patch parsing fix for renames and dotfiles - 1.1.8: Fix maxLineDiffLength regression May resolve intermittent "trailing context mismatch" errors in diff rendering. For provenance purposes, this commit was AI assisted. * fix(review): remove shell provider, flag injection, Claude log formatting, copy UX Security: - Remove shell provider from agent capabilities (unauthenticated RCE vector) - Move `--` before prRepo in `gh repo clone` to prevent flag injection Features: - Wire up formatClaudeLogEvent — Claude live logs now show readable text instead of raw JSONL - Sidebar annotations: copy + delete buttons appear on hover (no overlap) - Agent finding rows: copy button on hover (progressive disclosure) - Verdict card: copy button pushed to the right - File tree: reduced indent per level, files aligned with folders Infra: - PR action endpoint logging for debugging submit failures For provenance purposes, this commit was AI assisted. * fix: validate repo identifier to prevent flag injection in gh repo clone The `--` separator in `gh repo clone` separates gh args from git args, not positional args from flags. Using `--` before prRepo would break the git flags. Instead, validate that the repo identifier doesn't start with `-` to prevent flag injection via crafted PR URLs. For provenance purposes, this commit was AI assisted. * feat(review): Claude-specific review model with severity, reasoning, and multi-agent prompt Claude review agent now has its own schema, prompt, and transform — separate from Codex's P0-P3 priority model. Each provider uses its natural review style. Schema changes: - Claude findings use severity (important/nit/pre_existing) instead of priority (0-3) - Flat structure: file, line, end_line instead of nested code_location - description (single field) instead of title + body - reasoning field captures the validation chain per finding - summary with counts instead of overall_correctness/confidence Prompt: Converges the open-source Claude Code review prompt with the remote review service model. 4 parallel agents (Bug+Regression at Opus, Security at Opus, Code Quality at Sonnet, Guideline Compliance at Haiku), validation step, deduplication, severity classification. CLAUDE.md and REVIEW.md awareness. UI: Severity markers (colored dots) on finding rows. Collapsible reasoning section via <details>. New optional severity/reasoning fields on CodeAnnotation and the external annotation store — backward compatible, only set by Claude. Transform: transformClaudeFindings normalizes Claude output into the shared annotation format. Codex path (transformReviewFindings) is completely untouched. For provenance purposes, this commit was AI assisted. * fix: use bg-amber-500 for nit severity dot (bg-warning may not be defined) For provenance purposes, this commit was AI assisted. * fix: security hardening, debug cleanup, deduplication, Pi mirroring, findings UX Security: - Add -- separator to ensureObjectAvailable git fetch (worktree.ts) - Validate baseBranch against path traversal (..) before git ref operations - Use process.once('exit') instead of process.on for worktree cleanup Debug: - Gate debugLog behind PLANNOTATOR_DEBUG env var (no more unconditional writes) - Remove PARSE_OUTPUT_RAW dump that logged full JSON output to disk Deduplication: - Extract toRelativePath to packages/server/path-utils.ts (was duplicated in codex-review.ts and claude-review.ts) Pi extension: - Remove shell provider from capabilities - Add buildCommand callback to AgentJobHandlerOptions - POST handler calls buildCommand for server-side command synthesis UI: - Findings sorted by severity (important → nit → pre_existing) - Severity legend under findings header (colored dots) - Reasoning always visible (not collapsible) — fixes click navigation bug where <details> captured click events and broke annotation linkage - Full finding text shown (removed line-clamp-2 truncation) - Sidebar annotation hover actions aligned to the right - DiffHunkPreview: cancel requestAnimationFrame on unmount For provenance purposes, this commit was AI assisted. * fix: move toRelativePath import to top of claude-review.ts For provenance purposes, this commit was AI assisted. * fix: same-repo detection compares host, platform-aware comment links, remove design docs - Same-repo detection now compares both owner/repo AND hostname from the git remote URL against prMetadata.host. Prevents false positives on GitHub Enterprise where different instances share org/repo names. - "View on GitHub" label in PR comments tab now shows "View