#skip-bb

## Summary
- Replace DigiCert SSM-based code signing with Azure Trusted Signing for
Windows builds
- Add new `windowsSign.ts` configuration for Azure signing parameters
- Update release workflow to install Azure Trusted Signing CLI and
create metadata file
- Version bump to 0.36.0-beta.1 for testing the new signing workflow

## Test plan
- [ ] Trigger a release build and verify Windows binaries are signed
correctly
- [ ] Verify the signed executable passes Windows SmartScreen
verification

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2429">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->



<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Switches Windows code signing from DigiCert SSM to Azure Trusted Signing
to simplify CI and reduce secret handling. Updates Forge config and
release workflow; bumps version to 0.36.0-beta.1 for testing.

- **Refactors**
- Added windowsSign.ts with Azure sign params (dlib + metadata),
SHA-256, and timestamp server.
  - Wired windowsSign into Electron Forge packager and MakerSquirrel.
- Release workflow installs Azure Trusted Signing via winget and writes
signing-metadata.json; removes DigiCert SSM steps.

- **Migration**
- Add AZURE_CODE_SIGNING_DLIB, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, and
AZURE_TENANT_ID as CI secrets. The workflow sets AZURE_METADATA_JSON
automatically.
  - Run a release build and verify the signed EXE passes SmartScreen.

<sup>Written for commit 0d5b4d58940b59300796ea18e8c403bfcc25b30d.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

## Summary
- Replace `<dyad-write>` and `<dyad-execute-sql>` custom XML tags with
standard markdown code blocks in the Supabase prompt
- This improves compatibility and readability of the generated code
examples
- No functional changes to behavior

## Test plan
- All 661 unit tests pass
- Lint and type checks pass

#skip-bugbot

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2424">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->


<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Replaced custom <dyad-write> and <dyad-execute-sql> tags with standard
fenced code blocks in the Supabase prompt to improve compatibility and
readability. No behavior changes.

- **Refactors**
- Swapped custom XML tags for markdown code blocks with language hints
(tsx, sql, typescript).
- Cleaned up instructions (removed tag-specific guidance; clarified
auto-deploy and file labels).
  - Updated example paths (e.g., supabase/functions/hello/index.ts).

<sup>Written for commit e0aecca9615c9580de231e740fa71f934c8ecb3a.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Fixes #2395 

## Summary
- Use `write_file` tool format instead of `dyad-write` XML tags when
local agent stream mode is active
- The local agent uses tools rather than XML-based commands, so
attachments need compatible upload instructions
- Refactored `willUseLocalAgentStream` check to be computed once and
reused

## Test plan
- Test uploading file attachments while in local agent mode
- Verify the system prompt contains `write_file` tool instructions
instead of `dyad-write` XML tags
- Verify regular (non-local-agent) mode still uses the XML-based
instructions

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2412">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Low risk: only adjusts system-prompt attachment upload instructions
and reuses a single `willUseLocalAgentStream` flag; could affect how
models handle uploads in local-agent/Pro ask mode.
> 
> **Overview**
> Fixes attachment-upload prompting when streaming via the local agent
by switching from `dyad-write` XML tag instructions to `write_file`
tool-call instructions for conversations that will use
`handleLocalAgentStream`.
> 
> Also refactors the `willUseLocalAgentStream` condition to be computed
once (based on chat mode/Pro ask mode and absence of mentioned-app
codebases) and reused for both system-prompt construction and
`aiMessagesJson` persistence.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
60dd66e4548c5d10ace43739aea7765958284739. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

## Summary
- Fix regression from PR #2336 where `previewCurrentUrlAtom` wasn't
cleared when navigating back to root (`/`)
- Clear preserved URL in `pushState`/`replaceState` handlers when
pathname is "/" or empty
- Clear preserved URL in `restartApp` before restarting to prevent stale
route restoration
- Add E2E test to verify route stays on root after restart

Fixes the issue where HMR/restart would load the wrong URL after
navigating back to root from a sub-route.

## Test plan
- [x] E2E test `restart after navigating back to root should stay on
root` passes
- [x] Existing test `refresh preserves current route` still passes
- [x] Unit tests pass (661 tests)

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2422">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Medium risk because it changes preview navigation state persistence
and restart behavior, which could impact route restoration and
back/forward history across apps. Added e2e coverage reduces the chance
of regressions.
> 
> **Overview**
> Fixes a regression where the preview could restore a stale sub-route
after returning to `/` or after an app restart.
> 
> `PreviewIframe` now **clears `previewCurrentUrlAtom`** when
`pushState`/`replaceState` navigates to same-origin root, and
`useRunApp.restartApp` clears the preserved URL for the app before
restarting to avoid remount restoring the wrong route.
> 
> Adds an e2e Playwright test ensuring navigating `/about` → `/` and
then restarting stays on the home route.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
16db90a34c728f311599eab4c029010d89354420. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Fixes a regression where the preview restored a stale sub-route after
returning to “/” or restarting. We now clear the preserved URL so the
app stays on the expected root route.

- **Bug Fixes**
- Clear preserved URL on pushState/replaceState when pathname is “/” in
PreviewIframe.
- Clear preserved URL during restart (useRunApp) to prevent stale route
restoration.
  - Add E2E test to ensure restart after returning to root stays on “/”.

- **New Features**
- Allow disabling the stop hook via DISABLE_DYAD_STOP_HOOK environment
variable.

<sup>Written for commit 16db90a34c728f311599eab4c029010d89354420.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

#skip-bb
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2392">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->


<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Fixes failing Next.js e2e tests by selecting the correct chat mode and
restarting after upgrades, and improves the Playwright PR comment with
clearer run/update commands. Also increases local test timeout to reduce
flaky failures.

- **Bug Fixes**
  - Selects “build” chat mode in Next.js tests.
  - Adds restart after upgrade in select component test.
  - Updates snapshot to expect the “next” template ID.
  - Raises local timeout to 75s to reduce flakes.

- **New Features**
- Playwright PR comment now includes copy-paste commands to run and
update snapshots for each failed test.
- Uses -g "pattern" with proper escaping; groups many commands in a
collapsible section.

<sup>Written for commit 5124cf2f3e8aa80e9de63b412ff0b6aeeff81eb5.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

## Summary
- Adds new "Auto-expand preview panel" toggle in Workflow Settings
- When disabled, the preview panel stays collapsed after chat responses
and proposal approvals
- Defaults to enabled to preserve existing behavior

Fixes #2090

## Test plan
1. Go to Settings > Workflow Settings
2. Disable "Auto-expand preview panel"
3. Collapse the preview panel manually
4. Send a chat message that generates code changes
5. Verify the preview panel stays collapsed

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2352">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Introduces a user setting to control automatic preview expansion after
code changes.
> 
> - Adds `autoExpandPreviewPanel` to `UserSettings` with default `true`
and schema support
> - New `AutoExpandPreviewSwitch` and integrates it into Workflow
Settings UI
> - Gates preview opening in `ChatInput` (on approve) and
`useStreamChat` (on stream end) behind the new setting
> - Updates settings defaults and unit tests to include the new field
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
74064a7eb9092556833afd8fcb37527e59de14cc. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Adds an “Auto-expand preview panel” toggle in Workflow Settings to
control whether the preview opens automatically after chat file updates
or proposal approvals. Defaults to on to preserve current behavior and
addresses Linear issue #2090.

