bottleship 0.1.0-prototype.1 → 0.1.0-prototype.2

package/review-app/package.json

@@ -0,0 +1,24 @@
+{
+  "name": "review",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "build": "vite build",
+    "check": "tsc --noEmit && vite build && node scripts/check.cjs",
+    "playground": "vite --config playground/vite.config.ts"
+  },
+  "dependencies": {
+    "react": "19.1.10",
+    "react-dom": "19.1.10",
+    "react-markdown": "10.1.0",
+    "remark-gfm": "4.0.1"
+  },
+  "devDependencies": {
+    "@types/react": "19.3.0",
+    "@types/react-dom": "19.3.0",
+    "@vitejs/plugin-react": "6.1.2",
+    "typescript": "5.9.3",
+    "vite": "8.3.5"
+  }
+}

package/review-app/playground/fixtures/excalidraw-12602/data/box.json

@@ -0,0 +1 @@
+{"base": "dd2f8fc32b92cbf56f4abee6a0cf3b14681b4b55", "head": "d668f6a2a1603723c2187225fd27b185b30bf920"}

package/review-app/playground/fixtures/excalidraw-12602/data/pr.diff

@@ -0,0 +1,91 @@
+diff --git a/packages/excalidraw/components/Actions.scss b/packages/excalidraw/components/Actions.scss
+index 954d0b51128b..964fa10c244b 100644
+--- a/packages/excalidraw/components/Actions.scss
++++ b/packages/excalidraw/components/Actions.scss
+@@ -5,6 +5,10 @@
+   box-shadow: 0 0 0 1px var(--color-surface-lowest);
+ }
+ 
++.zoom-actions {
++  direction: ltr;
++}
++
+ .zoom-button,
+ .undo-redo-buttons button {
+   border-radius: 0 !important;
+@@ -54,10 +58,6 @@
+   border-top-left-radius: var(--border-radius-lg) !important;
+   border-bottom-left-radius: var(--border-radius-lg) !important;
+ 
+-  :root[dir="rtl"] & {
+-    transform: scaleX(-1);
+-  }
+-
+   .ToolIcon__icon {
+     border-top-right-radius: 0 !important;
+     border-bottom-right-radius: 0 !important;
+@@ -68,10 +68,6 @@
+   border-top-right-radius: var(--border-radius-lg) !important;
+   border-bottom-right-radius: var(--border-radius-lg) !important;
+ 
+-  :root[dir="rtl"] & {
+-    transform: scaleX(-1);
+-  }
+-
+   .ToolIcon__icon {
+     border-top-left-radius: 0 !important;
+     border-bottom-left-radius: 0 !important;
+diff --git a/packages/excalidraw/components/Actions.tsx b/packages/excalidraw/components/Actions.tsx
+index b10e855c8964..9e749352b5f9 100644
+--- a/packages/excalidraw/components/Actions.tsx
++++ b/packages/excalidraw/components/Actions.tsx
+@@ -880,7 +880,7 @@ export const ZoomActions = ({
+   renderAction: ActionManager["renderAction"];
+ }) => (
+   <Stack.Col gap={1} className={CLASSES.ZOOM_ACTIONS}>
+-    <Stack.Row align="center">
++    <Stack.Row align="center" style={{ direction: "ltr" }}>
+       {renderAction("zoomOut")}
+       {renderAction("resetZoom")}
+       {renderAction("zoomIn")}
+diff --git a/packages/excalidraw/css/styles.scss b/packages/excalidraw/css/styles.scss
+index 9a2b66892409..e17afb28479f 100644
+--- a/packages/excalidraw/css/styles.scss
++++ b/packages/excalidraw/css/styles.scss
+@@ -741,10 +741,6 @@ body.excalidraw-cursor-resize * {
+     // shift into the hidden zoom-out button's place
+     .reset-zoom-button-wrapper {
+       transform: translateX(calc(-1 * var(--lg-button-size)));
+-
+-      :root[dir="rtl"] & {
+-        transform: translateX(var(--lg-button-size));
+-      }
+     }
+   }
+ 
+diff --git a/packages/excalidraw/tests/interactivity.test.tsx b/packages/excalidraw/tests/interactivity.test.tsx
+index fa6e50dd0572..0d3f9ba4dd7e 100644
+--- a/packages/excalidraw/tests/interactivity.test.tsx
++++ b/packages/excalidraw/tests/interactivity.test.tsx
+@@ -717,6 +717,21 @@ describe("ui={{ enabled: ... }}", () => {
+     ).toBe(true);
+   });
+ 
++  it("preserves LTR direction for zoom controls in RTL locales", async () => {
++    await render(<Excalidraw langCode="he-IL" />);
++
++    const zoomActions = queryContainer(".zoom-actions")!;
++    expect(zoomActions).not.toBe(null);
++    const row = zoomActions.querySelector(".Stack_horizontal") as HTMLElement;
++    expect(row).not.toBe(null);
++    expect(row.style.direction).toBe("ltr");
++
++    const buttons = zoomActions.querySelectorAll("button");
++    expect(buttons[0].classList.contains("zoom-out-button")).toBe(true);
++    expect(buttons[1].classList.contains("reset-zoom-button")).toBe(true);
++    expect(buttons[2].classList.contains("zoom-in-button")).toBe(true);
++  });
++
+   it("renders an opted-in scroll-back-to-content control", async () => {
+     await render(
+       <Excalidraw