on GitLab" for GitLab MR comments based on the comment URL. - Remove internal design docs (PR_LOCAL_WORKTREE.md, AGENT_LIVE_LOGS.md) that were development artifacts, not user-facing documentation. For provenance purposes, this commit was AI assisted. * fix(review): show severity markers and reasoning in inline diff annotations The severity and reasoning fields from Claude findings were only visible in the agent detail panel, not in the inline diff annotations. Now: - DiffAnnotationMetadata carries severity and reasoning fields - DiffViewer passes them through when mapping annotations - InlineAnnotation renders colored severity dot and reasoning text For provenance purposes, this commit was AI assisted. * fix: prefix Claude findings text with [severity] tag Findings now show as "[important] description", "[nit] description", "[pre_existing] description" — consistent with Codex's [P0]/[P1] tags. For provenance purposes, this commit was AI assisted. * feat(pi): full agent review mirroring — stdin, stdout, live logs, result ingestion Pi extension agent-jobs handler now mirrors the Bun server's full capabilities: - stdin piping for Claude prompt delivery - stdout capture for Claude JSONL stream parsing - Live stderr streaming with 200ms buffer-and-flush for job:log events - Claude JSONL formatting via vendored formatClaudeLogEvent - onJobComplete callback for result parsing and annotation push - Full buildCommand integration in POST handler - jobOutputPaths tracking with cleanup on kill Pi serverReview.ts now wires buildCommand and onJobComplete with the same logic as the Bun review server — Codex and Claude commands are built server-side, results are parsed and transformed into external annotations. Runtime compatibility: replaced Bun.file/Bun.write in codex-review.ts with node:fs/promises equivalents (writeFile, readFile, existsSync) that work on both Bun and Node. Verified Bun build passes. Vendoring: vendor.sh now copies codex-review.ts, claude-review.ts, and path-utils.ts from packages/server/ with import path rewriting for the generated/ layout. Also: Review Prompt label, px-8 padding on agent detail header/tabs/logs. For provenance purposes, this commit was AI assisted. * fix: remove duplicate isPRMode declaration in Pi serverReview.ts For provenance purposes, this commit was AI assisted. * fix: include reasoning in all copy and feedback export paths - exportReviewFeedback: appends **Reasoning:** after finding text - Per-finding copy button: appends reasoning to copy text - Sidebar annotation copy: appends reasoning to copy text This ensures reasoning flows through Copy All, Send Feedback, and individual copy actions — not just the visual rendering. For provenance purposes, this commit was AI assisted. * fix: six verified findings — navigation, dedup, cleanup, copy, diff match, Windows paths 1. openDiffFile: clicking a finding now navigates to the correct file before selecting the annotation (was silently selecting in wrong file) 2. SEVERITY_STYLES: extracted to packages/ui/types.ts as shared constant, imported in both ReviewAgentJobDetailPanel and InlineAnnotation (was duplicated with per-render rebuild in InlineAnnotation) 3. killJob: added jobOutputPaths.delete calls to match Pi's version (was leaking two strings per killed job) 4. CommentActions: replaced hand-rolled copy with CopyButton inline variant (was reimplementing useState/clipboard/setTimeout pattern) 5. Branch mode prompt: changed from three-dot to two-dot to match the UI's actual diff computation (agent was reviewing different diff) 6. toRelativePath: uses path.relative + forward-slash normalization for Windows compatibility (was string prefix matching with / only) For provenance purposes, this commit was AI assisted. * perf: wrap ReviewSidebar in React.memo to prevent re-renders during log streaming Every job:log SSE event triggers setJobLogs in useAgentJobs, which re-renders App.tsx. Without memo, the sidebar re-renders on every event (~5/sec) even though its props (agentJobs.jobs, capabilities, callbacks) haven't changed. This caused visible flickering when a review tab was open during agent runs. React.memo shallow-compares props — all sidebar props are stable references (jobs array only changes on status events, callbacks are useCallback-wrapped), so the sidebar correctly skips re-renders during log streaming. For provenance purposes, this commit was AI assisted. * fix(security): remove find/ls/cat from Claude allowed tools, add glab CLI Security: Bash(find:*) allowed find -exec to spawn arbitrary