<sup>Written for commit 74064a7eb9092556833afd8fcb37527e59de14cc.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

## Summary
- Updates version from `0.35.0-beta.2` to `0.35.0` for stable release

## Test plan
- [x] All 661 unit tests pass
- [x] Lint and type checks pass

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2398">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> <sup>[Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) is
generating a summary for commit
8e69b7cac6a9f9d94c62f78891d2701642bb5be0. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Promotes 0.35.0-beta.2 to the 0.35.0 stable release to ship the
finalized build. Updates package.json to publish the stable package.

<sup>Written for commit 8e69b7cac6a9f9d94c62f78891d2701642bb5be0.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

#skip-bb

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Show a setup banner and dialog to promote the Dyad Pro free trial during
onboarding. Improves provider selection with clear logos and refreshed
styles.

- **New Features**
- Added DyadProTrialDialog with feature highlights, Start Free Trial
(opens checkout with trialCode=1PRO30), and Learn more.
- Prominent “Start with Dyad Pro free trial” card in SetupBanner; click
opens the trial dialog; marked as Recommended.
- Added Google and OpenRouter assets and switched provider icons to real
logos, including in OpenRouterSetupBanner.

- **Refactors**
- Updated SetupProviderCard styles and chips (new chipColor per
variant); more neutral Google/OpenRouter variants.
- Minor layout tweaks in SetupBanner and ProBanner for spacing and
readability.

<sup>Written for commit 3e3c2932b1189a52f4d332f6d3e8649afe03bfe1.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Low risk UI-only onboarding changes that add a new modal and update
links/assets; main risk is UX/analytics behavior changes around the Dyad
Pro entry point and external URL targets.
> 
> **Overview**
> Adds a new `DyadProTrialDialog` modal to promote a Dyad Pro free
trial, including feature highlights and CTAs that open external
checkout/learn-more URLs.
> 
> Updates `SetupBanner` to show a prominent “Start with Dyad Pro free
trial” recommended card that opens the modal (instead of immediately
navigating externally), refreshes Google/OpenRouter setup cards to use
real logo assets, and slightly tweaks spacing.
> 
> Refines `SetupProviderCard` styling by introducing per-variant
`chipColor` and making Google/OpenRouter variants more neutral, plus a
small spacing tweak in `ProBanner`’s “Already have Dyad Pro?” button.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
3e3c2932b1189a52f4d332f6d3e8649afe03bfe1. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

#skip-bb
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2390">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_SUMMARY -->
> [!NOTE]
> Introduces URL-based theme generation alongside image uploads,
enabling prompts derived from live websites.
> 
> - New `Website URL` input source in `AIGeneratorTab` with toggle,
validation, crawl status indicators, and adjusted generate button/empty
states
> - Adds `useGenerateThemeFromUrl` hook and integrates it with existing
generation flow and loading state
> - Extends IPC types with `ThemeInputSource`, `CrawlStatus`, and
`GenerateThemeFromUrlParams`; updates `templateContracts` with
`generate-theme-from-url`
> - Implements `generate-theme-from-url` handler: validates inputs,
calls Dyad Engine `/tools/web-crawl`, selects web-crawl-specific system
prompts (inspired/high-fidelity), streams model output, and returns
prompt with robust error handling
> - Preserves and refines image-based generation; resets state on dialog
close and adds small UI polish (icons, counters, disabled states)
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
b5b1aebb277ce421953a06b148bd342fded2a64f. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Add URL-based theme generation with web crawling to the custom theme
generator, alongside image uploads. Users can paste a website URL to
extract a design system and generate a prompt with clear generation
status, with added security and reliability improvements.

- **New Features**
- Source toggle: switch between “Upload Images” and “Website URL,” with
state reset on dialog close.
- URL input flow: validate URL and update button states/text; show
generating state during processing.
- New hook and types: useGenerateThemeFromUrl, ThemeInputSource,
CrawlStatus.
- IPC + contract: generate-theme-from-url with
GenerateThemeFromUrlParams and result typing.
- Backend handler: validates Dyad Pro + API key, URL, keywords; crawls
via Dyad Engine (/tools/web-crawl); uses screenshot + markdown with
truncation; distinct meta prompts for inspired vs high-fidelity; model
mapping (Gemini 3 Pro, Claude Opus 4.5, GPT-5.2); streams prompt;
returns clear errors; test mode stub output.

- **Bug Fixes**
- Security: restrict to HTTP/HTTPS URLs; block internal/private hosts
(SSRF); sanitize crawled markdown and user keywords; Zod-validate crawl
response.
- Reliability: 120s crawl timeout with AbortController; clearer errors;
UUID request IDs.
- UI: add “generating” state; fix effect deps to avoid races; correct
button disabled states.
  - Code health: shared model map at module scope (DRY).

<sup>Written for commit b8aef2d51b1c5b7de5266f5afdfeb3174a64285b.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2347">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Will Chen <willchen90@gmail.com>

## Summary
- Adds `normalizeGitHubRepoName` function that converts spaces to
hyphens to match GitHub's automatic normalization behavior
- Applies normalization when creating repos, checking availability, and
storing repo names in the database
- Fixes issue where Dyad stored "my app" but GitHub created "my-app",
causing a mismatch

Fixes #1336

## Test plan
- Unit tests added for `normalizeGitHubRepoName` function covering edge
cases
- E2E test added to verify repo names with spaces are properly
normalized when creating and syncing

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2377">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Normalize GitHub repo names by converting all whitespace to hyphens so
our stored name matches GitHub’s actual repo name. Fixes #1336.

- **Bug Fixes**
  - Add normalizeGitHubRepoName to convert whitespace to hyphens.
- Apply normalization for availability checks, repo creation, remote
URLs, and DB storage.
- Add unit tests for edge cases and an E2E test for create/sync with
spaced names.

<sup>Written for commit 0735ce38a11fced50e670821e58289dcc53fe86f.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Touches the GitHub create/availability flow and the repo name stored
in the app DB, which could break GitHub linking if normalization is
incorrect. Logic is small and well-covered by new unit and E2E tests,
reducing risk.
> 
> **Overview**
> Fixes repo-name mismatches when users enter names containing
whitespace by introducing `normalizeGitHubRepoName` (trim + collapse
whitespace to `-`).
> 
> Applies normalization to repo availability checks, repo creation
payloads, generated remote URLs, and `updateAppGithubRepo` persistence
so the app consistently uses GitHub’s normalized repo name.
> 
> Adds Vitest unit coverage for normalization edge cases and a
Playwright E2E test that creates/syncs a repo named with spaces and
asserts the hyphenated name is used end-to-end.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
0735ce38a11fced50e670821e58289dcc53fe86f. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2387">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Restricts Dyad Pro trial users to the Auto model and adds an upgrade
call-to-action. Non-trial users see the full set of cloud and local
models as before.

