## Summary
- Extends the existing `gh pr` shell injection exemption to also cover
`gh issue` commands in the permission hook
- `gh issue create/comment/edit` frequently contain markdown in `--body`
with backticks, pipes, `**bold**`, etc. that were incorrectly flagged as
injection attempts
- Added 50+ test cases covering `gh issue` and `gh pr` commands with
rich markdown body content

## Test plan
- [x] All 977 hook permission tests pass (`python
.claude/hooks/tests/test_gh_permission_hook.py`)
- [x] `npm run fmt && npm run lint:fix && npm run ts` passes
- [x] `npm test` passes (33/33 test files)

#skip-bugbot

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2638"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->


<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Extend the shell injection exemption to gh issue commands to prevent
false positives on markdown in --body (backticks, pipes, bold). Other gh
commands remain protected by injection checks.

- **Bug Fixes**
- Exempted "gh issue ..." (and kept "gh pr ...") from shell injection
checks in the permission hook.
- Added 50+ tests for rich markdown bodies across gh issue and gh pr
commands.
- Moved six gh issue cases from bad_commands to good_commands to match
the exemption.
  - Preserved injection checks for all other gh commands.

<sup>Written for commit e168f9b81384568475cbcb81a92ef19a0963c7a6.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

## Summary
Adds a comprehensive GitHub Actions workflow that automatically responds
to pull requests with AI-powered code reviews and automated fixes. The
workflow handles PR labeling, manages retry logic (up to 3 retries), and
integrates with Claude Code for automated problem resolution.

## Test plan
- Verify the workflow is properly formatted and no syntax errors exist
- Check that the workflow triggers on the correct events
(pull_request_target with labels and workflow_run)
- Verify that only trusted maintainers (wwwillchen, wwwillchen-bot) can
trigger the workflow
- Test the retry logic by checking label transitions (cc:request →
cc:pending → cc:request:N)
- Confirm the workflow creates meaningful git commits through Claude
Code
- Verify proper cleanup of labels when max retries (4 total) are reached

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2641"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Small workflow change, but it affects automation that can push to PR
branches; failure modes are limited to CI/labeling behavior.
> 
> **Overview**
> The `PR Review Responder` workflow now runs an additional Claude Code
step after `/dyad:pr-fix` to push any local commits that may have been
created but not pushed (via a new `/dyad:fast-push` invocation).
> 
> This reduces cases where the workflow would proceed to “check if
commits were pushed” and label transitions without the PR branch
actually being updated.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
27a3059357b5f2511abc39d1a7c3aedccd92b38c. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Adds a GitHub Actions workflow that automatically reviews pull requests,
manages labels/retry logic, and applies fixes via Claude Code. Adds a
fallback step to push any unpushed commits to ensure downstream
workflows run and PR labels update correctly.

<sup>Written for commit 27a3059357b5f2511abc39d1a7c3aedccd92b38c.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

## Summary
Adds a new `/feedback-to-issues` command that converts customer feedback
(usually emails or support tickets) into discrete GitHub issues. The
command:

- Parses feedback to extract concrete, actionable issues
- Searches for existing duplicate issues on GitHub
- Proposes new issues for user approval
- Creates approved issues
- Drafts a professional reply email to the customer

## Features
- **Duplicate detection**: Searches GitHub with multiple keyword
variations
- **User approval workflow**: Shows proposed issues for review before
creating
- **Draft reply email**: Generates a response email acknowledging all
items

This is a useful tool for managing customer feedback and support tickets
at scale.
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2639"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Documentation-only addition of a new Claude command; no
application/runtime code paths change.
> 
> **Overview**
> Adds a new Claude command spec,
`/.claude/commands/dyad/feedback-to-issues.md`, to turn pasted (or
file-based) customer feedback into actionable GitHub issues.
> 
> The workflow explicitly guides parsing feedback into discrete items,
searching `gh issue list` for potential duplicates, presenting *already
filed* vs *proposed* issues for **user approval**, then creating
approved issues via `gh issue create` and drafting a reply email linking
the resulting issues.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
546a1ace575909596613fa3b5863421bbafe1594. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Adds a new /feedback-to-issues command that turns customer emails or
tickets into actionable GitHub issues. It checks for duplicates,
requires approval before creating issues, and drafts a reply email with
links.

- **New Features**
- Parses feedback into discrete issues with clear titles, types, and
priorities.
- Searches GitHub for duplicates using multiple keyword variations (open
and closed).
  - Presents a review report and creates only approved issues via gh.
- Drafts a concise customer reply that references existing and newly
created issues.

<sup>Written for commit 546a1ace575909596613fa3b5863421bbafe1594.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

## Summary
- Update claude-pr-review.yml with latest configuration
- Adjust settings for improved PR review automation

## Changes
- Modified `.github/workflows/claude-pr-review.yml` with updated
configuration

## Test plan
- Workflow configuration has been validated by lint checks
- No breaking changes to existing functionality

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2640"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Workflow-only change that limits job runtime; low risk beyond possibly
timing out unusually long review runs.
> 
> **Overview**
> Adds a 30-minute `timeout-minutes` to the `claude-review` job in
`.github/workflows/claude-pr-review.yml` to prevent the automated PR
review workflow from running indefinitely.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
75736d6b53a2104d2fe2a030dc0101aabc72f6c6. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Set a 30-minute timeout for the Claude PR Review GitHub Actions job to
prevent runaway runs and improve reliability. Added timeout-minutes: 30
to .github/workflows/claude-pr-review.yml; no functional changes to
triggers or permissions.

<sup>Written for commit 75736d6b53a2104d2fe2a030dc0101aabc72f6c6.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

## Summary
- Prefetch user budget on app initialization to ensure budget info is
available immediately on load
- Invalidate user budget query when Dyad Pro API key is saved to reflect
updated subscription status immediately
- Added documentation for React Query prefetch and invalidation patterns
to AGENTS.md

## Test plan
- Verify that user budget data loads on app startup
- Test saving a Dyad Pro API key and confirm the budget information
updates automatically
- Check that the app continues to work correctly without a Dyad Pro
subscription

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2632"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->


<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Prefetches the user budget on app load and invalidates the budget query
after saving a Dyad Pro API key, so subscription status and budget
update instantly. Adds React Query docs for prefetch and invalidation
patterns.

<sup>Written for commit 92b15f29cda8b9b19ba04d281c6e3774ea3928c8.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->
Co-authored-by: Will Chen <willchen90@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

## Summary
- Update language model constants with latest model configurations and
pricing
- Add support for new model versions across multiple providers
- Improve model descriptions and configuration parameters

## Test plan
- Verify that the application loads with all model configurations
- Test model selection in the UI
- Confirm no TypeScript or lint errors

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2633"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Primarily updates configuration/constants for model selection; main
behavioral change is the expanded free-model name matching which could
alter which OpenRouter models are used in fallback.
> 
> **Overview**
> Adds the new Anthropic model `claude-opus-4-6` (with updated token
limits/pricing metadata) to the selectable model options.
> 
> Refreshes OpenRouter model options by introducing a generic
`openrouter/free` entry, adding `z-ai/glm-5`, tweaking `glm-4.7`
description, and removing older explicit free-model entries and
`moonshotai/kimi-k2-0905`. Updates `FREE_OPENROUTER_MODEL_NAMES` to
treat both `:free` and `/free` model names as free, which changes which
models can be selected in the auto free fallback.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
d192033357d87355a9d414269a19a348c3faef6d. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Updated language model constants with the latest configs and pricing to
keep model selection current. Adds new models and improves free model
detection for OpenRouter.

- **New Features**
  - Added Claude Opus 4.6 (1M context, 32k max output).
- Added OpenRouter “free” model and Z‑AI GLM 5; updated GLM 4.7
description.
- Updated context windows, temperatures, and pricing; removed deprecated
free entries and Kimi K2 0905.