subprocesses that bypassed --disallowedTools. Removed find, ls, and cat — Claude has Glob, Read, and Grep built-in which cover file access without shell exec. Feature: Added glab mr view/diff/list and glab api to allowed tools so Claude can inspect GitLab MR context in remote-mode reviews. For provenance purposes, this commit was AI assisted. * fix: Pi addAnnotations, Pi stdout drain, cross-repo exit codes Pi extension: - Add addAnnotations() to external-annotations.ts return object — serverReview.ts calls it when agent jobs complete but the method was missing (build/runtime error) - Change proc.on('exit') to proc.on('close') in agent-jobs.ts — Node's 'exit' fires before stdio streams drain, so stdoutBuf could be incomplete when onJobComplete parses Claude's JSONL result Cross-repo --local: - Check git checkout FETCH_HEAD exit code — throw if it fails so the outer catch falls back to remote-only with a clear warning - Log warning if baseSha fetch fails (non-fatal, agents just can't diff locally) For provenance purposes, this commit was AI assisted. * fix: FETCH_HEAD ordering, Pi worktree-aware cwd, SEVERITY_ORDER hoisted Critical: - Move ensureObjectAvailable before PR head fetch — it can overwrite FETCH_HEAD if baseSha needs fetching, causing createWorktree to check out the base commit instead of the PR head - Pi serverReview.ts: extract resolveAgentCwd() helper used by getCwd, buildCommand, and onJobComplete — was bypassing worktree-aware path resolution, causing agents to run in wrong directory Cleanup: - Hoist SEVERITY_ORDER to module scope in ReviewAgentJobDetailPanel (was recreated inside component body on every render) For provenance purposes, this commit was AI assisted. * fix: Bun/Pi parity — provider default, annotation error logging - Bun agent-jobs: change provider default from "shell" to "" (shell was removed from capabilities, default should match Pi) - Pi serverReview: log errors from addAnnotations in onJobComplete (Bun logs them, Pi was silently ignoring) For provenance purposes, this commit was AI assisted. * docs: add AI Code Review Agents guide with full prompt transparency New docs page covering: - Overview of Codex and Claude review agents - How findings work (severity/priority, reasoning, navigation) - Local worktree behavior (same-repo vs cross-repo) - Full transparency section with: - Claude multi-agent pipeline prompt (all 6 steps) - Claude command and allowed/blocked tools - Codex review prompt and command - Both output schemas (Claude severity + Codex priority) - Security notes (read-only, no network, local execution, no commenting) - Customization via CLAUDE.md and REVIEW.md For provenance purposes, this commit was AI assisted. * docs: add provenance links for Claude and Codex review integrations Credit Anthropic's Claude Code Review service, the open-source code-review plugin, and OpenAI's Codex CLI as the foundations for our review agent integrations. For provenance purposes, this commit was AI assisted. * fix: temp clone leak, j/k key conflict, thread header null line - Cross-repo: clean up localPath in catch block when fetch/checkout fails after clone succeeds (directory was leaking in /tmp) - Remove j/k/arrow keyboard navigation from PR comments panel — these shortcuts belong to the file tree only, both registering global handlers caused double-navigation - Thread header null guard: check thread.line before building range label to prevent "L12–null" for outdated GitHub threads For provenance purposes, this commit was AI assisted. * fix: hoist localPath for catch-block scope, validate baseSha format The previous rmSync(localPath) in the catch block was dead code — const declarations inside try are not in scope in catch (separate lexical environments per ECMAScript spec). The ReferenceError was silently swallowed by the inner try/catch, so temp directories still leaked on failed fetch/checkout. Fix: hoist `let localPath` before the try block so it's accessible in catch. Guard with `if (localPath)` since the error could occur before assignment. Also: validate baseSha is a hex SHA (40-64 chars) to prevent git flag injection via crafted API responses. Validate baseBranch rejects both '..' and '-' prefixes. For provenance purposes, this commit was AI assisted. * docs: rewrite AI Code Review guide for clarity and readability Restructured for a technical audience: shorter paragraphs, cleaner tables, removed em-dashes and filler prose, tightened the pipeline diagram, streamlined security section into scannable single-line items. For provenance