Chat input state management to use per-chat values
 
 Closes #3128 
 
 
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3129"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

## Summary
- run Socket Firewall through `npx sfw@2.0.4` instead of relying on a
global install
- keep the socket firewall command path reproducible and avoid Windows
global path issues
- update command-shape assertions in the related IPC tests

## Test plan
- npm run fmt
- npm run lint:fix
- npm run ts
- npm test

<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3163"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Will Chen <7344640+wwwillchen@users.noreply.github.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

## Summary
- accept `keppo-bot[bot]` in GitHub Actions author checks that read raw
`github.*` logins
- switch Claude PR Review to `allowed_bots: \"keppo-bot[bot]\"` instead
of treating the bot as a non-write user
- trust `copilot-pull-request-reviewer` in the PR comment-fixing skill

## Test plan
- `npm run fmt`
- `npm run lint:fix`
- `npm run ts`
- `npm test`

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3162"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Will Chen <7344640+wwwillchen@users.noreply.github.com>

This PR changes the SQLite database setting to use WAL (Write-Ahead
Logging) mode. From what I can tell, it should be an easy performance
improvement with no real downside for our case. Documentation is here:
https://sqlite.org/wal.html

Also, the [docs for
better-sqlite3](https://www.npmjs.com/package/better-sqlite3) explicitly
recommend it:

> Though not required, it is generally important to set the WAL pragma
for performance reasons.

I came across this as I was looking into the issue where the chat code
blocks slow down Dyad's framerate. I'm not entirely sure whether this is
related, but I did notice that sometimes database calls were taking a
lot longer than I expected, and that would cause Dyad's framerate to
drop significantly on my machine. This change seems to be an improvement
in that regard, so it might also have an effect on the code blocks issue
as well.

It's hard to accurately benchmark this because its effect is only
substantial when there are multiple database calls going on at the same
time. I can definitely attempt a benchmark if that would be worthwhile
though.
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3140"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

#skip-bb
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3161"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->
Co-authored-by: Claude <noreply@anthropic.com>

Co-authored-by: Claude <noreply@anthropic.com>

## Summary
- stop the preview route dropdown from showing "Loading routes..." after
route discovery has already finished
- expand React Router discovery to scan common route files like
`src/routes/*`, `*routes.tsx`, and `router.tsx` instead of only
`src/App.tsx`
- add parser tests covering modular route files and merged route
discovery

## Test plan
- `npm run fmt && npm run lint:fix && npm run ts`
- `npm test`

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3158"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Will Chen <7344640+wwwillchen@users.noreply.github.com>

## Summary
- Adds a new right-click context menu option on chat tabs that reorders
tabs so they are grouped by app
- Within each app group the original relative order is preserved, and
app groups appear in the order their first tab was encountered
- The option is disabled when all open tabs belong to the same app
- Includes i18n support (en, pt-BR, zh-CN) and unit tests

Closes #3126

## Test plan
- Right-click on a chat tab and verify the "Group tabs by app" option
appears
- With tabs from multiple apps open, click the option and verify tabs
are reordered by app grouping
- With tabs from only one app, verify the option is disabled
- Run `npm test` — all 1003 tests pass

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3150"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->
Co-authored-by: Will Chen <7344640+wwwillchen@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>

Fixes #3139 

## Summary
- Fixes the bug where clicking **Sync to GitHub** on the Publish tab and
navigating away before the push finishes dropped the in-flight state —
the push actually continued in the main process, but on return the UI
showed neither success nor failure.
- Moves sync state (`isSyncing`, `syncError`, `syncSuccess`,
`conflicts`, rebase status, etc.) out of local `useState` in
`ConnectedGitHubConnector` and into a Jotai atom keyed by `appId`
(`src/atoms/githubSyncAtoms.ts`), so it survives unmount/remount.
- Adds success/error toasts on completion so users get feedback even
when they're viewing a different preview tab.

