@plannotator/ui 0.53.1 → 0.55.0

package/utils/belowTitleSlot.ts

@@ -0,0 +1,174 @@
+/**
+ * The `Viewer` `belowTitle` host slot, and how stored text positions stay
+ * independent of it.
+ *
+ * web-highlighter stores a comment's position as `{ parentTagName,
+ * parentIndex, textOffset }`, where `parentIndex` is the index of the parent
+ * element among EVERY element of that tag under the annotation root (the
+ * Viewer's `<article>`). The slot sits inside that root, right after the
+ * title, so whatever a host renders in it (a `<p>`, a `<span>`, an `<a>`)
+ * would renumber every later element of the same tag. That would make a
+ * comment saved with the slot present resolve onto other text without it (or
+ * with different slot contents), and the other way round.
+ *
+ * So the hook translates at its two edges: a new selection's metas are
+ * rewritten to the index the element would have WITHOUT the slot
+ * (`metaWithoutBelowTitle`), and a stored meta is mapped back to the live
+ * element before `fromStore` (`metaWithBelowTitle`). With no slot in the root
+ * both are the identity, so a document without one stores and restores
+ * exactly as before.
+ */
+
+/** Marks the slot's wrapper. Presence is enough for a host's CSS. */
+export const BELOW_TITLE_SLOT_ATTRIBUTE = 'data-viewer-below-title';
+
+/**
+ * The attribute's value on the wrapper the Viewer draws itself: random per
+ * page load, so a `<div data-viewer-below-title>` an author writes as raw
+ * HTML in a document (the sanitizer keeps `data-*`) is never taken for the
+ * slot. Only a direct child of the root carrying exactly this value counts.
+ */
+export const BELOW_TITLE_SLOT_MARKER = `slot-${Math.random().toString(36).slice(2, 12)}`;
+
+/** web-highlighter's sentinels (`ROOT_IDX`, `UNKNOWN_IDX`): never translated. */
+const isElementIndex = (index: number): boolean => Number.isInteger(index) && index >= 0;
+
+interface TextMeta {
+  parentTagName: string;
+  parentIndex: number;
+  textOffset: number;
+}
+
+/** Which end of a selection a meta is; decides where one inside the slot goes. */
+export type MetaEdge = 'start' | 'end';
+
+/** The Viewer's own slot wrapper in `root`, or null. */
+const findSlot = (root: Element): Element | null => {
+  for (const child of Array.from(root.children)) {
+    if (child.getAttribute(BELOW_TITLE_SLOT_ATTRIBUTE) === BELOW_TITLE_SLOT_MARKER) return child;
+  }
+  return null;
+};
+
+/** web-highlighter's own parent rule: skip its highlight wrappers. */
+const originParent = (node: Node): HTMLElement | null => {
+  let parent = node.parentElement;
+  while (parent && parent.dataset?.highlightId) parent = parent.parentElement;
+  return parent;
+};
+
+/** Text that is never part of a comment (the highlighter's exclusions). */
+const isExcludedText = (node: Text): boolean =>
+  node.parentElement?.closest('.annotation-exclude, .annotation-toolbar, button, .katex, .math-annotatable') != null;
+
+/** The text offset of `text`'s end (or start) inside `parent`, counted the
+ *  way web-highlighter counts it: every text node under `parent` in order. */
+const offsetIn = (parent: Element, text: Text, atEnd: boolean): number => {
+  const walker = parent.ownerDocument.createTreeWalker(parent, NodeFilter.SHOW_TEXT);
+  let offset = 0;
+  for (let node = walker.nextNode(); node; node = walker.nextNode()) {
+    if (node === text) return offset + (atEnd ? text.length : 0);
+    offset += (node as Text).length;
+  }
+  return offset;
+};
+
+/**
+ * A boundary that landed inside the slot, moved out of it: an end goes back
+ * to the end of the last comment text before the slot, a start forward to
+ * the beginning of the first after it. Returned as a LIVE meta.
+ */
+const snapOutOfSlot = <M extends TextMeta>(root: Element, slot: Element, meta: M, edge: MetaEdge): M => {
+  const walker = root.ownerDocument.createTreeWalker(root, NodeFilter.SHOW_TEXT);
+  let chosen: Text | null = null;
+  for (let node = walker.nextNode(); node; node = walker.nextNode()) {
+    const text = node as Text;
+    if (!text.length || slot.contains(text) || isExcludedText(text)) continue;
+    const before = (slot.compareDocumentPosition(text) & Node.DOCUMENT_POSITION_PRECEDING) !== 0;
