collavre 0.23.0 → 0.24.0

data/app/services/collavre/link_preview_fetcher.rb

@@ -1,5 +1,5 @@
 module Collavre
-  require "open-uri"
+  require "net/http"
   require "nokogiri"
   require "uri"
   require "ipaddr"
@@ -29,18 +29,22 @@ module Collavre
       IPAddr.new("ff00::/8")
     ].freeze
 
+    # Minimal HTTP result the fetcher reasons about. `body` is only populated for
+    # successful (2xx) responses; redirects carry a `location` instead.
+    Response = Struct.new(:code, :content_type, :body, :location, keyword_init: true)
+
     def self.fetch(url)
       new(url).fetch
     end
 
-    def initialize(url, io_opener: URI, logger: Rails.logger)
+    def initialize(url, http_client: nil, logger: Rails.logger)
       @url = url
-      @io_opener = io_opener
+      @http_client = http_client || PinnedHttpClient.new
       @logger = logger
     end
 
     def fetch
-      uri = safe_http_uri
+      uri = parse_http_uri(@url)
       return {} unless uri
 
       html, base_uri = read_html(uri)
@@ -56,47 +60,53 @@ module Collavre
     private
 
     def read_html(uri, redirect_limit = MAX_REDIRECTS)
-      html = nil
-      base_uri = nil
-      options = REQUEST_OPTIONS.merge(read_timeout: READ_TIMEOUT, open_timeout: OPEN_TIMEOUT, redirect: false)
-      @io_opener.open(uri.to_s, options) do |io|
-        content_type = io.respond_to?(:content_type) ? io.content_type : nil
-        if content_type && HTML_CONTENT_TYPES.none? { |type| content_type.include?(type) }
-          return [ nil, nil ]
-        end
-        base_uri = io.respond_to?(:base_uri) ? io.base_uri : uri
-        html = io.read(MAX_BYTES)
+      # Resolve+validate the host ONCE per hop and pin the request to that exact
+      # IP. This closes the DNS-rebinding TOCTOU gap: a hostname that validates
+      # as public here can no longer be re-resolved to a private/metadata IP at
+      # connect time, because the connection targets the pinned address (with the
+      # original hostname preserved for Host/SNI).
+      addresses = safe_addresses(uri)
+      return [ nil, nil ] if addresses.empty?
+
+      response = fetch_via_pinned_addresses(uri, addresses)
+      return [ nil, nil ] unless response
+
+      if redirect?(response.code)
+        return [ nil, nil ] if redirect_limit <= 0
+
+        redirected_uri = normalize_redirect_uri(uri, response.location)
+        return [ nil, nil ] unless redirected_uri
+
+        # Recurse so the new host is resolved+validated+pinned from scratch;
+        # never follow a hop to an internal address.
+        return read_html(redirected_uri, redirect_limit - 1)
       end
-      [ html, base_uri ]
-    rescue OpenURI::HTTPRedirect => e
-      return [ nil, nil ] if redirect_limit <= 0
 
-      redirected_uri = safe_redirect_uri(uri, e.uri)
-      return [ nil, nil ] unless redirected_uri
+      return [ nil, nil ] unless success?(response.code)
 
-      read_html(redirected_uri, redirect_limit - 1)
-    rescue OpenURI::HTTPError, SocketError, IOError, SystemCallError, URI::InvalidURIError => e
+      content_type = response.content_type
+      if content_type && HTML_CONTENT_TYPES.none? { |type| content_type.include?(type) }
+        return [ nil, nil ]
+      end
+
+      [ response.body, uri ]
+    rescue SocketError, IOError, SystemCallError, Net::OpenTimeout, Net::ReadTimeout,
+           OpenSSL::SSL::SSLError, URI::InvalidURIError => e
       @logger&.info("Link preview fetch skipped for #{@url}: #{e.class} #{e.message}")
       [ nil, nil ]
     end
 
-    def safe_http_uri
-      uri = parse_http_uri(@url)
-      return unless uri
-      return unless allowed_destination?(uri)
-
-      uri
+    def redirect?(code)
+      code.to_i.between?(300, 399)
     end
 