- **Bug Fixes**
- Free model detection now supports names ending with “/free” (not just
“:free”).

<sup>Written for commit d192033357d87355a9d414269a19a348c3faef6d.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

#skip-bb
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2628"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Improved the local agent system prompt for clarity, safety, and
consistency across Pro/Basic/Ask modes. Added prompt snapshot tests and
stabilized Playwright snapshots by masking system messages in both input
and message dumps.

- **Refactors**
- Shared COMMON_GUIDELINES across all modes; strengthened security
guidance; added concise-explanations and Help-button guidance.
- Added Vitest snapshot tests for agent/basic/ask prompts and the e2e:p3
script (parallelism=3, retries=1).

- **Bug Fixes**
- Masked system messages in body.input and body.messages for all dump
types to make Playwright snapshots deterministic; updated affected
snapshots.

<sup>Written for commit 162030ad2a8c1db3e3905b7d6ac30b518d05dbda.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

- Extract shared helpers (formatSettingsLines, formatSystemInfoSection,
openGitHubIssue) to eliminate duplication between Report a Bug and
Upload Chat Session flows
- Extract reusable components (AnimatedScreen, ReviewDetailsSection,
CopyButton) for modularity
- Add smooth slide animations between dialog screens using
framer-motion, with no animation on initial open
- Collapse all review screen sections into accordions
- Redesign upload complete screen: inline checkmark, animated copy
button, Create GitHub Issue button above warning banner
- Include error logs and system info in Upload Chat Session's GitHub
issue (previously only in Report a Bug)
- Add visual hierarchy to main screen: bordered cards for each report
option, labeled divider separating self-help from issue reporting
- Show clear "Open a chat first" warning when no chat is selected
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2629"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Primarily UI/UX refactoring and animation changes, plus expanded
GitHub issue prefill content; low risk but could affect
support/reporting flow behavior if screen navigation or issue URL
construction regresses.
> 
> **Overview**
> Refactors `HelpDialog` into a 3-screen flow (`main` → `review` →
`upload-complete`) with slide transitions via `framer-motion`, including
reusable subcomponents (`AnimatedScreen`, `ReviewDetailsSection`,
`CopyButton`) and a navigation helper.
> 
> Unifies GitHub issue creation for both bug reports and session uploads
with shared formatting helpers and `openGitHubIssue`, and **expands
session-upload issues to include system info, settings, and recent
logs** (plus a `v2:` session ID prefix). Updates the main screen layout
into clearer “self-help” vs “report an issue” sections with card styling
and a disabled-state warning when no chat is selected, and makes review
sections collapsible plus redesigns the upload-complete screen with an
animated copy affordance and a clearer call-to-action to create the
GitHub issue.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
a3b76962ec8796ce1a081dcfb8447d5da4d2e15b. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: Cursor <cursoragent@cursor.com>

<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2619"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Introduces new cross-cutting chat navigation UI and new tab-state
atoms that affect chat selection/creation/deletion flows; risk is mainly
UX/state regressions and e2e flakiness rather than security.
> 
> **Overview**
> **Adds browser-like chat tabs in the title bar.** Introduces
`ChatTabs` with draggable visible tabs, an overflow menu, per-tab close
(incl. middle-click), streaming-in-progress indicator, and “new
activity” dot, plus i18n strings for accessible labels.
> 
> **Persists and coordinates tab state across navigation.** Adds
`recentViewedChatIds`/`closedChatIds` atoms and helpers to keep MRU
ordering, prevent explicitly closed tabs from reappearing, prune stale
IDs, and choose an adjacent fallback chat when closing the active tab
(navigating home if none).
> 
> **Updates chat creation/selection flows and tests.** Refactors
`useSelectChat` to optionally preserve tab order; updates
Home/CreateApp/ChatHeader/ChatList to use it and invalidate chat queries
so new chats appear in tabs immediately; adds stable `new-chat-button`
test IDs, new unit tests for tab helpers/atoms, and new Playwright e2e
coverage for tab render/switch/close behavior.
> 
> **Build tooling/doc tweaks.** Bumps Node engine requirement to `>=24`
and updates `rules/git-workflow.md` guidance for engine conflict
resolution and stash handling.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
982cef98ff0d3c1552097a91f59196fd07d47602. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Adds browser-like tabs to the chat title bar for fast multi-chat
navigation. Refines tab behavior, accessibility, and creation/deletion
flows so tabs stay accurate, responsive, and preserve tab order.

- **New Features**
- ChatTabs in TitleBar: MRU ordering; drag-to-reorder (visible tabs);
overflow dropdown with live count; streaming spinner; post-stream
notification dot; middle-click close; WCAG 24x24 close targets;
tooltips; accessible labels and focus-visible rings; i18n labels for
“Chat in progress” and “New activity” (en, pt-BR, zh-CN); unit + e2e
tests (incl. closed-tab state).
- Persistent tab state via Jotai: recentViewedChatIds (cap 100) and
closedChatIds so explicitly closed tabs don’t reappear;
ensureRecentViewedChatId to keep tab order on route changes; Node engine
bumped to >=24.

- **Bug Fixes**
- Close/selection: adjacent-tab fallback; closing the last tab navigates
home; selecting a closed tab re-opens it; clear notifications on close;
guard unknown/stale IDs; resolve selection loop; prune stale closed IDs;
deleting the selected chat also navigates home.
- Flows/accessibility: new-chat in ChatHeader uses correct
invalidate/select order so tabs render immediately; route changes use
ensureRecentViewedChatId to preserve order; overflow ARIA label uses
actual overflow count; ResizeObserver attaches with async loads; title
truncation respects max length; stable e2e selectors via
new-chat-button; fixed CI npm sync via encoding; updated git workflow
docs on stash review and engine conflicts; internal refactor with
removeFromClosedSet helper to reduce duplication.

<sup>Written for commit 982cef98ff0d3c1552097a91f59196fd07d47602.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>

## Summary
- Replaces the old `ChatLogsDataSchema` with a new
`SessionDebugBundleSchema` (schema version 1) that captures all
non-sensitive data needed for debugging chat sessions
- Each message now includes AI SDK JSON (with base64 images stripped),
model name, token usage, timestamps, commit hashes, request ID, and
approval state
- Adds non-sensitive user settings snapshot, app metadata, custom
provider/model definitions, and MCP server configurations to the debug
bundle
- Updates HelpDialog to use the new schema and adds `Session Schema:
v2.0` marker to GitHub issue templates

## Test plan
- [ ] Verify `npm run ts` passes (type-check)
- [ ] Verify `npm run lint` passes
- [ ] Verify `npm test` passes (all 661 unit tests)
- [ ] Manual: Open Help dialog → Upload Chat Session → verify the review
modal shows messages, codebase, logs, and system info correctly
- [ ] Manual: Complete upload and verify the GitHub issue template
includes `Session Schema: v2.0`
- [ ] Manual: Download uploaded JSON and verify it contains:
`schemaVersion`, `system`, `settings`, `app`, `chat` (with
`aiMessagesJson` per message), `providers`, `mcpServers`, `codebase`,
`logs`
- [ ] Manual: Verify no API keys, OAuth tokens, or MCP env vars appear
in uploaded data

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2488">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Expands what gets captured and uploaded for support sessions
(settings/app metadata/providers/MCP and richer message data), so any
sanitization or schema mismatch could leak data or break the support
upload flow.
> 
> **Overview**
> Switches chat-session uploads from `ChatLogsData` to a new versioned
`SessionDebugBundle` (`SESSION_DEBUG_SCHEMA_VERSION = 2`) and updates
the IPC contract/exports accordingly.
> 
> The main-process handler now assembles a comprehensive bundle
(system/runtime info, sanitized settings snapshot, app metadata, full
chat messages with stripped image/file blobs, custom provider/model
summaries, MCP server configs without env/header secrets, codebase
snapshot, and last ~1000 log lines), and `HelpDialog` is updated to
fetch/review/upload this bundle and annotate created GitHub issues with
`Session Schema: v2.0` (plus adds a settings section to the bug report
template).
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7b94199939aa6963787e8fe69716e20cd6570b7d. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

## Summary
- Move the Plan mode option outside the `isProEnabled` conditional so
it's accessible to all users
- Agent v2 remains Pro-only
- Plan mode allows users to design and plan before building, which is
valuable for all users

## Test plan
- [ ] Verify Plan mode appears in the chat mode selector for non-Pro
users
- [ ] Verify Agent v2 only appears for Pro users
- [ ] Verify both modes work correctly when selected

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2625"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Made Plan mode available to all users in the chat mode selector, and
allowed plan-only flows to run without Pro while Agent v2 remains
Pro-only.
Exiting Plan now requires explicit user confirmation before switching to
implementation.

