revdeck 0.1.0 → 0.2.0

package/dist/daemon.js

@@ -74,6 +74,16 @@ var init_locale = __esm({
   }
 });
 
+// src/core/types.ts
+var LEVELS, REACTIONS;
+var init_types = __esm({
+  "src/core/types.ts"() {
+    "use strict";
+    LEVELS = ["blocker", "major", "minor", "question"];
+    REACTIONS = ["thumbsup", "thumbsdown", "smile", "tada", "confused", "heart", "rocket", "eyes"];
+  }
+});
+
 // src/core/errors.ts
 function messageOf(error) {
   if (error instanceof Error) return error.message;
@@ -289,11 +299,11 @@ function diffStats(files) {
 function changedPaths(files) {
   return files.map((file) => file.path);
 }
-function findFile(files, path8) {
-  return files.find((file) => file.path === path8) ?? files.find((file) => file.oldPath === path8);
+function findFile(files, path9) {
+  return files.find((file) => file.path === path9) ?? files.find((file) => file.oldPath === path9);
 }
-function findNewLine(files, path8, line) {
-  const file = findFile(files, path8);
+function findNewLine(files, path9, line) {
+  const file = findFile(files, path9);
   if (!file) return void 0;
   for (const hunk of file.hunks) {
     for (const item of hunk.lines) {
@@ -302,8 +312,8 @@ function findNewLine(files, path8, line) {
   }
   return void 0;
 }
-function snippetAround(files, path8, line, radius = 6) {
-  const file = findFile(files, path8);
+function snippetAround(files, path9, line, radius = 6) {
+  const file = findFile(files, path9);
   if (!file || line == null) return null;
   const flat = file.hunks.flatMap((hunk) => hunk.lines);
   const target = flat.findIndex((item) => item.newLine === line);
@@ -316,9 +326,9 @@ function snippetAround(files, path8, line, radius = 6) {
     target: item.newLine === line
   }));
 }
-function linePosition(files, path8, line) {
-  const file = findFile(files, path8);
-  const found = findNewLine(files, path8, line);
+function linePosition(files, path9, line) {
+  const file = findFile(files, path9);
+  const found = findNewLine(files, path9, line);
   if (!file || !found) return null;
   return { newPath: file.path, newLine: line, oldPath: file.oldPath, oldLine: found.kind === " " ? found.oldLine : null };
 }
@@ -429,8 +439,8 @@ async function withTempJson(data, fn) {
     await rm(dir, { recursive: true, force: true });
   }
 }
-function query(path8, params) {
-  const url = new URL(path8.startsWith("/") ? path8 : `/${path8}`, "http://local");
+function query(path9, params) {
+  const url = new URL(path9.startsWith("/") ? path9 : `/${path9}`, "http://local");
   for (const [key, value] of Object.entries(params)) {
     if (value !== void 0 && value !== "") url.searchParams.set(key, String(value));
   }
@@ -459,6 +469,7 @@ var EMPTY_SHA, GitLabProvider;
 var init_gitlab = __esm({
   "src/providers/gitlab.ts"() {
     "use strict";
+    init_types();
     init_diff();
     init_errors();
     init_redact();
@@ -475,7 +486,7 @@ var init_gitlab = __esm({
       ref;
       options;
       platform = "gitlab";
-      capabilities = { reactions: true, resolve: true, nativeDrafts: true };
+      capabilities = { reactions: true, resolve: true, nativeDrafts: true, attachments: true };
       run;
       me = null;
       infoCache = null;
@@ -643,6 +654,24 @@ rename to ${newPath}
           await this.call(["--method", "PUT", this.endpoint(`/discussions/${encodeURIComponent(threadId)}`), "--input", file]);
         });
       }
+      async reactions(noteId) {
+        const base = this.endpoint(`/notes/${encodeURIComponent(noteId)}/award_emoji`);
+        const items = await this.paged(base);
+        const me = await this.currentUser();
+        const grouped = /* @__PURE__ */ new Map();
+        for (const item of items) {
+          if (!REACTIONS.includes(item.name)) continue;
+          const reaction = grouped.get(item.name) ?? { name: item.name, count: 0, users: [], mine: false };
+          reaction.count += 1;
+          const username = item.user?.username;
+          if (username) {
+            reaction.users.push(username);
+            if (username === me.username) reaction.mine = true;
+          }
+          grouped.set(item.name, reaction);
+        }
+        return [...grouped.values()].sort((left, right) => left.name.localeCompare(right.name));
+      }
       async react(noteId, emoji) {
         const base = this.endpoint(`/notes/${encodeURIComponent(noteId)}/award_emoji`);
         const existing = await this.json([query(base, { per_page: 100 })]);
@@ -657,6 +686,16 @@ rename to ${newPath}
         });
         return { active: true };
       }
+      async upload(input) {
+        const endpoint = `projects/${this.projectRef}/uploads`;
+        const uploaded = await this.json(["--method", "POST", endpoint, "--form", `file=@${input.path}`]);
