Release 0.11.0

.github/RELEASE_NOTES.md

@@ -1,12 +1,9 @@
-> ⚠️ **Early preview (0.x)**: features, configuration, and data formats may change incompatibly, and stability is not fully verified.
-> Do not use it for critical production review workflows — assess the risk and back up your data first.
+> 📖 Full changelog: [English](%%CHANGELOG_URL_EN%%) · [简体中文](%%CHANGELOG_URL_ZH%%)
 
 ## What's changed
 
 %%CHANGELOG_SECTION%%
 
-> 📖 This version on the website changelog (English · 简体中文): %%CHANGELOG_URL%%
-
 ## Installation
 
 The installers are ready to use — the review runtime is bundled in, so **no extra setup is needed after installing**.

.github/workflows/release.yml

@@ -221,9 +221,12 @@ jobs:
         shell: bash
         run: |
           VERSION="${GITHUB_REF_NAME#v}"
-          # Deep-link to this version on the website changelog. The anchor is stable and date-independent:
-          # sync-docs.mjs injects `{#v<version, dots→hyphens>}`; build the same slug here from the tag.
-          CHANGELOG_URL="https://huhamhire.github.io/code-meeseeks/changelog#v$(echo "$VERSION" | tr '.' '-')"
+          # Deep-link to this version on the website changelog, per language. The anchor is stable and
+          # date-independent: sync-docs.mjs injects `{#v<version, dots→hyphens>}` on both locales' pages;
+          # build the same slug here from the tag. EN is the root locale, ZH lives under /zh/.
+          SLUG="v$(echo "$VERSION" | tr '.' '-')"
+          CHANGELOG_EN="https://huhamhire.github.io/code-meeseeks/changelog#${SLUG}"
+          CHANGELOG_ZH="https://huhamhire.github.io/code-meeseeks/zh/changelog#${SLUG}"
           # Extract the body between `## [VERSION] ...` and the next `## [` (index==1 does a literal prefix match, avoiding regex metacharacters)
           awk -v ver="## [$VERSION]" 'index($0,ver)==1{f=1;next} f&&/^## \[/{exit} f{print}' CHANGELOG.md > changelog-section.md
           if [ -s changelog-section.md ]; then
@@ -233,8 +236,9 @@ jobs:
             echo "::warning::CHANGELOG.md has no [$VERSION] section, Release body falls back to the original RELEASE_NOTES.md"
             sed 's/%%CHANGELOG_SECTION%%//' .github/RELEASE_NOTES.md > RELEASE_BODY.tmp
           fi
-          # Fill the version deep-link (use | as the sed delimiter — the URL contains slashes)
-          sed "s|%%CHANGELOG_URL%%|${CHANGELOG_URL}|" RELEASE_BODY.tmp > RELEASE_BODY.md
+          # Fill the per-language version deep-links (use | as the sed delimiter — the URLs contain slashes)
+          sed -e "s|%%CHANGELOG_URL_EN%%|${CHANGELOG_EN}|" -e "s|%%CHANGELOG_URL_ZH%%|${CHANGELOG_ZH}|" \
+            RELEASE_BODY.tmp > RELEASE_BODY.md
 
       - name: Upload to Release (single point)
         uses: softprops/action-gh-release@v2

AGENTS.md

@@ -62,6 +62,8 @@ npm --prefix apps/desktop run prepare:pragent    # align the embedded pr-agent r
 
 `npm install` (not `npm ci`) resolves against `package.json` and writes the lockfile back, keeping local and remote `package-lock.json` consistent; `prepare:pragent` is idempotent and aligns the local pr-agent runtime per `pragent-runtime.json` (skips if the version is unchanged, only syncing the shim). If the lockfile changes, commit it together with the change it belongs to.
 