-    def safe_redirect_uri(current_uri, redirected)
-      new_uri = normalize_redirect_uri(current_uri, redirected)
-      return unless new_uri
-      return unless allowed_destination?(new_uri)
-
-      new_uri
+    def success?(code)
+      code.to_i.between?(200, 299)
     end
 
     def normalize_redirect_uri(current_uri, redirected)
+      return if redirected.blank?
+
       target_uri = redirected.is_a?(URI) ? redirected : URI.parse(redirected.to_s)
       target_uri = current_uri.merge(target_uri) if target_uri.relative?
       return unless %w[http https].include?(target_uri.scheme)
@@ -116,15 +126,45 @@ module Collavre
       nil
     end
 
-    def allowed_destination?(uri)
+    # Resolve the host, reject if it maps to ANY unsafe address, and return every
+    # validated public IP to pin against. Rejecting when any resolved address is
+    # unsafe (not just the one we pick) keeps defense-in-depth against
+    # split-horizon DNS returning a mix of public and private records. Returning
+    # all safe addresses lets the caller fall back to the next one when the first
+    # is unreachable (e.g. an AAAA record with no IPv6 egress).
+    def safe_addresses(uri)
       host = uri.hostname
-      return false if host.nil? || host.empty?
+      return [] if host.nil? || host.empty?
 
       addresses = resolve_addresses(host)
-      return false if addresses.empty?
-      return false if addresses.any? { |address| unsafe_ip?(address) }
+      return [] if addresses.empty?
+      return [] if addresses.any? { |address| unsafe_ip?(address) }
 
-      true
+      addresses
+    end
+
+    # Try each pre-validated address in turn, pinning the connection to it, and
+    # return the first response we can actually open. Connection-level failures
+    # fall through to the next candidate; if none connect, the caller treats it
+    # as an empty preview. Every address here already passed safe_addresses, so
+    # falling back never targets an unsafe IP.
+    def fetch_via_pinned_addresses(uri, addresses)
+      last_error = nil
+      addresses.each do |address|
+        return @http_client.get(
+          uri,
+          ip: address,
+          headers: REQUEST_OPTIONS,
+          open_timeout: OPEN_TIMEOUT,
+          read_timeout: READ_TIMEOUT,
+          max_bytes: MAX_BYTES
+        )
+      rescue SocketError, IOError, SystemCallError, Net::OpenTimeout, Net::ReadTimeout,
+             OpenSSL::SSL::SSLError => e
+        last_error = e
+      end
+      @logger&.info("Link preview fetch skipped for #{@url}: #{last_error.class} #{last_error.message}") if last_error
+      nil
     end
 
     def resolve_addresses(host)
@@ -226,5 +266,56 @@ module Collavre
 
       text.to_s.gsub(/\s+/, " ").strip
     end
+
+    # Performs a single (non-redirect-following) GET against a pre-resolved IP
+    # while keeping the original hostname for the Host header and TLS SNI/cert
+    # verification. Net::HTTP#ipaddr= pins the socket to `ip`, so no second DNS
+    # lookup happens between validation and connect. Enforces the caller's open/
+    # read timeouts and byte cap.
+    class PinnedHttpClient
+      def get(uri, ip:, headers:, open_timeout:, read_timeout:, max_bytes:)
+        # Pass an explicit nil proxy: Net::HTTP.new defaults p_addr to :ENV, so a
+        # set http_proxy/HTTP_PROXY would route through the proxy, which resolves
+        # the hostname itself and defeats `http.ipaddr = ip` pinning — reopening
+        # the DNS-rebinding/SSRF gap. nil forces a direct, pinned connection.
+        http = Net::HTTP.new(uri.hostname, uri.port, nil)
+        http.use_ssl = uri.scheme == "https"
+        http.ipaddr = ip
+        http.open_timeout = open_timeout
+        http.read_timeout = read_timeout
+
+        request = Net::HTTP::Get.new(uri, headers)
+        response_struct = nil
+
+        http.start do |conn|
+          conn.request(request) do |response|
+            body = read_capped_body(response, max_bytes)
+            response_struct = Response.new(
+              code: response.code.to_i,
+              content_type: response.content_type,
+              body: body,
+              location: response["location"]
+            )
+          end
+        end
+
+        response_struct
+      ensure
+        http&.finish if http&.started?
+      end
+
+      private
+
+      def read_capped_body(response, max_bytes)
+        return nil unless response.is_a?(Net::HTTPSuccess)
+
+        body = +""
+        response.read_body do |chunk|
+          body << chunk
+          break if body.bytesize >= max_bytes
+        end
+        body.byteslice(0, max_bytes)
+      end
+    end
   end
 end

