You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Merges the 7 upstream commits from anomalyco/opencode dev into this fork's dev, resolving the merge conflict that was blocking #78. Once dev contains the upstream commits, #78 closes automatically.
The only conflict was nix/hashes.json, where both sides had auto-generated nix node_modules hashes. Resolved by keeping this fork's hashes:
This is safe because the nix-hashes workflow recomputes and commits fresh hashes automatically on any push to dev that touches bun.lock, which this merge does.
The upstream commits are small fixes to existing UI (desktop external links now open in the system browser, console limits graph axis restored), deepseek v4 flash model support, GPT 5.6 Luna docs content, and generated/lockfile churn.
How did you verify your code works?
Upstream deleted packages/app/src/components/link.tsx, packages/app/src/utils/notification-click.ts, and packages/desktop/src/main/markdown.ts; I verified no remaining code in this fork references them. CI on this PR validates the merged tree.
Screenshots / recordings
Not a UI change authored here; this is a merge of already-reviewed upstream commits.
Checklist
I have tested my changes locally
I have not included unrelated changes in this PR
Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.
Summary by CodeRabbit
New Features
External links now open securely in the default browser, while local file links open with the desktop application.
Notifications and session-related actions provide more reliable in-app navigation.
Go usage graphs now include clearer axes, gridlines, and mobile-friendly labels.
Lite routing and regional availability checks have been improved.
Documentation
Updated Go plan documentation and translations clarify global availability, privacy details, model ordering, and regional consent requirements.
The changes replace platform link interception with validated external and local-file opening, move notification and session navigation to callbacks, update desktop IPC, enable Go provider routing, revise Go graph and regional behavior, and align Go copy across console and documentation locales.
Changes
Application and desktop navigation
Layer / File(s)
Summary
External link and notification flow packages/app/src/components/*, packages/app/src/context/*, packages/app/src/entry.tsx, packages/app/src/pages/*
Adds ExternalLink, replaces Link, validates external URLs, separates local-file opening, and changes notifications to use click callbacks.
Desktop URL and IPC boundary packages/desktop/src/main/*, packages/desktop/src/preload/*, packages/desktop/src/renderer/index.tsx
Adds URL resolution and navigation policies, separates external and local-file IPC channels, and removes Markdown, notification, and window-count APIs.
Passes session IDs through data context and uses explicit callbacks for task-session navigation. @solidjs/router is removed from the package dependency list.
Go plan updates
Layer / File(s)
Summary
Routing and graph presentation packages/console/app/src/routes/go/*, packages/console/app/src/routes/workspace/[id]/go/*, packages/console/app/src/routes/zen/util/handler.ts
Enables provider routing, adds Lite region checks, expands inference-provider classification, and updates graph ticks, grid lines, model ordering, and plotted models.
bolt-builder/bolt-cli#29: Contains closely related link API, notification, Markdown, and desktop IPC changes.
Suggested reviewers:brendonovich, fwang
🚥 Pre-merge checks | ✅ 4 | ❌ 1
❌ Failed checks (1 warning)
Check name
Status
Explanation
Resolution
Docstring Coverage
⚠️ Warning
Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.
Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name
Status
Explanation
Title check
✅ Passed
The title clearly identifies the main change: merging the upstream dev branch into this fork.
Description check
✅ Passed
The description includes the issue, change type, merge details, conflict resolution, verification, screenshots note, and checklist.
Linked Issues check
✅ Passed
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
✅ Passed
Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
Create stacked PR
Commit on current branch
🧪 Generate unit tests (beta)
Create PR with unit tests
Commit unit tests in branch sync-upstream-dev
Warning
There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.
🔧 ESLint
If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.
ESLint install failed. For unrecoverable errors, disable the tool in CodeRabbit configuration.
Comment @coderabbitai help to get the list of available commands.
We reviewed changes in f1a8eea...ddf8fa6 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
Some issues found as part of this review are outside of the diff in this pull request and aren't shown in the inline review comments due to GitHub's API limitations. You can see those issues on the DeepSource dashboard.
PR Report Card
Overall Grade
Focus Area: Reliability
Security
Reliability
Complexity
Hygiene
Feedback
Type and hook usage around React
The any, non-null assertions, and the useNavigate-in-init issue all cluster around React/TS boundaries: hooks, props/state, and values assumed to exist.
