[Olga Lavrichenko (OLavrik)]

How to review

About 300 of the roughly 4,500 changed lines carry meaning. The rest is mechanical.

Substance, around 300 lines. Review these:

• Windows desktop drag region, Chromium 156: apps/desktop/src/windowChrome.ts, apps/desktop/src/preload.ts, apps/web/src/index.css, plus windowChrome.test.ts and e2e/topbar-chrome.spec.ts
• Editor chunk retry loop: packages/resource-renderers/src/support/rendererMount.tsx and its new test in rendererMount.test.tsx
• Escape under a nested modal: packages/ui/dialog.tsx
• PostHog chained causes: packages/server/src/analytics/errors.ts
• posthog-cli checksums: apps/web/posthogCli.ts
• Test updates for new Radix behavior: e2e/plan-open-pr.spec.ts (Escape order) and e2e/layout.spec.ts (two timing races)
• Lint fixes for Biome 2.6's new rules: imageGuard.test.ts (guardedContent helper), errorReports.test.ts, hydrate.test.ts, ChangesReviewGuide.tsx
• Config and pins: biome.json and the package.json files
• Specs: apps/desktop, apps/web, apps/web/src/shell, apps/web/src/panels, packages/resource-renderers, packages/ui, packages/server/src/analytics, e2e

Mechanical, safe to skim:

• bun.lock: about 690 lines from the version bumps.
• patches/@pierre%2Fdiffs@1.6.1.patch: the 1.5.1 patch renamed. Its change lines are identical.
• apps/web/src/chat/generated/providerGlyphs.ts: the regenerated Qwen glyph.
• Biome 2.6 formatter output, 3,523 lines across 29 files. It mostly re-wraps test.each(...) calls and indents their bodies; nothing changes meaning. Each file below is byte-identical to running Biome 2.6 format on its main version:

29 formatting-only files

• .github/workflows/ci.yml
• apps/cli/src/update.test.ts
• apps/desktop/src/externalNavigation.test.ts
• apps/web/src/transport/mcp.test.ts
• apps/website/src/attribution/claimPage.test.ts
• packages/artifact-tests/src/artifact.test.ts
• packages/artifact-tests/src/installerEnvironment.test.ts
• packages/artifact-tests/src/installerScripts.test.ts
• packages/artifact-tests/src/releaseArtifacts.test.ts
• packages/extension-api/src/browser.test.ts
• packages/pi-dag/extension/adapter.test.ts
• packages/pi-delegation/src/service.test.ts
• packages/pi-subagents/src/definitions.test.ts
• packages/pi-subagents/src/extension.test.ts
• packages/pi-subagents/src/mapping.test.ts
• packages/server/src/agent/agentSessionManager.test.ts
• packages/server/src/agent/chatResources.test.ts
• packages/server/src/analytics/analytics.test.ts
• packages/server/src/analytics/errors.test.ts
• packages/server/src/auth/providerLogin.test.ts
• packages/server/src/host/authAnalytics.test.ts
• packages/server/src/host/mcp.test.ts
• packages/server/src/host/planReview.test.ts
• packages/server/src/host/runQueueAnalytics.test.ts
• packages/server/src/host/turnShutdown.test.ts
• packages/server/src/settings/settings.test.ts
• packages/server/src/turns/turns.test.ts
• packages/website-analytics/src/index.test.ts
• scripts/checkModuleBoundaries.test.ts

Problem

Seven dependency updates from the audit each broke a test when tried alone, so they were left out of #926. Playwright 1.64's Chromium 156 also exposed two real product bugs, both fixed here:

• Windows desktop dragging would break on Chromium 156. Chromium 156 computes app-region: var(--window-chrome-drag-region, no-drag) as none. Any var() in app-region is dropped, even a defined one. The Windows desktop shell runs on WebView2, an evergreen Chromium, and uses a real app-region: drag for its title bar, so the header would stop dragging the window once WebView2 reaches 156. macOS is unaffected because Electrobun rewrites app-region into a custom property.
• A failed editor chunk retried in a tight loop. When the Monaco chunk failed to load, rendererMount forgot the failed lazy at once so that "the next mount retries". React retries a failed render, though, and that retry made a fresh lazy and a fresh import(). Chromium 149 caches a failed module fetch, which hid the loop. Chromium 156 refetches: about 5,900 chunk requests in 3 s, and the error boundary never showed.

Approach

Chromium 156 fixes (Playwright itself stays at 1.61).