- **New Features**
- Added useTrialModelRestriction hook to detect trial status and
auto-switch to the Auto model.
- Updated ModelPicker to show an upgrade banner and only the Auto model
for trial users; hides cloud and local models.
  - Extended IPC user budget response and schema to include isTrial.
  - Updated TitleBar to show "Pro Trial" when applicable.

<sup>Written for commit 714d2c704f155c004240e563e0e850ace0c9f5f8.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Introduces trial-based gating in the model picker and an effect that
can automatically change a user’s selected model, which could impact UX
if trial detection is wrong or delayed.
> 
> **Overview**
> **Trial enforcement for model selection.** Adds
`useTrialModelRestriction` to derive `isTrial` from `get-user-budget`
and auto-switch trial users to the `auto` model.
> 
> **Model picker gating + upgrade CTA.** Updates `ModelPicker` to show
an upgrade banner (opening the subscription URL via
`ipc.system.openExternalUrl`) and to hide all cloud/local model choices
for trial users, leaving only the `auto` option.
> 
> **IPC/schema update.** Extends user budget IPC types and
`pro_handlers` API parsing to include an `isTrial` flag (defaulting to
`false` when absent).
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7928275e3b1a7d32ec792609968d9d5786ee8582. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

## Summary
- Add "Basic Agent" mode for non-Pro users with a 5 messages per 24-hour
rolling window quota
- Track quota usage via `usingFreeAgentModeQuota` column in messages
table
- Show quota remaining in mode selector (e.g., "4/5 remaining") and
display warning banner when quota exceeded with upgrade/switch options
- Default to Basic Agent mode if quota available, Build mode if exceeded

## Test plan
- Run `npm run ts` and `npm run lint` to verify code compiles
- Run `PLAYWRIGHT_HTML_OPEN=never npm run e2e -- --grep "free agent
quota"` to run the E2E tests
- Manual testing:
1. Without Dyad Pro, verify "Basic Agent" option appears in mode
selector with quota display
  2. Send 5 messages in Basic Agent mode, verify quota decrements
  3. After 5 messages, verify quota exceeded banner appears
  4. Click "Switch back to Build mode" button, verify mode changes

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2355">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Introduces new quota enforcement and state changes in the chat
streaming path plus a DB schema change; bugs could block non‑Pro agent
usage or miscount/refund quota. Also adds a network call for trusted
time and a test-only IPC channel, which increases surface area but is
scoped and guarded.
> 
> **Overview**
> Adds a **non‑Pro “Basic Agent” mode** (implemented via `local-agent`)
gated by a **5-message/day quota**, including quota-aware defaults and
mode labeling (`Agent v2` for Pro vs `Basic Agent` for free).
> 
> Implements **DB-backed quota tracking** via a new
`messages.using_free_agent_mode_quota` column and new IPC handlers to
compute/reset quota (using server time where possible), enforce limits
before starting a `local-agent` stream, and **refund quota on stream
failure/abort**.
> 
> Updates the UI to display remaining quota, disable Basic Agent when
exceeded, show a dedicated exceeded banner and error messaging, and adds
targeted E2E tests plus a test-only IPC hook to simulate time passing.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
f4d3470477e247e782e8b5005d7fd60e6da98c13. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Adds a Basic Agent mode for non‑Pro users with a 5‑message quota in a
24‑hour window. Quota is enforced server‑side, with clear UI for
remaining messages, a banner showing time until reset, a friendly error
when exceeded, and engine tools disabled in Basic Agent mode.

- **New Features**
- Shows “Basic Agent” for non‑Pro users; defaults to Basic Agent when
quota and a supported provider are available, falls back to Build when
exceeded.
- Tracks usage via messages.using_free_agent_mode_quota and enforces the
limit before local‑agent streams; marks messages before stream and
refunds quota on failure/abort; blocks the 6th message with a clear
error.
- Mode selector displays X/5 remaining and disables Basic Agent when the
quota is exceeded.
- Quota banner shows time until reset and provides “Upgrade to Dyad Pro”
and “Switch back to Build mode” actions; useFreeAgentQuota hook
auto‑refreshes every 30 minutes.
- Disables engine-dependent tools in Basic Agent mode; E2E tests cover
availability, tracking, banner, switching, exceeded-message blocking,
and 24‑hour reset.

- **Migration**
- Apply drizzle migration 0024 to add the using_free_agent_mode_quota
column to messages.

<sup>Written for commit f4d3470477e247e782e8b5005d7fd60e6da98c13.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

## Summary
Replace the PR close/reopen mechanism for CI re-triggering with GitHub's
`workflow_dispatch` event, which is more reliable and avoids potential
issues with PR state management.

## Key Changes
- **ci.yml**: Added `workflow_dispatch` trigger with optional
`pr_number` input parameter to allow manual CI runs
- **ci.yml**: Updated test check logic to always run tests when
triggered via `workflow_dispatch`
- **ci.yml**: Pass `PR_NUMBER` environment variable to Playwright
summary script for workflow_dispatch triggers
- **pr-review-responder.yml**: Replaced PR close/reopen logic with `gh
workflow run` command to trigger CI via `workflow_dispatch`

## Implementation Details
- The `workflow_dispatch` trigger accepts an optional `pr_number` input
that can be passed by the pr-review-responder workflow
- When CI is triggered via `workflow_dispatch`, tests always run
(skipping the file change check)
- The new approach is more reliable because:
  - Avoids the risk of leaving a PR in a closed state if operations fail
  - Works with `GITHUB_TOKEN` without infinite loop concerns
  - Provides explicit control over when CI re-runs
- Eliminates retry logic and recovery mechanisms needed with
close/reopen approach

https://claude.ai/code/session_014TKdhebC3RqZ7yusKuRSJD
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2382">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Medium risk because it changes GitHub Actions triggering, concurrency
grouping, and checkout behavior (including fork PR handling) for CI and
AI review bots; misconfiguration could lead to running workflows on the
wrong ref or not running at all.
> 
> **Overview**
> Switches CI and AI-bot workflows to support manual `workflow_dispatch`
runs via a required `pr_number`, enabling reliable re-triggers without
PR close/reopen.
> 
> `ci.yml` now derives checkout `repository`/`ref` from the PR head
(fetched via `gh pr view` for dispatch), updates concurrency grouping to
key by PR number, always runs tests for dispatch runs, and passes
`PR_NUMBER` to the Playwright summary script so comments still attach to
the correct PR.
> 
> `pr-review-responder.yml` replaces the close/reopen hack with `gh
workflow run` calls to dispatch `ci.yml`, `bugbot-trigger.yml`, and
`claude-pr-review.yml` when Claude pushes commits. `bugbot-trigger.yml`
and `claude-pr-review.yml` add dispatch support and PR-number fallbacks;
BugBot additionally validates `pr_number` and re-checks skip tags before
commenting.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
357dddba6b3c3c9144b21f6f400fc0b49e55e244. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Switch re-triggers to workflow_dispatch for CI, BugBot, and Claude PR
Review. This replaces the close/reopen hack, works with GITHUB_TOKEN,
and ensures tests and reviews run after automated commits.

