Workspace discovery follows symlinks since #1060, which means the walk can
leave the workspace root by design. A link into a huge unrelated tree was
enumerated synchronously before the server bound its port, hanging startup
with no output. The walk now shares the PLANNOTATOR_FILE_BROWSER_MAX_FILES
budget: it visits at most that many directories and returns what it found.
Symlinked repos are still discovered under the default budget.
Claude-Session: https://claude.ai/code/session_01YXkgsNucxDwAL4GdR4XYRk
Adds a first-class artifact gallery and annotation workflow for GitHub pull requests and GitLab merge requests, including images, GIFs, video timestamps, rendered HTML, Markdown, provenance-aware feedback, authenticated provider resources, and reliable CDN/media handling.
Adds current-architecture GitButler workspace, stack, and branch review support across Bun and Pi while preserving the existing Git, JJ, and P4 paths.
Co-authored-by: Dan Susman <56033661+dansusman@users.noreply.github.com>
* feat(server): support bounded port ranges
* fix(server): harden bounded port retries
* fix(server): preserve non-range port behavior
---------
Co-authored-by: Michael Ramos <mdramos8@gmail.com>
* fix(server): return JSON 404 for unknown /api/* routes instead of HTML
All three servers (plan, review, annotate) serve the SPA HTML for any
unmatched route. This means hitting /api/nonexistent returns the full
HTML page with 200 OK — confusing for API clients and wasteful.
Now unknown /api/* paths get a proper JSON 404 response before the SPA
fallback kicks in. Non-API paths (like /some/random/path) still serve
HTML for SPA routing as before.
Tested on all three server types.
* fix(server): guard unknown API routes across runtimes
---------
Co-authored-by: buihongduc132 <buihongduc132@gmail.com>
Co-authored-by: Michael Ramos <mdramos8@gmail.com>
Use one shared Light/Dark/System registry across review, plan, annotate, Settings, and published UI consumers. Preserve the public Mode contract, scope wider menu geometry to theme pickers, and keep constrained palettes coherent in rendering and previews.
Co-authored-by: Vladyslav Hrabovyi <vladyslav.hrabovyii@gmail.com>
Co-authored-by: sasha <kredich05@gmail.com>
* fix(ui): keep Ask AI input visible after responses
Long completed responses caused the h-full chat flex item to retain its automatic minimum height, pushing the follow-up composer below the sidebar viewport. Let the panel consume the remaining flex space with min-h-0 so only the message area scrolls.
* chore: remove Ask AI browser harness
* fix(server): bound startup file discovery (#978)
* test: observe the server's own warm cache key so the ordering tests actually pin the fix
Review finding: both bind-before-warm ordering tests raced against
observeWarmState(projectRoot), but on macOS mkdtempSync returns /var/...
while the chdir'd server warms under the realpath /private/var/... —
a different warmFileListCache key. The tests therefore raced a FRESH
warm (always pending at observation time) and passed on the OLD broken
code too. Observing process.cwd() inside onReady uses the server's real
key. Verified: with old resolve-file/server code checked out, all four
ordering tests now fail; on the fix they pass (17/17 across both files).
Claude-Session: https://claude.ai/code/session_01SFy9fY27SA8g5BtotWPi1G
Fixes for the three-agent adversarial sweep findings:
- reference-handlers.ts: seed the user's modified/untracked files BEFORE
the bulk walk — the 5000-file cap (d3c9de1e) filled in raw readdir order
and could silently drop the exact files the user just edited from the
annotate browser (and the truncated latch broke the merge loop on its
first iteration).
- opencode commands.ts: pass `project` to startAnnotateServer at both
call sites (annotate + annotate-last) via detectProjectName, matching
the hook and Pi runtimes — OpenCode annotate history no longer lands in
the shared "_unknown" bucket.