<sup>Written for commit 7c2749bfbffca819792f962b99c5c4e13aba7c99.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

---------
Co-authored-by: Will Chen <willchen90@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

## Summary
- Two mid-turn compaction tests in `local_agent_handler.test.ts` were
failing because mock messages lacked `createdAt` fields
- `buildChatMessageHistory` and `getMidTurnCompactionSummaryIds` call
`createdAt.getTime()` to detect mid-turn compaction summaries, causing a
silent TypeError inside the async generator
- Added `createdAt` timestamps to all mock messages and compaction
summary messages in both tests

## Test plan
- [x] `npm test` passes (786/786 tests)
- [x] Both previously-failing mid-turn compaction tests now pass
- [x] Lint, formatting, and type checks all pass

#skip-bugbot

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2624"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->


<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Fix failing mid-turn compaction tests by adding createdAt timestamps to
mocked chat and summary messages. This prevents a silent TypeError in
the async generator and restores test reliability.

- **Bug Fixes**
- Added createdAt to all test messages (including compaction summaries)
so buildChatMessageHistory and getMidTurnCompactionSummaryIds can safely
call createdAt.getTime().
- Documented the createdAt requirement for compaction tests in
AGENTS.md.

<sup>Written for commit c8f0acb09058c5e3313f1423c585857ea61416f4.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2524"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Changes local-agent streaming/history rebuilding and compaction
timing/persistence, which can impact message ordering, UI rendering, and
tool-loop continuity if edge cases are missed.
> 
> **Overview**
> **Enables mid-turn context compaction in local-agent mode** by
triggering compaction between AI SDK steps (when token usage crosses the
threshold and the step included tool calls) so the agent can finish the
same user turn.
> 
> Updates `handleLocalAgentStream` to rebuild message history after
compaction while preserving in-flight tool-loop messages, inline the
compaction indicator into the active assistant response, hide
newly-inserted compaction-summary DB rows from streamed message lists,
and persist only the post-compaction `aiMessagesJson` slice. Also
hardens compaction output by XML-escaping the stored summary, adds
`createdAtStrategy` handling for compaction insertion timing, and
includes new unit/E2E coverage (fixture + snapshots) plus expanded git
workflow documentation.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
ac3ccb6e1221012141954ba6560ef2426bf07253. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Enables mid-turn context compaction in local-agent tool loops so the
agent can finish the same user turn. Improves history rebuilding, inline
compaction messaging, streaming behavior, scheduling, and safe
persistence.

- **New Features**
- Triggers mid-turn compaction when per-step tokens cross the threshold
and tool calls exist; schedules in onStepFinish and applies before the
next step.
- Centralizes history via buildChatMessageHistory, preserving in-flight
assistant/tool messages, hiding mid-turn compaction DB rows from
streaming, and placing the summary after the triggering user.
- Streams a compaction preview over current content and inlines the
final compaction summary into the current assistant turn; selects
createdAtStrategy ("now" mid-turn, "before-latest-user" pre-turn) with a
1-second margin to keep turn order.
- Persists only post-compaction AI messages when compaction happens
mid-turn, slicing correctly with 0-indexed stepNumber.

- **Bug Fixes**
- Escapes compaction summary in both the live preview and the persisted
DB message to prevent XSS.
- Re-queries chat only on successful compaction and filters hidden
compaction summaries out of streaming payloads.
- Clears injected messages after mid-turn compaction to avoid stale
insertion indices; prevents repeat attempts and skips further compaction
checks in the same turn after success.
- Always runs checkAndMarkForCompaction in onStepFinish to mark
next-turn compaction when appropriate.

<sup>Written for commit ac3ccb6e1221012141954ba6560ef2426bf07253.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>

## Summary
- Add safe pattern for `$(gh ...)` subcommands in the shell injection
checker, allowing common patterns like dynamically constructing API
endpoint URLs using `gh repo view` output
- The inner content must not contain shell metacharacters to prevent
nested injection
- Add two new test cases to `good_commands.txt` covering `$(gh repo view
...)` and `REPO=$(gh repo view ...) &&` patterns

## Test plan
- [x] All 923 hook permission tests pass (516 good + 407 bad)
- [x] Unit tests pass (31 test files)
- [x] Lint/format/type checks pass

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2622"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Touches shell-injection detection logic in a security gate; a
too-permissive regex could allow malicious command substitution, though
it is constrained to read-only subcommands and covered by new tests.
> 
> **Overview**
> **Permission hook now permits a constrained form of `$(gh ...)`
substitution.** `gh-permission-hook.py` adds
`SAFE_GH_SUBCOMMAND_PATTERN` and neutralizes matching read-only `$(gh
…)` subcommands before running shell-metacharacter checks, enabling
dynamic `gh api` paths built from `gh repo view`/similar.
> 
> **Tests updated to validate both sides.** `good_commands.txt` adds
allowed examples using `$(gh repo view …)` (including a var-assignment
pattern that remains passthrough), and `bad_commands.txt` adds cases
ensuring destructive subcommands inside `$(...)` are still blocked.
`package-lock.json` also changes peer metadata for multiple dependencies
(lockfile-only churn).
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
8bcb142513e4dfab4689e0160d581f44f7b24e95. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Enabled safe $(gh ...) command substitution in the permission hook for
dynamic GitHub API paths, limited to read-only gh subcommands. Tightened
validation to block nested injection and newline/CR bypass.

- **New Features**
- Treat $(gh ...) as safe when the inner command has no shell
metacharacters and uses an allowed read-only subcommand
(repo/pr/issue/run/release/gist view, search, status, auth status,
config get/list), and neutralize it before checks.
- Added two good-command tests for gh api with $(gh repo view ...) and
REPO=$(gh repo view ...) && patterns.

- **Bug Fixes**
- Fixed regex to prevent newline/CR bypass by using [ \t] and excluding
\n\r in the inner content.
- Added five bad-command tests to ensure destructive subcommands inside
$(...) are blocked.

<sup>Written for commit 8bcb142513e4dfab4689e0160d581f44f7b24e95.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>

## Summary
- Add support for showing line number ranges (e.g., ":L3-L5") in the
Read file display
- Pass `start_line` and `end_line` attributes from the markdown parser
to the DyadRead component
- Display line number suffix in the file path to provide better context
when viewing partial file reads

## Test plan
- [x] Verify line numbers appear correctly when a file read includes
start/end lines
- [x] Verify files read without line numbers display normally
- [x] All tests pass

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2615"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->


<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Show line numbers in the Read file path for partial file reads. Start
and end lines are parsed from markdown and rendered as a :L suffix
(e.g., :L3-L5) for clearer context.

