Repository navigation
feat: admins comment on Drop's own pages, and agents fix what they say - #63
Conversation
… what they say Drop turns on ViteHub Comments (server/comments.ts). Opening the Console turns the toolbar on for admins: they pin comments on any page, reply, resolve, and see each other live. Each thread keeps its page, element, Vue components and their files, browser, and build. Agents read and resolve threads through Drop's MCP (comments_* tools, admins only) and ViteHub MCP. Other people get the pages unchanged. ViteHub moves to the Comments stack (vite-hub/vitehub#2864).
onmax
changed the title
Latest result Pull request merged. Final answersSession Pull request merged. Session Waiting for GitHub merge request 9db35124-f287-49ec-bb53-8b038a46d0bb. Session Pushed 83c6680 resolving dependency conflicts and Nitro’s virtual MCP handler failure. All 65 focused tests, lint, formatting, Nuxt preparation, and frozen installation pass. Production Nuxt initialization confirms the corrected handler. Host refresh still fails on the unchanged --ignore-pnpmfile checksum mismatch. Pullfrog: inherited P1 pre-squash upgrades remain declined; the snapshot finding remains fixed. Awaiting hosted CI. Session Pushed 83c6680 resolving dependency conflicts and Nitro’s virtual MCP handler failure. All 65 focused tests, lint, formatting, Nuxt preparation, and frozen installation pass. Production Nuxt initialization confirms the corrected handler. Host refresh still fails on the unchanged --ignore-pnpmfile checksum mismatch. Pullfrog: inherited P1 pre-squash upgrades remain declined; the snapshot finding remains fixed. Awaiting hosted CI. Session Pushed 6f956f4 fixing generated-root tests for ViteHub 0.1’s API. Reproduced the CI failures; 45 focused tests, lint, formatting, and Nuxt preparation pass. Normal frozen installation succeeds; the host’s --ignore-pnpmfile installation conflicts with the unchanged hook checksum. Pullfrog: P1 inherited pre-squash upgrades remain declined as outside scope; the snapshot finding remains fixed. Awaiting hosted CI. Pushed 6f956f4 fixing generated-root tests for ViteHub 0.1’s API. Reproduced the CI failures; 45 focused tests, lint, formatting, and Nuxt preparation pass. Normal frozen installation succeeds; the host’s --ignore-pnpmfile installation conflicts with the unchanged hook checksum. Pullfrog: P1 inherited pre-squash upgrades remain declined as outside scope; the snapshot finding remains fixed. Awaiting hosted CI. Pushed 688296d with narrow doctor exceptions for verified page-tool authorization. `pnpm run doctor` now passes after reproducing both warnings; all 40 focused tests, config typecheck, lint and formatting pass. Pullfrog: historical P1 pre-squash upgrades remain declined as inherited/out of scope; snapshot finding already fixed. Normal frozen installation passed; the host’s --ignore-pnpmfile install conflicts with the hook checksum. Awaiting CI. |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
vitehub-drop | fc05b66 | Oct 26 2026, 07:07 AM |
|
The PR body's merge prerequisite is still unmet: vite-hub/vitehub#2864 currently shows Draft, and package.json still pins the 1674483 pkg.pr.new build. Land the complete ViteHub stack including #2864 and publish a release containing it; Drop can then replace the preview pin with that release. Please comment here when the release is available so the repair can resume. |
![vitehub-bot[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
Next step Verified c402f15 with a clean checkout and green current-head CI. After preparing generated files, 44 focused tests passed; scoped vp check and drizzle-kit check passed. No actionable review findings or source repairs remain. Reconfirmed ViteHub #2864 is Draft, so the required upstream release still blocks completion. Final answersSession Verified c402f15 with a clean checkout and green current-head CI. After preparing generated files, 44 focused tests passed; scoped vp check and drizzle-kit check passed. No actionable review findings or source repairs remain. Reconfirmed ViteHub #2864 is Draft, so the required upstream release still blocks completion. |
|
New pull request evidence is queued. |
|
New pull request evidence is queued. |
|
New pull request evidence is queued. |
Queued Waiting for a worker slot. |
|
New pull request evidence is queued. |
|
New pull request evidence is queued. |
|
New pull request evidence is queued. |
|
New pull request evidence is queued. |
|
New pull request evidence is queued. |
|
New pull request evidence is queued. |
|
New pull request evidence is queued. |
|
This Agent activity was superseded by a newer managed comment. |
|
The complete ViteHub Comments stack, including #2864, is now merged. The release prerequisite remains unmet: npm still lists |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
There was a problem hiding this comment.