package/review-app/playground/fixtures/excalidraw-12602/data/pr.json

@@ -0,0 +1,62 @@
+{
+  "author": {
+    "id": "U_kgDOCp5MVQ",
+    "is_bot": false,
+    "login": "yashash1111",
+    "name": ""
+  },
+  "baseRefName": "master",
+  "baseRefOid": "701b901a0f1ba3d0b390d9cdf63d112e25abac4b",
+  "body": "",
+  "comments": [
+    {
+      "id": "IC_kwDODcka_M8AAAABlm7rBA",
+      "author": {
+        "login": "vercel"
+      },
+      "authorAssociation": "NONE",
+      "body": "[vc]: #o1Usyqwb1sMkGdhOILBPAYCVZX+OMBlSvpLLQMXj5/A=:eyJpc01vbm9yZXBvIjp0cnVlLCJ0eXBlIjoiZ2l0aHViIiwicHJvamVjdHMiOlt7Im5hbWUiOiJleGNhbGlkcmF3IiwicHJvamVjdElkIjoiUW1lRzdGQkJ0YzZzV0ZjUHZZdFNIS1ZucnZFOTl0ZFg4N3cyMlpaTHBBY0pOdCIsInYwIjpmYWxzZSwicm9vdERpcmVjdG9yeSI6bnVsbCwiaW5zcGVjdG9yVXJsIjoiaHR0cHM6Ly92ZXJjZWwuY29tL2V4Y2FsaWRyYXcvZXhjYWxpZHJhdy84b20zQW9YWnJUVVJZVWNDOG92QVZjVGRuNmZ5IiwicHJldmlld1VybCI6ImV4Y2FsaWRyYXctZ2l0LWZvcmsteWFzaGFzaDExMTEtZml4LXpvb20tYnV0dG9ucy1ydGwtZXhjYWxpZHJhdy52ZXJjZWwuYXBwIiwibmV4dENvbW1pdFN0YXR1cyI6IkRFUExPWUVEIn1dLCJyZXF1ZXN0UmV2aWV3VXJsIjoiaHR0cHM6Ly92ZXJjZWwuY29tL3ZlcmNlbC1hZ2VudC9yZXF1ZXN0LXJldmlldz9vd25lcj1leGNhbGlkcmF3JnJlcG89ZXhjYWxpZHJhdyZwcj0xMjYwMiJ9\nThe latest updates on your projects. Learn more about [Vercel for GitHub](https://vercel.link/github-learn-more).\n\n| Project | Deployment | Actions | Updated |\n| :--- | :----- | :------ | :------ |\n| <a href=\"https://vercel.com/excalidraw/excalidraw\"><sup><img src=\"https://vercel.com/api/www/avatar?projectId=QmeG7FBBtc6sWFcPvYtSHKVnrvE99tdX87w22ZZLpAcJNt&teamId=team_ya85fAOOrg7PG2amlMCyqH0k&s=32\" width=\"16\" height=\"16\" align=\"middle\" alt=\"\" /></sup></a> [excalidraw](https://vercel.com/excalidraw/excalidraw) | ![Ready](https://vercel.com/static/status/ready.svg) [Ready](https://vercel.com/excalidraw/excalidraw/8om3AoXZrTURYUcC8ovAVcTdn6fy) | [Preview](https://excalidraw-git-fork-yashash1111-fix-zoom-buttons-rtl-excalidraw.vercel.app) | <relative-time datetime=\"2026-11-12T08:37:21.834Z\">Nov 12, 2026 8:37am UTC</relative-time> |\n\n<a href=\"https://vercel.com/vercel-agent/request-review?owner=excalidraw&repo=excalidraw&pr=12602\" rel=\"noreferrer\"><picture><source media=\"(prefers-color-scheme: dark)\" srcset=\"https://agents-vade-review.vercel.sh/request-review-dark.svg\"><source media=\"(prefers-color-scheme: light)\" srcset=\"https://agents-vade-review.vercel.sh/request-review-light.svg\"><img src=\"https://agents-vade-review.vercel.sh/request-review-light.svg\" alt=\"Request Review\"></picture></a>\n\n",
+      "createdAt": "2026-11-12T08:36:07Z",
+      "includesCreatedEdit": true,
+      "isMinimized": false,
+      "minimizedReason": "",
+      "reactionGroups": [],
+      "url": "https://github.com/excalidraw/excalidraw/pull/12602#issuecomment-6818818820",
+      "viewerDidAuthor": false
+    }
+  ],
+  "files": [
+    {
+      "path": "packages/excalidraw/components/Actions.scss",
+      "additions": 4,
+      "deletions": 8,
+      "changeType": "MODIFIED"
+    },
+    {
+      "path": "packages/excalidraw/components/Actions.tsx",
+      "additions": 1,
+      "deletions": 1,
+      "changeType": "MODIFIED"
+    },
+    {
+      "path": "packages/excalidraw/css/styles.scss",
+      "additions": 0,
+      "deletions": 4,
+      "changeType": "MODIFIED"
+    },
+    {
+      "path": "packages/excalidraw/tests/interactivity.test.tsx",
+      "additions": 15,
+      "deletions": 0,
+      "changeType": "MODIFIED"
+    }
+  ],
+  "headRefName": "fix/zoom-buttons-rtl",
+  "headRefOid": "d668f6a2a1603723c2187225fd27b185b30bf920",
+  "labels": [],
+  "number": 12602,
+  "reviews": [],
+  "state": "OPEN",
+  "title": "fix(ui): preserve zoom controls order in RTL locales (#12375)",
+  "url": "https://github.com/excalidraw/excalidraw/pull/12602"
+}

package/review-app/playground/fixtures/excalidraw-12602/data/review-comments.json