purposes, this commit was AI assisted. * docs: rewrite transparency section with exact prompts and commands Replaced summarized/paraphrased transparency section with the actual prompts, commands, schemas, and tool allowlists as they exist in the code. One short security note at the top, then raw content. For provenance purposes, this commit was AI assisted. * docs: add mini TOC to transparency section For provenance purposes, this commit was AI assisted. * fix: stdout drain hang, Codex verdict override, Claude parse logging, memo removal Critical: - Race stdoutDone against 2s timeout after proc.exited — prevents permanent job hang when Bun's ReadableStream doesn't close after process exit. The process is dead; 2s is a cleanup deadline. Bug fix: - Codex verdict: override to "Issues Found" when P0/P1 findings exist, regardless of the freeform overall_correctness string. Prevents green "Correct" badge when Codex says "mostly correct but has issues." P2/P3-only findings still trust Codex's verdict. Observability: - Log Claude parse failures with buffer size and last 200 bytes so we can diagnose empty-findings cases. Performance: - Remove React.memo from ReviewSidebar — was blocking legitimate re-renders (job status, findings) to prevent cosmetic log flickering. The tradeoff was wrong. Docs: - Remove "shell" from CLAUDE.md capabilities table (provider was removed). For provenance purposes, this commit was AI assisted. * fix: type assertions for Bun ReadableStream async iteration Bun's proc.stdout/stderr support for-await at runtime but TypeScript's ReadableStream type doesn't declare [Symbol.asyncIterator]. Cast through unknown to AsyncIterable<Uint8Array> — standard Bun workaround, same pattern as the FileSink cast for stdin. For provenance purposes, this commit was AI assisted.	2026-04-06 12:15:27 -07:00
Esteban Sanchez	70b0cfb34e	fix(annotate): support @ markdown file references (#488) ... OpenCode can pass annotate targets as @file references, so resolve markdown paths with an @ fallback only after the primary lookup misses. This preserves real @-prefixed filenames while making @README.md and quoted @ inputs resolve reliably.	2026-04-05 17:46:10 -07:00
Yoni Hornstein	03b3bdd011	feat(review): add merge-base diff option for PR-style diffs (#485)	2026-04-05 08:44:47 -07:00
Michael Ramos	d850b78ba6	fix: handle markdown hard line breaks and list continuations (#483) ... * fix: handle markdown hard line breaks and list continuation lines List items with indented continuation lines (no blank line separator) now merge into the preceding bullet instead of becoming orphan paragraphs. InlineMarkdown now converts two-trailing-space and backslash line breaks into <br> elements. Synced to the diff view's InlineMarkdown copy. Closes #482 For provenance purposes, this commit was AI assisted. * fix: allow bold/italic to span across hard line breaks Changed bold/italic regexes from .+? to [\s\S]+? so emphasis can match across newlines (per CommonMark spec). Moved hard break check after all ^-anchored inline patterns so bold/italic get first crack, then the recursive InlineMarkdown call inside <strong>/<em> handles the break. For provenance purposes, this commit was AI assisted.	2026-04-04 18:03:58 -07:00
foxytanuki	26364543b2	fix(remote): support explicit local override (#481)	2026-04-04 13:17:16 -07:00
Michael Ramos	70ad54dd70	chore: bump version to 0.16.7 ... For provenance purposes, this commit was AI assisted.	2026-04-02 15:33:48 -07:00
Michael Ramos	1800c24d80	feat(gemini): add Gemini CLI plan review integration ... * feat(gemini): add Gemini CLI plan review integration Adds a new `apps/gemini-hook/` adapter that enables Plannotator plan review for Gemini CLI users via the BeforeTool hook system. The adapter reads the plan file from disk (Gemini provides a path, not inline content), delegates to the shared @plannotator/server for the browser-based review UI, and translates the decision back into Gemini's hook output format. Requires an upstream fix (google-gemini/gemini-cli#21802) that makes `decision = "allow"` user policies work for exit_plan_mode, allowing hooks to replace the built-in TUI approval dialog. Includes: - apps/gemini-hook/server/index.ts — stdin/stdout adapter - apps/gemini-hook/hooks/ — policy TOML + settings snippet - scripts/install.sh — Gemini binary download, policy install, settings config For provenance purposes, this commit was AI assisted. * refactor(gemini): use single binary with auto-detection instead of separate app Removes apps/gemini-hook/ — the plannotator