feat(desktop): add input context and inline comments

[Sun-sunshine06]

Summary

• add sidebar support for local files, reference URLs, and design system repos
• scan design system repos into prompt context and pass them into generate/apply-comment flows
• add preview selection + inline comment editing MVP in the desktop app

Validation

• corepack pnpm --filter @open-codesign/shared typecheck
• corepack pnpm --filter @open-codesign/desktop typecheck
• corepack pnpm --filter @open-codesign/core test

[github-actions]

Findings

• [Blocker] Prompt-context enrichment now fails silently when a selected attachment cannot be read or when the reference URL fetch fails, so generate/apply-comment proceed with partial grounding and no user-visible error. That violates the repo's "no silent fallbacks" constraint and can produce a design that looks grounded when the grounding step never succeeded, evidence apps/desktop/src/main/prompt-context.ts:55, apps/desktop/src/main/prompt-context.ts:104, apps/desktop/src/main/index.ts:126, apps/desktop/src/main/index.ts:186
  Suggested fix:

  import { CodesignError } from '@open-codesign/shared';
  
  } catch (error) {
    throw new CodesignError(
      `Failed to read attachment "${file.path}"`,
      'ATTACHMENT_READ_FAILED',
      { cause: error },
    );
  }
  
  if (!response.ok) {
    throw new CodesignError(
      `Reference URL fetch failed (${response.status}) for ${url}`,
      'REFERENCE_URL_FETCH_FAILED',
    );
  }

• [Major] The new persisted designSystem payload is written into config.toml without any nested schema/version field or migration boundary. The docs explicitly require schema-versioning for on-disk data, and future extractor changes will have no reliable way to distinguish old snapshots from new ones, evidence packages/shared/src/config.ts:30, packages/shared/src/config.ts:50, apps/desktop/src/main/onboarding-ipc.ts:111
  Suggested fix:

  export const StoredDesignSystem = z.object({
    schemaVersion: z.literal(1),
    rootPath: z.string().min(1),
    summary: z.string().min(1),
    extractedAt: z.string().min(1),
    // ...
  });
  
  const next: Config = {
    ...cfg,
    designSystem: designSystem ? { schemaVersion: 1, ...designSystem } : undefined,
  };

• [Major] inspectReferenceUrl() reads the full response body into the Electron main process before applying any size or content-type guard, so a large or non-HTML URL can stall the app and inflate prompt size even though only 1,200 characters are eventually kept, evidence apps/desktop/src/main/prompt-context.ts:88
  Suggested fix:

  const contentType = response.headers.get('content-type') ?? '';
  const contentLength = Number(response.headers.get('content-length') ?? 0);
  if (!response.ok || !contentType.includes('text/html') || contentLength > 256_000) {
    throw new CodesignError(
      `Unsupported reference URL response for ${url}`,
      'REFERENCE_URL_UNSUPPORTED',
    );
  }

Summary

• Review mode: initial. Three issues above block this from being ready: silent fallbacks in prompt-context ingestion, an unversioned on-disk designSystem snapshot, and unbounded reference-URL reads in the main process. Separately, the GitHub commit metadata for ebb7e2e7b6fe70f23ec517920195d1ce8dd095cb does not show a Signed-off-by: trailer, so the DCO requirement still appears unmet.

Testing

• Not run (automation): corepack pnpm --filter @open-codesign/core test, corepack pnpm --filter @open-codesign/desktop typecheck, and corepack pnpm --filter @open-codesign/shared typecheck could not run in this runner because node_modules are absent; the environment also reports Node v20.20.2 while the repo requires Node 22+.

open-codesign Bot

[github-actions]

This turns a failed reference-URL enrichment step into a silent fallback. The generate/apply-comment IPC handlers both rely on preparePromptContext(), so returning only { url } here means the request keeps going with partial grounding and no user-visible error, which violates PRINCIPLES §10.

Suggested fix:

import { CodesignError } from '@open-codesign/shared';

if (!response.ok) {
  throw new CodesignError(
    `Reference URL fetch failed (${response.status}) for ${url}`,
    'REFERENCE_URL_FETCH_FAILED',
  );
}

} catch (error) {
  throw new CodesignError(
    `Failed to inspect reference URL ${url}`,
    'REFERENCE_URL_FETCH_FAILED',
    { cause: error },
  );
}

[github-actions]

designSystem is a new on-disk payload, but this schema has no nested version marker. The repo docs call out schema-versioning for persisted data explicitly; without it, any future extractor shape change becomes a blind breaking change for existing config.toml files.