- **Refactors**
- Added workflow_dispatch with pr_number input to ci.yml,
bugbot-trigger.yml, and claude-pr-review.yml.
- pr-review-responder now calls gh workflow run for all three when it
pushes commits.
- CI always runs tests on workflow_dispatch, checks out the PR head
(supports forks), passes PR_NUMBER to the Playwright summary, and uses
pr_number in concurrency.
- Claude PR Review fetches PR head info on dispatch; concurrency keys
use pr_number when provided.
- BugBot dispatch uses inputs.pr_number, re-checks skip tags, and
bypasses author gating for dispatch.

<sup>Written for commit 357dddba6b3c3c9144b21f6f400fc0b49e55e244.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

---------
Co-authored-by: Claude <noreply@anthropic.com>

Closes #2354
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2373">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->


<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Automatically commits local changes before preparing a GitHub branch,
preventing failures on dirty repos and making branch setup reliable.
Closes #2354.

- **Bug Fixes**
  - Auto-add and commit pending changes in prepareLocalBranch.
  - Block with a clear error if a merge or rebase is in progress.
- Use locking and ensureCleanWorkspace to keep operations atomic and
clean.
  - Export prepareLocalBranch for reuse.

<sup>Written for commit b3af874e41856d47d397343ded7e278336ad0d92.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

- Add ready_for_review and closed event types to pull_request trigger
- Update concurrency group to use PR number for proper cancellation
- Add condition to skip draft PRs and closed events
- When a PR is merged, the closed event triggers cancellation of
in-progress runs

https://claude.ai/code/session_0131m7Y5ac6ztV6iPCiW6zMU

#skip-bb
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2383">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Update CI to cancel in-progress runs when a PR is merged and use per-PR
concurrency for accurate cancellation. Draft PRs now run; only closed
events are skipped.

- **Refactors**
  - Listen to closed in the pull_request trigger.
  - Use PR number in the concurrency group for proper cancellation.
  - Add a job condition to skip closed events only.

<sup>Written for commit fe1d8903f8730bbf6ed93dbdfc8a9f0b804b9912.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

---------
Co-authored-by: Claude <noreply@anthropic.com>

## Summary
- Removed ANTHROPIC_API_KEY from the required environment variables list
- Added clarification that sub-agents spawned via the Task tool
automatically have access to Anthropic

#skip-bugbot

## Test plan
- Verify the documentation accurately reflects the current behavior of
the multi-pr-review skill

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2386">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->


<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Clarified that ANTHROPIC_API_KEY is not required for the multi-pr-review
skill. Updated SKILL.md to note that sub-agents launched via the Task
tool already have Anthropic access, so only GITHUB_TOKEN is needed.

<sup>Written for commit f5735d135face9923420ecfa08ebcbfab60796dd.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

## Summary
- Updates the E2E test snapshot for the turbo edits search-replace
fallback test
- The error message format changed to remove the fuzzy match similarity
percentage, simplifying the error output

## Test plan
- [x] E2E snapshot updated to reflect new error message format
- All existing tests pass (654/654)

#skip-bugbot

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2384">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->


<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Update the turbo edits E2E snapshot to match the new simplified
search-replace error message. Removes the fuzzy match similarity
percentage from the expected output so tests align with current
behavior.

<sup>Written for commit c256a7205139069cccc23cea31e16b30f50b649f.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

## Summary
- Bumps version from 0.34.0-beta.1 to 0.35.0-beta.1

## Test plan
- Verify package.json shows correct version

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2378">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->


<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Bumps package.json version from 0.34.0-beta.1 to 0.35.0-beta.1 to
prepare the next beta release. No functional changes.

<sup>Written for commit a9ff86fa30e2d1811fa0e305aaee6668fe9a7861.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Version bump**
> 
> - Updates `package.json` version from `0.34.0-beta.1` to
`0.35.0-beta.1`. No code or dependency changes.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
a9ff86fa30e2d1811fa0e305aaee6668fe9a7861. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

## Summary
- Add E2E test for preview navigation forward/back buttons
- Fix back/forward navigation by sending target URL instead of using
`history.back()`/`history.forward()` which don't work reliably in
Electron iframes
- Update dyad-shim.js to handle URL-based navigation with
`location.replace`
- Add popstate event handler to notify parent of navigation changes

## Test plan
- Run `npm run e2e -- --grep "forward and back"` to verify the new test
passes
- Run `npm run e2e -- --grep "refresh"` to verify all refresh-related
tests pass
- Manually test back/forward navigation buttons in the preview panel

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2372">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Ensures preview back/forward navigation works reliably in Electron
iframes and preserves routes across refresh/HMR. Adds targeted E2E
coverage.
> 
> - In `PreviewIframe.tsx`, switch back/forward handling to send the
target URL via `postMessage` and update local `navigationHistory`,
`currentHistoryPosition`, and `preservedUrls`; keep
`currentIframeUrlRef` in sync.
> - In `worker/dyad-shim.js`, add `popstate` handler to notify parent
(`replaceState` message) and handle `navigate` messages by validating
http/https URLs and using `location.replace`, with fallback to
`history.go(±1)`.
> - Add E2E test `refresh.spec.ts` for preview forward/back buttons,
verifying initial disabled state, navigation to About, back to Home,
then forward to About again.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7f9f790158262b9e3100ead96bf25f8e3ee8cac7. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Fixes preview forward/back navigation and preserves the current route on
refresh and HMR so the preview behaves like a real browser. Adds E2E
tests for both flows.

- **Bug Fixes**
- Make back/forward work in Electron by posting the target URL to the
iframe and navigating with location.replace; notify parent on popstate;
validate http/https URLs to block unsafe protocols.
- Track and restore the current route across refresh and HMR via
previewCurrentUrlAtom and a URL ref; clear preserved URL on root path;
reset on app switch and validate same-origin URLs.

- **E2E Tests**
  - Add a multi-page react-router fixture (Home/About).
- Add tests for route preservation on refresh and for forward/back
buttons, including enabled/disabled states.

<sup>Written for commit 7f9f790158262b9e3100ead96bf25f8e3ee8cac7.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

## Summary
- Add `local_agent:search_replace:success` and
`local_agent:search_replace:failure` telemetry events to track
search-replace outcomes in local-agent mode
- Add `local_agent:file_edit_retry` telemetry to detect when multiple
edit tool types (write_file, edit_file, search_replace) are used on the
same file, indicating retry/fallback behavior
- Add `FileEditTracker` to `AgentContext` to track tool usage per file
during an agent session

## Test plan
- [x] TypeScript type checks pass
- [x] Linter passes
- [x] All 654 unit tests pass

🤖 Generated with [Claude Code](https://claude.com/claude-code)

#skip-bugbot
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2371">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Adds telemetry to local-agent to track search-replace success/failure
and when multiple edit tools touch the same file. Introduces a
FileEditTracker in AgentContext to record write_file, edit_file, and
search_replace usage per file.

