skills/backnotprop__plannotator
1
0
Fork 0
mirror of https://github.com/backnotprop/plannotator.git synced 2026-09-14 14:17:26 +08:00
Code Issues Packages Projects Releases Wiki Activity
513 Commits 375 Branches 154 Tags
v0.19.0
Commit Graph

277 Commits

Author SHA1 Message Date
Michael Ramos 289a2aa494 chore: bump version to 0.19.0 
Bump version across all 7 package/plugin manifests. Also refresh
AGENTS.md (new Block types from #597, Code Tour endpoints from #569),
prune removed flags from the Pi README (--plan-file, /plannotator-set-file
from #595), and pin Renovate off bun-version bumps to keep the macOS
codesign hotfix from v0.17.9 in place.

For provenance purposes, this commit was AI assisted.
 2026-04-21 19:36:02 -07:00
Michael Ramos c80ace825a fix(pi): let agent submit any markdown plan file by path (#595) 
* fix(pi): let agent submit any markdown plan file by path

Removes all configured plan-file state (module var, --plan-file flag,
/plannotator-set-file command, interactive path prompt). The agent now
writes its plan as a markdown file anywhere inside the working directory
and calls plannotator_submit_plan with the file path.

During planning, the write gate allows any .md / .mdx file inside cwd
(with traversal/absolute-escape rejection) instead of a single configured
path. plannotator_submit_plan gains a required filePath parameter, which
is validated, stat-checked, and read. Version history in ~/.plannotator
continues to key off plan content so naming is free-form without losing
version linking.

For provenance purposes, this commit was AI assisted.

* refactor(pi): drop isSubmitPathAllowed alias

isSubmitPathAllowed was a pure pass-through to isPlanWritePathAllowed
with no plausible reason to diverge. Use the write-gate helper directly
from submit_plan and drop the alias.

For provenance purposes, this commit was AI assisted.

* fix(pi): update bundled planning prompt for filePath-based submit

The shipped plannotator.json planning prompt still referenced
${planFilePath} and instructed the agent to call plannotator_submit_plan
with no arguments. After the submit tool gained a required filePath
parameter, default sessions hit the stale prompt and submits failed.
Rewritten to match the new flow: agent picks its own plan filename and
passes it to plannotator_submit_plan.

For provenance purposes, this commit was AI assisted.

* fix(pi): persist state on plan denial

Mirror the approve branches by calling persistState() before returning
on the deny path. Without this, a Pi restart between denial and the
agent's next submit would lose the lastSubmittedPath in memory, forcing
the agent to re-pick a plan file instead of resuming on the same one.

For provenance purposes, this commit was AI assisted.
 2026-04-21 17:50:16 -07:00
Eli Thompson 24a070d1cd fix(session-log): walk ancestor PIDs to resolve correct session log (#598) 
* fix(session-log): walk ancestor PIDs to find Claude Code session metadata

When plannotator is invoked from a slash command's `!` bang, the direct
parent process is an intermediate bash shell spawned by the Bash tool —
not Claude Code itself. The old resolveSessionLogByPpid() only checked
process.ppid, so it always missed the session metadata file and fell back
to mtime-based selection, which picks the wrong log when multiple sessions
exist for the same project.

New resolution ladder (four tiers):
1. Ancestor-PID walk: call `ps -o ppid=` repeatedly from process.ppid up
   to 8 hops, checking ~/.claude/sessions/<pid>.json at each hop.
   Deterministic — no guessing, matches exact session every time.
2. Cwd-scan: read every ~/.claude/sessions/*.json, filter by cwd, pick
   most recent startedAt. Handles cases where ps is unavailable.
3. CWD slug mtime (legacy): existing behavior, fragile with multiple
   sessions.
4. Ancestor directory walk: handles cd-deeper-into-subdirectory cases.

Adds getAncestorPids (injectable getParent for testing), resolveSessionLogByAncestorPids,
and resolveSessionLogByCwdScan. Exports SessionMetadata and accepts
projectsDirOverride on findSessionLogsForCwd for test isolation.

17 new tests cover: edge cases for getAncestorPids (cycles, maxHops,
self-loops), resolveSessionLogByAncestorPids (finds correct session among
multiple, skips missing logs, falls back when no metadata matches), and
resolveSessionLogByCwdScan (picks newest startedAt, ignores mismatched
cwd, handles missing sessions dir).

Closes #458

* refactor(session-log): simplify resolver and findSessionLogs for clarity

* fix(session-log): add Windows support to ancestor-PID resolver

Tier 1 used `ps`, which doesn't exist on Windows. Multiple Claude Code
sessions in the same repo remained broken on Windows because tier 2
(cwd scan) can't disambiguate when both sessions share the same cwd.

- Replace per-hop `ps` calls with a single process-table snapshot (`ps`
  on Unix, PowerShell Get-CimInstance on Windows), cached across the
  walk. One spawn instead of up to eight; faster on both platforms.
- Export pure-function parsers (parseProcessTablePs,
  parseProcessTableCsv) so the Windows path is unit-testable without
  a Windows runner.
- Normalize cwd comparison in resolveSessionLogByCwdScan: Windows is
  case-insensitive and processes may report drive letters in either
  case, so fold slashes and lowercase before comparing.

Windows viability confirmed empirically: ~/.claude/sessions/<pid>.json
exists with the expected schema on Windows 11 + Claude Code 2.1.116.

For provenance purposes, this commit was AI assisted.

---------

Co-authored-by: Michael Ramos <mdramos8@gmail.com>
 2026-04-21 16:28:38 -07:00
Michael Ramos 53d2246b16 feat: Code Tour — guided PR walkthrough as a third agent provider (#569) 
* feat(server): add Code Tour agent as third review provider

Adds a "tour" provider alongside "claude" and "codex" that generates a
guided walkthrough of a changeset from a product-minded colleague's
perspective. Reuses the entire agent-jobs infrastructure (process
lifecycle, SSE broadcasting, live logs, kill support, capability
detection) so the only new server plumbing is the prompt/schema module,
the GET endpoint for the result, and checklist persistence.

- tour-review.ts: prompt, JSON schema, Claude (stream-json) and Codex
  (file output) command builders, and parsers for both. Prompt frames
  the agent as a colleague giving a casual tour, orders stops by reading
  flow (not impact), chunks by logical change (not per-file), and writes
  QA questions a human can answer by reading code or using the product.
- review.ts: tour buildCommand with per-engine model defaults (fixes a
  bug where Codex was defaulting to "sonnet", a Claude model), an
  onJobComplete handler that parses and stores the tour, plus GET
  /api/tour/:jobId and PUT /api/tour/:jobId/checklist endpoints.
- agent-jobs.ts: tour capability detection and config threading from the
  POST body through to the provider's buildCommand.
- shared/agent-jobs.ts: engine/model fields on AgentJobInfo so the UI
  can render tour jobs with their chosen provider + model.

For provenance purposes, this commit was AI assisted.

* feat(review-editor): Code Tour dialog with animated walkthrough

Adds the tour overlay surface: a full-screen dialog with three animated
pages (Overview, Walkthrough, Checklist) that renders the CodeTourOutput
from the server-side agent. Opens automatically when a tour job completes
and can be dismissed with Escape or backdrop click.

- components/tour/TourDialog.tsx: three-page animated dialog. Intro page
  uses a composition cascade (greeting, Intent/Before/After cards with
  one-shot color-dot pulse, key takeaways table) with a pinned Start
  Tour button and a bottom fade so content scrolls cleanly under it.
  Page slides between Overview/Walkthrough/Checklist are ease-out
  springs with direction auto-derived from tab index.
- components/tour/TourStopCard.tsx: per-stop accordion using motion's
  AnimatePresence for height + opacity springs with staggered children
  for detail text and anchor blocks. Anchors lazy-mount DiffHunkPreview
  on first open to keep mount costs low. Callout labels (Important,
  Warning, Note) are deterministic typography, no emoji.
- components/tour/QAChecklist.tsx: always-open list of verification
  questions with per-item spring entrance and persistent checkbox state
  that PUTs to the server.
- hooks/useTourData.ts: fetch + checklist persistence with a dev-mode
  short-circuit when jobId === DEMO_TOUR_ID so UI iteration doesn't
  require a live agent run.
- demoTour.ts: realistic demo data (multi-stop, multiple takeaways,
  real diff hunks) for dev iteration.
- App.tsx: tour dialog state, auto-open on job completion, and a
  dev-only "Demo tour" floating button + Cmd/Ctrl+Shift+T shortcut
  guarded by import.meta.env.DEV.
- index.css: all tour animations (dialog enter/exit, page slides, stop
  reveal cascade, intro exit) with reduced-motion fallbacks. Dark-mode
  contrast tuning across structural surfaces (borders, surface tints,
  callout backgrounds) so the design works in both themes.
- package.json: adds motion@12.38.0 for spring-driven accordion physics
  and the intro composition cascade.

For provenance purposes, this commit was AI assisted.

* feat(review-editor): wire Code Tour into agent jobs UI + polish DiffHunkPreview

Connects the tour provider to the existing agent jobs sidebar and detail
panel so the user can launch a tour the same way they launch Claude or
Codex reviews. Also tightens DiffHunkPreview (used inside tour anchors)
to render correctly on first mount and handle every diff hunk shape the
agent might produce.

- ui/components/AgentsTab.tsx: tour engine (Claude/Codex) + model select
  when launching a tour job. Resets model to blank when falling back to
  Codex-only so Codex uses its own default instead of inheriting
  "sonnet" (a Claude model).
- ui/hooks/useAgentJobs.ts: forward engine/model config from the UI
  through to the POST /api/agents/jobs body so the server's tour
  provider can pick the right command shape.
- dock/panels/ReviewAgentJobDetailPanel.tsx: tour-aware detail panel.
  Replaces the "Findings" tab with a "Status" card for tour jobs and
  surfaces an "Open Tour" button that opens the dialog overlay when
  the tab is already in the dock.
- components/DiffHunkPreview.tsx: synchronous pierre theme init via a
  useState lazy initializer so the first render (inside a tooltip) is
  already themed; robust hunk parser that handles bare @@ hunks, file-
  level --- hunks, and full git diffs; "Diff not available" fallback
  for broken hunks.
- components/ReviewSidebar.tsx, dock/ReviewStateContext.tsx: small
  wiring changes to expose openTourPanel from the review state context.

Also removes two dead components (TourHeader, DiffAnchorChip) that were
superseded by the inline title bar in TourDialog and the inline
AnchorBlock in TourStopCard.

For provenance purposes, this commit was AI assisted.

* refactor(server): extract Code Tour lifecycle into shared createTourSession factory + Pi parity

The route-parity test suite requires the Pi server (apps/pi-extension/)
to expose the same routes as the Bun server (packages/server/). After
Code Tour shipped in the prior 3 commits, Pi was missing /api/tour/:jobId
(GET) and /api/tour/:jobId/checklist (PUT).

A naive mirror would duplicate ~100 lines of provider-branch logic
(buildCommand, onJobComplete, in-memory maps) into Pi's serverReview.ts,
perpetuating the existing claude/codex duplication problem. Instead,
extract the pure runtime-agnostic tour lifecycle into a
createTourSession() factory that both servers consume. Route handlers
stay per-server (different HTTP primitives) but are ~5 lines each.

Net effect: Pi port is ~25 lines instead of ~100. Future providers that
adopt the same pattern cost ~15 lines per server.

- tour-review.ts: new createTourSession() at the bottom of the module.
  Encapsulates tourResults + tourChecklists maps, buildCommand (with
  the Claude-vs-Codex model-default fix baked in), onJobComplete
  (parse/store/summarize), plus getTour/saveChecklist lookup helpers
  for route handlers.
- review.ts (Bun): tour branch in buildCommand, tour branch in
  onJobComplete, and both route handlers collapse to one-line calls
  into the factory. Drops ~70 lines.
- vendor.sh: add tour-review to the review-agent loop so Pi regenerates
  generated/tour-review.ts on every build:pi.
- serverReview.ts (Pi): import createTourSession from
  ../generated/tour-review.js; add tour branch to buildCommand (one
  line), tour branch to onJobComplete (three lines), and GET/PUT route
  handlers using Pi's json() helper. ~25 lines added.
- agent-jobs.ts (Pi): extend buildCommand interface to accept config
  and return engine/model; thread config from POST body; extend
  spawnJob to persist engine/model on AgentJobInfo; add tour to
  capability list.

Claude and Codex branches are intentionally left in the old pattern;
they can migrate to the factory approach when next touched to keep
this change's blast radius contained.

Tests: 518/518 passing (previous 3 route-parity failures resolved,
plus 2 extra assertions passing since tour is now in both servers'
route tables).

For provenance purposes, this commit was AI assisted.

* refactor(tour): self-review cleanup — Pi route match parity + remove setOpen shim

Two small cleanups surfaced by a self-review pass:

- Pi's GET /api/tour/:jobId route used `endsWith("/checklist")` to block
  the checklist sub-route, while Bun uses `includes("/", ...)`. The two
  are not equivalent: a URL like /api/tour/abc/extra would be accepted
  by Pi (jobId becomes "abc/extra") but correctly rejected by Bun.
  Align Pi to Bun's pattern.
- TourStopCard had a leftover `setOpen` shim from when open state was
  local to the card. State is now lifted to TourDialog, so the shim
  just aliases onToggle and ignores its argument. Replace with a
  direct `onClick={onToggle}` on the trigger button.

520/0 tests still pass.

For provenance purposes, this commit was AI assisted.

* feat(review): per-provider model + effort controls across all review agents

Exposes model, effort/reasoning, and fast-mode (Codex) as per-job knobs
for Claude, Codex, and Code Tour via the Agents tab. Threads the config
from the UI through the POST body into each provider's buildCommand,
which emits the corresponding CLI flags (--model/--effort for Claude;
-m / -c model_reasoning_effort / -c service_tier for Codex). Bun and Pi
servers stay in parity.

UI: option catalogs (CLAUDE_MODELS, CLAUDE_EFFORT, CODEX_MODELS,
CODEX_REASONING, TOUR_CLAUDE_MODELS) are defined once and mapped into
every dropdown so there's a single source of truth for the choices.
Tour's Claude/Codex settings are kept separate from the standalone
provider's state so toggling the tour engine no longer overwrites the
provider's last choice.

Job badge now surfaces the model/reasoning/fast selection for both Tour
and the standalone Codex provider.

For provenance purposes, this commit was AI assisted.

* docs: add Prompts reference page

Documents the three-layer structure every review call travels through
(CLI system prompt, our user message of review-prompt + user-prompt,
output schema flag), names each constant + its file, and calls out
that the Claude/Codex review prompts are the upstream ones from those
projects (only Code Tour's prompt is original to Plannotator).

Linked from the Code Review command page.

For provenance purposes, this commit was AI assisted.

* feat(review): persist per-agent, per-model settings in a single cookie

Drops the hidden "Default" options from the agent dropdowns, locks in explicit
sensible defaults (Opus 4.7/High for Claude review, gpt-5.3-codex/High for Codex,
Sonnet/Medium for Tour Claude, gpt-5.3-codex/Medium for Tour Codex), and
remembers the last-used effort/reasoning/fast-mode per (agent job × model) so
switching models reveals the choices you made last time.