Important
The feature path is coherent, but the migration metadata and upgrade coverage can produce broken future migrations or fail an older preview database during startup.
Reviewed changes across the Comments overlay integration, Console authorization, OAuth MCP wrappers, ViteHub dependency pin, schema registration, migration history, and focused tests.
- Admin page comments — installs ViteHub Comments for Console-authorized admins while leaving ordinary page responses unchanged outside comment mode.
- Agent comment workflow — exposes list, read, reply, and resolve tools through Drop's
/mcp, with an effective admin-role gate followed by ViteHub's Comments policy. - Database schema — adds the two ViteHub Comments tables to Drizzle generation and attempts to preserve data across historical preview migration timestamps and filenames.
- Dependency integration — advances the ViteHub preview stack and retains Drop's lazy Nitro route patch.
- Verification — focused migration and MCP tests pass, as does
drizzle-kit check; the upgrade-state gaps are not represented by those passing cases.
gpt-5.6-sol ｜ 𝕏
|
Pullfrog’s old-preview upgrade finding, P1, is declined as inherited and outside this PR: applying the genuine |
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes since the prior Pullfrog review, covering the released dependency transition and migration metadata repair.
- Pinned the released Comments stack — replaced the preview ViteHub build with
vite-hub@0.1.0and refreshed the lockfile to its released package graph. - Aligned the release schema — registered scope-counter and forge-link tables, added their migration, and seeded counters from existing thread numbers.
- Rebuilt migration snapshots — made the final snapshot include the earlier comment-suggestion and consolidated-baseline columns, preventing future generation from recreating applied schema changes.
- Narrowed upgrade coverage explicitly — tests now cover fresh databases and preview databases derived from the current consolidated baseline while preserving existing comment rows and counters.
- Validated focused paths — the 40 migration, MCP, and Console tests pass, and
drizzle-kit checkreports consistent metadata.
gpt-5.6-sol ｜ 𝕏
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes since the prior Pullfrog review, covering the Better Auth dependency alignment.
- Unified the OAuth provider graph — forced ViteHub and Drop onto
@better-auth/oauth-provider@1.7.10, removing the parallel1.7.7provider and@better-auth/utils@0.4.2graph. - Regenerated the lockfile — resolved ViteHub, Better Auth adapters, Stripe, and the app against one
@better-auth/core@1.7.10and@better-auth/utils@0.5.0type/runtime surface. - Validated affected paths — dependency inspection reports one version of each aligned package, the 36 focused MCP and Console authorization tests pass, and Nuxt typechecking passes.
gpt-5.6-sol ｜ 𝕏
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes since the prior Pullfrog review, covering the new security-rule exceptions for ViteHub page-tool discovery.
- Scoped Doctor suppressions — exempted only ViteHub's bundled page-session dispatcher and its generated Comments re-export from the route-middleware security rule.
- Verified authorization boundaries — confirmed the shared dispatcher filters every tool through its
allowedcallback, Console usesconsoleAllowsRequest, and Comments resolves the Console-backed identity before applying itsreadpolicy. - Validated the configuration —
pnpm run doctorpasses with no blockers, errors, warnings, or informational findings.
gpt-5.6-sol ｜ 𝕏
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes since the prior Pullfrog review, covering the generated-root tests' transition to the released ViteHub APIs.
- Updated Rate Limit setup coverage — awaited the released async config hook and retained assertions that generated files and Nitro plugins live at the project root.
- Replaced obsolete Content handler coverage — removed checks for the retired per-definition dev handler and now verifies project-root definition discovery, operation loading, and the no-definition case.
- Validated the focused suite —
pnpm test -- test/deploy/generated-roots.test.mjspasses all 5 tests againstvite-hub@0.1.0.
gpt-5.6-sol ｜ 𝕏
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes since the prior Pullfrog review, covering the Nitro virtual-handler build fix and the two main-branch commits incorporated into the updated head.
