bottleship 0.1.0-prototype.1 → 0.1.0-prototype.2

package/review-app/playground/playground.css

@@ -0,0 +1,18 @@
+/* playground only */
+.still *, .still *::before, .still *::after { animation: none !important; transition: none !important; }
+.gallery-main { overflow: auto; height: 100vh; }
+.g-sec { padding: 48px 56px; border-bottom: 1px solid var(--line); max-width: 1180px; }
+.g-head { margin-bottom: 28px; }
+.g-head h2 { font-size: 19px; font-weight: 500; letter-spacing: -0.015em; margin: 0; }
+.g-head p { color: var(--text-2); margin: 6px 0 0; }
+.g-body { display: flex; flex-direction: column; gap: 32px; }
+.g-spec { display: grid; grid-template-columns: 180px 1fr; gap: 24px; align-items: start; }
+.g-name { font: 12px var(--mono); color: var(--text-3); padding-top: 4px; }
+.g-row { display: flex; gap: 10px; flex-wrap: wrap; align-items: center; }
+.g-swatches { display: grid; grid-template-columns: repeat(auto-fill, minmax(150px, 1fr)); gap: 10px; }
+.g-swatches div { display: flex; align-items: center; gap: 10px; font-size: 12px; }
+.g-swatches i { width: 28px; height: 28px; border-radius: 7px; border: 1px solid var(--line-2); flex: none; }
+.g-frames { height: 520px; border: 1px solid var(--line); border-radius: 12px; overflow: hidden; }
+.g-frames .live { height: 100%; padding: 12px; }
+.rail .g-link { color: var(--text-2); text-decoration: none; padding: 6px 10px; border-radius: 7px; font-size: 13.5px; }
+.rail .g-link:hover { background: var(--hover); color: var(--text); }

package/review-app/playground/vite.config.ts

@@ -0,0 +1,32 @@
+// The playground: the review kit and frame, run locally against a recorded review (no box needed).
+//   npm run playground                       the excalidraw#12602 review, a visual change
+//   FIXTURE=rply-16 npm run playground       the rply#16 review, a backend change with flows
+//   LOCAL=1 npm run playground               either one as a review of local changes, for the developer's agent
+// Open /#/gallery for every component in every state.
+import { defineConfig, type Plugin } from "vite";
+import { readFileSync } from "node:fs";
+import react from "@vitejs/plugin-react";
+import { fileURLToPath } from "node:url";
+import { mockReviewServer } from "./mock";
+
+const here = (p: string) => fileURLToPath(new URL(p, import.meta.url));
+const fixture = here(`./fixtures/${process.env.FIXTURE ?? "excalidraw-12602"}`);
+const local = !!process.env.LOCAL;
+
+// a PR fixture read as local changes: no number, no link, the branch as its title
+const asLocal: Plugin = {
+  name: "fixture-as-local",
+  enforce: "pre",
+  load(id) {
+    if (!local || !id.endsWith("/data/pr.json")) return;
+    const pr = JSON.parse(readFileSync(id, "utf8"));
+    return JSON.stringify({ ...pr, number: 0, url: "", repo: pr.url.split("/")[4], title: pr.headRefName, comments: [], reviews: [] });
+  },
+};
+
+export default defineConfig({
+  root: here("."),
+  plugins: [asLocal, react(), mockReviewServer(fixture, local)],
+  resolve: { alias: { "@data": `${fixture}/data`, "@review": `${fixture}/review.tsx` } },
+  server: { port: 5199, fs: { allow: [here("..")] } },
+});

package/review-app/scripts/check.cjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+// Opens every page of the built review in Chromium, the way the reviewer will see it, and fails on any problem:
+// script errors, failed requests to the review server, and images that do not load.
+// Saves a screenshot of each page to ~/review/checks so you can look at what you built.
+const { mkdirSync } = require("node:fs");
+const { join, resolve } = require("node:path");
+const { chromium } = require("playwright");
+
+const base = (process.env.BOTTLESHIP_REVIEW_URL ?? "http://127.0.0.1:7777").replace(/\/$/, "");
+const out = resolve(__dirname, "../../checks");
+mkdirSync(out, { recursive: true });
+
+(async () => {
+  const browser = await chromium.launch();
+  const problems = [];
+  try {
+    const page = await browser.newPage({ viewport: { width: 1440, height: 900 } });
+    let where = "/";
+    page.on("pageerror", (e) => problems.push(`${where}: ${e.message}`));
+    page.on("console", (m) => m.type() === "error" && (m.location().url ?? "").startsWith(base) && problems.push(`${where}: console: ${m.text()}`));
+    page.on("response", (r) => r.url().startsWith(base) && r.status() >= 400 && problems.push(`${where}: ${r.status()} ${r.url().slice(base.length)}`));
+    await page.goto(`${base}/`, { waitUntil: "domcontentloaded" });
+    await page.waitForFunction(() => Array.isArray(window.__REVIEW_ROUTES__), null, { timeout: 10000 }).catch(() => problems.push("/: the review did not render (no routes); is the app built and the review server running?"));
+    const routes = (await page.evaluate(() => window.__REVIEW_ROUTES__)) ?? [];
+    for (const [i, route] of routes.entries()) {
+      where = route;
+      await page.goto(`${base}/${route}`, { waitUntil: "domcontentloaded" });
+      await page.waitForTimeout(900);
+      const broken = await page.evaluate(() => [...document.images].filter((img) => img.complete && img.naturalWidth === 0).map((img) => img.getAttribute("src")));
+      broken.forEach((src) => problems.push(`${route}: image does not load: ${src}`));
+      const clips = await page.evaluate(() => [...document.querySelectorAll("video")].filter((v) => v.error || v.networkState === 3).map((v) => v.getAttribute("src")));
+      clips.forEach((src) => problems.push(`${route}: video does not load: ${src}`));
+      const name = route.replace(/^#\/?/, "").replace(/[^\w-]+/g, "-") || "overview";
+      await page.screenshot({ path: join(out, `${String(i + 1).padStart(2, "0")}-${name}.png`), fullPage: true });
+    }
+    console.log(`checked ${routes.length} pages; screenshots in ${out}`);
+  } finally {
+    await browser.close();
+  }
+  if (problems.length) {
+    console.error([...new Set(problems)].map((p) => `- ${p}`).join("\n"));
+    process.exit(1);
+  }
+})().catch((e) => {
+  console.error(e.message);
+  process.exit(1);
+});