Treating these as one theme (strengthening types and hook placement) will likely clear most of the reliability flags in one pass and make future merges less fragile.
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
The reason will be displayed to describe this comment to others. Learn more.
Forbidden non-null assertion
Using non-null assertions cancels out the benefits of strict null-checking, and introduces the possibility of runtime errors. Avoid non-null assertions unless absolutely necessary. If you still need to use one, write a skipcq comment to explain why it is safe.
The reason will be displayed to describe this comment to others. Learn more.
Forbidden non-null assertion
Using non-null assertions cancels out the benefits of strict null-checking, and introduces the possibility of runtime errors. Avoid non-null assertions unless absolutely necessary. If you still need to use one, write a skipcq comment to explain why it is safe.
The reason will be displayed to describe this comment to others. Learn more.
This code is merged verbatim from upstream anomalyco/opencode; restyling it in a sync PR would diverge the fork and create future merge conflicts. Style nits should be fixed upstream.
The reason will be displayed to describe this comment to others. Learn more.
Forbidden non-null assertion
Using non-null assertions cancels out the benefits of strict null-checking, and introduces the possibility of runtime errors. Avoid non-null assertions unless absolutely necessary. If you still need to use one, write a skipcq comment to explain why it is safe.
The reason will be displayed to describe this comment to others. Learn more.
Unexpected function declaration in the global scope, wrap in an IIFE for a local variable, assign as global property for a global variable
It is considered a best practice to avoid 'polluting' the global scope with variables that are intended to be local to the script. Global variables created from a script can produce name collisions with global variables created from another script, which will usually lead to runtime errors or unexpected behavior. It is mostly useful for browser scripts.
The reason will be displayed to describe this comment to others. Learn more.
Unknown property 'class' found, use 'className' instead
React components use JSX, not HTML.
So we need to use JSX attributes and React replicate the respective HTML property/attribute while rendering.
Use of HTML property in JSX can sometimes lead to errors.
For example, class is a keyword in JavaScript (JSX is an extension of JavaScript), so it will throw an error.
However, in HTML it is a valid attribute.
Note: If you use React with Web Components, use the class attribute instead.
The reason will be displayed to describe this comment to others. Learn more.
Expected 'undefined' and instead saw 'void'
The void operator takes an operand and returns undefined. It can be used to ignore the value produced by an expression. However, this can lead to code that is difficult to understand and maintain. Historically, the void operator was used to get a "pure" undefined value, as the undefined variable was mutable prior to ES5.
The reason will be displayed to describe this comment to others. Learn more.
Expected 'undefined' and instead saw 'void'
The void operator takes an operand and returns undefined. It can be used to ignore the value produced by an expression. However, this can lead to code that is difficult to understand and maintain. Historically, the void operator was used to get a "pure" undefined value, as the undefined variable was mutable prior to ES5.
The reason will be displayed to describe this comment to others. Learn more.
Expected 'undefined' and instead saw 'void'
The void operator takes an operand and returns undefined. It can be used to ignore the value produced by an expression. However, this can lead to code that is difficult to understand and maintain. Historically, the void operator was used to get a "pure" undefined value, as the undefined variable was mutable prior to ES5.
The reason will be displayed to describe this comment to others. Learn more.
Expected 'undefined' and instead saw 'void'
The void operator takes an operand and returns undefined. It can be used to ignore the value produced by an expression. However, this can lead to code that is difficult to understand and maintain. Historically, the void operator was used to get a "pure" undefined value, as the undefined variable was mutable prior to ES5.
The reason will be displayed to describe this comment to others. Learn more.
Upstream code merged verbatim in a sync PR; the void operator is intentional fire-and-forget promise handling. Changing it would diverge from upstream; the nit belongs upstream.
The reason will be displayed to describe this comment to others. Learn more.
`errorMessage` has a cyclomatic complexity of 6 with "medium" risk
A function with high cyclomatic complexity can be hard to understand and
maintain. Cyclomatic complexity is a software metric that measures the number of
independent paths through a function. A higher cyclomatic complexity indicates
that the function has more decision points and is more complex.
Reorder the model list to match the reordered tables.
