prreviewbuddy 0.55.6 → 0.55.10

package/CHANGELOG.md

@@ -1,5 +1,83 @@
 # Changelog
 
+## 0.55.10
+
+**Complexity worth keeping loses its side rules.** In a KISS review, each item in the list had a
+grey line down its left edge, which made the list look like a timeline or a run of quotations. The
+disclosure arrow and the space between items already show where each one ends, so the line is
+gone, and the items sit a little closer to the left so they line up with the heading.
+
+## 0.55.9
+
+**No more 404s in the workspace console.** Opening a review, the Diagrams tab or a file logged a
+"Failed to load resource" error for every chunk the page loads on demand. Vite's preload hints asked
+for each chunk at the site root, while the workspace serves them from `/assets/`. The chunks
+themselves always loaded, so nothing was broken, but the hints were wasted and the console was
+noisy. They now point at `/assets/`, and the page fetches a dynamic import's chunks in parallel as
+intended.
+
+## 0.55.8
+
+**Author's context links to the PR description on GitHub.** In the extension, which sits on the PR
+page where GitHub already shows the description in full, Author's context is now a link, **View PR
+description on GitHub ↗**, instead of a second copy of it: on the Conversation tab it scrolls to
+and focuses GitHub's own description, and from any other tab it goes there. Cmd-, Ctrl-, Shift- and
+Alt-click do what they do on any link. Why this change? follows straight after. This is deliberate,
+host-specific layout: the extension does not duplicate what GitHub renders on the same page. The
+workspace keeps its copy of the description, which is the one the analysis read, and adds the same
+link to the section's header, opening GitHub in a new tab; once the review is stale it reads **View
+current PR description on GitHub ↗**, including when it goes stale with the page open. Neither
+shows the link for a review with no PR, such as a local branch. Both hosts still give the analysis
+the stored description. (Extension 0.25.6.)
+
+**The CLI prints the PR description's link.** When a review of a PR finishes, the terminal shows
+`PR description:` and its GitHub link under the review's own.
+
+**Mermaid diagrams in the workspace.** A block fenced as `mermaid` in a PR description or comment
+is now drawn as a diagram, as GitHub draws it, from the Mermaid the workspace already bundles, with
+nothing fetched from anywhere else. Each one is drawn when it first comes into view, including when
+a collapsed section opens, at its natural size, scrolling sideways in a narrow pane rather than
+shrinking past reading. **View source** shows the Mermaid behind it, with **Copy source**. One that
+cannot be drawn shows its source with "This diagram couldn’t be displayed." Each is labelled for
+screen readers by the title above it, such as "Mermaid diagram: Diagram Walkthrough". Diagrams are
+treated as untrusted, and so are the Diagrams tab's, which a model wrote: both draw through one
+engine, with strict mode, plain-text labels, no scripts, and no links, including `click … href`,
+which is drawn as an ordinary node. A diagram can no longer switch HTML labels back on or inject its
+own styles through `%%{init}%%` or front matter. The extension leaves diagrams to GitHub, on whose
+page it sits.
+
+**Workspace pages load nothing from other sites.** Every workspace page now sends a
+Content-Security-Policy that limits images, styles, fonts, media and connections to the workspace
+itself. Mermaid fetches the picture in an image shape (`A@{ img: "https://…" }`) while it lays the
+diagram out, before anything can sanitise it, so without this a PR description could tell its
+author when you opened the review, and from where. Such a diagram now shows its source instead. A
+test draws hostile diagrams with the real Mermaid in Chromium, through both the description and the
+Diagrams tab, and fails on any request that leaves the page.
+
+## 0.55.7
+
+**Supports common GitHub-formatted PR descriptions and bot walkthroughs.** A PR description or
+comment that used HTML, such as a template's `<details>` or a review bot's file walkthrough table,
+showed as raw tag text in Author's context and on the PR context page. A documented safe subset is
+now formatted: collapsible `<details>` sections (always starting closed, with Markdown inside them
+when set apart by blank lines), tables (which scroll on their own rather than widening the page),
+paragraphs, lists, links, emphasis, code and line breaks. Images, audio and video are linked, not
+displayed inline: a screenshot becomes **View image: Login page** (or **View attached image** when
+it has no description), and audio and video become **Open attached audio** and **Open attached
+video**. They open in a new tab in your own browser session, so a private repository's uploads open
+too, and nothing is fetched until you choose to. Only https media is linked. Anything else outside
+the subset, such as preformatted HTML, shows as the text inside it, never as tags. The subset is
+rebuilt from a fixed allowlist with only safe attributes: scripts, styles, frames, forms and event
+handlers never reach the page, a link must be http(s) or in-page, and anything left open is closed
+within the description. The preview opens on the author's words, past any HTML ahead of them.
+Analysis output is unchanged. (Extension 0.25.5.)
+
+**A long description closes from its top.** Once the full PR description is open, Author's context
+has a **Show less** in its header, which stays at the top of the pane while you read, so you no
+longer scroll to the end of a long description to close it; the one under the description is still
+there. Closing takes you back to the section if you had scrolled past it, with keyboard focus on
+**View full PR description**, and opening it again returns you to where you were reading.
+
 ## 0.55.6
 
 **File paths are shown whole.** A deep directory above a file name was cut short with an ellipsis,