mirror of
https://github.com/backnotprop/plannotator.git
synced 2026-09-14 14:17:26 +08:00
feat/opencode2-native-commands
731 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Michael Ramos
|
bb404f8d14 |
feat: stacked PR review — PR switching, scope toggling, multi-PR posting (#620)
* feat(shared): add isSameProject, PR stack types, and PR list provider Extends PRRef/PRMetadata with defaultBranch, PRStackInfo, PRStackTree, PRStackNode, PRDiffScope, and PRListItem types. Adds isSameProject() for owner/repo validation on PR switching. Adds fetchPRStack() and fetchPRList() dispatch functions (GitHub-only for now, GitLab stubs). Includes 9 new tests for isSameProject covering GitHub, GitLab, and cross-platform scenarios. For provenance purposes, this commit was AI assisted. * feat(shared): add GitHub PR stack tree walking and PR list fetching Implements fetchGhPRStack() which walks up/down the PR stack via GraphQL, resolving numbers and titles for each node in the chain. Collapses queryPRsByHead/queryPRsByBase into a single queryPRsByRef helper. Adds fetchGhPRList() using gh pr list. Fixes GHE support by removing hostnameArgs from fetchGhPRList (--repo already handles GHE). Filters jq "null" string from defaultBranch detection. For provenance purposes, this commit was AI assisted. * feat(shared): fetch defaultBranch for GitLab MRs Queries the project's default_branch via glab API so getPRStackInfo can detect stacked MRs on GitLab. Best-effort — caught errors fall back to undefined. For provenance purposes, this commit was AI assisted. * feat(shared): add PR stack detection and full-stack diff module New pr-stack module with: - getPRStackInfo(): detects stacked PRs from baseBranch vs defaultBranch - getPRDiffScopeOptions(): generates layer/full-stack scope options - runPRFullStackDiff(): computes diff from default branch to HEAD - resolvePRFullStackBaseRef(): resolves origin/main or local main - checkoutPRHead(): fetches and checks out a PR head in a worktree - buildMinimalStackTree(): builds UI tree from stack info Includes 13 tests covering ref resolution, branch fallbacks, and GitLab ref formats. For provenance purposes, this commit was AI assisted. * feat(shared): add worktree pool for per-PR agent isolation Creates a session-scoped pool of git worktrees — each PR visited during a stacked review gets its own isolated checkout. Agents run in their PR's worktree undisturbed by PR switches. Handles deduplication of concurrent ensure() calls for the same PR. Includes 11 tests covering caching, cross-repo restrictions, GitLab ref formats, and cleanup. For provenance purposes, this commit was AI assisted. * feat(shared): add diffScope/prUrl to agent jobs, branch diff type Adds prUrl and diffScope optional fields to AgentJobInfo so agent findings carry the PR and scope context they were launched under. Exports new pr-stack and worktree-pool modules from package.json. Adds 'branch' to DefaultDiffType union for branch diff as default. For provenance purposes, this commit was AI assisted. * feat(ui): add PR annotation fields, Popover, and SearchableSelect Extends CodeAnnotation with prUrl, prNumber, prTitle, prRepo, and diffScope fields for stacked PR attribution. Adds shared Popover wrapper around radix-ui. Adds SearchableSelect for filterable dropdown lists (used by PR selector). For provenance purposes, this commit was AI assisted. * feat(ui): add branch diff as default option, new Git settings tab Adds 'Branch' as a fourth default diff type option in both the first-run dialog and settings panel. Moves the default diff type setting from the Display tab to a new Git tab in review mode. Updates config store validators to accept 'branch'. For provenance purposes, this commit was AI assisted. * feat(server): add prUrl/diffScope plumbing to agent jobs and prompts Threads prUrl and diffScope through the agent job lifecycle so findings carry the PR and scope they were generated under. Adds full-stack prompt branch to codex-review and tour-review — when in full-stack mode, the diff is inlined in the prompt instead of telling the agent to run git diff. Re-exports isSameProject and new PR provider functions from server/pr.ts. For provenance purposes, this commit was AI assisted. * feat(server): add stacked PR support to Bun review server Adds PR switching, layer/full-stack scope toggling, PR list caching, worktree pool integration, and multi-PR platform posting to the Bun review server. Key additions: - /api/pr-diff-scope: switch between layer and full-stack diffs - /api/pr-list: cached PR list for the current repo - /api/pr-switch: in-place navigation between PRs in a stack - /api/pr-action: targetPrUrl support for multi-PR posting - /api/file-content: full-stack branch for hunk expansion - prSwitchCache/prStackTreeCache for session-scoped caching - diffScope tagging on agent job completion - Scope guard: returns 400 on full-stack diff failure instead of overwriting the working diff with empty content For provenance purposes, this commit was AI assisted. * feat(ai): pass cwd to Claude agent SDK for worktree support Forwards the working directory to the Claude agent provider so agents run in the correct worktree when reviewing stacked PRs. For provenance purposes, this commit was AI assisted. * feat(pi): add stacked PR support to Pi server (Bun parity) Mirrors all stacked PR features from the Bun server: - PR switching, scope toggling, PR list, multi-PR posting - prSwitchCache/prStackTreeCache with initial PR seeding - diffScope/prUrl plumbing in agent jobs - Worktree pool creation and lifecycle - Full-stack file-content resolution matching Bun's guard structure - targetPrUrl support on /api/pr-action Hoists worktreePool declaration to outer scope in plannotator-browser to fix TS18004 scoping error. Updates vendor.sh for new shared modules. For provenance purposes, this commit was AI assisted. * feat(hook): create worktree pool for PR review sessions Creates a worktree pool when opening a PR review with --local, seeding it with the initial PR's checkout. Integrates pool cleanup into server shutdown. Passes the pool to startReviewServer for agent isolation during PR switching. For provenance purposes, this commit was AI assisted. * feat(review-editor): add hooks for PR stack, context, and annotations - useAnnotationFactory: stamps prUrl/prNumber/prTitle/prRepo/diffScope onto annotations, only when viewing a stacked PR - usePRStack: handles scope selection and PR switching with loading state - usePRContext: adds URL-change detection to prevent stale-fetch race when switching PRs (discards in-flight responses for previous PR) For provenance purposes, this commit was AI assisted. * feat(review-editor): add stacked PR UI components - PRSelector: searchable dropdown for switching between PRs in a repo - PRSwitchOverlay: loading animation during PR switch - StackedPRLabel: stack tree popover with scope selector and PR navigation - ReviewSubmissionDialog: multi-PR submission dialog with per-target status, orphaned findings section with copy-as-markdown, and partial failure retry For provenance purposes, this commit was AI assisted. * feat(review-editor): multi-PR export with heading hierarchy Updates exportReviewFeedback for multi-PR sessions: - Groups annotations by prUrl, then by file within each PR - Uses proper heading hierarchy (## for files, ### for annotations in multi-PR mode) - Detects single-PR mismatch (annotations from a different PR than the current view) and uses annotation-level PR context - Adds diffScope labels per PR group when present Includes 5 new tests: multi-PR headings, single-PR mismatch, diffScope labels, and non-stacked annotation handling. For provenance purposes, this commit was AI assisted. * feat(review-editor): integrate stacked PR into sidebar, diff panel, and agents - ReviewSidebar: groups annotations by PR in multi-PR sessions, shows PR headers with annotation counts - ReviewDiffPanel: filters annotations by prUrl and diffScope so only matching annotations appear in the diff gutter - ReviewStateContext: adds prDiffScope to shared review state - ReviewAgentJobDetailPanel: shows diffScope in job detail - PRSummaryTab: shows stack info in PR summary - index.css: PR switch shimmer and overlay animations For provenance purposes, this commit was AI assisted. * feat(review-editor): wire stacked PR into main review app Integrates all stacked PR features into the review editor: - PR stack state management (prStackInfo, prStackTree, prDiffScope) - applyPRResponse: shared handler for PR switch and scope toggle, preserves active file index on scope changes - Multi-PR platform posting via Promise.allSettled with parallel requests, partial failure retry, and per-target status tracking - ReviewSubmissionDialog replaces inline dialog JSX - useAnnotationFactory stamps PR context onto annotations - keepalive on /api/feedback to survive tab closure - Proper try/catch/finally on handlePlatformAction For provenance purposes, this commit was AI assisted. * docs: add stacked PR review documentation Updates AGENTS.md, code-review command docs, and AI code review guide with stacked PR review capabilities. For provenance purposes, this commit was AI assisted. * fix(server): stamp prNumber/prTitle/prRepo on agent findings Agent annotations only had prUrl and diffScope, missing prNumber, prTitle, and prRepo. When agent findings were the only annotations for a PR target in the submission dialog, the target rendered as #0 with no title. Now resolves full PR context from prSwitchCache at job completion and stamps all five fields. Both Bun and Pi. For provenance purposes, this commit was AI assisted. * feat(ui): rename diff options — "Committed" replaces "Branch" / "Current PR Diff" Consolidates two confusing committed-diff options into one: - Settings/first-run: "Committed" — "Everything you've committed on this branch" - Mid-session switcher: "Committed changes" (replaces both "vs main" and "Current PR Diff") Uses merge-base under the hood (matches GitHub PR behavior). Removes the two-dot branch diff from the UI — it stays in the runtime DiffType union for backwards compat. Old "branch" values in config/cookies are silently upgraded to merge-base. Git settings tab now uses radio cards with descriptions instead of a cramped segmented control. First-run dialog descriptions rewritten in plain language — no git commands. For provenance purposes, this commit was AI assisted. * fix(review-editor): rename client-side "PR Diff" labels to "Committed changes" DiffTypePicker.tsx had a hardcoded "PR Diff" override for merge-base when the base picker is present. exportFeedback.ts also used "PR Diff" in export labels. Both now say "Committed changes" to match the server-side label and settings UI. For provenance purposes, this commit was AI assisted. * fix(server): discover stack UI for root PRs targeting the default branch Root PRs (baseBranch === defaultBranch) were excluded from stack detection because getPRStackInfo returned null. Now the server always fetches the stack tree in PR mode. If the tree reveals descendant PRs, prStackInfo is retroactively set with source "tree-discovered", enabling the stack UI, scope selector, and PR navigation from the root of a stack. Both Bun and Pi servers updated. Adds "tree-discovered" to the PRStackInfo source union. For provenance purposes, this commit was AI assisted. * fix(review-editor): derive diff scope from annotations, not UI state The export function now reads diffScope from annotations instead of the prReviewScope parameter. Fixes two issues: 1. Agent job "Copy All" showed the wrong scope when the user switched between layer/full-stack after launching the agent 2. Mixed-scope annotations produced a confusing "layer, full-stack" comma-joined label instead of grouping by scope Extracts renderScopedGroups helper for scope-aware grouping — used by both single-PR and multi-PR export paths. When annotations share one scope, it appears in the header. When mixed, annotations are grouped under ## Layer / ## Full-stack headings. Includes 4 new tests: uniform scope derivation, mixed scope grouping, single scope header, and prReviewScope override prevention. For provenance purposes, this commit was AI assisted. * fix(server): add tree-discovered stack fallback to pr-switch handler The initial-load path upgrades prStackInfo for root PRs when the stack tree reveals descendants, but the pr-switch handler was missing this logic. The server now sends correct prStackInfo after switching to a root-of-stack PR. Both Bun and Pi. Also removes stale prReviewScope dependency from agent job panel's copyAllText useMemo. For provenance purposes, this commit was AI assisted. * fix: extract resolveStackInfo helper, fix stack UI on non-stacked PRs Extracts the tree-discovered stack fallback into resolveStackInfo() in pr-stack.ts — eliminates 4 copies of the same logic across Bun startup, Bun pr-switch, Pi startup, and Pi pr-switch. Fixes StackedPRLabel showing on every PR: the check now counts non-default-branch nodes (> 1) instead of all nodes (> 1). Without this, every PR showed a "Stack (1 PR)" popover because the tree always has at least [defaultBranch, currentPR]. For provenance purposes, this commit was AI assisted. * fix(review-editor): don't re-open already-succeeded PR tabs on retry On partial failure retry, openUrls was pre-seeded with URLs from previously succeeded targets, causing those PR pages to re-open in the browser alongside newly succeeded ones. Now starts empty — only URLs from the current attempt are opened. For provenance purposes, this commit was AI assisted. * refactor(review-editor): extract PR session state into usePRSession hook Consolidates 5 independent useState calls (prMetadata, prStackInfo, prStackTree, prDiffScope, prDiffScopeOptions) into a single usePRSession hook with atomic updatePRSession callback. Replaces two identical 5-line setter blocks (initial load and applyPRResponse) with single updatePRSession calls. All ~60 consumer sites unchanged — same variable names via destructuring. For provenance purposes, this commit was AI assisted. |
||
|
Michael Ramos
|
f13807bd54 | chore: bump version to 0.19.1 | ||
|
Michael Ramos
|
364cd870fa |
feat(annotate): replace --silent-approve with --hook for native hook protocol
Replaces `--silent-approve` with `--hook`, which emits hook-native JSON
that works directly with Claude Code and Codex PostToolUse/Stop hooks.
- Approve/Close: empty stdout (hook passes)
- Annotate: `{"decision":"block","reason":"<feedback>"}` (hook blocks)
- `--hook` implies `--gate` (three-button UX), applied in the parser
so all harnesses (binary, OpenCode, Pi) get it automatically
- Rewrites hook integration guide to be agent-agnostic
Follow-up to #606. Refs #570.
For provenance purposes, this commit was AI assisted.
|
||
|
Peter Bowyer
|
4d8d3a2ca8 |
feat(ui): quieter plan diffs on prose edits (#603)
* feat(ui): atomize balanced emphasis pairs in plan diff Before word-diffing, replace each balanced `**…**`, `__…__`, `~~…~~`, `*…*`, `_…_` (and triples `***…***` / `___…___`) with a unique word-char sentinel — same pattern as the existing code-span / link atomization passes. Identical phrases pair as unchanged; different phrases produce a single remove+add. Fixes the "preliminary analysis" → "final analysis" demo case (⑯), which previously orphaned the closing `**` into the unchanged tail and rendered as literal asterisks. Now renders as one clean bold-struck → bold-green swap. Pair matching uses CommonMark-ish flanking rules so stray `2**3` or intraword `my__var` / `snake_case` stay literal. Longest-first ordering prevents single delimiters from eating the inside of a double-delim pair. * feat(ui): coalesce adjacent diff sites separated by thin tokens After `diffWordsWithSpace` and sentinel restoration, merge dirty runs of ≥2 change sites separated only by thin unchanged tokens (whitespace, commas, periods, semicolons, colons, dashes, quotes) into a single phrase-level swap. Parens and brackets are excluded so inline links and bracketed content stay as hard boundaries. Turns alternating red/green word-noise (e.g. paragraph reworks with multiple adjacent word swaps) into a readable before/after. Also rescues the atomization edge case where wrapping a previously-plain phrase in emphasis (`foo bar baz` → `foo **bar baz**`) would otherwise surface as fragmented literal delimiters inside colored tags. Single-site dirty runs pass through unchanged so isolated word swaps keep word-level highlighting. * feat(ui): atomize hyphenated compounds in plan diff Hyphens between word chars (`ninety-five`, `64-byte`, `state-of-the-art`) are semantic compound words, not two tokens. `diffWordsWithSpace` splits on word boundaries, so without this pass `ninety-five` → `ninety-nine` fragments into an unchanged `ninety-` prefix and a swapped `five`/`nine` suffix — a visually noisy partial-word diff. Added a sentinel pass that replaces infix hyphens with a word-char marker before diffing and restores them afterwards. Runs after the code/link/emphasis passes so hyphens inside those constructs stay hidden. Unlike the other sentinels this one uses a fixed marker — all hyphens restore to the same character, so uniqueness isn't needed. Leading/trailing dashes and em-dash-like separators (dash with space on one side) are not substituted; only true compound infixes. |
||
|
Michael Ramos
|
b0c5db924f |
fix(review): detect remote default branch asynchronously at startup (#609)
getDefaultBranch relied on `symbolic-ref refs/remotes/origin/HEAD` which is commonly unset in worktrees, manual remote setups, and long-lived repos. When absent, the code fell through to local `main`/`master`, silently losing the upstream-preference behavior. Adds `detectRemoteDefaultBranch()` — queries the remote via `git ls-remote --symref origin HEAD` to find the actual default branch name (works for any name: develop, trunk, etc.). The call is fire-and-forget at server startup: non-blocking, runs concurrently while the browser loads. By the time the user opens Branch diff or PR Diff (usually 1-2 seconds later), the result has arrived and `currentBase` has been silently upgraded to the upstream ref. If offline or slow, the 5-second timeout fires and the local fallback sticks. If the user has already switched bases manually, their choice is never overwritten. `ReviewGitRuntime.runGit` gains an optional `timeoutMs` param. Bun kills the process via setTimeout + proc.kill(). Pi uses spawnSync's native `timeout` option. Both treat timeout as a non-zero exit. For provenance purposes, this commit was AI assisted. |
||
|
Michael Ramos
|
d102c5f709 |
feat(annotate): add --gate, --json, and --silent-approve flags (#570)
Adds an opt-in review gate flow to annotation mode with three composable flags:
- `--gate`: 3-way UX (Approve / Send Annotations / Close)
- `--json`: structured decision output (`{"decision":"approved|annotated|dismissed"}`)
- `--silent-approve`: suppresses plaintext approve marker for naive hooks
Includes shared arg parser, @-reference handling, updated templates across all
harnesses (Claude Code, Copilot, Gemini, OpenCode, Pi), and full documentation.
Closes #570
For provenance purposes, this commit was AI assisted.
|
||
|
Michael Ramos
|
68972aa6a6 |
feat(review): custom base branch for code review (#599) (#602)
Adds a searchable base-branch picker to the code review UI so reviewers can compare against any branch, not just the auto-detected default. Key changes: - Base-branch picker (Radix Popover + search, local/remote groups) - Diff-type picker (Radix DropdownMenu + info tooltips) - Worktree picker (Radix Popover + search) - getDefaultBranch prefers upstream ref (origin/main) for fresher diffs - listBranches populates GitContext.availableBranches - resolveBaseBranch trusts caller verbatim (no silent rewrites) - --end-of-options hardens git argv against flag-injection via base refs - Branch diff / PR Diff always available (removed hide-on-default guard) - merge-base agent prompt runs git itself instead of inlining the patch - Agent jobs snapshot diff context at launch for honest "Copy All" - Feedback export includes diff mode + base header for agent context - Round-trip base through /api/diff so refresh preserves the selection - selectedBase / committedBase split prevents file-content race - Optimistic picker reverts on switch failure - DiffViewer remounts on mode switch to invalidate stale file content - Worktree switch preserves active diff mode - Pi parity: initialBase, currentBase, agent diffContext, vendor.sh - Tooltip wide mode, TooltipProvider mounted, keyboard/touch fixes - GPT-5.5 added to Codex model picker - CLAUDE.md API table updated Closes #599 For provenance purposes, this PR was AI assisted. |
||
|
dgrissen2
|
5a41a21861 |
fix(ui): in-page anchor navigation for headings (#605)
* fix(ui): in-page anchor navigation for headings
Intercept `#`-prefixed link clicks and smooth-scroll inside the sticky
scroll viewport instead of letting the browser jump (which broke when the
content lives inside a scrollable container). Headings now expose both a
canonical slug and a legacy slug via `data-anchor-aliases` so older shared
URLs keep resolving. Also listen for `hashchange` / initial hash so direct
links land on the right heading.
Adds `packages/ui/utils/anchors.ts` with `normalizeAnchorText`,
`decodeAnchorHash`, `slugifyHeadingAnchor`, `legacySlugifyHeadingAnchor`,
and `getHeadingAnchorAliases` (+ tests).
Also ignore `.serena/` tooling state.
* refactor(ui): drop unjustified slug aliasing
Anchor navigation didn't work before this branch, so no shared URLs exist
using any slug format — the legacy slug alias was preserving nothing.
The canonical slug was also a redefinition: heading ids are already
written by `utils/slugify.ts` (unicode-aware, `\p{L}\p{N}`). The new
ASCII-only `slugifyHeadingAnchor` would miss unicode headings ("Café"
writes `id="café"` but the nav code looked for `cafe`).
Nav path is now just: decode the hash and `getElementById`. The
sticky-header offset math — the part that actually mattered — stays.
