Workspace discovery follows symlinks since #1060, which means the walk can
leave the workspace root by design. A link into a huge unrelated tree was
enumerated synchronously before the server bound its port, hanging startup
with no output. The walk now shares the PLANNOTATOR_FILE_BROWSER_MAX_FILES
budget: it visits at most that many directories and returns what it found.
Symlinked repos are still discovered under the default budget.
Claude-Session: https://claude.ai/code/session_01YXkgsNucxDwAL4GdR4XYRk
Adds a first-class artifact gallery and annotation workflow for GitHub pull requests and GitLab merge requests, including images, GIFs, video timestamps, rendered HTML, Markdown, provenance-aware feedback, authenticated provider resources, and reliable CDN/media handling.
Adds current-architecture GitButler workspace, stack, and branch review support across Bun and Pi while preserving the existing Git, JJ, and P4 paths.
Co-authored-by: Dan Susman <56033661+dansusman@users.noreply.github.com>
* feat(server): support bounded port ranges
* fix(server): harden bounded port retries
* fix(server): preserve non-range port behavior
---------
Co-authored-by: Michael Ramos <mdramos8@gmail.com>
* fix(server): return JSON 404 for unknown /api/* routes instead of HTML
All three servers (plan, review, annotate) serve the SPA HTML for any
unmatched route. This means hitting /api/nonexistent returns the full
HTML page with 200 OK — confusing for API clients and wasteful.
Now unknown /api/* paths get a proper JSON 404 response before the SPA
fallback kicks in. Non-API paths (like /some/random/path) still serve
HTML for SPA routing as before.
Tested on all three server types.
* fix(server): guard unknown API routes across runtimes
---------
Co-authored-by: buihongduc132 <buihongduc132@gmail.com>
Co-authored-by: Michael Ramos <mdramos8@gmail.com>
Use one shared Light/Dark/System registry across review, plan, annotate, Settings, and published UI consumers. Preserve the public Mode contract, scope wider menu geometry to theme pickers, and keep constrained palettes coherent in rendering and previews.
Co-authored-by: Vladyslav Hrabovyi <vladyslav.hrabovyii@gmail.com>
Co-authored-by: sasha <kredich05@gmail.com>
Use literal light and dark colors at the Mermaid themeVariables boundary while preserving OKLCH for ordinary page CSS.
Add a real Mermaid 11 light/dark render guard and block delivery on empty or error SVG output.
Co-authored-by: FND <fndevve@proton.me>
* fix(ui): keep Ask AI input visible after responses
Long completed responses caused the h-full chat flex item to retain its automatic minimum height, pushing the follow-up composer below the sidebar viewport. Let the panel consume the remaining flex space with min-h-0 so only the message area scrolls.
* chore: remove Ask AI browser harness
* fix(server): bound startup file discovery (#978)
* test: observe the server's own warm cache key so the ordering tests actually pin the fix
Review finding: both bind-before-warm ordering tests raced against
observeWarmState(projectRoot), but on macOS mkdtempSync returns /var/...
while the chdir'd server warms under the realpath /private/var/... —
a different warmFileListCache key. The tests therefore raced a FRESH
warm (always pending at observation time) and passed on the OLD broken
code too. Observing process.cwd() inside onReady uses the server's real
key. Verified: with old resolve-file/server code checked out, all four
ordering tests now fail; on the fix they pass (17/17 across both files).
Claude-Session: https://claude.ai/code/session_01SFy9fY27SA8g5BtotWPi1G
Fixes for the three-agent adversarial sweep findings:
- reference-handlers.ts: seed the user's modified/untracked files BEFORE
the bulk walk — the 5000-file cap (d3c9de1e) filled in raw readdir order
and could silently drop the exact files the user just edited from the
annotate browser (and the truncated latch broke the merge loop on its
first iteration).
- opencode commands.ts: pass `project` to startAnnotateServer at both
call sites (annotate + annotate-last) via detectProjectName, matching
the hook and Pi runtimes — OpenCode annotate history no longer lands in
the shared "_unknown" bucket.
- App.tsx: the Alt-Alt destination double-tap now dismisses the
DestinationSpotlight — the coachmark advertised that exact gesture but
its own keydown handler deliberately ignores modifiers, so performing
the tip left the dim overlay stranded.