+    if (edge === 'end' && before) chosen = text;
+    if (edge === 'start' && !before) { chosen = text; break; }
+  }
+  const parent = chosen ? originParent(chosen) : null;
+  if (!chosen || !parent || !root.contains(parent) || parent === root) return meta;
+  const index = Array.from(root.getElementsByTagName(parent.tagName)).indexOf(parent);
+  if (index < 0) return meta;
+  return { ...meta, parentTagName: parent.tagName, parentIndex: index, textOffset: offsetIn(parent, chosen, edge === 'end') };
+};
+
+/**
+ * Live index → the index the element has with the slot's elements left out.
+ * A boundary inside the slot (a selection from the title that ends in it) is
+ * first moved out of it, so a stored meta never points into the slot.
+ */
+export function metaWithoutBelowTitle<M extends TextMeta>(root: Element | null, meta: M, edge: MetaEdge): M;
+export function metaWithoutBelowTitle<M extends TextMeta>(root: Element | null, meta: M | undefined, edge: MetaEdge): M | undefined;
+export function metaWithoutBelowTitle<M extends TextMeta>(root: Element | null, meta: M | undefined, edge: MetaEdge): M | undefined {
+  if (!root || !meta || !isElementIndex(meta.parentIndex)) return meta;
+  const slot = findSlot(root);
+  if (!slot) return meta;
+  let live = meta;
+  const parent = root.getElementsByTagName(live.parentTagName)[live.parentIndex];
+  if (!parent) return meta;
+  if (slot.contains(parent)) {
+    live = snapOutOfSlot(root, slot, live, edge);
+    if (live === meta) return meta;
+  }
+  const list = root.getElementsByTagName(live.parentTagName);
+  let skipped = 0;
+  for (let i = 0; i < live.parentIndex; i++) {
+    if (slot.contains(list[i]!)) skipped++;
+  }
+  return skipped === 0 ? live : { ...live, parentIndex: live.parentIndex - skipped };
+}
+
+/** Slot-free index → the live index of that element (the slot's skipped). */
+export function metaWithBelowTitle<M extends TextMeta>(root: Element | null, meta: M): M;
+export function metaWithBelowTitle<M extends TextMeta>(root: Element | null, meta: M | undefined): M | undefined;
+export function metaWithBelowTitle<M extends TextMeta>(root: Element | null, meta: M | undefined): M | undefined {
+  if (!root || !meta || !isElementIndex(meta.parentIndex)) return meta;
+  const slot = findSlot(root);
+  if (!slot) return meta;
+  const list = root.getElementsByTagName(meta.parentTagName);
+  let seen = 0;
+  for (let i = 0; i < list.length; i++) {
+    if (slot.contains(list[i]!)) continue;
+    if (seen === meta.parentIndex) return i === meta.parentIndex ? meta : { ...meta, parentIndex: i };
+    seen++;
+  }
+  // Past the end: unchanged, so the restore fails exactly as it would have.
+  return meta;
+}
+
+/**
+ * Move a selection's ends out of the Viewer's slot before the highlighter
+ * reads it: an end inside the slot goes back to the end of the last comment
+ * text before the slot, a start inside it forward to the first after it. A
+ * range that lies wholly inside the slot (or would collapse) is left alone;
+ * it paints nothing. Returns whether the range changed. No slot in `root`:
+ * never changes anything.
+ */
+export function snapRangeOutOfBelowTitle(root: Element | null, range: Range): boolean {
+  if (!root) return false;
+  const slot = findSlot(root);
+  if (!slot) return false;
+  const startIn = slot.contains(range.startContainer);
+  const endIn = slot.contains(range.endContainer);
+  if (startIn === endIn) return false;
+  const walker = root.ownerDocument.createTreeWalker(root, NodeFilter.SHOW_TEXT);
+  let chosen: Text | null = null;
+  for (let node = walker.nextNode(); node; node = walker.nextNode()) {
+    const text = node as Text;
+    if (!text.length || slot.contains(text) || isExcludedText(text)) continue;
+    const before = (slot.compareDocumentPosition(text) & Node.DOCUMENT_POSITION_PRECEDING) !== 0;
+    if (endIn && before) chosen = text;
+    if (startIn && !before) { chosen = text; break; }
+  }
+  if (!chosen) return false;
+  const next = range.cloneRange();
+  if (endIn) next.setEnd(chosen, chosen.length);
+  else next.setStart(chosen, 0);
+  if (next.collapsed) return false;
+  if (endIn) range.setEnd(chosen, chosen.length);
+  else range.setStart(chosen, 0);
+  return true;
+}