data/app/services/collavre/markdown_importer.rb

@@ -20,6 +20,12 @@ module Collavre
         end
       end
       created = []
+      # Per-parent sequence counters. closure_tree orders siblings by the
+      # `sequence` column (default 0), but plain Creative.create never assigns
+      # it — so without this every imported sibling would share sequence 0 and
+      # fall back to a DB-defined tie-break (stable on SQLite, arbitrary on
+      # Postgres), corrupting document order. Assign contiguous values here.
+      seq = {}
       root = parent
       i = 0
       if create_root
@@ -28,7 +34,7 @@ module Collavre
         end
         if i < lines.size && lines[i] !~ /^\s*#/ && lines[i] !~ /^\s*[-*+]/
           page_title = lines[i].strip
-          root = Creative.create(user: user, parent: parent, description: page_title)
+          root = create_child(user: user, parent: parent, description: page_title, seq: seq)
           created << root
           i += 1
         end
@@ -73,7 +79,7 @@ module Collavre
           code_html = build_code_block_html(code_content, fence_info)
 
           new_parent = stack.any? ? stack.last[1] : root
-          c = Creative.create(user: user, parent: new_parent, description: code_html)
+          c = create_child(user: user, parent: new_parent, description: code_html, seq: seq)
           created << c
           next
         end
@@ -81,7 +87,7 @@ module Collavre
         if (table_data = parse_markdown_table(lines, i))
           table_html = build_table_html(table_data, image_refs)
           new_parent = stack.any? ? stack.last[1] : root
-          c = Creative.create(user: user, parent: new_parent, description: table_html)
+          c = create_child(user: user, parent: new_parent, description: table_html, seq: seq)
           created << c
           i = table_data[:next_index]
         elsif line =~ /^(#+)\s+(.*)$/
@@ -89,7 +95,7 @@ module Collavre
           desc = ApplicationController.helpers.markdown_links_to_html($2.strip, image_refs)
           stack.pop while stack.any? && stack.last[0] >= level
           new_parent = stack.any? ? stack.last[1] : root
-          c = Creative.create(user: user, parent: new_parent, description: desc)
+          c = create_child(user: user, parent: new_parent, description: desc, seq: seq)
           created << c
           stack << [ level, c ]
           i += 1
@@ -99,14 +105,14 @@ module Collavre
           bullet_level = 10 + indent / 2
           stack.pop while stack.any? && stack.last[0] >= bullet_level
           new_parent = stack.any? ? stack.last[1] : root
-          c = Creative.create(user: user, parent: new_parent, description: desc)
+          c = create_child(user: user, parent: new_parent, description: desc, seq: seq)
           created << c
           stack << [ bullet_level, c ]
           i += 1
         elsif !line.strip.empty?
           desc = ApplicationController.helpers.markdown_links_to_html(line.strip, image_refs)
           new_parent = stack.any? ? stack.last[1] : root
-          c = Creative.create(user: user, parent: new_parent, description: desc)
+          c = create_child(user: user, parent: new_parent, description: desc, seq: seq)
           created << c
           i += 1
         else
@@ -121,6 +127,24 @@ module Collavre
       created
     end
 
+    # Creates a child under `parent` with an explicit `sequence`, tracking the
+    # next value per parent in `seq`. The first time a parent is seen the
+    # counter is seeded past any pre-existing children so an import into an
+    # already-populated parent appends after them instead of colliding at 0.
+    # A nil parent means a root-level import (top-level page with no parent_id);
+    # closure_tree orders roots by `sequence` too, so seed from Creative.roots.
+    def self.create_child(user:, parent:, description:, seq:)
+      key = parent&.id
+      unless seq.key?(key)
+        siblings = parent ? parent.children : Creative.roots
+        max = siblings.maximum(:sequence)
+        seq[key] = max ? max + 1 : 0
+      end
+      creative = Creative.create(user: user, parent: parent, description: description, sequence: seq[key])
+      seq[key] += 1
+      creative
+    end
+
     def self.build_code_block_html(code_content, language = nil)
       escaped_content = ERB::Util.html_escape(code_content)
       lang_class = language.present? ? " class=\"language-#{ERB::Util.html_escape(language)}\"" : ""

data/app/services/collavre/mobile/event_summarizer.rb

@@ -29,7 +29,7 @@ module Collavre
       end
 
       def parse_action(comment)
-        return nil if comment.action.blank?
+        return nil unless comment.approval_action?
 