- **New Features**
- Parse start_line and end_line in DyadMarkdownParser and pass to
DyadRead.
- DyadRead builds and displays line suffix (:L3, :L3-L5, or :L1-L5) next
to the filename; tooltip shows full path with suffix.
  - Files without line numbers render unchanged.

<sup>Written for commit 301bd200f245d934974c8d09ab0edf6ae42d7e9c.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->
Co-authored-by: Will Chen <willchen90@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

## Summary
- Switch `claude-pr-review` workflow from `multi-pr-review` to
`swarm-pr-review` skill
- Add warnings in both skill SKILL.md files to save intermediate files
to the working directory (`./pr_diff.patch`) instead of `/tmp/`, which
is blocked by `claude-code-action` security sandboxing in CI
- Document the CI file access restriction in `rules/git-workflow.md`

Fixes the `cat in '/tmp/pr_*_diff.patch' was blocked` error:
https://github.com/dyad-sh/dyad/actions/runs/21896099089?pr=2524

#skip-bugbot

## Test plan
- [ ] Verify PR review workflow triggers on a new PR and doesn't hit the
`/tmp/` file access error
- [ ] Confirm the swarm-pr-review skill posts a review summary comment

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2623"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->


<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Switched the CI PR review workflow to use swarm-pr-review and fixed the
/tmp file access block in claude-code-action. Updated skill docs and git
workflow rules to save PR diffs in the repo working directory (e.g.,
./pr_diff.patch) instead of /tmp, resolving the “cat in
'/tmp/pr_*_diff.patch' was blocked” error.

<sup>Written for commit 449c7b02b4bacad12a659177d1f6a4db949fc7ab.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

## Summary
- Adds `pull_request: types: [labeled]` trigger to
`pr-review-responder.yml` so that adding the `cc:request:now` label
immediately runs the pr-fix flow without waiting for CI to complete
- Refactors the script to handle both `pull_request` and `workflow_run`
event types, extracting `head_repo`, `head_branch`, and `ci_conclusion`
as shared step outputs
- Gates the `needs-human` labeler steps on `ci_conclusion` availability
(only from `workflow_run` events) since CI status is unknown for
immediate triggers

## Test plan
- [ ] Add `cc:request:now` label to a test PR and verify the workflow
triggers immediately
- [ ] Verify existing `cc:request` / `cc:request:N` labels still work
via the `workflow_run` path
- [ ] Verify the retry loop works: if Claude pushes commits from a
`cc:request:now` trigger, confirm it sets `cc:request:1` and subsequent
retries go through the normal CI-waiting flow
- [ ] Verify the job-level `if` filter prevents unnecessary runs for
unrelated label additions

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2618"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Adds a new `pull_request_target` label-triggered path to a
high-permission workflow; while gated by allowed actors and PR author,
mistakes here could expand when privileged automation runs or what code
gets checked out/pushed.
> 
> **Overview**
> **Adds an immediate trigger for PR fix loops.**
`pr-review-responder.yml` now runs not only after `CI` completes, but
also when a trusted actor applies the `cc:request:now` label, so the
automation can start without waiting for CI.
> 
> **Refactors the workflow to support both event types safely.** The
PR-info step now branches on event type to derive `pr_number`,
`head_repo`, `head_branch`, and (only for `workflow_run`)
`ci_conclusion`, uses these outputs for checkout and retry detection,
and skips the needs-human labeler steps when CI conclusion is
unavailable.
> 
> **Docs/process updates.** Updates the workflows README to document the
new trigger and removes outdated guidance about auto-adding `cc:request`
from the `pr-push` command; adds a small rebase-conflict tip for
documentation table merges.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7fa3a013b815dda47ab643fd9b23f51f6feac59b. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Enable immediate PR review runs via the cc:request:now label, using
pull_request_target with strict labeler and author gating. The existing
cc:request/cc:request:N CI-driven flow stays the same.

- **New Features**
- Trigger pr-review-responder on pull_request_target labeled when the
label is cc:request:now.
- Guarded start with a job-level filter; only labels applied by
wwwillchen, wwwillchen-bot, azizmejri1, or princeaden1 are allowed, and
only PRs authored by wwwillchen/wwwillchen-bot are eligible.

- **Refactors**
- Support both pull_request_target and workflow_run; expose pr_number,
head_repo, head_branch, and ci_conclusion as shared outputs and use them
for checkout/status.
- Gate needs-human labeling on ci_conclusion (workflow_run only);
cc:request:now skips it. Add null checks for head_repository and exclude
cc:request:now in workflow_run label checks to avoid race conditions.
- Docs: update workflow trigger README, remove outdated label
instructions in .claude/commands/dyad/pr-push.md, and add rebase
guidance to keep both additions in README tables.

<sup>Written for commit 7fa3a013b815dda47ab643fd9b23f51f6feac59b.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Adds a scheduled GitHub Actions workflow that safely frees disk space on
self-hosted macOS runner `ci1` at 4:00 AM PST to prevent CI from running
out of space.

## Changes
- **New workflow** `.github/workflows/nightly-runner-cleanup.yml`: Runs
daily at 4 AM PST; only executes on runner `ci1`
- **Extended cleanup script** `scripts/ci-cleanup-macos.sh`:
`CI_NIGHTLY_CLEANUP=1` enables host-level cleanup:
  - `~/Library/Caches` subdirs (Homebrew, Xcode, LLVM)
  - npm cache
  - Runner `_work` dirs older than 2 days
- **Documentation** in workflows README with validation steps

## Safety
- Only allowlisted paths are deleted
- Never removes runner binaries, config, or user data
- Manual run via `workflow_dispatch` for testing

Made with [Cursor](https://cursor.com)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2620"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Primarily CI automation changes, but it introduces scheduled `rm -rf`
cleanup on a self-hosted runner; an allowlist/guard is present, yet
mistakes could still delete useful caches or workspaces and disrupt
builds.
> 
> **Overview**
> Adds a scheduled `Nightly Runner Cleanup` GitHub Actions workflow that
runs daily (and via `workflow_dispatch`) on self-hosted macOS runners,
guarded to execute only when `RUNNER_NAME` is `ci1`.
> 
> Extends `scripts/ci-cleanup-macos.sh` with a `CI_NIGHTLY_CLEANUP=1`
mode that additionally purges allowlisted `~/Library/Caches`
subdirectories and removes stale runner `actions-runner/_work`
directories older than 2 days, and updates the workflows README with the
new workflow and manual validation steps.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
0b108a8a7969060614311f54cd694f0454a6839b. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Adds a nightly GitHub Actions workflow to free disk on self-hosted macOS
runner ci1 at 4:00 AM PST. Extends the cleanup script with a guarded
nightly mode to remove allowlisted caches and stale work dirs so CI
doesn’t run out of space.

- **New Features**
- Added nightly-runner-cleanup.yml: runs daily at 4 AM PST; only
executes on runner ci1; supports manual workflow_dispatch.
- Updated scripts/ci-cleanup-macos.sh: CI_NIGHTLY_CLEANUP=1 cleans
Library/Caches subdirs (Homebrew, Xcode, org.llvm.clang*), npm cache,
Playwright browsers, and runner _work dirs older than 2 days; prints
mode and disk before/after.
  - Updated README with manual validation steps.