package/review-app/scripts/clip.cjs

@@ -0,0 +1,104 @@
+#!/usr/bin/env node
+// Records a short video of a running instance into ~/review/shots, for <Clip>: the page, then each action at a
+// person's pace, with a cursor drawn in so the viewer sees where it clicks.
+//
+//   node scripts/clip.cjs --url http://localhost:7781/board --out base-drag
+//     [--do "click:button.add" --do "type:#title=Ship it" --do "press:Enter" --do "hover:.card"
+//      --do "drag:.card=.done" --do "scroll:600" --do "wait:800"]
+//     [--viewport 1280x800] [--scheme light|dark] [--locale he-IL] [--pace 600]
+//
+// Prints the src to put in <Clip> (shots/<out>.webm#t=<seconds>): the part before the page was ready is skipped.
+const { parseArgs } = require("node:util");
+const { mkdirSync, mkdtempSync, rmSync } = require("node:fs");
+const { tmpdir } = require("node:os");
+const { join, resolve } = require("node:path");
+const { chromium } = require("playwright");
+
+const { values: o } = parseArgs({
+  options: {
+    url: { type: "string" }, out: { type: "string" }, do: { type: "string", multiple: true, default: [] },
+    viewport: { type: "string", default: "1280x800" }, scheme: { type: "string", default: "light" }, locale: { type: "string" }, pace: { type: "string", default: "600" },
+  },
+});
+if (!o.url || !o.out) {
+  console.error("usage: clip.cjs --url <url> --out <name> [--do action]... (see the top of this file)");
+  process.exit(2);
+}
+
+const shots = resolve(__dirname, "../../shots");
+mkdirSync(shots, { recursive: true });
+const [width, height] = o.viewport.split("x").map(Number);
+const pace = Number(o.pace);
+
+// a cursor the recording can see: a dot that follows the mouse and rings when it presses
+const CURSOR = `addEventListener("DOMContentLoaded", () => {
+  const c = document.createElement("div");
+  c.style.cssText = "position:fixed;left:0;top:0;width:18px;height:18px;margin:-9px 0 0 -9px;border-radius:50%;background:rgba(20,20,22,.35);border:2px solid #fff;box-shadow:0 1px 4px rgba(0,0,0,.35);pointer-events:none;z-index:2147483647;transition:transform 120ms ease-out;transform:translate(-40px,-40px)";
+  document.documentElement.appendChild(c);
+  let x = -40, y = -40, down = false;
+  const paint = () => (c.style.transform = "translate(" + x + "px," + y + "px) scale(" + (down ? 0.75 : 1) + ")");
+  addEventListener("mousemove", (e) => { x = e.clientX; y = e.clientY; paint(); }, true);
+  addEventListener("mousedown", () => { down = true; paint(); }, true);
+  addEventListener("mouseup", () => { down = false; paint(); }, true);
+});`;
+
+(async () => {
+  const dir = mkdtempSync(join(tmpdir(), "clip-"));
+  const browser = await chromium.launch();
+  try {
+    const t0 = Date.now();
+    const context = await browser.newContext({ viewport: { width, height }, colorScheme: o.scheme, ...(o.locale && { locale: o.locale }), recordVideo: { dir, size: { width, height } } });
+    await context.addInitScript(CURSOR);
+    const page = await context.newPage();
+    await page.goto(o.url, { waitUntil: "networkidle" });
+    // the recording starts with the empty page; the clip starts once this one is ready
+    const start = Math.max(0, (Date.now() - t0) / 1000 - 0.2);
+    let mx = width / 2, my = height / 2;
+    const glide = async (x, y) => { await page.mouse.move(x, y, { steps: Math.max(8, Math.round(Math.hypot(x - mx, y - my) / 18)) }); mx = x; my = y; };
+    const at = async (sel) => {
+      const el = page.locator(sel).first();
+      await el.scrollIntoViewIfNeeded();
+      const box = await el.boundingBox();
+      if (!box) throw new Error(`"${sel}" is not on the page`);
+      return [box.x + box.width / 2, box.y + box.height / 2];
+    };
+    await page.mouse.move(mx, my);
+    await page.waitForTimeout(pace);
+    for (const step of o.do) {
+      const [kind, ...rest] = step.split(":");
+      const arg = rest.join(":");
+      const eq = arg.indexOf("=");
+      if (kind === "click" || kind === "hover") {
+        await glide(...(await at(arg)));
+        await page.waitForTimeout(150);
+        if (kind === "click") await page.mouse.click(mx, my);
+      } else if (kind === "type") {
+        await glide(...(await at(arg.slice(0, eq))));
+        await page.mouse.click(mx, my);
+        await page.locator(arg.slice(0, eq)).first().fill("");
+        await page.keyboard.type(arg.slice(eq + 1), { delay: 55 });
+      } else if (kind === "drag") {
+        await glide(...(await at(arg.slice(0, eq))));
+        await page.mouse.down();
+        const [x, y] = await at(arg.slice(eq + 1));
+        await glide(x, y);
+        await page.mouse.up();
+      } else if (kind === "press") await page.keyboard.press(arg);
+      else if (kind === "scroll") await page.mouse.wheel(0, Number(arg));
+      else if (kind === "wait") await page.waitForTimeout(Number(arg));
+      else throw new Error(`unknown action "${kind}": use click, hover, type, drag, press, scroll or wait`);
+      await page.waitForTimeout(pace);
+    }
+    await page.waitForTimeout(1200);
+    const video = page.video();
+    await context.close();
+    await video.saveAs(join(shots, `${o.out}.webm`));
+    console.log(`shots/${o.out}.webm#t=${start.toFixed(2)}`);
+  } finally {
+    await browser.close();
+    rmSync(dir, { recursive: true, force: true });
+  }
+})().catch((e) => {
+  console.error(e.message);
+  process.exit(1);
+});

