## Summary
- disable `actions/setup-node` package manager caching in release
workflow jobs
- keep release builds on fresh `npm ci` installs to avoid cache-related
release breakage
- #skip-bugbot

## Test plan
- `npm run fmt`
- `npm run lint:fix`
- `npm run ts`
- `npm test`

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2929"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->
Co-authored-by: Will Chen <willchen90@gmail.com>

<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2842"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

closes #2634 
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2717"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Mohamed Aziz Mejri <mohamedazizmejri@Mohameds-Mac-mini.local>

## Summary
- Allow multiple Dyad apps to run simultaneously instead of stopping the
previous app when switching
- Add garbage collection that stops apps idle for 10+ minutes (unless
currently selected)
- Track `lastViewedAt` timestamp on running apps to determine
eligibility for GC
- Clean up all running apps when the Dyad application quits

## Test plan
1. Create two test apps in Dyad
2. Run the first app and verify it starts
3. Switch to the second app - verify the first app keeps running (check
processes)
4. Wait 10+ minutes without viewing the first app - verify it gets
garbage collected
5. Close Dyad completely - verify all running app processes are stopped

Closes #2819

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2825"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Will Chen <willchen90@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>

## Summary
- Check if branch exists locally before attempting to delete it
- If branch only exists on remote, inform user to delete on GitHub
- If branch doesn't exist anywhere, treat as success (already deleted)

## Test plan
- Try deleting a branch that exists locally - should work as before
- Try deleting a branch that only exists on remote - should get helpful
error message
- Try deleting a branch that doesn't exist anywhere - should succeed
silently

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2910"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Will Chen <willchen90@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>

<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2887"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

## Summary
- Added `sendTelemetryException()` utility that sends `$exception`
events to PostHog via the main→renderer telemetry bridge, including
error type, message, and stack trace
- Wired error capture into all three IPC handler factories
(`createTypedHandler`, `createLoggedTypedHandler`,
`createLoggedHandler`) so every `ipcMain.handle` error is automatically
reported with the IPC channel name as context
- Errors are still re-thrown after capture so existing behavior is
unchanged

## Test plan
- All 844 existing tests pass
- Verify in dev that IPC handler errors appear as `$exception` events in
PostHog with `ipc_channel` property
- Confirm telemetry opt-out still prevents exception events from being
sent (via existing `before_send` filter)

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2886"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

## Summary
- Add a new setting to configure the maximum number of tool call steps
for local agent interactions
- Users can choose from Low (25), Default (50), High (100), Very High
(250) options
- The setting is integrated into the settings page with search index
support

## Test plan
- [ ] Verify the setting appears in Settings > Agent Settings
- [ ] Change the value and confirm it persists after app restart
- [ ] Verify the agent respects the configured limit during tool calls
- [ ] Run the new e2e tests to confirm UI interactions work correctly

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2900"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->
Co-authored-by: Will Chen <willchen90@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

## Summary
- trigger the Claude rebase workflow on PR close events
- add a per-PR concurrency group so a close/merge event cancels any
in-progress rebase run
- restrict the rebase job itself to labeled events so closed PRs only
trigger cancellation

## Test plan
- npm run fmt
- npm run lint:fix
- npm run ts
- npm test

#skip-bugbot

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2915"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

## Summary
- Add `hasCheckedReleaseNotes` ref to track whether release notes have
already been checked in the current session
- Prevent the useEffect from running multiple times due to
settings/appVersion dependency changes
- Refactor conditional logic to use early-return pattern for improved
readability

## Test plan
- Open the app and navigate to Home page
- Verify release notes dialog only shows once per session when there are
new release notes
- Confirm no duplicate API calls to `doesReleaseNoteExist`

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2912"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Will Chen <willchen90@gmail.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

should fix #2879.

## Summary
- Add defensive sanitization ensuring tool-call `input` fields are
always valid objects (at minimum `{}`) before messages reach the
Anthropic API
- Prevents LiteLLM from sending empty strings as `tool_use.input` when
converting OpenAI→Anthropic format, which causes `400
invalid_request_error: Input should be a valid dictionary`
- Adds sanitization in two locations: `cleanMessageForOpenAI` (stored
messages) and `maybeCaptureRetryReplayEvent` (stream replay events)

## Context
This is a known LiteLLM bug pattern (issues
[#5063](https://github.com/BerriAI/litellm/issues/5063),
[#15322](https://github.com/BerriAI/litellm/issues/15322),
[#19061](https://github.com/BerriAI/litellm/issues/19061)). When
`function.arguments` is empty or malformed, LiteLLM's `json.loads()`
fails and falls back to passing the raw string as `input`, which
Anthropic rejects.