<sup>Written for commit 0b108a8a7969060614311f54cd694f0454a6839b.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com>

## Summary
- Add .npmrc configuration file for npm package manager settings
- Update package.json to specify npm version constraint (11.8.0)
- Update CI/CD workflow files for npm compatibility
- Add fast-push command documentation

## Test plan
- Verify npm builds correctly with the new .npmrc configuration
- Check CI workflows execute successfully with updated configuration
- Ensure package.json constraints are properly honored

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2621"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Mostly tooling and workflow changes; primary risk is CI/build failures
if npm 11.8.0 or strict engine checks conflict with some environments.
> 
> **Overview**
> **Standardizes npm version/engine enforcement.** Adds `.npmrc` with
`engine-strict=true` and updates `package.json`/`package-lock.json`
`engines` to require `npm` `11.8.0`.
> 
> **Updates automation to match.** CI, release, and deflake workflows
now install `npm@11.8.0` before running `npm ci`, and a new `.claude`
command (`fast-push`) documents an autonomous commit/lint/amend/push/PR
flow.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
391bd1deb4c07dae590444cdda77cfc2cb85482a. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Standardizes on npm 11.8.0 across local dev and CI to ensure consistent
installs/builds, and adds documentation for the dyad fast-push command.

- **Dependencies**
  - Add .npmrc with engine-strict=true
  - Set engines.npm to 11.8.0 in package.json
  - CI workflows install npm@11.8.0 before npm ci

- **Migration**
  - Upgrade local npm: npm install -g npm@11.8.0
  - Reinstall deps with Node >= 20: npm ci

<sup>Written for commit 391bd1deb4c07dae590444cdda77cfc2cb85482a.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

## Summary
- Adds `scripts/ci-cleanup-macos.sh` that cleans up build outputs, test
artifacts, old Playwright browsers, npm cache, and stale runner
diagnostic logs after each CI job
- Integrates the cleanup as an `if: always()` post-job step in `ci.yml`
(build + e2e-tests jobs) and `claude-deflake-e2e.yml`
- Prevents disk space exhaustion on Mac Mini self-hosted runners (see
[failed
job](https://github.com/dyad-sh/dyad/actions/runs/21882508263/job/63168659300))

## Test plan
- [ ] Verify cleanup step runs on self-hosted macOS runners after build
job
- [ ] Verify cleanup step runs on self-hosted macOS runners after
e2e-tests job
- [ ] Verify cleanup step runs after deflake workflow
- [ ] Verify cleanup is skipped on GitHub-hosted runners (guarded by
`contains(matrix.os.image, 'self-hosted')`)
- [ ] Verify the script is idempotent (safe to run when artifacts don't
exist)

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2617"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Adds a macOS CI cleanup script that runs after each job on self-hosted
Mac Minis to free disk space and prevent failures from exhaustion.

- **New Features**
- Added scripts/ci-cleanup-macos.sh to remove build outputs, test
artifacts, old Playwright browsers (keeps current via chromium revision
from browsers.json), npm cache/logs (rm -rf _cacache), and runner
diagnostics older than 7 days; safe to run multiple times with a
corrected Node check.
- Integrated as an if: always() post-job step in ci.yml (build and
e2e-tests, guarded to self-hosted) and claude-deflake-e2e.yml.

<sup>Written for commit 756485ea0c30b9ba26800c168f182b3688bef6cc.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Low risk CI-only change; main risk is over-aggressive cleanup
(caches/artifacts) causing longer reruns or unexpected deletions on
self-hosted runners.
> 
> **Overview**
> Adds a new `scripts/ci-cleanup-macos.sh` post-job script to reclaim
disk space on self-hosted macOS runners by deleting workspace build/test
artifacts, pruning old Playwright browser installs, clearing npm
cache/logs, and removing stale runner diagnostic logs.
> 
> Integrates the cleanup as an `if: always()` step after `build` and
`e2e-tests` in `ci.yml` (guarded to self-hosted macOS) and after the
deflake job in `claude-deflake-e2e.yml`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
756485ea0c30b9ba26800c168f182b3688bef6cc. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

#skip-bb
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2616"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

## Summary
- Pass `fakeLlmPort` through `preLaunchHook` so each parallel worker
uses its own fake LLM server instance
- Dynamically generate webServer configs in `playwright.config.ts` based
on parallelism setting
- Allow fake-llm-server to accept port via command line argument
(`--port=XXXX`)

This ensures parallel Playwright tests don't conflict when accessing the
fake LLM server.

## Test plan
- [x] Lint checks pass
- [x] All 784 unit tests pass
- [ ] Run E2E tests in parallel to verify no port conflicts

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2557"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Fixes parallel E2E conflicts by running a dedicated fake LLM server per
Playwright worker and passing its port through preLaunchHook, env vars,
and app/test URLs so all requests hit the worker’s server.

- **Bug Fixes**
- Compute per-worker fakeLlmPort (FAKE_LLM_BASE_PORT + parallelIndex),
expose via preLaunchHook, set FAKE_LLM_PORT, and pass into PageObject,
Settings, GitHubConnector; Azure tests use it for TEST_AZURE_BASE_URL.
- Use worker-scoped URLs for Azure, GitHub test APIs, Ollama, LM Studio,
Engine, Gateway, and OpenAI provider; Electron GitHub/Vercel handlers
read FAKE_LLM_PORT instead of hardcoded 3500.
- Generate one webServer per worker with build+start to avoid startup
races; health checks target each worker; reuse servers locally; extract
FAKE_LLM_BASE_PORT to e2e-tests/helpers/test-ports.ts.
- fake-llm-server accepts --port or PORT with NaN validation; docs
updated with parallel port isolation and rebase workflow notes.

<sup>Written for commit 407923e90ddc9cf4d9ec98ccc56849154d2ad932.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

---------
Co-authored-by: Will Chen <willchen90@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>

#skip-bb

## Summary
- Improve picker button wait reliability in logs_server.spec.ts using
toPass() with visibility and enabled checks
- Update local_agent_read_logs snapshot to use regex for dynamic log
count matching

## Test plan
- Run the affected E2E tests: `npx playwright test logs_server.spec.ts
local_agent_read_logs.spec.ts`
- Tests should pass consistently without timing-related flakiness

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2613"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->


<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Improve logs_server E2E stability and update a snapshot to handle
dynamic log counts. We now poll with toPass until the picker button is
visible and enabled, and the snapshot uses a regex (/LOGS Reading \d+
logs/) instead of a fixed count.

<sup>Written for commit 1810af01aee8f1862c36ded946adda4a60436b97.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->
Co-authored-by: Will Chen <willchen90@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

## Summary
- The `/dyad:pr-fix` skill was missing a push step, so Claude would fix
review comments and CI issues but never commit/push the changes back to
the PR branch
- Added `/dyad:pr-push` as an explicit step 3 in the skill (between fix
steps and summary comment)
- Simplified the workflow prompt in `pr-review-responder.yml` since the
skill itself now handles the push

## Test plan
- [ ] Trigger the PR Review Responder workflow on a PR with `cc:request`
label and verify that changes are actually pushed

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2612"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Documentation/prompt-orchestration changes only; risk is limited to
altering the automation flow if the new required `/dyad:pr-push` step
behaves unexpectedly.
> 
> **Overview**
> Updates the `/dyad:pr-fix` orchestration to **explicitly run
`/dyad:pr-push` as a required step** before posting the final PR summary
comment, ensuring fixes are actually committed and pushed back to the PR
branch.
> 
> Simplifies the `pr-review-responder.yml` Claude prompt by removing
redundant detailed rules and relying on the updated skill to execute
end-to-end without skipping the push.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
542b65bac4120de76a8759ce3cf3e2e021e4fb98. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Add a required /dyad:pr-push step to the /dyad:pr-fix skill so fixes are
committed and pushed to the PR branch. Simplifies the
pr-review-responder workflow now that pushing is handled by the skill.

- **Bug Fixes**
- Added /dyad:pr-push as step 3 in pr-fix to commit, run lint/tests, and
push to GitHub.
- Simplified pr-review-responder.yml prompt to run pr-fix end-to-end
without manual push checks.