package/review-app/scripts/shot.cjs

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+// Takes a screenshot of a running instance into ~/review/shots, for <Shot> and <Compare>.
+//
+//   node scripts/shot.cjs --url http://localhost:7781/settings --out base-settings
+//     [--selector ".zoom-actions"] [--pad 24]       crop to an element, with some room around it
+//     [--highlight ".zoom-actions"]                 outline an element before the shot
+//     [--do "click:button.save" --do "fill:#name=Ada" --do "press:Enter" --do "hover:.menu" --do "wait:500"]
+//     [--viewport 1280x800] [--scale 2] [--scheme light|dark] [--locale he-IL] [--full]
+//
+// Prints the path to put in src (shots/<out>.png).
+const { parseArgs } = require("node:util");
+const { mkdirSync } = require("node:fs");
+const { join, resolve } = require("node:path");
+const { chromium } = require("playwright");
+
+const { values: o } = parseArgs({
+  options: {
+    url: { type: "string" }, out: { type: "string" }, selector: { type: "string" }, pad: { type: "string", default: "16" },
+    highlight: { type: "string" }, do: { type: "string", multiple: true, default: [] }, viewport: { type: "string", default: "1280x800" },
+    scale: { type: "string", default: "2" }, scheme: { type: "string", default: "light" }, locale: { type: "string" }, full: { type: "boolean", default: false },
+  },
+});
+if (!o.url || !o.out) {
+  console.error("usage: shot.cjs --url <url> --out <name> [--selector css] [--highlight css] [--do action]... (see the top of this file)");
+  process.exit(2);
+}
+
+const shots = resolve(__dirname, "../../shots");
+mkdirSync(shots, { recursive: true });
+const [width, height] = o.viewport.split("x").map(Number);
+
+(async () => {
+  const browser = await chromium.launch();
+  try {
+    const page = await browser.newPage({ viewport: { width, height }, deviceScaleFactor: Number(o.scale), colorScheme: o.scheme, ...(o.locale && { locale: o.locale }) });
+    await page.goto(o.url, { waitUntil: "networkidle" });
+    for (const step of o.do) {
+      const [kind, ...rest] = step.split(":");
+      const arg = rest.join(":");
+      if (kind === "click") await page.click(arg);
+      else if (kind === "hover") await page.hover(arg);
+      else if (kind === "press") await page.keyboard.press(arg);
+      else if (kind === "wait") await page.waitForTimeout(Number(arg));
+      else if (kind === "fill") {
+        const i = arg.indexOf("=");
+        await page.fill(arg.slice(0, i), arg.slice(i + 1));
+      } else throw new Error(`unknown action "${kind}": use click, hover, press, wait or fill`);
+    }
+    await page.waitForLoadState("networkidle").catch(() => {});
+    if (o.highlight) await page.locator(o.highlight).first().evaluate((el) => { el.style.outline = "2px solid #eb5d5d"; el.style.outlineOffset = "3px"; });
+    const file = join(shots, `${o.out}.png`);
+    if (o.selector) {
+      const box = await page.locator(o.selector).first().boundingBox();
+      if (!box) throw new Error(`"${o.selector}" is not on the page`);
+      const pad = Number(o.pad);
+      const x = Math.max(0, box.x - pad), y = Math.max(0, box.y - pad);
+      await page.screenshot({ path: file, clip: { x, y, width: Math.min(width - x, box.width + 2 * pad), height: box.height + 2 * pad } });
+    } else await page.screenshot({ path: file, fullPage: o.full });
+    console.log(`shots/${o.out}.png`);
+  } finally {
+    await browser.close();
+  }
+})().catch((e) => {
+  console.error(e.message);
+  process.exit(1);
+});