         JSON.parse(comment.action)
       rescue JSON::ParserError

data/app/services/collavre/orchestration/agent_context_builder.rb

@@ -126,24 +126,10 @@ module Collavre
           "id" => @agent.id,
           "name" => @agent.name,
           "display_name" => @agent.display_name,
-          "type" => extract_agent_type
+          "type" => AgentTypeClassifier.classify(@agent)
         }
       end
 
-      def extract_agent_type
-        # Extract agent type from system_prompt or default
-        prompt = @agent.system_prompt.to_s.downcase
-        case prompt
-        when /developer|개발/ then "developer"
-        when /pm|project.?manager|프로젝트/ then "pm"
-        when /qa|test|quality|테스트|품질/ then "qa"
-        when /research|조사|연구/ then "researcher"
-        when /market|마케팅/ then "marketer"
-        when /plan|기획/ then "planner"
-        else "agent"
-        end
-      end
-
       def build_collaborators
         return [] unless @creative
 

data/app/services/collavre/orchestration/agent_orchestrator.rb

@@ -64,7 +64,7 @@ module Collavre
         return unless creative_id && context&.key?("topic")
 
         topic_id = context.dig("topic", "id")
-        scope = Comment.public_only
+        scope = Comment.public_only.without_approval_action
           .where(creative_id: creative_id, topic_id: topic_id)
           .where.not(user_id: [ task.agent_id, nil ])
           .order(created_at: :desc)

data/app/services/collavre/system_events/context_builder.rb

@@ -34,23 +34,10 @@ module Collavre
           "name" => user.name,
           "display_name" => user.respond_to?(:display_name) ? user.display_name : user.name,
           "is_ai" => user.ai_user?,
-          "type" => user.ai_user? ? extract_agent_type(user) : "human"
+          "type" => user.ai_user? ? AgentTypeClassifier.classify(user) : "human"
         }
       end
 
-      def extract_agent_type(user)
-        prompt = user.system_prompt.to_s.downcase
-        case prompt
-        when /developer|개발/ then "developer"
-        when /pm|project.?manager|프로젝트/ then "pm"
-        when /qa|test|quality|테스트|품질/ then "qa"
-        when /research|조사|연구/ then "researcher"
-        when /market|마케팅/ then "marketer"
-        when /plan|기획/ then "planner"
-        else "agent"
-        end
-      end
-
       def mentioned_user(chat_context)
         content = chat_context["content"]
         return nil unless content

data/app/services/collavre/tools/preview_attach_service.rb

@@ -113,15 +113,13 @@ module Tools
       raise ArgumentError, "preview_url is not a valid URI: #{preview_url.inspect}"
     end
 
-    # config is JSON, so worktree_id matching is a Ruby-side scan over the
-    # topic's preview channels. With only a handful of previews per topic in
-    # practice this is fine and avoids JSON operator divergence between
-    # Postgres (config->>'worktree_id') and SQLite (json_extract).
+    # worktree_id is a real column denormalized from config (see
+    # Collavre::Channel#sync_indexed_config_columns), so the lookup is an
+    # indexed query — it also backs the (topic_id, worktree_id) unique index
+    # that makes attach idempotent.
     sig { params(topic: Collavre::Topic, worktree_id: String).returns(T.nilable(Collavre::PreviewChannel)) }
     def lookup_channel(topic, worktree_id)
-      Collavre::PreviewChannel.where(topic_id: topic.id).find do |c|
-        c.worktree_id.to_s == worktree_id.to_s
-      end
+      Collavre::PreviewChannel.find_by(topic_id: topic.id, worktree_id: worktree_id)
     end
   end
 end