• app-region: the desktop publishes its drag flag as the data-window-chrome-drag-region attribute on <html> instead of a custom property. window-drag uses only literal values: no-drag by default, drag under :root[data-window-chrome-drag-region="drag"]. This works in every engine and through Electrobun's text rewrite, which still produces the --electrobun-app-region mirror that title-bar double-click reads. topbar-chrome.spec.ts passed on both Chromium 149 and 156.
• Failed editor chunk: a lazy stored by a mount stays stored and failed, so re-renders of that mount throw to the boundary instead of reloading. The next load (hover or idle preload) replaces it. A new unit test fails without the fix, and error-boundary.spec.ts passed on Chromium 156 with the fix.
• Playwright 1.64 itself is held back. On Chromium 156, a modal Radix DropdownMenu closed by an outside click leaves its content mounted with data-state="open" while the trigger reports closed. It reproduces with both Radix versions and breaks history-search.spec.ts:738. That needs its own investigation and PR.

Radix 1.3 (dialog, toast, popover, dropdown-menu, context-menu, tooltip, moved together because they share react-dismissable-layer). A toast that opens over a dialog is now the topmost layer, so the first Escape dismisses the toast and the next closes the dialog. Before, one Escape closed the dialog and left the error toast. I kept the new order because it lets you read an error and keep the dialog open. plan-open-pr.spec.ts asserts it, and packages/ui/SPEC.md documents it.

The new Radix also moves the Escape listener to a new highest layer in an effect. A modal opened over another dialog could therefore lose an Escape to the dialog under it: the Settings dialog closed under the non-dismissable installer, and update-install-journey.spec.ts:120 failed in 3 of 6 runs. @thinkrail/ui/dialog's DialogContent and DialogPanel now ignore an Escape whose focus sits in a different dialog (it passed 6/6 runs). The same render timing exposed two races in layout.spec.ts, fixed in the tests: one focused a control before the context menu had closed, the other before the app's one-frame focus placement after showing a side.

Biome 2.6

• Markdown formatting and linting are turned off in biome.json; specs keep their hand wrapping.
• The new formatter style is applied to 30 test files.
• The 14 new noUnsafeOptionalChaining errors in tests are fixed, including a guardedContent helper in imageGuard.test.ts. One useMathMinMax is fixed in ChangesReviewGuide.tsx.
• 18 new warnings remain: 16 noDescendingSpecificity in apps/website/src/styles.css, where reordering selectors risks the cascade, and 2 useDomNodeTextContent false positives on Playwright's locator.innerText().

PostHog (posthog-node 5.57.2, @posthog/core 1.60.1, @posthog/cli 0.18.12)

• The new SDK writes chained causes with mechanism: { type: "chained", … } and no handled. Our sanitizer turned a missing handled into false, which broke "causes stay handled". It now treats a missing handled as handled, which is the SDK's own default.
• The posthog-cli binary checksums are re-pinned for 0.18.12. Each hash comes from the official PostHog/posthog GitHub release archive, and the method was checked by reproducing a 0.18.10 pin exactly. One archive was cross-checked byte for byte against releases.posthog.com.

@lobehub/icons-static-svg 1.101.0: regenerated provider glyphs. Only Qwen changed, to its new logo (screenshots below).

@pierre/diffs 1.6.1: upstream still lacks both fixes, and pierrecomputer/pierre#1185 was closed unmerged. The patch is re-applied as patches/@pierre%2Fdiffs@1.6.1.patch with the same change lines. Its guard tests in review.spec.ts (text-selection drags keep the comment button) pass.

bun-pty 0.5.2: 0.5's breaking change makes env the child's whole environment. terminalManager already passes a full copy of process.env plus TERM/COLORTERM. The native library files the binary embeds are unchanged.

vite 8.3.5, astro 7.4.2, @astrojs/markdown-satteri 0.4.5, sharp 0.35.5: astro 7.4 itself requires satteri 0.4.5. The built website HTML matches main except for whitespace, inline-script minification, and an empty srcset="" dropped from blog images.

Changes

• apps/desktop/src/windowChrome.ts, preload.ts: publish the drag flag as an <html> attribute; apps/web/src/index.css: literal window-drag
• packages/resource-renderers/src/support/rendererMount.tsx and test: a failed mounted lazy stays failed until a later load replaces it
• packages/server/src/analytics/errors.ts: a missing mechanism.handled counts as handled
• apps/web/posthogCli.ts: 0.18.12 version and checksums
• biome.json: schema 2.6.3, Markdown off; test reformatting and lint fixes
• apps/web/src/chat/generated/providerGlyphs.ts: regenerated (Qwen)
• patches/@pierre%2Fdiffs@1.6.1.patch replaces the 1.5.1 patch
• e2e: topbar-chrome sets the drag attribute, plan-open-pr covers the new Escape order, and layout waits for the menu to close and for the app's one-frame focus placement before focusing by hand. Both were timing races in the tests that the new Radix render timing exposed.
• Specs: apps/desktop, apps/web, apps/web/src/shell, apps/web/src/panels (patch name), packages/resource-renderers (failed lazy), packages/ui (toast layering), packages/server/src/analytics (chained causes), e2e
• Versions: @biomejs/biome 2.6.3, @radix-ui/* (context-menu 2.4.1, dialog 1.3.1, dropdown-menu 2.2.1, popover 1.3.1, toast 1.3.1, tooltip 1.4.1), posthog-node 5.57.2, @posthog/core 1.60.1, @posthog/cli 0.18.12, @lobehub/icons-static-svg 1.101.0, @pierre/diffs 1.6.1, bun-pty 0.5.2, vite 8.3.5, astro 7.4.2, @astrojs/markdown-satteri 0.4.5, sharp 0.35.5