Backed by a single `plannotator.agents` cookie holding the whole settings tree —
one read on mount, one mirror write per change, all mutations funnel through a
single React state owner to avoid stale-read or lost-write races across rapid
successive updates.

For provenance purposes, this commit was AI assisted.

* fix(tour): unblock reduced-motion nav + flush pending checklist save on close

Two P2 issues surfaced in review:

- Under prefers-reduced-motion, tour page animations are suppressed, so
  onAnimationEnd never fires and exitingPage stuck on 'intro' kept the
  walkthrough/checklist gated out. navigate() now swaps pages directly when
  reduced motion is on, mirroring the pattern already used in the wrapper.

- Checklist toggles are debounced 500ms before the PUT, but unmount only
  cleared the timer — checking an item and closing within the window dropped
  the save. Cleanup now flushes the pending payload with keepalive: true.

For provenance purposes, this commit was AI assisted.

* feat(review): surface Claude model + effort in job badge, trim redundant labels

Claude effort was never persisted on AgentJobInfo, so the job badge had nothing
to render beyond "Claude". Plumbs `effort` through the shared type, both
server build-command pipelines (Bun + Pi), and spawnJob, then teaches the
ProviderBadge to display Claude and Tour Claude model + effort with the same
shape Codex already had. Labels resolve via the dropdown catalogs so the
badge shows "Opus 4.7" / "High" instead of raw ids.

Server labels for both Claude and Codex reviews collapse to plain "Code Review"
(matching tour's "Code Tour"), since the badge now carries the provider +
model + settings — the title only needs to name the action.

For provenance purposes, this commit was AI assisted.

* polish(review): prefix agent dropdown options with the action name

The Run launcher listed "Claude Code", "Codex CLI", and "Code Tour" side by
side — the CLI's detection name was doing double duty as the action label.
Prefixes the review entries with "Code Review · " so scanning three options
surfaces two reviews + one tour instead of three raw provider names.

For provenance purposes, this commit was AI assisted.

* fix(review): drop invalid codex reasoning option + fail tour on empty output

Two P2 issues from PR review:

- Tour jobs exited 0 but returned null output would still be marked "done",
  and the auto-open watcher would greet the user with a 404 "Tour not found"
  dialog. onJobComplete now flips the job to failed with an error message
  when nothing was stored, so the card reflects the real state.

- The codex reasoning dropdown offered "None", but codex-rs only accepts
  minimal/low/medium/high/xhigh. Picking None sent `-c model_reasoning_effort=none`
  and launched a broken job. Removed the option; added a one-shot cookie
  migration so users who already saved "none" don't keep shipping it.

For provenance purposes, this commit was AI assisted.

* fix(tour): format Claude-engine logs + allow reading linked issues

Two P2/P3 issues from PR review:

- The stdout formatter keyed only on provider === "claude", so Code Tour
  jobs running on the Claude engine streamed raw JSONL to the log panel
  while Claude review jobs got formatted text. Widened the check to also
  catch spawnOptions.engine === "claude" and mirrored the fix into Pi.

- The tour Claude allowlist permitted PR/MR commands but not issue reads,
  yet the prompt explicitly asks the agent to open `Fixes #123` / `Closes
  owner/repo#456` targets for deeper context. Claude was being denied
  those commands mid-tour. Added gh issue view + gh api issues + glab
  issue view to the allowlist.

For provenance purposes, this commit was AI assisted.

* cleanup(review): e2e punchlist — Pi parity + dedup + tests

- Pi now logs Claude parse failures with the same diagnostic as Bun
- Tour route match uses a regex instead of an includes-offset trick
- Drop `any` cast in Pi's Codex blocking-findings predicate
- Extract `patchClaude` twin of `patchCodex` in useAgentSettings
- Factor `resolveAgentCwd` helper in Bun review to match Pi
- AgentsTab launch payload becomes a per-provider dispatch table
- Wrap TourDialog in MotionConfig reducedMotion="user" so motion.*
  children honor prefers-reduced-motion alongside the CSS keyframes
- Tests for parseTourStreamOutput/parseTourFileOutput and the Codex
  perModel sanitizer

For provenance purposes, this commit was AI assisted.

* test(tour-review): use real TourStop shape in fixtures

The parsers don't validate stop fields so the original made-up shape
passed fine, but future readers would be misled. Use the real
CodeTourOutput / TourStop / TourDiffAnchor shapes from tour-review.ts.

For provenance purposes, this commit was AI assisted.

* cleanup(tour): hoist shared types + subfolder server module + dedup

- Hoist tour output types to packages/shared/tour.ts so server and UI
  share one source of truth (prevents silent drift when schema changes).
- Move tour-review into packages/server/tour/ subfolder alongside the
  existing packages/review-editor/components/tour/ convention.
- Extend tour.buildCommand to accept tour context directly (patch,
  diffType, options, prMetadata), so Bun and Pi no longer duplicate the
  buildTourUserMessage call site. Export TOUR_EMPTY_OUTPUT_ERROR from
  the tour module to prevent string drift between servers.
- Early-return the tour branch in buildCommand so the review userMessage
  is built once on the shared non-tour path instead of unconditionally
  (dead work on tour launches) or twice (codex+claude dup).
- Regex capture group for tour checklist jobId in both servers —
  replaces a second url.pathname.split("/")[3] fragile fallback.
- Drop existsSync guard in parseTourFileOutput (TOCTOU + duplicate
  syscall); the outer try/catch already handles ENOENT.
- Dedupe two matchMedia reads in TourDialog behind a prefersReducedMotion
  helper; memoize intro-page card array so unrelated state churn doesn't
  recompute it.
- Comment hygiene on tour files — drop WHAT/change-referencing comments
  added by this PR; keep non-obvious WHY.

For provenance purposes, this commit was AI assisted.

* fix(tour): hoist introCards useMemo above early returns + subfolder hook

The memoized intro-card array was placed after the loading/error early
returns in TourDialogContent, so the first successful render called one
more hook than the initial loading render — React threw "Rendered more
hooks than during the previous render" (error #310) the moment a tour
finished loading. Move the useMemo above the early returns and use
optional chaining on `tour` so it's safe to run during loading.

Also move useTourData.ts into a hooks/tour/ subfolder to start a
standard for feature-scoped hooks (was flat among siblings).

For provenance purposes, this commit was AI assisted.
 2026-04-20 20:57:57 -07:00
Michael Ramos 3a7f1156cd chore: bump version to 0.18.0 
Also fix stale annotate description in README and add missing PLANNOTATOR_ORIGIN entry to the env vars table.

For provenance purposes, this commit was AI assisted.
 2026-04-19 17:41:53 -07:00
Alexander Kolberg 54c206c77d Add ~ support for user-entered file paths (#572) 
* refactor(path): centralize user path resolution

* fix(annotate): resolve user paths in file entrypoints

* fix(pi-extension): restore resolve import and add typecheck to CI

The refactor removed `resolve` from `node:path` imports, but `resolvePlanPath()`
and the planning-mode write/edit guards still call `resolve(...)`. That breaks
plan submission and plan-file restriction at runtime for Pi users.

Also wires pi-extension's tsconfig into the root `typecheck` script so CI
catches this class of missing-symbol regression in the future. Required
adding @mariozechner/pi-* packages as explicit devDependencies so tsc can
resolve them (they were previously only reachable transitively via the
peer dep, which Bun keeps in its `.bun/` store unhoisted).

For provenance purposes, this commit was AI assisted.

* fix(path): reject whitespace-only user paths and run vendor before typecheck

resolveUserPath() trims input, so whitespace-only customPath/vaultPath
resolved to process.cwd(). Plans silently wrote into the repo root and
Obsidian notes landed in <cwd>/plannotator/ instead of erroring.

Guard at both call sites (getPlanDir, saveToObsidian — Bun + Pi copies).

Also prepend vendor.sh to the root typecheck script so fresh-clone
`bun run typecheck` works without a separate vendoring step.

For provenance purposes, this commit was AI assisted.

* fix(path): short-circuit resolveUserPath on empty input

Trimming in normalizeUserPathInput meant whitespace-only input resolved
to cwd/baseDir. Callers like the annotate CLI and reference API endpoints
would then list the project root instead of erroring. Return "" early so
downstream existsSync/resolveMarkdownFile checks fail naturally.

For provenance purposes, this commit was AI assisted.

---------

Co-authored-by: Michael Ramos <mdramos8@gmail.com>
 2026-04-19 16:54:15 -07:00
HeikoAtGitHub 9bc1ba97d3 feat: detect OpenCode origin + activate PLANNOTATOR_ORIGIN override (#590) 
* feat: detect OpenCode origin + activate PLANNOTATOR_ORIGIN override

Extend the origin detection chain in apps/hook/server/index.ts to recognize
OpenCode via `process.env.OPENCODE`, the stable runtime flag set by the
OpenCode binary (also sets OPENCODE_RUN_ID, OPENCODE_PID, OPENCODE_PROCESS_ROLE,
but OPENCODE=1 is the canonical detection flag).

Additionally, activate `PLANNOTATOR_ORIGIN` as an explicit override. The
comment in packages/server/index.ts already documented this variable, but
it was never actually read. It is now honored at the top of the detection
chain and validated against AGENT_CONFIG so only known origins take effect
— invalid values fall through to env-based detection.

Priority order after this change:
  PLANNOTATOR_ORIGIN > Codex > Copilot CLI > OpenCode > Claude Code (default)

Single-point fix: all five existing `detectedOrigin` usages (lines 405,
568, 694, 741, 999) pick up the new chain automatically. The `'opencode'`
origin key is already defined in packages/shared/agents.ts (AGENT_CONFIG),
complete with a UI badge — the detection chain was the last missing piece.

Closes the gap noted in packages/shared/agents.ts header comment:
"If detection is via environment variable, add it to the detection chain
in apps/hook/server/index.ts (detectedOrigin constant)".

* fix: remove stray project argument from getServerConfig calls

getServerConfig only accepts gitUser — the project argument was silently
ignored at runtime but fails the typecheck. Reverts the two call sites to
their correct single-argument form.

For provenance purposes, this commit was AI assisted.

---------

Co-authored-by: Michael Ramos <mdramos8@gmail.com>
 2026-04-19 15:56:25 -07:00
dgrissen2 8a4ef65553 Add annotate wide mode (#578) 
* Add annotate wide mode

* Extend wide mode: add Focus variant, enable in all modes, reposition controls

- Drop annotate-only gate in canUseAnnotateWideMode; available in plan review, annotate, and linked-doc flows (archive/diff still excluded)
- Add Focus mode alongside Wide: both collapse sidebars and suppress annotation panel auto-open; only Wide removes the reader width cap
- Move controls out of AnnotationToolstrip/StickyHeaderLane; render as absolute-positioned "Wide | Focus" text buttons floating above the plan card's top-right edge (no vertical space cost)
- Add Radix-based Tooltip primitive (packages/ui/components/Tooltip.tsx) and TooltipProvider; replaces the ad-hoc CSS tooltip with portaled, accessible, animated content
- Polish: tracking-wide for 11px labels, focus-visible ring, active press state, aria-pressed, weight-stable toggle (color-only), 60px right offset under tater mode

For provenance purposes, this commit was AI assisted.

* Update wideMode test to cover both annotate and plan review modes

The annotateMode gate was removed — update the test matrix to assert
wide mode is enabled in annotate AND plan review, and disabled for
archive/diff across both mode values.

For provenance purposes, this commit was AI assisted.

* Drop unused annotateMode parameter from canUseAnnotateWideMode

The parameter was ignored after the annotate-only gate was removed.
Prune it from the signature, the App.tsx call site and deps, and the
test matrix to match the actual behavior (disabled only for archive
and diff).

For provenance purposes, this commit was AI assisted.

---------

Co-authored-by: Michael Ramos <mdramos8@gmail.com>
 2026-04-18 23:21:05 -07:00
Michael Ramos 615cc59c38 Prevent model from auto-invoking plannotator slash commands (#586) 
Add `disable-model-invocation: true` frontmatter so these user-driven
commands (which open browser UIs and require human interaction) can
only be triggered explicitly by the user, not picked up automatically
by the model.
 2026-04-18 20:44:25 -07:00
Michael Ramos ea758f9978 Add configurable paste service URL for self-hosting (#582) 
* Wire PLANNOTATOR_PASTE_URL through opencode/pi servers and Landing demo link

OpenCode plugin only read PLANNOTATOR_SHARE_URL; add a getPasteApiUrl helper
and thread it into plan/annotate/archive server starts. Pi extension's
serverReview gains the same shareBaseUrl/pasteApiUrl env-var pair already
used by serverPlan/serverAnnotate. Landing.tsx now accepts a shareBaseUrl
prop for self-hosters' demo link. Paste-service CORS defaults grow a
comment clarifying that self-hosters must override ALLOWED_ORIGINS.

* Embed custom paste origin in short URL fragment

When PLANNOTATOR_PASTE_URL is set to a non-default paste service, the
generated short link now includes a base64url-encoded paste param in the
fragment (#key=...&paste=...). The share portal and importFromShareUrl
extract it on load so they can fetch from the right paste backend without
needing a server — fixing broken short links for self-hosters who use a
custom paste service but keep the hosted share portal.

Backward compatible: links without a paste param continue to use the
default or server-provided paste API URL as before.

For provenance purposes, this commit was AI assisted.

---------

Co-authored-by: Claude <noreply@anthropic.com>
 2026-04-17 22:21:49 -07:00
Александар Симић 0fe6c86333 Fix for RSS feed (#573) 
Advertise the blog feed in the shared marketing layout
so feed readers and browsers can discover it automatically.
 2026-04-16 07:53:50 -07:00
Andrei Neculau a8dc9e8f4b don't change current agent (#564) 
agent_cycle is not the correct command as the user may have several agents defined, not only build and plan
 2026-04-15 16:40:06 -07:00
Michael Ramos 32d78a4c8c docs(marketing): add parameter placeholder to /plannotator-review command 
For provenance purposes, this commit was AI assisted.
 2026-04-15 15:20:47 -07:00
Michael Ramos 96eab3a9c3 docs(marketing): update review command description to mention GitHub and GitLab PRs 
For provenance purposes, this commit was AI assisted.
 2026-04-15 15:18:31 -07:00
Michael Ramos 51d49a5c87 docs(marketing): replace html with spec/plan in annotate description 
For provenance purposes, this commit was AI assisted.
 2026-04-15 15:15:20 -07:00
Michael Ramos 6072f93c9e docs(marketing): use folder in annotate description, keep dir in param placeholder 
For provenance purposes, this commit was AI assisted.
 2026-04-15 15:13:11 -07:00
Michael Ramos 5ac9987e6a docs(marketing): apply shimmer animation to Plan review cap item 
For provenance purposes, this commit was AI assisted.
 2026-04-15 15:11:09 -07:00
Michael Ramos afd57e486f docs(marketing): rename folder to dir in annotate command 
For provenance purposes, this commit was AI assisted.
 2026-04-15 15:09:28 -07:00
Michael Ramos 7fb147403e docs(marketing): add parameter placeholder to /plannotator-annotate command 
For provenance purposes, this commit was AI assisted.
 2026-04-15 15:07:27 -07:00
Michael Ramos 2fbf180aac docs(marketing): add folder to annotate command description 
For provenance purposes, this commit was AI assisted.
 2026-04-15 15:07:14 -07:00
Michael Ramos 23aa6d456c docs(marketing): replace em dash with colon in plan review description 
For provenance purposes, this commit was AI assisted.
 2026-04-15 15:06:31 -07:00
Michael Ramos 901e92e188 docs(marketing): move /plannotator-review below annotate and last in capabilities 
For provenance purposes, this commit was AI assisted.
 2026-04-15 15:04:25 -07:00
Michael Ramos 9eb07e2985 docs(marketing): update annotate command description to include html and URL 
For provenance purposes, this commit was AI assisted.
 2026-04-15 15:03:57 -07:00
Michael Ramos e966db5188 docs(privacy): clarify decryption key is not stored for shared plans 
For provenance purposes, this commit was AI assisted.
 2026-04-15 14:50:08 -07:00
Michael Ramos f1fc0cb55c feat(marketing): add privacy policy page and footer link 
For provenance purposes, this commit was AI assisted.
 2026-04-15 14:46:35 -07:00
Orestis Ioannou 14bff361f8 fix(opencode): reuse local server for review flows (#567) 
* fix(opencode): reuse local server for review flows

Try the default local OpenCode server before spawning a new one, and resolve bundled assets and command paths correctly when the plugin is loaded from source during local testing.