* fix(ui): anchor-nav edge cases — share-hash collision and raw HTML blocks
Two issues flagged by cross-model review of
|
||
|
Michael Ramos
|
1338802a58 | Scope OpenCode submit_plan to planning agents (#571) | ||
|
Michael Ramos
|
289a2aa494 |
chore: bump version to 0.19.0
Bump version across all 7 package/plugin manifests. Also refresh AGENTS.md (new Block types from #597, Code Tour endpoints from #569), prune removed flags from the Pi README (--plan-file, /plannotator-set-file from #595), and pin Renovate off bun-version bumps to keep the macOS codesign hotfix from v0.17.9 in place. For provenance purposes, this commit was AI assisted. |
||
|
Michael Ramos
|
ba2e4d2a1d |
feat(ui): markdown reader parity — HTML blocks, GitHub alerts, GFM inline extras (#597)
* feat(ui): markdown reader parity — HTML blocks, GitHub alerts, GFM inline extras Brings the in-app markdown reader to parity with GitHub's flavored rendering. Additive across the parser + renderer; no behavior change for existing blocks. Refactor: - Extract InlineMarkdown (262 lines) out of Viewer.tsx into its own file - Extract BlockRenderer + block-type components (CodeBlock, HtmlBlock, AlertBlock, Callout) into components/blocks/ — Viewer drops from 1279 to ~770 lines - Each new block-level feature lands in BlockRenderer or a new blocks/*.tsx, not Viewer Block-level features: - Raw HTML blocks (<details>, <summary>, etc.) via balanced-tag parser branch, rendered through marked + DOMPurify for nested-markdown support; inner innerHTML set imperatively so React reconciliation doesn't collapse open <details> - GitHub alerts (> [!NOTE] / [!TIP] / [!WARNING] / [!CAUTION] / [!IMPORTANT]) with inline Octicons, title-case labels, GitHub's Primer colors (light + dark) - Directive containers (:::kind ... :::) with arbitrary kinds for project-specific callouts (note, tip, warning, danger, info, success, question, etc.) - Heading anchor ids — slugifyHeading() strips inline markdown, preserves unicode Inline features (all in InlineMarkdown, all code-span-safe): - Bare URL autolinks (https://...) with trailing-punctuation trimming - @mentions and #issue-refs — render as clickable links when repo is GitHub, styled spans otherwise; threaded via repoInfo.display through BlockRenderer - Emoji shortcodes (👋, 🚀, 29 curated codes) via transformPlainText() - Smart punctuation (curly quotes, em/en dashes, ellipsis) applied only to plain-text fragments after code spans have been consumed Safety: - Render-time transforms live inside InlineMarkdown's plain-text push, which is only reached after code-span regex consumes code content. Backticks stay literal for shell/regex snippets. - DOMPurify allowlist (no on* handlers, no style attrs, no scripts) gates every raw HTML block. Unsafe link protocols (javascript:/data:/vbscript:/file:) stripped by sanitizeLinkUrl. Tests: +40 (149 total). New files: - utils/slugify.test.ts (10) — unicode, markdown stripping, edge cases - utils/inlineTransforms.test.ts (9) — emoji + smartypants - utils/parser.test.ts — alert detection (5 cases), directives (5 cases), HTML block balancing (5 cases) Fixtures for manual verification: - tests/test-fixtures/11-html-blocks.md - tests/test-fixtures/12-gfm-and-inline-extras.md (release-plan-shaped demo) Known limitations (not blockers): - Bare URL regex doesn't balance parens (https://en.wikipedia.org/wiki/Foo_(bar) drops the trailing ")") - Duplicate heading text → duplicate anchor ids (browser picks first on hash nav) - Directive body is inline-only (no nested headings/lists) For provenance purposes, this commit was AI assisted. * fix(ui): wire typecheck for packages/ui, address PR review findings Root-cause fix for the missing-import bug caught in review: the UI package had no tsconfig.json and no typecheck script, so missing references like `getImageSrc` in the extracted InlineMarkdown slipped past vite/esbuild (which only type-strip, they don't resolve imports). Infrastructure: - Added packages/ui/tsconfig.json with proper module resolution, JSX config, and bundler-style paths. - Added globals.d.ts to accept side-effect CSS imports. - Added @types/react, @types/react-dom, @types/bun, @types/dompurify as devDeps on packages/ui so React / Bun / DOMPurify types actually resolve. - Wired `tsc --noEmit -p packages/ui/tsconfig.json` into the top-level `bun run typecheck` script. With the typecheck running, 0 errors remain in this PR's scope. Four pre-existing errors on main (plan-diff SVG type narrowing, sharing.ts SharePayload shape) are unrelated and tracked separately. Review fixes: - InlineMarkdown: import getImageSrc from ImageThumbnail. Was calling the helper without importing it — markdown images with relative paths (``) would throw ReferenceError at render. Regression caused by the InlineMarkdown extraction. - useAnnotationHighlighter: findTextInDOM now retries with the rendered form (transformPlainText) when the raw originalText doesn't match. Annotations made before smart-punctuation / emoji shortcodes shipped (straight quotes, `👋` text) still re-bind after reload. - sanitizeHtml: allow the `open` attribute so `<details open>` preserves its default-expanded state instead of always rendering collapsed. - parser.test.ts: narrow a string->AlertKind assertion to satisfy strict typechecking. Deferred (tracked as known limitation in PR description): - HtmlBlock relative URL rewriting for nested <img src="./logo.png"> / <a href="note.md">. New-feature gap, not a regression. For provenance purposes, this commit was AI assisted. * fix(ui): HtmlBlock rewrites relative <img>/<a> refs to match markdown paths Raw HTML blocks inject sanitized HTML verbatim, so nested <img src="./logo.png"> and <a href="notes.md"> resolved against the plannotator server URL instead of the plan's directory — images 404'd, .md links navigated away instead of opening in the linked-doc overlay. This is the path README.md content hits (hero <img>, YouTube thumbnails, <details> sections with anchors). Fix: after setting innerHTML, walk <img> and <a> elements and apply the same rewriting markdown content uses: - <img> relative src → getImageSrc(src, imageBaseDir), routing through /api/image?path=... with the plan's base directory. - <a> relative href matching .md / .mdx / .html → click handler that calls onOpenLinkedDoc, same pattern as [label](./foo.md) markdown links. - http(s):, data:, blob:, mailto:, tel:, and #anchor hrefs pass through untouched. BlockRenderer now threads imageBaseDir + onOpenLinkedDoc into HtmlBlock. React.memo equality extended to compare those props too, so legitimate changes still re-run the rewrite pass without forcing re-renders on every parent update. Verified against the repo's own README.md — hero image, YouTube thumbnails, and <details> sections all render correctly in annotate mode. For provenance purposes, this commit was AI assisted. * feat(ui): table conveniences — hover toolbar, popout dialog with sort/filter Extracts table rendering into blocks/TableBlock and adds two companion surfaces: a hover toolbar for quick copy, and a full-screen popout dialog with TanStack-powered sort/filter/copy for power use. No pagination — plan tables don't get that big. Hover toolbar (blocks/TableToolbar.tsx): - Floats above the table on mouse enter via React portal, positioned with getBoundingClientRect + scroll/resize listeners, entry/exit animations. Same positional pattern as AnnotationToolbar's top-right mode. - Debounced hover state in Viewer (100ms leave → 150ms exit animation), mirroring hoveredCodeBlock's state machine. - Three actions: Copy markdown (icon), CSV (short uppercase button, RFC 4180 escaping), Expand (opens popout). Popout dialog (blocks/TablePopout.tsx): - Radix Dialog, fullscreen-ish card with ~2rem backdrop visible for click-to-close. max-w-[min(calc(100vw-4rem),1500px)]. - Portaled into Viewer's containerRef so the annotation hook can walk into the popout's text nodes — selection-based annotations, text-search restoration, and shared blockId all work across the collapsed and popped-out views. - TanStack Table for the grid: click column headers to sort (asc → desc → clear), global filter input, no pagination. Row count indicator shows "15 of 27" when filter reduces the set. - Copy / CSV buttons in the header row: filter- and sort-aware. When visible rows < total, tooltips read "Copy 15 rows as markdown" / "Copy 15 rows as CSV". When no filter, copies whole table (normalized whitespace). Read is one-shot on click — no derived state to sync. - Floating X close button (absolute top-right), no header bar. Chrome stacking while popout is open (CSS-only, via :has()): - body:has([data-popout="true"]) drops four element types behind the dialog: annotation sidebar, sticky header lane, app nav header, overlay scrollbars. :has() observes the dialog's presence directly — when the dialog unmounts, the selector stops matching and everything returns to natural stacking. No JS state, no useEffect cleanup. Shared helpers in TableBlock.tsx (exported): - parseTableContent — pipe-delimited markdown → { headers, rows } - buildCsvFromRows / buildMarkdownTable — inverse, from parsed data - buildCsv — thin wrapper for the hover toolbar's raw-block path Dependencies added: - @radix-ui/react-dialog ^1.1.15 (~6 KB gzipped) - @tanstack/react-table ^8.21.3 (~14 KB gzipped) Fixture: - tests/test-fixtures/12-gfm-and-inline-extras.md — added a 27×11 "Detailed feature backlog" table to exercise wide + deep tables, horizontal scroll in the popout, and the sort/filter flows. For provenance purposes, this commit was AI assisted. * fix(ui): table popout — annotation flow, chrome stacking, sidebar tabs Tightens the popout so annotations work inside it and chrome doesn't overlap the dialog. Annotation flow inside popout: - Radix Dialog modal={false} so the focus trap doesn't yank focus back from CommentPopover's textarea (CommentPopover portals to document.body, outside the dialog's DOM subtree). - Dialog.Content onInteractOutside handler whitelists the annotation toolbar, CommentPopover, and FloatingQuickLabelPicker so clicking them doesn't dismiss the dialog. Backdrop click + Escape still close. - aria-describedby={undefined} on Dialog.Content (Radix opt-out; the popout doesn't need a description). - React.memo on TablePopout with a custom comparator (block id/content, open, container, imageBaseDir, githubRepo). Prevents upstream Viewer re-renders from re-running TanStack's flexRender on every cell, which conflicted with web-highlighter's live DOM mutations and caused a NotFoundError in React's reconciler. Widget markers for :has()-based chrome stacking: - [data-comment-popover="true"] on CommentPopover (both popover + dialog variants). - [data-floating-picker="true"] on FloatingQuickLabelPicker. - [data-sidebar-tabs="true"] on SidebarTabs (left-side TOC/Files/Versions flags that sit on top of the dialog otherwise). - theme.css extended: sidebar tabs join the annotation sidebar, sticky header lane, app header, and overlay scrollbars in dropping to z-index -1 while body:has([data-popout="true"]) matches. Known limitation (not addressed): annotations created inside the popout show their <mark> only while the popout is open; when it closes, the <mark> unmounts with the popout's DOM and does not reappear on the collapsed table. The annotation itself persists in state (sidebar, shared URLs, exports). Round-tripping visual marks between popout and collapsed view requires either a second web-highlighter instance or a switch to the CSS Custom Highlight API — out of scope here. For provenance purposes, this commit was AI assisted. * fix(ui): review findings — flags, alerts, forges, tabs, anchors, URL brackets Six targeted fixes from the v0.19 PR review. Each is small and scoped; the riskier items from the review (plan-diff block variants, HTML relative non-doc links) are tracked as follow-ups. Smart punctuation — CLI flags preserved: - Narrowed the `--` → en-dash rule to only fire between digits (`pages 3--5` still converts; `bun --watch` stays literal). GitHub alerts — list/code/heading bodies absorb correctly: - Blockquote merge now always merges into a previous alert blockquote, regardless of whether the new line starts with a block marker. Without this, `> [!NOTE]\n> - item` split the list off into a plain italic quote and emptied the alert. - AlertBlock got a mini block-level renderer for the body so `- item` / `* item` / `1. item` render as real <ul>/<ol>, not flattened prose. Forge-aware mentions/issue refs: - packages/shared/repo: new parseRemoteHost() extracts the host from the git remote URL; RepoInfo gains an optional `host` field. - packages/server/repo: getRepoInfo populates host alongside display. - Viewer only passes githubRepo to InlineMarkdown when the host is exactly "github.com". Non-GitHub repos render mentions/issue refs as styled text, no wrong github.com links. HTML block external links: - rewriteRelativeRefs now forces `target="_blank"` and `rel="noopener noreferrer"` on every external http(s) link inside raw HTML. Fixes two problems in one pass: external links no longer hijack the review tab, and pasted-HTML links can't tab-nab the plannotator tab via window.opener. Heading anchor dedup: - New buildHeadingSlugMap() walks all heading blocks and assigns `foo`, `foo-1`, `foo-2`, ... for repeats (GitHub convention). BlockRenderer receives the anchor id as a prop from Viewer via a memoized map rather than computing per-block; first occurrence keeps the bare slug so existing links stay stable. URL autolink bracket balance: - Trailing `)`/`]`/`}` in bare URLs are kept when they balance an earlier opener inside the URL. Wikipedia-style `https://en.wikipedia.org/wiki/Function_(mathematics)` now keeps its paren; `(see https://x.com)` still trims the orphan. Tests: +8 (157 total). - utils/slugify.test: buildHeadingSlugMap dedup behavior, non-heading skipping, empty-slug skipping. - utils/inlineTransforms.test: CLI flags stay literal, `3--5` still converts. - utils/parser.test: alerts with list body / code fence body, blank line ending an alert. Fixture: - tests/test-fixtures/13-known-issues.md — reproduces each of the review findings end-to-end; useful as a regression check going forward. Deferred (tracked for follow-up): - Plan diff view doesn't render html / directive / alertKind semantics (SimpleBlockRenderer has no cases for the new block variants). - Relative non-doc links inside raw HTML (.pdf, .csv) don't get rewritten — only .md/.mdx/.html are routed through the linked-doc overlay today. Not a regression; narrow audience. For provenance purposes, this commit was AI assisted. * fix(ui): round-3 review — drop host gate, link paren balance, data/blob images - Viewer: remove repoInfo.host === 'github.com' gate so @user/#123 links render for GitHub Enterprise and runtimes (Pi) that don't populate host. - HtmlBlock: treat protocol-relative //host links as external and harden with target=_blank rel=noopener noreferrer. - InlineMarkdown: data:/blob: image sources bypass /api/image rewrite. - InlineMarkdown: replace [text](url) regex with a depth-tracking scanner so URLs with balanced parens (Wikipedia /Function_(mathematics)) and backslash-escapes no longer truncate. Empty text/url guard preserves prior fall-through behavior. - InlineMarkdown: isLocalDoc accepts .md/.mdx/.html/.htm with optional #fragment; fragment stripped before onOpenLinkedDoc so guide.md#setup opens the linked doc instead of a broken anchor. For provenance purposes, this commit was AI assisted. * fix(ui): round-4 review — table pipe escape, callout lists, emoji h-splitter - TableBlock: buildMarkdownTable now re-escapes literal | as \| in each cell. parseTableContent already unescapes on parse; without the mirror on serialize, the popout's copy-as-markdown produces extra columns for tables with pipes in regex, shell, or boolean content. - AlertBlock + Callout: extract the shared paragraph-and-list body renderer into blocks/proseBody.tsx. Fixes directive callouts (:::note with a bulleted list) rendering as literal hyphens instead of a list. Paragraph lines join with '\n' so InlineMarkdown's hard-break handler still fires. Callout passes an empty text-color class so directive color tokens inherited from the container are preserved. - InlineMarkdown: drop `h` from the plaintext chunk-break class; it was splitting emoji shortcodes like ❤️, 👍, 🤔 at the h, so the :word: pattern never reassembled and transformPlainText couldn't replace the shortcode. Bare URL detection moves inline via emitPlainTextWithBareUrls, which scans chunks for https?:// at word boundaries and emits anchors, passing surrounding text through transformPlainText so emoji + smart punctuation still apply to non-URL slices. - InlineMarkdown: extract trimUrlTail (shared between the top-of-loop URL branch and the new inline scanner) — one balanced-paren trim implementation instead of two. +8 unit tests covering the trim cases (Wikipedia parens, unbalanced brackets, stacked punctuation). - Fixture: section 9 in 13-known-issues.md demonstrates the table copy corruption for manual verification. For provenance purposes, this commit was AI assisted. * fix(ui): resolve pre-existing typecheck errors surfacing in CI - PlanCleanDiffView: narrow heading Tag to 'h1'..'h6' so hover props resolve to HTMLHeadingElement instead of the SVGSymbolElement branch of keyof IntrinsicElements. - VSCodeIcon: spread mask-type as a kebab-case attribute; React 19's typings no longer expose the camelCase maskType prop on SVG masks. - useSharing / sharing: cast decompress() result to SharePayload — the shared compress module returns unknown by design; callers were implicitly any and TS 5.x now flags the assignment. For provenance purposes, this commit was AI assisted. |
||
|
Michael Ramos
|
53d2246b16 |
feat: Code Tour — guided PR walkthrough as a third agent provider (#569)
* feat(server): add Code Tour agent as third review provider Adds a "tour" provider alongside "claude" and "codex" that generates a guided walkthrough of a changeset from a product-minded colleague's perspective. Reuses the entire agent-jobs infrastructure (process lifecycle, SSE broadcasting, live logs, kill support, capability detection) so the only new server plumbing is the prompt/schema module, the GET endpoint for the result, and checklist persistence. - tour-review.ts: prompt, JSON schema, Claude (stream-json) and Codex (file output) command builders, and parsers for both. Prompt frames the agent as a colleague giving a casual tour, orders stops by reading flow (not impact), chunks by logical change (not per-file), and writes QA questions a human can answer by reading code or using the product. - review.ts: tour buildCommand with per-engine model defaults (fixes a bug where Codex was defaulting to "sonnet", a Claude model), an onJobComplete handler that parses and stores the tour, plus GET /api/tour/:jobId and PUT /api/tour/:jobId/checklist endpoints. - agent-jobs.ts: tour capability detection and config threading from the POST body through to the provider's buildCommand. - shared/agent-jobs.ts: engine/model fields on AgentJobInfo so the UI can render tour jobs with their chosen provider + model. For provenance purposes, this commit was AI assisted. * feat(review-editor): Code Tour dialog with animated walkthrough Adds the tour overlay surface: a full-screen dialog with three animated pages (Overview, Walkthrough, Checklist) that renders the CodeTourOutput from the server-side agent. Opens automatically when a tour job completes and can be dismissed with Escape or backdrop click. - components/tour/TourDialog.tsx: three-page animated dialog. Intro page uses a composition cascade (greeting, Intent/Before/After cards with one-shot color-dot pulse, key takeaways table) with a pinned Start Tour button and a bottom fade so content scrolls cleanly under it. Page slides between Overview/Walkthrough/Checklist are ease-out springs with direction auto-derived from tab index. - components/tour/TourStopCard.tsx: per-stop accordion using motion's AnimatePresence for height + opacity springs with staggered children for detail text and anchor blocks. Anchors lazy-mount DiffHunkPreview on first open to keep mount costs low. Callout labels (Important, Warning, Note) are deterministic typography, no emoji. - components/tour/QAChecklist.tsx: always-open list of verification questions with per-item spring entrance and persistent checkbox state that PUTs to the server. - hooks/useTourData.ts: fetch + checklist persistence with a dev-mode short-circuit when jobId === DEMO_TOUR_ID so UI iteration doesn't require a live agent run. - demoTour.ts: realistic demo data (multi-stop, multiple takeaways, real diff hunks) for dev iteration. - App.tsx: tour dialog state, auto-open on job completion, and a dev-only "Demo tour" floating button + Cmd/Ctrl+Shift+T shortcut guarded by import.meta.env.DEV. - index.css: all tour animations (dialog enter/exit, page slides, stop reveal cascade, intro exit) with reduced-motion fallbacks. Dark-mode contrast tuning across structural surfaces (borders, surface tints, callout backgrounds) so the design works in both themes. - package.json: adds motion@12.38.0 for spring-driven accordion physics and the intro composition cascade. For provenance purposes, this commit was AI assisted. * feat(review-editor): wire Code Tour into agent jobs UI + polish DiffHunkPreview Connects the tour provider to the existing agent jobs sidebar and detail panel so the user can launch a tour the same way they launch Claude or Codex reviews. Also tightens DiffHunkPreview (used inside tour anchors) to render correctly on first mount and handle every diff hunk shape the agent might produce. - ui/components/AgentsTab.tsx: tour engine (Claude/Codex) + model select when launching a tour job. Resets model to blank when falling back to Codex-only so Codex uses its own default instead of inheriting "sonnet" (a Claude model). - ui/hooks/useAgentJobs.ts: forward engine/model config from the UI through to the POST /api/agents/jobs body so the server's tour provider can pick the right command shape. - dock/panels/ReviewAgentJobDetailPanel.tsx: tour-aware detail panel. Replaces the "Findings" tab with a "Status" card for tour jobs and surfaces an "Open Tour" button that opens the dialog overlay when the tab is already in the dock. - components/DiffHunkPreview.tsx: synchronous pierre theme init via a useState lazy initializer so the first render (inside a tooltip) is already themed; robust hunk parser that handles bare @@ hunks, file- level --- hunks, and full git diffs; "Diff not available" fallback for broken hunks. - components/ReviewSidebar.tsx, dock/ReviewStateContext.tsx: small wiring changes to expose openTourPanel from the review state context. Also removes two dead components (TourHeader, DiffAnchorChip) that were superseded by the inline title bar in TourDialog and the inline AnchorBlock in TourStopCard. For provenance purposes, this commit was AI assisted. * refactor(server): extract Code Tour lifecycle into shared createTourSession factory + Pi parity The route-parity test suite requires the Pi server (apps/pi-extension/) to expose the same routes as the Bun server (packages/server/). After Code Tour shipped in the prior 3 commits, Pi was missing /api/tour/:jobId (GET) and /api/tour/:jobId/checklist (PUT). A naive mirror would duplicate ~100 lines of provider-branch logic (buildCommand, onJobComplete, in-memory maps) into Pi's serverReview.ts, perpetuating the existing claude/codex duplication problem. Instead, extract the pure runtime-agnostic tour lifecycle into a createTourSession() factory that both servers consume. Route handlers stay per-server (different HTTP primitives) but are ~5 lines each. Net effect: Pi port is ~25 lines instead of ~100. Future providers that adopt the same pattern cost ~15 lines per server. - tour-review.ts: new createTourSession() at the bottom of the module. Encapsulates tourResults + tourChecklists maps, buildCommand (with the Claude-vs-Codex model-default fix baked in), onJobComplete (parse/store/summarize), plus getTour/saveChecklist lookup helpers for route handlers. - review.ts (Bun): tour branch in buildCommand, tour branch in onJobComplete, and both route handlers collapse to one-line calls into the factory. Drops ~70 lines. - vendor.sh: add tour-review to the review-agent loop so Pi regenerates generated/tour-review.ts on every build:pi. - serverReview.ts (Pi): import createTourSession from ../generated/tour-review.js; add tour branch to buildCommand (one line), tour branch to onJobComplete (three lines), and GET/PUT route handlers using Pi's json() helper. ~25 lines added. - agent-jobs.ts (Pi): extend buildCommand interface to accept config and return engine/model; thread config from POST body; extend spawnJob to persist engine/model on AgentJobInfo; add tour to capability list. Claude and Codex branches are intentionally left in the old pattern; they can migrate to the factory approach when next touched to keep this change's blast radius contained. Tests: 518/518 passing (previous 3 route-parity failures resolved, plus 2 extra assertions passing since tour is now in both servers' route tables). For provenance purposes, this commit was AI assisted. * refactor(tour): self-review cleanup — Pi route match parity + remove setOpen shim Two small cleanups surfaced by a self-review pass: - Pi's GET /api/tour/:jobId route used `endsWith("/checklist")` to block the checklist sub-route, while Bun uses `includes("/", ...)