@@ -0,0 +1,44 @@
+[
+  {
+    "id": 9001,
+    "path": "packages/excalidraw/components/Actions.tsx",
+    "line": 883,
+    "side": "RIGHT",
+    "body": "Actions.scss now sets `direction: ltr` on `.zoom-actions` too. Do we need both? The inline style wins either way.",
+    "user": { "login": "dwelle", "type": "User" },
+    "created_at": "2026-11-12T09:14:00Z",
+    "html_url": "https://github.com/excalidraw/excalidraw/pull/12602#discussion_r9001"
+  },
+  {
+    "id": 9002,
+    "path": "packages/excalidraw/components/Actions.tsx",
+    "line": 883,
+    "side": "RIGHT",
+    "in_reply_to_id": 9001,
+    "body": "The class covers the wrapper, the inline style the row. I can drop the inline one if you prefer.",
+    "user": { "login": "yashash1111", "type": "User" },
+    "created_at": "2026-11-12T11:40:00Z"
+  },
+  {
+    "id": 9003,
+    "path": "packages/excalidraw/tests/interactivity.test.tsx",
+    "line": 732,
+    "start_line": 730,
+    "side": "RIGHT",
+    "start_side": "RIGHT",
+    "body": "Checking classes by index is brittle. Maybe:\n\n```suggestion\n    const order = [...buttons].map((b) => b.className);\n    expect(order).toEqual([expect.stringContaining(\"zoom-out\"), expect.stringContaining(\"reset-zoom\"), expect.stringContaining(\"zoom-in\")]);\n```",
+    "user": { "login": "mtolmacs", "type": "User" },
+    "created_at": "2026-11-12T10:02:00Z",
+    "resolved": true
+  },
+  {
+    "id": 9004,
+    "path": "packages/excalidraw/css/styles.scss",
+    "line": null,
+    "original_line": 744,
+    "side": "RIGHT",
+    "body": "<!-- review-bot -->\n**Possible regression:** the reset button no longer shifts in RTL. Verify the hidden zoom-out case.",
+    "user": { "login": "review-bot[bot]", "type": "Bot" },
+    "created_at": "2026-11-11T18:20:00Z"
+  }
+]

package/review-app/playground/fixtures/excalidraw-12602/events.json

@@ -0,0 +1 @@
+{"rtl-order":{"status":{"id":"rtl-order","status":"done"},"ms":5036,"events":[{"instance":"base","kind":"request","text":"open /?lng=he-IL","step":"rtl-order","seq":1},{"instance":"base","kind":"request","text":"open /?lng=ar-SA","step":"rtl-order","seq":2},{"instance":"base","kind":"fail","text":"he-IL + 100% − · ar-SA + 100% −","overlay":{"status":"fail","title":"Order is reversed","body":"he-IL: left to right: + 100% −\nar-SA: left to right: + 100% −"},"step":"rtl-order","seq":3},{"instance":"head","kind":"request","text":"open /?lng=he-IL","step":"rtl-order","seq":4},{"instance":"head","kind":"request","text":"open /?lng=ar-SA","step":"rtl-order","seq":5},{"instance":"head","kind":"ok","text":"he-IL − 100% + · ar-SA − 100% +","overlay":{"status":"ok","title":"Order is − 100% +","body":"he-IL: left to right: − 100% +\nar-SA: left to right: − 100% +"},"step":"rtl-order","seq":6}]},"rtl-zen":{"status":{"id":"rtl-zen","status":"done"},"ms":5039,"events":[{"instance":"base","kind":"request","text":"open /?lng=he-IL and turn on zen mode","step":"rtl-zen","seq":7},{"instance":"base","kind":"ok","text":"after zen, \"−\" slot is on the right of the \"+\" slot","overlay":{"status":"ok","title":"Zoom level sits in the − slot","body":"he-IL: zen: \"100%\" has its right edge 0px from where \"−\" had it"},"step":"rtl-zen","seq":8},{"instance":"head","kind":"request","text":"open /?lng=he-IL and turn on zen mode","step":"rtl-zen","seq":9},{"instance":"head","kind":"ok","text":"after zen, \"−\" slot is on the left of the \"+\" slot","overlay":{"status":"ok","title":"Zoom level sits in the − slot","body":"he-IL: zen: \"100%\" has its left edge 0px from where \"−\" had it"},"step":"rtl-zen","seq":10}]},"ltr-unchanged":{"status":{"id":"ltr-unchanged","status":"done"},"ms":3015,"events":[{"instance":"base","kind":"request","text":"open /?lng=en-US","step":"ltr-unchanged","seq":11},{"instance":"base","kind":"ok","text":"en-US − 100% +","overlay":{"status":"ok","title":"Order is − 100% +","body":"en-US: left to right: − 100% +"},"step":"ltr-unchanged","seq":12},{"instance":"head","kind":"request","text":"open /?lng=en-US","step":"ltr-unchanged","seq":13},{"instance":"head","kind":"ok","text":"en-US − 100% +","overlay":{"status":"ok","title":"Order is − 100% +","body":"en-US: left to right: − 100% +"},"step":"ltr-unchanged","seq":14}]},"pr-test":{"status":{"id":"pr-test","status":"done"},"ms":6020,"events":[{"instance":"base","kind":"request","text":"vitest -t 'preserves LTR direction'","step":"pr-test","seq":15},{"instance":"base","kind":"fail","text":"Test fails","overlay":{"status":"fail","title":"Test fails","body":"⎯⎯⎯⎯⎯⎯⎯ Failed Tests 1 ⎯⎯⎯⎯⎯⎯⎯ AssertionError: expected '' to be 'ltr' // Object.is equality "},"step":"pr-test","seq":16},{"instance":"head","kind":"request","text":"vitest -t 'preserves LTR direction'","step":"pr-test","seq":17},{"instance":"head","kind":"ok","text":"Test passes","overlay":{"status":"ok","title":"Test passes","body":"      Tests  1 passed | 60 skipped (61) "},"step":"pr-test","seq":18}]}}