package/review-app/src/App.tsx

@@ -0,0 +1,132 @@
+// The review shell: the rail with every stop of the tour, routing between them, and keyboard navigation.
+// This frame is shared by every review. Leave it as it is unless a PR genuinely needs something else, and say why.
+import { useEffect, useState } from "react";
+import { Changes, isReviewed } from "./kit/code";
+import { Finish } from "./kit/finish";
+import { PullRequest } from "./kit/pullrequest";
+import { Footer, type Page } from "./kit/agent";
+import { useLive } from "./kit/live";
+import { pr, shortTitle, total } from "./kit/pr";
+import { hash, NavContext, seenChapters as seen, type Review, type Target } from "./kit/review";
+import { Icon, Stat, ThemeToggle } from "./kit/ui";
+
+type Route = { name: "overview" } | { name: "chapter"; id: string } | { name: "changes"; group?: string } | { name: "pr" } | { name: "finish" };
+
+function parse(h: string): Route {
+  const [, kind, id] = h.replace(/^#\/?/, "").match(/^([^/]*)\/?(.*)$/) ?? [];
+  if (kind === "chapter" && id) return { name: "chapter", id: decodeURIComponent(id) };
+  if (kind === "changes") return { name: "changes", group: id ? decodeURIComponent(id) : undefined };
+  if (kind === "finish") return { name: "finish" };
+  if (kind === "pr") return { name: "pr" };
+  return { name: "overview" };
+}
+
+
+// the rail folds to a strip of its marks; remembered across visits
+const RAIL_KEY = "review-rail";
+function useRail() {
+  const [strip, setStrip] = useState(() => { try { return localStorage.getItem(RAIL_KEY) === "strip"; } catch { return false; } });
+  useEffect(() => {
+    document.documentElement.toggleAttribute("data-rail-strip", strip);
+    try { localStorage.setItem(RAIL_KEY, strip ? "strip" : "full"); } catch { /* private mode: still folds for this visit */ }
+  }, [strip]);
+  return [strip, () => setStrip((s) => !s)] as const;
+}
+
+export function App({ review }: { review: Review }) {
+  const [route, setRoute] = useState<Route>(() => parse(location.hash));
+  const [, bump] = useState(0);
+  const [strip, toggleStrip] = useRail();
+  useEffect(() => {
+    const on = () => setRoute(parse(location.hash));
+    const re = () => bump((n) => n + 1);
+    addEventListener("hashchange", on);
+    addEventListener("reviewed", re);
+    return () => (removeEventListener("hashchange", on), removeEventListener("reviewed", re));
+  }, []);
+  const go = (t: Target) => {
+    if (route.name === "chapter") seen.add(route.id);
+    location.hash = hash(t);
+  };
+  const { updates } = useLive();
+  const update = updates.at(-1);
+  // the pull request page only where there is one
+  const order: Target[] = ["overview", ...review.chapters.map((c) => ({ chapter: c.id })), "changes", "finish", ...(pr.number ? ["pr" as const] : [])];
+  // every page, for scripts/check.cjs
+  (window as any).__REVIEW_ROUTES__ = order.map(hash);
+  const index = route.name === "chapter" ? review.chapters.findIndex((c) => c.id === route.id) : -1;
+  const at = route.name === "overview" || route.name === "chapter" ? index + 1 : order.indexOf(route.name);
+
+  useEffect(() => {
+    const key = (e: KeyboardEvent) => {
+      // ⌘B (Ctrl+B elsewhere) folds the rail, as in most editors
+      if ((e.metaKey || e.ctrlKey) && !e.altKey && !e.shiftKey && e.key.toLowerCase() === "b") { e.preventDefault(); toggleStrip(); return; }
+      if (e.metaKey || e.ctrlKey || e.altKey || /input|textarea|select/i.test((e.target as HTMLElement).tagName)) return;
+      if ((e.key === "j" || e.key === "ArrowRight") && at < order.length - 1) go(order[at + 1]);
+      else if ((e.key === "k" || e.key === "ArrowLeft") && at > 0) go(order[at - 1]);
+      else if (e.key === "r") document.getElementById("run")?.click();
+      else if (e.key === "[") toggleStrip();
+    };
+    addEventListener("keydown", key);
+    return () => removeEventListener("keydown", key);
+  });
+  useEffect(() => { document.querySelector("main .content")?.scrollTo(0, 0); }, [route.name, route.name === "chapter" && route.id]);
+
+  const chapter = index >= 0 ? { def: review.chapters[index], index } : undefined;
+  const group = route.name === "changes" && route.group ? review.groups.find((g) => g.id === route.group) : undefined;
+  const page: Page = chapter
+    ? { label: `chapter ${chapter.index + 1}, ${chapter.def.title}`, short: `Chapter ${chapter.index + 1}`, chapter: chapter.def.id }
+    : route.name === "overview" ? { label: "the overview", short: "Overview" }
+    : route.name === "finish" ? { label: "the finish page", short: "Finish" }
+    : route.name === "pr" ? { label: "the pull request page", short: "Pull request" }
+    : { label: group ? `the changes, ${group.title}` : "the changes", short: "Changes" };
+  const Item = ({ to, current, mark, done, sub, title, children }: { to: Target; current: boolean; mark: React.ReactNode; done?: boolean; sub?: boolean; title: string; children: React.ReactNode }) => (
+    <button className={`${done ? "seen" : ""}${sub ? " sub" : ""}`} aria-current={current} onClick={() => go(to)} title={strip ? title : undefined} aria-label={strip ? title : undefined}>
+      <span className="mk">{done ? Icon.check : mark}</span>
+      <span>{children}</span>
+    </button>
+  );
+
+  return (
+    <NavContext.Provider value={{ review, go, chapter }}>
+      <nav className="rail" aria-label="Review">
+        <div className="pr">
+          {pr.url ? <a className="r" href={pr.url} target="_blank" rel="noreferrer">{Icon.pr} {pr.repo} {pr.ref}</a> : <span className="r">{Icon.pr} {pr.repo} {"\u00b7"} {pr.ref}</span>}
+          <b>{shortTitle}</b>
+          {update && <span className="update" title={update.note}>{update.refreshed ? `Updated: ${update.note}` : `Updating the tour: ${update.note}`}</span>}
+        </div>
+        <Item to="overview" current={route.name === "overview"} mark="" title="Overview">Overview</Item>
+        {review.chapters.length > 0 && <div className="sh">Tour</div>}
+        {review.chapters.map((c, i) => (
+          <Item key={c.id} to={{ chapter: c.id }} current={route.name === "chapter" && route.id === c.id} mark={i + 1} done={seen.has(c.id)} title={c.title}>{c.title}</Item>
+        ))}
+        <div className="sh">Code</div>
+        <Item to="changes" current={route.name === "changes" && !route.group} mark="" title="Changes">Changes <Stat {...total} /></Item>
+        {route.name === "changes" &&
+          review.groups.map((g, i) => (
+            <Item key={g.id} sub to={{ group: g.id }} current={route.group === g.id} mark="" done={isReviewed(g.id)} title={g.title}>{g.title}</Item>
+          ))}
+        <Item to="finish" current={route.name === "finish"} mark="" title="Finish review">Finish review</Item>
+        {pr.number > 0 && <Item to="pr" current={route.name === "pr"} mark="" title="Pull request">Pull request</Item>}
+        <div className="gap" />
+        <div className="rail-foot">
+          <button className="icon-btn" onClick={toggleStrip} title={`${strip ? "Show" : "Fold"} the sidebar (${navigator.platform.startsWith("Mac") ? "⌘B" : "Ctrl+B"})`} aria-label={strip ? "Show the sidebar" : "Fold the sidebar"} aria-pressed={strip}>{Icon.panel}</button>
+          <ThemeToggle />
+        </div>
+      </nav>
+      <main>
+        <div className="main-row">
+        <div className="content">
+        {route.name === "overview" && review.overview()}
+        {route.name === "chapter" && (chapter ? <div key={chapter.def.id} style={{ height: "100%" }}>{chapter.def.page()}</div> : <p className="empty">No chapter "{route.id}".</p>)}
+        {route.name === "changes" && <Changes focus={route.group} />}
+        {route.name === "pr" && <PullRequest />}
+        {route.name === "finish" && <Finish />}
+        </div>
+        <aside className="dock" id="agent-dock" />
+        </div>
+        <Footer page={page} />
+      </main>
+    </NavContext.Provider>
+  );
+}