## Test plan
- [x] Added 3 new unit tests for `cleanMessageForOpenAI` covering empty
string, null, and valid inputs
- [x] All 847 existing tests pass
- [x] Lint, format, and type checks pass

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2890"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Will Chen <willchen90@gmail.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

closes #1804
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2344">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Introduces voice input across chat inputs with transcription via Dyad
Engine and Pro gating.
> 
> - Replaces send row with `LexicalVoiceInputRow` in `ChatInput` and
`HomeChatInput`, adding mic control, waveform (`VoiceWaveform`), and
send/cancel integration
> - New `VoiceInputButton` handles Pro-only disabled state,
recording/transcribing states, and tooltips
> - New hooks `useAudioRecorder` and `useVoiceInput` to record via
`MediaRecorder`, visualize with `AnalyserNode`, and call
`ipc.misc.transcribeAudio`
> - IPC: adds `misc.transcribeAudio` contract, registers
`transcription_handlers` that validate input, support E2E mock, and call
`transcribeWithDyadEngine`
> - Dyad Engine util: adds `transcribeWithDyadEngine` with request-id
attempt tracking and multipart upload to `/audio/transcriptions`
> - E2E tests for voice flow and Pro gating; mocks `getUserMedia` and
asserts transcription append
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7dc1944bf0149a9f88b63a3fdfe0df83e7aa4f9f. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Adds voice input with waveform visualization and transcription for chat,
gated to Dyad Pro users. Improves reliability with fixes for recording
setup leaks, analyser state, and proper audio MIME typing so IPC-backed
Dyad Engine transcription consistently appends text; addresses #1804.

- **New Features**
- Integrated VoiceInputButton and VoiceWaveform via LexicalVoiceInputRow
in ChatInput and HomeChatInput; appends transcribed text to the input.
- Added useAudioRecorder/useVoiceInput hooks to record via
MediaRecorder, visualize with AnalyserNode, and invoke IPC channel
chat:transcribe.
- Pro gating with tooltip and disabled state for non-Pro users;
recording can always be stopped.
- IPC handler validates payloads and calls Dyad Engine via multipart
upload; includes E2E mock support.
- E2E tests mock getUserMedia and verify transcription append and
Pro-only disabled state.

- **Migration**
- Provide a Dyad Pro API key (settings or DYAD_PRO_API_KEY) and enable
Dyad Pro.
  - Ensure microphone permissions are granted.
- Optionally set DYAD_ENGINE_URL; defaults to https://engine.dyad.sh/v1.

<sup>Written for commit fa71433ae270a7276e5466c6c8df359eab1eb03d.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

---------
Co-authored-by: Will Chen <willchen90@gmail.com>

## Summary
- Updated stale aria snapshot for `partial_response.spec.ts` that was
consistently failing
- Button text content now renders actual text (e.g., `file1.txt
file1.txt`, `Edit`, `Undo`, `Retry`) instead of empty strings
- Removed `wrote 1 file(s)` text entries that no longer appear in the UI

## Context
Scanned 5 recent CI runs on main and 13 open PRs by
wwwillchen/wwwillchen-bot/dyadbot. Found flaky tests across 16+ spec
files. Most flakiness is CI-specific (timing/load dependent) and cannot
be reproduced locally with 10x repeats. The `partial_response.spec.ts`
snapshot was the only consistently broken test.

## Test plan
- [x] `partial_response.spec.ts` passes 10/10 times locally with updated
snapshot
- [x] Full E2E suite passes (236/243, with only transient flaky failures
unrelated to this change)

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2907"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

## Summary
- Added dyadbot wherever wwwillchen-bot was allowlisted in CI workflows
and automation policy docs.
- Updated trusted author/bot references in PR workflow selectors and
skill docs to include dyadbot.