package/utils/blockParse.ts

@@ -0,0 +1,45 @@
+// Moved from the Workspaces app's `block-parse.ts` with its contents rail
+// (MarkdownContentsRail, approved 2026-10-03). Port: none; the module-level
+// cache is the same.
+
+import type { Block } from '../types';
+import { parseMarkdownToBlocks } from './parser';
+
+/**
+ * ONE parse per document body, shared across consumers: a host's Viewer and
+ * its contents rail render from the same body string, and each would
+ * otherwise run its own full `parseMarkdownToBlocks`. This module-level cache
+ * keys on the content string (value equality: the call sites derive `content`
+ * independently via `extractFrontmatter`), so whoever parses first feeds
+ * everyone.
+ *
+ * Sharing one blocks array is safe: the consumers treat the parser output as
+ * immutable.
+ *
+ * Capacity 4 with hit-refresh recency: a page holds at most a couple of live
+ * bodies at once; the cap only exists so navigating across documents cannot
+ * grow it without bound.
+ */
+const MAX_ENTRIES = 4;
+const cache = new Map<string, Block[]>();
+
+/** Test probe: counts real parses (cache misses). */
+export const blockParseProbe = { parses: 0 };
+
+export function parseBlocksShared(content: string): Block[] {
+  const hit = cache.get(content);
+  if (hit !== undefined) {
+    // Refresh recency (Map preserves insertion order; oldest is evicted).
+    cache.delete(content);
+    cache.set(content, hit);
+    return hit;
+  }
+  blockParseProbe.parses += 1;
+  const blocks = parseMarkdownToBlocks(content);
+  cache.set(content, blocks);
+  if (cache.size > MAX_ENTRIES) {
+    const oldest = cache.keys().next().value;
+    if (oldest !== undefined) cache.delete(oldest);
+  }
+  return blocks;
+}

package/utils/codeLineScroll.ts

@@ -0,0 +1,100 @@
+/**
+ * Find a rendered code line in a file area drawn by Pierre's `File`, and wait
+ * for it when it is not there yet. Pierre draws the lines inside the shadow
+ * root of a `diffs-container` it attaches in the element's constructor, and
+ * may draw them some time after mount (a worker highlight, a large file), so a
+ * fixed delay can fire before the line exists.
+ */
+
+function lineSelector(line: number): string {
+  return `[data-line="${line}"]`;
+}
+
+/** The element of code line `line` under `root`, in its own DOM or a Pierre shadow root. */
+export function findCodeLineElement(root: ParentNode, line: number): HTMLElement | null {
+  const selector = lineSelector(line);
+  const direct = root.querySelector<HTMLElement>(selector);
+  if (direct) return direct;
+  for (const container of root.querySelectorAll('diffs-container')) {
+    const inShadow = container.shadowRoot?.querySelector<HTMLElement>(selector);
+    if (inShadow) return inShadow;
+  }
+  return null;
+}
+
+/** How long to wait for a line before giving up (a file that never draws it). */
+export const CODE_LINE_WAIT_MS = 5_000;
+
+/**
+ * Call `onFound` once with code line `line` under `root`, in the frame after it
+ * exists (so it has been laid out). Watches `root` and every Pierre shadow root
+ * that appears under it until the line shows up. Gives up at once when the line
+ * cannot exist (below 1, or past `lineCount`), and after `timeoutMs`. Returns a
+ * function that stops watching; call it on unmount or when the line or file
+ * changes.
+ */
+export function whenCodeLineRendered(
+  root: HTMLElement,
+  line: number,
+  onFound: (element: HTMLElement) => void,
+  options: { lineCount?: number; timeoutMs?: number } = {},
+): () => void {
+  if (!Number.isInteger(line) || line < 1 || (options.lineCount != null && line > options.lineCount)) {
+    return () => {};
+  }
+  let stopped = false;
+  let frame: number | null = null;
+  const observers: MutationObserver[] = [];
+  const watched = new Set<Node>();
+
+  const stopWatching = () => {
+    for (const observer of observers) observer.disconnect();
+    observers.length = 0;
+    watched.clear();
+  };
+
+  const watch = (node: Node) => {
+    if (watched.has(node)) return;
+    watched.add(node);
+    const observer = new MutationObserver(check);
+    observer.observe(node, { childList: true, subtree: true });
+    observers.push(observer);
+  };
+
+  function check() {
+    if (stopped || frame != null) return;
+    if (findCodeLineElement(root, line)) {
+      stopWatching();
+      frame = requestAnimationFrame(() => {
+        frame = null;
+        if (stopped) return;
+        // Look it up again: a highlight pass may have replaced the element.
+        const element = findCodeLineElement(root, line);
+        if (element) {
+          stop();
+          onFound(element);
+          return;
+        }
+        watch(root);
+        check();
+      });
+      return;
+    }
+    for (const container of root.querySelectorAll('diffs-container')) {
+      if (container.shadowRoot) watch(container.shadowRoot);
+    }
+  }
+
+  const stop = () => {
+    stopped = true;
+    stopWatching();
+    clearTimeout(giveUp);
+    if (frame != null) cancelAnimationFrame(frame);
+  };
+  const giveUp = setTimeout(stop, options.timeoutMs ?? CODE_LINE_WAIT_MS);
+
+  watch(root);
+  check();
+
+  return stop;
+}