Suggested fix:

export const StoredDesignSystem = z.object({
  schemaVersion: z.literal(1),
  rootPath: z.string().min(1),
  summary: z.string().min(1),
  extractedAt: z.string().min(1),
  // ...
});

[github-actions]

This fetch path pulls the entire response into the Electron main process with response.text() before any content-type or size guard. For an arbitrary user-entered URL, that is enough to freeze the UI on large pages/binary responses even though the code only keeps 1,200 characters afterward.

Suggested fix:

const contentType = response.headers.get('content-type') ?? '';
const contentLength = Number(response.headers.get('content-length') ?? 0);
if (!response.ok || !contentType.includes('text/html') || contentLength > 256_000) {
  throw new CodesignError(
    `Unsupported reference URL response for ${url}`,
    'REFERENCE_URL_UNSUPPORTED',
  );
}

[github-actions]

Findings

• [Major] Attachment grounding still reads the entire file into the Electron main process before truncating it to a 6,000-character excerpt, so a user-selected large file or binary can stall the app or spike memory even though only a tiny prefix is ever used, evidence apps/desktop/src/main/prompt-context.ts:58, apps/desktop/src/main/prompt-context.ts:76
  Suggested fix:

  import { open } from 'node:fs/promises';
  
  const MAX_ATTACHMENT_BYTES = 256_000;
  if (file.size > MAX_ATTACHMENT_BYTES) {
    throw new CodesignError(
      `Attachment "${file.name}" is too large (${file.size} bytes).`,
      'ATTACHMENT_TOO_LARGE',
    );
  }
  
  const handle = await open(file.path, 'r');
  const buffer = Buffer.alloc(Math.min(file.size, MAX_ATTACHMENT_BYTES));
  const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
  await handle.close();

• [Major] The new prompt-grounding path leaks absolute local filesystem paths to the model provider: attachment prompts include file.path, and the scanned design-system summary includes the absolute repo root. That unnecessarily exposes usernames/project names over the network and is not needed for generation, evidence packages/core/src/index.ts:97, packages/core/src/index.ts:115, apps/desktop/src/main/design-system.ts:166
  Suggested fix:

  import { basename } from 'node:path';
  
  const repoLabel = basename(designSystem.rootPath);
  const lines = ['## Design system to follow', `Repository: ${repoLabel}`];
  
  const attachmentLines = [`${index + 1}. ${file.name}`];

• [Major] PreviewPane now trusts any window.postMessage payload with the right shape, but the generated preview runs untrusted JavaScript under sandbox="allow-scripts" and can forge those messages itself. That lets artifact code spoof element-selection and iframe-error events in the parent UI, evidence apps/desktop/src/renderer/src/components/PreviewPane.tsx:26, apps/desktop/src/renderer/src/components/PreviewPane.tsx:72
  Suggested fix:

  const iframeRef = useRef<HTMLIFrameElement>(null);
  
  function onMessage(event: MessageEvent): void {
    if (event.source !== iframeRef.current?.contentWindow) return;
    if (isOverlayMessage(event.data)) {
      // ...
    }
  }
  
  <iframe ref={iframeRef} ... />

Summary

• Review mode: follow-up after new commits. Three issues remain in the latest head: full attachment reads in the main process, absolute local-path leakage into provider prompts, and untrusted preview postMessage payloads being accepted by the renderer. I did not find new direct provider SDK imports or dependency/license changes in this diff.

Testing

• Not run (automation): the runner is on Node v20.20.2, the repo requires Node 22+, pnpm is not on PATH, node_modules are absent, and corepack pnpm vitest run apps/desktop/src/main/prompt-context.test.ts packages/core/src/generate.test.ts packages/shared/src/config.test.ts failed with Command "vitest" not found.
• Missing coverage: not found in the touched tests for oversized-attachment handling or renderer-side postMessage source validation around inline comments / iframe errors.

open-codesign Bot

[github-actions]

This still reads the full attachment into memory before the code decides whether it is text and before it trims the excerpt to 6,000 characters. A large file or binary will block the Electron main process for no gain.