- **New Features**
- Emit local_agent:search_replace:success and
local_agent:search_replace:failure (includes filePath and error on
failure).
- Emit local_agent:file_edit_retry when a file uses 2+ different edit
tools; includes per-tool counts.
- Track usage via FileEditTracker on AgentContext with a helper that
records tool calls.

- **Migration**
- Update any AgentContext mocks/constructors to include fileEditTracker:
{}.

<sup>Written for commit f8345128b1d29b555c4c787df7103a6cae98373b.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

## Summary
- Add new `search_replace` tool with strict matching requirements:
  - Requires minimum 3 lines of context for unambiguous matching
  - Enforces exact-only matching (no fuzzy/lenient fallback)
  - Rejects ambiguous matches and identical old/new strings
- Extend `applySearchReplace` processor with `SearchReplaceOptions`
interface
- Update system prompt with file editing tool selection guidelines
- Add comprehensive unit tests (43 tests) and E2E test

## Test plan
- Unit tests: `npm run test -- search_replace` (43 tests passing)
- E2E tests: `npm run e2e -- --grep "local-agent"` (19 tests passing)
- Verify lint passes: `npm run fmt && npm run lint && npm run ts`

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2367">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Introduces a precise, single-instance `search_replace` tool for local
agent edits and wires it across stack.
> 
> - New `search_replace` tool: strict schema (`file_path`, `old_string`,
`new_string`), rejects identical/ambiguous matches, streams XML, deploys
Supabase functions when applicable; registered in `tool_definitions`
> - Processor overhaul: replace Levenshtein with cascading matching
(exact → whitespace-tolerant → unicode-normalized), detailed failure
diagnostics, marker escaping helper, async fs usage
> - Update `edit_file` schema/usage from `description` → `instructions`
(tool schema, XML builder, examples)
> - Prompt: add file-editing tool selection guidance and post-edit
verification
> - UI: `DyadSearchReplace` gains `data-testid="dyad-search-replace"`
for E2E visibility
> - Tests: comprehensive unit tests for processor and tool, DSL runner
with pass/fail suites, plus new Playwright E2E and fixtures; snapshots
updated
> - Chore: remove `fastest-levenshtein` dependency from
`package.json`/lockfile
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
dfa9b9e172e89f135fc71cd1f35f7f3c614b9af4. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Adds a strict search_replace tool for precise, single-instance file
edits by the local agent. Enforces exact matches with ≥3 non-empty lines
of context and auto-deploys Supabase functions when server functions are
edited.

- New search_replace tool: exact-only matching, requires ≥3 non-empty
lines of context, rejects ambiguous matches, and disallows identical
old/new strings
- Processor: implement cascading matching passes; add
SearchReplaceOptions (exactMatchOnly, rejectIdentical) and wire into
applySearchReplace
- Prompt: add clear edit-tool selection guidance, post-edit
verification, and write_file fallback
- Tests: comprehensive unit tests plus an E2E covering the new tool;
snapshots updated
- UI: add data-testid to surface search-replace actions and register the
tool in definitions
- Dependencies: remove fastest-levenshtein
- Edit tool: rename description → instructions in the schema and XML;
examples and prompt updated

<sup>Written for commit dfa9b9e172e89f135fc71cd1f35f7f3c614b9af4.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Original PR: https://github.com/dyad-sh/dyad/pull/2328
Authored by @gkrdy - thank you!

---------
Co-authored-by: gkrdy <girishkathirdy@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Add a new setting "Keep extra Supabase edge functions" that controls
whether dangling edge functions (deployed to Supabase but not in
codebase) are automatically deleted during sync operations.

When disabled (default), edge functions are pruned during batch
deployments triggered by:
- Shared module changes
- Version reverts
- Local agent file operations

Changes:
- Add skipPruneEdgeFunctions to UserSettings schema
- Add listSupabaseFunctions API method to management client
- Modify deployAllSupabaseFunctions to prune dangling functions
- Add UI toggle in SupabaseIntegration component
- Update all call sites to pass the setting

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Introduces a user setting to control pruning of Supabase edge
functions and integrates pruning into batch deployments.
> 
> - Adds `skipPruneEdgeFunctions` to `UserSettings` and a toggle in
`SupabaseIntegration`
> - Extends management client with `listSupabaseFunctions`
> - Updates `deployAllSupabaseFunctions` to optionally prune deployed
functions not in the codebase, using `deleteSupabaseFunction`;
controlled by `skipPruneEdgeFunctions`
> - Threads the setting through all batch deploy call sites: shared
module edits (`app_handlers`), version reverts (`version_handlers`),
chat/agent file ops (`response_processor`, local agent
`file_operations`)
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
6af28fb682e7a6352426e0033d67ee1e750201fc. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Adds a setting to control pruning of extra Supabase edge functions
during batch deployments. By default, dangling functions (deployed but
not in code) are pruned; enable “Keep extra Supabase edge functions” to
skip pruning.

- **New Features**
- Added skipPruneEdgeFunctions to UserSettings and a toggle in
SupabaseIntegration.
- Implemented listSupabaseFunctions API and pruning in
deployAllSupabaseFunctions.
- Passed the setting through all batch deploy paths (shared module
changes, version reverts, local agent file operations).

<sup>Written for commit 6af28fb682e7a6352426e0033d67ee1e750201fc.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2228">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Claude <noreply@anthropic.com>

## Summary
- Adds a new step to run `npm test` in the `/dyad:pr-push` skill after
lint checks
- Ensures tests pass before pushing changes to prevent broken code from
being pushed
- Updates step numbering and summary section accordingly

## Test plan
- Run `/dyad:pr-push` and verify it now runs `npm test` as step 4
- Confirm the skill fails if tests don't pass

#skip-bugbot

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2364">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->


<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Adds an npm test step to the /dyad:pr-push skill after linting, blocking
pushes when tests fail. Also updates step ordering and the final summary
to confirm tests passed.

- New Features
  - Run npm test after lint and before push (required).
  - Fail the skill if tests fail.
  - Renumber follow-up steps and update instructions.
  - Add “tests passed” to the result summary.

<sup>Written for commit ba2ef4fb11989841170a9f1e56732d60ae205c29.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2363">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

## Summary
- Adds a `check-changes` job to CI that detects if a PR only modifies
files in `.claude/`
- Skips the expensive `test` and `merge-reports` jobs when only Claude
config files are changed
- Always runs tests on pushes to main branch for safety

## Test plan
- Create a PR that only changes files in `.claude/` → CI should skip E2E
tests
- Create a PR that changes files outside `.claude/` → CI should run E2E
tests normally
- Push to main → CI should always run E2E tests

#skip-bugbot

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2362">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->


<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Skip E2E tests in CI when a PR only changes files in .claude/, cutting
build time and saving resources. Tests always run on pushes to main;
aligns with Linear issue 1769548046265.