package/utils/commentSubmitKey.ts

@@ -0,0 +1,48 @@
+/**
+ * Which key saves a comment (#1934).
+ *
+ * Every comment composer (the plan / annotate comment popover, the panel's
+ * edit box, code review's line, file and general comments, the Inbox's file
+ * comments) asks this one question, so a single setting governs them all.
+ *
+ * - Cmd/Ctrl+Enter always saves, whatever the setting says.
+ * - With `enterSaves` (Settings → General → "Enter saves a comment", the
+ *   cookie-only `enterSavesComment`, off by default) a plain Enter saves too
+ *   and Shift+Enter is left to the field, which adds a new line.
+ * - An Enter that belongs to an input method (Japanese, Chinese, Korean IME)
+ *   never saves: `isComposing`, or the legacy `keyCode` 229 Safari reports for
+ *   the Enter that commits a composition.
+ *
+ * The skill and mention menus are offered the key BEFORE this check by every
+ * caller, so an arrowed-to row still takes Enter.
+ */
+
+export interface CommentSubmitKeyEvent {
+  key: string;
+  shiftKey?: boolean;
+  altKey?: boolean;
+  metaKey?: boolean;
+  ctrlKey?: boolean;
+  isComposing?: boolean;
+  keyCode?: number;
+  /** React's synthetic events carry the DOM event here. */
+  nativeEvent?: { isComposing?: boolean; keyCode?: number };
+}
+
+/** The Enter (or any key) belongs to an input method's composition. */
+export function isImeCompositionKey(event: CommentSubmitKeyEvent): boolean {
+  return (
+    event.isComposing === true ||
+    event.nativeEvent?.isComposing === true ||
+    event.keyCode === 229 ||
+    event.nativeEvent?.keyCode === 229
+  );
+}
+
+/** Whether this keydown saves the comment being written. */
+export function isCommentSubmitKey(event: CommentSubmitKeyEvent, enterSaves: boolean): boolean {
+  if (event.key !== 'Enter') return false;
+  if (isImeCompositionKey(event)) return false;
+  if (event.metaKey || event.ctrlKey) return true;
+  return enterSaves && !event.shiftKey && !event.altKey;
+}

