Note
Reviews paused
It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.
- Last reviewed commit: b55a050c6a9c8533039b50e5674485b3e8b3daaa
- Latest commit, not reviewed: cd77cbdbdeac368cfbbd2622a44aa7fcd4c5e10b
Use the following commands to manage reviews:
@coderabbitai resumeto resume automatic reviews.@coderabbitai reviewto trigger a single review.
Use the checkboxes below for quick actions:
- ▶️ Resume reviews
- 🔍 Trigger review
No actionable comments were generated in the recent review.
Walkthrough
The changes add a server contribution-status store and WebSocket subscription, client state and status chips in server-thread headers. They also move right-panel surfaces into a typed registry and use a shared host context for panel state and scoped operations.
Changes: Contribution Status
Layer / File(s) Summary Status contract and subscription RPC
packages/contracts/src/contributionStatus.ts,packages/contracts/src/rpc.ts,packages/contracts/src/environment.ts,apps/server/src/auth/RpcAuthorization.ts,apps/server/src/ws.ts,apps/server/src/environment/ServerEnvironment.ts,apps/server/src/observability/RpcInstrumentation.ts,packages/client-runtime/src/rpc/client.ts,packages/contracts/src/index.ts,packages/client-runtime/package.json,apps/server/src/contributions/ContributionStatusRpc.test.ts,packages/contracts/src/contributionStatus.test.tsDefines status schemas, a capability flag, and an authorized streaming RPC. Adds contract decoding and RPC behavior tests. Store and Pi session routing
apps/server/src/contributions/ContributionStatusStore.ts,apps/server/src/contributions/ContributionStatusStore.test.ts,apps/server/src/orchestration-v2/Adapters/PiAdapterV2.ts,apps/server/src/orchestration-v2/Adapters/PiAdapterV2.test.ts,apps/server/src/provider/ProviderOrchestrationAdapterInfrastructure.ts,apps/server/src/server.ts,docs/user/providers-pi.mdAdds normalized, capacity-limited status storage and routes Pi extension updates across thread registration, session changes, and rollback outcomes. Wires the shared store into server and provider infrastructure. Client subscription and thread display
packages/client-runtime/src/state/contributionStatus.ts,packages/client-runtime/src/state/contributionStatus.test.ts,apps/web/src/state/contributionStatus.ts,apps/web/src/components/chat/ThreadContributionStatus.logic.ts,apps/web/src/components/chat/ThreadContributionStatus.logic.test.ts,apps/web/src/components/chat/ThreadContributionStatus.tsx,apps/web/src/components/chat/ThreadContributionStatus.test.tsx,apps/web/src/components/chat/ChatHeader.tsxAdds capability-gated, per-environment client state and per-thread status chips. Server-thread headers display the chips; tests cover isolation, replacement frames, and rendering. Registered Side Panels
Layer / File(s) Summary Panel registry and host context
apps/web/src/panels/panelRegistry.ts,apps/web/src/panels/bundledPanels.tsx,apps/web/src/panels/panelHost.ts,apps/web/src/panels/panelRegistry.test.tsx,apps/web/src/panels/bundledPanels.test.tsx,apps/web/src/panels/panelHost.test.tsAdds typed lazy panel registration, metadata lookup, and a shared host context. The host provides thread, visibility, draft, workspace-mutation, and annotation-sender values. Registered panel rendering and launchers
apps/web/src/components/ChatView.tsx,apps/web/src/components/RightPanelTabs.tsx,apps/web/src/components/RightPanelTabs.*.test.tsx,apps/web/src/routes/_chat.pull-requests.tsxChatView renders registered surfaces under the panel host. Launcher metadata and open callbacks flow through a shared panel map. Scoped preview, device, and file actions
apps/web/src/panels/preview/*,apps/web/src/panels/device/*,apps/web/src/panels/files/*,apps/web/src/panels/panelHost.test.ts,apps/web/src/browser/openFileInPreview.ts,apps/web/src/components/files/FileBrowserPanel.tsxPreview annotation, device, composer, file-opening, and browser-preview operations use host state and scope checks. Results from stale thread visits are ignored or interrupted. Terminal panel and persistent drawer
apps/web/src/panels/terminal/*Adds terminal launch-context resolution and a persistent drawer with terminal session reconciliation and controls. Tests cover host thread changes and worktree selection. Pull-request and diff panels
apps/web/src/panels/pullRequest/*,apps/web/src/panels/diff/DiffSidePanel.tsx,apps/web/src/components/pullRequest/*,apps/web/src/components/diffs/*Adds registered pull-request panels and loading states. The diff panel reads host values and uses an embedded frame. Estimated code review effort: 5 (Critical) | ~90 minutes
Change: Feature
Suggested reviewers:
juliusmarminge,bil0000
Merge Risk: External image Minimal · previous review b55a0
Preview annotations that finish after you navigate to another thread are now dropped instead of being sent from the wrong thread's draft. No remaining merge-blocking risk was found in the reviewed changes.