* Fix typecheck after narrowing the opencode type to the sdk
 2026-04-15 08:22:55 -07:00
Michael Ramos 4139999526 feat(plan-diff): word-level inline diff rendering (#565) 
* feat(plan-diff): word-level inline diff rendering

Two-pass hierarchical diff (diffLines outer + diffWordsWithSpace inner)
so modified plan blocks render with inline insertions/deletions in
context instead of showing the whole old block struck-through above the
whole new block. Resolves #560.

Engine (packages/ui/utils/planDiffEngine.ts):
- computeInlineDiff runs a second-pass word diff on modified blocks
  that pass a whitelist gate (paragraph/heading/list-item with matching
  structural fields).
- Sentinel substitution atomizes inline-code spans, markdown links, and
  fenced code blocks before diffWordsWithSpace runs, so diff markers
  never land inside backticks, link hrefs, or across fence boundaries.
  Fence regex uses a backreference so variable-length (e.g., 4-backtick
  wrapping 3-backtick) fences are matched atomically.
- Annotation context for an inline-diffed modified block now captures
  both old and new content so comments on struck-through words preserve
  that text in the exported feedback.

Renderer (packages/ui/components/plan-diff/PlanCleanDiffView.tsx):
- New InlineModifiedBlock component renders a modified block as one
  structural wrapper with <ins>/<del> wrappers inside, parsed through
  the local InlineMarkdown in a single pass so markdown delimiter pairs
  survive across token boundaries.
- InlineMarkdown extended to recognize <ins>/<del> tag passthrough
  (with recursive parsing of the wrapped content) and to recursively
  parse link anchor text so diff markers inside links render correctly.
- Plain-text stop-char scanner includes '<' so <ins>/<del> dispatch
  re-enters the loop instead of swallowing tag text.
- Click-to-annotate works in every editor mode (not just comment), with
  the block-level onClick opening the popover directly.

Mode switcher (packages/ui/components/plan-diff/PlanDiffModeSwitcher.tsx):
- Adds a third "Classic" tab between Rendered and Raw. Rendered is the
  new word-level default (labeled "exp"); Classic forces the legacy
  block-level stacked fallback for every modified block.

Styling (packages/ui/theme.css, packages/editor/index.css):
- plan-diff-word-added / plan-diff-word-removed utility classes for
  inline highlights with box-decoration-break: clone across line wraps.
- Inline <code> inside the diff wrappers picks up a tinted background
  so code-pill changes read unambiguously green/red.
- New plan-diff-modified class (amber border) for inline-diff modified
  blocks, matching the GitHub/VSCode convention of green=add,
  red=remove, yellow=both.

Tests (packages/ui/utils/planDiffEngine.test.ts):
- 18 tests covering the engine's qualification gate, structural-field
  matching, sentinel round-trip (inline code / links / fences), token
  content for common edit patterns.

For provenance purposes, this commit was AI assisted.

* chore(demo): restructure default demo, add VITE_DIFF_DEMO stress test

Demo content changes that support the word-level diff work but do not
alter shipped app behavior — only what other devs see running dev:hook.

packages/editor/demoPlan.ts (default V3 editor content):
- Added a "Context" section at the top of the plan with prose that
  showcases the word-level engine in V2→V3 diff: bold phrase swap,
  inline-code pill swaps, a link URL change, and a single-line code
  edit inside a config block.
- Moved the mermaid architecture diagram and graphviz service map to
  an "Appendix: Diagrams" section at the end of the plan; they were
  rendering ugly mid-document.

apps/hook/dev-mock-api.ts (Vite mock for the diff API):
- PLAN_V1 / PLAN_V2 split into *_DEFAULT (original Real-time
  Collaboration plan — preserved identically from pre-branch state) and
  *_DIFF_TEST (the 20-case Auth Service Refactor diff-engine stress
  test, kept as an opt-in tool).
- Resolves which pair to serve based on VITE_DIFF_DEMO env var. Matches
  the V2 Context section to the new V3 Context, with differences that
  produce rich word-level inline diffs on first load.
- Diagrams moved to Appendix in V2_DEFAULT to match V3.

packages/editor/App.tsx:
- Both demo imports are active. VITE_DIFF_DEMO=1 swaps
  DIFF_DEMO_PLAN_CONTENT into the editor's default; unset renders the
  original Real-time Collaboration plan as before.

packages/editor/demoPlanDiffDemo.ts (new):
- 20-case stress test (paragraphs, headings, lists, tables, fences,
  blockquotes, known limitations). Each case has an identical
  "What to watch for" blockquote label in both V2 and V3 so the diff
  view cleanly isolates each case. Opt-in only.

.gitignore:
- Ignore .claude/ runtime lock/state files. Machine-specific content
  that should not be tracked.

For provenance purposes, this commit was AI assisted.

* style(plan-diff): refine modified-block visual — amber gutter, no fill

Drop the yellow background fill from .plan-diff-modified and keep only a
softened amber left border. Added/removed blocks remain loud (full fill +
strong border) because add/remove are block-scope events — the whole
block matters. Modify is a word-scope event — the individual changed
words carry loud inline red/green highlights, and a block-level fill
would compete with that inline work. The amber gutter at 75% opacity now
reads as a quiet "look inside, the change is in the text" marker that
sits coherently with the rest of the palette.

For provenance purposes, this commit was AI assisted.

* fix(plan-diff): sanitize link hrefs against javascript: / data: schemes

PlanCleanDiffView has its own local copy of InlineMarkdown (separate
from the one in Viewer.tsx). The link-rendering branch was passing the
captured URL directly to href with no validation, so a plan containing
  [click me](javascript:alert(document.cookie))
would render as a live clickable anchor in the diff view. Plan content
is attacker-influenced — Claude pulls from source comments, READMEs,
fetched URLs — so this is a real exploit path in the diff flow.

Port the same guard Viewer.tsx already has: sanitizeLinkUrl() rejects
javascript:, data:, vbscript:, and file: schemes (case-insensitive, with
optional leading whitespace). Rejected links render their anchor text as
plain text instead of a clickable <a>, so the content is still visible
to the reader but no longer dangerous.

For provenance purposes, this commit was AI assisted.
 2026-04-14 18:43:38 -07:00
Michael Ramos e22c911c2c chore: bump version to 0.17.10 
For provenance purposes, this commit was AI assisted.
 2026-04-13 08:02:26 -07:00
David han (Bart) c2dadc9717 Bind local Plannotator servers to loopback by default (#533) 
* Harden review agent job launch endpoints

* Stabilize agent job auth tests

* Drop review agent job token gating

* Align useAgentJobs with upstream formatting

* Allow remote sessions to bind all interfaces
 2026-04-13 07:00:05 -07:00
Michael Ramos e410ac2568 docs(annotate): add URL/HTML docs, blog post, and env var references (#553) 
- Rewrote the annotate command docs page to cover all four input types
  (URLs, HTML files, folders, markdown) with Jina Reader pipeline details,
  --no-jina flag, JINA_API_KEY, and source badge
- Added PLANNOTATOR_JINA and JINA_API_KEY to the environment variables
  reference page
- New blog post: "Annotate Any Web Page or HTML File" with embedded video

For provenance purposes, this commit was AI assisted.
 2026-04-12 21:46:52 -07:00
Michael Ramos b780739291 feat(annotate): support HTML files and URL annotation (#545) 
* fix(annotate): sanitize dangerous link protocols in markdown renderer

Block javascript:, data:, and vbscript: URLs in InlineMarkdown link
rendering. Links with dangerous protocols render as plain text instead
of clickable anchors. Uses a blocklist approach so existing links with
custom protocols (obsidian://, vscode://, Windows C:\ paths) continue
to work.

For provenance purposes, this commit was AI assisted.

* feat(annotate): add HTML-to-markdown and URL-to-markdown utilities

- html-to-markdown.ts: Turndown wrapper with GFM table rule, strips
  script/style/noscript tags
- url-to-markdown.ts: Jina Reader (free, returns markdown) with
  fetch+Turndown fallback. Warns on Jina failure, auto-skips Jina for
  local/private URLs (localhost, 192.168.*, 10.*, etc.)
- config.ts: add jina setting and resolveUseJina() with priority chain
  --no-jina flag > PLANNOTATOR_JINA env > config.json > default true

For provenance purposes, this commit was AI assisted.

* feat(annotate): support HTML files and URLs in annotate command

Extend the annotate subcommand to accept .html/.htm local files
(converted via Turndown) and https:// URLs (fetched via Jina Reader
with fetch+Turndown fallback). URL content is fetched terminal-side
before opening the browser.

Add --no-jina global flag to disable Jina Reader per-invocation.
Add 10MB file size guard for local HTML files.

For provenance purposes, this commit was AI assisted.

* feat(annotate): HTML files in folder browser and on-demand conversion

- Widen file browser glob to include .html/.htm alongside markdown
- handleDoc converts HTML files via Turndown on demand when selected
- hasMarkdownFiles accepts optional extensions param for folder validation
- Add sourceInfo field to annotate server API response
- Add _site/, public/, out/, .docusaurus/, .jekyll-cache/,
  storybook-static/ to FILE_BROWSER_EXCLUDED

For provenance purposes, this commit was AI assisted.

* feat(annotate): source attribution badge for HTML/URL annotations

Show a subtle badge in DocBadges displaying the URL hostname or HTML
filename for converted content. Thread sourceInfo from API response
through App → Viewer → DocBadges.

Also update Pi extension to accept HTML-only folders in annotate mode.

For provenance purposes, this commit was AI assisted.

* test: update CLI help text assertion for HTML/URL annotate support

For provenance purposes, this commit was AI assisted.

* fix(annotate): address PR review findings

Security:
- Add project-root containment check for HTML files in /api/doc handler
  using exported isWithinProjectRoot() from resolve-file.ts
- Blocks path traversal via absolute paths or ../ escapes

isLocalUrl fixes:
- Add bracketed IPv6 loopback [::1] detection
- Replace hostname.startsWith('10.') with proper IPv4 regex to avoid
  matching public hostnames like 10.example.com

Revert Pi extension change:
- Pi server doesn't implement HTML file browsing or conversion yet
- Keep Pi folder validation markdown-only until both implementations
  are updated per CLAUDE.md guidelines

Cleanup:
- Remove dead el.children || el.childNodes fallback in table rule
- Extract hostnameOrFallback() helper to @plannotator/shared/project
  replacing duplicated try/catch IIFEs in DocBadges and index.ts

For provenance purposes, this commit was AI assisted.

* feat(annotate): Pi extension HTML annotation parity

Bring the Pi extension to full parity with the Bun server for HTML
annotation support:

- Vendor html-to-markdown and url-to-markdown via vendor.sh
- walkMarkdownFiles now scans .html/.htm alongside markdown
- handleDocRequest converts HTML files on-demand via Turndown with
  isWithinProjectRoot containment check
- serverAnnotate includes sourceInfo in /api/plan response
- index.ts supports URL detection (Jina Reader + fallback), HTML file
  detection with Turndown conversion, folder HTML validation, and 10MB
  file size guard
- openMarkdownAnnotation accepts and threads sourceInfo
- Add turndown as a Pi extension dependency

For provenance purposes, this commit was AI assisted.

* fix(pi): Obsidian vault walks stay markdown-only, add try/catch for HTML

- Add extensions param to walkMarkdownFiles (default: HTML-inclusive)
- Obsidian callers pass /\.mdx?$/i to match Bun server behavior
- Add try/catch around HTML file reads in handleDocRequest

For provenance purposes, this commit was AI assisted.

* fix(annotate): address second review — base-block traversal, metadata IP, dead code

Security:
- Add isWithinProjectRoot check to the base-relative block for HTML
  files in both Bun and Pi /api/doc handlers. Previously HTML files
  served via the base query param bypassed the containment guard.
- Add 169.254.0.0/16 (link-local / cloud metadata) to isLocalUrl
  private IP ranges

Cleanup:
- Remove dead hostname === "[::1]" check (WHATWG URL parser strips
  brackets; hostname === "::1" already handles it)
- Remove dead parent?.childNodes fallback in table cell() function

For provenance purposes, this commit was AI assisted.

* refactor(annotate): replace custom table rules with turndown-plugin-gfm

Drop ~60 lines of hand-rolled GFM table conversion that had a bug
(tables without explicit <thead> produced invalid GFM). Use the
official turndown-plugin-gfm plugin (24KB) which correctly handles
all table patterns plus adds strikethrough and task list support.

For provenance purposes, this commit was AI assisted.

* fix(annotate): handle all CommonMark backslash escapes in InlineMarkdown

Expand the backslash escape regex to cover all CommonMark-defined
escapable characters (. ) - # > + | { } &), not just the subset
the parser uses for formatting. Fixes literal backslashes appearing
in rendered output for Turndown-escaped content like "1\." → "1.".

For provenance purposes, this commit was AI assisted.

* fix(annotate): prevent SSRF via redirect to private/local URLs

Replace redirect: "follow" with redirect: "manual" in fetchViaTurndown
and validate each redirect hop against isLocalUrl. Blocks attacks where
an external URL redirects to cloud metadata endpoints (169.254.169.254)
or other private IPs. Limits redirect chain to 10 hops.

For provenance purposes, this commit was AI assisted.

* chore: update lockfile for turndown-plugin-gfm in Pi extension

bun install needed to resolve turndown-plugin-gfm in the Pi extension
workspace after adding it to apps/pi-extension/package.json.

For provenance purposes, this commit was AI assisted.

* fix(annotate): switch to @joplin/turndown-plugin-gfm, fix TS errors

Replace unmaintained turndown-plugin-gfm (2017, v1.0.2) with the
actively maintained Joplin fork (2025, v1.0.64, 16KB).

Fix TypeScript errors that broke CI:
- Add @ts-expect-error for untyped @joplin/turndown-plugin-gfm import
- Restructure fetchViaTurndown redirect loop to avoid uninitialized
  variable — first fetch before loop, loop only for redirects

For provenance purposes, this commit was AI assisted.