The tables at lines 89-91, 129-132, and 185-187 now list GPT 5.6 Luna before GLM-5.2 and GLM-5.1. The "current model list" bullet section at lines 52-68 keeps the old order, with GLM-5.2 and GLM-5.1 before GPT 5.6 Luna.
Reorder the bullet list to match the tables. Use the same order everywhere in this document to avoid confusing readers who compare the sections.
📝 Proposed fix to match the model list order to the reordered tables
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/web/src/content/docs/zh-tw/go.mdx` around lines 52 - 68, Reorder the
current model list in the bullet section so GPT 5.6 Luna appears before GLM-5.2
and GLM-5.1, matching the model ordering in the document’s tables. Preserve all
other models and their relative order.
Align the China-providers toggle with the next-state pattern used by the useBalance toggle.
The hidden useChinaProviders input carries the CURRENT toggle state, not the next state. The setLiteUseBalance toggle in the same file (line 251) uses a clearer pattern: its hidden useBalance field contains the NEXT state (sub().useBalance ? "false" : "true"), and the server action applies it directly.
For setGoProviderRouting, the hidden input contains the current state (line 279: sub().region.includes("cn") ? "true" : "false"). The server action then inverts this: when useChinaProviders === true, it excludes China (sets ["us","eu","sg"]); when false, it includes China (sets ["us","eu","sg","cn"]). The current-state hidden value and the inverted server mapping currently cancel out, producing the correct toggle result, but the pattern is fragile and inconsistent.
If a future maintainer updates the hidden field to follow the next-state convention without also updating the server ternary (or vice versa), the region toggle for China-hosted models will silently invert. No test evidence in the repository protects against this regression.
Adopt the next-state pattern throughout: pass the NEXT state in the hidden field, apply it directly in the server action without inversion. This aligns with setLiteUseBalance, improves readability, and removes the double-inversion hazard.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/console/app/src/routes/workspace/`[id]/go/lite-section.tsx around
lines 139 - 155, Update setGoProviderRouting and its useChinaProviders hidden
input to use the next-state convention: have the form submit the toggled value,
then map true directly to regions ["us", "eu", "sg", "cn"] and false to ["us",
"eu", "sg"] in the server action. Align this with the setLiteUseBalance pattern
and remove the current inverted ternary.
Line 211 and Line 214 redundantly annotate url. The Platform return type contextually types both methods. Remove the annotations and confirm the repository typecheck passes.
As per coding guidelines, “Rely on type inference when possible; avoid explicit type annotations or interfaces unless required for exports or clarity.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/desktop/src/renderer/index.tsx` around lines 211 - 215, Remove the
redundant string annotations from the url parameters in the openExternal and
openLocalFile methods of the Platform object, relying on its contextual return
type for inference. Run the repository typecheck to confirm the change passes.
URL.canParse(text) already parses text internally, then new URL(text) parses it again to read .protocol. Parse once and reuse the result.
♻️ Proposed refactor
- if (URL.canParse(text) && new URL(text).protocol === "file:" && platform.openLocalFile) {- platform.openLocalFile(text)- return- }- platform.openExternal(text)+ const parsed = URL.canParse(text) ? new URL(text) : undefined+ if (parsed?.protocol === "file:" && platform.openLocalFile) {+ platform.openLocalFile(text)+ return+ }+ platform.openExternal(text)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/app/src/components/terminal.tsx` around lines 385 - 389, The
conditional at lines 385-389 parses the text parameter twice—once in
URL.canParse(text) and again when constructing new URL(text) to check the
protocol property. Refactor by removing URL.canParse and instead wrapping the
new URL(text) construction in a try-catch block, then checking the protocol on
the single parsed URL object. This preserves the branch logic for file protocol
URLs calling platform.openLocalFile versus platform.openExternal for other
cases.
Model order in this list no longer matches the reordered tables below.
Lines 63-65 still list GLM-5.2, then GLM-5.1, then GPT 5.6 Luna. The usage table (line 99), pricing table (line 139), and endpoint table (line 197) now list GPT 5.6 Luna before GLM-5.2 and GLM-5.1. Line 119 ("observed request patterns" bullet list) also still lists GLM-5.2/5.1 before GPT 5.6 Luna. Readers see three different orderings of the same three models within one document.