<sup>Written for commit 542b65bac4120de76a8759ce3cf3e2e021e4fb98.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

## Summary
- Update selectors for renamed UI elements ("Max Chat Turns in Context",
"Build" mode, "Add Environment Variable" button)
- Fix copy_app test to use more specific dialog and heading selectors
for robustness
- Refactor edit_code tests to use keyboard interactions instead of
fill() for Monaco editor
- Update problem button text patterns to match new "Fix N problem(s)"
format
- Update related test snapshots

## Test plan
- [ ] Run `npm test` to verify all unit tests pass
- [ ] Run E2E tests to verify the updated selectors work correctly
- [ ] Verify the modified tests match the current UI state

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2611"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->


<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Updates E2E tests to match renamed UI labels and make Monaco editor
edits reliable, reducing flakiness and keeping snapshots in sync.
Improves selectors and expectations across affected specs.

- **Bug Fixes**
- Update selectors for renamed labels: “Max Chat Turns in Context”,
“Build”, “Add Environment Variable”.
  - Match new “Fix N problem(s)” button text.
  - Use scoped dialog and heading selectors in copy_app.
  - Refresh snapshots to reflect current UI.

- **Refactors**
- Switch Monaco editor edits to keyboard interactions instead of fill().
  - Add auto-approve setup in edit_code tests for stability.

<sup>Written for commit 0f1e771f52850e3a6b89286d22ade5a4ff6db606.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->
Co-authored-by: Will Chen <willchen90@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

## Summary
- Replaced `deflake-e2e-recent-prs` command with
`deflake-e2e-recent-commits` that scans CI workflow runs on main instead
of PR comments
- Downloads the `html-report` artifact (`results.json`) from each CI run
to extract flaky test data, which works for push events that don't post
PR comments
- Updated `claude-deflake-e2e.yml` workflow to use the new command

## Test plan
- [ ] Trigger the `Claude Deflake E2E` workflow manually and verify it
correctly scans recent main branch CI runs
- [ ] Verify flaky tests are correctly parsed from `results.json`
artifacts

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2607"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Low risk doc/workflow tweak that changes how the deflake automation
sources flaky tests (GitHub Actions runs/artifacts) but does not touch
production code or test logic.
> 
> **Overview**
> Updates the deflake automation to **scan recent `main` CI workflow
runs** (push events) instead of PR Playwright summary comments, by
downloading each run’s `html-report` artifact and parsing `results.json`
to detect retry-passed tests with prior failures/timeouts.
> 
> Adjusts the scheduled `Claude Deflake E2E` workflow to accept
`commit_count`, grant `actions: read`, and invoke
`/dyad:deflake-e2e-recent-commits` rather than the old PR-based command.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
0da1e67da43e509577d5b8dc1f155779742d1529. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Switched the deflake command to scan recent main CI runs and parse
html-report results.json to find flaky E2E tests. Updated the Claude
Deflake E2E workflow to use commit_count and added actions: read
permission.

- **Refactors**
- List completed main push runs via gh api, fetch 3x commit_count, and
filter to success/failure.
- Download non-expired html-report artifacts; parse results.json with a
Node.js script to detect flakes (final passed after
fail/timedOut/interrupted).
- Build "<spec_path.spec.ts> > Suite > Test" titles; group and rank by
frequency; clean up artifacts.
  - Skip runs without artifacts; note 3-day artifact retention.

- **Bug Fixes**
  - Updated command doc to reference the TodoWrite tool.

<sup>Written for commit 0da1e67da43e509577d5b8dc1f155779742d1529.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

## Summary
- Update CI workflow to use 2 E2E test shards instead of 1 for
self-hosted Mac mini runners (privileged authors)
- This improves E2E test parallelism on self-hosted infrastructure

## Test plan
- CI should run with 2 shards on self-hosted runners for privileged
authors
- Non-privileged authors still get 4 shards on GitHub-hosted runners
(unchanged)

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2606"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->


<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Run E2E tests in 2 shards on self-hosted Mac mini (macOS ARM64) runners
for privileged authors to improve parallelism and speed up CI.
Non-privileged authors remain on GitHub-hosted runners with 4 shards;
other CI settings are unchanged.

<sup>Written for commit 972f36eb853a620a3f08ac2089d725768177beb7.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Low risk workflow-only change; main impact is CI execution behavior
(more parallel shards) and potential shard/merge configuration issues if
assumptions about 1 shard were relied on.
> 
> **Overview**
> In `.github/workflows/ci.yml`, increases **self-hosted
privileged-author** Playwright E2E parallelism by changing the matrix
from `1/1` to `2` shards (`e2e_shard=[1,2]`, `e2e_shard_total=[2]`).
> 
> GitHub-hosted macOS/Windows runs remain at `4` shards, and build/job
wiring is otherwise unchanged.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
972f36eb853a620a3f08ac2089d725768177beb7. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

## Summary
- Adds a new GitHub Actions workflow that cancels in-progress/queued
`claude-pr-review.yml` runs when a PR is merged
- Mirrors the existing `cancel-ci-after-merge.yml` pattern, targeting
the Claude PR review workflow instead of CI
- Avoids wasting CI minutes on reviews for already-merged PRs

## Test plan
- Verify the workflow file is valid YAML and matches the structure of
`cancel-ci-after-merge.yml`
- Merge a PR that has a running Claude PR review and confirm the review
workflow is cancelled

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2609"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Low risk: adds an isolated GitHub Actions workflow that only cancels
in-progress/queued runs for a specific workflow on PR merge, with no
application code or data changes.
> 
> **Overview**
> Adds a new `cancel-claude-pr-review-after-merge.yml` workflow that
triggers when a PR is *closed and merged* and cancels any
in-progress/queued `claude-pr-review.yml` runs associated with the PR’s
head SHA.
> 
> The job queries multiple run statuses, deduplicates results, and
issues `cancelWorkflowRun` calls with `actions: write` permission to
avoid wasting runner time on already-merged PR reviews.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
9faccb5308bd575e3ef638c6efb94818dc9964b4. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Adds a GitHub Actions workflow that cancels Claude PR review runs after
a PR is merged to save CI minutes. Mirrors the existing
cancel-ci-after-merge workflow but targets claude-pr-review.yml.

- **New Features**
- New workflow triggers on merged PRs and cancels claude-pr-review.yml
runs for the PR’s head SHA (in_progress/queued/pending/waiting) using
file-path matching and dedup, including for forks.

<sup>Written for commit 9faccb5308bd575e3ef638c6efb94818dc9964b4.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

## Summary
- The `draft-stale-prs` workflow was failing with "Resource not
accessible by integration" when trying to convert fork PRs to draft via
the GraphQL `convertPullRequestToDraft` mutation
- The default `GITHUB_TOKEN` lacks the necessary cross-repo permissions
for this operation
- Switch to the `PR_RW_GITHUB_TOKEN` secret which has the required
permissions

#skip-bugbot

## Test plan
- Trigger the workflow manually via `workflow_dispatch` and verify fork
PRs are successfully converted to draft without "Resource not accessible
by integration" errors

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2608"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

## Summary
- Replace per-test `npm run e2e` commands in the Playwright PR comment
with a single combined command listing all unique failing spec files
- Remove unused `isSnapshotFailure` and `generateTestCommand` helper
functions
- Makes it easier to copy-paste and re-run all failures at once

## Test plan
- Verify the generated PR comment format by inspecting the next CI run
with test failures
- The command section should show a single `npm run e2e` with
backslash-joined spec file paths

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2605"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->


<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Simplified the Playwright PR comment to a single copy-paste command that
re-runs all failing spec files at once. This reduces noise and speeds up
local reproduction.

- **Refactors**
- Generate one command using backslash-joined unique failing spec paths;
sanitize file paths.
- Remove isSnapshotFailure and generateTestCommand; drop snapshot flags
and error previews from the comment.