package/review-app/playground/fixtures/excalidraw-12602/instances.json

@@ -0,0 +1 @@
+{ "7781": "shots/base-he-page.png", "7782": "shots/head-he-page.png" }

package/review-app/playground/fixtures/excalidraw-12602/review.tsx

@@ -0,0 +1,103 @@
+import { Attention, BeforeAfter, Card, Chapter, Compare, defineReview, Lead, Live, Overview } from "../../../src/kit";
+
+const SCSS = "packages/excalidraw/components/Actions.scss";
+const ACTIONS = "packages/excalidraw/components/Actions.tsx";
+const STYLES = "packages/excalidraw/css/styles.scss";
+const TEST = "packages/excalidraw/tests/interactivity.test.tsx";
+
+const HE = "/?lng=he-IL";
+
+export default defineReview({
+  instances: [
+    { id: "base", label: "Base", detail: "master, Hebrew", port: 7781, path: HE },
+    { id: "head", label: "Head", detail: "this PR, Hebrew", port: 7782, path: HE },
+  ],
+
+  overview: () => (
+    <Overview>
+      <Lead>In right-to-left languages such as Hebrew and Arabic, the zoom controls in the bottom corner keep their − 100% + order instead of showing + 100% −.</Lead>
+      <BeforeAfter
+        before={<>The row of zoom buttons followed the page direction, so in an RTL locale it was mirrored: <code>+ 100% −</code>. Corner rounding and the zen-mode shift were patched with <code>scaleX(-1)</code> and an RTL-only <code>translateX</code>.</>}
+        after={<>The zoom row is forced to <code>direction: ltr</code>, so it reads <code>− 100% +</code> in every locale. The RTL-only patches are deleted, because the left-to-right rules now apply everywhere.</>}
+      />
+      <Compare title="The zoom controls in Hebrew" base="shots/base-he-IL-zoom.png" head="shots/head-he-IL-zoom.png" caption="Base mirrors the controls; head keeps − 100% +." />
+      <Attention
+        items={[
+          { text: "Zen mode: the lone zoom level must still land in the − slot", detail: "The RTL-only translateX is gone, so the one left-shift now serves both directions. Chapter 2 measures where it ends up.", to: { chapter: "rtl-zen" } },
+          { text: "The direction is set twice", detail: "Both a .zoom-actions CSS rule and an inline style on the inner row force ltr. Either alone would probably do. The inline one is what the test checks.", to: { group: "force-ltr" } },
+          { text: "The new test checks the DOM order, not what is on screen", detail: "It fails on base and passes on head, but it asserts the inline direction and the order of the buttons in the DOM. A CSS change that flips them visually would still pass. Chapter 1 measures the order on screen.", to: { group: "tests" } },
+          { text: "Everything inside the zoom controls is now LTR", detail: "That includes the tooltips shown on hover. They are rendered outside the row, so they were not changed.", to: { chapter: "ltr-unchanged" } },
+        ]}
+        held={[
+          { source: "PR title", quote: "fix(ui): preserve zoom controls order in RTL locales", to: { chapter: "rtl-order" } },
+          { source: "PR diff", quote: "preserves LTR direction for zoom controls in RTL locales", to: { group: "tests" } },
+          { source: "Implied by the removed RTL-only rules", quote: "(deleted :root[dir=\"rtl\"] rules)", to: { chapter: "ltr-unchanged" } },
+        ]}
+      />
+    </Overview>
+  ),
+
+  chapters: [
+    {
+      id: "rtl-order",
+      title: "Button order in Hebrew and Arabic",
+      page: () => (
+        <Chapter
+          title="Button order in Hebrew and Arabic"
+          step="rtl-order"
+          expect={{ base: "Reads + 100% − from left to right in both locales.", head: "Reads − 100% + in both locales." }}
+          group="force-ltr"
+          evidence={<>
+            <Live />
+            <Compare title="Arabic" base="shots/base-ar-zoom.png" head="shots/head-ar-zoom.png" />
+            <Compare title="Dark theme, Hebrew" base="shots/base-he-dark.png" head="shots/head-he-dark.png" />
+            <Compare title="Hovering −" base="shots/base-he-hover.png" head="shots/head-he-hover.png" caption="The pressed highlight and the rounded corners follow the button." />
+            <Compare title="The whole page" base="shots/base-he-page.png" head="shots/head-he-page.png" caption="The zoom controls are outlined." />
+          </>}
+        >
+          Opens each instance in Hebrew and Arabic and sorts the three zoom buttons by their position on screen. The live apps open in Hebrew above the screenshots, so you can look at the controls yourself.
+        </Chapter>
+      ),
+    },
+    {
+      id: "rtl-zen",
+      title: "Zen mode in Hebrew",
+      page: () => (
+        <Chapter
+          title="Zen mode in Hebrew"
+          step="rtl-zen"
+          expect={{ base: "The zoom level sits where − was, on the right (mirrored).", head: "The zoom level sits where − was, on the left." }}
+          group="zen"
+        >
+          In zen mode only the zoom level shows. It slides into the hidden − button's place. Presses Alt+Z in Hebrew and measures where the zoom level ends up compared with where − was. Try it yourself in the apps: Alt+Z, in Hebrew.
+        </Chapter>
+      ),
+    },
+    {
+      id: "ltr-unchanged",
+      title: "English is unchanged",
+      page: () => (
+        <Chapter
+          title="English is unchanged"
+          step="ltr-unchanged"
+          expect={{ base: "− 100% +", head: "− 100% +" }}
+          group="zen"
+          evidence={<>
+            <Compare title="English" base="shots/base-en-US-zoom.png" head="shots/head-en-US-zoom.png" mode="diff" caption="Nothing is marked: the deleted RTL rules did not touch the left-to-right layout." />
+            <Compare title="Tooltip, Hebrew" base="shots/base-he-tip.png" head="shots/head-he-tip.png" caption="Tooltips are drawn outside the zoom row, so they keep their own direction." />
+          </>}
+        >
+          Repeats the measurement in English on both instances, to show the deleted RTL rules did not touch the normal layout. Screenshots here compare the pixels, and the hover tooltip in Hebrew.
+        </Chapter>
+      ),
+    },
+  ],
+
+  groups: [
+    { id: "force-ltr", title: "Force the zoom row to left-to-right", why: "The fix itself: one CSS rule and an inline style, so the flex row never reverses.", chapter: "rtl-order", file: ACTIONS, lines: [[880, 887]] },
+    { id: "force-ltr-css", title: "The CSS rule", why: "Same direction set on the container class.", chapter: "rtl-order", file: SCSS, lines: [[8, 10]] },
+    { id: "cleanup", title: "RTL-only mirroring removed", why: "These patched the mirrored row (flipping the rounded corners). With the row fixed, they would now do harm.", chapter: "rtl-order", file: SCSS, lines: [[55, 78]] },
+    { id: "zen", title: "Zen mode shift", why: "The RTL-only opposite shift is deleted, because the left shift is now right in every locale.", chapter: "rtl-zen", file: STYLES, lines: [[738, 748]] },
+    { id: "tests", title: "Test", why: "Renders Hebrew and checks the inline direction and the order of the buttons.", file: TEST, lines: [[718, 736]] },
+  ],
+});