Security Architecture Review
Security architecture risk: 🔵 Low · up to
b55a0The change preserves read permissions and thread-scoped action controls. Status content is bounded, displayed as text and identified as advisory. No introduced security finding was established, but incomplete evidence around overlapping session changes prevents a minimal-risk assessment.
Retained concerns No architecture-level concerns identified.
Security review details
Security Blast Radius
- observed — The subscription exposes all live status entries in the authenticated environment to orchestration:read holders, not merely the active thread. Visible state is capped at 64 threads, 128 items overall and eight items per source. Producer-controlled status requests do not select their provider identity or thread envelope.
Trust Boundaries and Controls
- observed — The new stream passes through authenticated WebSocket upgrade handling and group-wide scope middleware. orchestration:read is checked before its handler runs. Registry extraction retains terminal operation checks, filesystem read/write guards, preview controls and page-only pull-request checkout restrictions.
Resilience and Maintainability Implications
- observed — A retained panel annotation callback forwards only when the latest sender still belongs to the original scoped thread. Final message sending also checks orchestration operation access and an active thread. This prevents a late annotation selection from being redirected into a newly selected thread.
Important
Pre-merge checks failed
Please resolve all errors before merging. Addressing warnings is optional.
Failed Failed checks: 1 error · 1 warning
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Approvability | Error | The pull request meets the Approvability rule “Adds a subsystem or user workflow, or is a large refactor across apps or packages.” It adds the contribution-status workflow across packages/contracts,… | A maintainer must review this pull request before approval, including its new contribution-status subsystem and the no-control-regex suppression directives in apps/server/src/contributions/ContributionStatusStore.ts. |
| Description check | Warning | The description includes all required sections and gives detailed problem, implementation, scope, verification results, screenshots, limitations, and test status. However, the Scope and approval secti… | Obtain explicit maintainer approval for the proposed direction and scope, then link or quote the approval comment in the Scope and approval section. If an exemption applies, document why the change qualifies. |
Passed Passed checks: 3 passed
Check name Status Explanation Linked Issues check Passed Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request. Title check Passed The title clearly and concisely describes the primary change: displaying Pi extension statuses in the thread header.
Full details: Approvability
Explanation
The pull request meets the Approvability rule “Adds a subsystem or user workflow, or is a large refactor across apps or packages.” It adds the contribution-status workflow across
packages/contracts,apps/server, andapps/web; it also refactorsapps/web/src/components/ChatView.tsxby 119 additions and 779 deletions and adds a panel registry and panels. It also addseslint-disable-next-line no-control-regexdirectives inapps/server/src/contributions/ContributionStatusStore.ts, which suppress static-analysis diagnostics. The pull request needs a maintainer’s review before CodeRabbit approves it.Resolution
A maintainer must review this pull request before approval, including its new contribution-status subsystem and the
no-control-regexsuppression directives inapps/server/src/contributions/ContributionStatusStore.ts.
Full details: Description check
Explanation
The description includes all required sections and gives detailed problem, implementation, scope, verification results, screenshots, limitations, and test status. However, the Scope and approval section states that maintainer approval is still outstanding and does not provide the required explicit approval comment.
Resolution
Obtain explicit maintainer approval for the proposed direction and scope, then link or quote the approval comment in the Scope and approval section. If an exemption applies, document why the change qualifies.
Finishing Touches
🧪 Generate unit tests (beta)
- Create a new PR
- Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
ℹ️ Recent review info
-
⚙️ Run configuration
- Configuration used: Path: .coderabbit.config.ts
- Review profile: CHILL
- Plan: Advanced
- Run ID:
d3d4e1b6-250d-49de-ad75-bb18fedd0c41
📥 Commits
Reviewing files that changed from the base of the PR and between a4c61dc9e75d5f92f2e72c6195b2e6f579beea44 and b55a050c6a9c8533039b50e5674485b3e8b3daaa.
📒 Files selected for processing (1)
apps/web/src/components/ChatView.tsx
Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 7 remain after this review.
ℹ️ Recent review info
⚙️ Run configuration
- Configuration used: Path: .coderabbit.config.ts
- Review profile: CHILL
- Plan: Advanced
- Run ID:
d3d4e1b6-250d-49de-ad75-bb18fedd0c41
📥 Commits
Reviewing files that changed from the base of the PR and between a4c61dc9e75d5f92f2e72c6195b2e6f579beea44 and b55a050c6a9c8533039b50e5674485b3e8b3daaa.
📒 Files selected for processing (1)
apps/web/src/components/ChatView.tsx
Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 7 remain after this review.