`. The two are not equivalent: a URL like /api/tour/abc/extra would be accepted by Pi (jobId becomes "abc/extra") but correctly rejected by Bun. Align Pi to Bun's pattern. - TourStopCard had a leftover `setOpen` shim from when open state was local to the card. State is now lifted to TourDialog, so the shim just aliases onToggle and ignores its argument. Replace with a direct `onClick={onToggle}` on the trigger button. 520/0 tests still pass. For provenance purposes, this commit was AI assisted. * feat(review): per-provider model + effort controls across all review agents Exposes model, effort/reasoning, and fast-mode (Codex) as per-job knobs for Claude, Codex, and Code Tour via the Agents tab. Threads the config from the UI through the POST body into each provider's buildCommand, which emits the corresponding CLI flags (--model/--effort for Claude; -m / -c model_reasoning_effort / -c service_tier for Codex). Bun and Pi servers stay in parity. UI: option catalogs (CLAUDE_MODELS, CLAUDE_EFFORT, CODEX_MODELS, CODEX_REASONING, TOUR_CLAUDE_MODELS) are defined once and mapped into every dropdown so there's a single source of truth for the choices. Tour's Claude/Codex settings are kept separate from the standalone provider's state so toggling the tour engine no longer overwrites the provider's last choice. Job badge now surfaces the model/reasoning/fast selection for both Tour and the standalone Codex provider. For provenance purposes, this commit was AI assisted. * docs: add Prompts reference page Documents the three-layer structure every review call travels through (CLI system prompt, our user message of review-prompt + user-prompt, output schema flag), names each constant + its file, and calls out that the Claude/Codex review prompts are the upstream ones from those projects (only Code Tour's prompt is original to Plannotator). Linked from the Code Review command page. For provenance purposes, this commit was AI assisted. * feat(review): persist per-agent, per-model settings in a single cookie Drops the hidden "Default" options from the agent dropdowns, locks in explicit sensible defaults (Opus 4.7/High for Claude review, gpt-5.3-codex/High for Codex, Sonnet/Medium for Tour Claude, gpt-5.3-codex/Medium for Tour Codex), and remembers the last-used effort/reasoning/fast-mode per (agent job × model) so switching models reveals the choices you made last time. Backed by a single `plannotator.agents` cookie holding the whole settings tree — one read on mount, one mirror write per change, all mutations funnel through a single React state owner to avoid stale-read or lost-write races across rapid successive updates. For provenance purposes, this commit was AI assisted. * fix(tour): unblock reduced-motion nav + flush pending checklist save on close Two P2 issues surfaced in review: - Under prefers-reduced-motion, tour page animations are suppressed, so onAnimationEnd never fires and exitingPage stuck on 'intro' kept the walkthrough/checklist gated out. navigate() now swaps pages directly when reduced motion is on, mirroring the pattern already used in the wrapper. - Checklist toggles are debounced 500ms before the PUT, but unmount only cleared the timer — checking an item and closing within the window dropped the save. Cleanup now flushes the pending payload with keepalive: true. For provenance purposes, this commit was AI assisted. * feat(review): surface Claude model + effort in job badge, trim redundant labels Claude effort was never persisted on AgentJobInfo, so the job badge had nothing to render beyond "Claude". Plumbs `effort` through the shared type, both server build-command pipelines (Bun + Pi), and spawnJob, then teaches the ProviderBadge to display Claude and Tour Claude model + effort with the same shape Codex already had. Labels resolve via the dropdown catalogs so the badge shows "Opus 4.7" / "High" instead of raw ids. Server labels for both Claude and Codex reviews collapse to plain "Code Review" (matching tour's "Code Tour"), since the badge now carries the provider + model + settings — the title only needs to name the action. For provenance purposes, this commit was AI assisted. * polish(review): prefix agent dropdown options with the action name The Run launcher listed "Claude Code", "Codex CLI", and "Code Tour" side by side — the CLI's detection name was doing double duty as the action label. Prefixes the review entries with "Code Review · " so scanning three options surfaces two reviews + one tour instead of three raw provider names. For provenance purposes, this commit was AI assisted. * fix(review): drop invalid codex reasoning option + fail tour on empty output Two P2 issues from PR review: - Tour jobs exited 0 but returned null output would still be marked "done", and the auto-open watcher would greet the user with a 404 "Tour not found" dialog. onJobComplete now flips the job to failed with an error message when nothing was stored, so the card reflects the real state. - The codex reasoning dropdown offered "None", but codex-rs only accepts minimal/low/medium/high/xhigh. Picking None sent `-c model_reasoning_effort=none` and launched a broken job. Removed the option; added a one-shot cookie migration so users who already saved "none" don't keep shipping it. For provenance purposes, this commit was AI assisted. * fix(tour): format Claude-engine logs + allow reading linked issues Two P2/P3 issues from PR review: - The stdout formatter keyed only on provider === "claude", so Code Tour jobs running on the Claude engine streamed raw JSONL to the log panel while Claude review jobs got formatted text. Widened the check to also catch spawnOptions.engine === "claude" and mirrored the fix into Pi. - The tour Claude allowlist permitted PR/MR commands but not issue reads, yet the prompt explicitly asks the agent to open `Fixes #123` / `Closes owner/repo#456` targets for deeper context. Claude was being denied those commands mid-tour. Added gh issue view + gh api issues + glab issue view to the allowlist. For provenance purposes, this commit was AI assisted. * cleanup(review): e2e punchlist — Pi parity + dedup + tests - Pi now logs Claude parse failures with the same diagnostic as Bun - Tour route match uses a regex instead of an includes-offset trick - Drop `any` cast in Pi's Codex blocking-findings predicate - Extract `patchClaude` twin of `patchCodex` in useAgentSettings - Factor `resolveAgentCwd` helper in Bun review to match Pi - AgentsTab launch payload becomes a per-provider dispatch table - Wrap TourDialog in MotionConfig reducedMotion="user" so motion.* children honor prefers-reduced-motion alongside the CSS keyframes - Tests for parseTourStreamOutput/parseTourFileOutput and the Codex perModel sanitizer For provenance purposes, this commit was AI assisted. * test(tour-review): use real TourStop shape in fixtures The parsers don't validate stop fields so the original made-up shape passed fine, but future readers would be misled. Use the real CodeTourOutput / TourStop / TourDiffAnchor shapes from tour-review.ts. For provenance purposes, this commit was AI assisted. * cleanup(tour): hoist shared types + subfolder server module + dedup - Hoist tour output types to packages/shared/tour.ts so server and UI share one source of truth (prevents silent drift when schema changes). - Move tour-review into packages/server/tour/ subfolder alongside the existing packages/review-editor/components/tour/ convention. - Extend tour.buildCommand to accept tour context directly (patch, diffType, options, prMetadata), so Bun and Pi no longer duplicate the buildTourUserMessage call site. Export TOUR_EMPTY_OUTPUT_ERROR from the tour module to prevent string drift between servers. - Early-return the tour branch in buildCommand so the review userMessage is built once on the shared non-tour path instead of unconditionally (dead work on tour launches) or twice (codex+claude dup). - Regex capture group for tour checklist jobId in both servers — replaces a second url.pathname.split("/")[3] fragile fallback. - Drop existsSync guard in parseTourFileOutput (TOCTOU + duplicate syscall); the outer try/catch already handles ENOENT. - Dedupe two matchMedia reads in TourDialog behind a prefersReducedMotion helper; memoize intro-page card array so unrelated state churn doesn't recompute it. - Comment hygiene on tour files — drop WHAT/change-referencing comments added by this PR; keep non-obvious WHY. For provenance purposes, this commit was AI assisted. * fix(tour): hoist introCards useMemo above early returns + subfolder hook The memoized intro-card array was placed after the loading/error early returns in TourDialogContent, so the first successful render called one more hook than the initial loading render — React threw "Rendered more hooks than during the previous render" (error #310) the moment a tour finished loading. Move the useMemo above the early returns and use optional chaining on `tour` so it's safe to run during loading. Also move useTourData.ts into a hooks/tour/ subfolder to start a standard for feature-scoped hooks (was flat among siblings). For provenance purposes, this commit was AI assisted. |
||
|
Michael Ramos
|
3a7f1156cd |
chore: bump version to 0.18.0
Also fix stale annotate description in README and add missing PLANNOTATOR_ORIGIN entry to the env vars table. For provenance purposes, this commit was AI assisted. |
||
|
Alexander Kolberg
|
54c206c77d |
Add ~ support for user-entered file paths (#572)
* refactor(path): centralize user path resolution * fix(annotate): resolve user paths in file entrypoints * fix(pi-extension): restore resolve import and add typecheck to CI The refactor removed `resolve` from `node:path` imports, but `resolvePlanPath()` and the planning-mode write/edit guards still call `resolve(...)`. That breaks plan submission and plan-file restriction at runtime for Pi users. Also wires pi-extension's tsconfig into the root `typecheck` script so CI catches this class of missing-symbol regression in the future. Required adding @mariozechner/pi-* packages as explicit devDependencies so tsc can resolve them (they were previously only reachable transitively via the peer dep, which Bun keeps in its `.bun/` store unhoisted). For provenance purposes, this commit was AI assisted. * fix(path): reject whitespace-only user paths and run vendor before typecheck resolveUserPath() trims input, so whitespace-only customPath/vaultPath resolved to process.cwd(). Plans silently wrote into the repo root and Obsidian notes landed in <cwd>/plannotator/ instead of erroring. Guard at both call sites (getPlanDir, saveToObsidian — Bun + Pi copies). Also prepend vendor.sh to the root typecheck script so fresh-clone `bun run typecheck` works without a separate vendoring step. For provenance purposes, this commit was AI assisted. * fix(path): short-circuit resolveUserPath on empty input Trimming in normalizeUserPathInput meant whitespace-only input resolved to cwd/baseDir. Callers like the annotate CLI and reference API endpoints would then list the project root instead of erroring. Return "" early so downstream existsSync/resolveMarkdownFile checks fail naturally. For provenance purposes, this commit was AI assisted. --------- Co-authored-by: Michael Ramos <mdramos8@gmail.com> |
||
|
HeikoAtGitHub
|
9bc1ba97d3 |
feat: detect OpenCode origin + activate PLANNOTATOR_ORIGIN override (#590)
* feat: detect OpenCode origin + activate PLANNOTATOR_ORIGIN override Extend the origin detection chain in apps/hook/server/index.ts to recognize OpenCode via `process.env.OPENCODE`, the stable runtime flag set by the OpenCode binary (also sets OPENCODE_RUN_ID, OPENCODE_PID, OPENCODE_PROCESS_ROLE, but OPENCODE=1 is the canonical detection flag). Additionally, activate `PLANNOTATOR_ORIGIN` as an explicit override. The comment in packages/server/index.ts already documented this variable, but it was never actually read. It is now honored at the top of the detection chain and validated against AGENT_CONFIG so only known origins take effect — invalid values fall through to env-based detection. Priority order after this change: PLANNOTATOR_ORIGIN > Codex > Copilot CLI > OpenCode > Claude Code (default) Single-point fix: all five existing `detectedOrigin` usages (lines 405, 568, 694, 741, 999) pick up the new chain automatically. The `'opencode'` origin key is already defined in packages/shared/agents.ts (AGENT_CONFIG), complete with a UI badge — the detection chain was the last missing piece. Closes the gap noted in packages/shared/agents.ts header comment: "If detection is via environment variable, add it to the detection chain in apps/hook/server/index.ts (detectedOrigin constant)". * fix: remove stray project argument from getServerConfig calls getServerConfig only accepts gitUser — the project argument was silently ignored at runtime but fails the typecheck. Reverts the two call sites to their correct single-argument form. For provenance purposes, this commit was AI assisted. --------- Co-authored-by: Michael Ramos <mdramos8@gmail.com> |
||
|
Michael Ramos
|
104be99f3c |
Add thumbs up quick label button to annotation toolbar (#588)
* Add thumbs-up quick annotation button to annotation toolbar
A one-click "👍 Looks good" button joins the existing quick-label
system so users can approve a selection, code block, or diff hunk
without opening the picker. Covers plan, annotate, and plan-diff
modes (all share the same AnnotationToolbar).
* Move thumbs-up button to the right of the zap quick-label button
For provenance purposes, this commit was AI assisted.
|
||
|
Michael Ramos
|
84aa1d7d0b |
Surface Save as PDF via existing print flow (#587)
Rename the Options menu item from "Print Plan" to "Print / Save as PDF" with a subtitle guiding users to pick "Save as PDF" as the print destination. Linked docs, plan diff, annotate mode, and archive mode all render through the same Viewer's [data-print-region="article"], so print.css already covers them with no further changes. |
||
|
dgrissen2
|
8a4ef65553 |
Add annotate wide mode (#578)
* Add annotate wide mode * Extend wide mode: add Focus variant, enable in all modes, reposition controls - Drop annotate-only gate in canUseAnnotateWideMode; available in plan review, annotate, and linked-doc flows (archive/diff still excluded) - Add Focus mode alongside Wide: both collapse sidebars and suppress annotation panel auto-open; only Wide removes the reader width cap - Move controls out of AnnotationToolstrip/StickyHeaderLane; render as absolute-positioned "Wide | Focus" text buttons floating above the plan card's top-right edge (no vertical space cost) - Add Radix-based Tooltip primitive (packages/ui/components/Tooltip.tsx) and TooltipProvider; replaces the ad-hoc CSS tooltip with portaled, accessible, animated content - Polish: tracking-wide for 11px labels, focus-visible ring, active press state, aria-pressed, weight-stable toggle (color-only), 60px right offset under tater mode For provenance purposes, this commit was AI assisted. * Update wideMode test to cover both annotate and plan review modes The annotateMode gate was removed — update the test matrix to assert wide mode is enabled in annotate AND plan review, and disabled for archive/diff across both mode values. For provenance purposes, this commit was AI assisted. * Drop unused annotateMode parameter from canUseAnnotateWideMode The parameter was ignored after the annotate-only gate was removed. Prune it from the signature, the App.tsx call site and deps, and the test matrix to match the actual behavior (disabled only for archive and diff). For provenance purposes, this commit was AI assisted. --------- Co-authored-by: Michael Ramos <mdramos8@gmail.com> |
||
|
Michael Ramos
|
ea758f9978 |
Add configurable paste service URL for self-hosting (#582)
* Wire PLANNOTATOR_PASTE_URL through opencode/pi servers and Landing demo link OpenCode plugin only read PLANNOTATOR_SHARE_URL; add a getPasteApiUrl helper and thread it into plan/annotate/archive server starts. Pi extension's serverReview gains the same shareBaseUrl/pasteApiUrl env-var pair already used by serverPlan/serverAnnotate. Landing.tsx now accepts a shareBaseUrl prop for self-hosters' demo link. Paste-service CORS defaults grow a comment clarifying that self-hosters must override ALLOWED_ORIGINS. * Embed custom paste origin in short URL fragment When PLANNOTATOR_PASTE_URL is set to a non-default paste service, the generated short link now includes a base64url-encoded paste param in the fragment (#key=...&paste=...). The share portal and importFromShareUrl extract it on load so they can fetch from the right paste backend without needing a server — fixing broken short links for self-hosters who use a custom paste service but keep the hosted share portal. Backward compatible: links without a paste param continue to use the default or server-provided paste API URL as before. For provenance purposes, this commit was AI assisted. --------- Co-authored-by: Claude <noreply@anthropic.com> |
||
|
Orestis Ioannou
|
14bff361f8 |
fix(opencode): reuse local server for review flows (#567)
* fix(opencode): reuse local server for review flows Try the default local OpenCode server before spawning a new one, and resolve bundled assets and command paths correctly when the plugin is loaded from source during local testing. * Fix typecheck after narrowing the opencode type to the sdk |
||
|
Michael Ramos
|
4139999526 |
feat(plan-diff): word-level inline diff rendering (#565)
* feat(plan-diff): word-level inline diff rendering Two-pass hierarchical diff (diffLines outer + diffWordsWithSpace inner) so modified plan blocks render with inline insertions/deletions in context instead of showing the whole old block struck-through above the whole new block. Resolves #560. Engine (packages/ui/utils/planDiffEngine.ts): - computeInlineDiff runs a second-pass word diff on modified blocks that pass a whitelist gate (paragraph/heading/list-item with matching structural fields). - Sentinel substitution atomizes inline-code spans, markdown links, and fenced code blocks before diffWordsWithSpace runs, so diff markers never land inside backticks, link hrefs, or across fence boundaries. Fence regex uses a backreference so variable-length (e.g., 4-backtick wrapping 3-backtick) fences are matched atomically. - Annotation context for an inline-diffed modified block now captures both old and new content so comments on struck-through words preserve that text in the exported feedback. Renderer (packages/ui/components/plan-diff/PlanCleanDiffView.tsx): - New InlineModifiedBlock component renders a modified block as one structural wrapper with <ins>/<del> wrappers inside, parsed through the local InlineMarkdown in a single pass so markdown delimiter pairs survive across token boundaries. - InlineMarkdown extended to recognize <ins>/<del> tag passthrough (with recursive parsing of the wrapped content) and to recursively parse link anchor text so diff markers inside links render correctly. - Plain-text stop-char scanner includes '<' so <ins>/<del> dispatch re-enters the loop instead of swallowing tag text. - Click-to-annotate works in every editor mode (not just comment), with the block-level onClick opening the popover directly. Mode switcher (packages/ui/components/plan-diff/PlanDiffModeSwitcher.tsx): - Adds a third "Classic" tab between Rendered and Raw. Rendered is the new word-level default (labeled "exp"); Classic forces the legacy block-level stacked fallback for every modified block. Styling (packages/ui/theme.css, packages/editor/index.css): - plan-diff-word-added / plan-diff-word-removed utility classes for inline highlights with box-decoration-break: clone across line wraps. - Inline <code> inside the diff wrappers picks up a tinted background so code-pill changes read unambiguously green/red. - New plan-diff-modified class (amber border) for inline-diff modified blocks, matching the GitHub/VSCode convention of green=add, red=remove, yellow=both. Tests (packages/ui/utils/planDiffEngine.test.ts): - 18 tests covering the engine's qualification gate, structural-field matching, sentinel round-trip (inline code / links / fences), token content for common edit patterns. For provenance purposes, this commit was AI assisted. * chore(demo): restructure default demo, add VITE_DIFF_DEMO stress test Demo content changes that support the word-level diff work but do not alter shipped app behavior — only what other devs see running dev:hook. packages/editor/demoPlan.ts (default V3 editor content): - Added a "Context" section at the top of the plan with prose that showcases the word-level engine in V2→V3 diff: bold phrase swap, inline-code pill swaps, a link URL change, and a single-line code edit inside a config block. - Moved the mermaid architecture diagram and graphviz service map to an "Appendix: Diagrams" section at the end of the plan; they were rendering ugly mid-document. apps/hook/dev-mock-api.ts (Vite mock for the diff API): - PLAN_V1 / PLAN_V2 split into *_DEFAULT (original Real-time Collaboration plan — preserved identically from pre-branch state) and *_DIFF_TEST (the 20-case Auth Service Refactor diff-engine stress test, kept as an opt-in tool). - Resolves which pair to serve based on VITE_DIFF_DEMO env var. Matches the V2 Context section to the new V3 Context, with differences that produce rich word-level inline diffs on first load. - Diagrams moved to Appendix in V2_DEFAULT to match V3. packages/editor/App.tsx: - Both demo imports are active. VITE_DIFF_DEMO=1 swaps DIFF_DEMO_PLAN_CONTENT into the editor's default; unset renders the original Real-time Collaboration plan as before. packages/editor/demoPlanDiffDemo.ts (new): - 20-case stress test (paragraphs, headings, lists, tables, fences, blockquotes, known limitations). Each case has an identical "What to watch for" blockquote label in both V2 and V3 so the diff view cleanly isolates each case. Opt-in only. .gitignore: - Ignore .claude/ runtime lock/state files. Machine-specific content that should not be tracked. For provenance purposes, this commit was AI assisted. * style(plan-diff): refine modified-block visual — amber gutter, no fill Drop the yellow background fill from .plan-diff-modified and keep only a softened amber left border. Added/removed blocks remain loud (full fill + strong border) because add/remove are block-scope events — the whole block matters. Modify is a word-scope event — the individual changed words carry loud inline red/green highlights, and a block-level fill would compete with that inline work. The amber gutter at 75% opacity now reads as a quiet "look inside, the change is in the text" marker that sits coherently with the rest of the palette. For provenance purposes, this commit was AI assisted. * fix(plan-diff): sanitize link hrefs against javascript: / data: schemes PlanCleanDiffView has its own local copy of InlineMarkdown (separate from the one in Viewer.tsx). The link-rendering branch was passing the captured URL directly to href with no validation, so a plan containing [click me](javascript:alert(document.cookie)) would render as a live clickable anchor in the diff view. Plan content is attacker-influenced — Claude pulls from source comments, READMEs, fetched URLs — so this is a real exploit path in the diff flow. Port the same guard Viewer.tsx already has: sanitizeLinkUrl() rejects javascript:, data:, vbscript:, and file: schemes (case-insensitive, with optional leading whitespace). Rejected links render their anchor text as plain text instead of a clickable <a>, so the content is still visible to the reader but no longer dangerous. For provenance purposes, this commit was AI assisted. |
||
|
Prannay Hebbar
|
724554600f |
feat(viewer): render color swatches next to hex color codes (#562)
When a plan contains hex color values (#rgb, #rrggbb, #rgba, #rrggbbaa), the InlineMarkdown renderer now shows a small filled swatch inline to the left of the code so the actual color is immediately visible. |
||
|
Michael Ramos
|
f1d3a880ed |
feat(annotate): try Accept: text/markdown before Jina/Turndown (#557)
Sites that support Cloudflare's "Markdown for Agents" (or similar content negotiation) now return markdown directly, skipping the Jina Reader and Turndown conversion entirely. The negotiation attempt uses a short 5s timeout so failures fall through quickly to the existing pipeline. For provenance purposes, this commit was AI assisted. |
||
|
Michael Ramos
|
e22c911c2c |
chore: bump version to 0.17.10
For provenance purposes, this commit was AI assisted. |
||
|
David han (Bart)
|
c2dadc9717 |
Bind local Plannotator servers to loopback by default (#533)
* Harden review agent job launch endpoints * Stabilize agent job auth tests * Drop review agent job token gating * Align useAgentJobs with upstream formatting * Allow remote sessions to bind all interfaces |
||
|
Michael Ramos
|
b780739291 |
feat(annotate): support HTML files and URL annotation (#545)
* fix(annotate): sanitize dangerous link protocols in markdown renderer
Block javascript:, data:, and vbscript: URLs in InlineMarkdown link
rendering. Links with dangerous protocols render as plain text instead
of clickable anchors. Uses a blocklist approach so existing links with
custom protocols (obsidian://, vscode://, Windows C:\ paths) continue
to work.