* fix(annotate): use proper declarations.d.ts instead of ts-expect-error

Add declarations.d.ts for @joplin/turndown-plugin-gfm with typed
function signatures, remove the ts-expect-error suppression.

For provenance purposes, this commit was AI assisted.

* fix: explicitly include declarations.d.ts in shared tsconfig

CI's tsc wasn't finding the ambient module declaration with implicit
include. Add explicit include to ensure declarations.d.ts is always
picked up regardless of environment.

For provenance purposes, this commit was AI assisted.

* fix: use ts-expect-error for @joplin/turndown-plugin-gfm types

CI's tsc does not pick up ambient declarations.d.ts files despite
local tsc finding them — likely a module resolution discrepancy
between environments. Revert to @ts-expect-error which passes in
both CI and local typecheck.

For provenance purposes, this commit was AI assisted.

* fix(annotate): body size limit for URL fetches, redirect error, file: protocol

- Add 10MB body size limit to both Jina and fetch+Turndown URL paths,
  matching the local HTML file guard. Streams response body and aborts
  if limit exceeded.
- Distinguish "Too many redirects" from a genuine 3xx response after
  redirect loop exhaustion.
- Add file: to the dangerous protocol blocklist in sanitizeLinkUrl.

For provenance purposes, this commit was AI assisted.

* fix(annotate): HTML folder outside cwd, HTML linked doc navigation

- Remove containment check from base-relative block for HTML files in
  both Bun and Pi /api/doc handlers. Matches markdown behavior so HTML
  files in annotated folders outside cwd are served correctly.
  Standalone block (no base) retains its cwd check as fallback.
- Widen isLocalMd → isLocalDoc to treat .html/.htm links as linked
  documents. Clicking [Next](next.html) in a converted page now opens
  it via /api/doc with Turndown conversion instead of a new browser tab.

For provenance purposes, this commit was AI assisted.

* fix(annotate): full loopback range, drain redirect bodies, document env vars

- Expand loopback check from just 127.0.0.1 to the full 127.0.0.0/8
  range so all loopback addresses skip Jina Reader
- Cancel redirect response body before re-fetching to avoid leaking
  TCP connections back to the pool
- Document PLANNOTATOR_JINA and JINA_API_KEY in CLAUDE.md env var table

For provenance purposes, this commit was AI assisted.

* fix(annotate): IPv6 loopback, readBodyWithLimit fallback, env var docs, comments

- Add [::1] back to isLocalUrl — WHATWG URL hostname getter preserves
  brackets for IPv6 (verified: Bun and Node both return "[::1]").
  Add comment explaining the empirical verification so future reviewers
  don't re-flag.
- Fix readBodyWithLimit null-body fallback to still enforce the 10MB
  limit via text length check instead of silently falling through.
- Document PLANNOTATOR_JINA and JINA_API_KEY in AGENTS.md env var table
  (CLAUDE.md is a symlink to AGENTS.md).
- Add comments to base-relative blocks in both Bun and Pi handleDoc
  explaining the intentional lack of containment check (matches
  pre-existing markdown behavior, base is set server-side).

For provenance purposes, this commit was AI assisted.

* fix(annotate): block IPv4-mapped IPv6 and private IPv6 ranges in isLocalUrl

Add PRIVATE_IPV6 regex matching bracketed IPv6 private/reserved ranges:
- ::ffff: (IPv4-mapped — embeds private IPv4 as hex, e.g. [::ffff:c0a8:1])
- fe80: (link-local)
- fc00::/7 (unique-local, covers fc00:: through fdff::)

Closes the redirect-SSRF bypass where a public URL redirects to a
private address expressed as IPv4-mapped IPv6, e.g.
http://[::ffff:169.254.169.254]/latest/meta-data/

For provenance purposes, this commit was AI assisted.

* fix(annotate): document IPv6 hostname verification, sourceInfo type, annotate flow

- Expand isLocalUrl comment with full empirical verification table
  showing actual hostname getter output for every IPv6 format in both
  Bun and Node — prevents false-positive review findings about brackets
- Add sourceInfo to /api/plan response type in App.tsx for type safety
- Update CLAUDE.md annotate flow diagram to reflect HTML/URL/folder
  input types

For provenance purposes, this commit was AI assisted.

* fix(annotate): escape \(, cancel response bodies on error, doc sourceInfo

- Add ( to backslash escape regex alongside existing ) — Turndown
  emits \( in link-adjacent contexts
- Cancel response body before throwing on !res.ok in both fetchViaJina
  and fetchViaTurndown error paths (redirect loop already did this)
- Document sourceInfo field in AGENTS.md annotate server API table

For provenance purposes, this commit was AI assisted.

* fix(annotate): skip base injection for URL annotations, body cleanup

- Skip dirname(filePath) base injection when filePath is a URL in both
  Bun and Pi annotate servers. dirname on a URL string produces a
  nonsensical filesystem path, causing linked doc clicks to 404.
  URL annotations now let links open normally instead.
- Cancel response body before throwing on content-type mismatch and
  content-length overflow in fetchViaTurndown/readBodyWithLimit.
- Fix double parseInt in readBodyWithLimit content-length check.
- Correct AGENTS.md flow diagram: OpenCode not yet implemented for
  HTML/URL annotation.

For provenance purposes, this commit was AI assisted.

* feat(annotate): OpenCode HTML file and URL annotation support

Add URL detection (Jina Reader + fallback), HTML file detection with
Turndown conversion, 10MB file size guard, and sourceInfo threading
to OpenCode's handleAnnotateCommand. Uses the same shared utilities
as the Bun CLI and Pi extension.

OpenCode uses the Bun server directly (startAnnotateServer from
@plannotator/server/annotate), so no server-side changes needed —
only the command handler routing was missing.

Note: folder annotation mode is not added (OpenCode didn't have it
before this PR for markdown either — separate scope).

For provenance purposes, this commit was AI assisted.

* chore(annotate): update slash command description, align fetch log messages

- OpenCode plannotator-annotate.md description now mentions HTML/URL
- Align fetch progress messages across all three clients: all now show
  "(via Jina Reader)" or "(via fetch+Turndown)" consistently

For provenance purposes, this commit was AI assisted.

* fix(annotate): skip conversion for .md URLs, wikilink HTML targets, cleanup

- URLs ending in .md/.mdx are fetched raw — no Jina, no Turndown.
  Content is already markdown. Removes text/plain from fetchViaTurndown
  content-type whitelist since .md URLs are now short-circuited.
- Wikilink regex widened to preserve .html/.htm targets instead of
  appending .md (e.g. [[page.html]] no longer becomes page.html.md)
- Remove redundant existsSync before statSync in OpenCode handler

For provenance purposes, this commit was AI assisted.

* test(annotate): add htmlToMarkdown conversion tests

Tests cover the core conversion utility that all three clients depend on:
- Basic HTML → markdown (headings, paragraphs, links, code blocks)
- Tables with and without <thead> (the GFM plugin bug that was caught)
- Script/style/noscript stripping
- Strikethrough (GFM)
- Empty HTML handling
- Dangerous links preserved (sanitization is in the renderer, not here)

For provenance purposes, this commit was AI assisted.

* fix(annotate): check content-type before treating .md URLs as raw markdown

URLs ending in .md/.mdx (e.g. GitHub's viewer page for README.md)
may return HTML instead of raw markdown. fetchRawText now checks the
response content-type — if the server returns HTML, returns null so
the caller falls through to Jina/Turndown for proper conversion.

For provenance purposes, this commit was AI assisted.

* fix(annotate): add SSRF redirect protection to fetchRawText

fetchRawText (for .md/.mdx URLs) was using default redirect: "follow"
with no isLocalUrl validation on redirect hops — a .md URL redirecting
to 169.254.169.254 would be followed and credentials returned as
"markdown". Now uses redirect: "manual" with per-hop isLocalUrl checks,
matching fetchViaTurndown's SSRF protection.

For provenance purposes, this commit was AI assisted.
 2026-04-12 18:56:28 -07:00
Michael Ramos 3f3b0f63cc fix: pin Bun to 1.3.11 to fix macOS binary codesign regression (Bun 1.3.12) 
Bun 1.3.12 introduced a regression where cross-compiled macOS binaries
lose their ad-hoc linker signature, causing macOS Sequoia to SIGKILL
them immediately. Pin bun-version to 1.3.11 across all three workflow
jobs (test, build, npm-publish) until the Bun issue is resolved.

Fixes #541

Bumps version to 0.17.9.
 2026-04-11 12:00:07 -07:00
Michael Ramos 6677e3f280 chore: bump version to 0.17.8 2026-04-10 17:27:09 -07:00
Michael Ramos 0287b96b63 feat(review): configurable default diff type (#531) 
feat(review): configurable default diff type with first-run setup

Add `defaultDiffType` as a persistent user setting (cookie + config.json) with 'unstaged' as the default, matching `git diff` semantics. A first-run setup dialog prompts users to choose their preferred default on first review session. The setting is also available in Settings > Display.

Entry points (hook, opencode, pi-extension) read the config via `resolveDefaultDiffType()` instead of hardcoding. The setup dialog applies the chosen diff type to the active review immediately. P4 users are excluded from the Git-specific dialog.

Based on the community contribution in #521 by Hendrik Richert.

Co-authored-by: Hendrik Richert <hendrik.richert@swisscom.com>
 2026-04-10 14:54:21 -07:00
Vladyslav Hrabovyi 3b1b3317ae feat(review,annotate): add Close button to exit sessions without feedback (#523) 
Adds a Close button to review and annotation sessions so users can exit
cleanly without sending feedback or killing the agent. Works across all
agent origins and includes a warning dialog when annotations would be lost.

Fixes #522

Co-authored-by: gwynnnplaine <vladyslav.hrabovyii@gmail.com>
 2026-04-09 19:22:01 -07:00
Michael Ramos bac424d056 chore: bump version to 0.17.7 
For provenance purposes, this commit was AI assisted.
 2026-04-09 09:35:27 -07:00
Michael Ramos 93b09c7dc2 chore: bump version to 0.17.6 
For provenance purposes, this commit was AI assisted.
 2026-04-09 08:05:34 -07:00
Michael Ramos 32fc0f92b7 docs: move verification details to dedicated reference page 
The installation page was bloated with 55 lines of SLSA/SHA256
verification details before users could see agent setup instructions.
Moved to /docs/reference/verifying-your-install/ with a one-line link.

For provenance purposes, this commit was AI assisted.
 2026-04-09 07:39:05 -07:00
Michael Ramos 2202cc011d docs: simplify install blocks across docs for easy copy-paste 
For provenance purposes, this commit was AI assisted.
 2026-04-09 07:17:38 -07:00
Michael Ramos 29fc7920f8 chore: bump version to 0.17.5 
For provenance purposes, this commit was AI assisted.
 2026-04-09 07:08:01 -07:00
Michael Ramos 93b4a4a070 chore: bump version to 0.17.4 2026-04-08 16:20:24 -07:00
Michael Ramos 70dda029be feat(sidebar): merge vault browser into files tab + UX polish (#526) 
* fix(annotate): add missing obsidian vault endpoints to annotate servers

Both the Bun and Pi annotate servers were missing the three Obsidian
reference endpoints (/api/obsidian/vaults, /api/reference/obsidian/files,
/api/reference/obsidian/doc), making the vault browser unavailable in
annotate mode. Added the handlers to both servers.

For provenance purposes, this commit was AI assisted.

* feat(sidebar): merge vault browser into files tab

Vault is conceptually just another directory — same tree UI, same
expand/collapse, same annotation counts. Rather than maintaining a
parallel tab and hook, vault now appears as a collapsible section
inside the Files tab alongside any other configured directories.

Changes:
- Add `isVault` flag to `DirState` and `addVaultDir()` to
  `useFileBrowser` — fetches from the Obsidian endpoint and stamps
  the dir so downstream code can route to the correct API
- Remove `useVaultBrowser` hook and `VaultBrowser` component entirely
- Remove `"vault"` from `SidebarTab` type
- Update `App.tsx`: drop all parallel vault state; wire vault into the
  combined file browser fetch effect; update `handleFileBrowserSelect`
  to pick the right URL builder based on `isVault`; update
  `handleOpenLinkedDoc` and annotation count derivation to cover vault
  dirs via the same path
- Fix sticky header lane: remove the `!linkedDocHook.isActive` gate
  that was suppressing sticky headers for linked docs and annotate mode
- Remove primary border on linked doc viewer card
- Add `ObsidianIcon` (full branded logo) and `ObsidianIconRaw`
  (compact purple mark) to `packages/ui/components/icons/ObsidianIcons.tsx`
- Display `ObsidianIconRaw` in the FileBrowser directory header for
  vault dirs

Net: -334 lines. One Files tab handles all directory types uniformly.

For provenance purposes, this commit was AI assisted.

* fix(sidebar): fix stale vault dirs and unrecoverable vault load failures

Three issues identified in review:

1. Switching vault paths accumulated stale sections — addVaultDir now
   atomically replaces all existing vault dirs instead of appending,
   so changing the configured vault never leaves a ghost section behind.

2. Disabling the vault left the old section visible until reload —
   a new clearVaultDirs() method prunes all isVault entries, called
   via a dedicated effect that fires whenever vaultPath becomes empty.

3. Vault load failures were unrecoverable in-session — the Retry button
   only called fetchAll(regularDirs). FileBrowser now accepts an
   onRetryVaultDir prop and routes vault dir retries to addVaultDir
   (which re-fetches from the Obsidian endpoint) instead of the
   regular-dirs-only fetchAll.

For provenance purposes, this commit was AI assisted.
 2026-04-08 16:07:08 -07:00
Dillon Mulroy 3c0e35a08a fix(pi): strip planning-only tools on fresh idle sessions (#525) 
PR #446 refactored the session_start handler to use applyPhaseConfig()
but changed the idle branch to only call restoreSavedState(), which
no-ops when savedState is null (i.e., fresh sessions that were never
in planning mode). This left plannotator_submit_plan in the active
tool set even though plan mode hadn't been activated — a regression
from the fix in #387.

Now the idle branch explicitly strips planning-only tools when there
is no saved state to restore.
 2026-04-08 15:51:28 -07:00
Michael Ramos 667eb12e8a chore: bump version to 0.17.3 
For provenance purposes, this commit was AI assisted.
 2026-04-08 07:39:12 -07:00
Michael Ramos ede9cb77d8 chore: bump version to 0.17.2 
Includes bun.lock update for @pierre/diffs dep added in #509.

For provenance purposes, this commit was AI assisted.
 2026-04-08 07:07:41 -07:00
Michael Ramos ed254cf3bd Supply-chain hardening: version pinning, SLSA attestations, fix #506 (#512) 
* feat(install): supply-chain hardening (#507) + fix Gemini crash on Windows (#506)

Closes #507 items 1-2 and fixes #506.

Issue #507 asked for version-pinned installs from a trusted source, immutable
releases, and build-provenance attestations. This commit ships:

- `--version v0.X.Y` / positional / `-Version` flag across all three installers
  (bash, PowerShell, cmd) so users can pin to reviewed versions. Default stays
  `latest` — every existing `curl | bash` / `irm | iex` invocation works
  unchanged. install.cmd gained `--version` as an alias to its existing
  positional form for surface-area consistency.

