prreviewbuddy 0.55.6 → 0.56.0

package/CHANGELOG.md

@@ -1,5 +1,131 @@
 # Changelog
 
+## 0.56.0
+
+**Work in one focused tab, with Back and Forward that know where you were.** The workspace now has
+Back and Forward buttons at the start of the top bar, before Reviews. They move through this tab's
+workspace history: from the Reviews list into a review, between Overview, themes, Issues,
+Questions, Files, PR context, Diagrams and KISS, and back out again. The browser's own Back and
+Forward buttons, mouse buttons and shortcuts use the same history, and so do **⌘[** and **⌘]** on a
+Mac (**Ctrl+[** and **Ctrl+]** elsewhere). The shortcuts do nothing while you are typing in a field
+or a dialog is open. The workspace's Back is disabled on the first workspace page in a tab, so it
+never takes you to a site you came from; the browser's Back still does.
+
+**Coming back puts every page as you left it.** Back to the Reviews list restores the search,
+filters, rows you loaded with Load more, opened history rows, scroll position and the review you
+had selected. Back to a review restores its section or theme, exactly the files that were open, each
+where you were reading it (the change you stepped to, how far Show more had gone, Expand, and the
+line at the top), the document and sidebar scroll, whether Buddy AI was open and where in its conversation,
+the folded parts of the sidebar, and keyboard focus. If something changed while you were away, for
+example a finding is gone after an update or a file is shorter, you land on the closest thing that
+is still there. Open files and scrolling are part of a page, not steps of their own, so one Back
+always goes to the previous page. A reload keeps all of this too, and so does going back an instant
+after scrolling. Pressing Back and Forward faster than a file can load ends on the page you stopped
+at, with that page's files, never with an earlier page's.
+
+**An unsent Buddy AI question survives.** A question you have started typing is kept per tab while
+you move around, through a refresh, and through the reloads a review does to itself when an
+analysis or update lands. While an earlier question is still being answered you can write the next
+one, and it is kept even if you leave and come back: it waits in the box, never sent by itself, and
+Ask is there once the answer arrives. Enter does nothing until then, so typing can never stop the
+running answer. A question that did not go, because you stopped it, the server could not be
+reached, or another page of the review was already asking, goes back into the box. Text you wrote
+is cleared only when it is sent or when you delete it.
+
+**New tabs still work as links do.** The sidebar's views and themes are now real links, so
+Cmd-click, Ctrl-click, middle-click and the browser's "Open link in new tab" open them in a tab of
+their own, for comparing side by side. Each new tab starts its own history.
+
+**Search and filters no longer add history steps.** Changing the search, the status, author or PR
+filter on the Reviews list updates its address in place, so Back from a review returns to the list
+as you filtered it rather than stepping back through each filter. Bookmarked list addresses open
+exactly as before.
+
+At phone width the version number in the top bar gives way to Back and Forward; it is now also at
+the foot of Help.
+
+Tested in current Chromium, Firefox and WebKit (Safari's engine), each with and without the
+browser's Navigation API. Safari itself and earlier major versions have not been run, so support
+there is provisional.
+
+## 0.55.10
+
+**Complexity worth keeping loses its side rules.** In a KISS review, each item in the list had a
+grey line down its left edge, which made the list look like a timeline or a run of quotations. The
+disclosure arrow and the space between items already show where each one ends, so the line is
+gone, and the items sit a little closer to the left so they line up with the heading.
+
+## 0.55.9
+
+**No more 404s in the workspace console.** Opening a review, the Diagrams tab or a file logged a
+"Failed to load resource" error for every chunk the page loads on demand. Vite's preload hints asked
+for each chunk at the site root, while the workspace serves them from `/assets/`. The chunks
+themselves always loaded, so nothing was broken, but the hints were wasted and the console was
+noisy. They now point at `/assets/`, and the page fetches a dynamic import's chunks in parallel as
+intended.
+
+## 0.55.8
+
+**Author's context links to the PR description on GitHub.** In the extension, which sits on the PR
+page where GitHub already shows the description in full, Author's context is now a link, **View PR