- **New Features**
- Added a check-changes job that outputs should_run_tests based on the
diff (PR vs push).
- Gated test and merge-reports jobs on should_run_tests; skip when only
.claude/ files changed.
  - Falls back to running tests if changed files can’t be determined.

<sup>Written for commit a75bfed9498b31634a8944d63a435688e0bac8ac.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

## Summary
- Multiple components calling `useRunApp()` each registered their own
event listener for `onAppOutput`, causing duplicate log entries in the
console
- Extracted the event subscription into a new
`useAppOutputSubscription()` hook
- The new hook is called only once in `layout.tsx` at the root level,
eliminating duplicates

## Test plan
- Run an app and observe the System Messages console
- Verify that server log messages (stdout/stderr) appear only once
instead of multiple times
- Verify HMR updates still trigger iframe refreshes correctly

🤖 Generated with [Claude Code](https://claude.com/claude-code)

#skip-bugbot
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2359">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->


<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Fix duplicate server log messages by subscribing to app output events
only once at the app root. Prevents repeated stdout/stderr entries while
keeping HMR iframe refreshes working.

- **Bug Fixes**
- Extracted event subscription from useRunApp into a new
useAppOutputSubscription hook.
- Call useAppOutputSubscription once in layout.tsx to avoid duplicate
listeners.
  - Preserved proxy URL processing and hot module reload behavior.

<sup>Written for commit 0f4df3f539c818e2100228e23602f31fe1d07742.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Eliminates duplicate server logs by centralizing app output
subscription.
> 
> - Extracts event listener logic from `useRunApp` into new
`useAppOutputSubscription()` and subscribes once in `src/app/layout.tsx`
> - Preserves HMR handling (refresh via preview panel key) and proxy URL
parsing in `processProxyServerOutput`
> - Refactors internals with `useCallback` dependencies to avoid
duplicate processing while keeping existing `useRunApp` API intact
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
0f4df3f539c818e2100228e23602f31fe1d07742. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

#skip-bb
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2361">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Upgrades the Claude PR review to include a dedicated code-health agent,
smart deduplication, and an always-posted summary, while enforcing app
builds before E2E tests to avoid stale binaries. Also improves stop
behavior by analyzing Task* tool calls and updates the workflow to use
the new multi-agent review command.

- **New Features**
  - Adds a Code Health reviewer alongside correctness-focused agents.
  - Deduplicates issues with Sonnet and skips already-commented items.
  - Posts a summary every run; inline comments only for HIGH/MEDIUM.
- Improves stop-hook by sending Task* calls to the model and recognizing
plan-mode waits.
- Switches GitHub Action to `/dyad:multi-pr-review`; adds “Plan to
Issue” command; updates trusted commenters and E2E run permissions.

- **Migration**
  - Before any E2E run, build the app: `npm run build`.
- Adds a `build` script; updates docs and commands to require building
before tests.

<sup>Written for commit ceddd301964cf0f74d1d1cd016dec951433dce98.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2342">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Adds a pull workflow and consolidates branch operations into a single
actions menu.
> 
> - UI: Replace standalone buttons with `Branch actions` dropdown
(`GithubBranchManager.tsx`) containing `Create new branch`, `Refresh
branches`, and new `Git pull`; disables controls while pulling
> - IPC: New `github:pull` contract and handler that pulls from `origin`
on current branch, uses auth token, tolerates missing remote branch, and
reloads branches (`src/ipc/types/github.ts`,
`src/ipc/handlers/git_branch_handlers.ts`)
> - E2E: Update flows to use `branch-actions-menu-trigger`; add pull
test and snapshots; factor `configureGitUser()` helper (`e2e-tests/...`)
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
40bb9e7cd72308acf34563e9758884d2b0c2cd4e. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Adds Git pull support and consolidates branch actions into a single
“Branch actions” menu, making it easy to pull remote changes from the
UI. Includes IPC wiring and an end-to-end test.

- **New Features**
- Added “Branch actions” dropdown with Create branch, Refresh branches,
and Git pull.
  - Git pull action with loading state and success/error toasts.
- New IPC contract and handler (github:pull) that pulls from origin and
tolerates missing remote branch.

- **Refactors**
- Replaced separate buttons with a dropdown in GithubBranchManager and
updated test IDs.
- Added configureGitUser helper and new e2e test for pulling from
remote.
  - Updated snapshots to reflect the new menu.

<sup>Written for commit 40bb9e7cd72308acf34563e9758884d2b0c2cd4e.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

## Summary
- When clicking the refresh button in the preview panel, the app now
preserves the current route instead of defaulting to the root path (/)
- Store the current URL in a ref when refresh is clicked, then use it as
the iframe src during reload
- Added E2E test to verify route preservation on refresh

Fixes #253

## Test plan
- E2E test `refresh preserves current route` verifies the fix:
  1. Create an app
2. Navigate to a different route using JavaScript (simulating
client-side navigation)
  3. Click refresh
  4. Verify the address bar still shows the navigated route (not /)
- Existing `refresh app` test continues to pass

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2336">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Ensures the preview iframe keeps the current client-side route on
refresh and after HMR remounts.
> 
> - Track route changes (`pushState`/`replaceState`) and persist per-app
URL via `previewCurrentUrlAtom`; initialize navigation from preserved
URL
> - Use `currentIframeUrlRef` and validated same-origin URL as iframe
`src` on reload; reset history on app change
> - Update `PreviewIframe` navigation history, address bar
(`data-testid="preview-address-bar-path"`), and reload logic; avoid
unintended src resets on re-render
> - Add E2E test `refresh preserves current route` with a multi-page
React Router fixture to verify behavior
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
d715ec38b8fb94383eafe3a31b901d407468ab4e. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Refresh in the preview panel now preserves the current route instead of
resetting to /. Routes are also restored after HMR remounts; adds an E2E
test to confirm this; fixes #253.

- **Bug Fixes**
- Track route changes (pushState/replaceState) and persist the current
URL per app via previewCurrentUrlAtom; on reload, validate same-origin
and use it as the iframe src; reset on app change.
- Add a data-testid to the address bar and a Playwright test that
navigates via a react-router link in a multi-page app, refreshes, waits,
and asserts the route remains.

<sup>Written for commit d715ec38b8fb94383eafe3a31b901d407468ab4e.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>

## Summary
- Add `remarkGfm` plugin to `VanillaMarkdownParser` and
`DyadMarkdownParser` components
- Enables proper rendering of GitHub Flavored Markdown features
including tables, strikethrough, autolinks, and task lists

## Test plan
- Verify tables render correctly in chat messages
- Verify strikethrough text (~~text~~) renders with strikethrough
styling
- Verify task lists (- [ ] and - [x]) render as checkboxes
- Verify autolinks are properly converted to clickable links

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2353">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->


<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Enabled GitHub Flavored Markdown in chat markdown parsing to correctly
render tables, strikethrough, autolinks, and task lists. Adds remarkGfm
to VanillaMarkdownParser and DyadMarkdownParser; addresses Linear issue
2297.