+        const raw = uploaded.full_path || uploaded.url || "";
+        if (!raw) throw new ProviderError(tr("GitLab \u043D\u0435 \u0432\u0435\u0440\u043D\u0443\u043B \u0441\u0441\u044B\u043B\u043A\u0443 \u043D\u0430 \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043D\u043D\u044B\u0439 \u0444\u0430\u0439\u043B", "GitLab did not return a link to the uploaded file"));
+        const absolute = raw.startsWith("http://") || raw.startsWith("https://") ? raw : `https://${this.ref.host}${raw.startsWith("/") ? "" : "/"}${raw}`;
+        const label = input.name.replace(/[[\]\r\n]/g, " ").trim() || "attachment";
+        const markdown = input.contentType.startsWith("image/") || input.contentType.startsWith("video/") ? `![${label}](${absolute})` : `[${label}](${absolute})`;
+        return { name: input.name, url: absolute, markdown };
+      }
       async createThread(input) {
         const info = await this.info();
         if (!info.commit.head || info.commit.head === EMPTY_SHA) {
@@ -693,7 +732,7 @@ __export(github_exports, {
   GitHubProvider: () => GitHubProvider
 });
 import { tmpdir as tmpdir3 } from "node:os";
-var THREADS_QUERY, REACTIONS, GitHubProvider;
+var THREADS_QUERY, REACTIONS2, CONTENT_TO_NAME, GitHubProvider;
 var init_github = __esm({
   "src/providers/github.ts"() {
     "use strict";
@@ -717,7 +756,7 @@ var init_github = __esm({
     }
   }
 }`;
-    REACTIONS = {
+    REACTIONS2 = {
       thumbsup: "+1",
       thumbsdown: "-1",
       smile: "laugh",
@@ -727,6 +766,7 @@ var init_github = __esm({
       rocket: "rocket",
       eyes: "eyes"
     };
+    CONTENT_TO_NAME = Object.fromEntries(Object.entries(REACTIONS2).map(([name, content]) => [content, name]));
     GitHubProvider = class {
       constructor(ref, options) {
         this.ref = ref;
@@ -742,7 +782,7 @@ var init_github = __esm({
       ref;
       options;
       platform = "github";
-      capabilities = { reactions: true, resolve: true, nativeDrafts: false };
+      capabilities = { reactions: true, resolve: true, nativeDrafts: false, attachments: false };
       run;
       owner;
       name;
@@ -945,8 +985,27 @@ rename to ${newPath}
         const mutation = resolved ? "mutation($id: ID!) { resolveReviewThread(input: { threadId: $id }) { thread { isResolved } } }" : "mutation($id: ID!) { unresolveReviewThread(input: { threadId: $id }) { thread { isResolved } } }";
         await this.graphql(mutation, { id: threadId });
       }
+      async reactions(noteId) {
+        const base = `repos/${this.repo}/pulls/comments/${encodeURIComponent(noteId)}/reactions`;
+        const items = await this.paged(base);
+        const me = await this.currentUser();
+        const grouped = /* @__PURE__ */ new Map();
+        for (const item of items) {
+          const name = CONTENT_TO_NAME[item.content];
+          if (!name) continue;
+          const reaction = grouped.get(name) ?? { name, count: 0, users: [], mine: false };
+          reaction.count += 1;
+          const login = item.user?.login;
+          if (login) {
+            reaction.users.push(login);
+            if (login === me.username) reaction.mine = true;
+          }
+          grouped.set(name, reaction);
+        }
+        return [...grouped.values()].sort((left, right) => left.name.localeCompare(right.name));
+      }
       async react(noteId, emoji) {
-        const content = REACTIONS[emoji];
+        const content = REACTIONS2[emoji];
         if (!content) throw new ProviderError(tr(`GitHub \u043D\u0435 \u043F\u043E\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u0440\u0435\u0430\u043A\u0446\u0438\u044E ${emoji}`, `GitHub does not support reaction ${emoji}`));
         const base = `repos/${this.repo}/pulls/comments/${noteId}/reactions`;
         const existing = await this.json([query(base, { per_page: 100 })]);
@@ -961,6 +1020,12 @@ rename to ${newPath}
         });
         return { active: true };
       }
+      async upload(_input) {
+        throw new ProviderError(
+          tr("GitHub \u043D\u0435 \u0434\u0430\u0451\u0442 \u043F\u0443\u0431\u043B\u0438\u0447\u043D\u043E\u0433\u043E API \u0434\u043B\u044F \u0437\u0430\u0433\u0440\u0443\u0437\u043A\u0438 \u0432\u043B\u043E\u0436\u0435\u043D\u0438\u0439", "GitHub has no public API for uploading attachments"),
+          tr("\u0432\u0441\u0442\u0430\u0432\u044C\u0442\u0435 \u0430\u0431\u0441\u043E\u043B\u044E\u0442\u043D\u0443\u044E \u0441\u0441\u044B\u043B\u043A\u0443 \u043D\u0430 \u0444\u0430\u0439\u043B \u0432\u0440\u0443\u0447\u043D\u0443\u044E; \u0437\u0430\u0433\u0440\u0443\u0437\u043A\u0430 \u043F\u043E\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044F \u0442\u043E\u043B\u044C\u043A\u043E \u0434\u043B\u044F GitLab", "paste an absolute file URL manually; uploads are supported for GitLab only")