## Test plan
- [x] New unit tests in `src/atoms/githubSyncAtoms.test.tsx` verify
state is preserved across unmount/remount, that a "completion" happening
while unmounted is visible on remount, that state is isolated per
`appId`, and that `null` appId is a no-op.
- [x] `npm run ts` — clean
- [x] `npm run fmt` / `npm run lint:fix` — clean (only the pre-existing
unrelated warning in `local_agent_handler.test.ts`)
- [x] `npm test` — 1003/1003 passing
- [ ] Manual: click Sync to GitHub, immediately switch to Code tab,
switch back — spinner should still show (if still running) or the
success message should be visible (if finished); a toast should appear
on completion regardless of tab.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3151"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Will Chen <7344640+wwwillchen@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

## Summary
- add a default-on Experiments setting to block unsafe npm packages with
Socket Firewall
- wrap shared add-dependency installs in sfw when available and
bootstrap sfw via npm install -g sfw when it is missing
- surface firewall bootstrap warnings through build-mode approvals and
local-agent add_dependency flows, with tests for the new setting and
install path

## Test plan
- npm run fmt && npm run lint:fix && npm run ts
- npm test

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3152"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Will Chen <7344640+wwwillchen@users.noreply.github.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3146"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

This issue is causing build failure in the main branch

## Summary
- Add MiniMax-M2.7 and MiniMax-M2.7-highspeed to the model selection
list (direct provider and OpenRouter)
- Set MiniMax-M2.7 as the new default model
- Retain all previous models (M2.5, M2.5-highspeed) as available
alternatives
- Update related unit tests

## Why
MiniMax-M2.7 is the latest flagship model with enhanced reasoning and
coding capabilities.

## Changes
- `src/ipc/shared/language_model_constants.ts`: Added M2.7 and
M2.7-highspeed models to the `minimax` provider section (before existing
M2.5 models) and added M2.7 to the `openrouter` section
- `src/__tests__/minimax_provider.test.ts`: Updated tests to verify all
4 models are present, M2.7 is default (first), and model ordering is
correct

## Testing
- Unit tests updated and passing
- Integration tested with MiniMax API
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3038"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: PR Bot <pr-bot@minimaxi.com>

probleme :
Before this change, developers couldn't inspect React components in the
Electron app's DevTools. The DevTools only showed the Elements tab
(DOM), not the ⚛️ React Components tab. This made debugging React
components much harder.

solution:
We added automatic loading of React DevTools extension when running in
development mode, so the React Components tab is available in Electron
DevTools.

Two simple files changed:

[main.ts]→ Added React DevTools extension loading code
[package.json] → Added npm run dev script

New script: "dev": "cross-env NODE_ENV=development npm start"
This sets [NODE_ENV=development]( so React DevTools loads


📝 Steps to Enable This Feature
For Developers Using Dyad
Step 1: Install React DevTools Extension in Chrome

Open Google Chrome
Go to:
[https://chromewebstore.google.com/detail/react-developer-tools/fmkadmapgofadopljbjfkapdkoienihi]
Click "Add to Chrome"
Confirm the installation
Step 2: Run the App in Dev Mode





expected behavior
<img width="1591" height="870" alt="Capture d&#39;écran 2026-04-01
152857"
src="https://github.com/user-attachments/assets/341130e8-38ac-4d61-84cb-5415b248278d"
/>

<!-- devin-review-badge-begin -->

---







<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3112"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

## Summary
- Raise the Basic Agent (free tier) message quota from 5 to 10 per
window.
- Add `src/lib/free_agent_quota_limit.ts` as the single source of truth;
IPC re-exports the constant.
- UI (selector, banner, chat error) uses `messagesLimit` from quota
status so copy stays in sync.
- Update `e2e-tests/free_agent_quota.spec.ts` for the new limit and
strings.

## Test plan
- `npm run fmt && npm run lint:fix && npm run ts`
- `npm test` (vitest)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Made with [Cursor](https://cursor.com)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3147"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->
Co-authored-by: Claude <noreply@anthropic.com>

#skip-bb
Co-authored-by: Claude <noreply@anthropic.com>

<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3121"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->
Co-authored-by: Claude <noreply@anthropic.com>

Currently, `collectFiles` is calling `isGitIgnored` on each
(non-excluded) recursion. Although there is caching, we're frequently
executing Git just to check whether an individual file or directory is
gitignored, meaning that the number of Git invocations scales with the
number of files in the user's app.