Update the bullet lists to place GPT 5.6 Luna before GLM-5.2 and GLM-5.1, to match the table order established by this PR. This same inconsistency exists in every localized go.mdx in this batch.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/web/src/content/docs/go.mdx` around lines 60 - 65, The bullet lists
at the beginning of the document (containing Grok 4.5, GLM-5.2, GLM-5.1, and GPT
5.6 Luna) and the "observed request patterns" bullet list have a different model
order than the usage, pricing, and endpoint tables. Reorder both bullet lists to
place GPT 5.6 Luna before GLM-5.2 and GLM-5.1, matching the table ordering. This
same fix applies to all localized go.mdx versions in this batch.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/app/src/context/notification.tsx`:
- Around line 359-361: Update notification navigation to preserve server
identity: in packages/app/src/context/notification.tsx at lines 359-361, pass
the emitting ServerConnection.Key into notification state and build a
server-aware session route; at lines 394-394, use the same server-aware route
for error notifications, including the project route when no session exists. In
packages/app/src/pages/layout.tsx at lines 449-455, include the current server
key when constructing permission and question notification paths before calling
navigate.
In `@packages/console/app/src/i18n/da.ts`:
- Line 343: Reconcile the Go privacy wording across go.faq.a5.beforeExceptions
and go.privacy.body/go.privacy.beforeExceptions with the updated generic wording
in go.faq.a5.body. Remove or revise the USA hosting and zero-retention claims
unless they are confirmed accurate, ensuring users do not see contradictory
statements.
In `@packages/console/app/src/i18n/fr.ts`:
- Line 347: The companion privacy text following the updated FAQ text in each
locale file still contains older exception wording about hosting and retention
details, creating conflicting privacy claims. Update the companion text in
packages/console/app/src/i18n/fr.ts at lines 348-350,
packages/console/app/src/i18n/it.ts at lines 343-345,
packages/console/app/src/i18n/ja.ts at lines 343-345, and
packages/console/app/src/i18n/ko.ts at lines 339-341 to remove or realign the
older exception wording so it no longer contradicts the removed hosting and
retention details from the main FAQ text, ensuring all locales present
consistent privacy claims.
In `@packages/console/app/src/i18n/uk.ts`:
- Line 344: Reconcile the Go privacy wording by updating the related
go.faq.a5.beforeExceptions, go.privacy.body, and go.privacy.beforeExceptions
strings to match the new generic hosting and data-use language, removing stale
USA/Singapore and zero-retention claims unless they are explicitly confirmed as
still accurate.
In `@packages/desktop/src/main/windows.ts`:
- Around line 235-252: Update the blocked-target logging in openExternalURL and
openLocalFileURL so it no longer records the raw untrusted value field. Log only
a fixed rejection reason or an appropriately redacted value, while preserving
the existing warning behavior and return flow.
In `@packages/session-ui/src/components/message-part.tsx`:
- Line 591: Update the taskSession input declaration to remove any, reusing the
existing task-input type when available or using Record<string, unknown>; narrow
description and subagent_type before accessing them, while preserving the
current behavior.
In `@packages/session-ui/src/components/tool-error-card.tsx`:
- Around line 118-121: Update the subtitle rendering logic in the tool error
card so callback-only navigation remains interactive: the `<a>` branch should
activate when either `split.href` or `split.onSubtitleClick` is available, while
preserving the existing click callback behavior and non-interactive fallback.
Alternatively, enforce paired `sessionHref`/`navigateToSession` props through
the data API and every caller, but do not leave callback-only consumers
rendering a plain `<span>`.
---
Outside diff comments:
In `@packages/console/app/src/routes/workspace/`[id]/go/lite-section.tsx:
- Around line 139-155: Update setGoProviderRouting and its useChinaProviders
hidden input to use the next-state convention: have the form submit the toggled
value, then map true directly to regions ["us", "eu", "sg", "cn"] and false to
["us", "eu", "sg"] in the server action. Align this with the setLiteUseBalance
pattern and remove the current inverted ternary.