package/review-app/playground/fixtures/rply-16/data/box.json

@@ -0,0 +1 @@
+{"base": "44a296d4de65a4fc955aa6c2e5df4133f81b4497", "head": "d1d74d5d283e5df930a332001b7048e97b48e5f7"}

package/review-app/playground/fixtures/rply-16/data/hooks.diff

@@ -0,0 +1,28 @@
+diff --git a/packages/server/src/routes/unfurl.ts b/packages/server/src/routes/unfurl.ts
+index f290720..ea57dec 100644
+--- a/packages/server/src/routes/unfurl.ts
++++ b/packages/server/src/routes/unfurl.ts
+@@ -35,6 +35,7 @@ async function fetchPreview(url: string): Promise<LinkPreview> {
+   let current = url;
+   for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+     await assertPublic(new URL(current).hostname);
++    reviewHook("unfurl.ts:fetch", `server fetches ${current}`, { id: "ssrf", edge: ["guard", "internal"], node: "internal", status: "fail", label: "reached" });
+     const res = await fetch(current, {
+       redirect: "manual",
+       signal: AbortSignal.timeout(TIMEOUT_MS),
+@@ -73,6 +74,7 @@ export function fallbackPreview(url: string, pageUrl: string, icon?: string | nu
+ async function assertPublic(hostname: string) {
+   const host = hostname.replace(/^\[|\]$/g, "");
+   const addresses = isIP(host) ? [host] : (await lookup(host, { all: true })).map((a) => a.address);
++  { const blocked = addresses.length === 0 || addresses.some(isPrivate); reviewHook("unfurl.ts:assertPublic", `guard checked ${host} -> ${blocked ? "blocked" : "allowed"}`, { id: "ssrf", edge: ["route", "guard"], node: "guard", status: blocked ? "fail" : "ok", label: blocked ? "blocked" : "public?" }); }
+   if (addresses.length === 0 || addresses.some(isPrivate)) throw new Error("Private address");
+ }
+ 
+@@ -197,3 +199,7 @@ function clean(value: string | null) {
+     .trim();
+   return text ? text.slice(0, 300) : null;
+ }
++
++function reviewHook(at: string, text: string, flow: object) {
++  fetch(process.env.BOTTLESHIP_REVIEW_URL + "/api/events", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ instance: process.env.BOTTLESHIP_REVIEW_INSTANCE, kind: "hook", at, text, flow }) }).catch(() => {});
++}