For provenance purposes, this commit was AI assisted.
* feat(annotate): add HTML-to-markdown and URL-to-markdown utilities
- html-to-markdown.ts: Turndown wrapper with GFM table rule, strips
script/style/noscript tags
- url-to-markdown.ts: Jina Reader (free, returns markdown) with
fetch+Turndown fallback. Warns on Jina failure, auto-skips Jina for
local/private URLs (localhost, 192.168.*, 10.*, etc.)
- config.ts: add jina setting and resolveUseJina() with priority chain
--no-jina flag > PLANNOTATOR_JINA env > config.json > default true
For provenance purposes, this commit was AI assisted.
* feat(annotate): support HTML files and URLs in annotate command
Extend the annotate subcommand to accept .html/.htm local files
(converted via Turndown) and https:// URLs (fetched via Jina Reader
with fetch+Turndown fallback). URL content is fetched terminal-side
before opening the browser.
Add --no-jina global flag to disable Jina Reader per-invocation.
Add 10MB file size guard for local HTML files.
For provenance purposes, this commit was AI assisted.
* feat(annotate): HTML files in folder browser and on-demand conversion
- Widen file browser glob to include .html/.htm alongside markdown
- handleDoc converts HTML files via Turndown on demand when selected
- hasMarkdownFiles accepts optional extensions param for folder validation
- Add sourceInfo field to annotate server API response
- Add _site/, public/, out/, .docusaurus/, .jekyll-cache/,
storybook-static/ to FILE_BROWSER_EXCLUDED
For provenance purposes, this commit was AI assisted.
* feat(annotate): source attribution badge for HTML/URL annotations
Show a subtle badge in DocBadges displaying the URL hostname or HTML
filename for converted content. Thread sourceInfo from API response
through App → Viewer → DocBadges.
Also update Pi extension to accept HTML-only folders in annotate mode.
For provenance purposes, this commit was AI assisted.
* test: update CLI help text assertion for HTML/URL annotate support
For provenance purposes, this commit was AI assisted.
* fix(annotate): address PR review findings
Security:
- Add project-root containment check for HTML files in /api/doc handler
using exported isWithinProjectRoot() from resolve-file.ts
- Blocks path traversal via absolute paths or ../ escapes
isLocalUrl fixes:
- Add bracketed IPv6 loopback [::1] detection
- Replace hostname.startsWith('10.') with proper IPv4 regex to avoid
matching public hostnames like 10.example.com
Revert Pi extension change:
- Pi server doesn't implement HTML file browsing or conversion yet
- Keep Pi folder validation markdown-only until both implementations
are updated per CLAUDE.md guidelines
Cleanup:
- Remove dead el.children || el.childNodes fallback in table rule
- Extract hostnameOrFallback() helper to @plannotator/shared/project
replacing duplicated try/catch IIFEs in DocBadges and index.ts
For provenance purposes, this commit was AI assisted.
* feat(annotate): Pi extension HTML annotation parity
Bring the Pi extension to full parity with the Bun server for HTML
annotation support:
- Vendor html-to-markdown and url-to-markdown via vendor.sh
- walkMarkdownFiles now scans .html/.htm alongside markdown
- handleDocRequest converts HTML files on-demand via Turndown with
isWithinProjectRoot containment check
- serverAnnotate includes sourceInfo in /api/plan response
- index.ts supports URL detection (Jina Reader + fallback), HTML file
detection with Turndown conversion, folder HTML validation, and 10MB
file size guard
- openMarkdownAnnotation accepts and threads sourceInfo
- Add turndown as a Pi extension dependency
For provenance purposes, this commit was AI assisted.
* fix(pi): Obsidian vault walks stay markdown-only, add try/catch for HTML
- Add extensions param to walkMarkdownFiles (default: HTML-inclusive)
- Obsidian callers pass /\.mdx?$/i to match Bun server behavior
- Add try/catch around HTML file reads in handleDocRequest
For provenance purposes, this commit was AI assisted.
* fix(annotate): address second review — base-block traversal, metadata IP, dead code
Security:
- Add isWithinProjectRoot check to the base-relative block for HTML
files in both Bun and Pi /api/doc handlers. Previously HTML files
served via the base query param bypassed the containment guard.
- Add 169.254.0.0/16 (link-local / cloud metadata) to isLocalUrl
private IP ranges
Cleanup:
- Remove dead hostname === "[::1]" check (WHATWG URL parser strips
brackets; hostname === "::1" already handles it)
- Remove dead parent?.childNodes fallback in table cell() function
For provenance purposes, this commit was AI assisted.
* refactor(annotate): replace custom table rules with turndown-plugin-gfm
Drop ~60 lines of hand-rolled GFM table conversion that had a bug
(tables without explicit <thead> produced invalid GFM). Use the
official turndown-plugin-gfm plugin (24KB) which correctly handles
all table patterns plus adds strikethrough and task list support.
For provenance purposes, this commit was AI assisted.
* fix(annotate): handle all CommonMark backslash escapes in InlineMarkdown
Expand the backslash escape regex to cover all CommonMark-defined
escapable characters (. ) - # > + | { } &), not just the subset
the parser uses for formatting. Fixes literal backslashes appearing
in rendered output for Turndown-escaped content like "1\." → "1.".
For provenance purposes, this commit was AI assisted.
* fix(annotate): prevent SSRF via redirect to private/local URLs
Replace redirect: "follow" with redirect: "manual" in fetchViaTurndown
and validate each redirect hop against isLocalUrl. Blocks attacks where
an external URL redirects to cloud metadata endpoints (169.254.169.254)
or other private IPs. Limits redirect chain to 10 hops.
For provenance purposes, this commit was AI assisted.
* chore: update lockfile for turndown-plugin-gfm in Pi extension
bun install needed to resolve turndown-plugin-gfm in the Pi extension
workspace after adding it to apps/pi-extension/package.json.
For provenance purposes, this commit was AI assisted.
* fix(annotate): switch to @joplin/turndown-plugin-gfm, fix TS errors
Replace unmaintained turndown-plugin-gfm (2017, v1.0.2) with the
actively maintained Joplin fork (2025, v1.0.64, 16KB).
Fix TypeScript errors that broke CI:
- Add @ts-expect-error for untyped @joplin/turndown-plugin-gfm import
- Restructure fetchViaTurndown redirect loop to avoid uninitialized
variable — first fetch before loop, loop only for redirects
For provenance purposes, this commit was AI assisted.
* fix(annotate): use proper declarations.d.ts instead of ts-expect-error
Add declarations.d.ts for @joplin/turndown-plugin-gfm with typed
function signatures, remove the ts-expect-error suppression.
For provenance purposes, this commit was AI assisted.
* fix: explicitly include declarations.d.ts in shared tsconfig
CI's tsc wasn't finding the ambient module declaration with implicit
include. Add explicit include to ensure declarations.d.ts is always
picked up regardless of environment.
For provenance purposes, this commit was AI assisted.
* fix: use ts-expect-error for @joplin/turndown-plugin-gfm types
CI's tsc does not pick up ambient declarations.d.ts files despite
local tsc finding them — likely a module resolution discrepancy
between environments. Revert to @ts-expect-error which passes in
both CI and local typecheck.
For provenance purposes, this commit was AI assisted.
* fix(annotate): body size limit for URL fetches, redirect error, file: protocol
- Add 10MB body size limit to both Jina and fetch+Turndown URL paths,
matching the local HTML file guard. Streams response body and aborts
if limit exceeded.
- Distinguish "Too many redirects" from a genuine 3xx response after
redirect loop exhaustion.
- Add file: to the dangerous protocol blocklist in sanitizeLinkUrl.
For provenance purposes, this commit was AI assisted.
* fix(annotate): HTML folder outside cwd, HTML linked doc navigation
- Remove containment check from base-relative block for HTML files in
both Bun and Pi /api/doc handlers. Matches markdown behavior so HTML
files in annotated folders outside cwd are served correctly.
Standalone block (no base) retains its cwd check as fallback.
- Widen isLocalMd → isLocalDoc to treat .html/.htm links as linked
documents. Clicking [Next](next.html) in a converted page now opens
it via /api/doc with Turndown conversion instead of a new browser tab.
For provenance purposes, this commit was AI assisted.
* fix(annotate): full loopback range, drain redirect bodies, document env vars
- Expand loopback check from just 127.0.0.1 to the full 127.0.0.0/8
range so all loopback addresses skip Jina Reader
- Cancel redirect response body before re-fetching to avoid leaking
TCP connections back to the pool
- Document PLANNOTATOR_JINA and JINA_API_KEY in CLAUDE.md env var table
For provenance purposes, this commit was AI assisted.
* fix(annotate): IPv6 loopback, readBodyWithLimit fallback, env var docs, comments
- Add [::1] back to isLocalUrl — WHATWG URL hostname getter preserves
brackets for IPv6 (verified: Bun and Node both return "[::1]").
Add comment explaining the empirical verification so future reviewers
don't re-flag.
- Fix readBodyWithLimit null-body fallback to still enforce the 10MB
limit via text length check instead of silently falling through.
- Document PLANNOTATOR_JINA and JINA_API_KEY in AGENTS.md env var table
(CLAUDE.md is a symlink to AGENTS.md).
- Add comments to base-relative blocks in both Bun and Pi handleDoc
explaining the intentional lack of containment check (matches
pre-existing markdown behavior, base is set server-side).
For provenance purposes, this commit was AI assisted.
* fix(annotate): block IPv4-mapped IPv6 and private IPv6 ranges in isLocalUrl
Add PRIVATE_IPV6 regex matching bracketed IPv6 private/reserved ranges:
- ::ffff: (IPv4-mapped — embeds private IPv4 as hex, e.g. [::ffff:c0a8:1])
- fe80: (link-local)
- fc00::/7 (unique-local, covers fc00:: through fdff::)
Closes the redirect-SSRF bypass where a public URL redirects to a
private address expressed as IPv4-mapped IPv6, e.g.
http://[::ffff:169.254.169.254]/latest/meta-data/
For provenance purposes, this commit was AI assisted.
* fix(annotate): document IPv6 hostname verification, sourceInfo type, annotate flow
- Expand isLocalUrl comment with full empirical verification table
showing actual hostname getter output for every IPv6 format in both
Bun and Node — prevents false-positive review findings about brackets
- Add sourceInfo to /api/plan response type in App.tsx for type safety
- Update CLAUDE.md annotate flow diagram to reflect HTML/URL/folder
input types
For provenance purposes, this commit was AI assisted.
* fix(annotate): escape \(, cancel response bodies on error, doc sourceInfo
- Add ( to backslash escape regex alongside existing ) — Turndown
emits \( in link-adjacent contexts
- Cancel response body before throwing on !res.ok in both fetchViaJina
and fetchViaTurndown error paths (redirect loop already did this)
- Document sourceInfo field in AGENTS.md annotate server API table
For provenance purposes, this commit was AI assisted.
* fix(annotate): skip base injection for URL annotations, body cleanup
- Skip dirname(filePath) base injection when filePath is a URL in both
Bun and Pi annotate servers. dirname on a URL string produces a
nonsensical filesystem path, causing linked doc clicks to 404.
URL annotations now let links open normally instead.
- Cancel response body before throwing on content-type mismatch and
content-length overflow in fetchViaTurndown/readBodyWithLimit.
- Fix double parseInt in readBodyWithLimit content-length check.
- Correct AGENTS.md flow diagram: OpenCode not yet implemented for
HTML/URL annotation.
For provenance purposes, this commit was AI assisted.
* feat(annotate): OpenCode HTML file and URL annotation support
Add URL detection (Jina Reader + fallback), HTML file detection with
Turndown conversion, 10MB file size guard, and sourceInfo threading
to OpenCode's handleAnnotateCommand. Uses the same shared utilities
as the Bun CLI and Pi extension.
OpenCode uses the Bun server directly (startAnnotateServer from
@plannotator/server/annotate), so no server-side changes needed —
only the command handler routing was missing.
Note: folder annotation mode is not added (OpenCode didn't have it
before this PR for markdown either — separate scope).
For provenance purposes, this commit was AI assisted.
* chore(annotate): update slash command description, align fetch log messages
- OpenCode plannotator-annotate.md description now mentions HTML/URL
- Align fetch progress messages across all three clients: all now show
"(via Jina Reader)" or "(via fetch+Turndown)" consistently
For provenance purposes, this commit was AI assisted.
* fix(annotate): skip conversion for .md URLs, wikilink HTML targets, cleanup
- URLs ending in .md/.mdx are fetched raw — no Jina, no Turndown.
Content is already markdown. Removes text/plain from fetchViaTurndown
content-type whitelist since .md URLs are now short-circuited.
- Wikilink regex widened to preserve .html/.htm targets instead of
appending .md (e.g. [[page.html]] no longer becomes page.html.md)
- Remove redundant existsSync before statSync in OpenCode handler
For provenance purposes, this commit was AI assisted.
* test(annotate): add htmlToMarkdown conversion tests
Tests cover the core conversion utility that all three clients depend on:
- Basic HTML → markdown (headings, paragraphs, links, code blocks)
- Tables with and without <thead> (the GFM plugin bug that was caught)
- Script/style/noscript stripping
- Strikethrough (GFM)
- Empty HTML handling
- Dangerous links preserved (sanitization is in the renderer, not here)
For provenance purposes, this commit was AI assisted.
* fix(annotate): check content-type before treating .md URLs as raw markdown
URLs ending in .md/.mdx (e.g. GitHub's viewer page for README.md)
may return HTML instead of raw markdown. fetchRawText now checks the
response content-type — if the server returns HTML, returns null so
the caller falls through to Jina/Turndown for proper conversion.
For provenance purposes, this commit was AI assisted.
* fix(annotate): add SSRF redirect protection to fetchRawText
fetchRawText (for .md/.mdx URLs) was using default redirect: "follow"
with no isLocalUrl validation on redirect hops — a .md URL redirecting
to 169.254.169.254 would be followed and credentials returned as
"markdown". Now uses redirect: "manual" with per-hop isLocalUrl checks,
matching fetchViaTurndown's SSRF protection.
For provenance purposes, this commit was AI assisted.
|
||
|
Michael Ramos
|
aa73295b8d |
fix(review): work around Safari scroll-reset bug with shadow DOM diffs (#540) (#547)
Safari's compositor resets scrollTop to 0 when momentum-scrolling ends inside a container whose child is a web-component shadow DOM (the @pierre/diffs `<diffs-container>`). The reset bypasses all JavaScript APIs — neither scrollTo nor the scrollTop setter fires. Add a WebKit-only scroll event listener that detects the bogus reset (scrollTop jumping from >200 to 0 in a single event, which cannot happen during normal scrolling) and synchronously restores the last known good position before the browser paints the wrong frame. Closes #540 For provenance purposes, this commit was AI assisted. |
||
|
Michael Ramos
|
8ee7c6b99f |
fix(ui): restore triple-click paragraph selection (#544) (#546)
Switch outside-click dismiss from pointerdown to mousedown and skip
on multi-click (event.detail >= 2).
The capture-phase pointerdown listener from useDismissOnOutsideAndEscape
was calling handleToolbarClose on the 3rd click of a triple-click,
which removed the word <mark> and normalised text nodes. That DOM
mutation between pointerdown and mousedown reset the browser's
click-count tracking, so mousedown fired with detail=1 instead of
detail=3 — placing a cursor instead of selecting the paragraph.
Using mousedown instead of pointerdown because MouseEvent.detail is
spec-guaranteed to carry the click count (UI Events spec), whereas
the Pointer Events spec says PointerEvent.detail SHOULD be 0.
Multi-click mousedowns are part of an active selection gesture; the
web-highlighter CREATE handler already cleans up stale pending
highlights when a new selection commits, so the eager dismiss is
unnecessary.
Side-benefit: touch scroll gestures no longer dismiss the toolbar
(browsers suppress compatibility mousedown for scrolls); only taps
dismiss. closeOnScrollOut already handles the anchor-scrolled-away
case.