+        );
+      }
       async createThread(input) {
         if (input.line === null) {
           const comment2 = await withTempJson(
@@ -992,7 +1057,7 @@ rename to ${newPath}
 import { existsSync as existsSync4, readFileSync } from "node:fs";
 import { appendFile, open as open2, readFile as readFile3, unlink as unlink3 } from "node:fs/promises";
 import net2 from "node:net";
-import path7 from "node:path";
+import path8 from "node:path";
 import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
 
@@ -1084,7 +1149,7 @@ async function writeFileAtomic(file, data, mode = 384) {
 init_redact();
 
 // src/version.ts
-var VERSION = "0.1.0";
+var VERSION = "0.2.0";
 var PROTOCOL_VERSION = 1;
 
 // src/daemon/main.ts
@@ -1095,10 +1160,8 @@ import { DatabaseSync } from "node:sqlite";
 import { mkdirSync } from "node:fs";
 import path2 from "node:path";
 
-// src/core/types.ts
-var LEVELS = ["blocker", "major", "minor", "question"];
-
 // src/core/refs.ts
+init_types();
 function reviewId(ref) {
   return `${ref.platform}:${ref.host}/${ref.project}!${ref.number}`;
 }
@@ -1639,6 +1702,9 @@ init_redact();
 init_errors();
 import { EventEmitter } from "node:events";
 import { createHash as createHash2, randomBytes } from "node:crypto";
+import { mkdtemp as mkdtemp2, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
+import { tmpdir as tmpdir4 } from "node:os";
+import path6 from "node:path";
 
 // src/core/config.ts
 import { z } from "zod";
@@ -1691,8 +1757,8 @@ function globToRegExp(glob) {
 function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function classifyFile(path8) {
-  const lower = path8.toLowerCase();
+function classifyFile(path9) {
+  const lower = path9.toLowerCase();
   if (/(^|\/)(node_modules|dist|build|coverage|vendor)\//.test(lower)) return "generated";
   if (/\.(md|mdx|rst|txt|adoc)$/.test(lower) || /(^|\/)(docs?|adr)\//.test(lower)) return "docs";
   if (/(^|\/)(__tests__|tests?|spec|e2e)\//.test(lower) || /\.(test|spec)\.[cm]?[jt]sx?$/.test(lower) || /_test\.go$/.test(lower)) return "test";
@@ -2004,7 +2070,8 @@ init_locale();
 var CONTROL_OR_HIDDEN = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f\u00ad\u061c\u115f\u1160\u180e\u200b-\u200f\u2028-\u202e\u2060-\u206f\u2800\u3164\ufeff\uffa0]/;
 var QUICK_ACTION = /^[\s\p{Z}\p{Cf}]*\/[a-z_]+(?=[\s\p{Z}\p{Cf}]|$)/imu;
 var MASS_MENTION = /(^|[^\w@./-])@(all|here|everyone)(?![\w-])/i;
-var MD_IMAGE = /!\[[^\]]*\]\s*\(|!\[[^\]]*\]\s*\[/;
+var MD_IMAGE_REF = /!\[[^\]]*\]\s*\[/;
+var MD_IMAGE_LINK = /!\[[^\]]*\]\s*\(\s*<?([^)\s>]+)>?(?:\s+["'][^"']*["'])?\s*\)/g;
 var HTML_TAG = /<(?:img|script|iframe|style|video|audio|object|embed|svg|math)\b/i;
 var HTML_COMMENT = /<!--/;
 var MAX_LENGTH = 64 * 1024;
@@ -2017,15 +2084,113 @@ function sanitizeBody(body, platform, options = {}) {
   if (CONTROL_OR_HIDDEN.test(text2)) return { ok: false, reason: tr("\u0432 \u0442\u0435\u043A\u0441\u0442\u0435 \u0435\u0441\u0442\u044C \u0443\u043F\u0440\u0430\u0432\u043B\u044F\u044E\u0449\u0438\u0435 \u0438\u043B\u0438 \u043D\u0435\u0432\u0438\u0434\u0438\u043C\u044B\u0435 \u0441\u0438\u043C\u0432\u043E\u043B\u044B", "the text contains control or invisible characters"), text: text2 };
   if (HTML_COMMENT.test(text2)) return { ok: false, reason: tr("\u0432 \u0442\u0435\u043A\u0441\u0442\u0435 \u0435\u0441\u0442\u044C HTML-\u043A\u043E\u043C\u043C\u0435\u043D\u0442\u0430\u0440\u0438\u0439", "the text contains an HTML comment"), text: text2 };
   if (HTML_TAG.test(text2)) return { ok: false, reason: tr("\u0432 \u0442\u0435\u043A\u0441\u0442\u0435 \u0435\u0441\u0442\u044C HTML-\u0442\u0435\u0433", "the text contains an HTML tag"), text: text2 };
-  if (MD_IMAGE.test(text2)) return { ok: false, reason: tr("\u0432 \u0442\u0435\u043A\u0441\u0442\u0435 \u0435\u0441\u0442\u044C \u043A\u0430\u0440\u0442\u0438\u043D\u043A\u0430: \u0437\u0430\u043C\u0435\u043D\u0438\u0442\u0435 \u0441\u0441\u044B\u043B\u043A\u043E\u0439", "the text contains an image: replace it with a link"), text: text2 };
+  const imageProblem = imageIssue(text2, options.host);
+  if (imageProblem) return { ok: false, reason: imageProblem, text: text2 };
   if (MASS_MENTION.test(text2)) return { ok: false, reason: tr("\u043C\u0430\u0441\u0441\u043E\u0432\u043E\u0435 \u0443\u043F\u043E\u043C\u0438\u043D\u0430\u043D\u0438\u0435: \u0443\u043A\u0430\u0436\u0438\u0442\u0435 \u043A\u043E\u043D\u043A\u0440\u0435\u0442\u043D\u044B\u0445 \u043B\u044E\u0434\u0435\u0439", "mass mention: name specific people"), text: text2 };
   if (checkQuickActions && QUICK_ACTION.test(text2)) {