+**Vulnerability-alert fixes — no `overrides`**: resolve a Dependabot / `npm audit` advisory only by upgrading the actual direct or parent dependency — **never** with npm `overrides` (or any other transitive version-pin hack). Overrides mask the real dependency graph and silently break on the parent's next update. When there is no clean parent upgrade (a transitive vuln pinned by a parent that has no patched release — e.g. `monaco-editor` pinning `dompurify`, or `vitepress` pinning `vite`), **prefer to leave it unpatched** over forcing an override. File a long-term **tracking issue** for advisories worth following (typically a **runtime** dependency); **dev-server-only tool-chain** advisories that never reach the shipped artifact (e.g. the `vite`/`esbuild` dev server under the website) may simply be left with no issue.
+
 ## Required before committing
 
 After changing code, run these four steps locally before wrapping up (this is exactly what CI does): `lint` → `typecheck` → `test` → `build`. lint is zero-tolerance (`--max-warnings=0`), and a warning will turn CI red.
@@ -101,6 +103,7 @@ Release: merge `dev` into `master` → tag `v*` on `master`, which triggers [rel
 - **PR descriptions in English**: the PR title and body are always in **English** (an external collaboration surface, consistent with English commits); the base branch points at `dev` per the branch strategy.
 - **Label PRs**: after opening / updating a PR, **habitually label it** — pick the most fitting one or more from the repo's existing label set (`gh label list`: enhancement / documentation / bug / …) and apply them (`gh pr edit <n> --add-label`). If no existing label fits, create one as needed or leave it empty with a note — don't force a poor fit.
 - **Uniform platform display order**: code platforms (GitHub / Bitbucket / GitLab …) are displayed everywhere in the uniform order **GitHub → Bitbucket → GitLab**, and **a new platform is always appended at the end**. The reference is the `PLATFORM_META` array in [PlatformIcon.tsx](apps/desktop/src/renderer/src/components/common/PlatformIcon.tsx); the settings-page platform dropdown, the first-launch wizard grid, the user doc [docs/guide/01-code-platform.md](docs/guide/01-code-platform.md), the `PlatformKind` type, etc. all follow this order — align them together when changing the platform list to avoid mismatches.
+- **Comment interactions are identical across all surfaces**: every comment-interaction behavior — emoji reactions, `@mention` (local candidates + remote repo-scoped user search), image attachments, reply / edit / delete — must behave **the same** on every comment surface: the comments/activity page (`CommentItem`), the inline diff comment zone (`InlineCommentZone`), and the inline draft editor (`DraftZone`). Enforce this by **sharing the leaf components / hooks** (`CommentReplyEditor`, `MentionTextarea`, `useReactions`, `useCommentThread`) rather than reimplementing per surface — surfaces may differ only in layout, never in interaction behavior. When adding or changing an interaction, thread the same props down **every** path (ActivityPanel→CommentItem, DiffView→useCommentZones→InlineCommentZone, DiffView→useDraftZones→DraftZone); a capability reaching only one surface is a bug, not a scope choice. Full rationale in [docs/arch/01-platform/04-comment-interactions.md](docs/arch/01-platform/04-comment-interactions.md).
 
 ## Internationalization (i18n)
 

CHANGELOG.md

@@ -5,6 +5,36 @@
 All notable changes to this project are recorded here. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and the versioning follows [Semantic Versioning](https://semver.org/).
 