data/app/views/collavre/comments/_comment.html.erb

@@ -1,6 +1,6 @@
 <% comment_topic = comment.topic %>
 <% current_topic_id = local_assigns[:current_topic_id] %>
-<% has_pending_action = comment.action.present? && comment.action_executed_at.blank? %>
+<% has_pending_action = comment.approval_action? && comment.action_executed_at.blank? %>
 <% approver_id = comment.approver_id %>
 <div class="comment-item" id="<%= dom_id(comment) %>" data-controller="comment" data-user-id="<%= comment.user&.id %>" data-comment-id="<%= comment.id %>" data-topic-id="<%= comment_topic&.id %>" data-creative-id="<%= comment.creative_id %>" data-creative-owner-id="<%= comment.creative&.user_id %>" data-has-pending-action="<%= has_pending_action %>" data-approver-id="<%= approver_id %>" data-ai-user="<%= comment.user&.ai_user? %>" data-streaming="<%= local_assigns.fetch(:streaming, false) %>">
   <div class="comment-select">
@@ -90,8 +90,8 @@
     </div>
   <% end %>
   <div class="comment-content" data-comment-target="content"><%= comment.content %></div>
-  <% if comment.comment_versions.any? %>
-    <% version_count = comment.comment_versions.size %>
+  <% if comment.comment_versions_count > 0 %>
+    <% version_count = comment.comment_versions_count %>
     <% selected_id = comment.selected_version_id %>
     <% version_ids = comment.comment_versions.order(:version_number).pluck(:id) %>
     <% selected_index = selected_id ? (version_ids.index(selected_id)&.+(1) || version_count) : version_count %>
@@ -173,7 +173,7 @@
       <a href="#" class="comment-topic-switch" data-topic-id="<%= comment_topic.id %>">#<%= comment_topic.name %></a>
     </div>
   <% end %>
-  <% if comment.action.present? %>
+  <% if comment.approval_action? %>
     <div class="comment-action-block" data-comment-id="<%= comment.id %>">
       <details class="comment-action-details">
         <summary class="comment-action-summary"><%= t("collavre.comments.action_summary") %></summary>

data/app/views/collavre/comments/_comments_popup.html.erb

@@ -125,9 +125,17 @@
        data-action="dragover->comments--contexts#handleExternalDragOver drop->comments--contexts#handleExternalDrop dragleave->comments--contexts#handleExternalDragLeave"></div>
   <div data-share-modal-target="container"></div>
   <div id="comment-participants" data-comments--presence-target="participants" data-comments--mention-menu-target="participants"></div>
-  <div id="comment-topics" data-comments--topics-target="list" class="comment-topics-list"
-       data-confirm-delete-text="<%= t('collavre.topics.delete_confirm') %>"
-       data-new-topic-placeholder="<%= t('collavre.topics.new_placeholder') %>"></div>
+  <div class="comment-topics-bar">
+    <div id="comment-topics" data-comments--topics-target="list" class="comment-topics-list"
+         data-confirm-delete-text="<%= t('collavre.topics.delete_confirm') %>"
+         data-new-topic-placeholder="<%= t('collavre.topics.new_placeholder') %>"></div>
+    <button type="button" class="topic-list-btn"
+            data-action="click->comments--topics#openTopicListPopup"
+            title="<%= t('collavre.comments.topic_list') %>"
+            aria-label="<%= t('collavre.comments.topic_list') %>">
+      <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="8" y1="6" x2="21" y2="6"/><line x1="8" y1="12" x2="21" y2="12"/><line x1="8" y1="18" x2="21" y2="18"/><line x1="3" y1="6" x2="3.01" y2="6"/><line x1="3" y1="12" x2="3.01" y2="12"/><line x1="3" y1="18" x2="3.01" y2="18"/></svg>
+    </button>
+  </div>
   <%= render Collavre::UserMentionMenuComponent.new(menu_id: 'mention-menu') %>
   <%= render Collavre::CommandMenuComponent.new(menu_id: 'command-menu') %>
   <div id="comments-list" data-comments--popup-target="list" data-comments--list-target="list"><%= t('app.loading') %></div>

data/app/views/collavre/creatives/_inline_edit_form.html.erb

@@ -50,6 +50,15 @@
                 style="margin-left:0.5em;font-family:monospace;font-size:0.9em;">
           <%= t('collavre.creatives.index.toggle_markdown') %>
         </button>
+        <span id="inline-save-status"
+              class="inline-save-status"
+              role="status"
+              aria-live="polite"
+              data-label-pending="<%= t('collavre.creatives.index.save_status_pending') %>"
+              data-label-saving="<%= t('collavre.creatives.index.save_status_saving') %>"
+              data-label-saved="<%= t('collavre.creatives.index.save_status_saved') %>"
+              data-label-error="<%= t('collavre.creatives.index.save_status_error') %>"
+              style="margin-left:auto;font-size:0.85em;color:var(--text-secondary);"></span>
       </div>
       <div style="margin-top:0.5em;">
         <button type="button" id="inline-move-up" class="creative-action-btn" title="<%= t('collavre.creatives.index.inline_move_up_tooltip') %>">