package/utils/cssFontFamily.ts

@@ -0,0 +1,65 @@
+/**
+ * The code font is free text since custom fonts (#851): a person types the
+ * family name of a font installed on their machine. Every place that turns
+ * that name into CSS goes through here, so a quote, backslash or line break
+ * in it can never end the CSS string early.
+ *
+ * Only a family NAME is accepted, never a URL or a stack: the name resolves
+ * against the fonts installed on the machine showing the page, and nothing
+ * is fetched for it.
+ */
+
+/** Longest family name kept. Real names are far shorter. */
+export const MAX_FONT_FAMILY_LENGTH = 200;
+
+/** Control characters (C0, DEL, C1) and the Unicode line and paragraph separators. */
+const CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/g;
+
+/** The name as it is stored: control characters dropped, trimmed, capped. */
+export function normalizeFontFamilyName(name: string): string {
+  return name.replace(CONTROL_CHARS, '').trim().slice(0, MAX_FONT_FAMILY_LENGTH).trim();
+}
+
+/**
+ * The name as a CSS string (`"Iosevka Term"`), with backslashes and double
+ * quotes escaped. Empty for an empty name.
+ */
+export function quoteFontFamily(name: string): string {
+  const clean = normalizeFontFamilyName(name);
+  if (!clean) return '';
+  return `"${clean.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+}
+
+/**
+ * A `font-family` value for code: the quoted name, then the generic
+ * `monospace`, so a name that is not installed still renders aligned code.
+ * Empty for an empty name.
+ */
+export function monoFontStack(name: string | undefined): string {
+  const quoted = name ? quoteFontFamily(name) : '';
+  return quoted ? `${quoted}, monospace` : '';
+}
+
+/** Accepted range per unit for the code font size (roughly 6px to 72px). */
+const FONT_SIZE_RANGE: Record<'px' | 'pt' | 'rem' | 'em', readonly [number, number]> = {
+  px: [6, 72],
+  pt: [5, 54],
+  rem: [0.375, 4.5],
+  em: [0.375, 4.5],
+};
+
+/**
+ * The code font size as CSS, or '' (the default size) when it is not a plain
+ * number with a px, pt, rem or em unit inside a sane range. The value comes
+ * from a cookie and config.json, which other localhost pages can write, so it
+ * is never put into CSS unchecked.
+ */
+export function normalizeCssFontSize(size: string | undefined): string {
+  if (!size) return '';
+  const match = /^(\d{1,3}(?:\.\d{1,3})?)(px|pt|rem|em)$/i.exec(size.trim());
+  if (!match) return '';
+  const value = Number(match[1]);
+  const unit = match[2].toLowerCase() as keyof typeof FONT_SIZE_RANGE;
+  const [min, max] = FONT_SIZE_RANGE[unit];
+  return value >= min && value <= max ? `${value}${unit}` : '';
+}

package/utils/decisionSpec.ts

@@ -83,8 +83,8 @@ export interface DecisionSpec {
 }
 
 export interface DecisionSpecInput {
-  app: 'annotate' | 'review';
-  /** Annotate: `gate`. Review: always true — review's primary decision IS approval. */
+  app: 'annotate' | 'review' | 'plan';
+  /** Annotate: `gate`. Review and plan: ignored — their primary decision IS approval. */
   gate: boolean;
   /** The annotation count interpolated into the menu's discard and note copy (never the primary label). */
   count: number;
@@ -117,6 +117,38 @@ export interface DecisionSpecInput {
    * gate only on `selfAuthored`, muted rather than removed.
    */
   platform?: DecisionPlatformInput;
+  /**
+   * #1057: the plan-review arm's extra facts (only read when `app` is
+   * `'plan'`). Absent means no answers, no edits, no agent switch.
+   */
+  plan?: DecisionPlanInput;
+}
+
+/**
+ * Plan review (#1057). Plan approval is the same decision as review's, with
+ * three plan-only facts: `:::question` answers (an answers-only deny reads as
+ * answers, not as a rejection), direct edits (they ride the deny and, where
+ * supported, the approval), and the agent an OpenCode approval hands off to.
+ */
+export interface DecisionPlanInput {
+  /** How many of `count` are answers to the plan's questions. */
+  answers: number;
+  /** Direct edits ride the feedback (they are not in `count`). */
+  directEdits: boolean;
+  /** The only feedback is answers: the primary reads "Send answers". */
+  answersOnly: boolean;
+  /** Named where notes on approval would be lost ("Claude Code"). */
+  agentName: string;
+  /** OpenCode: the agent approval switches to, shown as "Approve → build". */
+  approveTarget?: string;
+  /**
+   * The only feedback is file changes the reviewer already saved to disk
+   * (Edit Mode on a source-backed document). Approving drops nothing, the
+   * agent just isn't told, so the approve-away row says that instead of
+   * "discard". The value is the confirm's sentence ("Your saved file change
+   * is already on disk. The agent won't be told about it.").
+   */
+  savedFilesOnly?: string;
 }
 
 export interface DecisionPlatformInput {
@@ -449,10 +481,166 @@ function buildPlatformSpec(input: DecisionSpecInput, platform: DecisionPlatformI
   };
 }
 