- App.tsx: the Alt-Alt destination double-tap now dismisses the
DestinationSpotlight — the coachmark advertised that exact gesture but
its own keydown handler deliberately ignores modifiers, so performing
the tip left the dim overlay stranded.
- annotate.ts + pi mirror: degradation notice now reads "warning: annotate
history unavailable" so OpenCode's logCliWarnings forwarder (which
filters on \bwarn(ing)?\b) actually surfaces it.
- cli-bridge.ts: a rejected showToast un-marks the URL (the other delivery
path can retry) and logs the failure instead of being fully silent.
- test.yml: register packages/editor/editableDocumentsHook.test.tsx (7
draft/conflict tests, DOM-gated since #936, never ran in CI). Repo-wide
sweep confirms all 19 DOM-gated test files are now registered.
Gates: DOM batch 102/0 across 19 files, review+server 507/0, opencode 70/0,
install harness 85/0, full typecheck incl. strict-consumer, review build OK.
Claude-Session: https://claude.ai/code/session_01SFy9fY27SA8g5BtotWPi1G
Adversarial self-review findings on 1f7d08f5: (1) the cutout was measured
once + on window resize only, so async header siblings (platform error
banner, partial-diff notice) shifting the destination button left the ring
on empty space — now also re-measured on a 250ms interval while the
transient overlay is up. (2) The capture-phase Escape handler plus the z-90
click-trap could strand a keyboard-opened surface (search at z-50) dimmed
and unclickable underneath — now ANY non-modifier keypress dismisses the
spotlight, with only Escape stopping propagation (topmost-overlay
semantics); shortcuts proceed and their surfaces never open under the dim.
(3) "a MR" → "an MR" for GitLab via a vowel-sound article check.
Claude-Session: https://claude.ai/code/session_01SFy9fY27SA8g5BtotWPi1G
QA probe: with PLANNOTATOR_DATA_DIR on a read-only mount, `plannotator
annotate file.md` crashed before the UI opened — twice. (1) #961's
saveToHistory call on annotate open was unguarded, so the new version-diff
enhancement gated startup that was stateless at v0.22.0; now wrapped
(both the Bun server and the Pi mirror) and degrades to no-version-diff
with a stderr notice. (2) registerSession's mkdir/writeFileSync (pre-existing
since #795) threw after the server was already listening; the session
registry only powers `plannotator sessions` discovery, so it is now
best-effort, and unregisterSession/listSessions tolerate an unwritable
sessions dir too. Verified: read-only data dir now starts, serves
/api/plan with no versionInfo, and prints the session URL.
Claude-Session: https://claude.ai/code/session_01SFy9fY27SA8g5BtotWPi1G
First-time PR reviewers get a driver.js-style coachmark (zero new
dependencies: rounded cutout + oversized box-shadow dim, portaled to body)
pointing at the header's Agent/GitHub destination dropdown, explaining that
feedback can post to the PR or go to the agent session and can be switched
at any time (Alt Alt). Cookie-gated one-time flag
(plannotator-review-dest-spotlight-seen, versioned) mirroring the
guide-intro/review-setup gates. Renders strictly after the first-run dialog
chain (guide intro → look-and-feel → review setup) has cleared and only in
PR mode; opening the destination menu organically also marks it seen.
Escape/click-anywhere/Got-it dismiss. GitLab-aware copy via
platformLabel/mrLabel.
Claude-Session: https://claude.ai/code/session_01SFy9fY27SA8g5BtotWPi1G
QA traced the repeatedly-regressed remote-URL invariant to its root cause on
OpenCode: every URL path (logPlannotatorReady, the cli-bridge stderr
forwarder, and the ready-file poller) funneled exclusively through
client.app.log, which OpenCode documents as "write a log entry to the server
logs" — it is never rendered in the TUI. Remote users therefore never saw
the session URL. All three paths now ALSO call tui.showToast (the SDK's
visible surface), best-effort with optional chaining so older hosts without
/tui/show-toast no-op. A shared per-run toastedUrls set dedupes the stderr
and ready-file deliveries so one session never stacks two toasts.