data/app/views/collavre/landing/show.html.erb

@@ -19,6 +19,7 @@
   <section id="problem" class="landing-section landing-problem">
     <div class="landing-container">
       <h2 class="landing-section-title"><%= t('collavre.landing.problem.title') %></h2>
+      <p class="landing-section-sub"><%= t('collavre.landing.problem.subtitle') %></p>
       <div class="landing-problem-grid">
         <div class="landing-problem-card">
           <span class="landing-problem-icon">📝</span>
@@ -52,40 +53,77 @@
           <p><%= t('collavre.landing.features.tree.desc') %></p>
         </div>
 
-        <div class="landing-feature-card">
-          <div class="landing-feature-icon">🤖</div>
-          <h3><%= t('collavre.landing.features.ai.title') %></h3>
-          <p><%= t('collavre.landing.features.ai.desc') %></p>
-        </div>
-
         <div class="landing-feature-card">
           <div class="landing-feature-icon">💡</div>
           <h3><%= t('collavre.landing.features.context.title') %></h3>
           <p><%= t('collavre.landing.features.context.desc') %></p>
         </div>
 
+        <div class="landing-feature-card">
+          <div class="landing-feature-icon">🤖</div>
+          <h3><%= t('collavre.landing.features.ai.title') %></h3>
+          <p><%= t('collavre.landing.features.ai.desc') %></p>
+        </div>
+
         <div class="landing-feature-card">
           <div class="landing-feature-icon">💬</div>
           <h3><%= t('collavre.landing.features.chat.title') %></h3>
           <p><%= t('collavre.landing.features.chat.desc') %></p>
         </div>
 
+      </div>
+    </div>
+  </section>
 
+  <%# ═════════════════════════════════════ THE INTERFACE ══════════════════════════════════════ %>
+  <%# A still before the film: the reader decides in two seconds whether this is a surface they
+      would write in, and a video they have not pressed play on cannot answer that. %>
+  <section id="interface" class="landing-section landing-interface">
+    <div class="landing-container">
+      <h2 class="landing-section-title"><%= t('collavre.landing.interface.title') %></h2>
+      <p class="landing-section-sub"><%= t('collavre.landing.interface.subtitle') %></p>
+
+      <div class="landing-shot-frame landing-shot-light">
+        <%= image_tag "collavre/landing/interface-#{I18n.locale == :ko ? 'ko' : 'en'}.png",
+                      class: "landing-shot-img",
+                      alt: t('collavre.landing.interface.alt'), loading: "lazy" %>
       </div>
+      <div class="landing-shot-frame landing-shot-dark">
+        <%= image_tag "collavre/landing/interface-#{I18n.locale == :ko ? 'ko' : 'en'}-dark.png",
+                      class: "landing-shot-img",
+                      alt: t('collavre.landing.interface.alt'), loading: "lazy" %>
+      </div>
+
+      <ul class="landing-interface-points">
+        <li><%= t('collavre.landing.interface.markdown') %></li>
+        <li><%= t('collavre.landing.interface.rich') %></li>
+        <li><%= t('collavre.landing.interface.drag') %></li>
+        <li><%= t('collavre.landing.interface.presence') %></li>
+      </ul>
     </div>
   </section>
 