- annotate.ts + pi mirror: degradation notice now reads "warning: annotate
history unavailable" so OpenCode's logCliWarnings forwarder (which
filters on \bwarn(ing)?\b) actually surfaces it.
- cli-bridge.ts: a rejected showToast un-marks the URL (the other delivery
path can retry) and logs the failure instead of being fully silent.
- test.yml: register packages/editor/editableDocumentsHook.test.tsx (7
draft/conflict tests, DOM-gated since #936, never ran in CI). Repo-wide
sweep confirms all 19 DOM-gated test files are now registered.
Gates: DOM batch 102/0 across 19 files, review+server 507/0, opencode 70/0,
install harness 85/0, full typecheck incl. strict-consumer, review build OK.
Claude-Session: https://claude.ai/code/session_01SFy9fY27SA8g5BtotWPi1G
Adversarial QA findings. (1) install.ps1 and install.cmd spliced the
absolute exe path UNQUOTED into the generated hooks.json commands — any
Windows user with a space in their profile path (C:\Users\John Smith\...)
got hook commands that word-split when the hook shell runs them, so plan
review silently never intercepted (install.sh is immune: it writes the
PATH-resolved bare name). Both hook commands in both installers now wrap
the path in JSON-escaped quotes, pinned by updated harness assertions.
(2) install.cmd still carried 32 em-dashes + 2 ellipses — several in
user-facing echo lines — which render as mojibake on cmd.exe's default
non-UTF-8 codepages; #1021 fixed exactly this class in install.ps1 but
left cmd untouched. Full ASCII purge, with a new ASCII-only regression
test mirroring the ps1 one. Harness: 85 pass / 0 fail.
Claude-Session: https://claude.ai/code/session_01SFy9fY27SA8g5BtotWPi1G
Adversarial self-review findings on 1f7d08f5: (1) the cutout was measured
once + on window resize only, so async header siblings (platform error
banner, partial-diff notice) shifting the destination button left the ring
on empty space — now also re-measured on a 250ms interval while the
transient overlay is up. (2) The capture-phase Escape handler plus the z-90
click-trap could strand a keyboard-opened surface (search at z-50) dimmed
and unclickable underneath — now ANY non-modifier keypress dismisses the
spotlight, with only Escape stopping propagation (topmost-overlay
semantics); shortcuts proceed and their surfaces never open under the dim.
(3) "a MR" → "an MR" for GitLab via a vowel-sound article check.
Claude-Session: https://claude.ai/code/session_01SFy9fY27SA8g5BtotWPi1G
Self-review hardening of e5fcc415: the hey-api SDK returns {error} for HTTP
failures (404 on pre-toast hosts is safe), but a fetch-level failure (host
server restarting) REJECTS the promise, and `void promise` doesn't catch
that. Both toast call sites now .catch(() => {}) when the result is
thenable, so the cosmetic toast path is strictly quieter than the
surrounding app.log pattern.
Claude-Session: https://claude.ai/code/session_01SFy9fY27SA8g5BtotWPi1G
QA probe: with PLANNOTATOR_DATA_DIR on a read-only mount, `plannotator
annotate file.md` crashed before the UI opened — twice. (1) #961's
saveToHistory call on annotate open was unguarded, so the new version-diff
enhancement gated startup that was stateless at v0.22.0; now wrapped
(both the Bun server and the Pi mirror) and degrades to no-version-diff
with a stderr notice. (2) registerSession's mkdir/writeFileSync (pre-existing
since #795) threw after the server was already listening; the session
registry only powers `plannotator sessions` discovery, so it is now
best-effort, and unregisterSession/listSessions tolerate an unwritable
sessions dir too. Verified: read-only data dir now starts, serves
/api/plan with no versionInfo, and prints the session URL.
Claude-Session: https://claude.ai/code/session_01SFy9fY27SA8g5BtotWPi1G
First-time PR reviewers get a driver.js-style coachmark (zero new
dependencies: rounded cutout + oversized box-shadow dim, portaled to body)
pointing at the header's Agent/GitHub destination dropdown, explaining that
feedback can post to the PR or go to the agent session and can be switched
at any time (Alt Alt). Cookie-gated one-time flag
(plannotator-review-dest-spotlight-seen, versioned) mirroring the
guide-intro/review-setup gates. Renders strictly after the first-run dialog
chain (guide intro → look-and-feel → review setup) has cleared and only in
PR mode; opening the destination menu organically also marks it seen.