<sup>Written for commit f3eb069a860e6bf95f76a9bcc97b44d89fe07da7.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Adds GitHub Flavored Markdown support to chat markdown rendering.
> 
> - Import `remark-gfm` and pass via `remarkPlugins` to `ReactMarkdown`
in `VanillaMarkdownParser` and within `DyadMarkdownParser` for markdown
pieces
> - Ensures proper rendering of GFM features (tables, strikethrough,
autolinks, task lists) in chat content
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
f3eb069a860e6bf95f76a9bcc97b44d89fe07da7. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

## Summary

- Re-triggers CI after Claude Code pushes commits by closing and
reopening the PR (workaround for GITHUB_TOKEN commits not triggering
workflows)
- Updates pr-fix command to post a summary comment on the PR when done,
with collapsible details

## Background

When Claude Code pushes commits using `GITHUB_TOKEN`, GitHub's
anti-recursion protection prevents other workflows from triggering. This
PR adds a step to close and reopen the PR after Claude pushes, which
triggers the `reopened` event that CI listens for.

Also adds instructions to the pr-fix command to have Claude post a
summary comment on the PR summarizing what was done.

## Test plan

- [ ] Verify CI re-triggers after Claude Code pushes commits
- [ ] Verify summary comment is posted on the PR

#skip-bugbot

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2339">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Automatically re-triggers CI after Claude Code pushes and adds a clear
PR summary comment when pr-fix completes. This avoids missed builds from
GITHUB_TOKEN commits and helps reviewers see what changed.

- **New Features**
- Detects new commits from Claude and re-triggers CI by
closing/reopening the PR (uses HEAD tracking, GitHub API, and a reopen
retry for reliability).
- pr-fix posts a success/failure summary comment with addressed review
items, CI fixes, remaining issues, collapsible details, plus a workflow
run link; handles comment failures and missing env vars gracefully.

<sup>Written for commit 77be40a076e264333efb046a81fbc6920b5adc64.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

## Summary
- Add Python script to sanitize GitHub issue markdown (removes HTML
comments, zero-width characters, excessive whitespace, details/summary
tags)
- Add unit tests with 5 golden input/output pairs plus additional inline
tests
- Update fix-issue.md to use sanitizer and proceed directly with
implementation for straightforward plans (no remote session question)
- Add goldens directory to format ignore to preserve test data

## Test plan
- Run `python3
.claude/commands/dyad/scripts/test_sanitize_issue_markdown.py` to verify
all 13 unit tests pass
- Test the sanitizer directly: `echo "<!-- comment -->" | python3
.claude/commands/dyad/scripts/sanitize_issue_markdown.py`

#skip-bugbot

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2337">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Adds a Python markdown sanitizer and integrates it into the fix-issue
flow to clean GitHub issue content and enable direct local
implementation for straightforward plans.

- **New Features**
- Added sanitizer script that removes HTML comments, invisible
characters, excessive blank lines, and strips details/summary tags while
keeping content; normalizes line endings and whitespace.
- Updated fix-issue.md to run the sanitizer and let simple plans proceed
directly to local implementation without the remote session prompt.
- Included golden files and unit tests (13) to validate sanitizer
behavior.
- Added the goldens directory to formatter and Prettier ignore lists to
preserve test fixtures.

- **Bug Fixes**
- Fixed shell injection risk in fix-issue.md by using printf in the
sanitizer step.

<sup>Written for commit 226f9436ba6f338efd6fb798aa327334459647aa.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>

## Summary

- Adds an application menu with Edit, View, and Window submenus to
enable standard keyboard shortcuts
- Fixes #1952: Users can now use Cmd/Ctrl+C, Cmd/Ctrl+V, Cmd/Ctrl+Z,
Cmd/Ctrl+X, Cmd/Ctrl+A instead of right-clicking
- The Edit menu provides: Undo, Redo, Cut, Copy, Paste, Delete, Select
All

## Test plan

1. Start the app
2. Click in the chat input field and type some text
3. Test Ctrl/Cmd+A (Select All) - should select all text
4. Test Ctrl/Cmd+C (Copy) - should copy selected text
5. Test Ctrl/Cmd+V (Paste) - should paste clipboard content
6. Test Ctrl/Cmd+Z (Undo) - should undo last action
7. Test Ctrl/Cmd+Shift+Z or Ctrl+Y (Redo) - should redo undone action
8. Test Ctrl/Cmd+X (Cut) - should cut selected text
9. Verify right-click context menu still works as before

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2335">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Introduces a global application menu to enable OS-standard keyboard
shortcuts and window/view controls.
> 
> - Adds `createApplicationMenu` in `src/main.ts` with `Edit`, `View`,
and `Window` menus (plus macOS `App` menu) providing `undo/redo`,
`cut/copy/paste/delete/selectAll`, zoom controls, reload, devtools, and
fullscreen
> - Calls `createApplicationMenu()` during startup after
`createWindow()` to activate shortcuts across the app
> - Leaves existing right-click context menu behavior intact
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
fbd07b8dc49d8ee97f98526ac1d654701734c038. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Adds an application menu to enable standard keyboard shortcuts (Undo,
Redo, Cut, Copy, Paste, Select All) across the app. Fixes #1952 so users
can use Cmd/Ctrl shortcuts instead of relying on the context menu.

- **New Features**
- Create and set application menu on startup with Edit, View, and Window
menus.
- Edit menu wires Undo, Redo, Cut, Copy, Paste, Delete, Select All via
Electron roles.
- Includes macOS app menu (About, Services, Hide, Quit); Windows/Linux
use Window -> Close.

<sup>Written for commit f2499679fb571476cec5f74a2e5a23c3447512c3.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>

## Summary
- Fixed `gh pr edit` commands failing with "Could not resolve to a
PullRequest" error
- When the workflow checks out a fork repository, the `gh` CLI operates
in that context and tries to find the PR in the fork instead of the
upstream repo
- Added `--repo ${{ github.repository }}` flag to all `gh pr edit`
commands to ensure they target the correct repository

## Test plan
- Create a PR from a fork with the `cc:request` label
- Verify the PR Review Responder workflow can successfully update labels

#skip-bugbot

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2338">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->


<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Fixes gh pr edit failures on fork-based PRs by forcing the repo context
with --repo ${{ github.repository }}. The PR Review Responder now
reliably updates cc:request/pending/done/failed labels in the upstream
repo even when the workflow runs in a fork.

<sup>Written for commit b2d37c8852965f102932662d309da8c45bf9f2f1.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

## Summary
- Adds `getWindowsSanitizedEnv()` function that filters WSL-related PATH
entries on Windows
- Creates `execGit()` wrapper that applies sanitized environment to all
dugite exec calls
- Prevents WSL relay from intercepting git commands when WSL is
installed but misconfigured

Fixes #2194

## Test plan
- [ ] Test on Windows machine with WSL installed
- [ ] Verify git commit operations work with native Git enabled
- [ ] Verify no regression on macOS/Linux (sanitization only activates
on Windows)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Sanitize PATH on Windows to stop WSL from hijacking git commands,
ensuring native Git runs reliably. Fixes #2194.