- SLSA build provenance attestations via `actions/attest-build-provenance`
  (SHA-pinned to v4.1.0) in release.yml. Covers all 10 compiled binaries
  (5 plannotator + 5 paste-service). Top-level workflow permissions tightened
  from `contents: write` to `contents: read`, with per-job overrides where
  needed. Attestation step is gated on tag pushes so PR dry-runs don't
  pollute Sigstore's transparency log.

- Opt-in provenance verification in all three installers, resolved via a
  three-layer precedence ladder:
    1. CLI flag   `--verify-attestation` / `-VerifyAttestation`
    2. Env var    `PLANNOTATOR_VERIFY_ATTESTATION=1`
    3. Config     `~/.plannotator/config.json` → `verifyAttestation: true`
    4. Default    off
  Off-by-default matches every major ecosystem installer (rustup, brew, bun,
  deno, helm) and avoids a UX failure for the majority of users who don't
  have `gh` installed or authenticated. Security-conscious users get three
  ergonomic opt-in paths. When enabled, the installer hard-fails if `gh` is
  missing so opt-in is never silently skipped.

- `PlannotatorConfig.verifyAttestation?: boolean` added to
  `packages/shared/config.ts`. Pure additive schema change; no runtime
  consumer exists (the field is read only by the install scripts). No UI
  surface — this is an OS-level power-user knob only.

- Documentation rewritten in README.md, apps/hook/README.md, and the
  marketing install page with both pinned-version examples and a "Verifying
  your install" section covering manual `gh attestation verify` and offline
  `cosign verify-blob` paths.

- Release skill updated to note that the release pipeline now emits SLSA
  attestations and (post-merge) GitHub Immutable Releases will be enabled
  on the repo.

Issue #506 (install.cmd crash on Windows when Gemini is present):

Root cause was cmd.exe's `setlocal enabledelayedexpansion` eating `!` chars
in the embedded `node -e "..."` Gemini settings merge script. Cmd's Phase 2
parser treated `!s.hooks)s.hooks={};if(!` as a variable expansion, corrupting
the JS before node saw it. Fixed by rewriting the JS to use the `||` idiom
(`s.hooks = s.hooks || {}`) which contains no `!` characters — semantically
identical, and sidesteps cmd's parser entirely with no escape gymnastics and
no new dependencies.

Added regression test in scripts/install.test.ts that asserts the `||` form
is present and `if(!s.hooks)` is absent, so re-introducing the bug would
fail CI.

Test suite expanded from 23 to 29 tests covering:
- Gemini #506 regression
- Three-layer opt-in wiring assertions for all three installers
- install.sh guard check (the executable `gh attestation verify` call must
  live behind the `verify_attestation -eq 1` gate, so the default path never
  invokes gh)
- PlannotatorConfig schema assertion

Out of scope (tracked):
- Immutable Releases toggle in repo Settings (one-click, post-merge).
- SLSA Build L3 via `slsa-framework/slsa-github-generator` (requires
  restructuring release.yml around a reusable workflow).
- Issue #507 item 3: UI update-cooldown setting.

For provenance purposes, this commit was AI assisted.

* fix(install): address PR #512 review feedback

- docs: drop broken `cosign verify-blob` example. Verified against
  Sigstore's docs that `cosign verify-blob` requires `--bundle` (or
  `--signature` + `--certificate`); the shipped command provided neither
  and could not have worked. Replaced with the canonical
  `gh attestation verify --repo` flow (gh + auth required, but optional —
  only needed if a user wants to manually audit provenance) and a link
  to GitHub's offline-verification docs for advanced workflows. Applied
  to README.md, apps/hook/README.md, and the marketing install page.

- docs: list per-platform binary paths in the manual verification
  examples. The previous snippets hardcoded `~/.local/bin/plannotator`
  even though install.ps1 writes to `%LOCALAPPDATA%\plannotator\` and
  install.cmd writes to `%USERPROFILE%\.local\bin\` — Windows users
  copying the snippet got file-not-found instead of a verification
  result.

- install.sh: capture and surface `gh attestation verify` stderr on
  failure instead of redirecting to /dev/null. Diagnosability matches
  install.ps1, which already prints `$verifyOutput` on failure. The
  most common failure mode (`gh auth login` not run) is now
  immediately actionable instead of presenting as a generic
  "verification failed" error.

- install.cmd: reject any unknown dash-prefixed token before the
  positional fall-through. A typoed `--verify-attesttion` no longer
  becomes `VERSION=--verify-attesttion` and 404s on a nonsensical
  download URL — it fails fast with `Unknown option:` and a usage
  hint. install.sh and install.ps1 already had equivalent guards
  (case `-*)` arm and PowerShell's strict param block respectively).

All 29 install tests still pass.

For provenance purposes, this commit was AI assisted.

* test(ci): add Windows integration job for install.cmd

Address the reviewer gap flagged in PR #512: the unit tests in
scripts/install.test.ts only do file-content string matching on Linux
and never execute cmd.exe, so the #506 fix (rewriting the embedded
`node -e` Gemini merge to use `x = x || {}` instead of `if(!x)x=...`)
was shipped without any runtime coverage. The previous CI only had
ubuntu-latest runners.

New `install-cmd-windows` job on `windows-latest`:

1. Seeds a fake `~/.gemini/settings.json` with a pre-existing non-
   plannotator hook plus unrelated top-level keys (theme, general).
   The fixture mirrors the shape of a real Gemini settings.json but
   uses only obviously-fake values and contains no secrets.

2. Runs `scripts\install.cmd v0.17.1 --skip-attestation` end-to-end
   through real cmd.exe. This exercises the parser under
   `enabledelayedexpansion`, the embedded `node -e` merge script,
   and the full install flow.

3. Parses the post-install settings.json with PowerShell and asserts:
   - The plannotator hook was added to hooks.BeforeTool.
   - The pre-existing fixture hook is still present (regression guard
     for the original #506 bug, where cmd ate the `!` in
     `if(!s.hooks.BeforeTool)s.hooks.BeforeTool=[]` and wiped existing
     arrays).
   - Unrelated top-level keys (`theme`, `general.ciFixtureSentinel`)
     survived the merge untouched.

4. Separately exercises the new unknown-flag rejection added in the
   previous commit: invokes `install.cmd --verify-attesttion` (typo)
   via Start-Process and asserts exit code != 0. Before the review
   fix this would have silently set `VERSION=--verify-attesttion`
   and 404'd on the download.

The job runs in parallel with the existing ubuntu `test` job (no
deps, independent runner). Uses the v0.17.1 release as the binary
source — that release is pre-PR, so the test is stable against
release drift and is testing install.cmd's CODE, not any specific
binary.

This closes the CI gap where install.cmd had effectively zero
runtime coverage and the original #506 bug could have recurred
without anyone noticing until a user reported it.

For provenance purposes, this commit was AI assisted.

* fix(install.cmd): capture gh stderr on failure (consistency with install.sh)

Self-review catch: the PR #512 reviewer flagged install.sh for
redirecting `gh attestation verify` output to /dev/null, which
swallowed actionable error messages (auth missing, network issue,
attestation not yet propagated) behind a generic "verification
failed" line. I fixed install.sh in the previous review-fix commit
but missed that install.cmd had the exact same pattern:

    gh attestation verify "!TEMP_FILE!" --repo !REPO! >/dev/null 2>&1

Same bug, same consequence, same fix. cmd doesn't have bash's
`$(cmd)` or PowerShell's `& cmd 2>&1` output capture, so we redirect
to a temp file and `type` it on failure, then clean up in both
branches:

    gh attestation verify ... > "%TEMP%\gh-output.txt" 2>&1
    if !ERRORLEVEL! neq 0 (
        type "%TEMP%\gh-output.txt" >&2
        del "%TEMP%\gh-output.txt"
        echo Attestation verification failed! >&2
        ...
    )
    del "%TEMP%\gh-output.txt"

All three installers now surface gh's actual error message on
failure, which makes the most common failure mode (`gh auth login`
not run) immediately diagnosable on every platform.

Note: this code path is not exercised by the new Windows CI
integration job because that job passes `--skip-attestation`, and
exercising the gh verify path would require an attestation for
v0.17.1 to exist — which it doesn't, since v0.17.1 was released
before this PR added the attestation step. The fix will first
become CI-testable against the first post-merge release that
carries a provenance bundle.

For provenance purposes, this commit was AI assisted.

* fix(install): address second review pass on PR #512

Five findings, all verified against the actual code:

- **AGENTS.md env var table** (reviewer: "CLAUDE.md"; it's a symlink to
  AGENTS.md) was missing PLANNOTATOR_VERIFY_ATTESTATION. Added with an
  explicit note that it's read by the install scripts only, not the
  runtime binary — since every other entry in that table is a runtime
  env var, the distinction matters.

- **install.cmd unknown-flag guard metacharacter injection.** The
  previous guard ran `echo %~1 | findstr /b "[-]"`, where %~1 is
  unquoted before the pipe. A user passing `install.cmd "--bad&calc"`
  would have cmd expand %~1 to `--bad&calc`, see the `&` as a command
  separator, and execute `calc` as a side effect before the flag
  check. Not a remote exploit (user already has shell exec), but a
  defensive coding weakness in supply-chain hardening code.

  Replaced with a variable-assigned substring test using delayed
  expansion — `set "CURRENT_ARG=%~1"` preserves metacharacters
  literally inside the `"..."` set syntax, and `!CURRENT_ARG:~0,1!`
  extracts the first char without any subprocess. This also fixes the
  same bug in the error-message echo, which previously echoed the
  unquoted `%~1` and re-triggered metacharacter interpretation in the
  error path itself. The echo now uses `"%~1"`.

  Note: the reviewer's proposed one-liner `if "%~1:~0,1%"=="-"` was
  syntactically invalid — cmd's `:~start,length` substring modifier
  does not work on positional parameters, only on regular variables.
  A variable assignment is necessary.

- **install.cmd unquoted --repo argument** in the `gh attestation
  verify` call. TEMP_FILE was quoted but REPO was not. REPO is
  hardcoded to `backnotprop/plannotator` so not exploitable, but
  inconsistent with install.sh (which quotes `"$REPO"`). One-char
  fix: `--repo "!REPO!"`.

- **test.yml intentional-typo drift hazard.** The unknown-flag
  regression test invokes `install.cmd --verify-attesttion`
  (missing an `a`). The only assertion was `$p.ExitCode -eq 0`. If
  a future typo-sweep "fixes" the misspelling to the valid
  `--verify-attestation`, install.cmd would accept the flag,
  proceed to download the latest release, run `gh attestation
  verify` against it, and — because v0.17.1 pre-dates the
  attestation step — fail with a different non-zero exit. Both
  paths exit 1, so the test would silently drift from "guard
  works" to "gh attestation verify fails on pre-PR release"
  without anyone noticing.

  Two-part fix:
    1. Explicit comment marking the misspelling as intentional
       ("do not correct during a typo sweep").
    2. Redirect stderr to a temp file and assert it contains
       "Unknown option:" — the actual discriminator between the
       guard triggering and any other failure mode that happens
       to exit non-zero.

- **README.md verification block was too long** for the main
  README. Trimmed from ~33 lines (intro + 3 code blocks + opt-in
  mechanisms + precedence notes) to a single sentence that links
  to the canonical marketing installation docs where the full
  content already lived. Same treatment applied to
  apps/hook/README.md for consistency. The marketing docs are
  unchanged and remain the single source of truth for
  verification workflows.

All 29 install tests still pass. The Windows CI integration job's
new stderr assertion will exercise the harder guard on the next
push.

For provenance purposes, this commit was AI assisted.

* fix(install): tighten attestation verify with --source-ref and --signer-workflow

Addresses PR #512 review cycle 3 finding that repo-scoped verification
alone doesn't bind the downloaded binary to the specific tag the user
requested. A misattached release asset would pass the old check
because the wrong binary would still carry a valid attestation for
its own (wrong) commit.

GitHub's own docs explicitly recommend both constraints:

  "The more precisely you specify the identity, the more control you
   will have over the security guarantees. Ideally, the path of the
   signer workflow is also validated."
  — https://cli.github.com/manual/gh_attestation_verify

All three installers now pass:

  --source-ref "refs/tags/<requested-tag>"
      Enforces that the git ref the attestation was produced from
      matches the tag the installer asked for. Closes the
      misattached-asset gap.

  --signer-workflow backnotprop/plannotator/.github/workflows/release.yml
      Enforces that the attestation was signed by our release workflow
      file specifically, not any workflow in the repo. GitHub treats
      this flag as a regex (see cli/cli#9507) so future refactors can
      broaden the match without breaking version-pinned installs to
      historical releases.

Also addresses the sibling finding that install.cmd used a fixed
%TEMP%\gh-output.txt temp filename while the rest of the script
uses %RANDOM% for uniqueness. Renamed to
%TEMP%\plannotator-gh-%RANDOM%.txt, matching the established pattern
and removing a theoretical race between concurrent invocations.

New test in install.test.ts asserts all three installers pass
--source-ref and --signer-workflow with the expected values. 30
tests pass.

For provenance purposes, this commit was AI assisted.

* fix(install): address PR #512 review cycle 4 (parser edges, ps1 stream, docs)

Five findings, all verified against actual code. One bonus fix in
install.sh for a sibling bug the reviewer flagged only in install.cmd.

install.ps1: `Write-Host $verifyOutput` on attestation failure wrote
gh's diagnostic to PowerShell's Information stream (stream 6), which
is silently dropped when CI pipelines capture stderr. Replaced with
`[Console]::Error.WriteLine($verifyOutput)` — direct stderr handle,
matches the behavior of `echo ... >&2` in install.sh and `type ...
>&2` in install.cmd.

install.sh + install.cmd: `--version --some-other-flag` used to set
VERSION to the flag name (e.g. VERSION=--verify-attestation), which
then tried to download tag `v--verify-attestation` and 404'd. The
empty-check on `$2`/`%~2` didn't catch dash-prefixed values. Added
an explicit dash-prefix check that returns a clean "--version
requires a tag value, got flag: X" error instead of degrading into
a cryptic download failure.

install.sh + install.cmd: mixing `--version v1.0.0 stray` used to
silently overwrite VERSION with "stray" because the positional
branch unconditionally assigned VERSION=$1. Added a VERSION_EXPLICIT
sentinel that's set to 1 when --version is seen, and the positional
branch now errors with "Unexpected positional argument: X (version
already set)" when it sees a token while the sentinel is set. Same
sentinel is also set by the positional branch itself, so passing
two positional version tokens also errors out cleanly.

Note: the reviewer flagged the positional-overwrite bug only in
install.cmd, but install.sh had the identical issue (same
unconditional `VERSION="$1"` in the `*)` arm) and the same dash-
check gap in both its `--version <val>` and `--version=<val>`
branches. Fixing both installers symmetrically — inconsistency
here would just trigger another review round.

marketing/installation.md: the "Verifying your install" prose
promised a "cryptographic link to the exact commit and workflow
run," but the example commands only passed `--repo`, which just
proves the artifact came from some workflow in our repository.
The installer now constrains with `--source-ref` and
`--signer-workflow` after review cycle 3, so the docs were out of
sync with the actual installer behavior. Updated all three
platform examples (bash, pwsh, cmd) to include the tighter flags
with a placeholder (`vX.Y.Z`) and a sentence explaining what the
extra flags actually buy the user. README.md and
apps/hook/README.md are already link-only after cycle 2 and don't
need changes.

install.test.ts: two new tests.
  - Regression guard asserts install.sh and install.cmd contain the
    VERSION_EXPLICIT sentinel, the dash-prefix error message, and
    the "Unexpected positional argument" guard. Anyone removing
    any of these in a future cleanup would fail CI.
  - Regression guard asserts install.ps1 uses
    [Console]::Error.WriteLine and does NOT use Write-Host for
    verifyOutput.