     return { ok: false, reason: tr("\u0441\u0442\u0440\u043E\u043A\u0430-\u043A\u043E\u043C\u0430\u043D\u0434\u0430 GitLab (/approve, /merge \u2026): \u043F\u0435\u0440\u0435\u0444\u0440\u0430\u0437\u0438\u0440\u0443\u0439\u0442\u0435", "GitLab quick action line (/approve, /merge \u2026): rephrase it"), text: text2 };
   }
   return { ok: true, reason: "", text: text2 };
 }
+function imageIssue(text2, host) {
+  if (MD_IMAGE_REF.test(text2)) {
+    return tr("\u0432 \u0442\u0435\u043A\u0441\u0442\u0435 \u0435\u0441\u0442\u044C \u043A\u0430\u0440\u0442\u0438\u043D\u043A\u0430 \u0441\u043E \u0441\u0441\u044B\u043B\u043E\u0447\u043D\u043E\u0439 \u0441\u043D\u043E\u0441\u043A\u043E\u0439: \u0432\u0441\u0442\u0430\u0432\u044C\u0442\u0435 \u0430\u0431\u0441\u043E\u043B\u044E\u0442\u043D\u0443\u044E \u0441\u0441\u044B\u043B\u043A\u0443", "the text contains a reference-style image: use an absolute link");
+  }
+  for (const match of text2.matchAll(MD_IMAGE_LINK)) {
+    const url = match[1];
+    if (!host) {
+      return tr("\u043A\u0430\u0440\u0442\u0438\u043D\u043A\u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043D\u044B \u0442\u043E\u043B\u044C\u043A\u043E \u0441 \u0445\u043E\u0441\u0442\u0430 \u043F\u043B\u0430\u0442\u0444\u043E\u0440\u043C\u044B", "images are allowed only from the platform host");
+    }
+    if (url.startsWith("/uploads/")) continue;
+    try {
+      const parsed = new URL(url);
+      if ((parsed.protocol === "https:" || parsed.protocol === "http:") && parsed.host === host) continue;
+    } catch {
+    }
+    return tr(`\u0432\u043D\u0435\u0448\u043D\u044F\u044F \u043A\u0430\u0440\u0442\u0438\u043D\u043A\u0430 ${url}: \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043D\u044B \u0442\u043E\u043B\u044C\u043A\u043E \u0437\u0430\u0433\u0440\u0443\u0437\u043A\u0438 \u0441 ${host}`, `external image ${url}: only uploads from ${host} are allowed`);
+  }
+  return null;
+}
+function normalizeMediaLinks(body, platform, host) {
+  if (platform !== "gitlab" || !host) return body;
+  const base = `https://${host}`;
+  return body.replace(/(!?\[[^\]]*\]\(\s*)(\/?uploads\/[^)\s]+)/g, (_match, prefix, path9) => {
+    return `${prefix}${path9.startsWith("/") ? base : `${base}/`}${path9}`;
+  });
+}
+
+// src/core/attachments.ts
+var MAX_ATTACHMENT_BYTES = 25 * 1024 * 1024;
+var MIME_BY_EXTENSION = {
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".avif": "image/avif",
+  ".mp4": "video/mp4",
+  ".m4v": "video/mp4",
+  ".webm": "video/webm",
+  ".ogv": "video/ogg",
+  ".ogg": "video/ogg",
+  ".mov": "video/quicktime"
+};
+function extensionOf(name) {
+  const index = name.lastIndexOf(".");
+  return index >= 0 ? name.slice(index).toLowerCase() : "";
+}
+function attachmentSpec(name, contentType = "") {
+  if (/[/\\]/.test(name)) return null;
+  const base = name.replace(/[\u0000-\u001f\u007f]/g, "").trim();
+  if (!base || base.length > 240) return null;
+  const extension = extensionOf(base);
+  const expected = MIME_BY_EXTENSION[extension];
+  if (!expected) return null;
+  const provided = normalizeContentType(String(contentType));
+  if (provided && provided !== expected) return null;
+  return {
+    name: base,
+    contentType: expected,
+    extension,
+    kind: expected.startsWith("image/") ? "image" : "video"
+  };
+}
+var CONTENT_TYPE_ALIASES = {
+  "image/jpg": "image/jpeg",
+  "image/pjpeg": "image/jpeg",
+  "video/x-m4v": "video/mp4",
+  "video/x-ogg": "video/ogg"
+};
+function normalizeContentType(value) {
+  const type = value.split(";")[0].trim().toLowerCase();
+  return CONTENT_TYPE_ALIASES[type] ?? type;
+}
+function decodeAttachment(data) {
+  const clean = String(data ?? "").replace(/\s+/g, "");
+  if (!clean || clean.length % 4 !== 0 || !/^[A-Za-z0-9+/]+={0,2}$/.test(clean)) {
+    throw new Error("\u0432\u043B\u043E\u0436\u0435\u043D\u0438\u0435: \u043E\u0436\u0438\u0434\u0430\u043B\u0441\u044F base64");
+  }
+  const buffer = Buffer.from(clean, "base64");
+  if (!buffer.length) throw new Error("\u0432\u043B\u043E\u0436\u0435\u043D\u0438\u0435 \u043F\u0443\u0441\u0442\u043E\u0435");
+  if (buffer.length > MAX_ATTACHMENT_BYTES) {
+    throw new Error(`\u0432\u043B\u043E\u0436\u0435\u043D\u0438\u0435 \u0431\u043E\u043B\u044C\u0448\u0435 ${Math.floor(MAX_ATTACHMENT_BYTES / (1024 * 1024))} \u041C\u0411`);
+  }
+  return buffer;
+}
+function matchesSignature(buffer, contentType) {
+  if (contentType === "image/png") return buffer.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]));
+  if (contentType === "image/jpeg") return buffer.length > 3 && buffer[0] === 255 && buffer[1] === 216 && buffer[2] === 255;
+  if (contentType === "image/gif") return buffer.subarray(0, 4).toString("latin1") === "GIF8";
+  if (contentType === "image/webp") return buffer.subarray(0, 4).toString("latin1") === "RIFF" && buffer.subarray(8, 12).toString("latin1") === "WEBP";