package/review-app/src/data/box.json

@@ -0,0 +1 @@
+{"base": "44a296d4de65a4fc955aa6c2e5df4133f81b4497", "head": "d1d74d5d283e5df930a332001b7048e97b48e5f7"}

package/review-app/src/data/hooks.diff

@@ -0,0 +1,28 @@
+diff --git a/packages/server/src/routes/unfurl.ts b/packages/server/src/routes/unfurl.ts
+index f290720..ea57dec 100644
+--- a/packages/server/src/routes/unfurl.ts
++++ b/packages/server/src/routes/unfurl.ts
+@@ -35,6 +35,7 @@ async function fetchPreview(url: string): Promise<LinkPreview> {
+   let current = url;
+   for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+     await assertPublic(new URL(current).hostname);
++    reviewHook("unfurl.ts:fetch", `server fetches ${current}`, { id: "ssrf", edge: ["guard", "internal"], node: "internal", status: "fail", label: "reached" });
+     const res = await fetch(current, {
+       redirect: "manual",
+       signal: AbortSignal.timeout(TIMEOUT_MS),
+@@ -73,6 +74,7 @@ export function fallbackPreview(url: string, pageUrl: string, icon?: string | nu
+ async function assertPublic(hostname: string) {
+   const host = hostname.replace(/^\[|\]$/g, "");
+   const addresses = isIP(host) ? [host] : (await lookup(host, { all: true })).map((a) => a.address);
++  { const blocked = addresses.length === 0 || addresses.some(isPrivate); reviewHook("unfurl.ts:assertPublic", `guard checked ${host} -> ${blocked ? "blocked" : "allowed"}`, { id: "ssrf", edge: ["route", "guard"], node: "guard", status: blocked ? "fail" : "ok", label: blocked ? "blocked" : "public?" }); }
+   if (addresses.length === 0 || addresses.some(isPrivate)) throw new Error("Private address");
+ }
+ 
+@@ -197,3 +199,7 @@ function clean(value: string | null) {
+     .trim();
+   return text ? text.slice(0, 300) : null;
+ }
++
++function reviewHook(at: string, text: string, flow: object) {
++  fetch(process.env.BOTTLESHIP_REVIEW_URL + "/api/events", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ instance: process.env.BOTTLESHIP_REVIEW_INSTANCE, kind: "hook", at, text, flow }) }).catch(() => {});
++}