32 tests pass (was 30). Smoke-tested install.sh with
`--version --verify-attestation` and `--version v1.0.0 stray` —
both now exit 1 with clean usage errors instead of silent
download failures.

For provenance purposes, this commit was AI assisted.

* fix(install): address PR #512 review cycle 5

Five code/doc fixes, all verified against actual code. Finding 1 from
the review (opt-in verification unusable until a post-merge release is
cut) is correct but not actionable — it's inherent to how SLSA
attestations work and the only "fix" is timing + release cadence.

install.ps1: `[Console]::Error.WriteLine($verifyOutput)` silently
converted multi-line gh output to the literal string "System.Object[]"
— the opposite of what cycle 4's Write-Host fix was supposed to do.
`& gh ... 2>&1` captures multi-line output as an object[] array;
passing the array directly to [Console]::Error.WriteLine binds to the
WriteLine(object) overload and calls ToString() on the array. Fixed by
piping through Out-String first (and TrimEnd to drop the trailing
newline it adds). Confirmed against Sigstore/PowerShell docs and the
Delft Stack array-to-string guide.

install.cmd: replaced `echo !TAG! | findstr /b "v"` with a substring
test `if not "!TAG:~0,1!"=="v"`. Same metacharacter-injection class as
the parser bug fixed in cycle 2 — piping an unquoted expanded variable
re-exposes cmd's & | > < operators in the value before the pipe runs.
Inconsistent to leave this one instance using the unsafe pattern when
every other comparable check in the script uses the substring idiom.

install.cmd: randomized the two remaining deterministic temp file
paths — %TEMP%\release.json and %TEMP%\plannotator-<tag>.exe — to
match the %RANDOM% pattern already used by GH_OUTPUT. Closes two
gaps at once: concurrent-invocation collisions (real for automated
upgrade tooling) and same-user symlink pre-placement (the SHA256
check passes on authentic content, but a symlink at the predictable
path would redirect where curl writes the binary before the install
move runs).

All three installers: reject --verify-attestation and
--skip-attestation together as mutually exclusive instead of trying
to guess which the user meant. Previously install.sh/cmd took last-
on-command-line wins and install.ps1 took a fixed-priority Skip-
always-wins (documented but inconsistent with the other two). No
sane user passes both flags — fast-failing with a clear "mutually
exclusive" error is better than silently picking one and hoping it
matches intent. Guards live inline in both arms of the bash/cmd
parsers and right after the PowerShell param block.

test.yml: added a comment block on the install.cmd v0.17.1 pin
explaining why that version was chosen, why `latest` isn't used,
what the prerequisites are for bumping it, and what failure mode
to expect if the pinned release is ever removed. No behavior
change — the existing pin stays. Addresses the reviewer's concern
that the dependency was undocumented.

install.test.ts: four new regression guards.
  - Asserts install.ps1 uses Out-String (not bare [Console] call
    on raw $verifyOutput) for multi-line gh output
  - Asserts all three installers reject the --verify+--skip combo
    with a "mutually exclusive" error and install.ps1 has the
    `$VerifyAttestation -and $SkipAttestation` guard
  - Asserts install.cmd uses randomized temp paths for release.json
    and the binary download, and that the old deterministic paths
    are gone
  - Asserts install.cmd uses the substring test for v-prefix
    normalization and does not pipe echo|findstr for that check

35 install tests pass (was 32). Smoke-tested the bash mutex guard
in both orders — both fail fast with "mutually exclusive" and
exit 1 regardless of which flag appears first.

For provenance purposes, this commit was AI assisted.

* fix(install.cmd): randomize checksum temp path + tighten test assertions

Self-review catch on top of the cycle 5 commit:

- `%TEMP%\checksum.txt` (lines 164/172/174) was still a fixed
  predictable path. Same concurrency + symlink-pre-placement class
  as release.json and TEMP_FILE that cycle 5 fixed. Inconsistent to
  fix two of three and leave the third. Renamed to
  `%TEMP%\plannotator-checksum-%RANDOM%.txt` matching the established
  pattern. The reviewer didn't flag this one — I missed it during
  the cycle 5 sweep.

- Tightened the Out-String regression test from a weak "Out-String
  appears somewhere in the file" check to a regex matching the
  specific `$verifyOutput | Out-String` wiring. Previous assertion
  would have passed even if some future bug accidentally wrapped
  the mutex-guard string literal in Out-String while leaving
  $verifyOutput unprotected.

- Expanded the randomized-temp-paths test to cover all four curl
  download targets (release.json, binary, checksum sidecar, gh
  output capture) rather than the two originally in scope, and to
  assert the old fixed paths (including checksum.txt) are gone.

35 tests still pass.

For provenance purposes, this commit was AI assisted.

* fix(install.cmd): escape ! in Claude Code slash command files

Pre-existing bug flagged in PR #512 review cycle 6. install.cmd writes
the three Claude Code slash command files (plannotator-review.md,
plannotator-annotate.md, plannotator-last.md) via `echo` lines inside
`setlocal enabledelayedexpansion`. cmd.exe's Phase 2 parser strips
unmatched `!` characters — so lines like:

    echo !`plannotator review $ARGUMENTS`

ended up in the written file as:

    `plannotator review $ARGUMENTS`

without the leading `!`. The `!` prefix is what tells Claude Code to
execute the backtick block as a shell command; without it, Claude Code
renders the line as inline markdown code and the slash command is a
silent no-op. The install appeared to succeed, but every Windows cmd
user got three broken slash command files.

install.sh (single-quoted heredocs) and install.ps1 (single-quoted
here-strings) write the `!` correctly because their respective
literal-string idioms bypass shell expansion entirely. install.cmd
has no single-quote-literal equivalent — its escape hatch is `^!`.
The Gemini section of install.cmd (lines 482, 495) already uses
`^!` correctly; the Claude Code section didn't until now.

Fix: three characters — `echo !` → `echo ^!` on lines 334, 351, 368.
Brings install.cmd into parity with the other two installers. No
divergence introduced; existing divergence removed.

Two regression guards added:

  - Unit test in install.test.ts asserts install.cmd contains the
    escaped form for all three command files and does not contain
    the unescaped form.

  - New step in the Windows CI integration job reads back each
    generated .md file from %USERPROFILE%\.claude\commands\ and
    asserts it contains the literal `!`\`plannotator` prefix. Catches
    the bug at the actual file-write level on a real Windows runner,
    not just via source-code grep.

36 install tests pass (was 35).

Note: the broader architectural issue — all three installers carry
hand-typed duplicates of command content that already lives at
apps/hook/commands/*.md — is deferred to a follow-up issue. The
cmd bug is the visibly-broken symptom; the deduplication is the
long-term fix.

For provenance purposes, this commit was AI assisted.

* fix(install.cmd): double-caret escape for ! in slash command echoes

The previous fix used `echo ^!` for the three Claude Code slash command
files. The Windows CI integration job's new file-readback assertion
proved this is wrong: the generated plannotator-review.md still landed
with no `!` prefix, making the slash command a silent no-op as before.

Root cause: cmd has two escape phases under enabledelayedexpansion.
  Phase 1 (parse time): `^` escapes the next char. `^!` → `!`.
                        The caret is consumed.
  Phase 2 (delayed expansion): the remaining bare `!` is an unmatched
                        variable reference and gets stripped.
Single `^!` dies in Phase 2 because Phase 1 already ate the caret.
Double `^^!` survives: Phase 1 reduces `^^` to `^` (leaving `^!`),
Phase 2 treats the caret as an escape for `!` and emits a literal.

Cycle 6's fix got the direction right but the arithmetic wrong. The
new file-readback assertion in test.yml caught it on the first real CI
run, which is exactly why that assertion was added.

Also fixes the Gemini slash command echoes (lines 482, 495) which used
the identical incorrect `^!` pattern. The review comment flagged
Gemini as "correct" based on source-reading alone; there was never
any CI coverage for the Gemini file contents, and the Gemini section
was silently broken for the same reason. Both sections now use `^^!`.

Unit test updated to assert the double-caret form on all five echo
lines (three Claude Code, two Gemini) and reject both the unescaped
and single-caret variants.

For provenance purposes, this commit was AI assisted.

* fix(install.ps1): fall back to x64 on ARM64 Windows instead of 404ing

Pre-existing bug surfaced in PR #512 review cycle 7.

install.ps1 detected ARM64 correctly and set $arch=arm64, constructing
a URL for plannotator-win32-arm64.exe — which doesn't exist in any
release. The release pipeline only builds bun-windows-x64 (release.yml
line 88), so there is no native ARM64 Windows binary to download.
With $ErrorActionPreference=Stop set at the top of the script, the
resulting 404 on Invoke-WebRequest threw a terminating error and the
install aborted with a stack trace. ARM64 Windows PowerShell users
could not install plannotator at all.

Meanwhile install.cmd, which hardcodes PLATFORM=win32-x64 and lets
ARM64 hosts pass the arch check, silently installs the x64 binary
and relies on Windows 11's x86-64 emulation layer to run it. This is
accidentally the useful behavior — imperfect, but the user gets a
working install instead of a hard failure.

This commit brings install.ps1 into parity with install.cmd's
(accidentally correct) behavior:

- On 64-bit Windows, $arch is unconditionally "x64" — no more
  branch for arm64 that would download a nonexistent binary.
- When PROCESSOR_ARCHITECTURE == ARM64, Write-Host prints a notice
  telling the user they're getting the x64 binary via Windows
  emulation so the behavior isn't silent.
- 32-bit Windows still errors out (unchanged).

Both Windows installer paths now produce a working install on both
x64 and ARM64 hosts. No release pipeline changes. No new binaries.

The test `detects ARM64 architecture` used to be a weak string-
presence check that passed whether the ARM64 branch selected arm64
or x64. Rewrote it to assert the actual new contract: ARM64 is
detected (for the notice), $arch is hardcoded to "x64", and the
previous `{ "arm64" }` branch is gone so the regression can't
silently return.

Native ARM64 Windows builds tracked as a follow-up — requires
verifying Bun's Windows ARM64 target support and adding
bun-windows-arm64 to the release matrix.

For provenance purposes, this commit was AI assisted.

* fix(install): pre-flight MIN_ATTESTED_VERSION guard + placeholder docs

PR #512 cycle 7 review surfaced that opt-in provenance verification was
dead-on-arrival for the window between this PR merging and the first
post-merge release:

  - The docs showed `--version v0.17.1` as the pinned example. v0.17.1
    was cut before this PR added attestation generation to release.yml,
    so any user copy-pasting the example AND enabling verification
    would hit a cryptic `gh: no attestations found` error and a hard
    install failure.

  - Default installs with verification enabled (via flag, env var, or
    config file) resolve `latest` to v0.17.1 and hit the same failure
    with no user-visible pinned version to "blame."

Medium fix (better error message) was dismissed as lipstick — the
install still fails, just with nicer wording. This is the maximum fix
that actually prevents the failure path by checking the resolved tag
against a hardcoded floor BEFORE downloading.

## Changes

`scripts/install.sh`:
  - New `MIN_ATTESTED_VERSION="v0.18.0"` constant near the top
  - New `version_ge` helper using `sort -V` (handles v0.9.0 vs v0.10.0)
  - Moved three-layer verification resolution (config → env → flag) to
    before the download so $verify_attestation is known in time to
    gate network work
  - New pre-flight check: if verification is requested and the resolved
    tag is older than MIN_ATTESTED_VERSION, fail fast with a clean
    message listing recovery options (pin to newer version,
    --skip-attestation, or unset the env var / config). No binary
    download, no wasted SHA256 check.
  - Late `gh attestation verify` block now only handles the gh call
    itself — resolution and pre-flight moved upstream.

`scripts/install.ps1`:
  - New `$minAttestedVersion = "v0.18.0"` constant
  - Pre-flight guard in the verification branch using PowerShell's
    [version] class for proper numeric comparison
  - Same error message content as install.sh

`scripts/install.cmd`:
  - New `set "MIN_ATTESTED_VERSION=v0.18.0"` near REPO setup
  - Pre-flight guard shells out to PowerShell for semver comparison
    — Windows 10+ ships `powershell.exe` always, so no new runtime
    dependency. Hand-parsing semver in cmd was tried and rejected as
    too fragile for prerelease tags and non-numeric components.

`apps/marketing/.../installation.md`, `apps/hook/README.md`,
`README.md`, `scripts/install.sh --help`:
  - Replaced every user-facing `v0.17.1` example with `vX.Y.Z`
    placeholder. The placeholder pattern already exists in the
    "Verifying your install" section, so this is just consistency.
  - install.sh --help adds a link to the releases page so users know
    where to find actual tag values.

`.agents/skills/release/SKILL.md`:
  - New Phase 4 checklist step: before shipping the first attested
    release, verify MIN_ATTESTED_VERSION in all three installers
    matches the tag being cut. The constant is bumped ONCE and never
    again — it's a permanent floor, not a moving target. If the first
    post-merge release is not v0.18.0, the skill updates the constant
    in the same commit as the version bump so the installers served
    from plannotator.ai activate the new floor at the same moment
    the first attested release becomes fetchable.

`scripts/install.test.ts`:
  - New test asserts all three installers hardcode MIN_ATTESTED_VERSION,
    use appropriate version comparison for their dialect, and contain
    the "predates" error message
  - New test asserts install.sh and --help text no longer contain
    `v0.17.1` as a pinned example

38 install tests pass (was 36). Smoke-tested install.sh end-to-end:

  - `--version v0.17.1 --verify-attestation` → pre-flight rejects
    cleanly, no download attempted, exit 1 with actionable error
  - `--version v0.18.0 --verify-attestation` → pre-flight passes,
    script proceeds to download (404 as expected since v0.18.0 is
    not yet released)
  - `--version v0.17.1` (no verify) → pre-flight skipped, normal
    download path

For provenance purposes, this commit was AI assisted.

* fix(install): close PS injection + move Windows pre-flight before download

PR #512 review cycle 8 raised three related findings, all verified
against actual code.

## Critical: PowerShell command injection in install.cmd (Finding 2)

Line 228 of the previous install.cmd passed the version comparison
to PowerShell by interpolating delayed-expansion variables directly
into the command string between single-quoted literals:

    for /f "delims=" %%i in ('powershell -NoProfile -Command "try {
      if ([version]'!TAG_NUM!' -ge [version]'!MIN_NUM!') { 'yes' }
    } catch {}"') do set "VERSION_OK=%%i"

The arg parser rejected leading-dash values but not quotes or
semicolons, so a user passing

    install.cmd --version "0.18.0'; calc; '0.18.0"

produced the PowerShell command

    try { if ([version]'0.18.0'; calc; '0.18.0' -ge [version]'0.18.0')
        { 'yes' } } catch {}

PowerShell permits statement sequences inside `if` condition
parentheses — the last value is used — so `calc` executed as a side
effect during the first evaluation phase. Attacker-controlled
--version from a CI/CD wrapper (PR titles, external tag sources,
etc.) equals arbitrary code execution as the invoking user.