+  if (contentType === "image/avif") return buffer.subarray(4, 8).toString("latin1") === "ftyp";
+  if (contentType === "video/webm") return buffer.subarray(0, 4).equals(Buffer.from([26, 69, 223, 163]));
+  if (contentType === "video/ogg") return buffer.subarray(0, 4).toString("latin1") === "OggS";
+  if (contentType === "video/mp4" || contentType === "video/quicktime") return buffer.subarray(4, 8).toString("latin1") === "ftyp";
+  return false;
+}
 
 // src/core/findings.ts
+init_types();
 import { createHash } from "node:crypto";
 init_locale();
 var LEVEL_ORDER = { blocker: 0, major: 1, minor: 2, question: 3 };
@@ -2159,6 +2324,7 @@ function normalize(value) {
 
 // src/daemon/service.ts
 init_locale();
+init_types();
 
 // src/core/git.ts
 init_exec();
@@ -2368,6 +2534,14 @@ var ReviewService = class {
     await this.refresh(id, meta.row.root, provider, loaded);
     return this.getReview(id);
   }
+  async providerFor(id) {
+    const stored = this.store.getReview(id);
+    if (!stored) throw new Error(tr(`\u0440\u0435\u0432\u044C\u044E ${id} \u043D\u0435 \u043D\u0430\u0439\u0434\u0435\u043D\u043E`, `review ${id} not found`));
+    return this.providerFactory(
+      { platform: stored.row.platform, host: stored.row.host, project: stored.row.project, number: stored.row.number },
+      stored.row.root
+    );
+  }
   async refresh(id, root, provider, loaded) {
     const errors = [...loaded.warnings];
     const previous = this.store.getReview(id)?.snapshot;
@@ -2581,6 +2755,77 @@ ${errors.join("\n")}`));
     this.emit(id);
     return next;
   }
+  // ---------------------------------------------------------------- reactions
+  /** Реакции для набора комментариев; отсутствующие id пропускаются. */
+  async reactions(id, noteIds) {
+    const review = this.getReview(id);
+    const known = new Set(review.threads.flatMap((thread) => thread.notes.map((note) => note.id)));
+    const requested = [...new Set(noteIds.filter((noteId) => known.has(noteId)))].slice(0, 500);
+    if (!requested.length) return {};
+    const provider = await this.providerFor(id);
+    const result = {};
+    for (const noteId of requested) {
+      try {
+        result[noteId] = await provider.reactions(noteId);
+      } catch {
+        result[noteId] = [];
+      }
+    }
+    return result;
+  }
+  async react(id, noteId, emoji) {
+    if (!REACTIONS.includes(emoji)) {
+      throw new Error(tr(`\u043D\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043D\u0430\u044F \u0440\u0435\u0430\u043A\u0446\u0438\u044F ${emoji}: ${REACTIONS.join(", ")}`, `unknown reaction ${emoji}: ${REACTIONS.join(", ")}`));
+    }
+    const review = this.getReview(id);
+    const note = review.threads.flatMap((thread) => thread.notes).find((item) => item.id === noteId);
+    if (!note) throw new Error(tr(`\u043A\u043E\u043C\u043C\u0435\u043D\u0442\u0430\u0440\u0438\u044F ${noteId} \u043D\u0435\u0442 \u0432 \u044D\u0442\u043E\u043C \u0440\u0435\u0432\u044C\u044E`, `comment ${noteId} is not in this review`));
+    const provider = await this.providerFor(id);
+    const result = await provider.react(noteId, emoji);
+    let reactions = [];
+    try {
+      reactions = await provider.reactions(noteId);
+    } catch {
+    }
+    this.store.audit(id, "reaction.toggle", { noteId, emoji, active: result.active });
+    return { active: result.active, reactions };
+  }
+  async uploadAttachment(id, input) {
+    const stored = this.store.getReview(id);
+    if (!stored) throw new Error(tr(`\u0440\u0435\u0432\u044C\u044E ${id} \u043D\u0435 \u043D\u0430\u0439\u0434\u0435\u043D\u043E`, `review ${id} not found`));
+    const spec = attachmentSpec(String(input.name ?? ""), String(input.contentType ?? ""));
+    if (!spec) {
+      throw new Error(
+        tr(
+          "\u0432\u043B\u043E\u0436\u0435\u043D\u0438\u0435: \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043D\u044B PNG, JPEG, GIF, WebP, AVIF, MP4, WebM, OGV \u0438 MOV",
+          "attachment: PNG, JPEG, GIF, WebP, AVIF, MP4, WebM, OGV and MOV are allowed"
+        )
+      );
+    }
+    const provider = await this.providerFor(id);
+    if (!provider.capabilities.attachments) {
+      throw new Error(
+        tr(
+          "\u043F\u043B\u0430\u0442\u0444\u043E\u0440\u043C\u0430 \u043D\u0435 \u043F\u043E\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043A\u0443 \u0432\u043B\u043E\u0436\u0435\u043D\u0438\u0439 \u0438\u0437 revdeck: \u0432\u0441\u0442\u0430\u0432\u044C\u0442\u0435 \u0430\u0431\u0441\u043E\u043B\u044E\u0442\u043D\u0443\u044E \u0441\u0441\u044B\u043B\u043A\u0443 \u0432\u0440\u0443\u0447\u043D\u0443\u044E",
+          "the platform does not support attachments from revdeck: paste an absolute URL manually"