## Test plan
- Ran 
> dyad@0.39.0-beta.1 fmt
> npx oxfmt
- Ran 
> dyad@0.39.0-beta.1 lint:fix
> npx oxlint --fix --fix-suggestions --fix-dangerously

Found 0 warnings and 0 errors.
Finished in 18ms on 817 files with 88 rules using 10 threads.
- Ran 
> dyad@0.39.0-beta.1 ts
> npm run ts:main && npm run ts:workers


> dyad@0.39.0-beta.1 ts:main
> npx tsgo -p tsconfig.app.json --noEmit --incremental


> dyad@0.39.0-beta.1 ts:workers
> npx tsc -p workers/tsc/tsconfig.json --noEmit --incremental
- Verified remaining allowlist references for consistency

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2899"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2832"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Made-with: Cursor
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2896"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2712"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Will Chen <willchen90@gmail.com>

## Summary
Adds `princeaden1` to the allowed users list for the PR review responder
workflow (alongside wwwillchen and wwwillchen-bot).

## Test plan
- CI workflow runs on this PR
- No functional changes to application code; workflow change only

Made with [Cursor](https://cursor.com)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2894"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

## Summary
- Reject blank and whitespace-only `delete_file` paths at schema level.
- Add runtime guard to refuse project-root-equivalent delete targets
(like `.`, `./`, `.\\`, or normalized `foo/..`).
- Add unit tests covering root-path rejection and normal file/directory
delete behavior.

## Test plan
- [x] `npm test --
src/pro/main/ipc/handlers/local_agent/tools/delete_file.spec.ts`
- [x] `npm run fmt && npm run lint:fix && npm run ts`


Made with [Cursor](https://cursor.com)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2859"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

## Summary
- Update PR review responder workflow to run on a macOS ARM self-hosted
runner for compatibility with macOS-specific tooling.
- Keep permissions and trigger logic unchanged while replacing runner
label.

## Test plan
- Ran required checks locally: 
> dyad@0.39.0-beta.1 fmt
> npx oxfmt


> dyad@0.39.0-beta.1 lint:fix
> npx oxlint --fix --fix-suggestions --fix-dangerously

Found 0 warnings and 0 errors.
Finished in 32ms on 813 files with 88 rules using 10 threads.

> dyad@0.39.0-beta.1 ts
> npm run ts:main && npm run ts:workers


> dyad@0.39.0-beta.1 ts:main
> npx tsgo -p tsconfig.app.json --noEmit --incremental


> dyad@0.39.0-beta.1 ts:workers
> npx tsc -p workers/tsc/tsconfig.json --noEmit --incremental.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2893"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

## Summary
- Improve compaction prompt/provider option handling in IPC handlers
- Tighten local agent tool option passing and argument defaults
- Align LLM engine provider option generation across related paths

## Test plan
- npm run fmt
- npm run lint:fix
- npm run ts

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2876"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

## Summary
- Update the Claude triage workflow to be more conservative about
changing user-provided issue titles
- Only update titles that are essentially blank or contain no meaningful
information (placeholders, single unhelpful words like "help" or "bug",
just punctuation)
- Key rule: if you can understand what the user is roughly talking about
from the title, leave it alone

## Test plan
- Review the updated workflow conditions to verify they are
appropriately conservative
- Monitor triage behavior on new issues to confirm fewer unnecessary
title edits

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2888"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->
Co-authored-by: Will Chen <willchen90@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

## Summary
- Include `dyadRequestId` in `terminated_stream_retry` telemetry events
for better traceability
- Add new `terminated_stream_retries_exhausted` telemetry event when all
retries are used up (both stream_iteration and response_finalization
phases)
- Bump `MAX_TERMINATED_STREAM_RETRIES` from 2 to 3

## Test plan
- Existing `local_agent_handler` unit tests pass (stream retry tests
verified)
- Verify telemetry events include `dyadRequestId` in retry scenarios
- Verify exhausted event fires when retries exceed the new limit of 3

#skip-bugbot

Made with [Cursor](https://cursor.com)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2877"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

## Summary
- Add `wwwillchen-bot` to `allowed_non_write_users` in
`.github/workflows/claude-pr-review.yml`
- Keep existing `princeaden1` allowlist entry and broaden workflow
access for trusted bot-driven contributions

## Test plan
- npm run fmt
- npm run lint:fix
- npm run ts

#skip-bugbot

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2882"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

## Summary
- Increase MAX_TOOL_CALL_STEPS from 25 to 50 to allow longer multi-step
tasks
- Add step limit detection to track total steps across all passes
- Show a clear `<dyad-step-limit>` message when the limit is reached,
instructing users to send "continue" to resume
- Create DyadStepLimit component for displaying the pause notification

Fixes #2754

## Test plan
- Run the local agent and perform a task that requires many tool calls
- Verify the agent pauses at 50 tool calls instead of 25
- Verify a clear message is shown explaining why it paused and how to
continue
- Type "continue" to verify the agent resumes working