Regression introduced in
|
||
|
Michael Ramos
|
3f3b0f63cc |
fix: pin Bun to 1.3.11 to fix macOS binary codesign regression (Bun 1.3.12)
Bun 1.3.12 introduced a regression where cross-compiled macOS binaries lose their ad-hoc linker signature, causing macOS Sequoia to SIGKILL them immediately. Pin bun-version to 1.3.11 across all three workflow jobs (test, build, npm-publish) until the Bun issue is resolved. Fixes #541 Bumps version to 0.17.9. |
||
|
Michael Ramos
|
6677e3f280 | chore: bump version to 0.17.8 | ||
|
Michael Ramos
|
171691c197 |
fix(annotate): include original file annotations when submitting from linked doc view (#536)
* fix(annotate): include original file annotations when submitting from linked doc view When using `plannotator annotate` on a file with markdown links, annotations on the original file were silently dropped if the user clicked "Send Annotations" while viewing a linked document. The root cause was that `getDocAnnotations()` only read from `docCache` (previously-visited linked docs) and the current linked doc — it never read from `savedPlanState`, where the original file's annotations are stashed during navigation. This adds a `sourceFilePath` option to `useLinkedDoc` so the hook can key the stashed annotations in the returned Map. Also updates `docAnnotationCount` in `open()` so button visibility and exit warnings reflect reality immediately, not only after calling `back()`. Closes #535 For provenance purposes, this commit was AI assisted. * fix(annotate): include docCache in count when re-entering linked doc navigation The first branch of open() set docAnnotationCount from only the original file's annotations, ignoring any linked docs already cached from prior navigation. After original → linkedA → back → linkedB, the count dropped to 0 if the original had no annotations, hiding the Send Annotations button despite linkedA's annotations sitting in docCache. Also adds defensive spread copies for savedPlanState arrays in getDocAnnotations() to match the hook's existing pattern. For provenance purposes, this commit was AI assisted. * fix(annotate): exclude destination doc from docAnnotationCount to prevent double-counting When navigating to a previously-cached linked doc, the destination's cached annotations were included in docAnnotationCount AND loaded into allAnnotations, causing the exit warning to report an inflated count. Skip the destination filepath when summing the non-active total. For provenance purposes, this commit was AI assisted. * fix(annotate): treat backlinks to source file as back() navigation When a linked document contains a link back to the source file (e.g., original.md → design.md → backlink to original.md), opening it as a linked doc created two competing Map entries for the same filepath in getDocAnnotations(). The empty linked-doc entry overwrote the stashed annotations, silently dropping them. Now detects when the resolved destination matches sourceFilePath and routes through back() instead, which caches the current linked doc and restores the source file with its annotations intact. For provenance purposes, this commit was AI assisted. |
||
|
Michael Ramos
|
0287b96b63 |
feat(review): configurable default diff type (#531)
feat(review): configurable default diff type with first-run setup Add `defaultDiffType` as a persistent user setting (cookie + config.json) with 'unstaged' as the default, matching `git diff` semantics. A first-run setup dialog prompts users to choose their preferred default on first review session. The setting is also available in Settings > Display. Entry points (hook, opencode, pi-extension) read the config via `resolveDefaultDiffType()` instead of hardcoding. The setup dialog applies the chosen diff type to the active review immediately. P4 users are excluded from the Git-specific dialog. Based on the community contribution in #521 by Hendrik Richert. Co-authored-by: Hendrik Richert <hendrik.richert@swisscom.com> |
||
|
Vladyslav Hrabovyi
|
3b1b3317ae |
feat(review,annotate): add Close button to exit sessions without feedback (#523)
Adds a Close button to review and annotation sessions so users can exit cleanly without sending feedback or killing the agent. Works across all agent origins and includes a warning dialog when annotations would be lost. Fixes #522 Co-authored-by: gwynnnplaine <vladyslav.hrabovyii@gmail.com> |
||
|
Michael Ramos
|
062106ff90 |
fix: improve markdown rendering and bullet alignment (#530)
* fix: pin bullet markers to top of multi-line list items - Add `items-start` to list item flex container so markers align to the first line instead of centering vertically across the full item height - Use consistent bullet glyph (•) across all nesting levels - Add test fixture 10 covering all bullet/list types and inline gap cases For provenance purposes, this commit was AI assisted. * fix: improve inline markdown rendering - Add strikethrough support (~~text~~) - Fix ***bold italic*** by checking triple-asterisk before double - Nudge checkbox icons down 3px to align with text baseline For provenance purposes, this commit was AI assisted. * fix: add backslash escaping to inline markdown renderer - Add \* \_ \` \[ \~ \\ escape sequences — consume backslash and emit literal character - Add \ to nextSpecial scanner so the escape handler fires correctly mid-text For provenance purposes, this commit was AI assisted. * fix: add autolink support to inline markdown renderer - Handle <https://url> as clickable external links - Handle <email@domain.com> as mailto links - Add < to nextSpecial scanner so autolinks are detected mid-text For provenance purposes, this commit was AI assisted. * chore: remove HTML entities from test fixture Not a supported feature — matches Obsidian behavior. For provenance purposes, this commit was AI assisted. * fix: prevent empty DocBadges wrapper in sticky header row layout In row layout, check hasPreviousVersion && planDiffStats (what PlanDiffBadge actually needs) instead of onPlanDiffToggle (always truthy). Prevents an empty wrapper div that created phantom width via gap-x-3 in the sticky bar. For provenance purposes, this commit was AI assisted. |
||
|
Michael Ramos
|
bac424d056 |
chore: bump version to 0.17.7
For provenance purposes, this commit was AI assisted. |
||
|
Michael Ramos
|
93b09c7dc2 |
chore: bump version to 0.17.6
For provenance purposes, this commit was AI assisted. |
||
|
Michael Ramos
|
29fc7920f8 |
chore: bump version to 0.17.5
For provenance purposes, this commit was AI assisted. |
||
|
Michael Ramos
|
93b4a4a070 | chore: bump version to 0.17.4 | ||
|
Michael Ramos
|
70dda029be |
feat(sidebar): merge vault browser into files tab + UX polish (#526)
* fix(annotate): add missing obsidian vault endpoints to annotate servers Both the Bun and Pi annotate servers were missing the three Obsidian reference endpoints (/api/obsidian/vaults, /api/reference/obsidian/files, /api/reference/obsidian/doc), making the vault browser unavailable in annotate mode. Added the handlers to both servers. For provenance purposes, this commit was AI assisted. * feat(sidebar): merge vault browser into files tab Vault is conceptually just another directory — same tree UI, same expand/collapse, same annotation counts. Rather than maintaining a parallel tab and hook, vault now appears as a collapsible section inside the Files tab alongside any other configured directories. Changes: - Add `isVault` flag to `DirState` and `addVaultDir()` to `useFileBrowser` — fetches from the Obsidian endpoint and stamps the dir so downstream code can route to the correct API - Remove `useVaultBrowser` hook and `VaultBrowser` component entirely - Remove `"vault"` from `SidebarTab` type - Update `App.tsx`: drop all parallel vault state; wire vault into the combined file browser fetch effect; update `handleFileBrowserSelect` to pick the right URL builder based on `isVault`; update `handleOpenLinkedDoc` and annotation count derivation to cover vault dirs via the same path - Fix sticky header lane: remove the `!linkedDocHook.isActive` gate that was suppressing sticky headers for linked docs and annotate mode - Remove primary border on linked doc viewer card - Add `ObsidianIcon` (full branded logo) and `ObsidianIconRaw` (compact purple mark) to `packages/ui/components/icons/ObsidianIcons.tsx` - Display `ObsidianIconRaw` in the FileBrowser directory header for vault dirs Net: -334 lines. One Files tab handles all directory types uniformly. For provenance purposes, this commit was AI assisted. * fix(sidebar): fix stale vault dirs and unrecoverable vault load failures Three issues identified in review: 1. Switching vault paths accumulated stale sections — addVaultDir now atomically replaces all existing vault dirs instead of appending, so changing the configured vault never leaves a ghost section behind. 2. Disabling the vault left the old section visible until reload — a new clearVaultDirs() method prunes all isVault entries, called via a dedicated effect that fires whenever vaultPath becomes empty. 3. Vault load failures were unrecoverable in-session — the Retry button only called fetchAll(regularDirs). FileBrowser now accepts an onRetryVaultDir prop and routes vault dir retries to addVaultDir (which re-fetches from the Obsidian endpoint) instead of the regular-dirs-only fetchAll. For provenance purposes, this commit was AI assisted. |
||
|
Michael Ramos
|
2b4b556289 |
feat(themes): add Kanagawa Dragon, Wave, and Bones themes (#524)
* feat(themes): add Kanagawa Dragon, Wave, and Bones themes Adds all three Kanagawa variants as dark-only themes, mapped from the official Ghostty color palette to the app's CSS variable schema. For provenance purposes, this commit was AI assisted. * fix(themes): sort Kanagawa themes into alphabetical position For provenance purposes, this commit was AI assisted. * feat(themes): replace Kanagawa Bones with Kanagawa Lotus Bones is a community derivative; Lotus is the official third variant from kanagawa.nvim. Light-only theme with yellow-tan paper background mapped from the canonical lotusWhite/lotusInk palette. For provenance purposes, this commit was AI assisted. * style(themes): standardize border radius to 0.625rem Replaces the previous defaults (0.5rem, 0.75rem, 1rem) with 0.625rem across all themes. Intentionally sharp themes preserved: Doom 64 (0px), Terminal (4px), Solar Dusk (0.3rem). For provenance purposes, this commit was AI assisted. |
||
|
Michael Ramos
|
667eb12e8a |
chore: bump version to 0.17.3
For provenance purposes, this commit was AI assisted. |
||
|
Michael Ramos
|
9217297d78 |
fix(plan): hide repo/branch badges in sticky lane row layout
The sticky header lane's row-layout DocBadges was rendering repo + branch + plan-diff badges. With hasPreviousVersion true, the unwrapped flex content exceeded availableForBar, causing the inline-flex flex-wrap container to snap to max-width and wrap internally — leaving an empty rounded rectangle extending under the right-side action buttons. Gate the repo/branch block on !isRow so the sticky lane only shows the plan-diff badge. Column layout (top-of-doc card) is unchanged. For provenance purposes, this commit was AI assisted. |
||
|
Michael Ramos
|
ede9cb77d8 |
chore: bump version to 0.17.2
Includes bun.lock update for @pierre/diffs dep added in #509. For provenance purposes, this commit was AI assisted. |
||
|
Michael Ramos
|
b3fc1f724f |
fix(ui): render numerals for ordered list items (#520)
* feat(parser): detect ordered list markers and compute display indices
The block parser collapsed `*`, `-`, and `\d+.` markers into a single
`list-item` block type, discarding ordered/unordered status. Add
`ordered` + `orderedStart` to Block, capture the numeric marker in the
list regex, and introduce `computeListIndices()` — a pure helper that
walks a list group and assigns each ordered item a CommonMark-correct
display number (sequential renumbering, streak break/restart on
unordered items, deeper-level state truncation, top-level numbering
preserved across nested children).
21 new unit tests cover both the parser changes and the indexing
helper, including the tricky cases: `1./2./99.` renumbers as 1,2,3;
sub-bullets between ordered items keep the top-level streak alive;
nested ordered sublists number independently and reset between
siblings; numeric checkboxes set both `ordered` and `checked`.
For provenance purposes, this commit was AI assisted.
* feat(ui): render numerals for ordered list items
Branch the list-item marker span on `block.ordered`: render
`${index}.` (with `tabular-nums` and a 1.5rem min-width to keep
columns stable across single- and double-digit numerals) when the
source marker was numeric, otherwise fall through to the existing
`•`/`◦`/`▪` bullet symbols. Indices come from `computeListIndices()`
called once per list group; `groupBlocks` is unchanged so mixed
nested lists still share a single `data-pinpoint-group="list"`
hover wrapper and annotation anchoring is unaffected. Checkbox
items still take precedence over numerals.
Adds a real-world manual fixture (06-ordered-list-plan.md) whose
`## Verification` section exercises a 10-item ordered list, the
case that originally surfaced the bug.
For provenance purposes, this commit was AI assisted.
* fix(parser): merge consecutive blockquote lines into one block
Each `>` line was emitted as its own blockquote block, so the
renderer's `my-4` margin produced visible gaps between every line
of a multi-line quote (the parser had a literal TODO comment:
"Check if previous was blockquote, if so, merge? No, separate for
now"). Fix: append to the previous block when it's a blockquote
and the prior line wasn't blank, mirroring the list-continuation
pattern. A blank line still breaks the quote so two `>` runs
separated by a blank line stay distinct.
Adds 5 unit tests (merge, blank-line break, paragraph boundaries,
single-line) and a manual fixture (07-blockquotes.md) covering the
bug case, the blank-line-break case, sandwich-between-paragraphs,
and inline markdown across merged lines.
For provenance purposes, this commit was AI assisted.
* fix(ui): address code review — diff view, task lists, blockquote paragraphs
Three issues surfaced by PR review #520:
1. **Diff view flattened ordered lists to bullets.** PlanCleanDiffView's
SimpleBlockRenderer duplicated Viewer's list-item JSX with hardcoded
bullet symbols, so a denied+resubmitted plan with numbered steps
showed numerals in the main view but `•` in the diff view — exactly
the screen where "which step changed?" matters most. Fixed by
threading computeListIndices through MarkdownChunk and sharing the
marker rendering via a new ListMarker component used by both
renderers, which also removes the root-cause duplication.
2. **Ordered task lists dropped their numbers.** `1. [ ] step` set both
`ordered=true` and `checked=false` in the parser, but the renderer's
checkbox branch took precedence and the numeral was never shown.
GitHub renders `1. [ ]` as numeral + checkbox side by side; we now
match that by rendering both glyphs in ListMarker when an ordered
task list item appears.
3. **Multi-paragraph blockquotes collapsed.** After the blockquote-merge
fix in the previous commit, `> a\n>\n> b` produced content
`"a\n\nb"` but the renderer passed it straight to InlineMarkdown,
which renders `\n\n` as whitespace — so two quoted paragraphs
mashed into one line. Fixed by splitting blockquote content on
`/\n\n+/` in both Viewer and PlanCleanDiffView and emitting one
`<p>` child per paragraph.
Adds one unit test for the multi-paragraph blockquote content shape and
a manual fixture (08-ordered-edge-cases.md) covering ordered task lists,
multi-paragraph quotes, nested-bullet counter preservation, double-digit
alignment, and start-at-N numbering.
The fourth review comment — loose ordered lists with intervening non-list
blocks restarting numbering — is deferred. It requires parser-level
loose-list detection (CommonMark's indented-continuation rule) and the
bug only fires when users rely on lazy `1./1./1.` markers across a
break. Tracked as a follow-up.
For provenance purposes, this commit was AI assisted.
* fix(parser): don't merge blockquote lines containing block-level markers
Round-two review flagged a regression: `> 1. foo\n> 2. bar\n> 3. baz` was
merging into one blockquote whose content was `"1. foo\n2. bar\n3. baz"`.
The renderer split on `\n\n+` (paragraph breaks), found none, and emitted
a single `<p>` — so `\n` collapsed to whitespace in HTML and the user
saw `"1. foo 2. bar 3. baz"` as one run-on line. Worse than the pre-PR
behavior (which at least kept each line in its own box).
Pragmatic fix: don't merge a `>` line whose stripped content starts with
a block-level marker (`*`, `-`, `\d+.`, `#`, `` ``` ``, `>`). Those stay
as separate blockquote blocks so each marker line is visually distinct
(legible, matching pre-PR behavior for quoted lists). Wrapped prose
quotes — the original motivating case — still merge correctly because
prose lines don't start with markers.
Also check the PREVIOUS block's content for markers so a trailing prose
line after a `> 1. item` doesn't glue onto the list-item block.
7 new unit tests cover: quoted ordered list stays separate, quoted
unordered list stays separate, quoted heading stays separate, quoted
code fence stays separate, nested blockquote stays separate, wrapped
prose quote still merges (regression guard), and mixed prose+list where
prose merges and list lines stay separate.
Adds tests/test-fixtures/09-quoted-list-regression.md as a manual repro.
Known follow-ups (tracked separately, not in this PR):
- Consecutive separate blockquote blocks still get individual `my-4`
margins, so a quoted list shows as stacked boxes with gaps between
lines. The proper fix is recursive blockquote parsing (render the
content as its own Block[] tree with an actual nested list inside
the quote). Deferred — requires `children?: Block[]` on Block,
parser rework, and exportAnnotations traversal changes.
- Clean diff view renumbers ordered lists from the start of each diff
chunk when users rely on CommonMark's lazy `1./1./1.` markers. Same
power-user population as the earlier deferred loose-list case.
- Pure code-hygiene items from the second review (non-list-block
handling in computeListIndices, BULLET_BY_LEVEL modulo cycle,
<ListGroup> extraction, CLAUDE.md Block interface drift,
splitBlockquoteParagraphs helper) — batch into a follow-up cleanup.
For provenance purposes, this commit was AI assisted.