+        )
+      );
+    }
+    const buffer = decodeAttachment(input.data);
+    if (!matchesSignature(buffer, spec.contentType)) {
+      throw new Error(tr("\u0432\u043B\u043E\u0436\u0435\u043D\u0438\u0435: \u0441\u043E\u0434\u0435\u0440\u0436\u0438\u043C\u043E\u0435 \u043D\u0435 \u0441\u043E\u0432\u043F\u0430\u0434\u0430\u0435\u0442 \u0441 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043D\u0438\u0435\u043C", "attachment: content does not match the extension"));
+    }
+    const dir = await mkdtemp2(path6.join(tmpdir4(), "revdeck-attachment-"));
+    const file = path6.join(dir, spec.name);
+    try {
+      await writeFile2(file, buffer, { mode: 384, flag: "wx" });
+      const uploaded = await provider.upload({ path: file, name: spec.name, contentType: spec.contentType });
+      this.store.audit(id, "attachment.upload", { name: spec.name, contentType: spec.contentType, bytes: buffer.length, url: uploaded.url });
+      return uploaded;
+    } finally {
+      await rm2(dir, { recursive: true, force: true });
+    }
+  }
   // ---------------------------------------------------------------- notes
   addNote(id, input) {
     const review = this.getReview(id);
@@ -2653,25 +2898,27 @@ ${errors.join("\n")}`));
           warnings.push(tr(`\u0442\u0440\u0435\u0434 ${itemId} \u043D\u0435 \u043D\u0430\u0439\u0434\u0435\u043D`, `thread ${itemId} not found`));
           continue;
         }
-        const body = draft.body.trim();
-        const alreadyPosted = body !== "" && draft.posted.trim() === body;
+        const rawBody = draft.body.trim();
+        const body2 = normalizeMediaLinks(rawBody, review.info.ref.platform, review.info.ref.host);
+        const posted = normalizeMediaLinks(draft.posted.trim(), review.info.ref.platform, review.info.ref.host);
+        const alreadyPosted = rawBody !== "" && posted === body2;
         const resolveChanged = draft.resolve !== thread.resolved;
-        if (!body && !resolveChanged) {
+        if (!body2 && !resolveChanged) {
           warnings.push(tr(`\u0442\u0440\u0435\u0434 ${thread.id.substring(0, 8)}: \u043D\u0435\u0447\u0435\u0433\u043E \u043F\u0443\u0431\u043B\u0438\u043A\u043E\u0432\u0430\u0442\u044C`, `thread ${thread.id.substring(0, 8)}: nothing to publish`));
           continue;
         }
-        if (body && alreadyPosted && !resolveChanged) {
+        if (body2 && alreadyPosted && !resolveChanged) {
           warnings.push(tr(`\u0442\u0440\u0435\u0434 ${thread.id.substring(0, 8)}: \u043E\u0442\u0432\u0435\u0442 \u0443\u0436\u0435 \u043E\u043F\u0443\u0431\u043B\u0438\u043A\u043E\u0432\u0430\u043D`, `thread ${thread.id.substring(0, 8)}: reply already published`));
           continue;
         }
-        if (body) {
-          const check2 = sanitizeBody(body, review.info.ref.platform);
+        if (body2) {
+          const check2 = sanitizeBody(body2, review.info.ref.platform, { host: review.info.ref.host });
           if (!check2.ok) {
             warnings.push(tr(`\u0442\u0440\u0435\u0434 ${thread.id.substring(0, 8)}: ${check2.reason}`, `thread ${thread.id.substring(0, 8)}: ${check2.reason}`));
             continue;
           }
         }
-        items.push({ kind, id: thread.id, body, resolve: draft.resolve });
+        items.push({ kind, id: thread.id, body: body2, resolve: draft.resolve });
         continue;
       }
       if (kind === "finding") {
@@ -2684,13 +2931,13 @@ ${errors.join("\n")}`));
           warnings.push(tr(`\u0437\u0430\u043C\u0435\u0447\u0430\u043D\u0438\u0435 ${finding.id} \u0443\u0436\u0435 \u043E\u043F\u0443\u0431\u043B\u0438\u043A\u043E\u0432\u0430\u043D\u043E`, `finding ${finding.id} is already published`));
           continue;
         }
-        const body = finding.comment.trim();
-        const check2 = sanitizeBody(body, review.info.ref.platform);
+        const body2 = normalizeMediaLinks(finding.comment.trim(), review.info.ref.platform, review.info.ref.host);
+        const check2 = sanitizeBody(body2, review.info.ref.platform, { host: review.info.ref.host });
         if (!check2.ok) {
           warnings.push(tr(`\u0437\u0430\u043C\u0435\u0447\u0430\u043D\u0438\u0435 ${finding.id}: ${check2.reason}`, `finding ${finding.id}: ${check2.reason}`));
           continue;
         }
-        const finalBody = finding.file && finding.line === null ? `\`${finding.file}\`: ${body}` : body;
+        const finalBody = finding.file && finding.line === null ? `\`${finding.file}\`: ${body2}` : body2;
         items.push({
           kind,
           id: finding.id,
@@ -2710,12 +2957,13 @@ ${errors.join("\n")}`));
         warnings.push(tr(`\u043A\u043E\u043C\u043C\u0435\u043D\u0442\u0430\u0440\u0438\u0439 ${note.id} \u0443\u0436\u0435 \u043E\u043F\u0443\u0431\u043B\u0438\u043A\u043E\u0432\u0430\u043D`, `comment ${note.id} is already published`));