package/review-app/src/data/pr.diff

@@ -0,0 +1,114 @@
+diff --git a/packages/server/src/routes/unfurl.ts b/packages/server/src/routes/unfurl.ts
+index 197044a..f290720 100644
+--- a/packages/server/src/routes/unfurl.ts
++++ b/packages/server/src/routes/unfurl.ts
+@@ -76,14 +76,53 @@ async function assertPublic(hostname: string) {
+   if (addresses.length === 0 || addresses.some(isPrivate)) throw new Error("Private address");
+ }
+ 
+-function isPrivate(address: string) {
+-  const v4 = address.replace(/^::ffff:/, "");
+-  if (isIP(v4) === 4) {
+-    const [a, b] = v4.split(".").map(Number) as [number, number];
+-    return a === 0 || a === 10 || a === 127 || (a === 100 && b >= 64 && b < 128) || (a === 169 && b === 254) || (a === 172 && b >= 16 && b < 32) || (a === 192 && b === 168) || a >= 224;
++export function isPrivate(address: string) {
++  const v4 = toIPv4(address);
++  if (v4) return isPrivateV4(v4);
++  const groups = toIPv6Groups(address);
++  // An address this cannot parse is not proven public, so block it too.
++  if (!groups) return true;
++  const [a, b, c, d, e, f] = groups;
++  return (
++    (a & 0xfe00) === 0xfc00 || // fc00::/7 unique local
++    (a & 0xffc0) === 0xfe80 || // fe80::/10 link local
++    (a & 0xff00) === 0xff00 || // ff00::/8 multicast
++    (a === 0x64 && b === 0xff9b && c === 0 && d === 0 && e === 0 && f === 0) // 64:ff9b::/96 NAT64
++  );
++}
++
++function isPrivateV4(v4: string) {
++  const [a, b] = v4.split(".").map(Number) as [number, number];
++  return a === 0 || a === 10 || a === 127 || (a === 100 && b >= 64 && b < 128) || (a === 169 && b === 254) || (a === 172 && b >= 16 && b < 32) || (a === 192 && b === 168) || a >= 224;
++}
++
++// The IPv4 address an IPv6 address embeds (::/96 and ::ffff:0:0/96), or null.
++function toIPv4(address: string): string | null {
++  if (isIP(address) === 4) return address;
++  const groups = toIPv6Groups(address);
++  if (!groups) return null;
++  const [a, b, c, d, e, f, hi, lo] = groups;
++  if (a || b || c || d || e || (f !== 0 && f !== 0xffff)) return null;
++  return `${hi >> 8}.${hi & 0xff}.${lo >> 8}.${lo & 0xff}`;
++}
++
++// The eight 16-bit groups of an IPv6 address, or null when it is not one.
++function toIPv6Groups(address: string): number[] | null {
++  let src = address;
++  const dotted = address.match(/(\d{1,3}(?:\.\d{1,3}){3})$/);
++  if (dotted) {
++    const octets = dotted[1].split(".").map(Number);
++    if (octets.some((octet) => octet > 255)) return null;
++    src = `${address.slice(0, dotted.index)}${(((octets[0] << 8) | octets[1]) >>> 0).toString(16)}:${(((octets[2] << 8) | octets[3]) >>> 0).toString(16)}`;
+   }
+-  const v6 = address.toLowerCase();
+-  return v6 === "::" || v6 === "::1" || v6.startsWith("fc") || v6.startsWith("fd") || v6.startsWith("fe80");
++  const parts = src.split("::");
++  if (parts.length > 2) return null;
++  const parse = (part: string) => part.split(":").map((group) => (group === "" ? NaN : parseInt(group, 16)));
++  const high = parts[0] === "" ? [] : parse(parts[0]);
++  const low = parts.length === 1 || parts[1] === "" ? [] : parse(parts[1]);
++  if (parts.length === 2 && high.length + low.length > 8) return null;
++  const groups = parts.length === 1 ? high : [...high, ...Array(8 - high.length - low.length).fill(0), ...low];
++  return groups.length === 8 && groups.every((group) => Number.isInteger(group) && group >= 0 && group <= 0xffff) ? groups : null;
+ }
+ 
+ async function readStart(res: Response) {
+diff --git a/packages/server/test/unfurl.test.ts b/packages/server/test/unfurl.test.ts
+index 84154f4..6c04e6a 100644
+--- a/packages/server/test/unfurl.test.ts
++++ b/packages/server/test/unfurl.test.ts
+@@ -1,6 +1,8 @@
+ import assert from "node:assert/strict";
++import { createServer } from "node:http";
++import type { AddressInfo } from "node:net";
+ import { test } from "node:test";
+-import { fallbackPreview, parsePreview } from "../src/routes/unfurl.ts";
++import { fallbackPreview, isPrivate, parsePreview } from "../src/routes/unfurl.ts";
+ import { setup } from "./helpers.ts";
+ 
+ test("previews read open graph tags and fall back to title and favicon", () => {
+@@ -44,6 +46,34 @@ test("unfurl refuses private addresses and non-http URLs", async () => {
+   }
+ });
+ 
++test("private addresses cover IPv4-mapped forms and the full IPv6 ranges", () => {
++  for (const address of ["127.0.0.1", "10.0.0.1", "169.254.169.254", "::1", "::", "::ffff:7f00:1", "::ffff:127.0.0.1", "::ffff:a9fe:a9fe", "0:0:0:0:0:ffff:7f00:1", "fe80::1", "fe90::1", "febf::1", "fc00::1", "ff02::1", "64:ff9b::8.8.8.8"]) {
++    assert.equal(isPrivate(address), true, address);
++  }
++  for (const address of ["8.8.8.8", "172.32.0.1", "2606:4700::1111", "::ffff:8.8.8.8", "fbff::1"]) {
++    assert.equal(isPrivate(address), false, address);
++  }
++});
++
++test("unfurl refuses an IPv4-mapped loopback host", async () => {
++  const server = createServer((_req, res) => {
++    res.writeHead(200, { "content-type": "text/html" });
++    res.end("<title>internal</title>");
++  });
++  await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
++  try {
++    const port = (server.address() as AddressInfo).port;
++    const { request, ownedChannel } = await setup();
++    const { human } = await ownedChannel();
++    const { status, json } = await request("GET", `/unfurl?url=${encodeURIComponent(`http://[::ffff:7f00:1]:${port}/`)}`, { token: human });
++    assert.equal(status, 200);
++    assert.equal(json.title, null);
++  } finally {
++    server.closeAllConnections();
++    server.close();
++  }
++});
++
+ test("pages that can't be read still get a favicon, and GitHub links a title", () => {
+   assert.deepEqual(fallbackPreview("https://github.com/acme/app/pull/15", "https://github.com/acme/app/pull/15"), {
+     url: "https://github.com/acme/app/pull/15",