+description on GitHub ↗**, instead of a second copy of it: on the Conversation tab it scrolls to
+and focuses GitHub's own description, and from any other tab it goes there. Cmd-, Ctrl-, Shift- and
+Alt-click do what they do on any link. Why this change? follows straight after. This is deliberate,
+host-specific layout: the extension does not duplicate what GitHub renders on the same page. The
+workspace keeps its copy of the description, which is the one the analysis read, and adds the same
+link to the section's header, opening GitHub in a new tab; once the review is stale it reads **View
+current PR description on GitHub ↗**, including when it goes stale with the page open. Neither
+shows the link for a review with no PR, such as a local branch. Both hosts still give the analysis
+the stored description. (Extension 0.25.6.)
+
+**The CLI prints the PR description's link.** When a review of a PR finishes, the terminal shows
+`PR description:` and its GitHub link under the review's own.
+
+**Mermaid diagrams in the workspace.** A block fenced as `mermaid` in a PR description or comment
+is now drawn as a diagram, as GitHub draws it, from the Mermaid the workspace already bundles, with
+nothing fetched from anywhere else. Each one is drawn when it first comes into view, including when
+a collapsed section opens, at its natural size, scrolling sideways in a narrow pane rather than
+shrinking past reading. **View source** shows the Mermaid behind it, with **Copy source**. One that
+cannot be drawn shows its source with "This diagram couldn’t be displayed." Each is labelled for
+screen readers by the title above it, such as "Mermaid diagram: Diagram Walkthrough". Diagrams are
+treated as untrusted, and so are the Diagrams tab's, which a model wrote: both draw through one
+engine, with strict mode, plain-text labels, no scripts, and no links, including `click … href`,
+which is drawn as an ordinary node. A diagram can no longer switch HTML labels back on or inject its
+own styles through `%%{init}%%` or front matter. The extension leaves diagrams to GitHub, on whose
+page it sits.
+
+**Workspace pages load nothing from other sites.** Every workspace page now sends a
+Content-Security-Policy that limits images, styles, fonts, media and connections to the workspace
+itself. Mermaid fetches the picture in an image shape (`A@{ img: "https://…" }`) while it lays the
+diagram out, before anything can sanitise it, so without this a PR description could tell its
+author when you opened the review, and from where. Such a diagram now shows its source instead. A
+test draws hostile diagrams with the real Mermaid in Chromium, through both the description and the
+Diagrams tab, and fails on any request that leaves the page.
+
+## 0.55.7
+
+**Supports common GitHub-formatted PR descriptions and bot walkthroughs.** A PR description or
+comment that used HTML, such as a template's `<details>` or a review bot's file walkthrough table,
+showed as raw tag text in Author's context and on the PR context page. A documented safe subset is
+now formatted: collapsible `<details>` sections (always starting closed, with Markdown inside them
+when set apart by blank lines), tables (which scroll on their own rather than widening the page),
+paragraphs, lists, links, emphasis, code and line breaks. Images, audio and video are linked, not
+displayed inline: a screenshot becomes **View image: Login page** (or **View attached image** when
+it has no description), and audio and video become **Open attached audio** and **Open attached
+video**. They open in a new tab in your own browser session, so a private repository's uploads open
+too, and nothing is fetched until you choose to. Only https media is linked. Anything else outside
+the subset, such as preformatted HTML, shows as the text inside it, never as tags. The subset is
+rebuilt from a fixed allowlist with only safe attributes: scripts, styles, frames, forms and event
+handlers never reach the page, a link must be http(s) or in-page, and anything left open is closed
+within the description. The preview opens on the author's words, past any HTML ahead of them.
+Analysis output is unchanged. (Extension 0.25.5.)
+
+**A long description closes from its top.** Once the full PR description is open, Author's context
+has a **Show less** in its header, which stays at the top of the pane while you read, so you no
+longer scroll to the end of a long description to close it; the one under the description is still
+there. Closing takes you back to the section if you had scrolled past it, with keyboard focus on
+**View full PR description**, and opening it again returns you to where you were reading.
+
 ## 0.55.6
 
 **File paths are shown whole.** A deep directory above a file name was cut short with an ellipsis,