In `@packages/web/src/content/docs/zh-tw/go.mdx`:
- Around line 52-68: Reorder the current model list in the bullet section so GPT
5.6 Luna appears before GLM-5.2 and GLM-5.1, matching the model ordering in the
document’s tables. Preserve all other models and their relative order.
---
Nitpick comments:
In `@packages/app/src/components/terminal.tsx`:
- Around line 385-389: The conditional at lines 385-389 parses the text
parameter twice—once in URL.canParse(text) and again when constructing new
URL(text) to check the protocol property. Refactor by removing URL.canParse and
instead wrapping the new URL(text) construction in a try-catch block, then
checking the protocol on the single parsed URL object. This preserves the branch
logic for file protocol URLs calling platform.openLocalFile versus
platform.openExternal for other cases.
In `@packages/desktop/src/renderer/index.tsx`:
- Around line 211-215: Remove the redundant string annotations from the url
parameters in the openExternal and openLocalFile methods of the Platform object,
relying on its contextual return type for inference. Run the repository
typecheck to confirm the change passes.
In `@packages/web/src/content/docs/go.mdx`:
- Around line 60-65: The bullet lists at the beginning of the document
(containing Grok 4.5, GLM-5.2, GLM-5.1, and GPT 5.6 Luna) and the "observed
request patterns" bullet list have a different model order than the usage,
pricing, and endpoint tables. Reorder both bullet lists to place GPT 5.6 Luna
before GLM-5.2 and GLM-5.1, matching the table ordering. This same fix applies
to all localized go.mdx versions in this batch.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
Push a commit to this branch (recommended)
Create a new PR with the fixes
ℹ️ Review info⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 41888ce0-9a2d-4dc8-a5a0-3f9b802fd1a3
📥 Commits
Reviewing files that changed from the base of the PR and between f1a8eea and ddf8fa6.
The reason will be displayed to describe this comment to others. Learn more.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
Preserve server identity in notification navigation.
All three callbacks use a directory-only legacy path. The application supports server-key routes, so a notification from another server can navigate to the wrong server.
packages/app/src/context/notification.tsx#L359-L361: pass the emitting ServerConnection.Key into the notification state and build a server-aware session route.
packages/app/src/context/notification.tsx#L394-L394: use the same server-aware route for error notifications, including the project route when no session exists.
packages/app/src/pages/layout.tsx#L449-L455: build permission and question notification paths with the current server key before calling navigate.
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/app/src/context/notification.tsx` around lines 359 - 361, Update
notification navigation to preserve server identity: in
packages/app/src/context/notification.tsx at lines 359-361, pass the emitting
ServerConnection.Key into notification state and build a server-aware session
route; at lines 394-394, use the same server-aware route for error
notifications, including the project route when no session exists. In
packages/app/src/pages/layout.tsx at lines 449-455, include the current server
key when constructing permission and question notification paths before calling
navigate.
The reason will be displayed to describe this comment to others. Learn more.
The notification navigation code is upstream code merged verbatim in this sync PR; the server-aware routing change is a design improvement that belongs upstream, and diverging the fork here would create recurring merge conflicts.
"Planen er primært designet til internationale brugere, med modeller hostet i USA, EU og Singapore for stabil global adgang. Vores udbydere følger en nulopbevaringspolitik og bruger ikke dine data til modeltræning.",
"Planen er primært udviklet til internationale brugereog giver stabil adgang i hele verden. Dine data bruges ikke til modeltræning.",
The reason will be displayed to describe this comment to others. Learn more.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
Reconcile privacy wording within the same Go FAQ answer.
Line 343 removes the specific USA/EU/Singapore hosting claim from go.faq.a5.body. Lines 344-346 (go.faq.a5.beforeExceptions) still state that Go models are hosted in the USA under a "nulopbevaringspolitik" (zero-retention policy). Lines 320-325 (go.privacy.body, go.privacy.beforeExceptions) repeat the same unrevised claim. A user reading the FAQ sees one sentence with generic wording immediately followed by a sentence with specific hosting and retention claims.
Update the remaining strings to match the new generic wording, or confirm that the specific hosting claim is still accurate and should stay.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/console/app/src/i18n/da.ts` at line 343, Reconcile the Go privacy
wording across go.faq.a5.beforeExceptions and
go.privacy.body/go.privacy.beforeExceptions with the updated generic wording in
go.faq.a5.body. Remove or revise the USA hosting and zero-retention claims
unless they are confirmed accurate, ensuring users do not see contradictory
statements.