         continue;
       }
-      const check = sanitizeBody(note.text, review.info.ref.platform);
+      const body = normalizeMediaLinks(note.text, review.info.ref.platform, review.info.ref.host);
+      const check = sanitizeBody(body, review.info.ref.platform, { host: review.info.ref.host });
       if (!check.ok) {
         warnings.push(tr(`\u043A\u043E\u043C\u043C\u0435\u043D\u0442\u0430\u0440\u0438\u0439 ${note.id}: ${check.reason}`, `comment ${note.id}: ${check.reason}`));
         continue;
       }
-      items.push({ kind, id: note.id, body: note.text, file: note.file, line: note.line, side: note.side });
+      items.push({ kind, id: note.id, body, file: note.file, line: note.line, side: note.side });
     }
     return { plan: this.makePlan(id, kind, items), warnings };
   }
@@ -2778,7 +3026,7 @@ ${errors.join("\n")}`));
           if (!thread) throw new Error(tr("\u0442\u0440\u0435\u0434 \u0431\u043E\u043B\u044C\u0448\u0435 \u043D\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442", "the thread no longer exists"));
           const body = String(item.body ?? "").trim();
           if (body && draft.posted.trim() !== body) {
-            const check = sanitizeBody(body, platform);
+            const check = sanitizeBody(body, platform, { host: review.info.ref.host });
             if (!check.ok) throw new Error(check.reason);
             await provider.reply(thread, body);
             draft.posted = body;
@@ -3045,7 +3293,7 @@ init_errors();
 import http from "node:http";
 import { createReadStream } from "node:fs";
 import { readFile as readFile2, stat } from "node:fs/promises";
-import path6 from "node:path";
+import path7 from "node:path";
 import { timingSafeEqual } from "node:crypto";
 
 // src/daemon/rpc.ts
@@ -3053,7 +3301,7 @@ import net from "node:net";
 import { chmod, unlink as unlink2 } from "node:fs/promises";
 init_redact();
 init_errors();
-var MAX_LINE = 4 * 1024 * 1024;
+var MAX_LINE = 40 * 1024 * 1024;
 async function dispatch(service, method, params) {
   switch (method) {
     case "ping":
@@ -3091,6 +3339,23 @@ async function dispatch(service, method, params) {
       const file = service.diffFile(String(params.review ?? ""), String(params.file ?? ""));
       return { file };
     }
+    case "reactions.list":
+      return {
+        reactions: await service.reactions(
+          String(params.review ?? ""),
+          Array.isArray(params.noteIds) ? params.noteIds.map(String) : []
+        )
+      };
+    case "reactions.toggle":
+      return service.react(String(params.review ?? ""), String(params.noteId ?? ""), String(params.emoji ?? ""));
+    case "attachments.upload":
+      return {
+        attachment: await service.uploadAttachment(String(params.review ?? ""), {
+          name: String(params.name ?? ""),
+          contentType: String(params.contentType ?? ""),
+          data: String(params.data ?? "")
+        })
+      };
     case "drafts.put":
       return { draft: service.setDraft(String(params.review ?? ""), String(params.threadId ?? ""), params.patch ?? {}) };
     case "findings.put":
@@ -3223,7 +3488,7 @@ async function respond(service, request) {
 }
 
 // src/daemon/http.ts
-var MAX_BODY = 4 * 1024 * 1024;
+var MAX_BODY = 40 * 1024 * 1024;
 var MIME = {
   ".html": "text/html; charset=utf-8",
   ".js": "text/javascript; charset=utf-8",
@@ -3317,15 +3582,15 @@ async function startHttpServer(options) {
           res.end('<meta charset="utf-8"><h1>\u041D\u0443\u0436\u043D\u0430 \u0441\u0441\u044B\u043B\u043A\u0430 \u0437\u0430\u043F\u0443\u0441\u043A\u0430</h1><p>\u041E\u0442\u043A\u0440\u043E\u0439\u0442\u0435 \u0430\u0434\u0440\u0435\u0441 \u0438\u0437 \u0442\u0435\u0440\u043C\u0438\u043D\u0430\u043B\u0430: \u043E\u043D \u0441\u043E\u0434\u0435\u0440\u0436\u0438\u0442 \u043E\u0434\u043D\u043E\u0440\u0430\u0437\u043E\u0432\u044B\u0439 \u0442\u043E\u043A\u0435\u043D.</p>');
           return;
         }
-        const html = await readFile2(path6.join(options.uiDir, "index.html"));
+        const html = await readFile2(path7.join(options.uiDir, "index.html"));
         res.writeHead(200, { ...SECURITY_HEADERS, "content-type": MIME[".html"], "cache-control": "no-store" });
         res.end(html);
         return;
       }
       if (req.method === "GET" && (url.pathname.startsWith("/assets/") || url.pathname === "/favicon.svg")) {
         const relative = url.pathname === "/favicon.svg" ? "favicon.svg" : url.pathname.slice("/assets/".length);
-        const target = path6.resolve(options.uiDir, url.pathname === "/favicon.svg" ? "" : "assets", relative);