|
||
|
Michael Ramos
|
c342ffbed7 |
feat(plan): simplify share/copy + sticky header polish (#519)
* refactor(ui): simplify Quick Share/Copy to Share/Copy Rename "Quick Copy"/"Quick Share" buttons in AnnotationPanel to plain "Copy"/"Share" and route Share through the existing ExportModal so it benefits from the short-link path for large payloads. The naive clipboard.writeText fallback is gone. For provenance purposes, this commit was AI assisted. * feat(plan): coordinated sticky header label shrinking Replace fixed pixel reserves in the sticky ghost header with measured geometry: a ResizeObserver on the wrapper plus one on the Viewer's action button cluster (tagged with data-sticky-actions) computes the exact space available for the toolstrip + badges. Both sides shrink in coordination so they stay horizontally aligned as long as possible: plan area | right side | ghost bar | layout >= 800 | full labels | active labels | shared lane 680..800 | short labels | active labels | shared lane 500..680 | icons only | active labels | shared lane 340..500 | icons only | icon-only | shared lane < 340 | icons only | icon-only | stacked The label-mode bucket lives in App.tsx state so the tree re-renders at most twice per drag instead of every pixel. Sticky lane measurements snap to a 16px grid for the same reason. Switches the IntersectionObserver scroll root from <main> to the OverlayScrollArea viewport (via useScrollViewport) so the ghost bar actually appears at the right scroll position. AttachmentsButton's "Images" label now also collapses with the cluster. For provenance purposes, this commit was AI assisted. * fix(plan): float collapsed sidebar rail over the grid background Absolutely position the SidebarTabs rail and reclaim its 30px gutter with left padding on the OverlayScrollArea, so the bg-grid pattern paints edge-to-edge under the flags instead of starting to their right. The plan card lands in exactly the same place as before. For provenance purposes, this commit was AI assisted. * fix(plan): address PR review — mobile share, a11y, snap hoist - AnnotationPanel mobile Share was opening ExportModal (z-50) underneath the panel (z-[60]) and its backdrop (z-[59]), creating a dead-end on mobile. Close the panel before opening the share modal. - AttachmentsButton trigger had no accessible name when hideLabel was active and there were no images yet. Add aria-label + title. - Hoist StickyHeaderLane's snap() to module scope so the effects (which use [] deps) can't close over a stale per-render instance. Currently harmless since snap is pure, but removes a footgun. For provenance purposes, this commit was AI assisted. * fix(plan): address PR review round 2 - StickyHeaderLane's [data-sticky-actions] ResizeObserver had [] deps and was attached at mount, but Viewer is keyed by linkedDocHook state and remounts on linked-doc toggle. The observer would stay bound to the now-detached old node and freeze actionsWidth, leaving the bar's geometry permanently wrong. Add a remountToken prop threaded from App.tsx so the effect re-queries against the fresh DOM. - Restore the shareUrl gate on the AnnotationPanel Share action — only pass onShare when a URL has been generated, matching prior behavior. - Hoist StickyHeaderLane's layout constants (LEFT_OFFSET, GAP, WIDE_BAR_WIDTH, MIN_BAR_WIDTH) to module scope alongside snap, for consistency. For provenance purposes, this commit was AI assisted. * fix(plan): address PR review round 3 — polish glitches - snap() uses Math.floor instead of Math.round so the wrapper width undershoots and the actions width overshoots, both pushing toward a more cautious layout. Avoids a one-bucket overlap flash right at the 300/460 thresholds during a slow drag. - Reset actionsWidth to 0 at the top of the [remountToken] effect so the bar falls back to the safe unmeasured path for the one frame between Viewer remounting and the new observer's first callback. - App.tsx switches to useLayoutEffect + a synchronous getBoundingClientRect to set the initial actionsLabelMode bucket before paint. Eliminates the one-frame flash of full labels on narrow viewports during first render. For provenance purposes, this commit was AI assisted. |
||
|
Michael Ramos
|
ed254cf3bd |
Supply-chain hardening: version pinning, SLSA attestations, fix #506 (#512)
* feat(install): supply-chain hardening (#507) + fix Gemini crash on Windows (#506) Closes #507 items 1-2 and fixes #506. Issue #507 asked for version-pinned installs from a trusted source, immutable releases, and build-provenance attestations. This commit ships: - `--version v0.X.Y` / positional / `-Version` flag across all three installers (bash, PowerShell, cmd) so users can pin to reviewed versions. Default stays `latest` — every existing `curl | bash` / `irm | iex` invocation works unchanged. install.cmd gained `--version` as an alias to its existing positional form for surface-area consistency. - SLSA build provenance attestations via `actions/attest-build-provenance` (SHA-pinned to v4.1.0) in release.yml. Covers all 10 compiled binaries (5 plannotator + 5 paste-service). Top-level workflow permissions tightened from `contents: write` to `contents: read`, with per-job overrides where needed. Attestation step is gated on tag pushes so PR dry-runs don't pollute Sigstore's transparency log. - Opt-in provenance verification in all three installers, resolved via a three-layer precedence ladder: 1. CLI flag `--verify-attestation` / `-VerifyAttestation` 2. Env var `PLANNOTATOR_VERIFY_ATTESTATION=1` 3. Config `~/.plannotator/config.json` → `verifyAttestation: true` 4. Default off Off-by-default matches every major ecosystem installer (rustup, brew, bun, deno, helm) and avoids a UX failure for the majority of users who don't have `gh` installed or authenticated. Security-conscious users get three ergonomic opt-in paths. When enabled, the installer hard-fails if `gh` is missing so opt-in is never silently skipped. - `PlannotatorConfig.verifyAttestation?: boolean` added to `packages/shared/config.ts`. Pure additive schema change; no runtime consumer exists (the field is read only by the install scripts). No UI surface — this is an OS-level power-user knob only. - Documentation rewritten in README.md, apps/hook/README.md, and the marketing install page with both pinned-version examples and a "Verifying your install" section covering manual `gh attestation verify` and offline `cosign verify-blob` paths. - Release skill updated to note that the release pipeline now emits SLSA attestations and (post-merge) GitHub Immutable Releases will be enabled on the repo. Issue #506 (install.cmd crash on Windows when Gemini is present): Root cause was cmd.exe's `setlocal enabledelayedexpansion` eating `!` chars in the embedded `node -e "..."` Gemini settings merge script. Cmd's Phase 2 parser treated `!s.hooks)s.hooks={};if(!` as a variable expansion, corrupting the JS before node saw it. Fixed by rewriting the JS to use the `||` idiom (`s.hooks = s.hooks || {}`) which contains no `!` characters — semantically identical, and sidesteps cmd's parser entirely with no escape gymnastics and no new dependencies. Added regression test in scripts/install.test.ts that asserts the `||` form is present and `if(!s.hooks)` is absent, so re-introducing the bug would fail CI. Test suite expanded from 23 to 29 tests covering: - Gemini #506 regression - Three-layer opt-in wiring assertions for all three installers - install.sh guard check (the executable `gh attestation verify` call must live behind the `verify_attestation -eq 1` gate, so the default path never invokes gh) - PlannotatorConfig schema assertion Out of scope (tracked): - Immutable Releases toggle in repo Settings (one-click, post-merge). - SLSA Build L3 via `slsa-framework/slsa-github-generator` (requires restructuring release.yml around a reusable workflow). - Issue #507 item 3: UI update-cooldown setting. For provenance purposes, this commit was AI assisted. * fix(install): address PR #512 review feedback - docs: drop broken `cosign verify-blob` example. Verified against Sigstore's docs that `cosign verify-blob` requires `--bundle` (or `--signature` + `--certificate`); the shipped command provided neither and could not have worked. Replaced with the canonical `gh attestation verify --repo` flow (gh + auth required, but optional — only needed if a user wants to manually audit provenance) and a link to GitHub's offline-verification docs for advanced workflows. Applied to README.md, apps/hook/README.md, and the marketing install page. - docs: list per-platform binary paths in the manual verification examples. The previous snippets hardcoded `~/.local/bin/plannotator` even though install.ps1 writes to `%LOCALAPPDATA%\plannotator\` and install.cmd writes to `%USERPROFILE%\.local\bin\` — Windows users copying the snippet got file-not-found instead of a verification result. - install.sh: capture and surface `gh attestation verify` stderr on failure instead of redirecting to /dev/null. Diagnosability matches install.ps1, which already prints `$verifyOutput` on failure. The most common failure mode (`gh auth login` not run) is now immediately actionable instead of presenting as a generic "verification failed" error. - install.cmd: reject any unknown dash-prefixed token before the positional fall-through. A typoed `--verify-attesttion` no longer becomes `VERSION=--verify-attesttion` and 404s on a nonsensical download URL — it fails fast with `Unknown option:` and a usage hint. install.sh and install.ps1 already had equivalent guards (case `-*)` arm and PowerShell's strict param block respectively). All 29 install tests still pass. For provenance purposes, this commit was AI assisted. * test(ci): add Windows integration job for install.cmd Address the reviewer gap flagged in PR #512: the unit tests in scripts/install.test.ts only do file-content string matching on Linux and never execute cmd.exe, so the #506 fix (rewriting the embedded `node -e` Gemini merge to use `x = x || {}` instead of `if(!x)x=...`) was shipped without any runtime coverage. The previous CI only had ubuntu-latest runners. New `install-cmd-windows` job on `windows-latest`: 1. Seeds a fake `~/.gemini/settings.json` with a pre-existing non- plannotator hook plus unrelated top-level keys (theme, general). The fixture mirrors the shape of a real Gemini settings.json but uses only obviously-fake values and contains no secrets. 2. Runs `scripts\install.cmd v0.17.1 --skip-attestation` end-to-end through real cmd.exe. This exercises the parser under `enabledelayedexpansion`, the embedded `node -e` merge script, and the full install flow. 3. Parses the post-install settings.json with PowerShell and asserts: - The plannotator hook was added to hooks.BeforeTool. - The pre-existing fixture hook is still present (regression guard for the original #506 bug, where cmd ate the `!` in `if(!s.hooks.BeforeTool)s.hooks.BeforeTool=[]` and wiped existing arrays). - Unrelated top-level keys (`theme`, `general.ciFixtureSentinel`) survived the merge untouched. 4. Separately exercises the new unknown-flag rejection added in the previous commit: invokes `install.cmd --verify-attesttion` (typo) via Start-Process and asserts exit code != 0. Before the review fix this would have silently set `VERSION=--verify-attesttion` and 404'd on the download. The job runs in parallel with the existing ubuntu `test` job (no deps, independent runner). Uses the v0.17.1 release as the binary source — that release is pre-PR, so the test is stable against release drift and is testing install.cmd's CODE, not any specific binary. This closes the CI gap where install.cmd had effectively zero runtime coverage and the original #506 bug could have recurred without anyone noticing until a user reported it. For provenance purposes, this commit was AI assisted. * fix(install.cmd): capture gh stderr on failure (consistency with install.sh) Self-review catch: the PR #512 reviewer flagged install.sh for redirecting `gh attestation verify` output to /dev/null, which swallowed actionable error messages (auth missing, network issue, attestation not yet propagated) behind a generic "verification failed" line. I fixed install.sh in the previous review-fix commit but missed that install.cmd had the exact same pattern: gh attestation verify "!TEMP_FILE!" --repo !REPO! >/dev/null 2>&1 Same bug, same consequence, same fix. cmd doesn't have bash's `$(cmd)` or PowerShell's `& cmd 2>&1` output capture, so we redirect to a temp file and `type` it on failure, then clean up in both branches: gh attestation verify ... > "%TEMP%\gh-output.txt" 2>&1 if !ERRORLEVEL! neq 0 ( type "%TEMP%\gh-output.txt" >&2 del "%TEMP%\gh-output.txt" echo Attestation verification failed! >&2 ... ) del "%TEMP%\gh-output.txt" All three installers now surface gh's actual error message on failure, which makes the most common failure mode (`gh auth login` not run) immediately diagnosable on every platform. Note: this code path is not exercised by the new Windows CI integration job because that job passes `--skip-attestation`, and exercising the gh verify path would require an attestation for v0.17.1 to exist — which it doesn't, since v0.17.1 was released before this PR added the attestation step. The fix will first become CI-testable against the first post-merge release that carries a provenance bundle. For provenance purposes, this commit was AI assisted. * fix(install): address second review pass on PR #512 Five findings, all verified against the actual code: - **AGENTS.md env var table** (reviewer: "CLAUDE.md"; it's a symlink to AGENTS.md) was missing PLANNOTATOR_VERIFY_ATTESTATION. Added with an explicit note that it's read by the install scripts only, not the runtime binary — since every other entry in that table is a runtime env var, the distinction matters. - **install.cmd unknown-flag guard metacharacter injection.** The previous guard ran `echo %~1 | findstr /b "[-]"`, where %~1 is unquoted before the pipe. A user passing `install.cmd "--bad&calc"` would have cmd expand %~1 to `--bad&calc`, see the `&` as a command separator, and execute `calc` as a side effect before the flag check. Not a remote exploit (user already has shell exec), but a defensive coding weakness in supply-chain hardening code. Replaced with a variable-assigned substring test using delayed expansion — `set "CURRENT_ARG=%~1"` preserves metacharacters literally inside the `"..."` set syntax, and `!CURRENT_ARG:~0,1!` extracts the first char without any subprocess. This also fixes the same bug in the error-message echo, which previously echoed the unquoted `%~1` and re-triggered metacharacter interpretation in the error path itself. The echo now uses `"%~1"`. Note: the reviewer's proposed one-liner `if "%~1:~0,1%"=="-"` was syntactically invalid — cmd's `:~start,length` substring modifier does not work on positional parameters, only on regular variables. A variable assignment is necessary. - **install.cmd unquoted --repo argument** in the `gh attestation verify` call. TEMP_FILE was quoted but REPO was not. REPO is hardcoded to `backnotprop/plannotator` so not exploitable, but inconsistent with install.sh (which quotes `"$REPO"`). One-char fix: `--repo "!REPO!"`. - **test.yml intentional-typo drift hazard.** The unknown-flag regression test invokes `install.cmd --verify-attesttion` (missing an `a`). The only assertion was `$p.ExitCode -eq 0`. If a future typo-sweep "fixes" the misspelling to the valid `--verify-attestation`, install.cmd would accept the flag, proceed to download the latest release, run `gh attestation verify` against it, and — because v0.17.1 pre-dates the attestation step — fail with a different non-zero exit. Both paths exit 1, so the test would silently drift from "guard works" to "gh attestation verify fails on pre-PR release" without anyone noticing. Two-part fix: 1. Explicit comment marking the misspelling as intentional ("do not correct during a typo sweep"). 2. Redirect stderr to a temp file and assert it contains "Unknown option:" — the actual discriminator between the guard triggering and any other failure mode that happens to exit non-zero. - **README.md verification block was too long** for the main README. Trimmed from ~33 lines (intro + 3 code blocks + opt-in mechanisms + precedence notes) to a single sentence that links to the canonical marketing installation docs where the full content already lived. Same treatment applied to apps/hook/README.md for consistency. The marketing docs are unchanged and remain the single source of truth for verification workflows. All 29 install tests still pass. The Windows CI integration job's new stderr assertion will exercise the harder guard on the next push. For provenance purposes, this commit was AI assisted. * fix(install): tighten attestation verify with --source-ref and --signer-workflow Addresses PR #512 review cycle 3 finding that repo-scoped verification alone doesn't bind the downloaded binary to the specific tag the user requested. A misattached release asset would pass the old check because the wrong binary would still carry a valid attestation for its own (wrong) commit. GitHub's own docs explicitly recommend both constraints: "The more precisely you specify the identity, the more control you will have over the security guarantees. Ideally, the path of the signer workflow is also validated." — https://cli.github.com/manual/gh_attestation_verify All three installers now pass: --source-ref "refs/tags/<requested-tag>" Enforces that the git ref the attestation was produced from matches the tag the installer asked for. Closes the misattached-asset gap. --signer-workflow backnotprop/plannotator/.github/workflows/release.yml Enforces that the attestation was signed by our release workflow file specifically, not any workflow in the repo. GitHub treats this flag as a regex (see cli/cli#9507) so future refactors can broaden the match without breaking version-pinned installs to historical releases. Also addresses the sibling finding that install.cmd used a fixed %TEMP%\gh-output.txt temp filename while the rest of the script uses %RANDOM% for uniqueness. Renamed to %TEMP%\plannotator-gh-%RANDOM%.txt, matching the established pattern and removing a theoretical race between concurrent invocations. New test in install.test.ts asserts all three installers pass --source-ref and --signer-workflow with the expected values. 30 tests pass. For provenance purposes, this commit was AI assisted. * fix(install): address PR #512 review cycle 4 (parser edges, ps1 stream, docs) Five findings, all verified against actual code. One bonus fix in install.sh for a sibling bug the reviewer flagged only in install.cmd. install.ps1: `Write-Host $verifyOutput` on attestation failure wrote gh's diagnostic to PowerShell's Information stream (stream 6), which is silently dropped when CI pipelines capture stderr. Replaced with `[Console]::Error.WriteLine($verifyOutput)` — direct stderr handle, matches the behavior of `echo ... >&2` in install.sh and `type ... >&2` in install.cmd. install.sh + install.cmd: `--version --some-other-flag` used to set VERSION to the flag name (e.g. VERSION=--verify-attestation), which then tried to download tag `v--verify-attestation` and 404'd. The empty-check on `$2`/`%~2` didn't catch dash-prefixed values. Added an explicit dash-prefix check that returns a clean "--version requires a tag value, got flag: X" error instead of degrading into a cryptic download failure. install.sh + install.cmd: mixing `--version v1.0.0 stray` used to silently overwrite VERSION with "stray" because the positional branch unconditionally assigned VERSION=$1. Added a VERSION_EXPLICIT sentinel that's set to 1 when --version is seen, and the positional branch now errors with "Unexpected positional argument: X (version already set)" when it sees a token while the sentinel is set. Same sentinel is also set by the positional branch itself, so passing two positional version tokens also errors out cleanly. Note: the reviewer flagged the positional-overwrite bug only in install.cmd, but install.sh had the identical issue (same unconditional `VERSION="$1"` in the `*)` arm) and the same dash- check gap in both its `--version <val>` and `--version=<val>` branches. Fixing both installers symmetrically — inconsistency here would just trigger another review round. marketing/installation.md: the "Verifying your install" prose promised a "cryptographic link to the exact commit and workflow run," but the example commands only passed `--repo`, which just proves the artifact came from some workflow in our repository. The installer now constrains with `--source-ref` and `--signer-workflow` after review cycle 3, so the docs were out of sync with the actual installer behavior. Updated all three platform examples (bash, pwsh, cmd) to include the tighter flags with a placeholder (`vX.Y.Z`) and a sentence explaining what the extra flags actually buy the user. README.md and apps/hook/README.md are already link-only after cycle 2 and don't need changes. install.test.ts: two new tests. - Regression guard asserts install.sh and install.cmd contain the VERSION_EXPLICIT sentinel, the dash-prefix error message, and the "Unexpected positional argument" guard. Anyone removing any of these in a future cleanup would fail CI. - Regression guard asserts install.ps1 uses [Console]::Error.WriteLine and does NOT use Write-Host for verifyOutput. 32 tests pass (was 30). Smoke-tested install.sh with `--version --verify-attestation` and `--version v1.0.0 stray` — both now exit 1 with clean usage errors instead of silent download failures. For provenance purposes, this commit was AI assisted. * fix(install): address PR #512 review cycle 5 Five code/doc fixes, all verified against actual code. Finding 1 from the review (opt-in verification unusable until a post-merge release is cut) is correct but not actionable — it's inherent to how SLSA attestations work and the only "fix" is timing + release cadence. install.ps1: `[Console]::Error.WriteLine($verifyOutput)` silently converted multi-line gh output to the literal string "System.Object[]" — the opposite of what cycle 4's Write-Host fix was supposed to do. `& gh ... 2>&1` captures multi-line output as an object[] array; passing the array directly to [Console]::Error.WriteLine binds to the WriteLine(object) overload and calls ToString() on the array. Fixed by piping through Out-String first (and TrimEnd to drop the trailing newline it adds). Confirmed against Sigstore/PowerShell docs and the Delft Stack array-to-string guide. install.cmd: replaced `echo !TAG! | findstr /b "v"` with a substring test `if not "!TAG:~0,1!"=="v"`. Same metacharacter-injection class as the parser bug fixed in cycle 2 — piping an unquoted expanded variable re-exposes cmd's & | > < operators in the value before the pipe runs. Inconsistent to leave this one instance using the unsafe pattern when every other comparable check in the script uses the substring idiom. install.cmd: randomized the two remaining deterministic temp file paths — %TEMP%\release.json and %TEMP%\plannotator-<tag>.exe — to match the %RANDOM% pattern already used by GH_OUTPUT. Closes two gaps at once: concurrent-invocation collisions (real for automated upgrade tooling) and same-user symlink pre-placement (the SHA256 check passes on authentic content, but a symlink at the predictable path would redirect where curl writes the binary before the install move runs). All three installers: reject --verify-attestation and --skip-attestation together as mutually exclusive instead of trying to guess which the user meant. Previously install.sh/cmd took last- on-command-line wins and install.ps1 took a fixed-priority Skip- always-wins (documented but inconsistent with the other two). No sane user passes both flags — fast-failing with a clear "mutually exclusive" error is better than silently picking one and hoping it matches intent. Guards live inline in both arms of the bash/cmd parsers and right after the PowerShell param block. test.yml: added a comment block on the install.cmd v0.17.1 pin explaining why that version was chosen, why `latest` isn't used, what the prerequisites are for bumping it, and what failure mode to expect if the pinned release is ever removed. No behavior change — the existing pin stays. Addresses the reviewer's concern that the dependency was undocumented. install.test.ts: four new regression guards. - Asserts install.ps1 uses Out-String (not bare [Console] call on raw $verifyOutput) for multi-line gh output - Asserts all three installers reject the --verify+--skip combo with a "mutually exclusive" error and install.ps1 has the `$VerifyAttestation -and $SkipAttestation` guard - Asserts install.cmd uses randomized temp paths for release.json and the binary download, and that the old deterministic paths are gone - Asserts install.cmd uses the substring test for v-prefix normalization and does not pipe echo|findstr for that check 35 install tests pass (was 32). Smoke-tested the bash mutex guard in both orders — both fail fast with "mutually exclusive" and exit 1 regardless of which flag appears first. For provenance purposes, this commit was AI assisted. * fix(install.cmd): randomize checksum temp path + tighten test assertions Self-review catch on top of the cycle 5 commit: - `%TEMP%\checksum.txt` (lines 164/172/174) was still a fixed predictable path. Same concurrency + symlink-pre-placement class as release.json and TEMP_FILE that cycle 5 fixed. Inconsistent to fix two of three and leave the third. Renamed to `%TEMP%\plannotator-checksum-%RANDOM%.txt` matching the established pattern. The reviewer didn't flag this one — I missed it during the cycle 5 sweep. - Tightened the Out-String regression test from a weak "Out-String appears somewhere in the file" check to a regex matching the specific `$verifyOutput | Out-String` wiring. Previous assertion would have passed even if some future bug accidentally wrapped the mutex-guard string literal in Out-String while leaving $verifyOutput unprotected. - Expanded the randomized-temp-paths test to cover all four curl download targets (release.json, binary, checksum sidecar, gh output capture) rather than the two originally in scope, and to assert the old fixed paths (including checksum.txt) are gone. 35 tests still pass. For provenance purposes, this commit was AI assisted. * fix(install.cmd): escape ! in Claude Code slash command files Pre-existing bug flagged in PR #512 review cycle 6. install.cmd writes the three Claude Code slash command files (plannotator-review.md, plannotator-annotate.md, plannotator-last.md) via `echo` lines inside `setlocal enabledelayedexpansion`. cmd.exe's Phase 2 parser strips unmatched `!