The reason will be displayed to describe this comment to others. Learn more.
Upstream i18n content merged verbatim in a sync PR; reconciling the Danish privacy wording is an upstream content decision, not something to alter unilaterally in a fork sync.
"go.faq.q5": "Et pour les données et la confidentialité ?",
"go.faq.a5.body":
"Le plan est conçu principalement pour les utilisateurs internationaux, avec des modèles hébergés aux États-Unis, dans l'UE et à Singapour pour un accès mondial stable. Nos fournisseurs suivent une politique de rétention zéro et n'utilisent pas vos données pour l'entraînement des modèles.",
"Le forfait est principalement conçu pour les utilisateurs internationauxet offre un accès mondial stable. Vos données ne serviront pas à entraîner les modèles.",
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Align the companion Go privacy strings across locales.
The changed FAQ text removes hosting and retention details, but each locale still retains the older exception wording. This can expose conflicting privacy claims.
packages/console/app/src/i18n/fr.ts#L347-L347: update the companion text at Lines 348-350.
packages/console/app/src/i18n/it.ts#L342-L342: update the companion text at Lines 343-345.
packages/console/app/src/i18n/ja.ts#L342-L342: update the companion text at Lines 343-345.
packages/console/app/src/i18n/ko.ts#L338-L338: update the companion text at Lines 339-341.
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/console/app/src/i18n/fr.ts` at line 347, The companion privacy text
following the updated FAQ text in each locale file still contains older
exception wording about hosting and retention details, creating conflicting
privacy claims. Update the companion text in packages/console/app/src/i18n/fr.ts
at lines 348-350, packages/console/app/src/i18n/it.ts at lines 343-345,
packages/console/app/src/i18n/ja.ts at lines 343-345, and
packages/console/app/src/i18n/ko.ts at lines 339-341 to remove or realign the
older exception wording so it no longer contradicts the removed hosting and
retention details from the main FAQ text, ensuring all locales present
consistent privacy claims.
The reason will be displayed to describe this comment to others. Learn more.
This is upstream i18n content merged verbatim in a sync PR; the privacy wording is an upstream product/legal copy decision, and editing it here would diverge the fork and cause conflicts on future syncs. It should be reported upstream if inaccurate.
"go.faq.q5": "А як щодо даних та конфіденційності?",
"go.faq.a5.body":
"План розроблений переважно для міжнародних користувачів, з моделями в США, ЄС та Сінгапурі. Провайдери дотримуються політики нульового зберігання.",
"План розроблено передусім для міжнародних користувачів і він забезпечує стабільний глобальний доступ. Ваші дані не використовуватимуться для навчання моделей.",
The reason will be displayed to describe this comment to others. Learn more.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
Reconcile privacy wording within the same Go FAQ answer.
Line 344 removes the specific USA/EU/Singapore hosting claim from go.faq.a5.body. Lines 345-347 (go.faq.a5.beforeExceptions) still state that Go models are hosted in the USA under a "політики нульового зберігання" (zero-retention policy). Lines 321-326 (go.privacy.body, go.privacy.beforeExceptions) repeat the same unrevised claim. A user reading the FAQ sees generic wording immediately followed by a sentence with specific hosting and retention claims.
Update the remaining strings to match the new generic wording, or confirm the specific hosting claim should stay.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/console/app/src/i18n/uk.ts` at line 344, Reconcile the Go privacy
wording by updating the related go.faq.a5.beforeExceptions, go.privacy.body, and
go.privacy.beforeExceptions strings to match the new generic hosting and
data-use language, removing stale USA/Singapore and zero-retention claims unless
they are explicitly confirmed as still accurate.
The reason will be displayed to describe this comment to others. Learn more.
Upstream i18n content merged verbatim in a sync PR; reconciling the Ukrainian privacy wording is an upstream content decision that should be fixed upstream, not diverged in the fork.
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Do not log raw blocked URLs.
Line 238 and Line 247 persist untrusted URLs in debug logs. Rejected custom-scheme URLs can contain OAuth callback codes or credentials. Rejected file URLs can disclose local paths. Log a fixed reason or a redacted value instead.