   <%# ══════════════════════════════════════════ DEMO ══════════════════════════════════════════ %>
+  <%# Demo video/poster URLs are full absolute URLs stored per-locale in
+      config/locales/landing.*.yml. They point at the hosted assets directly, so
+      they resolve from any environment (preview included) with no DB lookup and
+      no env-bound blob ids. Render the section only when a video URL is set. %>
+  <% demo_video = t('collavre.landing.demo.video', default: nil) %>
+  <% demo_poster = t('collavre.landing.demo.poster', default: nil) %>
+  <% demo_video_dark = t('collavre.landing.demo.video_dark', default: nil) %>
+  <% demo_poster_dark = t('collavre.landing.demo.poster_dark', default: nil) %>
+  <% if demo_video.present? || demo_video_dark.present? %>
   <section id="demo" class="landing-section landing-demo">
     <div class="landing-container">
       <h2 class="landing-section-title"><%= t('collavre.landing.demo.title') %></h2>
       <%# Light mode video %>
+      <% if demo_video.present? %>
       <div class="landing-demo-frame landing-demo-light" data-controller="landing-video">
         <video class="landing-demo-video"
                data-landing-video-target="video"
                autoplay muted loop playsinline
-               poster="/public-assets/blobs/eyJfcmFpbHMiOnsiZGF0YSI6NDEyLCJwdXIiOiJibG9iX2lkIn19--33811afcd451cef0cf10313fa1bfecca15b41299/demo-poster.jpg">
-          <source src="/public-assets/blobs/eyJfcmFpbHMiOnsiZGF0YSI6NDEwLCJwdXIiOiJibG9iX2lkIn19--c272341a19ed8e847208c52da0617ebc801e2e67/demo.mp4" type="video/mp4">
+               poster="<%= demo_poster %>">
+          <source src="<%= demo_video %>" type="video/mp4">
         </video>
         <div class="landing-demo-progress" data-landing-video-target="progressBar">
           <div class="landing-demo-progress-fill" data-landing-video-target="progressFill"></div>
@@ -94,13 +132,15 @@
           <span class="landing-demo-toggle-icon" data-landing-video-target="icon">❚❚</span>
         </button>
       </div>
+      <% end %>
       <%# Dark mode video %>
+      <% if demo_video_dark.present? %>
       <div class="landing-demo-frame landing-demo-dark" data-controller="landing-video">
         <video class="landing-demo-video"
                data-landing-video-target="video"
                autoplay muted loop playsinline
-               poster="/public-assets/blobs/eyJfcmFpbHMiOnsiZGF0YSI6NDEzLCJwdXIiOiJibG9iX2lkIn19--53c3c505596bca0befbbebb5958764a153ffee5e/demo-dark-poster.jpg">
-          <source src="/public-assets/blobs/eyJfcmFpbHMiOnsiZGF0YSI6NDExLCJwdXIiOiJibG9iX2lkIn19--758c90c311bb68f46a2bda87553e3cdfd800420b/demo-dark.mp4" type="video/mp4">
+               poster="<%= demo_poster_dark %>">
+          <source src="<%= demo_video_dark %>" type="video/mp4">
         </video>
         <div class="landing-demo-progress" data-landing-video-target="progressBar">
           <div class="landing-demo-progress-fill" data-landing-video-target="progressFill"></div>
@@ -109,8 +149,10 @@
           <span class="landing-demo-toggle-icon" data-landing-video-target="icon">❚❚</span>
         </button>
       </div>
+      <% end %>
     </div>
   </section>
+  <% end %>
 
   <%# ═══════════════════════════════════════ FINAL CTA ════════════════════════════════════════ %>
   <section class="landing-section landing-cta">

data/config/locales/comments.en.yml

@@ -140,6 +140,7 @@ en:
       batch_delete_not_found: Some selected messages could not be found.
       topic_search_placeholder: Search topics...
       topic_main: All Messages
+      topic_list: Topic list
       fullscreen: Full screen
       exit_fullscreen: Exit full screen
       typo_keep_label: keep

data/config/locales/comments.ko.yml

@@ -137,6 +137,7 @@ ko:
       batch_delete_not_found: 일부 선택한 메시지를 찾을 수 없습니다.
       topic_search_placeholder: 토픽 검색...
       topic_main: 전체 메세지
+      topic_list: 토픽 목록
       fullscreen: 전체 화면
       exit_fullscreen: 전체 화면 종료
       typo_keep_label: 유지

data/config/locales/creatives.en.yml

@@ -136,6 +136,10 @@ en:
         metadata_save: Save
         toggle_markdown: Markdown
         toggle_richtext: Rich Text
+        save_status_pending: Save pending
+        save_status_saving: Saving…
+        save_status_saved: Saved
+        save_status_error: Save failed
         markdown_to_richtext_confirm: Switching to Rich Text will discard the Markdown
           source. Continue?
         richtext_to_markdown_confirm: Switching to Markdown will discard the current
@@ -156,6 +160,8 @@ en:
       errors:
         no_permission: You do not have permission to perform this action.
         metadata_must_be_object: Metadata must be an object.
+        description_read_only_source: cannot be changed directly for read-only source
+          content
       inline_editor:
         placeholder: Describe the creative…
         markdown_placeholder: Write in Markdown…