IW-347: Dashboard repo link + always-visible PR link with stale badge #378

Merged

mprihoda merged 21 commits from IW-347 into main

2026-06-12 05:55:16 +00:00

mprihoda commented

2026-05-29 07:30:20 +00:00

(Migrated from github.com)

Summary

Closes IW-347. Worktree cards now surface both key links — the git repository web page and the pull request — directly on the card, without expanding or navigating to details.

Repo web link: a new persistent "Repo" button on each worktree card, derived from the project's repository config (GitHub/GitLab-aware via RepoUrlBuilder).
Always-visible PR link with stale badge: the PR link is shown whenever a PR exists for the branch. When the cached PR data is stale, the last known link is kept (rather than hidden) and tagged with a · stale indicator.
Config rename: youtrackBaseUrl → trackerBaseUrl sweep across domain, CLI, help text, and docs. The HOCON file key tracker.baseUrl is unchanged; the short-form CLI alias for the old name was removed (no backward-compat alias).

Phase 1 was a discovery phase (no shipped code) — deliverables are cache-investigation.md and a draft follow-up issue cache-rework-issue-draft.md.

Changes

Domain: RepoUrlBuilder (new, scheme allow-list defence-in-depth), Config rename + parse-time validation of repository segments and trackerBaseUrl scheme, TrackerUrlBuilder.
Application/Infra: PrDisplayData view model (replaces inline CachedPR.isValid checks), staleness mapping in WorktreeListSync, per-worktree repo-URL lookup in CaskServer, WorktreeCardService.
Presentation: WorktreeCardRenderer repo-link section + stale-PR badge; frontend .repo-link/.repo-button CSS.

Testing

Core unit (scala-cli/munit): new RepoUrlBuilderTest (12 cases), extended ConfigTest (unsafe scheme / repository rejection), rename updates across ConfigFileTest, TrackerUrlBuilderTest, TestFixtures.
Dashboard unit + integration (Mill): renderer, sync staleness, service, project-details, search tests; dashboard.itest.testForked 192/192 green.
BATS E2E: config.bats rename test updated.

Code review

Two-iteration review (6 parallel skills + focused security re-review). Two critical security issues caught and fixed: javascript: URL injection via trackerBaseUrl, and path-traversal/open-redirect via weak repository validation. A functional gap (repo link dropped on HTMX OOB swaps) was also fixed. Details in project-management/issues/IW-347/review-phase-02-20260430-142658.md.

Release notes

See project-management/issues/IW-347/release-notes.md (Czech, user-facing).

🤖 Generated with Claude Code

## Summary Closes IW-347. Worktree cards now surface both key links — the git repository web page and the pull request — directly on the card, without expanding or navigating to details. - **Repo web link**: a new persistent "Repo" button on each worktree card, derived from the project's `repository` config (GitHub/GitLab-aware via `RepoUrlBuilder`). - **Always-visible PR link with stale badge**: the PR link is shown whenever a PR exists for the branch. When the cached PR data is stale, the last known link is kept (rather than hidden) and tagged with a `· stale` indicator. - **Config rename**: `youtrackBaseUrl` → `trackerBaseUrl` sweep across domain, CLI, help text, and docs. The HOCON file key `tracker.baseUrl` is unchanged; the short-form CLI alias for the old name was removed (no backward-compat alias). Phase 1 was a discovery phase (no shipped code) — deliverables are `cache-investigation.md` and a draft follow-up issue `cache-rework-issue-draft.md`. ## Changes Domain: `RepoUrlBuilder` (new, scheme allow-list defence-in-depth), `Config` rename + parse-time validation of `repository` segments and `trackerBaseUrl` scheme, `TrackerUrlBuilder`. Application/Infra: `PrDisplayData` view model (replaces inline `CachedPR.isValid` checks), staleness mapping in `WorktreeListSync`, per-worktree repo-URL lookup in `CaskServer`, `WorktreeCardService`. Presentation: `WorktreeCardRenderer` repo-link section + stale-PR badge; frontend `.repo-link`/`.repo-button` CSS. ## Testing - Core unit (scala-cli/munit): new `RepoUrlBuilderTest` (12 cases), extended `ConfigTest` (unsafe scheme / repository rejection), rename updates across `ConfigFileTest`, `TrackerUrlBuilderTest`, `TestFixtures`. - Dashboard unit + integration (Mill): renderer, sync staleness, service, project-details, search tests; `dashboard.itest.testForked` 192/192 green. - BATS E2E: `config.bats` rename test updated. ## Code review Two-iteration review (6 parallel skills + focused security re-review). Two critical security issues caught and fixed: `javascript:` URL injection via `trackerBaseUrl`, and path-traversal/open-redirect via weak `repository` validation. A functional gap (repo link dropped on HTMX OOB swaps) was also fixed. Details in `project-management/issues/IW-347/review-phase-02-20260430-142658.md`. ## Release notes See `project-management/issues/IW-347/release-notes.md` (Czech, user-facing). 🤖 Generated with [Claude Code](https://claude.com/claude-code)