Screenshots

Only the Qwen provider glyph changes. It is rendered the way the app renders it (currentColor on the dark surface) at the in-app 14 px size, next to a model label, and enlarged to 64 px.

Before (@lobehub/icons-static-svg 1.95.1)	After (1.101.0)

No other visual change is intended.

Related issues

None. Part of the dependency audit behind #909, #913, #914, #923 and #926. Overlaps #909 (vite, astro, sharp) and #926 (biome.json untouched there; bun.lock and package.json in both). Whichever merges later resolves the lockfile.

Checklist

• Fast gates pass: bun run lint, bun run typecheck, bun run test
• E2E suite passes for app-affecting changes (bun run e2e, or bun run e2e:full when touching agent behavior)
• Before/after screenshots are included for frontend changes, or marked not applicable
• Relevant SPEC.md / top-level specs updated to reflect any boundary, contract, or behavior change
• I have read the Contributing guide and agree to the Code of Conduct

Verification on the final tree, rebased onto main with #926:

• check:deps, check:boundaries, check:seams, check:spec-surface, check:i18n, lint, typecheck, check:compiler, provider-glyphs:check, and bun run test. All pass.
• bun run build:binary and bun run smoke:binary (for bun-pty): pass.
• Focused e2e on Chromium 149 (Playwright 1.61). All pass:
  • error-boundary, topbar-chrome, history-search, plan-open-pr, update-install-journey (31/31)
  • update-install-journey "Install & Restart" repeated 6/6
  • layout focus recovery repeated 10/10
  • terminals + workspace-tabs (27/27)
  • review + changes, including the Pierre patch guard tests
• Unit test for the editor-chunk loop: fails without the fix, passes with it.

The latest full local bun run e2e is not valid evidence: the machine sat at load average 30–50, the shards ran 4–7× slower than usual, and timeouts failed across every shard. CI's E2E shards are the full-suite check for this PR.

Biome 2.6 also formats YAML, which re-wraps one needs: line in .github/workflows/ci.yml. That is formatting only.

Found but not fixed here: in one run the host crashed with Unknown workspace thrown from the file-watcher callback (watch.ts:104 → recordWorkspaceHead → gitHeadSha) after a test removed its workspace. It did not reproduce on rerun and touches no code in this PR, but an uncaught throw from a watcher callback takes down the host, so it deserves its own issue.

[github-actions]

🌐 Website preview

Preview	https://pr-930.thinkrail-website.pages.dev
Routes	Landing · Blog · Vibecoding · Agentic development · Agentic IDE
Commit	6c6268d

This comment updates in place on every push that touches the website or shared build inputs.

[jetbrains-air]

Approved — ready to merge.

[jetbrains-air]

Non-blocking:
Problem: The foreign-dialog guard invokes onEscapeKeyDown before checking ownership, so caller side effects still run for an Escape it should ignore.
Failure scenario: Open Skills from New Workspace while editing template slots, then press Escape during Radix’s layer handoff. The outer NewWorkspaceDialog handler calls updatePromptDraft(prompt, null), ending slot editing underneath the Skills dialog before this guard prevents dismissal.
Suggested fix: Check ownership first; for a foreign dialog, prevent default and return before invoking the caller’s handler.

[jetbrains-air]

Approved — ready to merge.

[jetbrains-air]

Approved — ready to merge.

[jetbrains-air]

Approved — ready to merge.

[jetbrains-air]

Approved — ready to merge.

[jetbrains-air]

Approved — ready to merge.

[jetbrains-air]

Non-blocking:
Problem: Astro 7.4.2 raises the Node minimum to ≥22.23.4 while the repository still documents ≥22.19 for development.
Failure scenario: A contributor on Node 22.19 runs the required bun run typecheck; the website task exits immediately with Node.js v22.19.0 is not supported by Astro!. This reproduces with the pinned CLI; 7.3.3's CLI accepted ≥22.12.
Suggested fix: Keep an Astro pin compatible with the supported Node floor, or consistently update the repository's development prerequisites to ≥22.23.4.