-        if (!target.startsWith(path6.resolve(options.uiDir) + path6.sep) || relative.includes("..")) {
+        const target = path7.resolve(options.uiDir, url.pathname === "/favicon.svg" ? "" : "assets", relative);
+        if (!target.startsWith(path7.resolve(options.uiDir) + path7.sep) || relative.includes("..")) {
           reply(res, 404, { ok: false, error: "\u043D\u0435\u0442 \u0444\u0430\u0439\u043B\u0430" });
           return;
         }
@@ -3336,7 +3601,7 @@ async function startHttpServer(options) {
         }
         res.writeHead(200, {
           ...SECURITY_HEADERS,
-          "content-type": MIME[path6.extname(target)] ?? "application/octet-stream",
+          "content-type": MIME[path7.extname(target)] ?? "application/octet-stream",
           "cache-control": "public, max-age=31536000, immutable"
         });
         createReadStream(target).pipe(res);
@@ -3414,6 +3679,12 @@ data: ${JSON.stringify(event)}
         reply(res, 200, { ok: true, rules: await service.rules(review) });
         return;
       }
+      if (req.method === "GET" && url.pathname === "/api/reactions") {
+        const review = url.searchParams.get("review") ?? "";
+        const noteIds = (url.searchParams.get("notes") ?? "").split(",").map((item) => item.trim()).filter(Boolean);
+        reply(res, 200, { ok: true, reactions: await service.reactions(review, noteIds) });
+        return;
+      }
       if (req.method === "POST") {
         const body = await readBody(req);
         const review = String(body.review ?? "");
@@ -3436,6 +3707,20 @@ data: ${JSON.stringify(event)}
             reply(res, 200, { ok: true, review: service.getView(updated.id), reviews: service.listReviews() });
             return;
           }
+          case "/api/attachments": {
+            const attachment = await service.uploadAttachment(review, {
+              name: String(body.name ?? ""),
+              contentType: String(body.type ?? ""),
+              data: String(body.data ?? "")
+            });
+            reply(res, 200, { ok: true, attachment });
+            return;
+          }
+          case "/api/reactions": {
+            const result = await service.react(review, String(body.noteId ?? ""), String(body.emoji ?? ""));
+            reply(res, 200, { ok: true, ...result });
+            return;
+          }
           case "/api/drafts": {
             const draft = service.setDraft(review, String(body.threadId ?? ""), body.patch ?? {});
             reply(res, 200, { ok: true, draft });
@@ -3540,6 +3825,7 @@ async function main() {
   const { values } = parseArgs({
     options: {
       port: { type: "string" },
+      host: { type: "string" },
       "state-dir": { type: "string" },
       "runtime-dir": { type: "string" },
       "ui-dir": { type: "string" },
@@ -3582,12 +3868,13 @@ async function main() {
   });
   const socket = socketPath();
   const rpc = await startRpcServer(service, socket);
-  const uiDir = values["ui-dir"] ? path7.resolve(values["ui-dir"]) : path7.join(packageRoot(), "dist", "ui");
+  const uiDir = values["ui-dir"] ? path8.resolve(values["ui-dir"]) : path8.join(packageRoot(), "dist", "ui");
   const http2 = await startHttpServer({
     service,
     token,
     uiDir,
     ...values.port ? { port: Number(values.port) } : {},
+    ...values.host ? { host: String(values.host) } : {},
     version: VERSION
   });
   const info = {
@@ -3625,7 +3912,7 @@ async function main() {
       service.close();
       await unlink3(daemonInfoPath()).catch(() => void 0);
       await lock.close().catch(() => void 0);
-      await unlink3(path7.join(stateDir(), "daemon.lock")).catch(() => void 0);
+      await unlink3(path8.join(stateDir(), "daemon.lock")).catch(() => void 0);
       process.exit(0);
     }
   };
@@ -3637,9 +3924,9 @@ async function main() {
   }
 }
 function packageRoot() {
-  let dir = path7.dirname(fileURLToPath(import.meta.url));
+  let dir = path8.dirname(fileURLToPath(import.meta.url));
   for (; ; ) {
-    const candidate = path7.join(dir, "package.json");
+    const candidate = path8.join(dir, "package.json");
     if (existsSync4(candidate)) {
       try {
         const parsed = JSON.parse(readFileSync(candidate, "utf8"));
@@ -3647,7 +3934,7 @@ function packageRoot() {
       } catch {
       }
     }
-    const parent = path7.dirname(dir);
+    const parent = path8.dirname(dir);
     if (parent === dir) return process.cwd();
     dir = parent;
   }
@@ -3686,7 +3973,7 @@ async function runningDaemon() {
   return reachable ? info : null;
 }
 async function acquireLock() {
-  const file = path7.join(stateDir(), "daemon.lock");
+  const file = path8.join(stateDir(), "daemon.lock");
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
       const handle = await open2(file, "wx", 384);