Escape/click-anywhere/Got-it dismiss. GitLab-aware copy via
platformLabel/mrLabel.
Claude-Session: https://claude.ai/code/session_01SFy9fY27SA8g5BtotWPi1G
QA traced the repeatedly-regressed remote-URL invariant to its root cause on
OpenCode: every URL path (logPlannotatorReady, the cli-bridge stderr
forwarder, and the ready-file poller) funneled exclusively through
client.app.log, which OpenCode documents as "write a log entry to the server
logs" — it is never rendered in the TUI. Remote users therefore never saw
the session URL. All three paths now ALSO call tui.showToast (the SDK's
visible surface), best-effort with optional chaining so older hosts without
/tui/show-toast no-op. A shared per-run toastedUrls set dedupes the stderr
and ready-file deliveries so one session never stacks two toasts.
Also: recognize the current binary's "Plannotator session ready" stderr
phrasing in formatUserFacingCliStderrLine (the old "Open this link" match no
longer fires; only the bare-URL line was being forwarded), and add
data-print-hide to the resize-handle cursor tooltip portal so print.css hides
it (QA print-clipping finding).
Claude-Session: https://claude.ai/code/session_01SFy9fY27SA8g5BtotWPi1G
QA audit found four DOM-gated test files added since v0.22.0 (srcdoc,
InlineMarkdown.resolveLinkedDoc, MarkdownDiff.frozen,
MarkdownEditor.extensions) that self-skip under plain `bun test` and were
never added to the DOM_TESTS batch — so the mounted-seam contracts for the
published markdown-editor/atomic-editor packages ran nowhere in CI. Also
registers components/sidebar/FileBrowser.test.ts (pre-existing gap; its new
filtering tests from 1267cd50 were equally unexercised). All 5 files pass
locally: 40 tests, 0 fail.
Claude-Session: https://claude.ai/code/session_01SFy9fY27SA8g5BtotWPi1G
The launchable-jobs Codex catalog (review jobs, tour, guide, GuideEmptyState)
is a hardcoded list, so yesterday's GPT-5.6 release was missing from the
selectors. Ask AI needs no change — the codex-app-server provider discovers
models dynamically via model/list. The server passes -m through verbatim
(codex-review.ts), so the catalog addition is the complete fix. Defaults stay
on gpt-5.5. Also relocks bun.lock's workspace entry for ui 0.28.0 (missed in
the bump commit).
Claude-Session: https://claude.ai/code/session_01SFy9fY27SA8g5BtotWPi1G
The CommentPopover focus effect scheduled a setTimeout(0) keyed on [mode],
but in popover mode the textarea only renders after `position` is measured
by a later effect. Whether the 0ms timer fires before or after that commit
is engine-dependent task ordering: Chromium commits the re-render first, so
focus lands; WebKit fires the timer first, so textareaRef.current is still
null and the comment editor opens unfocused (reproduced in a WKWebView host
— the glimpseui integration — where users had to tab or click into the
field for every annotation).
Focus from a ref callback on the textarea instead: it runs exactly when the
element mounts, so there is nothing to race. Mode switches (popover/dialog)
still refocus because the textarea remounts. The deferred focus and
caret-to-end behavior are preserved; isConnected guards the popover closing
before the timer fires.
fetchModels() built the dropdown label from the model name alone,
so models with identical names from different providers (e.g.
deepseek-v4-pro via DeepSeek vs. via OpenRouter) were indistinguishable
in the UI even though their ids were already unique.
Fixes#988
Since Claude Code 2.1.199, a PermissionRequest "allow" decision for
ExitPlanMode is silently discarded unless it echoes updatedInput, because
ExitPlanMode requires user interaction and is not an MCP tool. The CLI then
falls back to its built-in approval dialog, so clicking Approve in the
Plannotator UI never returned control to the agent session (deny was
unaffected). This matches the reported behavior on 2.1.199 through 2.1.202.
Echo the original tool_input (in scope as event.tool_input) as updatedInput
in the Claude Code allow decision. Backward compatible: older Claude Code
versions treat the echoed input as unchanged (verified no-op on 2.1.198).
Fixes#995
Michael Ramos