<sup>Written for commit 9e24baa4782ab82cb93b7cbf3fa579063e269b51.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Only changes CI comment output formatting/commands and removes unused
helpers; no impact to test execution itself, but could slightly affect
how developers re-run failures locally.
> 
> **Overview**
> Simplifies the Playwright PR comment’s macOS re-run section to output
a **single** `npm run e2e` command listing all *unique failing spec
files*, instead of generating per-test `-g` commands.
> 
> Removes the snapshot-detection and per-test command helpers
(`isSnapshotFailure`, `generateTestCommand`), dropping
`--update-snapshots` suggestions and reducing comment noise.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
9e24baa4782ab82cb93b7cbf3fa579063e269b51. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

## Summary
- Move the ActionHeader component from TitleBar into PreviewPanel where
it logically belongs
- Improve component organization by separating preview-related controls
from the global title bar
- Update ActionHeader styling to fit its new location with sidebar
background

## Test plan
- Verify the ActionHeader appears at the top of the PreviewPanel instead
of in the title bar
- Confirm the tab switching (Preview/Code/Console) functionality works
correctly
- Test the refresh and external link buttons work as expected
- Verify the title bar still renders correctly with the spacer element

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2553"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Moved the preview action header into the PreviewPanel and added a right
action sidebar for quick mode switching. Maintenance actions moved to a
TitleBar “More” menu so controls are closer to their content.

- New Features
- RightActionSidebar on the chat page with buttons for Preview, Problems
(with count), Code, Configure, Security, Publish.
- TitleBar actions: Chat activity button and a “More” menu for Clean
Rebuild and Clear Preview Data.

- Refactors
- Render ActionHeader at the top of PreviewPanel; remove it from
TitleBar, drop useLocation, and add a spacer.
- Polish styles for ActionHeader (px-2, sidebar background) and sidebar
active/hover states.

<sup>Written for commit 5cc7c53453f280024838a43fdd89a357abca3523.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

---------
Co-authored-by: Will Chen <willchen90@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

## Summary
- Fixed 4 TypeScript errors in `e2e-tests/git_collaboration.spec.ts`
where the `createGitConflict` helper called
`getTitleBarAppNameButton()`, `getCurrentAppPath()`, and `goToChatTab()`
directly on `po` instead of through `po.appManagement` and
`po.navigation`
- Added PageObject sub-component pattern documentation to
`rules/e2e-testing.md`

## Test plan
- `npm run ts` passes with zero errors
- All 784 unit tests pass

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2604"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> E2E test refactor plus documentation only; no production logic
changes, with minimal risk beyond potential test behavior differences if
selectors were misrouted.
> 
> **Overview**
> Updates `createGitConflict` in `e2e-tests/git_collaboration.spec.ts`
to call UI helpers through the correct `PageObject` sub-components
(e.g., `po.appManagement.*`, `po.navigation.*`) instead of nonexistent
top-level `po` methods, resolving TypeScript errors.
> 
> Adds documentation to `rules/e2e-testing.md` describing the
`PageObject` sub-component pattern and listing the primary
sub-components to use in E2E tests.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
c053dacf656833ad274881e97337f8a97c97f1ee. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Fixed TypeScript errors in the createGitConflict e2e helper by using the
correct PageObject sub-components (po.appManagement and po.navigation).
Added docs in e2e-testing.md explaining the PageObject sub-component
pattern to prevent calling methods directly on po.

<sup>Written for commit c053dacf656833ad274881e97337f8a97c97f1ee.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Solves part of #2207



<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Introduces an in-app merge conflict workflow with both AI-assisted and
manual resolution, integrated into Git sync and branch merges.
> 
> - New `GithubConflictResolver` dialog: previews conflicting sections,
"Auto-Resolve with AI" (with optional auto-approve) and "Accept Current
Changes", and progresses through multi-file conflicts
> - Integrated into `GitHubConnector` and `GithubBranchManager` to
surface conflicts after failed push/merge, guide resolution, and then
finalize via `ipc.github.completeMerge` (rebase-continue or merge
commit)
> - New IPC contracts/handlers: `github:get-conflicts`,
`github:resolve-conflict` (writes/stages ours), `github:complete-merge`;
plus improved conflict detection by checking conflicts directly on
errors
> - Enhanced error/rebase-state messaging and abort/continue flows;
avoids relying on IPC-serialized error names
> - E2E tests for AI and manual conflict resolution; fake LLM updated to
emit conflict-fixing `dyad-write`
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
98b8aa07ef175a2806bbc0609b433279fbde78c8. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->




<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Adds inline merge-conflict resolution with a chat-based flow and a
cancel option. Conflict detection, streaming, and cancel behavior are
more reliable; merges remain blocked until the repo is clean.

- **New Features**
- Inline conflict banner listing files, with “Resolve merge conflicts
with AI” (opens a new chat, auto-starts streaming) and “Cancel sync”;
buttons disable while resolving or cancelling.
- New useResolveMergeConflictsWithAI hook that validates appId, guards
rapid clicks, creates the chat, navigates, starts the stream, and
refreshes chats/app on completion; integrated into GitHubConnector and
GithubBranchManager and clears conflicts only after chat creation.
- E2E tests for AI resolution and cancel flow; fake LLM supports new and
legacy prompts; Electron IPC docs clarify stream start returns void and
how to avoid duplicate streams.

- **Bug Fixes**
- Always fetch conflicts after failed sync/merge, not relying on
serialized error names; clearer messages for rebase/merge states and
when conflict checks fail.
- Cancel sync only shows success when an abort actually occurs; clears
conflicts and refreshes branches; buttons disable during cancellation.
- Resets streaming state if stream setup or navigation fails; onError
now refreshes chat list and app; e2e git commands quote filenames.

<sup>Written for commit 8ec0dd605bdadbec9b64b64643c0010129c9735b.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->




<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2240">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Will Chen <willchen90@gmail.com>

## Summary
- Set up i18n infrastructure using i18next with locale files for English
(chat, common, errors, home, settings namespaces)
- Add LanguageSelector component to the settings page for users to
switch languages
- Add language preference field to the app schema and integrate i18next
provider in the app layout and renderer

## Test plan
- Verify the app builds and starts without errors
- Navigate to Settings and confirm the Language Selector is visible and
functional
- Confirm English translations load correctly across all namespaces

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2450">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Broad UI text refactor plus new runtime language switching could
surface missing keys, incorrect namespaces, or layout regressions,
though changes are largely non-functional and localized to presentation.
> 
> **Overview**
> Adds app-wide internationalization via `i18next`/`react-i18next`,
including a new `src/i18n` initialization with bundled namespaces and
locale resources.
> 
> Introduces a persisted `language` setting (validated by
`LanguageSchema`) plus a new `LanguageSelector` UI, and syncs the active
i18n language at startup in `RootLayout`.
> 
> Migrates many user-facing strings across chat, settings, integrations,
dialogs, banners, and preview panel components to use `t()` translation
keys (with interpolation/plurals) instead of hardcoded English, and adds
an i18n design doc. Dependencies are updated in `package.json`/lockfile.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
a996131500b0f99ea766036084972f9863aca81d. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Add app-wide internationalization with i18next and a language selector
in Settings. The chosen language persists and updates the UI instantly;
ships with English, Simplified Chinese (zh-CN), and Brazilian Portuguese
(pt-BR), aligned with the Linear issue, and migrates UI text across the
app.

- **New Features**
- Initialize i18next/react-i18next with namespaces (common, settings,
chat, home, errors) before render; sync to UserSettings.language on
startup.
- Add LanguageSelector in Settings → General showing only completed
locales; saves validated values and switches UI language.
- Include complete en, zh-CN, pt-BR translations, Intl-based
date/number/relative-time helpers, and docs/i18n.md.