Suggested fix:

import { open } from 'node:fs/promises';

const MAX_ATTACHMENT_BYTES = 256_000;
if (file.size > MAX_ATTACHMENT_BYTES) {
  throw new CodesignError(
    `Attachment "${file.name}" is too large (${file.size} bytes).`,
    'ATTACHMENT_TOO_LARGE',
  );
}

const handle = await open(file.path, 'r');
const buffer = Buffer.alloc(Math.min(file.size, MAX_ATTACHMENT_BYTES));
const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
await handle.close();

[github-actions]

This prompt section sends absolute local paths upstream (file.path here, plus the scanned repo root in the design-system summary). That leaks usernames and project names to the provider even though the model only needs file names / relative repo labels.

Suggested fix:

import { basename } from 'node:path';

const repoLabel = basename(designSystem.rootPath);
const lines = ['## Design system to follow', `Repository: ${repoLabel}`];

const attachmentLines = [`${index + 1}. ${file.name}`];

[github-actions]

This trusts any window.postMessage payload with the expected shape. Because the preview iframe runs untrusted generated JavaScript under sandbox="allow-scripts", the artifact can forge ELEMENT_SELECTED / IFRAME_ERROR messages and drive parent-side UI state without a real user click.

Suggested fix:

const iframeRef = useRef<HTMLIFrameElement>(null);

function onMessage(event: MessageEvent): void {
  if (event.source !== iframeRef.current?.contentWindow) return;
  if (isOverlayMessage(event.data)) {
    // ...
  }
}

<iframe ref={iframeRef} ... />

[github-actions]

Findings

• [Major] IPC contract changes are still unversioned — GeneratePayload gained new fields and three new IPC channels were added without a v1 namespace or schemaVersion, which violates the repo's compatibility/upgradeability rule and makes the next payload/channel change a breaking swap instead of a parallel rollout, evidence packages/shared/src/index.ts:106, packages/shared/src/index.ts:116, apps/desktop/src/preload/index.ts:38, apps/desktop/src/main/index.ts:70
  Suggested fix:

  export const GeneratePayloadV1 = z.object({
    schemaVersion: z.literal(1),
    prompt: z.string().min(1).max(32_000),
    history: z.array(ChatMessage).max(200),
    model: ModelRef,
    baseUrl: z.string().url().optional(),
    referenceUrl: z.string().url().optional(),
    attachments: z.array(LocalInputFile).max(12).default([]),
  });
  
  ipcMain.handle('codesign:v1:generate', async (_e, raw) => {
    const payload = GeneratePayloadV1.parse(raw);
    // ...
  });

• [Major] Design-system scanning still masks partial failures and does full-file reads in the Electron main process — unreadable directories/files are silently skipped, but the flow still logs designSystem.scan.ok and the renderer shows “Design system linked”, while each selected file is loaded completely even though only the first 32,000 chars are used. Large repos can stall the main process and incomplete scans are surfaced as success, evidence apps/desktop/src/main/design-system.ts:89, apps/desktop/src/main/design-system.ts:204, apps/desktop/src/main/index.ts:105, apps/desktop/src/renderer/src/store.ts:215
  Suggested fix:

  import { open } from 'node:fs/promises';
  
  const failures: string[] = [];
  
  try {
    const handle = await open(file.fullPath, 'r');
    const buffer = Buffer.alloc(MAX_FILE_CHARS);
    const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
    await handle.close();
    const snippet = buffer.subarray(0, bytesRead).toString('utf8');
    collectCssVarValues(snippet, colors, spacing, radius, shadows);
    collectLooseValues(snippet, colors, fonts, spacing, radius, shadows);
  } catch (error) {
    failures.push(`${file.relativePath}: ${error instanceof Error ? error.message : String(error)}`);
  }
  
  if (failures.length > 0) {
    throw new CodesignError(
      `Design system scan skipped ${failures.length} paths: ${failures.slice(0, 3).join('; ')}`,
      'DESIGN_SYSTEM_SCAN_FAILED',
    );
  }