- Preserved virtual MCP discovery — kept handler IDs registered in
nitroOptions.virtualunchanged during Nitro path resolution, while retaining normal project-root resolution for filesystem handlers. - Added focused regression coverage — verified ViteHub's delegated Console MCP middleware remains linked to its virtual module under the Cloudflare Durable preset.
- Validated the production seam — the focused virtual-handler test and full
pnpm buildpass, and the generated server bundle containsvirtual:vitehub/console-mcp-discovery. - Absorbed current main — incorporated the video-stage and localized frontmatter-date changes without altering the PR-specific Comments behavior.
gpt-5.6-sol ｜ 𝕏
…longer holds a placeholder D1 id (#104) ViteHub 0.1.0 (#63) refuses a D1 binding declared twice with different ids. Nitro merges the root wrangler.jsonc into the generated config, so on Workers Builds the placeholder id clashed with CLOUDFLARE_D1_DATABASE_ID and the build failed. Without an id there, Wrangler provisions the database by name, as it already does for KV.
Drop admins had no way to leave a note about Drop's own pages where they see the problem. Agents could not read those notes either.
With this change, an admin who opens the Console gets the Comments toolbar on every Drop page:
This uses the released ViteHub Comments stack: vite-hub/vitehub#2858, #2860, #2861, #2862, #2864. The whole stack, #2864 included, has landed, and Drop now pins
vite-hub@0.1.0.Changes
server/comments.ts:defineComments(). With Drop's Console (auth: "app"), Comments' people are the people that the Console lets use itscommentssection.server/console-authorize.ts: admins get thecommentssection next toauth.server/mcp/site-comments.ts:comments_list_threads,comments_get_thread,comments_reply, andcomments_resolve_threadin Drop's/mcp, so OAuth clients such as Claude Code reach them. They wrapcommentsMcpTools()from ViteHub, and only admins may call them. ViteHub also serves the same tools at/_vitehub/mcpfor Console sessions.0003_vitehub_commentsand0005_vitehub_comments_release: ViteHub's thread, comment, scope counter, and forge-link tables. The release migration seeds scope counters from existing thread numbers.server/databases/comments.tsre-exports them for drizzle-kit only, sopnpm db:generatekeeps them.comment_attachmentsandcomments.element_x/yagain.0000_init.sqlalready has them, but its snapshot did not, so I took them out of the SQL. The latest snapshot lists them and the already-appliedcomments.suggestion, so later migrations stop trying.vite-hubpins the released0.1.0. The release includes the lazy route and environment fixes previously carried as Drop patches.Evidence
Original preview run: two admins (Ada, Ben) and a member (Cy) in headless Chromium against a production Node build of this branch (
DROP_HOST=vps, SQLite, memory Realtime):What else the run showed:
/_vitehub, she had thevitehub-commentscookie. Her pages got<script … nonce="…" data-vitehub-comments>with the page's CSP nonce, and the overlay ran under'strict-dynamic'.comments_get_threadreturned the URL,/dropsroute,<h1>element,app/layouts/dashboard.vueandapp/components/PageShell.vue, the viewport, the browser, and the build branch and commit, then resolved the thread.?commentsin the URL, the page loads the overlay, which asks the server, is denied, and says comments are only for the team. Cy got no toolbar, no cookie, and403from/_vitehub/mcp.422from the script signing up accounts that already existed.Validation
pnpm install --frozen-lockfile --ignore-scripts,vitehub types prepare, andnuxt preparepass.pnpm test test/deploy/migrate-d1.test.mjs test/mcp/tools.test.mjs test/cost/auth-console.test.mjspasses 40 tests, including the Comments tools' schemas, the admin gate, existing comment preservation, counter initialization, and snapshot consistency.drizzle-kit checkpasses. Migration generation against a temporary copy of the migration history reports no schema changes; fresh and current-baseline preview SQLite migrations pass.vp lintandvp fmt --checkpass on the changed source and configuration files.Not done yet
nuxt dev: the presence WebSocket never upgrades undernuxt dev. Sockets open but carry no frames, so dev shows comments without presence. The production Node build above works. I did not find whether this is Drop's dev setup or Nuxt's.RouterViewandPrimitive. The pinned release includes that fix, which has unit tests but no browser run on Drop.🤖 Generated with Claude Code