- **Refactors**
  - Replace hardcoded strings with t() across 50+ components.
- Validate settings.language via LanguageSchema.safeParse; defer
changeLanguage to layout sync to avoid duplicates; add error handling
for updateSettings; extract constants in formatRelativeTime.

<sup>Written for commit b670b0489415ca966db1f70f0a1ad3111a455538.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>

## Summary
- Remove "Build with MCP" option from chat mode selector dropdowns
- Route build mode to MCP agent code path when MCP servers are enabled
- Add MCP chip showing "N MCP" next to Build button when servers enabled
- Show MCP tools picker in build mode when MCP servers are enabled
- Skip deprecated agent mode in keyboard shortcut toggle cycle
- Update e2e tests to use build mode instead of agent mode

## Test plan
- [x] MCP e2e tests pass (verified locally)
- [ ] Verify Build mode works normally without MCP servers configured
- [ ] Configure an MCP server and verify the "N MCP" chip appears next
to Build button
- [ ] Verify clicking MCP tools picker shows enabled MCP servers
- [ ] Verify sending a message in Build mode with MCP servers uses the
agent code path

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2435">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Changes the chat-mode UI and the main chat streaming branching so
Build may enter the MCP/tooling code path when MCP servers are enabled;
this can alter assistant behavior and tool-consent flows. Lockfile churn
may also affect dependency installs across environments.
> 
> **Overview**
> **Removes the user-facing “Build with MCP”/`agent` mode selection**
and treats stored `agent` settings as **Build** for backwards
compatibility.
> 
> **Build now conditionally enables MCP tooling**: the MCP tools picker
appears in Build only when at least one MCP server is enabled, and the
main streaming handler runs the MCP agent pre-pass only when Build has
enabled MCP servers (or when legacy `agent` is set).
> 
> Adds a small **“N MCP” status chip** next to Build when MCP servers
are enabled, updates the keyboard mode-toggle cycle to skip deprecated
`agent`, updates MCP e2e tests to select Build, and includes a large
`package-lock.json` metadata update (peer flag changes).
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
6338761b9e45313d399dd2f4873e5ef9a53ff36a. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Removed the deprecated Agent mode by folding it into Build. Build now
uses MCP tooling only when MCP servers are enabled; the UI shows an MCP
count chip and tools picker, and old “agent” settings still work.

- **Refactors**
- Removed Agent from mode selectors; legacy “agent” appears as Build and
the keyboard toggle skips it.
- Build routes through the MCP agent path only when enabled MCP servers
exist; otherwise behaves like normal Build.
- Preserved compatibility for users with “agent” in settings and in the
streaming path.
- Updated E2E tests to use Build and aligned test_helper with the
modular PageObject structure.

- **New Features**
  - Added an “N MCP” chip next to Build when servers are enabled.
  - Show the MCP tools picker in Build when MCP servers are enabled.

<sup>Written for commit 6338761b9e45313d399dd2f4873e5ef9a53ff36a.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>

## Summary
- Remove `workflow_dispatch` inputs from CI, BugBot, and Claude PR
Review workflows since pushes made with `PR_CONTENTS_RW_GITHUB_TOKEN` (a
PAT) now naturally trigger downstream workflows via `pull_request
synchronize` events
- Simplify checkout logic across all workflows by removing
fork-resolution steps that were only needed for `workflow_dispatch`
- Remove manual workflow re-triggering in `pr-review-responder.yml`
since PAT-based pushes handle this automatically

#skip-bugbot

## Test plan
- Verify CI workflows trigger correctly on PR push events from fork PRs
- Verify BugBot and Claude PR Review trigger on `pull_request_target`
events
- Verify `pr-review-responder` pushes with PAT correctly trigger
downstream workflows without manual `workflow_dispatch` calls

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2598"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Streamlined GitHub Actions by removing workflow_dispatch paths and
switching to PAT-based pushes so pull_request synchronize events
naturally trigger CI, BugBot, and Claude review. This reduces custom
logic and makes fork PRs behave consistently.

- **Refactors**
- Removed workflow_dispatch and pr_number inputs from CI, BugBot, and
Claude PR Review.
- Checkout now uses pull_request head repo/ref; dropped fork-resolution
logic.
- Rebase and pr-review-responder push with PR_CONTENTS_RW_GITHUB_TOKEN
to emit real synchronize events.
  - BugBot comment now uses WWWILLCHEN_PR_RW_PAT.
- Simplified concurrency groups; removed manual re-triggers in
pr-review-responder.

- **Migration**
- Ensure secrets exist: PR_CONTENTS_RW_GITHUB_TOKEN (contents:
read/write) and WWWILLCHEN_PR_RW_PAT.
- Verify CI, BugBot, and Claude run on pull_request synchronize from
fork PRs; no manual reruns needed.

<sup>Written for commit b8950ec974c1c8b4ae52f1ff200fa0edc4b296d8.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

#skip-bb
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2597"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

## Summary
- Labels added by `GITHUB_TOKEN` don't trigger `pull_request_target`
events (GitHub limitation to prevent loops)
- `label-rebase-prs.yml` was adding `cc:rebase` via the default token,
so `claude-rebase.yml` never fired
- Switch to `GITHUB_PR_RW_TOKEN` (fine-grained PAT with PR read/write)
so label events trigger the rebase workflow
- Added `environment: ai-bots` to access the secret
- Documented the `GITHUB_TOKEN` workflow chaining gotcha in
`rules/git-workflow.md`

## Test plan
- Add `GITHUB_PR_RW_TOKEN` as a fine-grained PAT secret in the `ai-bots`
environment (needs `Pull requests: Read and write` permission on
`dyad-sh/dyad`)
- Push to `main` while a conflicting PR exists from an allowed author —
verify `cc:rebase` label is added AND `claude-rebase.yml` triggers

#skip-bugbot

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2596"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Switch label-rebase-prs to use a fine-grained PAT (PR_RW_GITHUB_TOKEN)
so adding cc:rebase triggers the claude-rebase pull_request_target
workflow. Document the GITHUB_TOKEN workflow-chaining limitation and
load the token from the ai-bots environment.

- **Migration**
- Add PR_RW_GITHUB_TOKEN as an environment secret in ai-bots
(fine-grained PAT with Pull requests: Read and write on dyad-sh/dyad).

<sup>Written for commit 2ff7d85a011aa53cff631f6490795ca4148f9f1c.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

## Summary
- Remove the `run_attempt` suffix from the `html-report` artifact name
in CI and the downstream Playwright comment workflow
- Use `overwrite: true` so re-runs replace the previous artifact in
place instead of creating a differently-named one that downstream
workflows can't find
- Fixes the issue where re-running failed CI jobs produced
`html-report--attempt-2.zip` but the comment workflow expected
`html-report--attempt-1.zip`

## Test plan
- Re-run a failed CI workflow and verify the Playwright comment workflow
can still find and download the HTML report artifact

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2595"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->


<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Use a stable artifact name for the Playwright HTML report and enable
overwrite so re-runs replace the same artifact. This fixes the comment
workflow failing to download the report after CI re-runs.

- **Bug Fixes**
  - CI uploads the report as "html-report" with overwrite: true.
- Comment workflow downloads "html-report" instead of attempt-specific
names.

<sup>Written for commit 96e5dcee43b5f03f602d31111afbe9860964b280.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Low risk workflow-only change that standardizes artifact naming and
enables overwriting on reruns; main risk is misnaming would break the
downstream report download.
> 
> **Overview**
> Makes the Playwright HTML report artifact name stable across CI reruns
by removing the `run_attempt` suffix in `ci.yml` and updating
`playwright-comment.yml` to download the fixed `html-report` artifact.
> 
> Enables `overwrite: true` on the uploaded HTML report so reruns
replace the prior artifact instead of creating a new name that the
comment workflow can’t find.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
96e5dcee43b5f03f602d31111afbe9860964b280. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>