package/review-app/playground/fixtures/rply-16/data/pr.diff

@@ -0,0 +1,114 @@
+diff --git a/packages/server/src/routes/unfurl.ts b/packages/server/src/routes/unfurl.ts
+index 197044a..f290720 100644
+--- a/packages/server/src/routes/unfurl.ts
++++ b/packages/server/src/routes/unfurl.ts
+@@ -76,14 +76,53 @@ async function assertPublic(hostname: string) {
+   if (addresses.length === 0 || addresses.some(isPrivate)) throw new Error("Private address");
+ }
+ 
+-function isPrivate(address: string) {
+-  const v4 = address.replace(/^::ffff:/, "");
+-  if (isIP(v4) === 4) {
+-    const [a, b] = v4.split(".").map(Number) as [number, number];
+-    return a === 0 || a === 10 || a === 127 || (a === 100 && b >= 64 && b < 128) || (a === 169 && b === 254) || (a === 172 && b >= 16 && b < 32) || (a === 192 && b === 168) || a >= 224;
++export function isPrivate(address: string) {
++  const v4 = toIPv4(address);
++  if (v4) return isPrivateV4(v4);
++  const groups = toIPv6Groups(address);
++  // An address this cannot parse is not proven public, so block it too.
++  if (!groups) return true;
++  const [a, b, c, d, e, f] = groups;
++  return (
++    (a & 0xfe00) === 0xfc00 || // fc00::/7 unique local
++    (a & 0xffc0) === 0xfe80 || // fe80::/10 link local
++    (a & 0xff00) === 0xff00 || // ff00::/8 multicast
++    (a === 0x64 && b === 0xff9b && c === 0 && d === 0 && e === 0 && f === 0) // 64:ff9b::/96 NAT64
++  );
++}
++
++function isPrivateV4(v4: string) {
++  const [a, b] = v4.split(".").map(Number) as [number, number];
++  return a === 0 || a === 10 || a === 127 || (a === 100 && b >= 64 && b < 128) || (a === 169 && b === 254) || (a === 172 && b >= 16 && b < 32) || (a === 192 && b === 168) || a >= 224;
++}
++
++// The IPv4 address an IPv6 address embeds (::/96 and ::ffff:0:0/96), or null.
++function toIPv4(address: string): string | null {
++  if (isIP(address) === 4) return address;
++  const groups = toIPv6Groups(address);
++  if (!groups) return null;
++  const [a, b, c, d, e, f, hi, lo] = groups;
++  if (a || b || c || d || e || (f !== 0 && f !== 0xffff)) return null;
++  return `${hi >> 8}.${hi & 0xff}.${lo >> 8}.${lo & 0xff}`;
++}
++
++// The eight 16-bit groups of an IPv6 address, or null when it is not one.
++function toIPv6Groups(address: string): number[] | null {
++  let src = address;
++  const dotted = address.match(/(\d{1,3}(?:\.\d{1,3}){3})$/);
++  if (dotted) {
++    const octets = dotted[1].split(".").map(Number);
++    if (octets.some((octet) => octet > 255)) return null;
++    src = `${address.slice(0, dotted.index)}${(((octets[0] << 8) | octets[1]) >>> 0).toString(16)}:${(((octets[2] << 8) | octets[3]) >>> 0).toString(16)}`;
+   }
+-  const v6 = address.toLowerCase();
+-  return v6 === "::" || v6 === "::1" || v6.startsWith("fc") || v6.startsWith("fd") || v6.startsWith("fe80");
++  const parts = src.split("::");
++  if (parts.length > 2) return null;
++  const parse = (part: string) => part.split(":").map((group) => (group === "" ? NaN : parseInt(group, 16)));
++  const high = parts[0] === "" ? [] : parse(parts[0]);
++  const low = parts.length === 1 || parts[1] === "" ? [] : parse(parts[1]);
++  if (parts.length === 2 && high.length + low.length > 8) return null;
++  const groups = parts.length === 1 ? high : [...high, ...Array(8 - high.length - low.length).fill(0), ...low];
++  return groups.length === 8 && groups.every((group) => Number.isInteger(group) && group >= 0 && group <= 0xffff) ? groups : null;
+ }
+ 
+ async function readStart(res: Response) {
+diff --git a/packages/server/test/unfurl.test.ts b/packages/server/test/unfurl.test.ts
+index 84154f4..6c04e6a 100644
+--- a/packages/server/test/unfurl.test.ts
++++ b/packages/server/test/unfurl.test.ts
+@@ -1,6 +1,8 @@
+ import assert from "node:assert/strict";
++import { createServer } from "node:http";
++import type { AddressInfo } from "node:net";
+ import { test } from "node:test";
+-import { fallbackPreview, parsePreview } from "../src/routes/unfurl.ts";
++import { fallbackPreview, isPrivate, parsePreview } from "../src/routes/unfurl.ts";
+ import { setup } from "./helpers.ts";
+ 
+ test("previews read open graph tags and fall back to title and favicon", () => {
+@@ -44,6 +46,34 @@ test("unfurl refuses private addresses and non-http URLs", async () => {
+   }
+ });
+ 
++test("private addresses cover IPv4-mapped forms and the full IPv6 ranges", () => {
++  for (const address of ["127.0.0.1", "10.0.0.1", "169.254.169.254", "::1", "::", "::ffff:7f00:1", "::ffff:127.0.0.1", "::ffff:a9fe:a9fe", "0:0:0:0:0:ffff:7f00:1", "fe80::1", "fe90::1", "febf::1", "fc00::1", "ff02::1", "64:ff9b::8.8.8.8"]) {
++    assert.equal(isPrivate(address), true, address);
++  }
++  for (const address of ["8.8.8.8", "172.32.0.1", "2606:4700::1111", "::ffff:8.8.8.8", "fbff::1"]) {
++    assert.equal(isPrivate(address), false, address);
++  }
++});
++
++test("unfurl refuses an IPv4-mapped loopback host", async () => {
++  const server = createServer((_req, res) => {
++    res.writeHead(200, { "content-type": "text/html" });
++    res.end("<title>internal</title>");
++  });
++  await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
++  try {
++    const port = (server.address() as AddressInfo).port;
++    const { request, ownedChannel } = await setup();
++    const { human } = await ownedChannel();
++    const { status, json } = await request("GET", `/unfurl?url=${encodeURIComponent(`http://[::ffff:7f00:1]:${port}/`)}`, { token: human });
++    assert.equal(status, 200);
++    assert.equal(json.title, null);
++  } finally {
++    server.closeAllConnections();
++    server.close();
++  }
++});
++
+ test("pages that can't be read still get a favicon, and GitHub links a title", () => {
+   assert.deepEqual(fallbackPreview("https://github.com/acme/app/pull/15", "https://github.com/acme/app/pull/15"), {
+     url: "https://github.com/acme/app/pull/15",