binary now auto-detects Gemini CLI from stdin (plan_path = file on disk) vs Claude Code (plan = inline content) and branches input parsing + output formatting. Config fixtures live in apps/gemini/ (policy TOML + settings snippet). Install script gates on ~/.gemini existing so Claude-only users are unaffected. For provenance purposes, this commit was AI assisted. * test(gemini): add manual sandbox script for Gemini CLI integration Three modes: - --simulate: pipes BeforeTool JSON to hook, tests approve/deny output - (default): runs local patched Gemini build - --nightly: installs Gemini nightly and runs it Backs up and restores ~/.gemini config on exit. For provenance purposes, this commit was AI assisted. * feat(gemini): add slash commands, marketing tab, and docs for Gemini CLI - Add /plannotator-review and /plannotator-annotate slash commands (.toml) - Install Gemini slash commands in all three install scripts (sh, ps1, cmd) - Add Gemini tab to marketing landing page with icon - Add Gemini CLI to top-level README install section - Create apps/gemini/README.md with full setup and usage docs - Remove stale dev:gemini script and regenerate bun.lock For provenance purposes, this commit was AI assisted. * fix(gemini): merge hook into existing settings.json instead of printing instructions When ~/.gemini/settings.json already exists, use node to JSON-merge the BeforeTool hook config rather than asking the user to do it manually. Falls back to instructions only if node is unavailable. For provenance purposes, this commit was AI assisted. * fix(gemini): handle plan_filename rename and fix scoping bug Gemini CLI nightly renamed plan_path to plan_filename in exit_plan_mode. Accept both field names for forward/backward compatibility. Reconstruct full plan path from transcript_path + session_id + plans/ + filename. Also hoist planFilename variable out of try block so it's accessible in the deny output path (was causing ReferenceError). For provenance purposes, this commit was AI assisted. * fix(gemini): dim approve button when annotations exist for Gemini CLI Gemini's hook runner ignores systemMessage on the allow path, so approve-with-feedback is silently dropped — same limitation as Claude Code. Extend the existing UI gate to also apply for gemini-cli origin. For provenance purposes, this commit was AI assisted. * fix(gemini): add AGENT_CONFIG entry and fix sandbox simulate mode Register "gemini-cli" in AGENT_CONFIG so the UI shows "Gemini CLI" with proper badge styling instead of generic "Coding Agent" fallback. Update sandbox simulate mode to match production input format: use plan_filename instead of plan_path, include transcript_path, and simulate the Gemini directory structure for path reconstruction. For provenance purposes, this commit was AI assisted.	2026-04-02 15:24:10 -07:00
Michael Ramos	a48fd8afb5	chore: bump version to 0.16.6 ... For provenance purposes, this commit was AI assisted.	2026-04-02 10:57:13 -07:00
rtsummit	e642e25124	feat: add Perforce (P4) pending changelist diff support (#472) ... * feat: add Perforce pending changelist diff support for code review Introduce P4 support alongside existing Git backend via a VCS dispatch layer (vcs.ts). Detects Git vs Perforce workspace automatically and routes diff/file-content operations to the appropriate backend. - Add p4-default and p4-changelist:<N> DiffType variants - Add P4 runtime (p4.ts): workspace detection with TTL cache, changelist context, unified diff conversion, binary file exclusion, batch p4 where - Add VCS dispatch layer (vcs.ts): auto-detect Git/P4, unified API - Update review server and CLI entry point to use VCS dispatch - Filter empty changelists from dropdown, disable staging for P4 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * refactor: introduce VcsProvider interface for extensible VCS support Replace hardcoded Git/P4 dispatch with a provider-based architecture. Each VCS implements VcsProvider interface and registers in a providers array — adding a new VCS only requires implementing the interface. - Define VcsProvider with detect, ownsDiffType, getContext, runDiff, getFileContents, and optional stageFile/unstageFile/resolveCwd - Create gitProvider and p4Provider as concrete implementations - Replace isP4DiffType/gitAddFile/gitResetFile in review.ts with provider-based canStageFiles/stageFile/unstageFile/resolveVcsCwd - Remove VCS-specific branching from review server endpoints Note: GitContext interface is not renamed to VcsContext in this commit. The rename touches too many files across the codebase (Pi extension, OpenCode plugin, shared types, tests) and should be handled as a separate pull request to keep the diff reviewable. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: rtsummit <rtsummit@abutton.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-02 10:49:24 -07:00