Also: recognize the current binary's "Plannotator session ready" stderr
phrasing in formatUserFacingCliStderrLine (the old "Open this link" match no
longer fires; only the bare-URL line was being forwarded), and add
data-print-hide to the resize-handle cursor tooltip portal so print.css hides
it (QA print-clipping finding).
Claude-Session: https://claude.ai/code/session_01SFy9fY27SA8g5BtotWPi1G
The launchable-jobs Codex catalog (review jobs, tour, guide, GuideEmptyState)
is a hardcoded list, so yesterday's GPT-5.6 release was missing from the
selectors. Ask AI needs no change — the codex-app-server provider discovers
models dynamically via model/list. The server passes -m through verbatim
(codex-review.ts), so the catalog addition is the complete fix. Defaults stay
on gpt-5.5. Also relocks bun.lock's workspace entry for ui 0.28.0 (missed in
the bump commit).
Claude-Session: https://claude.ai/code/session_01SFy9fY27SA8g5BtotWPi1G
The CommentPopover focus effect scheduled a setTimeout(0) keyed on [mode],
but in popover mode the textarea only renders after `position` is measured
by a later effect. Whether the 0ms timer fires before or after that commit
is engine-dependent task ordering: Chromium commits the re-render first, so
focus lands; WebKit fires the timer first, so textareaRef.current is still
null and the comment editor opens unfocused (reproduced in a WKWebView host
— the glimpseui integration — where users had to tab or click into the
field for every annotation).
Focus from a ref callback on the textarea instead: it runs exactly when the
element mounts, so there is nothing to race. Mode switches (popover/dialog)
still refocus because the textarea remounts. The deferred focus and
caret-to-end behavior are preserved; isConnected guards the popover closing
before the timer fires.
fetchModels() built the dropdown label from the model name alone,
so models with identical names from different providers (e.g.
deepseek-v4-pro via DeepSeek vs. via OpenRouter) were indistinguishable
in the UI even though their ids were already unique.
Fixes#988
Documents the 0.28.0 round for the Workspaces consumer: the
components/MarkdownDiff shim (frozen two-revision diff — newer revision as
the real document, deletions projected in place, toolbar/overview/gutter),
the byte contract on MarkdownDiffHandle (exact input strings incl. CRLF),
the frozen state/view edit rejection, and the extensions composition with
its capture-once caveat. Adds the supported-imports row and the 0.28.0
dependency note (wrapper ^0.4.0, engine ^0.8.0, new @codemirror/merge peer).
Publish is manual and owner-gated per HANDOFF (bun pm pack, then
npm publish --provenance, ui only — core is unchanged at 0.22.0).
Adds components/MarkdownDiff.tsx, a theme-bridging shim over
@plannotator/markdown-editor's frozen two-revision diff, mirroring the
MarkdownEditor shim exactly: ThemeProvider mode bridge, plannotator.css
theme import, extensions passthrough (wikiLinks composes), gridEnabled ->
the same design-system card chrome. Hosts import it from
@plannotator/ui/components/MarkdownDiff; AtomicDiffEditor and
@plannotator/atomic-editor stay off the allowlist.
Deps: @plannotator/markdown-editor ^0.4.0, @plannotator/atomic-editor
^0.8.0 (single lockfile copy each), plus @codemirror/merge — the engine's
new required peer — declared directly per the CM6 single-copy discipline.
Tests pin the seam end-to-end: public export surface + types, byte-exact
getMarkdown()/getOriginalMarkdown() incl. CRLF/trailing-space fixtures,
contenteditable="false" frozen contract, change navigation, wiki-link
composition through the shim, and theme/host-class forwarding. The
strict-consumer tsconfig now typechecks the new module.