package/review-app/playground/fixtures/rply-16/data/pr.json

@@ -0,0 +1,68 @@
+{
+  "author": {
+    "is_bot": true,
+    "login": "app/polylane"
+  },
+  "baseRefName": "main",
+  "baseRefOid": "44a296d4de65a4fc955aa6c2e5df4133f81b4497",
+  "body": "**Fixes:** [rply link-preview SSRF guard lets IPv4-mapped IPv6 hosts reach private addresses](https://console.polylane.com/joshuas-workspace-dnkxla/threads/thrd_17a0379e4001b2nxxdsn59kw?ref=github.autofix-pr)\n\nThe link-preview guard let an authenticated caller make the server fetch addresses it meant to block. A URL whose host is an IPv4-mapped IPv6 address such as `::ffff:7f00:1` passed the private-address check, so the server connected to loopback, link-local, or cloud metadata addresses. The guard now parses each address and rejects the full loopback, link-local, unique-local, multicast, mapped, and NAT64 ranges before it fetches.\n\n```mermaid\nflowchart LR\n  A[\"Attacker URL host<br/>[::ffff:7f00:1]\"] --> B[\"assertPublic(hostname)\"]\n  B --> C[\"isPrivate(address)\"]\n  C --> D[\"fetch(hostname)\"]\n  D --> E[\"loopback or metadata reachable<br/>observed pre-fix\"]\n  C -. \"fix: parse groups and check full ranges\" .-> F[\"reject before fetch\"]\n```\n\n<details>\n<summary>Detection evidence</summary>\n\n**Affected:** `int_179ff2f29001vt0jk49fzx9f`\n\n</details>\n\n## Why this fix\n\nThe guard's `isPrivate` stripped only the dotted `::ffff:` prefix and checked only `::`, `::1`, and the `fc`, `fd`, `fe80` prefixes. WHATWG URL serializes a mapped literal as hex, so `http://[::ffff:127.0.0.1]/` became `[::ffff:7f00:1]`, tested public, and was fetched. I reproduced this with a server listening only on 127.0.0.1: the pre-fix code returned its page. Parsing the address into groups and checking the full ranges classifies all 15 private test addresses as private and keeps the 5 public ones public.\n\n`assertPublic` and the fetch still resolve the host separately, so a DNS record that changes between them still bypasses the guard. That separate weakness is recorded on the issue timeline and is not addressed here.\n\n**Production impact: Link-preview guard rejects more private addresses; no deploy path affected**\n\nThe change edits one request-path guard in the rply server (`packages/server/src/routes/unfurl.ts`). It adds no external call, schema change, binding, or environment prerequisite, and it only narrows which hostnames the route may fetch. The workspace graph records no deployed resource for `joshuaKnauber/rply` (`getNodeEdges` on the repository node returned zero edges), so no production resource behavior changes beyond the guard. The repo-wide typecheck and the full server suite (60/60) pass.\n\nChecked and not affected: `provider#code#account#joshuaKnauber#region#earth#type#code.repository#id#joshuaKnauber/rply`.\n\n**Observability**\n\n- `fetchPreview` throws `Private address`, caught by the route, which returns the fallback preview with `title: null`; the existing test asserts this.\n- no new log or metric is added; the change relies on the existing route response.\n\n_Polylane assessed this pull request at `d1d74d5`._\n<!-- polylane:autofix-video -->\n<!-- polylane:autofix-video-attachment page_17a09b709001v6eo2xf2el31xs3sg0t7b277nkbb 1793049633417 -->\n## Fix walkthrough\n\n[![Watch the fix walkthrough](https://badges.polylane.com/poster/page_17a09b709001v6eo2xf2el31xs3sg0t7b277nkbb.png)](https://console.polylane.com/pages/page_17a09b709001v6eo2xf2el31xs3sg0t7b277nkbb?workspace=joshuas-workspace-dnkxla#video)\n\n[Watch the fix explained (1:26)](https://console.polylane.com/pages/page_17a09b709001v6eo2xf2el31xs3sg0t7b277nkbb?workspace=joshuas-workspace-dnkxla#video). Recorded for commit `d1d74d5d283e5df930a332001b7048e97b48e5f7`.\n<!-- /polylane:autofix-video -->\n\n\n<details>\n<summary>Causal chain</summary>\n\n- **Signal** (alert): rply link-preview SSRF check misses IPv4-mapped IPv6 addresses\n- **Surfacing site**: rply link-preview route at joshuaKnauber/rply:packages/server/src/routes/unfurl.ts#isPrivate\n- **Mechanism**: assertPublic passes the host to isPrivate, which strips only the dotted '::ffff:' prefix and checks only ::, ::1, fc, fd, fe80, so a hex IPv4-mapped address such as ::ffff:7f00:1 (WHATWG URL's serialization of a mapped literal) tests as public and fetchPreview fetches it.\n- **Producer**: rply link-preview guard (isPrivate), at joshuaKnauber/rply:packages/server/src/routes/unfurl.ts#isPrivate\n- **Trigger**: An authenticated member requests GET /v1/unfurl?url=http://[::ffff:7f00:1]:PORT/ (or a host whose AAAA record is ::ffff:a9fe:a9fe for 169.254.169.254).\n- **What happens to the failed unit today**: assertPublic resolves the host and rejects when any address is private; the guard and the fetch resolve the host separately, so they are not pinned to the same address.