Sylvain DNS	2c5ebb5ad1	feat(review): prefill suggested code textarea with selected code (#470) ... When user clicks "Add suggested code" button in an annotation comment, the textarea is now pre-filled with the original selected code, allowing them to edit from there instead of typing from scratch. The cursor is positioned at the end of the prefilled text using requestAnimationFrame to ensure proper focus after state updates.	2026-04-02 08:33:33 -07:00
Ben Limmer	ada0d5f9c5	fix(review): expand file tree folders by default on initial render (#473) (#474)	2026-04-02 08:33:10 -07:00
Sylvain DNS	ee8d181cf9	fix(review): hide annotation toolbar when suggestion modal is open (#469) ... Prevent stacking dialogs by hiding the AnnotationToolbar when the SuggestionModal (expanded editor) is open, avoiding the original dialog from overlaying the fullpage dialog.	2026-04-02 08:31:42 -07:00
Michael Ramos	070f75f804	chore: bump version to 0.16.5 ... For provenance purposes, this commit was AI assisted.	2026-04-01 22:13:51 -07:00
Michael Ramos	9ae034d2ea	fix(ui): right resize handle no longer covers scrollbar (#354) (#465) ... Commit 3ac3d5b swapped the touch area bias so side="right" extended 8px leftward into the content area, covering the 6px scrollbar. Changed to `left-0 -right-3` so the touch target has zero left encroachment and extends entirely into the sidebar panel instead. For provenance purposes, this commit was AI assisted.	2026-04-01 21:58:58 -07:00
Michael Ramos	6735266d66	chore: bump version to 0.16.4	2026-04-01 15:08:26 -07:00
Michael Ramos	68418e2a35	feat(review): add dockview center workspace (#453) ... * chore(review): add dockview-react dependency * feat(review): add dockview center workspace * fix(review): stabilize diff search navigation * feat(review): add progressive file search UI * feat(review): streamline header controls * fix(review): portal annotation toolbar * refactor(review): streamline header and action menus * fix(review): make file header responsive * fix(review): align split diff drag handle * chore(review): hide review agents sidebar * fix(review): remount diff viewer on file switch * fix(review): wrap inline diff comments	2026-04-01 14:58:45 -07:00
Michael Ramos	f8d4969e73	feat(hook): improvement hook context injection for planning (#459) ... * feat(shared): add improvement hook reader utility Adds a runtime-agnostic module for reading improvement hook files from ~/.plannotator/hooks/. Uses a hardcoded base path with an allowlist of known hook files and a 50KB size cap to prevent runaway context injection. Designed for cross-harness reuse (Claude Code, OpenCode, Pi, etc.). For provenance purposes, this commit was AI assisted. * feat(hook): wire up improve-context PreToolUse hook for EnterPlanMode Adds a PreToolUse hook on EnterPlanMode that injects corrective planning instructions into Claude's context at plan mode entry. The new `plannotator improve-context` subcommand reads the improvement hook file and returns additionalContext, or silently passes through if no file exists. For provenance purposes, this commit was AI assisted. * fix(skill): update compound skill improvement hook path Moves the improvement hook file path from ~/.plannotator/compound/ to ~/.plannotator/hooks/compound/ to namespace hook-injectable files separately from other plannotator data. For provenance purposes, this commit was AI assisted. * fix(shared): add legacy path fallback for improvement hook reader Users who ran the compound skill before the path migration have their improvement hook file at ~/.plannotator/compound/ instead of the new ~/.plannotator/hooks/compound/ path. Add a fallback that checks the legacy path only when the new path is absent — if the new path exists but is invalid (empty, oversized), no fallback occurs to prevent resurrecting stale instructions. Includes tests for new-path-wins, legacy-fallback, and invalid-new-blocks-legacy scenarios. For provenance purposes, this commit was AI assisted.	2026-04-01 13:16:55 -07:00