package/review-app/src/data/pr.json

@@ -0,0 +1,68 @@
+{
+  "author": {
+    "is_bot": true,
+    "login": "app/polylane"
+  },
+  "baseRefName": "main",
+  "baseRefOid": "44a296d4de65a4fc955aa6c2e5df4133f81b4497",
+  "body": "**Fixes:** [rply link-preview SSRF guard lets IPv4-mapped IPv6 hosts reach private addresses](https://console.polylane.com/joshuas-workspace-dnkxla/threads/thrd_17a0379e4001b2nxxdsn59kw?ref=github.autofix-pr)\n\nThe link-preview guard let an authenticated caller make the server fetch addresses it meant to block. A URL whose host is an IPv4-mapped IPv6 address such as `::ffff:7f00:1` passed the private-address check, so the server connected to loopback, link-local, or cloud metadata addresses. The guard now parses each address and rejects the full loopback, link-local, unique-local, multicast, mapped, and NAT64 ranges before it fetches.\n\n```mermaid\nflowchart LR\n  A[\"Attacker URL host<br/>[::ffff:7f00:1]\"] --> B[\"assertPublic(hostname)\"]\n  B --> C[\"isPrivate(address)\"]\n  C --> D[\"fetch(hostname)\"]\n  D --> E[\"loopback or metadata reachable<br/>observed pre-fix\"]\n  C -. \"fix: parse groups and check full ranges\" .-> F[\"reject before fetch\"]\n```\n\n<details>\n<summary>Detection evidence</summary>\n\n**Affected:** `int_179ff2f29001vt0jk49fzx9f`\n\n</details>\n\n## Why this fix\n\nThe guard's `isPrivate` stripped only the dotted `::ffff:` prefix and checked only `::`, `::1`, and the `fc`, `fd`, `fe80` prefixes. WHATWG URL serializes a mapped literal as hex, so `http://[::ffff:127.0.0.1]/` became `[::ffff:7f00:1]`, tested public, and was fetched. I reproduced this with a server listening only on 127.0.0.1: the pre-fix code returned its page. Parsing the address into groups and checking the full ranges classifies all 15 private test addresses as private and keeps the 5 public ones public.\n\n`assertPublic` and the fetch still resolve the host separately, so a DNS record that changes between them still bypasses the guard. That separate weakness is recorded on the issue timeline and is not addressed here.\n\n**Production impact: Link-preview guard rejects more private addresses; no deploy path affected**\n\nThe change edits one request-path guard in the rply server (`packages/server/src/routes/unfurl.ts`). It adds no external call, schema change, binding, or environment prerequisite, and it only narrows which hostnames the route may fetch. The workspace graph records no deployed resource for `joshuaKnauber/rply` (`getNodeEdges` on the repository node returned zero edges), so no production resource behavior changes beyond the guard. The repo-wide typecheck and the full server suite (60/60) pass.\n\nChecked and not affected: `provider#code#account#joshuaKnauber#region#earth#type#code.repository#id#joshuaKnauber/rply`.\n\n**Observability**\n\n- `fetchPreview` throws `Private address`, caught by the route, which returns the fallback preview with `title: null`; the existing test asserts this.\n- no new log or metric is added; the change relies on the existing route response.\n\n_Polylane assessed this pull request at `d1d74d5`._\n<!-- polylane:autofix-video -->\n<!-- polylane:autofix-video-attachment page_17a09b709001v6eo2xf2el31xs3sg0t7b277nkbb 1793049633417 -->\n## Fix walkthrough\n\n[![Watch the fix walkthrough](https://badges.polylane.com/poster/page_17a09b709001v6eo2xf2el31xs3sg0t7b277nkbb.png)](https://console.polylane.com/pages/page_17a09b709001v6eo2xf2el31xs3sg0t7b277nkbb?workspace=joshuas-workspace-dnkxla#video)\n\n[Watch the fix explained (1:26)](https://console.polylane.com/pages/page_17a09b709001v6eo2xf2el31xs3sg0t7b277nkbb?workspace=joshuas-workspace-dnkxla#video). Recorded for commit `d1d74d5d283e5df930a332001b7048e97b48e5f7`.\n<!-- /polylane:autofix-video -->\n\n\n<details>\n<summary>Causal chain</summary>\n\n- **Signal** (alert): rply link-preview SSRF check misses IPv4-mapped IPv6 addresses\n- **Surfacing site**: rply link-preview route at joshuaKnauber/rply:packages/server/src/routes/unfurl.ts#isPrivate\n- **Mechanism**: assertPublic passes the host to isPrivate, which strips only the dotted '::ffff:' prefix and checks only ::, ::1, fc, fd, fe80, so a hex IPv4-mapped address such as ::ffff:7f00:1 (WHATWG URL's serialization of a mapped literal) tests as public and fetchPreview fetches it.\n- **Producer**: rply link-preview guard (isPrivate), at joshuaKnauber/rply:packages/server/src/routes/unfurl.ts#isPrivate\n- **Trigger**: An authenticated member requests GET /v1/unfurl?url=http://[::ffff:7f00:1]:PORT/ (or a host whose AAAA record is ::ffff:a9fe:a9fe for 169.254.169.254).\n- **What happens to the failed unit today**: assertPublic resolves the host and rejects when any address is private; the guard and the fetch resolve the host separately, so they are not pinned to the same address.