+/** Frozen label (owner-approved mock): the plan primary when only answers are ready. */
+const SEND_ANSWERS = 'Send answers';
+/** The longest agent name the Approve primary carries before it is cut. */
+const APPROVE_TARGET_MAX = 24;
+
+function approveTargetSuffix(target: string | undefined): string {
+  const name = target?.trim();
+  if (!name) return '';
+  const cut = name.length > APPROVE_TARGET_MAX ? `${name.slice(0, APPROVE_TARGET_MAX - 1)}…` : name;
+  return ` → ${cut}`;
+}
+
+/**
+ * What the plan feedback is, in the reviewer's words: `2 answers`,
+ * `3 annotations`, `1 answer and 2 annotations`, `direct edits`. Mirrors the
+ * editor's describeFeedbackLoss so the menu and the close warnings agree;
+ * duplicated here because this module imports nothing.
+ */
+function planFeedbackPhrase(count: number, plan: DecisionPlanInput): { text: string; plural: boolean } {
+  const answers = Math.min(Math.max(plan.answers, 0), Math.max(count, 0));
+  const others = Math.max(count, 0) - answers;
+  const parts = [
+    answers > 0 ? `${answers} answer${answers === 1 ? '' : 's'}` : '',
+    others > 0 ? `${others} ${annotationNoun(others)}` : '',
+    plan.directEdits ? 'direct edits' : '',
+  ].filter(Boolean);
+  if (parts.length === 0) return { text: 'feedback', plural: false };
+  const text = parts.length === 1
+    ? parts[0]
+    : `${parts.slice(0, -1).join(', ')} and ${parts[parts.length - 1]}`;
+  return { text, plural: parts.length > 1 || answers + others > 1 || plan.directEdits };
+}
+
+/**
+ * The plan arm (#1057, approved proposal "plan-review-decision-control").
+ * Empty: the approval-flow empty spec (Approve; "Approve with a note…" where
+ * the host takes notes on approval; "Request changes…"), the Approve label
+ * naming OpenCode's hand-off agent. Feedback: Send Feedback, or Send answers
+ * for answers only; then the approve-away alternates, each saying what
+ * happens to the feedback on THIS host: "Approve with notes" only where the
+ * server advertises delivery, and "Approve, discard …" always (its subtitle
+ * and confirm name the agent when that is the only way to approve).
+ */
+function buildPlanSpec(input: DecisionSpecInput): DecisionSpec {
+  const plan: DecisionPlanInput = input.plan ?? {
+    answers: 0,
+    directEdits: false,
+    answersOnly: false,
+    agentName: 'The agent',
+  };
+  const target = approveTargetSuffix(plan.approveTarget);
+
+  if (!input.hasFeedback) {
+    const empty = buildEmptySpec(input, true);
+    return {
+      primary: target ? { ...empty.primary, label: `${empty.primary.label}${target}` } : empty.primary,
+      items: empty.items,
+    };
+  }
+
+  const { text: what, plural } = planFeedbackPhrase(input.count, plan);
+  const sendLabel = plan.answersOnly ? SEND_ANSWERS : 'Send Feedback';
+  const items: DecisionMenuItem[] = [
+    {
+      id: 'note-with-feedback',
+      label: plan.answersOnly ? 'Send answers with a note…' : 'Send with a note…',
+      subtitle: `Add an overall note on top of your ${what}`,
+      tone: 'primary',
+      icon: 'send',
+      composer: {
+        title: 'Send with a note',
+        actionLabel: plan.answersOnly ? 'Send answers with note' : 'Send feedback with note',
+        tone: 'primary',
+        icon: 'send',
+        placeholder: DECISION_NOTE_PLACEHOLDER,
+      },
+    },
+  ];
+
+  if (input.approvalNotesSupported) {
+    items.push({
+      id: 'approve-with-notes',
+      // Frozen copy (maintainer-approved): 'Approve with notes'.
+      label: `Approve with notes${target}`,
+      subtitle: `Approve; your ${what} ${plural ? 'ride' : 'rides'} along as non-blocking guidance`,
+      tone: 'success',
+      icon: 'check',
+      dividerBefore: true,
+    });
+  }
+
+  const pronoun = plural ? 'them' : 'it';
+  if (plan.savedFilesOnly) {