• [Minor] New renderer UI still hardcodes visual values instead of going through tokens/components — the new preview hint, iframe surface, send/apply buttons, and kbd styles add raw white/rgba values and inline font declarations, which violates the token-only constraint and will drift across themes, evidence apps/desktop/src/renderer/src/components/PreviewPane.tsx:76, apps/desktop/src/renderer/src/components/PreviewPane.tsx:85, apps/desktop/src/renderer/src/components/InlineCommentComposer.tsx:74, apps/desktop/src/renderer/src/components/Sidebar.tsx:189, apps/desktop/src/renderer/src/components/Sidebar.tsx:198
  Suggested fix:

  <div className="... bg-[var(--color-surface)] text-[var(--color-text-primary)] shadow-[var(--shadow-soft)]" />
  <iframe className="... bg-[var(--color-surface)] border border-[var(--color-border)]" />
  <Button className="...">Apply change</Button>
  <kbd className="font-mono ...">Enter</kbd>

Summary

• Review mode: follow-up after new commits. Three issues remain on the latest head: unversioned IPC/payload changes, design-system scanning that can silently succeed after partial failures while still full-reading candidate files in the main process, and new renderer literals that bypass the token system. I did not find dependency/license changes, direct provider SDK imports, or DCO problems in this diff.

Testing

• Not run (automation): corepack pnpm vitest run apps/desktop/src/main/prompt-context.test.ts apps/desktop/src/renderer/src/components/PreviewPane.test.ts packages/core/src/generate.test.ts packages/shared/src/config.test.ts failed because the runner is on Node v20.20.2 while the repo requires Node 22+, node_modules are absent, and pnpm could not find vitest.
• Missing coverage: not found in the touched tests for scanDesignSystem partial-failure/large-file handling or the new IPC contract surface around generate / applyComment / pick-*.

open-codesign Bot

[github-actions]

This adds new IPC/payload surface area without versioning: GeneratePayload changed shape, ApplyCommentPayload is new, and the new codesign:* channels are still unversioned. That violates the compatibility/upgradeability rule in docs/PRINCIPLES.md and makes the next contract change a breaking swap instead of a parallel rollout.

Suggested fix:

export const GeneratePayloadV1 = z.object({
  schemaVersion: z.literal(1),
  prompt: z.string().min(1).max(32_000),
  history: z.array(ChatMessage).max(200),
  model: ModelRef,
  baseUrl: z.string().url().optional(),
  referenceUrl: z.string().url().optional(),
  attachments: z.array(LocalInputFile).max(12).default([]),
});

ipcMain.handle('codesign:v1:generate', async (_e, raw) => {
  const payload = GeneratePayloadV1.parse(raw);
  // ...
});

[github-actions]

The scan still swallows unreadable directories/files and then returns success, and it still readFile()s each selected candidate even though only MAX_FILE_CHARS are used. On a large repo that can both produce a misleading partial snapshot and stall the Electron main process.

Suggested fix:

import { open } from 'node:fs/promises';

const failures: string[] = [];

try {
  const handle = await open(file.fullPath, 'r');
  const buffer = Buffer.alloc(MAX_FILE_CHARS);
  const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
  await handle.close();
  const snippet = buffer.subarray(0, bytesRead).toString('utf8');
  collectCssVarValues(snippet, colors, spacing, radius, shadows);
  collectLooseValues(snippet, colors, fonts, spacing, radius, shadows);
} catch (error) {
  failures.push(`${file.relativePath}: ${error instanceof Error ? error.message : String(error)}`);
}

if (failures.length > 0) {
  throw new CodesignError(
    `Design system scan skipped ${failures.length} paths: ${failures.slice(0, 3).join('; ')}`,
    'DESIGN_SYSTEM_SCAN_FAILED',
  );
}

[github-actions]

These new renderer additions still bypass the token system with raw white/rgba values and inline font declarations (bg-white, text-white, bg-[rgba(...)], style={{ fontFamily: ... }}). That will drift across themes and violates the repo's token-only UI rule.

Suggested fix:

<div className="... bg-[var(--color-surface)] text-[var(--color-text-primary)] shadow-[var(--shadow-soft)]" />
<iframe className="... bg-[var(--color-surface)] border border-[var(--color-border)]" />
<Button className="...">Apply change</Button>
<kbd className="font-mono ...">Enter</kbd>