` characters — so lines like: echo !`plannotator review $ARGUMENTS` ended up in the written file as: `plannotator review $ARGUMENTS` without the leading `!`. The `!` prefix is what tells Claude Code to execute the backtick block as a shell command; without it, Claude Code renders the line as inline markdown code and the slash command is a silent no-op. The install appeared to succeed, but every Windows cmd user got three broken slash command files. install.sh (single-quoted heredocs) and install.ps1 (single-quoted here-strings) write the `!` correctly because their respective literal-string idioms bypass shell expansion entirely. install.cmd has no single-quote-literal equivalent — its escape hatch is `^!`. The Gemini section of install.cmd (lines 482, 495) already uses `^!` correctly; the Claude Code section didn't until now. Fix: three characters — `echo !` → `echo ^!` on lines 334, 351, 368. Brings install.cmd into parity with the other two installers. No divergence introduced; existing divergence removed. Two regression guards added: - Unit test in install.test.ts asserts install.cmd contains the escaped form for all three command files and does not contain the unescaped form. - New step in the Windows CI integration job reads back each generated .md file from %USERPROFILE%\.claude\commands\ and asserts it contains the literal `!`\`plannotator` prefix. Catches the bug at the actual file-write level on a real Windows runner, not just via source-code grep. 36 install tests pass (was 35). Note: the broader architectural issue — all three installers carry hand-typed duplicates of command content that already lives at apps/hook/commands/*.md — is deferred to a follow-up issue. The cmd bug is the visibly-broken symptom; the deduplication is the long-term fix. For provenance purposes, this commit was AI assisted. * fix(install.cmd): double-caret escape for ! in slash command echoes The previous fix used `echo ^!` for the three Claude Code slash command files. The Windows CI integration job's new file-readback assertion proved this is wrong: the generated plannotator-review.md still landed with no `!` prefix, making the slash command a silent no-op as before. Root cause: cmd has two escape phases under enabledelayedexpansion. Phase 1 (parse time): `^` escapes the next char. `^!` → `!`. The caret is consumed. Phase 2 (delayed expansion): the remaining bare `!` is an unmatched variable reference and gets stripped. Single `^!` dies in Phase 2 because Phase 1 already ate the caret. Double `^^!` survives: Phase 1 reduces `^^` to `^` (leaving `^!`), Phase 2 treats the caret as an escape for `!` and emits a literal. Cycle 6's fix got the direction right but the arithmetic wrong. The new file-readback assertion in test.yml caught it on the first real CI run, which is exactly why that assertion was added. Also fixes the Gemini slash command echoes (lines 482, 495) which used the identical incorrect `^!` pattern. The review comment flagged Gemini as "correct" based on source-reading alone; there was never any CI coverage for the Gemini file contents, and the Gemini section was silently broken for the same reason. Both sections now use `^^!`. Unit test updated to assert the double-caret form on all five echo lines (three Claude Code, two Gemini) and reject both the unescaped and single-caret variants. For provenance purposes, this commit was AI assisted. * fix(install.ps1): fall back to x64 on ARM64 Windows instead of 404ing Pre-existing bug surfaced in PR #512 review cycle 7. install.ps1 detected ARM64 correctly and set $arch=arm64, constructing a URL for plannotator-win32-arm64.exe — which doesn't exist in any release. The release pipeline only builds bun-windows-x64 (release.yml line 88), so there is no native ARM64 Windows binary to download. With $ErrorActionPreference=Stop set at the top of the script, the resulting 404 on Invoke-WebRequest threw a terminating error and the install aborted with a stack trace. ARM64 Windows PowerShell users could not install plannotator at all. Meanwhile install.cmd, which hardcodes PLATFORM=win32-x64 and lets ARM64 hosts pass the arch check, silently installs the x64 binary and relies on Windows 11's x86-64 emulation layer to run it. This is accidentally the useful behavior — imperfect, but the user gets a working install instead of a hard failure. This commit brings install.ps1 into parity with install.cmd's (accidentally correct) behavior: - On 64-bit Windows, $arch is unconditionally "x64" — no more branch for arm64 that would download a nonexistent binary. - When PROCESSOR_ARCHITECTURE == ARM64, Write-Host prints a notice telling the user they're getting the x64 binary via Windows emulation so the behavior isn't silent. - 32-bit Windows still errors out (unchanged). Both Windows installer paths now produce a working install on both x64 and ARM64 hosts. No release pipeline changes. No new binaries. The test `detects ARM64 architecture` used to be a weak string- presence check that passed whether the ARM64 branch selected arm64 or x64. Rewrote it to assert the actual new contract: ARM64 is detected (for the notice), $arch is hardcoded to "x64", and the previous `{ "arm64" }` branch is gone so the regression can't silently return. Native ARM64 Windows builds tracked as a follow-up — requires verifying Bun's Windows ARM64 target support and adding bun-windows-arm64 to the release matrix. For provenance purposes, this commit was AI assisted. * fix(install): pre-flight MIN_ATTESTED_VERSION guard + placeholder docs PR #512 cycle 7 review surfaced that opt-in provenance verification was dead-on-arrival for the window between this PR merging and the first post-merge release: - The docs showed `--version v0.17.1` as the pinned example. v0.17.1 was cut before this PR added attestation generation to release.yml, so any user copy-pasting the example AND enabling verification would hit a cryptic `gh: no attestations found` error and a hard install failure. - Default installs with verification enabled (via flag, env var, or config file) resolve `latest` to v0.17.1 and hit the same failure with no user-visible pinned version to "blame." Medium fix (better error message) was dismissed as lipstick — the install still fails, just with nicer wording. This is the maximum fix that actually prevents the failure path by checking the resolved tag against a hardcoded floor BEFORE downloading. ## Changes `scripts/install.sh`: - New `MIN_ATTESTED_VERSION="v0.18.0"` constant near the top - New `version_ge` helper using `sort -V` (handles v0.9.0 vs v0.10.0) - Moved three-layer verification resolution (config → env → flag) to before the download so $verify_attestation is known in time to gate network work - New pre-flight check: if verification is requested and the resolved tag is older than MIN_ATTESTED_VERSION, fail fast with a clean message listing recovery options (pin to newer version, --skip-attestation, or unset the env var / config). No binary download, no wasted SHA256 check. - Late `gh attestation verify` block now only handles the gh call itself — resolution and pre-flight moved upstream. `scripts/install.ps1`: - New `$minAttestedVersion = "v0.18.0"` constant - Pre-flight guard in the verification branch using PowerShell's [version] class for proper numeric comparison - Same error message content as install.sh `scripts/install.cmd`: - New `set "MIN_ATTESTED_VERSION=v0.18.0"` near REPO setup - Pre-flight guard shells out to PowerShell for semver comparison — Windows 10+ ships `powershell.exe` always, so no new runtime dependency. Hand-parsing semver in cmd was tried and rejected as too fragile for prerelease tags and non-numeric components. `apps/marketing/.../installation.md`, `apps/hook/README.md`, `README.md`, `scripts/install.sh --help`: - Replaced every user-facing `v0.17.1` example with `vX.Y.Z` placeholder. The placeholder pattern already exists in the "Verifying your install" section, so this is just consistency. - install.sh --help adds a link to the releases page so users know where to find actual tag values. `.agents/skills/release/SKILL.md`: - New Phase 4 checklist step: before shipping the first attested release, verify MIN_ATTESTED_VERSION in all three installers matches the tag being cut. The constant is bumped ONCE and never again — it's a permanent floor, not a moving target. If the first post-merge release is not v0.18.0, the skill updates the constant in the same commit as the version bump so the installers served from plannotator.ai activate the new floor at the same moment the first attested release becomes fetchable. `scripts/install.test.ts`: - New test asserts all three installers hardcode MIN_ATTESTED_VERSION, use appropriate version comparison for their dialect, and contain the "predates" error message - New test asserts install.sh and --help text no longer contain `v0.17.1` as a pinned example 38 install tests pass (was 36). Smoke-tested install.sh end-to-end: - `--version v0.17.1 --verify-attestation` → pre-flight rejects cleanly, no download attempted, exit 1 with actionable error - `--version v0.18.0 --verify-attestation` → pre-flight passes, script proceeds to download (404 as expected since v0.18.0 is not yet released) - `--version v0.17.1` (no verify) → pre-flight skipped, normal download path For provenance purposes, this commit was AI assisted. * fix(install): close PS injection + move Windows pre-flight before download PR #512 review cycle 8 raised three related findings, all verified against actual code. ## Critical: PowerShell command injection in install.cmd (Finding 2) Line 228 of the previous install.cmd passed the version comparison to PowerShell by interpolating delayed-expansion variables directly into the command string between single-quoted literals: for /f "delims=" %%i in ('powershell -NoProfile -Command "try { if ([version]'!TAG_NUM!' -ge [version]'!MIN_NUM!') { 'yes' } } catch {}"') do set "VERSION_OK=%%i" The arg parser rejected leading-dash values but not quotes or semicolons, so a user passing install.cmd --version "0.18.0'; calc; '0.18.0" produced the PowerShell command try { if ([version]'0.18.0'; calc; '0.18.0' -ge [version]'0.18.0') { 'yes' } } catch {} PowerShell permits statement sequences inside `if` condition parentheses — the last value is used — so `calc` executed as a side effect during the first evaluation phase. Attacker-controlled --version from a CI/CD wrapper (PR titles, external tag sources, etc.) equals arbitrary code execution as the invoking user. Fixed by passing the version strings via environment variables ($env:TAG_NUM, $env:MIN_NUM) instead of interpolating them into the PowerShell command string. PowerShell reads $env: values as raw strings and never parses them as code. The [version] cast throws on invalid input, catch {} swallows it, VERSION_OK stays empty, and the guard rejects — safe fail with a slightly less helpful but correct error message. ## Structural: Windows pre-flight ran post-download (Findings 1 & 3) install.sh was already restructured in the previous commit to run the three-layer resolution + MIN_ATTESTED_VERSION guard BEFORE the binary download, so users hit the "predates attestation support" error without wasting bandwidth. install.ps1 and install.cmd drifted — their resolution and pre-flight blocks stayed in their original post-SHA256 positions, meaning the binary was always downloaded and SHA256-verified even when the requested tag was doomed to fail provenance verification. The "Pre-flight: reject the verification request before downloading" comments were lies copied from install.sh. This commit moves both Windows installers' resolution + pre-flight blocks upstream of the download: install.ps1: resolution + pre-flight now run immediately after `Write-Host "Installing plannotator $latestTag..."`, before $tmpFile is created or Invoke-WebRequest runs. The late gh-call block keeps only the gh attestation verify call itself. install.cmd: same restructure. The late block keeps only the where-gh check and gh invocation. The `del "!TEMP_FILE!"` calls inside the rejection branch are gone (TEMP_FILE doesn't exist yet when the guard runs). ## Tests Added two new regression guards to scripts/install.test.ts: 1. Order-aware check for all three installers: the resolution block's opening line must appear textually BEFORE the curl / Invoke-WebRequest download line. Uses indexOf to compare positions. Catches any future regression that drifts the pre-flight back after download. 2. Injection-safe pattern check for install.cmd: asserts the PowerShell command references $env:TAG_NUM / $env:MIN_NUM and does NOT interpolate !TAG_NUM! / !MIN_NUM! between single quotes in any [version] cast. 40 install tests pass (was 38). Smoke-tested install.sh with --version v0.17.1 --verify-attestation — rejects cleanly with no download, same as before. For provenance purposes, this commit was AI assisted. * fix(install): close cycle-9 gaps — CI coverage, v-strip, prerelease handling PR #512 cycle 9 review surfaced three real findings, all verified. ## Finding 1 (important): Windows CI never exercised the attestation path The Windows integration job ran `install.cmd v0.17.1 --skip-attestation`, which bypasses every bit of logic this PR shipped: three-layer opt-in resolution, MIN_ATTESTED_VERSION pre-flight, $env:-based PowerShell version comparison, and the gh attestation verify call. A runtime bug in any of those paths would not be caught by CI. `--skip-attestation` was passed intentionally because v0.17.1 predates attestation support — running without it hits the pre-flight and rejects. But that's the point: the REJECTION path is a real, valid end state we can assert against. The previous test conflated "install should succeed" with "test should pass"; the fix is to assert the correct behavior for an old version. Added a new CI step that runs `install.cmd v0.17.1 --verify-attestation` via Start-Process with stderr redirection to a temp file, then asserts: - exit code != 0 (pre-flight rejected) - stderr contains "predates" (rejection came from our guard, not some other failure mode like a network error or gh missing) This exercises on a real cmd.exe: - setlocal enabledelayedexpansion parser under the guard - three-layer resolution reaching the CLI flag layer - the :~1 substring (instead of the previous :v= global substitution) - the pre-release tag detection (negative path for stable tags) - the PowerShell shell-out with $env:TAG_NUM / $env:MIN_NUM - the [version] -ge comparison returning false - the "predates" error message block Can't test the success path (valid attested release) until the first post-merge release exists. Tracked for follow-up. ## Finding 2 (nit): !TAG:v=! is a global substitution, not anchored cmd's delayed-expansion string-substitution syntax `!VAR:str=repl!` replaces every occurrence of `str` globally. For all current semver tags (vX.Y.Z) this happens to strip exactly one `v` by coincidence. A hypothetical future tag like v1.0.0-rev2 would become 1.0.0-re2, which [System.Version] can't parse, silently misclassifying the failure as "predates attestation support" (see Finding 3). install.ps1 line 121 uses `-replace '^v', ''` which is properly regex-anchored. install.cmd had no anchored equivalent. Fixed by using `!TAG:~1!` — substring from index 1 — which drops exactly the first character. Safe because TAG is guaranteed to start with `v` by the normalization step upstream (line ~141). ## Finding 3 (nit): Pre-release tags misdiagnosed on Windows [System.Version] doesn't support semver prerelease or build-metadata suffixes (e.g. v0.18.0-rc1). It throws on any `-` in the version string. The catch blocks in both Windows installers handled the throw but surfaced wrong/confusing errors: install.sh: handles prereleases correctly via `sort -V` (POSIX version sort is semver-aware) — no issue. install.ps1: caught and printed "Could not parse version tags for provenance check" — accurate but doesn't explain WHY. install.cmd: swallowed silently, VERSION_OK stayed empty, printed "predates attestation support" — actively wrong, the problem isn't the version's age. Fixed in both Windows installers by detecting `-` in the tag BEFORE attempting the [version] cast: install.ps1: `if ($latestTag -match '-')` → dedicated error install.cmd: `if not "!TAG_NUM!"=="!TAG_NUM:-=!"` (native substitution check, no subshell, no metacharacter risk) Both emit a clear "pre-release tags aren't currently supported for provenance verification on Windows" message pointing users at --skip-attestation or a stable tag. Windows has no built-in semver comparator; adopting one would require NuGet or a custom parser. Explicit rejection with honest diagnosis is the pragmatic choice. ## Tests Three new regression guards in install.test.ts: 1. `install.cmd strips leading v via substring, not global substitution` — asserts `!TAG:~1!` is present and `!TAG:v=!` is gone. 2. `both Windows installers reject pre-release tags with a dedicated error` — asserts both scripts contain the "Pre-release tags" error message and the appropriate detection pattern for their dialect. 3. The new test.yml CI step doubles as a runtime regression guard — any break in the cmd pre-flight path that no longer matches "predates" in stderr, or returns 0, fails CI. 42 install tests pass (was 40). Windows CI will now exercise the pre-flight rejection path end-to-end for the first time. For provenance purposes, this commit was AI assisted. * fix: cycle-10 review — split attest job, assert binary preservation, misc PR #512 cycle 10 raised four findings, all verified. ## Finding 1: id-token/attestations permissions granted to build on PRs The build job in release.yml had `id-token: write` and `attestations: write` at the job level with no conditional guard. On PR triggers, those permissions were live for every build step (checkout, bun install, bun build, compile) even though the attestation step itself was gated by `if: startsWith(github.ref, 'refs/tags/')`. Narrow-but-real attack surface: a trusted contributor's malicious PR injecting code into a build step could mint an OIDC token authenticating as the repo identity. Fork PRs are automatically protected (GitHub suppresses OIDC tokens on forks), but same-repo contributor compromise is a realistic risk in a project with external contributors. Fixed by splitting attestation into its own job: build: contents: read only. Runs on all triggers. Compiles binaries and uploads them as the `binaries` artifact. No OIDC capability anywhere in the job. attest: needs: build, if: tag push only. contents: read + id-token: write + attestations: write. Downloads the binaries artifact and runs attest-build-provenance. Permissions are only live when we're actually producing an attestation — never on PR dry-runs. release: needs: attest (was: needs: build). Still tag-only. The dependency chain guarantees the attestation exists in the GitHub attestation store before the release's binaries are published, closing the race window where a user could pull the binary and gh attestation verify would fail because the bundle hadn't propagated yet. npm-publish: unchanged. Still needs: build. Still has id-token: write for `npm publish --provenance`. The reviewer flagged only the build job; npm-publish's id-token grant is scoped to that one job and is actually used by the provenance flag. ## Finding 2: CI test promised a binary-preservation check but didn't do one The `Attestation pre-flight rejects v0.17.1` step contained a multi-line comment promising to verify the rejected run didn't overwrite the previously-installed binary. No assertion code followed — just a Write-Host success line. The test claimed more than it delivered. Added actual baseline capture + comparison: - Before running the rejection test, capture the binary's SHA256 and LastWriteTime from the prior Gemini-merge step. - After the rejection, recompute both and assert they match. - Any drift throws: catches future regressions that re-introduce the post-download pre-flight pattern (the pre-flight correctly rejects but only after downloading and overwriting the file). ## Finding 3: install.ps1 dead-code comment about flag precedence Line 111 read "-SkipAttestation beats -VerifyAttestation if both passed" but the upfront mutex guard (lines 13-16) exits 1 if both flags are present. The "beats" scenario is unreachable. The comment misleads a future reader into thinking the late ordering handles the mutual exclusion and is safe to remove the early guard — which would be backwards. Replaced with a comment that explicitly notes the mutex guard at the top of the script makes the two branches mutually exclusive by construction. ## Finding 4: install.sh `cd` inside `&&` condition leaked CWD on failure The skills-install block chained `git clone ... && cd ... && git sparse-checkout set ...`. If clone succeeded but sparse-checkout failed, the short-circuit skipped the `cd -` and `rm -rf "$skills_tmp"` later ran with the shell's CWD still inside the to-be-deleted directory. On Linux/macOS this silently "works" — the inode is unlinked but the process keeps its cwd reference — so nothing visibly breaks (all downstream code uses absolute paths). But it's structurally wrong: install.ps1 and install.cmd both use Push-Location/pushd for the same logic. Restructured to run the entire clone → sparse-checkout → verify → copy sequence inside a single `(...)` subshell, with `cd`s scoped to the subshell. The parent shell's CWD is unchanged regardless of which step fails, so the subsequent `rm -rf` always runs from a stable location. Any failure in the chain short-circuits to the else branch with a clean skip message. Also merged the two `[ -d ]` / `[ ls -A ]` guards into the chain so the "apps/skills empty" case is now reported in the skip message rather than being silently suppressed. 42 install tests pass. For provenance purposes, this commit was AI assisted. * fix(install): set MIN_ATTESTED_VERSION to v0.17.2, remove skill bump note Earlier cycles hardcoded MIN_ATTESTED_VERSION="v0.18.0" across the three installers as a best-guess for the first post-merge release, and I added a one-time bump instruction to the release skill as insurance in case the guess was wrong. The guess was wrong — the next release is v0.17.2 (patch bump, not a minor bump). Updated the constant in all three installers and the matching test assertions. No other version references in the shipped error messages need changing because they read MIN_ATTESTED_VERSION from the variable at runtime. Also removed the "⚠️ One-time MIN_ATTESTED_VERSION bump" section from .agents/skills/release/SKILL.md entirely. With the constant now set to the actual next release tag, there's nothing for the release agent to bump at release time — the constant is already correct. Baking a one-time action into a recurring release skill was the wrong place for it; every future release agent would read the warning, confirm it's already set, and move on. Noise in a workflow that's supposed to be tight. If the next release version ever differs from v0.17.2 (e.g. we decide to skip to v0.18.0 or go straight to v1.0.0), the PR cutting that release will need to update MIN_ATTESTED_VERSION in the three installers. That's an ad-hoc fix, not a recurring skill concern. Smoke test with the new value: - install.sh --version v0.17.1 --verify-attestation → rejects with "first attested release is v0.17.2" - install.sh --version v0.17.2 --verify-attestation → passes pre-flight, proceeds to download (404 as expected since v0.17.2 is not yet released) 42 install tests pass. For provenance purposes, this commit was AI assisted. * feat(release): ship native ARM64 Windows binaries Bun v1.3.10 (February 2025) promoted bun-windows-arm64 from preview to a stable cross-compile target, which makes native ARM64 Windows builds a 15-line change instead of a project. Adopted immediately so ARM64 Windows users get native-speed binaries instead of the x86-64 emulation tax. Earlier cycles of this PR shipped two temporary workarounds for the absence of a native ARM64 binary: - install.ps1 detected ARM64 and fell back to $arch="x64" with a Write-Host notice that the user was running via emulation. - install.cmd hardcoded PLATFORM=win32-x64 and let ARM64 hosts pass the arch check without differentiation. Both are now obsolete and have been replaced with real architecture detection that selects the native binary. ## Changes release.yml: Added `bun-windows-arm64` to the compile matrix for both apps/hook/server/index.ts and apps/paste-service/targets/bun.ts. Output files are plannotator-win32-arm64.exe and plannotator-paste-win32-arm64.exe with matching .sha256 sidecars. Upload-artifact already globs `plannotator-*` so no change there. release.yml attest step: Added the two new ARM64 binaries to subject-path so they're covered by the SLSA build provenance attestation alongside the x64 builds. Both binaries sign with the same Sigstore bundle as the rest of the matrix. install.ps1: Restored the proper ARM64 detection that the earlier fallback replaced. On 64-bit Windows, $arch is "arm64" when PROCESSOR_ARCHITECTURE equals "ARM64", otherwise "x64". The emulation-fallback Write-Host notice is gone — users now get native binaries and don't need to be told about emulation. install.cmd: Replaced the unconditional `set "PLATFORM=win32-x64"` with a set of conditional assignments keyed off PROCESSOR_ARCHITECTURE and PROCESSOR_ARCHITEW6432 (the latter covers the edge case of a 32-bit tool launching install.cmd on an ARM64 machine via WoW64). PLATFORM is left empty if neither variable indicates AMD64 or ARM64, which triggers the "does not support 32-bit Windows" error path. The :arch_valid label and its gotos are gone — the new logic is linear and doesn't need a label. install.test.ts: Updated the install.ps1 ARM64 test to assert the native arm64 branch (no more "runs via emulation" text) and added a new install.cmd test verifying both PLATFORM branches are present. 