+    // Nothing is lost on approval: the changes stay on disk. Same confirm
+    // (one click away from a plain Approve would hide that the agent is not
+    // told), different words.
+    items.push({
+      id: 'discard-and-finish',
+      label: 'Approve without telling the agent…',
+      subtitle: "Already on disk; the agent isn't told. Asks to confirm",
+      tone: 'destructive',
+      icon: 'check',
+      dividerBefore: !input.approvalNotesSupported,
+      confirm: {
+        title: 'Approve without telling the agent?',
+        message: plan.savedFilesOnly,
+        // Frozen copy (maintainer-approved): 'Discard & approve' is the
+        // discard confirm's; this one discards nothing.
+        confirmText: 'Approve',
+      },
+    });
+  } else items.push({
+    id: 'discard-and-finish',
+    label: `Approve, discard ${what}…`,
+    subtitle: input.approvalNotesSupported
+      ? 'Asks to confirm: nothing is sent'
+      : `${plan.agentName} can't take notes on approval; asks to confirm`,
+    tone: 'destructive',
+    icon: 'check',
+    dividerBefore: !input.approvalNotesSupported,
+    confirm: {
+      title: `Discard ${what} and approve?`,
+      message: input.approvalNotesSupported
+        ? `Approving without ${pronoun} tells the agent no changes are needed.`
+        : `${plan.agentName} doesn't take feedback on approval, so your ${what} would be lost. To send ${pronoun}, use ${sendLabel}.`,
+      // Frozen copy (maintainer-approved): 'Discard & approve'.
+      confirmText: 'Discard & approve',
+    },
+  });
+
+  return {
+    primary: plan.answersOnly
+      ? {
+          id: 'primary',
+          // Frozen copy (owner-approved mock): 'Send answers'.
+          label: SEND_ANSWERS,
+          mobileLabel: SEND_ANSWERS,
+          title: 'Send your answers to the agent',
+          tone: 'primary',
+          icon: 'send',
+        }
+      : {
+          id: 'primary',
+          // Frozen copy (maintainer-approved): 'Send Feedback'.
+          label: 'Send Feedback',
+          shortLabel: 'Send',
+          mobileLabel: 'Send feedback',
+          title: 'Send your feedback to the agent',
+          tone: 'primary',
+          icon: 'send',
+        },
+    items,
+  };
+}
+
 export function buildDecisionSpec(input: DecisionSpecInput): DecisionSpec {
   // PR6 (§3.4): the platform destination maps onto the same spec shape with
   // no composer items; presence of the arm selects it outright.
   if (input.platform) return buildPlatformSpec(input, input.platform);
+  if (input.app === 'plan') return buildPlanSpec(input);
   // Review's primary positive decision IS approval, gate flag or not.
   const approvalFlow = input.app === 'review' || input.gate;
   return input.hasFeedback

package/utils/defaultNotesApp.ts

@@ -9,7 +9,7 @@ import { storage } from './storage';
 
 const STORAGE_KEY = 'plannotator-default-notes-app';
 
-export type DefaultNotesApp = 'obsidian' | 'bear' | 'octarine' | 'download' | 'ask';
+export type DefaultNotesApp = 'obsidian' | 'bear' | 'octarine' | 'notion' | 'download' | 'ask';
 
 export function getDefaultNotesApp(): DefaultNotesApp {
   return (storage.getItem(STORAGE_KEY) as DefaultNotesApp) || 'ask';

package/utils/diffFonts.ts

@@ -21,8 +21,11 @@ const loaded = new Set<string>();
 
 export function loadDiffFont(fontFamily: string): void {
   if (!fontFamily || loaded.has(fontFamily)) return;
+  // Own keys only: a typed custom name such as `constructor` or `__proto__`
+  // must never resolve to something inherited from Object.prototype.
+  if (!Object.hasOwn(FONT_URLS, fontFamily)) return;
   const url = FONT_URLS[fontFamily];
-  if (!url) return;
+  if (typeof url !== 'string') return;
 
   const link = document.createElement('link');
   link.rel = 'stylesheet';