Michael Ramos	588b6a4de7	feat(review): support GitHub Enterprise and fix self-hosted GitLab MR diffs (#460) ... * feat(review): support GitHub Enterprise and fix self-hosted GitLab MR diffs Add `host` field to GitHub PR types and update URL parsing to accept any host with `/pull/` pattern, enabling GitHub Enterprise Server URLs like `ghe.company.com/owner/repo/pull/123`. All 8 `gh` CLI functions now pass `--hostname` (for `gh api`/`gh auth`) and `HOST/OWNER/REPO` (for `gh pr`) when targeting non-github.com hosts. Replace broken `glab mr diff --hostname` invocation (glab mr subcommands don't support --hostname) with `glab api .../diffs` which does. Diffs are now reconstructed from structured API response instead of heuristic parsing of bare diff output. Closes #348 Closes #457 For provenance purposes, this commit was AI assisted. * fix(review): remove destructive regex from GitLab paginated JSON parser glab api --paginate already returns a single merged JSON array, so the regex that replaced ][ with , was unnecessary and could corrupt diff content containing array indexing patterns like arr[i][j]. For provenance purposes, this commit was AI assisted.	2026-04-01 11:40:20 -07:00
Michael Ramos	46fa92712c	feat: add Clean Contrast, Code Fork, and Midnight themes (#454) ... Three new themes derived from Cursor's color palettes. Code Fork supports both dark and light modes; Clean Contrast and Midnight are dark-only. For provenance purposes, this commit was AI assisted.	2026-03-31 22:27:17 -07:00
Michael Ramos	41f78295ba	Reset review scroll on file switch (#452)	2026-03-31 20:50:18 -07:00
Ben Limmer	cce877d3c4	fix(review): resolve repo root for untracked file discovery (#450) ... git ls-files scopes to the CWD subtree and returns CWD-relative paths, unlike git diff HEAD which covers the full repo with root-relative paths. When the hook process inherits a subdirectory CWD, untracked files outside that subtree are silently dropped and paths for files inside it are wrong. Resolve the repo root via rev-parse --show-toplevel and use it as the CWD for both git ls-files and git diff --no-index in getUntrackedFileDiffs. Fixes #449	2026-03-31 11:08:44 -07:00
Michael Ramos	d8a67beb1c	feat: agentic review — background job runner with SSE streaming (#443) ... * feat(server): add agent job manager with process lifecycle and SSE streaming Introduces the backend for agentic review — a server-agnostic job runner that spawns agent processes, monitors their lifecycle via proc.exited, and broadcasts status updates over a dedicated SSE stream. New files: - packages/shared/agent-jobs.ts: runtime-agnostic types, SSE helpers, state machine - packages/server/agent-jobs.ts: Bun HTTP adapter with spawn/kill/SSE/REST routes Wired into the review server with late-bound serverUrl, killAll on stop and process exit for defense-in-depth cleanup. Capability detection via Bun.which() for Claude Code, Codex CLI, and shell. For provenance purposes, this commit was AI assisted. * feat(ui): add Review Agents tab with job management and live status Adds the client-side UI for agentic review: - useAgentJobs hook: SSE primary with polling fallback, capabilities fetch - AgentsTab: shared component with provider dropdown, job cards, kill controls - ReviewAgentsIcon: magnifying glass with cog icon - ReviewPanel: new "Review Agents" tab conditional on detected capabilities - App.tsx: initializes hook and passes props to ReviewPanel Jobs show live elapsed time, status badges, annotation counts per source, and expandable error details. Stub command (sleep 10-30s) for initial testing. For provenance purposes, this commit was AI assisted. * fix(server): narrow proc.stderr type to satisfy TS Bun types proc.stderr as ReadableStream | number. Add typeof guard to narrow before passing to Response constructor. For provenance purposes, this commit was AI assisted. * fix(server): prevent stdout deadlock, stderr pipe stall, and worktree cwd mismatch - Change stdout from "pipe" to "ignore" — agents post findings via the annotations API, not stdout. Unconsumed pipe buffer caused deadlock. - Drain stderr continuously instead of reading after exit — prevents pipe-full stall on chatty agents. - Make agent getCwd worktree-aware using the same currentDiffType check the AI endpoints use, so agents spawn in the correct checkout. - Exclude 'agents' tab from PR context fetch guard in ReviewPanel. For provenance purposes, this commit was AI assisted. * feat(pi): mirror agent-job endpoints in Pi review server Add apps/pi-extension/server/agent-jobs.ts — a Node.js port of the Bun agent-jobs handler using child_process.spawn, res.write() SSE, and execFileSync for capability detection. Wire into serverReview.ts: route delegation, killAll in stop(), process.on("exit") guard, worktree-aware