Proposed fix
- writeLog("window", "blocked external target", { url: value }, "warn")+ writeLog("window", "blocked external target", undefined, "warn")
...
- writeLog("window", "blocked local file target", { url: value }, "warn")+ writeLog("window", "blocked local file target", undefined, "warn")
📝 Committable suggestion
‼️IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
writeLog("window","blocked local file target",undefined,"warn")
return
}
voidshell.openPath(path).then((error)=>{
if(error)writeLog("window","failed to open local file",{ path, error },"error")
})
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/desktop/src/main/windows.ts` around lines 235 - 252, Update the
blocked-target logging in openExternalURL and openLocalFileURL so it no longer
records the raw untrusted value field. Log only a fixed rejection reason or an
appropriately redacted value, while preserving the existing warning behavior and
return flow.
The reason will be displayed to describe this comment to others. Learn more.
Upstream code merged verbatim in this sync PR (the fork's only local diffs in this file are branding strings); changing it would diverge the fork and cause future merge conflicts. The logs are also local desktop debug logs, so exposure is limited to the user's own machine, and the fix belongs upstream.
taskSession declares input as Record<string, any> on Line 591. Use the existing task-input type, or use Record<string, unknown> and narrow description and subagent_type before use.
As per coding guidelines, **/*.{ts,tsx} says: “Avoid the any type.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/session-ui/src/components/message-part.tsx` at line 591, Update the
taskSession input declaration to remove any, reusing the existing task-input
type when available or using Record<string, unknown>; narrow description and
subagent_type before accessing them, while preserving the current behavior.
The reason will be displayed to describe this comment to others. Learn more.
The Record<string, any> is upstream code merged verbatim in this sync PR; restyling upstream code to satisfy fork lint conventions would diverge the fork and cause future merge conflicts. Worth fixing upstream instead.
The callback runs only in the <a> branch. That branch still requires split.href && split.subtitle on Line 111. Because sessionHref and navigateToSession are independent optional fields in packages/session-ui/src/context/data.tsx Lines 50-65, a consumer can provide only navigateToSession; the subtitle then renders as a <span> and the callback never runs. Render an interactive subtitle when either value is present, or enforce the paired-prop contract in the API and all callers.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/session-ui/src/components/tool-error-card.tsx` around lines 118 -
121, Update the subtitle rendering logic in the tool error card so callback-only
navigation remains interactive: the `<a>` branch should activate when either
`split.href` or `split.onSubtitleClick` is available, while preserving the
existing click callback behavior and non-interactive fallback. Alternatively,
enforce paired `sessionHref`/`navigateToSession` props through the data API and
every caller, but do not leave callback-only consumers rendering a plain
`<span>`.
The reason will be displayed to describe this comment to others. Learn more.
The subtitle rendering logic is upstream code merged verbatim in this sync PR; changing the interactivity contract here would diverge the fork from upstream and belongs as an upstream fix.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![deepsource-io[bot]](https://avatars.githubusercontent.com/in/16372?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Issue for this PR
Closes #78
Type of change
What does this PR do?
Merges the 7 upstream commits from anomalyco/opencode
devinto this fork'sdev, resolving the merge conflict that was blocking #78. Oncedevcontains the upstream commits, #78 closes automatically.The only conflict was
nix/hashes.json, where both sides had auto-generated nixnode_moduleshashes. Resolved by keeping this fork's hashes:This is safe because the
nix-hashesworkflow recomputes and commits fresh hashes automatically on any push todevthat touchesbun.lock, which this merge does.The upstream commits are small fixes to existing UI (desktop external links now open in the system browser, console limits graph axis restored), deepseek v4 flash model support, GPT 5.6 Luna docs content, and generated/lockfile churn.
How did you verify your code works?
Upstream deleted
packages/app/src/components/link.tsx,packages/app/src/utils/notification-click.ts, andpackages/desktop/src/main/markdown.ts; I verified no remaining code in this fork references them. CI on this PR validates the merged tree.Screenshots / recordings
Not a UI change authored here; this is a merge of already-reviewed upstream commits.
Checklist
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is enabled.Summary by CodeRabbit
New Features
Documentation