\n- **Blast radius**: unknown other resource(s), unknown other tenant(s); data at risk: Internal HTTP services and cloud instance metadata (169.254.169.254) behind the server's network become reachable; any credentials or data they return can be read.\n- **Producer evidence**:\n  - packages/server/src/routes/unfurl.ts#isPrivate only stripped the dotted mapped prefix and checked a small IPv6 prefix set\n  - new URL('http://[::ffff:127.0.0.1]/').hostname === '[::ffff:7f00:1]' on Node v24.22.1\n  - fetch('http://[::ffff:7f00:1]:PORT/') reached a server listening only on 127.0.0.1 and returned its HTML title (200)\n\n</details>\n\n<details>\n<summary>2 files changed (+77/-8)</summary>\n\n- `packages/server/src/routes/unfurl.ts`: modified, +46/-7\n- `packages/server/test/unfurl.test.ts`: modified, +31/-1\n\n</details>\n\n<a href=\"https://console.polylane.com/joshuas-workspace-dnkxla/threads/thrd_17a0379e4001b2nxxdsn59kw?ref=github.autofix-pr\"><picture><source media=\"(prefers-color-scheme: dark)\" srcset=\"https://badges.polylane.com/view-investigation/dark.svg?v=11&amp;face=1\"><source media=\"(prefers-color-scheme: light)\" srcset=\"https://badges.polylane.com/view-investigation/light.svg?v=11&amp;face=1\"><img alt=\"View thread\" src=\"https://badges.polylane.com/view-investigation/light.svg?v=11&amp;face=1\"></picture></a> <a href=\"https://console.polylane.com/pages/page_17a09716d001eri4m7b59blqagt2xbtffx432q86?workspace=joshuas-workspace-dnkxla&amp;ref=github.autofix-pr\"><picture><source media=\"(prefers-color-scheme: dark)\" srcset=\"https://badges.polylane.com/view-autofix/dark.svg?v=11\"><source media=\"(prefers-color-scheme: light)\" srcset=\"https://badges.polylane.com/view-autofix/light.svg?v=11\"><img alt=\"View autofix\" src=\"https://badges.polylane.com/view-autofix/light.svg?v=11\"></picture></a>\n\n---\n\nGenerated by [Polylane](https://polylane.com/?ref=github.autofix-pr). You can ask follow-ups by mentioning @polylane in a comment.",
+  "comments": [
+    {
+      "id": "IC_kwDOVDnhhs8AAAABfy7Izg",
+      "author": {
+        "login": "cloudflare-workers-and-pages"
+      },
+      "authorAssociation": "NONE",
+      "body": "## 🚀 Deploying Preview to Cloudflare 🚀\n<!-- Preview URL -->\n\n<!-- Preview Deployments -->\n### Preview Deployments by commit\n\n<table>\n  <thead>\n    <tr>\n      <th align=\"left\">Status</th>\n      <th align=\"left\">Deployment URL</th>\n      <th align=\"left\">Commit</th>\n      <th align=\"left\">Updated (UTC)</th>\n      <th align=\"left\">See this deployment's details</th>\n    </tr>\n  </thead>\n  <tbody>\n    <tr>\n      <td><ul><li><b>Build:</b> Failed ❌</li></ul><br/>\n        <a href=\"https://dash.cloudflare.com/?to=/995b3d1a95046253b187262331316150/workers/services/view/rply/production/builds/09b47568-1586-44f5-b914-de34471b4f23\">View logs ↗</a></td>\n      <td></td>\n      <td>d1d74d5</td>\n      <td>2026-10-26T21:07:06.595Z</td>\n      <td><a href=\"https://dash.cloudflare.com/?to=/995b3d1a95046253b187262331316150/workers/services/view/rply/production/builds/09b47568-1586-44f5-b914-de34471b4f23\">View logs ↗</a></td>\n    </tr>\n  </tbody>\n</table>\n",
+      "createdAt": "2026-10-26T22:22:42Z",
+      "includesCreatedEdit": false,
+      "isMinimized": false,
+      "minimizedReason": "",
+      "reactionGroups": [
+        {
+          "content": "EYES",
+          "users": {
+            "totalCount": 1
+          }
+        }
+      ],
+      "url": "https://github.com/joshuaKnauber/rply/pull/16#issuecomment-6428739790",
+      "viewerDidAuthor": false
+    }
+  ],
+  "files": [
+    {
+      "path": "packages/server/src/routes/unfurl.ts",
+      "additions": 46,
+      "deletions": 7,
+      "changeType": "MODIFIED"
+    },
+    {
+      "path": "packages/server/test/unfurl.test.ts",
+      "additions": 31,
+      "deletions": 1,
+      "changeType": "MODIFIED"
+    }
+  ],
+  "headRefName": "polylane/autofix/kl2pj4cba6xv",
+  "headRefOid": "d1d74d5d283e5df930a332001b7048e97b48e5f7",
+  "labels": [
+    {
+      "id": "LA_kwDOVDnhhs8AAAAC_b_ssw",
+      "name": "polylane",
+      "description": "",
+      "color": "ededed"
+    },
+    {
+      "id": "LA_kwDOVDnhhs8AAAAC_cDnwA",
+      "name": "severity:medium",
+      "description": "Polylane autofix severity: medium",
+      "color": "fbca04"
+    }
+  ],
+  "number": 16,
+  "reviews": [],
+  "state": "OPEN",
+  "title": "fix(server): reject IPv4-mapped and reserved IPv6 hosts in link previews",
+  "url": "https://github.com/joshuaKnauber/rply/pull/16"
+}

package/review-app/src/data/review-comments.json

@@ -0,0 +1 @@
+[]