This amounts to a substantial number of Git invocations. For smaller
projects it could be dozens; for larger projects it could be thousands.
It's particularly a problem for native Git, because each `exec` call
comes with a lot of overhead even though Git itself is quite fast.

Although I'm not 100% sure, I suspect that this was the underlying cause
of both #2795 and #1642, because:
1. Both mention Dyad freezing when dealing with larger projects, and
this issue is far more noticeable for large projects.
2. Both specifically mention that the freeze happens upon opening their
project, which is when `collectFiles` runs.
3. I was able to replicate the crash consistently on Windows 10 and
inconsistently on Linux Mint by importing a large project into Dyad. I
don't yet have a good automated test for this, though.

The solution that I wrote for this PR puts the responsibility of
traversing the app's files onto native Git instead of doing it manually.
This means that we'll only have one Git invocation per call to the
function (formerly named) `collectFiles`.

I've also done my best to keep the output of `collectFilesNativeGit` as
close as possible to the original `collectFiles`. The ordering of the
files will be different, but I don't think that should make a difference
given that we later sort them anyway.

Some alternatives I've thought of if we decide we want to keep the
current traversal logic:
- Run `git check-ignore` on batches of files (e.g. each result of
`fsAsync.readdir`) rather than one at a time. This would still result in
multiple Git calls, though.
- Run `git check-ignore` on all of the files at once at the end of
`collectFiles`. We wouldn't be able to prune gitignored directories in
our traversal, but at least we'd still avoid the directories in
`EXCLUDED_DIRS`, such as `node_modules` and `.next`.

I've left the logic of `collectFiles` untouched for isomorphic-git for
now. There might be a good way to optimize that as well, but it will
likely be a bit different because isomorphic-git has different
capabilities than native Git.
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3105"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Claude <noreply@anthropic.com>

## Summary
- Removed the unused `NewBadge` component from `ChatModeSelector.tsx`
- Removed "New" badge displays from Agent v2 and Plan mode options, as
these features are no longer new

## Test plan
- Verify the chat mode selector dropdown still renders correctly without
the "New" badges
- Confirm Agent v2 and Plan mode options are still selectable and
functional

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3113"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->
Co-authored-by: Will Chen <7344640+wwwillchen@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>

#skip-bb
Co-authored-by: Claude <noreply@anthropic.com>

## Summary
This PR adds visual highlighting of search query matches in the
VersionPane component, making it easier for users to identify which
versions match their search criteria.

## Key Changes
- **New `HighlightMatch` component**: Created a reusable component that
highlights matching text segments with a yellow background (with dark
mode support). The matching is case-insensitive.
- **Version number highlighting**: Applied highlighting to version
numbers in the version list header
- **Version hash highlighting**: Applied highlighting to the short
commit hash (OID) displayed next to version numbers
- **Message highlighting**: Applied highlighting to version messages,
including those with reverted version information

## Implementation Details
- The `HighlightMatch` component performs case-insensitive substring
matching and wraps matched text in a `<mark>` element with Tailwind
classes (`bg-yellow-200 dark:bg-yellow-800 rounded-sm`)
- Search query is trimmed before being passed to the highlighting
function to avoid unnecessary whitespace
- The highlighting is applied consistently across all searchable text
fields in the version pane (version numbers, hashes, and messages)
- The implementation preserves existing message transformation logic for
"Reverted" messages while adding highlighting on top
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3117"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_AGENT_PR_BODY_BEGIN -->
## Summary

- Replace `wwwillchen-bot` with `keppo-bot` in GitHub Actions
privileged-user checks and related docs.
- Remove `dyadbot` from all privileged workflow paths: CI author matrix,
BugBot/Claude PR review triggers, rebase allowed users, label-rebase
authors, triage duplicate-comment guidance, pr-review-responder, and
Claude `allowed_non_write_users`.
- Update `plans/faster-pr-workflows.md` and agent skills
(`deflake-e2e-recent-commits`, `pr-fix-comments`) to match.