43 install tests pass (was 42). ## CI coverage caveat windows-latest is x86-64, so the Windows integration job still exercises install.cmd against the x64 binary path. ARM64 has no CI runner coverage yet — we're shipping ARM64 binaries on trust that Bun's cross-compile produces working executables. That's the same trust we extend to linux-arm64 builds (also x-compiled from an ubuntu-latest runner). GitHub Actions does offer a windows-11-arm runner that could be added later; tracked as follow-up since it has availability and pricing implications. Closes #517. For provenance purposes, this commit was AI assisted. * fix(install.ps1): detect ARM64 host through WoW64 too, matching install.cmd Self-review catch on top of the ARM64 support commit. My install.ps1 architecture detection only checked \$env:PROCESSOR_ARCHITECTURE, which reports the architecture the CURRENT PowerShell process is running under — not the host architecture. On ARM64 Windows, a 32-bit PowerShell process (rare, but possible) would see PROCESSOR_ARCHITECTURE=X86, miss the "ARM64" branch, fall through to \$arch = "x64", and download the emulated x64 binary instead of the new native arm64 build. install.cmd already handles this correctly via PROCESSOR_ARCHITEW6432, which is set only in 32-bit WoW64 processes and holds the host architecture. install.ps1 was the odd one out. Fixed by checking PROCESSOR_ARCHITEW6432 first and falling back to PROCESSOR_ARCHITECTURE. Now both Windows installers follow the same detection logic regardless of process bitness. Also added an explicit error branch for unrecognized architectures (anything that isn't AMD64 or ARM64) instead of silently assuming x64. Test updated to assert both env vars are referenced. For provenance purposes, this commit was AI assisted. * fix(install): cycle-12 review — consistency test, dead code, finally, docs Four findings addressed. Two findings rejected. ## Finding 1 (nit): MIN_ATTESTED_VERSION triplicated without CI consistency Added a cross-file consistency test in install.test.ts that extracts the version literal from each of install.sh, install.ps1, install.cmd via regex and asserts all three match. A future bump that updates only one or two files now fails CI loudly. The per-file tests still exist (they check each file contains the current literal), but the new test catches drift where each file is internally consistent with itself but differs from the others. ## Finding 4 (nit): Write-Error + exit 1 dead code in install.ps1 Verified against the actual file: $ErrorActionPreference = "Stop" is set at line 8 and never modified. All six Write-Error sites are dead- end paths — five outside any try/catch, one inside a catch block (line 147) where Write-Error raises a new terminating error that propagates past the catch and exits the script with code 1 (PowerShell default). The `exit 1` lines that followed were never reachable. Dropped the six unreachable `exit 1` lines. Added a comment at the first occurrence explaining the Stop + Write-Error semantics so future maintainers don't re-add them. Behavior is unchanged at runtime — every error path still exits with code 1 via PowerShell's default unhandled-terminating-error handling. ## Finding 5 (nit): Pop-Location not in finally block Verified the reviewer's claim in install.ps1 lines 384-403. The skills install wraps git clone, Push-Location, and Copy-Item calls in a single try block, with Pop-Location on the success path. If Copy-Item throws under ErrorActionPreference=Stop, catch runs without popping, and the subsequent Remove-Item deletes a directory the PowerShell location stack still points into. A naive `finally { Pop-Location }` would introduce a new bug: Pop-Location throws on an empty stack, which happens when git clone silently fails and Push-Location is never reached. Used a nested-try pattern instead: try { git clone ... # native, no throw if (Test-Path "$skillsTmp\repo") { # guard against clone failure Push-Location "$skillsTmp\repo" try { ...operations... } finally { Pop-Location # always runs IF pushed } } } catch { Write-Host "Skipping..." } Traced all four failure modes: - clone fails silently → repo dir missing → skip inner block → no push, no pop → clean exit - clone succeeds → push succeeds → operations fail → finally pops → outer catch fires - clone + push + operations all succeed → finally pops cleanly - push itself throws (permissions) → outer catch fires, nothing to pop ## Finding 6 (P1): CMD/ps1 ARM64 breaks pinned pre-v0.17.2 tags The original plan was a runtime x64-fallback on 404, but the simpler product-level framing is: v0.17.2 is the first fully-supported version for pinning. Pre-v0.17.2 tags predate native ARM64 Windows (no win32-arm64 asset exists) and predate attestation support (pre-flight rejects). Users pinning to older tags are outside the supported matrix; the failure modes are explicit (404 / clean rejection), not silent corruption. Documented in the three install docs: - apps/marketing/.../installation.md: full "Supported versions" paragraph explaining the floor, what fails, and recovery paths - README.md: one-line note folded into the existing provenance sentence ("Version pinning, native ARM64 Windows, and SLSA provenance are supported from v0.17.2 onwards — see installation docs for details") - apps/hook/README.md: same tight one-liner pattern README.md and apps/hook/README.md stay bloat-free; the canonical explanation lives in the marketing docs. ## Findings rejected - **Finding 2 (P3, sort -V misorders prereleases):** plannotator doesn't ship prerelease tags. A user pinning to a hypothetical vX.Y.Z-rc1 would 404 at the download step before the sort -V misordering matters. Moot in practice. - **Finding 3 (important, sort -V is GNU-only):** FALSE POSITIVE. Tested on macOS 26.3.1 running sort 2.3-Apple (197) — both -V and --version-sort are supported and work correctly, including for prerelease suffixes. Apple forked BSD sort and added -V years ago. The reviewer's claim cites outdated reference material about historical BSD sort. 44 install tests pass (was 43). For provenance purposes, this commit was AI assisted. * test: anchor MIN_ATTESTED_VERSION consistency regexes to line start Self-review catch: the cross-file consistency test added in the prior commit matched the assignment form anywhere in each file. No current comment triggers a false positive, but a future comment like `# Example: MIN_ATTESTED_VERSION="v0.17.0"` would match first and shadow the real assignment, causing the test to report the wrong value or pass when it shouldn't. Hardened by adding /m flag and ^ anchor. The real assignments in all three installers are flush-left at the top of their files, so requiring line-start is both safe (won't reject current code) and stricter (future comments with leading whitespace or other prefixes are ignored). 44 tests still pass. For provenance purposes, this commit was AI assisted. * fix: cycle-13 review — checksum cleanup leak + Gemini CI coverage Two findings addressed. Two pre-existing findings flagged but not in scope. ## Finding 3 (nit): CHECKSUM_FILE leak on download failure install.cmd's checksum download error path deleted TEMP_FILE but omitted CHECKSUM_FILE. curl -o creates the output file before it receives data, so a network failure or HTTP error leaves a 0-byte or partial file in %TEMP% that the script never cleans up. The symmetric cleanup for TEMP_FILE elsewhere in the script makes this an accidental omission, not an intentional design choice. Added `if exist "!CHECKSUM_FILE!" del "!CHECKSUM_FILE!"` inside the error block, matching the existing cleanup discipline. ## Finding 1 (nit): Windows CI readback misses Gemini .toml files The `Verify Claude Code slash command files contain the shell- invocation prefix` step in the Windows integration job verified the three `.md` files at %USERPROFILE%\.claude\commands\ but not the two `.toml` files at %USERPROFILE%\.gemini\commands\. Both sets of files use the `^^!` cmd escape pattern that this PR added, and a future regression that drops a `^` from the Gemini echoes would slip past CI even though install.test.ts catches it statically. Extended the readback step to also verify plannotator-review.toml and plannotator-annotate.toml contain the `!{plannotator ...}` invocation form. Same regression class, same guard, same runner — the earlier Gemini-merge fixture step already seeds ~/.gemini/settings.json, which causes install.cmd's Gemini block to fire and write the .toml files alongside the Claude Code ones, so no additional setup is required. ## Findings rejected (out of scope, pre-existing) - **install.cmd vs install.ps1 install location divergence:** cmd installs to %USERPROFILE%\.local\bin while ps1 installs to %LOCALAPPDATA%\plannotator. A user who switches between the two Windows installers ends up with hooks.json pointing at one location and an orphan binary at the other. Pre-existing structural divergence, requires picking a canonical location and migrating users on whichever installer changes. Out of scope for this PR. - **install.sh Gemini merge throws on user's malformed JSON:** if ~/.gemini/settings.json is invalid JSON, the embedded `node -e` call exits non-zero, set -e propagates, and the install aborts mid-run after the binary is in place but before slash commands are written. Pre-existing — the Gemini block predates this PR. Worth a follow-up but not in scope here. 44 install tests pass. For provenance purposes, this commit was AI assisted. * docs: update stale v0.17.1 references in script comments to vX.Y.Z Two cosmetic comment fixes flagged during the cycle-13 self-review. The user-facing examples and docs were updated to vX.Y.Z in cycle 5, but two inline code comments still referenced the old concrete version: - scripts/install.sh:129 — "Positional form: install.sh v0.17.1 (matches install.cmd interface)" - scripts/install.cmd:71 — "Positional form: install.cmd v0.17.1 (legacy interface)" Both updated to vX.Y.Z so the in-code comments match the rest of the documentation. No behavior change. 44 install tests pass. For provenance purposes, this commit was AI assisted. * docs(skill): update release skill platform/binary counts for ARM64 Windows Two stale references in .agents/skills/release/SKILL.md after the ARM64 Windows binaries were added: - "5 platforms (macOS ARM64/x64, Linux x64/ARM64, Windows x64)" → "6 platforms (macOS ARM64/x64, Linux x64/ARM64, Windows x64/ARM64)" - "Compiles paste service binaries (same 5 platforms)" → "Compiles paste service binaries (same 6 platforms)" - "Generates SLSA build provenance attestations for all 10 binaries" → "Generates SLSA build provenance attestations for all 12 binaries" The first two predate this PR; the third was added in the cycle-1 commit and not bumped when the ARM64 Windows targets landed in the ARM64 commit. All three corrected together so the release agent sees an internally-consistent description of what the pipeline actually does. Verified against release.yml — 12 entries in the attest job's subject-path list, 12 compile commands in the build job, all six platforms (macOS arm64/x64, Linux x64/arm64, Windows x64/arm64) for both plannotator and paste-service. For provenance purposes, this commit was AI assisted. |
||
|
Michael Ramos
|
7e8f914904 |
feat(plan): unified header dropdown + Agent Instructions (#515)
* feat(plan): unify header settings into combined dropdown
Replace the desktop sprawl (ModeToggle, Settings button, Export
sub-dropdown) and the separate MobileMenu with a single PlanHeaderMenu
modeled on ReviewHeaderMenu — one ActionMenu rendered at all
breakpoints. Move version + release notes into the dropdown footer,
drop the origin/agent badge, and stub an "Agent Instructions" item
that copies the current plan plus an /api/external-annotations URL
for external agents (real protocol body lands in a follow-up).
Also fix the annotate-folder Send button: it was hidden whenever a
file was opened via linkedDoc, so users in `plannotator annotate ./`
couldn't submit feedback. Gate now allows linked-doc state through in
annotate mode. Settings is always mounted instead of skipping when a
linked doc is active, so the dropdown's Settings item works in every
state.
For provenance purposes, this commit was AI assisted.
* feat(plan): real Agent Instructions clipboard payload
Replace the placeholder string in handleCopyAgentInstructions with a
real, contract-accurate markdown payload that teaches an external agent
(Claude Code, Codex, custom scripts) how to:
- read the current plan via GET /api/plan
- POST single or batch annotations to /api/external-annotations
- choose COMMENT vs DELETION vs GLOBAL_COMMENT and use originalText
for inline highlighting (or skip it for sidebar-only)
- list, delete-by-id, and delete-by-source for cleanup before reposting
The payload lives in packages/ui/utils/planAgentInstructions.ts as
buildPlanAgentInstructions(origin) — a single pure function that takes
the base URL and returns the markdown. Plan and code-review modes have
different annotation shapes, so each owns its own instructions module;
the review counterpart will live alongside this file when it's added.
For provenance purposes, this commit was AI assisted.
* docs: list planAgentInstructions.ts in AGENTS.md utils enumeration
For provenance purposes, this commit was AI assisted.
* fix(plan): restore 'system' theme option in header dropdown
The unified header dropdown only exposed light/dark, dropping the
'system' (follow OS) option that the previous ModeToggle and MobileMenu
both supported. Clicking either explicit mode would silently overwrite
a prior 'system' setting. Add it back as a third segmented control,
matching the old MobileMenu's three-way layout.
For provenance purposes, this commit was AI assisted.
* refactor(ui): extract shared theme-mode icons
PlanHeaderMenu and ThemeTab each inlined their own Sun/Moon/System
SVGs (and the deleted MobileMenu had its own copy too). Pull them into
a shared icons/themeIcons.tsx module so the iconography stays consistent
across the dropdown and the settings tab. Use the cleaner Heroicons
paths from ThemeTab as the canonical art.
ReviewHeaderMenu still inlines its own copies — left alone for this PR
since the broader review/plan menu unification is a separate follow-up.
For provenance purposes, this commit was AI assisted.
* fix(plan): use ReviewAgentsIcon for Agent Instructions menu item
Reuse the magnifying-glass-with-cog icon already used for the Review
Agents tab so the same visual marker identifies agent-related affordances
across plan and review modes.
For provenance purposes, this commit was AI assisted.
* fix(plan): drop DELETION + unanchored COMMENT from agent instructions
Plannotator's existing render and export pipeline only handles two
shapes well: an anchored COMMENT with originalText, and a GLOBAL_COMMENT
with no anchor. The previous instructions also documented:
- COMMENT without originalText — sidebar shows an empty quote bubble
("") and the export header reads `Feedback on: ""`. The text survives
but the framing is broken.
- DELETION with explanatory text — the text is invisible in the sidebar
and silently dropped on export, replaced by a generic template. Real
information loss.
Rather than expand the export pipeline to honor those edge cases, narrow
the documented surface to the two shapes that work today: inline COMMENT
(requires originalText) and GLOBAL_COMMENT (no anchor). DELETION is
omitted entirely; agents that need to suggest a removal can post an
inline COMMENT pointing at the phrase.
For provenance purposes, this commit was AI assisted.
* fix(plan): clear current new-settings hints, surface pulse on menu trigger
The new-settings indicator infrastructure (hasNewSettings / version
constant / markNewSettingsSeen) stays — it's the scaffolding for future
hint flagging — but every current marker is removed:
- Drop the four inline 'new' badges in Settings.tsx (Plan Width row,
Quick Labels row, mobile + desktop tab navigators).
- Drop the dead pulse on the standalone gear button — that button now
lives inside <div className="hidden"> after the header refactor, so
the pulse was unreachable anyway.
Surface the pulse on the new PlanHeaderMenu trigger instead. App.tsx
seeds local hasNewSettingsHints state from hasNewSettings(), passes it
to the menu, and clears it (plus calls markNewSettingsSeen) when the
user opens Settings from the dropdown.
For provenance purposes, this commit was AI assisted.
* docs: list icons/ subdirectory in AGENTS.md components tree
For provenance purposes, this commit was AI assisted.
* fix(server): require originalText for plan COMMENT annotations
The plan-mode external-annotation contract documents that COMMENT
annotations must carry an originalText anchor; sidebar-only feedback
uses GLOBAL_COMMENT instead. transformPlanInput already enforced this
for DELETION but silently defaulted COMMENT's originalText to "" when
missing — producing a broken render (empty quote bubble in the sidebar,
exported as `Feedback on: ""`).
Reject COMMENT without a non-empty originalText and steer the caller
toward GLOBAL_COMMENT in the error message so the fix is self-evident
to misbehaving agents.
For provenance purposes, this commit was AI assisted.
* chore: drop dead new-hints scaffolding leftovers
After clearing the four current inline hint markers, two pieces of
support code were unreachable:
- The destructured setShowNewHints setter in Settings.tsx — the state
itself stays as a stable mount-time snapshot for any future hint
markers, but the setter has no callers. Drop it and add a comment
explaining why the useState wrapper is intentional scaffolding.
- The settings-ping keyframe in editor/index.css — only the deleted
gear-button pulse referenced it; the new pulse on PlanHeaderMenu's
trigger uses Tailwind's built-in animate-ping instead.
For provenance purposes, this commit was AI assisted.
|
||
|
Michael Ramos
|
57495ec816 |
feat: Zed-style overlay scrollbars (#509)
* feat(ui): Zed-style overlay scrollbars for plan mode
Wide, translucent, full-length overlay scrollbars replacing the 6px
WebKit rail that users couldn't reliably grab. Click the track to
page-animate toward the click, drag the thumb, no layout shift, Firefox
parity.
Wraps plan-mode scroll containers (main viewer, annotation panel,
sidebar, settings, export modal) in a new <OverlayScrollArea> component
backed by overlayscrollbars-react. The library handles pointer capture,
click-to-jump, hover reveal, auto-hide, RTL, touch, momentum, and
cross-browser consistency. ClickScrollPlugin registered explicitly so
`clickScroll: true` actually pages (otherwise it silently no-ops).
Plumbing:
- New ScrollViewportContext + useScrollViewport() hook so descendants
(TableOfContents, PinpointOverlay, Viewer sticky observer) can reach
the real scrolling element instead of document.querySelector('main'),
which no longer returns the scroll node after wrapping.
- New useOverlayViewport() hook — canonical ref+state+callback pattern
bridging the library viewport into components that need both
imperative access and effect re-runs when the viewport mounts.
- useActiveSection gains an optional scrollElement arg so its
IntersectionObserver root re-attaches when the viewport becomes
available (ref mutations don't retrigger effects).
Theme:
- New .os-theme-plannotator tokens sourced from existing theme CSS
variables (translucent muted-foreground for handle, transparent track
at rest). 10px at rest, 14px on hover. Color + width transitions
only — deliberately does not reintroduce transform/opacity in global
transitions, preserving the
|
||
|
Michael Ramos
|
1e8a60ba93 |
feat(plan): complete sticky actions — pin toolstrip + badges on scroll (#510)
* feat(plan): complete sticky actions — pin toolstrip + badges on scroll
The sticky actions setting previously only pinned the action button cluster
on the right side of the plan card. The annotation toolstrip (selection
mode + editor mode toggles) and the left-side badges (repo / branch /
plan-diff) scrolled away, forcing users to scroll back to the top of long
plans to switch modes or jump into diff view.
Adds a ghost sticky header lane that pins the toolstrip and badges on the
same horizontal plane as the already-sticky action buttons once the user
scrolls past the top of the document. Top-of-document rendering is
unchanged.
- Extract the badge cluster into a reusable `DocBadges` component with
`column` / `row` layouts so the card's absolute cluster and the ghost
bar share the same markup.
- Add a `compact` prop to `AnnotationToolstrip` that disables hover
expansion (only the active button shows its label) and hides the help
link, for use inside the ghost bar.
- Introduce `StickyHeaderLane`: a zero-height sticky wrapper with an
absolute-positioned bar that fades + slides in via IntersectionObserver
on a sentinel. Uses a 72px top rootMargin so the bar only materializes
after the real toolstrip has scrolled off.
- Hidden in plan-diff, archive, and linked-doc modes, and gated by the
existing `stickyActionsEnabled` preference.
For provenance purposes, this commit was AI assisted.
* fix(plan): mobile sticky lane, keyboard a11y, action button overlap
Iteration on the sticky header lane addressing review feedback and
in-browser testing across viewport sizes:
- Mobile (<640px): the bar now drops to its own full-width row at
top: 52px, directly below the action buttons row. Two stacked
horizontal lanes — no horizontal collision possible. The toolstrip
switches to icon-only on mobile so the diff badges fit alongside.
- sm-md (640-1023px): bar shares the top: 12px lane with action
buttons, capped at `max-w-[calc(100%-340px)]` to clear the short-
label action button cluster (Attachments + Comment + Copy ≈ 320px).
- lg+ (1024px+): same shared-lane behavior, cap raised to 400px to
clear the full-label cluster.
- Bar is `inline-flex` (content-width), not flex (full bounding-box
width), so the chrome wraps tightly to the toolstrip + badges and
doesn't extend visually past where it needs to.
- Add `inert` to the bar when not stuck — removes the hidden subtree
from the tab order entirely so keyboard users don't land on
invisible duplicate controls before reaching the real toolstrip.
- Add `iconOnly` prop to AnnotationToolstrip; passed via JS-driven
matchMedia('(max-width: 639px)') in StickyHeaderLane. Active button
expansion is preserved on sm+ so users still see the current mode
label there.
- Bump action button label breakpoint md → lg in Viewer so "Comment"
and "Copy" stay short labels until 1024px, giving the action button
cluster more breathing room on tablet/laptop widths.
For provenance purposes, this commit was AI assisted.
|
||
|
Michael Ramos
|
91f57ad7a2 |
feat(ui): highlight external SSE annotations inline on plan text (#511)
* feat(ui): highlight external SSE annotations inline on plan text External annotations posted via /api/external-annotations previously appeared in the sidebar only. They now highlight the matching `originalText` span in the rendered plan, giving tools (linters, agents) an optional way to attach feedback to specific phrases — while `GLOBAL_COMMENT` (or any annotation without `originalText`) still degrades to sidebar-only. Implementation is a new focused hook that drives the Viewer's existing imperative `applySharedAnnotations` / `removeHighlight` API, reusing the same DOM text-search path that share-URL restoration uses. No protocol change, no schema change to `transformPlanInput`, and App.tsx gains only a single hook call. The hook tracks applied ids with a type+originalText fingerprint so SSE updates correctly remove+reapply, clears its bookkeeping only on plan markdown change (where blocks re-render), and early-returns (preserving state) while diff view or a linked doc overlay is active so SSE removals arriving under those conditions still reconcile when the hook re-enables. For provenance purposes, this commit was AI assisted. * fix(ui): repaint external SSE highlights after share import, clean dead code Addresses three review findings on the external annotation highlight hook: - Share-import wipe: `importFromShareUrl` merges annotations without changing `markdown`, so our `planKey` stayed stable. The share-apply effect in App.tsx calls `clearAllHighlights()` to reset the DOM before applying imported annotations — which also wiped live external SSE highlights. The hook believed they were still painted and never re-drove them, leaving sidebar entries with no visible highlight until the next SSE event. Fix: hook now exposes a `reset()` that clears its applied-set and re-runs the main effect via a counter; App.tsx calls it right after `clearAllHighlights()` in the share-apply path. - Removed a dead `nextIds.has(a.id)` guard inside the apply timer callback. `toAdd` is computed as a subset of `eligible`, and `nextIds` was built from `eligible.map(.id)`, so the guard was vacuously always true. - Removed the stable `viewerRef` from the main effect's dep array; React ref objects have stable identity for the component's lifetime so it was noise. Added a comment noting the intentional omission. For provenance purposes, this commit was AI assisted. * docs(ui): note reset() in useExternalAnnotationHighlights header comment For provenance purposes, this commit was AI assisted. |