0.6.0 and 0.3.1 will never be published; the engine is stamped 0.7.0 (adds
preferResolvedLabel on WikiLinksConfig — labeled links opting into resolved
titles, the flag the consumer needs) and the wrapper 0.3.2 (peer widened to
^0.5 || ^0.6 || ^0.7). The previous ^0.6.0 range would have excluded 0.7.0
under 0.x caret semantics and stripped preferResolvedLabel from the
re-exported type.
- @plannotator/atomic-editor ^0.7.0, @plannotator/markdown-editor ^0.3.2
- HANDOFF/README version references updated
- wikiLinks re-export test now sets preferResolvedLabel: true — a type-level
seam assertion (excess-property checking rejects unknown keys, verified by
negative control)
Re-verified against fresh npm-pack tarballs of both packages: full repo
typecheck, ui tests (354+66 skip plain / 420 DOM, 0 fail), build:css — all
green. Install still resolves only after the user publishes 0.7.0 + 0.3.2.
Documents the 0.27.0 round for the Workspaces consumer: the MarkdownEditor
'extensions' seam with its capture-once-per-documentId caveat, the wikiLinks
re-export through the ui surface, InlineMarkdown's sync resolveLinkedDoc
semantics, and the retirement of the H-ask-1 html-viewer patch. Marks HANDOFF
rough edge #4 (no live-collab extensions) resolved.
Publish is manual and user-gated per HANDOFF (bun pm pack, then npm publish
--provenance, core then ui); requires @plannotator/markdown-editor 0.3.1 and
@plannotator/atomic-editor 0.6.0 on npm first.
Workspaces carried two byte-identical one-line fixes against 0.25/0.26 for
strict tsc (--noUnusedLocals) on the shipped source. Verified with tsc under
the strict-consumer flags scoped to components/html-viewer: exactly two
TS6133s, no other strict errors.
- HtmlViewer.tsx: drop the unused React default import (jsx: react-jsx;
zero React.* uses)
- useHtmlAnnotation.ts: drop the unused 'annotations' destructured binding;
the UseHtmlAnnotationOptions property stays (callers pass it — removing it
from the options type would be a breaking API change)
New optional prop:
resolveLinkedDoc?: (target: string) =>
{ label?: string; status?: 'active' | 'deleted' } | null
Semantics (consumer-contracted, sync-only by design — the host backs it with
an in-memory cache; no async variant, no loading states, no phantom docs):
- absent or null → exactly today's rendering (stored label, live link)
- label → displayed instead of the stored label; stored label is the
fallback, the target the last resort
- status 'deleted' → muted non-link span (no anchor, no pointer, no link
icon, title "Document deleted"), even when onOpenLinkedDoc is present
- the callback receives the RAW stored target (doc_01XYZ), before the
.md-appending path normalization; onOpenLinkedDoc keeps receiving the
normalized path for non-deleted links, exactly as before
Threaded through all six recursive InlineMarkdown call sites so wiki-links
inside emphasis/strikethrough resolve too. Tests pin every branch, including
null → byte-identical innerHTML with and without onOpenLinkedDoc.
Hosts' import allowlist forbids @plannotator/atomic-editor; @plannotator/ui is
the single contract. wikiLinks and its types (WikiLinksConfig,
WikiLinkSuggestion, WikiLinkResolvedTarget, WikiLinkStatus) now re-export from
components/MarkdownEditor — colocated with the 'extensions' prop they feed,
already on the supported-import allowlist and under the strict-consumer gate.
Usage: build wikiLinks(config) and pass it via the shim's extensions prop.
Test pins identity with the engine export and exercises the type surface.
Declares extensions?: readonly Extension[] (@codemirror/state) on the shim's
props; the existing prop spread forwards it to @plannotator/markdown-editor,
which threads it into the atomic-editor engine. This is the seam Workspaces
needs to install wikiLinks(...) and, later, y-codemirror.next collab bindings
without importing the engine directly.
The doc comment carries the consumer-required rider prominently: the engine
captures the array ONCE per documentId — swapping the array later is silently
ignored until remount; config callbacks may close over live state.