\n- **Blast radius**: unknown other resource(s), unknown other tenant(s); data at risk: Internal HTTP services and cloud instance metadata (169.254.169.254) behind the server's network become reachable; any credentials or data they return can be read.\n- **Producer evidence**:\n  - packages/server/src/routes/unfurl.ts#isPrivate only stripped the dotted mapped prefix and checked a small IPv6 prefix set\n  - new URL('http://[::ffff:127.0.0.1]/').hostname === '[::ffff:7f00:1]' on Node v24.22.1\n  - fetch('http://[::ffff:7f00:1]:PORT/') reached a server listening only on 127.0.0.1 and returned its HTML title (200)\n\n</details>\n\n<details>\n<summary>2 files changed (+77/-8)</summary>\n\n- `packages/server/src/routes/unfurl.ts`: modified, +46/-7\n- `packages/server/test/unfurl.test.ts`: modified, +31/-1\n\n</details>\n\n<a href=\"https://console.polylane.com/joshuas-workspace-dnkxla/threads/thrd_17a0379e4001b2nxxdsn59kw?ref=github.autofix-pr\"><picture><source media=\"(prefers-color-scheme: dark)\" srcset=\"https://badges.polylane.com/view-investigation/dark.svg?v=11&amp;face=1\"><source media=\"(prefers-color-scheme: light)\" srcset=\"https://badges.polylane.com/view-investigation/light.svg?v=11&amp;face=1\"><img alt=\"View thread\" src=\"https://badges.polylane.com/view-investigation/light.svg?v=11&amp;face=1\"></picture></a> <a href=\"https://console.polylane.com/pages/page_17a09716d001eri4m7b59blqagt2xbtffx432q86?workspace=joshuas-workspace-dnkxla&amp;ref=github.autofix-pr\"><picture><source media=\"(prefers-color-scheme: dark)\" srcset=\"https://badges.polylane.com/view-autofix/dark.svg?v=11\"><source media=\"(prefers-color-scheme: light)\" srcset=\"https://badges.polylane.com/view-autofix/light.svg?v=11\"><img alt=\"View autofix\" src=\"https://badges.polylane.com/view-autofix/light.svg?v=11\"></picture></a>\n\n---\n\nGenerated by [Polylane](https://polylane.com/?ref=github.autofix-pr). You can ask follow-ups by mentioning @polylane in a comment.",
+  "comments": [
+    {
+      "id": "IC_kwDOVDnhhs8AAAABfy7Izg",
+      "author": {
+        "login": "cloudflare-workers-and-pages"
+      },
+      "authorAssociation": "NONE",
+      "body": "## 🚀 Deploying Preview to Cloudflare 🚀\n<!-- Preview URL -->\n\n<!-- Preview Deployments -->\n### Preview Deployments by commit\n\n<table>\n  <thead>\n    <tr>\n      <th align=\"left\">Status</th>\n      <th align=\"left\">Deployment URL</th>\n      <th align=\"left\">Commit</th>\n      <th align=\"left\">Updated (UTC)</th>\n      <th align=\"left\">See this deployment's details</th>\n    </tr>\n  </thead>\n  <tbody>\n    <tr>\n      <td><ul><li><b>Build:</b> Failed ❌</li></ul><br/>\n        <a href=\"https://dash.cloudflare.com/?to=/995b3d1a95046253b187262331316150/workers/services/view/rply/production/builds/09b47568-1586-44f5-b914-de34471b4f23\">View logs ↗</a></td>\n      <td></td>\n      <td>d1d74d5</td>\n      <td>2026-10-26T21:07:06.595Z</td>\n      <td><a href=\"https://dash.cloudflare.com/?to=/995b3d1a95046253b187262331316150/workers/services/view/rply/production/builds/09b47568-1586-44f5-b914-de34471b4f23\">View logs ↗</a></td>\n    </tr>\n  </tbody>\n</table>\n",
+      "createdAt": "2026-10-26T22:22:42Z",
+      "includesCreatedEdit": false,
+      "isMinimized": false,
+      "minimizedReason": "",
+      "reactionGroups": [
+        {
+          "content": "EYES",
+          "users": {
+            "totalCount": 1
+          }
+        }
+      ],
+      "url": "https://github.com/joshuaKnauber/rply/pull/16#issuecomment-6428739790",
+      "viewerDidAuthor": false
+    }
+  ],
+  "files": [
+    {
+      "path": "packages/server/src/routes/unfurl.ts",
+      "additions": 46,
+      "deletions": 7,
+      "changeType": "MODIFIED"
+    },
+    {
+      "path": "packages/server/test/unfurl.test.ts",
+      "additions": 31,
+      "deletions": 1,
+      "changeType": "MODIFIED"
+    }
+  ],
+  "headRefName": "polylane/autofix/kl2pj4cba6xv",
+  "headRefOid": "d1d74d5d283e5df930a332001b7048e97b48e5f7",
+  "labels": [
+    {
+      "id": "LA_kwDOVDnhhs8AAAAC_b_ssw",
+      "name": "polylane",
+      "description": "",
+      "color": "ededed"
+    },
+    {
+      "id": "LA_kwDOVDnhhs8AAAAC_cDnwA",
+      "name": "severity:medium",
+      "description": "Polylane autofix severity: medium",
+      "color": "fbca04"
+    }
+  ],
+  "number": 16,
+  "reviews": [],
+  "state": "OPEN",
+  "title": "fix(server): reject IPv4-mapped and reserved IPv6 hosts in link previews",
+  "url": "https://github.com/joshuaKnauber/rply/pull/16"
+}

package/review-app/playground/fixtures/rply-16/data/review-comments.json

@@ -0,0 +1 @@
+[]