## Testing

- Documentation and workflow YAML only; `npm run ts` not run in this
environment (tsgo package unavailable). Formatting applied via `npm run
fmt`.
<!-- CURSOR_AGENT_PR_BODY_END -->

<div><a
href="https://cursor.com/agents/bc-7b9e754e-66e4-4031-947a-9b438c3a5063"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-web-light.png"><img
alt="Open in Web" width="114" height="28"
src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a>&nbsp;<a
href="https://cursor.com/background-agent?bcId=bc-7b9e754e-66e4-4031-947a-9b438c3a5063"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img
alt="Open in Cursor" width="131" height="28"
src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a>&nbsp;</div>


<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3114"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Will Chen <wwwillchen@users.noreply.github.com>

<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3110"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->
Co-authored-by: Claude <noreply@anthropic.com>

<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3104"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

#skip-bb
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3080"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3099"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

## Summary
- Fixed flaky `select_component.spec.ts > select component next.js` test
by increasing the chat completion timeout for Next.js builds
- Added configurable `timeout` parameter to `sendPrompt()` and
`waitForChatCompletion()` in the test page objects
- The test was timing out because Next.js apps take longer to build on
the first prompt, exceeding the default MEDIUM timeout (15s local / 30s
CI)

## Flaky test analysis
Scanned 6 recent PRs by wwwillchen/wwwillchen-bot for flaky tests. Found
30+ unique flaky test occurrences across these specs:
- `setup_flow.spec.ts` (6 occurrences) - passed 10x runs, already stable
- `select_component.spec.ts` (6 occurrences) - **confirmed flaky,
fixed**
- `setup.spec.ts` (5 occurrences) - passed 10x runs, already stable
- `context_manage.spec.ts` (5 occurrences) - passed 10x runs, already
stable
- `undo.spec.ts` (3 occurrences) - passed 10x runs, already stable
- `debugging_logs.spec.ts` (3 occurrences) - passed 10x runs, already
stable

## Test plan
- [x] Confirmed flakiness: `select_component.spec.ts` failed 1/10 runs
before fix
- [x] Verified fix: all 60 tests passed (6 tests × 10 runs) after the
fix
- [x] Verified other flaky specs are currently stable (all passed 10x
repeat runs)

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3107"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

## Summary

- Fixes #3070 (and likely related to #2879)
- When retrying after a transient stream termination, parallel tool-call
results were split into separate `tool` messages instead of being
grouped. This violated the Anthropic API constraint that every
`tool_use` in an assistant message must have its `tool_result` in the
immediately following message, causing `400 invalid_request_error`.
- Extracted replay logic from `local_agent_handler.ts` into
`retry_replay_utils.ts` for testability, and fixed
`buildRetryReplayMessages` to merge consecutive tool-result entries into
a single tool message.

## Test plan

- [x] Added 18 new tests in `retry_replay_utils.test.ts` covering:
  - Parallel tool results grouped into single message (the core fix)
  - Sequential + parallel mixed scenarios
  - Incomplete tool exchanges excluded
  - Event capture deduplication
  - Edge cases (empty events, whitespace text, null inputs)
- [x] All 18 existing `local_agent_handler.test.ts` tests still pass
(including stream retry tests)


🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3072"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Will Chen <7344640+wwwillchen@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

This PR adds the ability to generate images inside the chat , a generate
image button was added to the auxiliary actions menu .
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3055"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

## Summary
- Stop sending `anthropic-beta: context-1m-2025-08-07` on Anthropic API
requests.
- `getAiHeaders` remains for future provider-specific headers but
currently returns `undefined`.

## Test plan
- `npm run fmt && npm run lint:fix && npm run ts`
- `npm test` (952 tests)

#skip-bugbot

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Made with [Cursor](https://cursor.com)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3103"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->
Co-authored-by: Claude <noreply@anthropic.com>

## Issue
Fixes #2962 - Improve the background color at hovering and MOST OF ALL
for selected projects.

## Changes
- Increased dark mode sidebar-accent background color contrast from
15.9% to 35% lightness
- Updated both OKLch and HSL color formats for consistency
- Selected items are now clearly distinguishable from unselected items

### Dark mode improvements:
- OKLch: `oklch(0.35 0 0)` instead of `oklch(0.269 0 0)`
- HSL: `240 5% 35%` instead of `240 3.7% 15.9%`

This dramatically improves visibility for users with less acute vision,
addressing the accessibility concern raised in the issue.