Fixed by passing the version strings via environment variables
($env:TAG_NUM, $env:MIN_NUM) instead of interpolating them into
the PowerShell command string. PowerShell reads $env: values as
raw strings and never parses them as code. The [version] cast
throws on invalid input, catch {} swallows it, VERSION_OK stays
empty, and the guard rejects — safe fail with a slightly less
helpful but correct error message.

## Structural: Windows pre-flight ran post-download (Findings 1 & 3)

install.sh was already restructured in the previous commit to run
the three-layer resolution + MIN_ATTESTED_VERSION guard BEFORE the
binary download, so users hit the "predates attestation support"
error without wasting bandwidth.

install.ps1 and install.cmd drifted — their resolution and
pre-flight blocks stayed in their original post-SHA256 positions,
meaning the binary was always downloaded and SHA256-verified even
when the requested tag was doomed to fail provenance verification.
The "Pre-flight: reject the verification request before
downloading" comments were lies copied from install.sh.

This commit moves both Windows installers' resolution + pre-flight
blocks upstream of the download:

  install.ps1: resolution + pre-flight now run immediately after
    `Write-Host "Installing plannotator $latestTag..."`, before
    $tmpFile is created or Invoke-WebRequest runs. The late
    gh-call block keeps only the gh attestation verify call itself.

  install.cmd: same restructure. The late block keeps only the
    where-gh check and gh invocation. The `del "!TEMP_FILE!"`
    calls inside the rejection branch are gone (TEMP_FILE doesn't
    exist yet when the guard runs).

## Tests

Added two new regression guards to scripts/install.test.ts:

  1. Order-aware check for all three installers: the resolution
     block's opening line must appear textually BEFORE the curl /
     Invoke-WebRequest download line. Uses indexOf to compare
     positions. Catches any future regression that drifts the
     pre-flight back after download.

  2. Injection-safe pattern check for install.cmd: asserts the
     PowerShell command references $env:TAG_NUM / $env:MIN_NUM and
     does NOT interpolate !TAG_NUM! / !MIN_NUM! between single
     quotes in any [version] cast.

40 install tests pass (was 38). Smoke-tested install.sh with
--version v0.17.1 --verify-attestation — rejects cleanly with no
download, same as before.

For provenance purposes, this commit was AI assisted.

* fix(install): close cycle-9 gaps — CI coverage, v-strip, prerelease handling

PR #512 cycle 9 review surfaced three real findings, all verified.

## Finding 1 (important): Windows CI never exercised the attestation path

The Windows integration job ran `install.cmd v0.17.1 --skip-attestation`,
which bypasses every bit of logic this PR shipped: three-layer opt-in
resolution, MIN_ATTESTED_VERSION pre-flight, $env:-based PowerShell
version comparison, and the gh attestation verify call. A runtime bug
in any of those paths would not be caught by CI.

`--skip-attestation` was passed intentionally because v0.17.1 predates
attestation support — running without it hits the pre-flight and
rejects. But that's the point: the REJECTION path is a real, valid end
state we can assert against. The previous test conflated "install
should succeed" with "test should pass"; the fix is to assert the
correct behavior for an old version.

Added a new CI step that runs `install.cmd v0.17.1 --verify-attestation`
via Start-Process with stderr redirection to a temp file, then asserts:
  - exit code != 0 (pre-flight rejected)
  - stderr contains "predates" (rejection came from our guard, not
    some other failure mode like a network error or gh missing)

This exercises on a real cmd.exe:
  - setlocal enabledelayedexpansion parser under the guard
  - three-layer resolution reaching the CLI flag layer
  - the :~1 substring (instead of the previous :v= global substitution)
  - the pre-release tag detection (negative path for stable tags)
  - the PowerShell shell-out with $env:TAG_NUM / $env:MIN_NUM
  - the [version] -ge comparison returning false
  - the "predates" error message block

Can't test the success path (valid attested release) until the first
post-merge release exists. Tracked for follow-up.

## Finding 2 (nit): !TAG:v=! is a global substitution, not anchored

cmd's delayed-expansion string-substitution syntax `!VAR:str=repl!`
replaces every occurrence of `str` globally. For all current semver
tags (vX.Y.Z) this happens to strip exactly one `v` by coincidence.
A hypothetical future tag like v1.0.0-rev2 would become 1.0.0-re2,
which [System.Version] can't parse, silently misclassifying the
failure as "predates attestation support" (see Finding 3).

install.ps1 line 121 uses `-replace '^v', ''` which is properly
regex-anchored. install.cmd had no anchored equivalent.

Fixed by using `!TAG:~1!` — substring from index 1 — which drops
exactly the first character. Safe because TAG is guaranteed to start
with `v` by the normalization step upstream (line ~141).

## Finding 3 (nit): Pre-release tags misdiagnosed on Windows

[System.Version] doesn't support semver prerelease or build-metadata
suffixes (e.g. v0.18.0-rc1). It throws on any `-` in the version
string. The catch blocks in both Windows installers handled the
throw but surfaced wrong/confusing errors:

  install.sh: handles prereleases correctly via `sort -V` (POSIX
    version sort is semver-aware) — no issue.
  install.ps1: caught and printed "Could not parse version tags for
    provenance check" — accurate but doesn't explain WHY.
  install.cmd: swallowed silently, VERSION_OK stayed empty, printed
    "predates attestation support" — actively wrong, the problem
    isn't the version's age.

Fixed in both Windows installers by detecting `-` in the tag BEFORE
attempting the [version] cast:

  install.ps1: `if ($latestTag -match '-')` → dedicated error
  install.cmd: `if not "!TAG_NUM!"=="!TAG_NUM:-=!"` (native
    substitution check, no subshell, no metacharacter risk)

Both emit a clear "pre-release tags aren't currently supported for
provenance verification on Windows" message pointing users at
--skip-attestation or a stable tag. Windows has no built-in semver
comparator; adopting one would require NuGet or a custom parser.
Explicit rejection with honest diagnosis is the pragmatic choice.

## Tests

Three new regression guards in install.test.ts:

  1. `install.cmd strips leading v via substring, not global
     substitution` — asserts `!TAG:~1!` is present and `!TAG:v=!`
     is gone.

  2. `both Windows installers reject pre-release tags with a
     dedicated error` — asserts both scripts contain the
     "Pre-release tags" error message and the appropriate
     detection pattern for their dialect.

  3. The new test.yml CI step doubles as a runtime regression
     guard — any break in the cmd pre-flight path that no longer
     matches "predates" in stderr, or returns 0, fails CI.

42 install tests pass (was 40). Windows CI will now exercise the
pre-flight rejection path end-to-end for the first time.

For provenance purposes, this commit was AI assisted.

* fix: cycle-10 review — split attest job, assert binary preservation, misc

PR #512 cycle 10 raised four findings, all verified.

## Finding 1: id-token/attestations permissions granted to build on PRs

The build job in release.yml had `id-token: write` and
`attestations: write` at the job level with no conditional guard.
On PR triggers, those permissions were live for every build step
(checkout, bun install, bun build, compile) even though the
attestation step itself was gated by `if: startsWith(github.ref,
'refs/tags/')`. Narrow-but-real attack surface: a trusted
contributor's malicious PR injecting code into a build step could
mint an OIDC token authenticating as the repo identity. Fork PRs
are automatically protected (GitHub suppresses OIDC tokens on
forks), but same-repo contributor compromise is a realistic risk
in a project with external contributors.

Fixed by splitting attestation into its own job:

  build:   contents: read only. Runs on all triggers. Compiles
           binaries and uploads them as the `binaries` artifact.
           No OIDC capability anywhere in the job.

  attest:  needs: build, if: tag push only. contents: read +
           id-token: write + attestations: write. Downloads the
           binaries artifact and runs attest-build-provenance.
           Permissions are only live when we're actually producing
           an attestation — never on PR dry-runs.

  release: needs: attest (was: needs: build). Still tag-only. The
           dependency chain guarantees the attestation exists in
           the GitHub attestation store before the release's
           binaries are published, closing the race window where a
           user could pull the binary and gh attestation verify
           would fail because the bundle hadn't propagated yet.

  npm-publish: unchanged. Still needs: build. Still has id-token:
           write for `npm publish --provenance`. The reviewer
           flagged only the build job; npm-publish's id-token
           grant is scoped to that one job and is actually used by
           the provenance flag.

## Finding 2: CI test promised a binary-preservation check but didn't do one

The `Attestation pre-flight rejects v0.17.1` step contained a
multi-line comment promising to verify the rejected run didn't
overwrite the previously-installed binary. No assertion code
followed — just a Write-Host success line. The test claimed
more than it delivered.

Added actual baseline capture + comparison:
  - Before running the rejection test, capture the binary's
    SHA256 and LastWriteTime from the prior Gemini-merge step.
  - After the rejection, recompute both and assert they match.
  - Any drift throws: catches future regressions that re-introduce
    the post-download pre-flight pattern (the pre-flight correctly
    rejects but only after downloading and overwriting the file).

## Finding 3: install.ps1 dead-code comment about flag precedence

Line 111 read "-SkipAttestation beats -VerifyAttestation if both
passed" but the upfront mutex guard (lines 13-16) exits 1 if both
flags are present. The "beats" scenario is unreachable. The
comment misleads a future reader into thinking the late ordering
handles the mutual exclusion and is safe to remove the early
guard — which would be backwards.

Replaced with a comment that explicitly notes the mutex guard at
the top of the script makes the two branches mutually exclusive
by construction.

## Finding 4: install.sh `cd` inside `&&` condition leaked CWD on failure

The skills-install block chained `git clone ... && cd ... && git
sparse-checkout set ...`. If clone succeeded but sparse-checkout
failed, the short-circuit skipped the `cd -` and `rm -rf
"$skills_tmp"` later ran with the shell's CWD still inside the
to-be-deleted directory. On Linux/macOS this silently "works" —
the inode is unlinked but the process keeps its cwd reference —
so nothing visibly breaks (all downstream code uses absolute
paths). But it's structurally wrong: install.ps1 and install.cmd
both use Push-Location/pushd for the same logic.

Restructured to run the entire clone → sparse-checkout → verify
→ copy sequence inside a single `(...)` subshell, with `cd`s
scoped to the subshell. The parent shell's CWD is unchanged
regardless of which step fails, so the subsequent `rm -rf`
always runs from a stable location. Any failure in the chain
short-circuits to the else branch with a clean skip message.
Also merged the two `[ -d ]` / `[ ls -A ]` guards into the
chain so the "apps/skills empty" case is now reported in the
skip message rather than being silently suppressed.

42 install tests pass.

For provenance purposes, this commit was AI assisted.

* fix(install): set MIN_ATTESTED_VERSION to v0.17.2, remove skill bump note

Earlier cycles hardcoded MIN_ATTESTED_VERSION="v0.18.0" across the
three installers as a best-guess for the first post-merge release,
and I added a one-time bump instruction to the release skill as
insurance in case the guess was wrong.

The guess was wrong — the next release is v0.17.2 (patch bump,
not a minor bump). Updated the constant in all three installers and
the matching test assertions. No other version references in the
shipped error messages need changing because they read MIN_ATTESTED_VERSION
from the variable at runtime.

Also removed the "⚠️ One-time MIN_ATTESTED_VERSION bump" section
from .agents/skills/release/SKILL.md entirely. With the constant
now set to the actual next release tag, there's nothing for the
release agent to bump at release time — the constant is already
correct. Baking a one-time action into a recurring release skill
was the wrong place for it; every future release agent would read
the warning, confirm it's already set, and move on. Noise in a
workflow that's supposed to be tight.

If the next release version ever differs from v0.17.2 (e.g. we
decide to skip to v0.18.0 or go straight to v1.0.0), the PR cutting
that release will need to update MIN_ATTESTED_VERSION in the three
installers. That's an ad-hoc fix, not a recurring skill concern.

Smoke test with the new value:
  - install.sh --version v0.17.1 --verify-attestation → rejects
    with "first attested release is v0.17.2"
  - install.sh --version v0.17.2 --verify-attestation → passes
    pre-flight, proceeds to download (404 as expected since
    v0.17.2 is not yet released)

42 install tests pass.

For provenance purposes, this commit was AI assisted.

* feat(release): ship native ARM64 Windows binaries

Bun v1.3.10 (February 2025) promoted bun-windows-arm64 from preview to
a stable cross-compile target, which makes native ARM64 Windows builds
a 15-line change instead of a project. Adopted immediately so ARM64
Windows users get native-speed binaries instead of the x86-64
emulation tax.

Earlier cycles of this PR shipped two temporary workarounds for the
absence of a native ARM64 binary:

  - install.ps1 detected ARM64 and fell back to $arch="x64" with a
    Write-Host notice that the user was running via emulation.
  - install.cmd hardcoded PLATFORM=win32-x64 and let ARM64 hosts pass
    the arch check without differentiation.

Both are now obsolete and have been replaced with real architecture
detection that selects the native binary.

## Changes

release.yml: Added `bun-windows-arm64` to the compile matrix for
both apps/hook/server/index.ts and apps/paste-service/targets/bun.ts.
Output files are plannotator-win32-arm64.exe and
plannotator-paste-win32-arm64.exe with matching .sha256 sidecars.
Upload-artifact already globs `plannotator-*` so no change there.

release.yml attest step: Added the two new ARM64 binaries to
subject-path so they're covered by the SLSA build provenance
attestation alongside the x64 builds. Both binaries sign with the
same Sigstore bundle as the rest of the matrix.

install.ps1: Restored the proper ARM64 detection that the earlier
fallback replaced. On 64-bit Windows, $arch is "arm64" when
PROCESSOR_ARCHITECTURE equals "ARM64", otherwise "x64". The
emulation-fallback Write-Host notice is gone — users now get
native binaries and don't need to be told about emulation.

install.cmd: Replaced the unconditional `set "PLATFORM=win32-x64"`
with a set of conditional assignments keyed off PROCESSOR_ARCHITECTURE
and PROCESSOR_ARCHITEW6432 (the latter covers the edge case of a
32-bit tool launching install.cmd on an ARM64 machine via WoW64).
PLATFORM is left empty if neither variable indicates AMD64 or ARM64,
which triggers the "does not support 32-bit Windows" error path.
The :arch_valid label and its gotos are gone — the new logic is
linear and doesn't need a label.

install.test.ts: Updated the install.ps1 ARM64 test to assert the
native arm64 branch (no more "runs via emulation" text) and added a
new install.cmd test verifying both PLATFORM branches are present.
43 install tests pass (was 42).

## CI coverage caveat

windows-latest is x86-64, so the Windows integration job still
exercises install.cmd against the x64 binary path. ARM64 has no CI
runner coverage yet — we're shipping ARM64 binaries on trust that
Bun's cross-compile produces working executables. That's the same
trust we extend to linux-arm64 builds (also x-compiled from an
ubuntu-latest runner). GitHub Actions does offer a windows-11-arm
runner that could be added later; tracked as follow-up since it has
availability and pricing implications.