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2828"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Will Chen <willchen90@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

## Summary
- Add a pre-flight check in `gitAdd` to detect if a file is ignored by
`.gitignore` before attempting to stage it
- Skip staging ignored files gracefully with a debug log instead of
throwing an error
- This prevents errors when the AI attempts to stage files like
`.env.local` that should remain untracked

## Test plan
- [ ] Verify that staging a normal file still works correctly
- [ ] Create a `.gitignore` file that ignores a test file (e.g.,
`test.ignored`)
- [ ] Create the ignored file and attempt to stage it
- [ ] Confirm the file is skipped without error and a debug message is
logged

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2707"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Will Chen <willchen90@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>

## Summary
- Fix stale-read race condition in `handleSupabaseOAuthReturn` and
`refreshSupabaseTokenForOrganization` where settings are read before an
async network call, then written back using the stale snapshot —
silently overwriting any concurrent credential writes from other orgs
- Fix legacy `refreshSupabaseToken` to preserve the `organizations` map
by spreading existing supabase settings before writing

## Test plan
- Verify connecting multiple Supabase organizations no longer causes
previously-connected orgs to lose their credentials
- Verify token refresh for one org does not clobber another org's
credentials
- All existing unit tests pass (842/842)

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2821"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

#skip-bb
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2855"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

## Summary
- Updated Supabase prompt to emphasize using the `execute_sql` tool for
database operations
- Changed documentation to clarify that users should not manually create
migration files
- Added warning that migration files in `supabase/migrations/` are
automatically generated

## Test plan
- Review the updated prompt content in `src/prompts/supabase_prompt.ts`
- Verify that the guidance is clear about using execute_sql tool
- Ensure migration file warning is prominent

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2829"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

closes #2804 
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2841"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Handle connection-drop and retry behavior in local agent IPC handling.
Add an end-to-end scenario that verifies recovery after a temporary
local agent disconnect.
Align test fixtures and snapshots for local-agent reconnection behavior.

## Summary
- Bump @ai-sdk/openai dependency in package.json from ^3.0.25 to
^3.0.36.
- Refresh package-lock.json to match the updated resolution.

## Test plan
- npm run fmt
- npm run lint:fix
- npm run ts

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2812"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2789"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Will Chen <willchen90@gmail.com>

#skip-bb
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2811"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

## Summary
- Refactored the TokenBar's percentage and context window display to use
a cleaner flex-based layout
- Added a centered separator dot between percentage and context window
values
- Improved visual alignment with `items-center` and consistent spacing

## Test plan
- Open a chat to view the TokenBar component
- Verify the token percentage and context window display are properly
aligned
- Check that the separator dot appears with correct styling

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2783"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Will Chen <willchen90@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>

## Summary
- Add new skill definition for  under .
- Document required workflow for adding model configurations from
official docs.

## Test plan
- npm run fmt
- npm run lint:fix
- npm run ts

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2786"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2810"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

Fixes #2790 

## Summary
- Return SQL execution output from execute_sql tool instead of
discarding it
- Surface migration write failures alongside SQL execution results
- Preserve existing migration behavior while improving feedback for
callers

## Test plan
- npm run fmt
- npm run lint:fix
- npm run ts

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2797"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

## Summary
- **attach_image.spec.ts**: Fix flaky aria snapshot for
`upload-to-codebase` test by using regex patterns for non-deterministic
button text and removing race-dependent "extra files edited outside of
Dyad" assertion
- **context_compaction.spec.ts**: Replace brittle aria snapshots with
order-independent element assertions since compaction restructures
messages non-deterministically between runs

## Test plan
- [x] `attach_image.spec.ts` passes 30/30 runs with `--repeat-each=30`
- [x] `context_compaction.spec.ts` passes 20/20 runs with
`--repeat-each=10`
- [x] Full test suite (`npm test`) passes (842/842 tests)
- [x] Lint checks pass (`npm run fmt && npm run lint:fix && npm run ts`)

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2793"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

## Summary
- cap `pr-review-responder` auto re-request attempts at 3 retries
- mark PRs with `cc:failed` and `needs-human:review-issue` when retry
limit is reached
- fix strict TypeScript errors in GitHub/local agent handlers so `npm
run ts` passes

## Test plan
- npm run fmt && npm run lint:fix && npm run ts
- npm test

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2798"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Will Chen <willchen90@gmail.com>