Test mounts through the SHIM with a facet-based probe extension
(EditorView.editorAttributes) and asserts the attribute lands on the engine's
.cm-editor DOM, proving the seam end-to-end, plus byte-fidelity is untouched.
0.3.1 adds the editor 'extensions' passthrough; 0.6.0 adds the wikiLinks
extension. Neither is published to npm yet (publishes are imminent and
user-gated): install/CI resolves only after they land. Local verification
for this branch ran against tarballs built from the source repos via
npm pack.
* feat(ui): handle-wide click-to-collapse + suppressible hover on resize handles
Rework the sidebar/panel resize-handle interaction:
- useResizablePanel: new `onClick` option that fires on pointer-up only when
the pointer never traveled past `clickThreshold` (4px default), so a genuine
click on the handle can be told apart from a drag-start. Plannotator is
unchanged unless `onClick` is passed.
- ResizeHandle: `hideHoverTrack` to suppress the hover color-change, a
cursor-following `tooltip`, a `trackClassName` prop, and a
`[data-resize-track]` attribute (mirrors `[data-collapse]`) so a host can
restyle/suppress the hover reveal from plain CSS.
- Wire all plan-editor and review-editor handles to the new UX: no track
highlight, cursor tooltip ("Click to close · Drag to resize"), single-click
collapse (double-click reset becomes unreachable), chevron retained.
- README: document the new resize-handle host seams.
* refactor(ui): self-review polish on resize-handle UX
- Skip tooltip-position state updates while dragging (they were hidden anyway).
- Extract the repeated resize-handle tooltip string into a per-app constant
(RESIZE_HANDLE_TOOLTIP) instead of 7 inline literals.
* fix(ui): don't treat pointercancel as a click-to-collapse
pointercancel fires when the browser aborts a gesture (palm rejection, system
gesture, focus loss). It was routed through the same onUp path as pointerup, so
a no-move cancel with onClick set would collapse the panel. Skip the onClick
branch on cancel — only clean up drag state (a real in-progress drag still
commits its width, matching prior behavior).
HtmlViewer no longer injects bare theme tokens, root classes, or
color-scheme into rendered documents (#1023); host theming is opt-in
via <meta name="plannotator-theme" content="host">. Supersedes
Workspaces' H-ask-1 patch.
Claude-Session: https://claude.ai/code/session_01MDqD8jdgTbdjiXcVVigzV2
HtmlViewer injected host-app state into rendered documents: ~26 bare
theme tokens (--muted, --background, ...) written into :root and
re-applied inline on the author's documentElement on every host theme
flip, a `light` class toggled on the author's root, an asymmetric
color-scheme:light injection, and unconditional ins/del diff styles.
Documents defining the same token names rendered with wrong colors in
both Plannotator and @plannotator/ui consumers.
Arbitrary documents now render exactly as in a standalone tab:
- Host tokens are pushed only under the viewer-owned --pn-* prefix;
annotation CSS and the bridge read only var(--pn-*, fallback). The
bridge refuses non---pn- writes and never touches the root class
list unless the document opts in.
- Host theme-following is opt-in per document via
<meta name="plannotator-theme" content="host">, which restores the
bare-token push, the light class, and a symmetric color-scheme sync.
The visual-explainer skill now emits the tag in generated artifacts.
- Diff CSS is injected only while the version-diff view is active and
scoped to ins/del.plannotator-diff, which htmlDiff now emits on its
generated wrappers; author <ins>/<del> markup is never restyled.
The srcdoc injection logic moves to a pure module (srcdoc.ts) with
tests pinning the neutrality contract, including a DOM test that runs
the actual bridge script and asserts a theme flip lands nothing on the
author's root except --pn-* properties.
Claude-Session: https://claude.ai/code/session_01MDqD8jdgTbdjiXcVVigzV2
Michael Ramos