Closes #517.

For provenance purposes, this commit was AI assisted.

* fix(install.ps1): detect ARM64 host through WoW64 too, matching install.cmd

Self-review catch on top of the ARM64 support commit. My install.ps1
architecture detection only checked \$env:PROCESSOR_ARCHITECTURE, which
reports the architecture the CURRENT PowerShell process is running
under — not the host architecture. On ARM64 Windows, a 32-bit
PowerShell process (rare, but possible) would see
PROCESSOR_ARCHITECTURE=X86, miss the "ARM64" branch, fall through to
\$arch = "x64", and download the emulated x64 binary instead of the
new native arm64 build.

install.cmd already handles this correctly via PROCESSOR_ARCHITEW6432,
which is set only in 32-bit WoW64 processes and holds the host
architecture. install.ps1 was the odd one out.

Fixed by checking PROCESSOR_ARCHITEW6432 first and falling back to
PROCESSOR_ARCHITECTURE. Now both Windows installers follow the same
detection logic regardless of process bitness. Also added an explicit
error branch for unrecognized architectures (anything that isn't AMD64
or ARM64) instead of silently assuming x64.

Test updated to assert both env vars are referenced.

For provenance purposes, this commit was AI assisted.

* fix(install): cycle-12 review — consistency test, dead code, finally, docs

Four findings addressed. Two findings rejected.

## Finding 1 (nit): MIN_ATTESTED_VERSION triplicated without CI consistency

Added a cross-file consistency test in install.test.ts that extracts
the version literal from each of install.sh, install.ps1, install.cmd
via regex and asserts all three match. A future bump that updates
only one or two files now fails CI loudly. The per-file tests still
exist (they check each file contains the current literal), but the
new test catches drift where each file is internally consistent with
itself but differs from the others.

## Finding 4 (nit): Write-Error + exit 1 dead code in install.ps1

Verified against the actual file: $ErrorActionPreference = "Stop" is
set at line 8 and never modified. All six Write-Error sites are dead-
end paths — five outside any try/catch, one inside a catch block
(line 147) where Write-Error raises a new terminating error that
propagates past the catch and exits the script with code 1 (PowerShell
default). The `exit 1` lines that followed were never reachable.

Dropped the six unreachable `exit 1` lines. Added a comment at the
first occurrence explaining the Stop + Write-Error semantics so
future maintainers don't re-add them. Behavior is unchanged at
runtime — every error path still exits with code 1 via PowerShell's
default unhandled-terminating-error handling.

## Finding 5 (nit): Pop-Location not in finally block

Verified the reviewer's claim in install.ps1 lines 384-403. The
skills install wraps git clone, Push-Location, and Copy-Item calls
in a single try block, with Pop-Location on the success path. If
Copy-Item throws under ErrorActionPreference=Stop, catch runs
without popping, and the subsequent Remove-Item deletes a directory
the PowerShell location stack still points into.

A naive `finally { Pop-Location }` would introduce a new bug:
Pop-Location throws on an empty stack, which happens when git
clone silently fails and Push-Location is never reached. Used a
nested-try pattern instead:

  try {
      git clone ...                    # native, no throw
      if (Test-Path "$skillsTmp\repo") {   # guard against clone failure
          Push-Location "$skillsTmp\repo"
          try {
              ...operations...
          } finally {
              Pop-Location                 # always runs IF pushed
          }
      }
  } catch {
      Write-Host "Skipping..."
  }

Traced all four failure modes:
  - clone fails silently → repo dir missing → skip inner block → no
    push, no pop → clean exit
  - clone succeeds → push succeeds → operations fail → finally pops
    → outer catch fires
  - clone + push + operations all succeed → finally pops cleanly
  - push itself throws (permissions) → outer catch fires, nothing
    to pop

## Finding 6 (P1): CMD/ps1 ARM64 breaks pinned pre-v0.17.2 tags

The original plan was a runtime x64-fallback on 404, but the simpler
product-level framing is: v0.17.2 is the first fully-supported version
for pinning. Pre-v0.17.2 tags predate native ARM64 Windows (no
win32-arm64 asset exists) and predate attestation support (pre-flight
rejects). Users pinning to older tags are outside the supported
matrix; the failure modes are explicit (404 / clean rejection), not
silent corruption.

Documented in the three install docs:
  - apps/marketing/.../installation.md: full "Supported versions"
    paragraph explaining the floor, what fails, and recovery paths
  - README.md: one-line note folded into the existing provenance
    sentence ("Version pinning, native ARM64 Windows, and SLSA
    provenance are supported from v0.17.2 onwards — see installation
    docs for details")
  - apps/hook/README.md: same tight one-liner pattern

README.md and apps/hook/README.md stay bloat-free; the canonical
explanation lives in the marketing docs.

## Findings rejected

- **Finding 2 (P3, sort -V misorders prereleases):** plannotator
  doesn't ship prerelease tags. A user pinning to a hypothetical
  vX.Y.Z-rc1 would 404 at the download step before the sort -V
  misordering matters. Moot in practice.

- **Finding 3 (important, sort -V is GNU-only):** FALSE POSITIVE.
  Tested on macOS 26.3.1 running sort 2.3-Apple (197) — both -V
  and --version-sort are supported and work correctly, including
  for prerelease suffixes. Apple forked BSD sort and added -V
  years ago. The reviewer's claim cites outdated reference
  material about historical BSD sort.

44 install tests pass (was 43).

For provenance purposes, this commit was AI assisted.

* test: anchor MIN_ATTESTED_VERSION consistency regexes to line start

Self-review catch: the cross-file consistency test added in the prior
commit matched the assignment form anywhere in each file. No current
comment triggers a false positive, but a future comment like
`# Example: MIN_ATTESTED_VERSION="v0.17.0"` would match first and
shadow the real assignment, causing the test to report the wrong
value or pass when it shouldn't.

Hardened by adding /m flag and ^ anchor. The real assignments in all
three installers are flush-left at the top of their files, so
requiring line-start is both safe (won't reject current code) and
stricter (future comments with leading whitespace or other prefixes
are ignored).

44 tests still pass.

For provenance purposes, this commit was AI assisted.

* fix: cycle-13 review — checksum cleanup leak + Gemini CI coverage

Two findings addressed. Two pre-existing findings flagged but not
in scope.

## Finding 3 (nit): CHECKSUM_FILE leak on download failure

install.cmd's checksum download error path deleted TEMP_FILE but
omitted CHECKSUM_FILE. curl -o creates the output file before it
receives data, so a network failure or HTTP error leaves a 0-byte
or partial file in %TEMP% that the script never cleans up. The
symmetric cleanup for TEMP_FILE elsewhere in the script makes this
an accidental omission, not an intentional design choice.

Added `if exist "!CHECKSUM_FILE!" del "!CHECKSUM_FILE!"` inside the
error block, matching the existing cleanup discipline.

## Finding 1 (nit): Windows CI readback misses Gemini .toml files

The `Verify Claude Code slash command files contain the shell-
invocation prefix` step in the Windows integration job verified
the three `.md` files at %USERPROFILE%\.claude\commands\ but not
the two `.toml` files at %USERPROFILE%\.gemini\commands\. Both
sets of files use the `^^!` cmd escape pattern that this PR added,
and a future regression that drops a `^` from the Gemini echoes
would slip past CI even though install.test.ts catches it
statically.

Extended the readback step to also verify
plannotator-review.toml and plannotator-annotate.toml contain the
`!{plannotator ...}` invocation form. Same regression class, same
guard, same runner — the earlier Gemini-merge fixture step
already seeds ~/.gemini/settings.json, which causes install.cmd's
Gemini block to fire and write the .toml files alongside the
Claude Code ones, so no additional setup is required.

## Findings rejected (out of scope, pre-existing)

- **install.cmd vs install.ps1 install location divergence:** cmd
  installs to %USERPROFILE%\.local\bin while ps1 installs to
  %LOCALAPPDATA%\plannotator. A user who switches between the two
  Windows installers ends up with hooks.json pointing at one
  location and an orphan binary at the other. Pre-existing
  structural divergence, requires picking a canonical location and
  migrating users on whichever installer changes. Out of scope
  for this PR.

- **install.sh Gemini merge throws on user's malformed JSON:** if
  ~/.gemini/settings.json is invalid JSON, the embedded `node -e`
  call exits non-zero, set -e propagates, and the install aborts
  mid-run after the binary is in place but before slash commands
  are written. Pre-existing — the Gemini block predates this PR.
  Worth a follow-up but not in scope here.

44 install tests pass.

For provenance purposes, this commit was AI assisted.

* docs: update stale v0.17.1 references in script comments to vX.Y.Z

Two cosmetic comment fixes flagged during the cycle-13 self-review.
The user-facing examples and docs were updated to vX.Y.Z in cycle 5,
but two inline code comments still referenced the old concrete version:

  - scripts/install.sh:129 — "Positional form: install.sh v0.17.1
    (matches install.cmd interface)"
  - scripts/install.cmd:71 — "Positional form: install.cmd v0.17.1
    (legacy interface)"

Both updated to vX.Y.Z so the in-code comments match the rest of the
documentation. No behavior change.

44 install tests pass.

For provenance purposes, this commit was AI assisted.

* docs(skill): update release skill platform/binary counts for ARM64 Windows

Two stale references in .agents/skills/release/SKILL.md after the
ARM64 Windows binaries were added:

- "5 platforms (macOS ARM64/x64, Linux x64/ARM64, Windows x64)"
  → "6 platforms (macOS ARM64/x64, Linux x64/ARM64, Windows x64/ARM64)"

- "Compiles paste service binaries (same 5 platforms)"
  → "Compiles paste service binaries (same 6 platforms)"

- "Generates SLSA build provenance attestations for all 10 binaries"
  → "Generates SLSA build provenance attestations for all 12 binaries"

The first two predate this PR; the third was added in the cycle-1
commit and not bumped when the ARM64 Windows targets landed in the
ARM64 commit. All three corrected together so the release agent
sees an internally-consistent description of what the pipeline
actually does.

Verified against release.yml — 12 entries in the attest job's
subject-path list, 12 compile commands in the build job, all six
platforms (macOS arm64/x64, Linux x64/arm64, Windows x64/arm64)
for both plannotator and paste-service.

For provenance purposes, this commit was AI assisted.
 2026-04-07 20:35:16 -07:00
Michael Ramos dd04e6b1cd feat: add Conventional Comments support to code review (#501) 
* feat: add Conventional Comments support to code review

Add structured label system based on the Conventional Comments spec
(conventionalcomments.org) to the code review annotation toolbar.

- Label picker with 9 default labels (suggestion, nit, question, issue,
  praise, thought, note, todo, chore) shown above the comment textarea
- Per-label blocking/non-blocking toggle for labels where severity is
  ambiguous (issue, suggestion, todo, chore)
- Labels exported as `**label** (decoration): text` in markdown feedback,
  naturally readable on GitHub and machine-parseable
- Label badges shown on inline annotations and sidebar cards
- Settings tab (Comments) with: master on/off toggle, editable label
  list with add/remove/rename, per-label blocking decorator toggle,
  educational intro with spec link and example output
- Feature is off by default, persisted via config store
- Custom labels supported via settings (up to 12)

For provenance purposes, this commit was AI assisted.

* fix(review): address conventional comments review feedback

Fix label clearing bug where editing an annotation to remove its
conventional label silently preserved the old value. Fix parseCCLabels
accepting 'non-blocking' as a truthy blocking value. Fix duplicate
custom label identities when adding multiple labels. Prepend
conventional prefix to platform PR/MR inline comments.

For provenance purposes, this commit was AI assisted.

* fix(server): persist conventionalComments setting to config.json

All six server config handlers (bun plan/review/annotate + pi
plan/review/annotate) now accept and save the conventionalComments
boolean, so the setting survives server restarts.

For provenance purposes, this commit was AI assisted.

* fix: add conventionalComments to server config round-trip

getServerConfig() was not returning the conventionalComments value
from config.json, so the setting silently reset to false on cookie
clear or new browser sessions. Also adds the field to the
PlannotatorConfig interface so saveConfig() is properly typed.

For provenance purposes, this commit was AI assisted.

* fix: label display, export, and draft persistence for conventional comments

- Remove slug derivation from label editing — store display text
  verbatim so badges and exports show what the user typed
- Emit conventional prefix in export even when annotation has no
  prose text (suggestion-only annotations were losing their label)
- Include conventionalLabel in draft save condition so label
  selection persists across file switches

For provenance purposes, this commit was AI assisted.

* fix: spec-compliant export format and empty label support

- Wrap label + decorations + colon in markdown bold per the
  Conventional Comments spec examples (was bolding only the label)
- Allow users to clear all labels — empty array no longer falls
  back to defaults in either the picker or the settings parser
- Enable blocking decorator on the question label by default; the
  spec permits blocking questions and they sometimes are critical

For provenance purposes, this commit was AI assisted.

* fix: server-sync conventionalLabels and small cleanups

- Sync conventionalLabels to ~/.plannotator/config.json so custom
  label configurations survive cookie clears and remote/SSH
  sessions, matching the persistence story for conventionalComments.
  Stored as a parsed array on disk; serialized as JSON string in
  the local config store to match the cookie format.
- Remove no-op intermediate variable in handleSubmitAnnotation;
  pass conventionalLabel/decorations directly with proper coalescing
  per call path (edit preserves null, add coalesces to undefined).
- Use index-prefixed key in the picker label list to avoid React
  warnings if duplicate labels ever exist.

For provenance purposes, this commit was AI assisted.
 2026-04-06 22:27:47 -07:00
Michael Ramos d710284020 chore: bump version to 0.17.1 
For provenance purposes, this commit was AI assisted.
 2026-04-06 18:14:11 -07:00
Michael Ramos 181d2a10d5 fix(pi): full PR review parity with Bun server (#503) 
## Summary

Full Pi PR review parity with Bun server, plus shared fixes and UI improvements.

### Pi PR Review (new)
- Parse PR/MR URLs, authenticate, fetch metadata and diff
- Create local worktree (same-repo) or shallow clone (cross-repo) for agent file access
- Full server parity: all 27 feature areas audited and aligned

### Shared Fixes (Bun + Pi)
- parseRemoteUrl: GitLab subgroup support, SSH+port, HTTPS non-standard port
- Cross-repo clone: --hostname replaced with GH_HOST/GITLAB_HOST env vars
- Cross-repo clone: shallow fetch depth 50 → 200
- Git Add button disabled in PR review mode (client-side)
- DiffViewer: eliminate dark flash on file switch (sync theme init)

### UI
- Resolved/Outdated toggle filters in PR comments tab

For provenance purposes, this commit was AI assisted.
 2026-04-06 18:06:38 -07:00
Michael Ramos 0e1ea9e363 fix(review): use merge-base SHA for PR file contents 
gh pr diff computes diffs against the merge-base (common ancestor), but
file contents were fetched at baseSha (base branch tip). When the base
branch has moved since the branch point, line counts don't match the
diff hunks, causing iterateOverDiff trailing context mismatch crashes.

Fetch the merge-base SHA via GitHub's compare API and use it for old
file contents. Added try/catch around processFile as a safety net.
Fixed in both Bun and Pi servers.

For provenance purposes, this commit was AI assisted.
 2026-04-06 13:05:30 -07:00