getCwd, and serverUrl late-binding. Add agent-jobs to vendor.sh for shared type vendoring. For provenance purposes, this commit was AI assisted. * fix(agents): harden agent jobs — listener leak, provider allowlist, Windows support, docs - Use process.once instead of process.on to prevent exit listener accumulation - Validate provider against known capabilities before spawning (rejects unknown providers) - Use platform-aware which/where for CLI detection on Windows - Broadcast jobs:cleared event from kill-all endpoint (was dead client code) - Document all /api/agents/* endpoints in CLAUDE.md Review Server table For provenance purposes, this commit was AI assisted. * fix(agents): SSE ref reset, jobs:cleared divergence, exit listener cleanup - Reset receivedSnapshotRef/fallbackRef on re-mount so polling fallback activates correctly on subsequent tab switches - Remove jobs:cleared broadcast from kill-all — killAll() already fires individual job:completed events, so the UI shows status transitions instead of going blank - Store exit handler ref so stop() can removeListener, preventing accumulation in long-lived hosts (OpenCode, Pi) For provenance purposes, this commit was AI assisted.	2026-03-31 10:06:18 -07:00
Michael Ramos	fad822e6ca	chore: bump version to 0.16.2	2026-03-30 21:49:08 -07:00
Michael Ramos	ede10fef9c	feat(ui): cross-file annotation visibility and adaptive navigation (#444) ... - Shared CountBadge component replacing heavy TOC accent circles - Per-file annotation count badges in FileBrowser and VaultBrowser - Folder aggregate counts from descendant files - Summary header showing total annotations across files - Dot indicators on Files/Vault sidebar tabs when annotations exist - Adaptive back button text (file list / file / message / plan) - Cross-file annotation indicator in right panel with flash highlight - Fix directory prefix matching bug (startsWith without trailing slash) - Move flash animation CSS to shared theme stylesheet For provenance purposes, this commit was AI assisted.	2026-03-30 21:39:00 -07:00
Michael Ramos	7435be0639	feat(ui): draggable comment popover and annotation toolbar (#442) ... Makes the CommentPopover and AnnotationToolbar draggable by their headers via a shared `useDraggable` hook. Users can reposition popovers that land awkwardly near viewport edges. - New `useDraggable` hook reads rendered position via getBoundingClientRect on drag start - 3px movement threshold prevents interfering with button clicks - CommentPopover: suppresses scroll/resize tracking after drag, resets on anchor change - AnnotationToolbar: both comment and Ask AI modes are draggable - Clamps position to keep at least 50px visible on screen For provenance purposes, this commit was AI assisted.	2026-03-30 19:02:04 -07:00
Michael Ramos	6b84ce4107	feat(review): custom diff font family and size overrides (#441) ... * feat(review): custom font family and size overrides for code review diffs Add Code Font and Code Font Size settings to the review Display tab, letting users override the theme's monospace font in the diff viewer. Supports 9 fonts (Fira Code, Hack, IBM Plex Mono, Inconsolata, JetBrains Mono, Red Hat Mono, Roboto Mono, Source Code Pro, Atkinson Hyperlegible Mono) loaded on demand from Google Fonts / jsDelivr CDN. Font size uses a continuous slider (8–24px) with a Reset button. Settings persist via cookies and sync to ~/.plannotator/config.json under diffOptions.fontFamily / diffOptions.fontSize, matching the existing config pattern. For provenance purposes, this commit was AI assisted. * fix(review): line-height scaling, inline annotation font coverage, and comment card cleanup - Add line-height: 1.5 alongside font-size in Pierre shadow DOM so large sizes don't clip - Include .review-comment-body selectors in font override CSS so inline annotation code spans get the custom font - Simplify comment card: remove drop shadow, left border accent, translateX hover; use tight border with subtle hover For provenance purposes, this commit was AI assisted.	2026-03-30 13:45:37 -07:00
Michael Ramos	b0980ef928	fix(opencode): remove verbose logs that flood the TUI (#440) ... Remove writeRemoteShareLink stderr output from the OpenCode plugin — the base64 share URL was flooding the TUI on remote sessions. Also strip leftover console.log debug statements from the PR viewed files feature in the review server. Closes #435 For provenance purposes, this commit was AI assisted.	2026-03-30 10:51:27 -07:00
Michael Ramos	a633e70597	chore: bump version to 0.16.1	2026-03-30 09:13:52 -07:00