## Testing
Added comprehensive E2E test to verify:
- Selected sidebar items have visually distinct background colors
- Hover states provide proper visual feedback
- Good contrast between selected, unselected, and hover states
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3074"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

Stop keydown event propagation on DialogContent to prevent the parent
DropdownMenu's typeahead handler from swallowing keypresses.
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3098"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

## Summary
- document that `git rev-list --left-right --count upstream/main...HEAD`
returning `0 0` means the branch cannot produce a PR
- note that agents should report the branch as pushed but PR-blocked
instead of creating an empty commit just to satisfy `gh pr create`
- update the git workflow rules with this edge case

## Test plan
- npm run fmt
- npm run lint:fix
- npm run ts
- npm test

#skip-bugbot

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3065"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->
Co-authored-by: Will Chen <7344640+wwwillchen@users.noreply.github.com>

## Summary
- Migrated `draft-stale-prs` and `label-rebase-prs` GitHub Actions
workflows from using a personal access token (`PR_RW_GITHUB_TOKEN`) to
generating tokens via the Dyad GitHub App
(`actions/create-github-app-token@v2`)
- Improves security and auditability by using scoped, short-lived GitHub
App tokens with explicit permissions instead of long-lived PATs

## Test plan
- [ ] Verify `draft-stale-prs` workflow runs successfully on its cron
schedule (or trigger manually)
- [ ] Verify `label-rebase-prs` workflow runs successfully when
triggered by push to `main`
- [ ] Confirm the GitHub App has the required permissions: `contents:
read`, `pull-requests: write`, and `issues: write` (for draft-stale-prs)

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3004"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->
Co-authored-by: Will Chen <willchen90@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>

Sends a daily email (8AM Pacific / 15:00 UTC) listing open PRs
requesting review from wwwillchen across all dyad-sh org repos. Also
supports manual workflow_dispatch trigger.
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3102"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->
Co-authored-by: Claude <noreply@anthropic.com>

The "View Plan" button in the plan card was non-functional when:

The preview panel was manually collapsed by the user
Starting a new app session (preview panel is closed initially)
The button only changed the preview mode to "plan" but didn't open the
panel, making it invisible to users.

Root Cause
[isPreviewOpenAtom]was set to false when starting the app and only set
back to true after streaming completes. The "View Plan" button only
called [setPreviewMode("plan")] but didn't call
[setIsPreviewOpen(true)], leaving the panel closed.

Solution
Added [setIsPreviewOpen(true)] to the "View Plan" button's onClick
handler to ensure the preview panel opens when users click the button.


Testing
The fix can be verified by:

Generating a plan in the chat
Collapsing the preview panel (or having it closed on new app start)
Clicking the "View Plan" button
Confirm the panel opens and shows the plan view
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3073"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Mohamed Aziz Mejri <mjrmohamedaziz@gmail.com>

## Summary
- Adds a nightly GitHub Actions workflow that checks for open security
advisories in triage/draft state
- Sends email alerts via Mailgun when open advisories are found
- Includes the supporting Node.js script at
`scripts/github-security-advisory-alert.mjs`

## Test plan
- [ ] Verify the workflow YAML is valid by triggering a manual
`workflow_dispatch` run
- [ ] Confirm required secrets/vars (`KEPPO_GITHUB_APP_ID`,
`KEPPO_GITHUB_APP_PRIVATE_KEY`, `MAILGUN_API_KEY`, `MAILGUN_DOMAIN`,
`MAILGUN_FROM_EMAIL`, `SECURITY_ADVISORY_ALERT_EMAILS`) are configured
in the `ai-bots` environment

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3087"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

#skip-bb
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3081"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

I've updated neon integration plan to include using neon auth and neon
data api for react/vite apps .
The data api will make it possible to integrate neon with react/vite
apps without requiring the users to add a backend on their own .