- **Bug Fixes**
- Added getWindowsSanitizedEnv to filter WSL PATH entries (\\wsl$,
\\wsl.localhost, windowsapps, /mnt, /usr, /bin, /home) and handle PATH
key casing.
- Wrapped all dugite exec calls with execGit on Windows; added '--'
separators and remote URL validation.
- Prevents WSL hijacking and errors like "execvpe(/bin/bash) failed: No
such file or directory".

<sup>Written for commit ad0a93ceb660831d8c4abf3e05dd91b8523dd9f1.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Fixes Windows WSL PATH contamination by introducing a sanitized env
and routing all native Git calls through a wrapper.
> 
> - **Add** `getWindowsSanitizedEnv()` to filter WSL-related PATH
entries on Windows and handle PATH key casing
> - **Introduce** `execGit()` wrapper and replace all `dugite.exec`
usages to apply sanitized env on Windows
> - **Harden** native Git calls: add `--` separators for path/URL args
(e.g., `clone`, `check-ignore`), and validate `remoteUrl` to prevent
option injection
> - Touches most native Git flows: status, commit, checkout, branch ops,
clone, push/pull/fetch/merge/rebase, file retrieval, and conflict
detection
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
ad0a93ceb660831d8c4abf3e05dd91b8523dd9f1. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2282">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

## Summary
- Replace broken prompt-based Stop hook with command-based hook using
Claude Sonnet
- Add .claude/hooks/stop-hook.py that reads conversation transcript and
uses Sonnet to analyze task completion
- Includes infinite loop prevention via stop_hook_active check
- Add unit tests for the stop hook

## Test plan
- [x] Run pytest .claude/hooks/tests/test_stop_hook.py -v - all 9 tests
pass
- [ ] Manual testing: verify stop hook fires and correctly analyzes task
completion

#skip-bugbot

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Replaced the broken prompt-based stop hook with a command-based hook
that blocks when tasks remain and uses Sonnet analysis as a fallback.
Adds loop protection and tests.

- **New Features**
- Added .claude/hooks/stop-hook.py that blocks when
TaskCreate/TaskUpdate show remaining tasks, returning
{"decision":"block","reason":...}. If none remain, it analyzes a 32k
transcript (middle truncation) with Sonnet.
- Added unit tests and a stop_hook_active guard to prevent infinite
loops.

- **Refactors**
- Updated .claude/settings.json to use the command-based hook (30000 ms
timeout) instead of the prompt hook.
- Added --no-session-persistence to Claude CLI calls in stop-hook.py and
permission-request-hook.py.

<sup>Written for commit 575426cee9efb0fa7e1f4be64a8405ae2e717a3b.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2331">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

## Summary
- **gh-permission-hook:** Allow `gh pr` commands without shell injection
check (common workflow patterns need pipes, backticks in markdown
bodies, etc.)
- **gh-permission-hook:** Keep shell injection as deny for all other
`gh` commands
- **gh-permission-hook:** Allow PATCH to `/pulls/{id}` for updating PR
title/body via API
- **python-permission-hook:** Allow `pytest` as an exception to the `-m`
module restriction for running tests
- Update test data to reflect new behavior

## Test plan
- Run `pytest tests/test_gh_permission_hook.py
tests/test_python_permission_hook.py -v` in `.claude/hooks/` to verify
all hook tests pass
- Verify `gh pr create` with backticks in body works without shell
injection error
- Verify `gh api -X PATCH repos/owner/repo/pulls/123` is allowed
- Verify `python -m pytest` is allowed

#skip-bugbot

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

<!-- CURSOR_SUMMARY -->
> [!NOTE]
> Modernizes IPC usage app-wide to new typed, namespaced contracts.
> 
> - Refactors calls from `IpcClient` to `ipc.*` namespaces (system, app,
chat, github, git, version, languageModel, neon, visualEditing, context,
misc, capacitor, template, events, upgrade, agent, proposal)
> - Updates type imports from `"@/ipc/ipc_types"` to `"@/ipc/types"`
(e.g., `ListedApp`, security types) and adapts optional fields
> - Aligns method signatures to object params and new return shapes
(e.g., `getAppVersion` → `{ version }`); replaces various URL
opens/restarts/screenshots with `ipc.system.*`
> - Moves custom theme and theme generation ops to `ipc.template.*`;
adds maxOutputTokens in custom model dialogs; adjusts provider/model
management APIs
> - Switches GitHub/Vercel/Neon/Supabase/Capacitor connectors and
branching flows to new IPC endpoints; updates event subscriptions for
GitHub device flow
> - Normalizes logging/preview interactions and visual editing
apply/analyze via `ipc.misc`/`ipc.visualEditing`
> 
> Potential follow-ups: verify all parameter objects and event handlers,
and update any remaining legacy imports.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7c574fe53296ba5c9a16d6b69d1008d06490534e. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Adopted the new typed IPC contracts across the app, replacing IpcClient
with namespaced ipc methods. Restored app output streaming via events,
added maxOutputTokens for custom model flows, migrated custom theme
operations to ipc.template, and fixed chat stream cancellation
lifecycle.

- **Refactors**
- Replaced IpcClient usage with ipc.* namespaces (system, app, chat,
github, git, version, languageModel, neon, visualEditing, context,
prompt, mcp, misc, capacitor, template, events, upgrade, agent,
proposal).
- Moved type imports from "@/ipc/ipc_types" to "@/ipc/types"; adjusted
renamed types and paths (e.g., ListedApp under "@/ipc/types/app",
security types under "@/ipc/types/security").
- Updated method signatures to use object params and new return shapes
(e.g., getAppVersion returns { version }).
- Subscribed to ipc.events.misc.onAppOutput in useRunApp to process app
output, restore preview URL updates, and handle HMR after API changes.
- Added missing maxOutputTokens in create/edit custom model dialogs;
small UI and hooks changes to align with new contracts.
- Fixed DeepLinkData typing by re-exporting a discriminated union for
correct type narrowing.
- Migrated custom themes and theme generation to ipc.template.*; added
CustomTheme and theme generation types.
- Moved methods to correct namespaces (e.g., takeScreenshot/restartDyad
→ system; checkProblems → misc).
- Emit chat:stream:end on stream cancellation for consistent renderer
cleanup.

- **Migration**
  - Replace any remaining IpcClient references with ipc.*.
- Update type imports to "@/ipc/types" and adjust for changed/optional
fields (e.g., App lists use ListedApp; Collaborator.permissions and
VercelProject.framework may be optional).
- Verify callers for new parameter objects and result shapes; replace
runApp/restartApp callbacks with ipc.events.misc.onAppOutput
subscriptions.

<sup>Written for commit 7c574fe53296ba5c9a16d6b69d1008d06490534e.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2276">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>