+## [0.11.0] - 2026-07-07
+
+> Highlights of this release:
+>
+> - **Richer `@mention`**: autocomplete now searches users beyond the PR's participants on the code platform (GitHub / Bitbucket / GitLab), so you can mention anyone without knowing their exact username — and mentioning behaves consistently across every comment editor, including inline diff comments and review drafts.
+> - **Review engine updated**: the embedded pr-agent moves to 0.39.0, picking up upstream model-provider routing improvements and fixes.
+> - **Consistent timestamps**: displayed times now use a fixed, locale-independent 24-hour `yyyy-mm-dd HH:mm:ss` format.
+>
+> The rest of the release is a batch of review-experience fixes (security-result wording, single-line file diffs, inline-comment width, token-rotation auth, and more).
+
+### ✨ Added
+
+- `@mention` autocomplete can now find users beyond this PR's participants: after the local suggestions, it searches matching users on the code platform (GitHub / Bitbucket / GitLab), so you can mention someone without knowing their exact username. It works consistently in every comment editor — the activity composer, replies (including inline diff comment replies), and review drafts.
+
+### ♻️ Changed
+
+- Updated the embedded review engine (pr-agent) to 0.39.0, picking up upstream model-provider routing improvements and fixes.
+- Displayed timestamps now use a consistent, locale-independent format — 24-hour `yyyy-mm-dd HH:mm:ss`, with same-day times showing only `HH:mm:ss` — instead of following the OS locale (so they no longer differ from the app's language or between machines).
+
+### 🔧 Fixed
+
+- Inline review-draft comments now offer `@mention` participant autocomplete, matching the activity and reply composers.
+- `@mentions` of a Bitbucket username containing special characters (e.g. a dot) are now inserted in the correctly quoted form, so the mention resolves and notifies the user.
+- The review "Security" result now reads unambiguously when there are no concerns (a consistent "no security concerns") instead of a terse "No" that could be mistaken for a warning.
+- Reviews of single-line file changes (e.g. a `VERSION` or hash file) no longer misread the change as the file containing both the old and new value.
+- Inline comments no longer render at the wrong width (spilling past the editor) when a commented file is opened from the file tree — a manual window resize is no longer needed.
+- The close button on the enlarged comment-image preview no longer sits beneath the window controls, and its icon is centered.
+- Fetching upstream code no longer fails with an authentication error after a code-platform access token is changed (which previously required clearing the repo cache to recover).
+- The default AI-suggestion draft layout again wraps its linked label and model name in brackets (the intended `[label (model)]` form).
+
 ## [0.10.0] - 2026-07-05
 
 > Highlights of this release:
@@ -435,6 +465,7 @@ and the versioning follows [Semantic Versioning](https://semver.org/).
 
 License: [Apache-2.0](LICENSE). The package bundles third-party components (pr-agent, Electron, etc.), each distributed under its own license, see [NOTICE](NOTICE).
 
+[0.11.0]: https://github.com/huhamhire/code-meeseeks/compare/v0.10.0...v0.11.0
 [0.10.0]: https://github.com/huhamhire/code-meeseeks/compare/v0.9.0...v0.10.0
 [0.9.0]: https://github.com/huhamhire/code-meeseeks/compare/v0.8.0...v0.9.0
 [0.8.0]: https://github.com/huhamhire/code-meeseeks/compare/v0.7.0...v0.8.0

CHANGELOG.zh-CN.md

@@ -5,6 +5,36 @@
 本项目所有重要变更记录于此。格式参考 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.1.0/)，
 版本号遵循 [语义化版本](https://semver.org/lang/zh-CN/)。
 
+## [0.11.0] - 2026-07-07
+
+> 本次发布要点：
+>
+> - **更强的 `@` 提及**：自动补全现会到代码平台（GitHub / Bitbucket / GitLab）检索 PR 参与者以外的用户，让你无需知道对方的准确用户名即可提及；且在所有评论编辑器（含行内差异评论与评审草稿）中行为一致。
+> - **评审引擎升级**：内置 pr-agent 升级至 0.39.0，纳入上游的模型服务商路由改进与修复。
+> - **统一的时间显示**：界面时间戳统一为与地区无关的 24 小时制 `yyyy-mm-dd HH:mm:ss` 格式。
+>
+> 其余为一批评审体验修复（安全结论措辞、单行文件差异、行内评论宽度、令牌轮换鉴权等）。
+
+### ✨ 新增
+
+- `@` 提及的自动补全现可检索 PR 参与者以外的用户：在本地候选之后，会到代码平台（GitHub / Bitbucket / GitLab）检索匹配的用户，让你无需知道对方的准确用户名即可提及。在所有评论编辑器中行为一致——活动输入框、回复（含行内差异评论的回复）以及评审草稿。
+
+### ♻️ 变更
+
+- 将内置评审引擎（pr-agent）升级至 0.39.0，纳入上游的模型服务商路由改进与修复。
+- 界面中展示的时间戳统一为与地区无关的固定格式——24 小时制 `yyyy-mm-dd HH:mm:ss`，当天时间仅显示 `HH:mm:ss`——不再跟随操作系统区域设置（因而不会与应用语言不一致，也不会在不同机器上呈现不同格式）。
+
+### 🔧 修复
+
+- 行内评审草稿评论现支持 `@` 提及参与者的自动补全，与活动 / 回复输入框一致。
+- Bitbucket 用户名包含特殊字符（如点号）时，`@` 提及会以正确的引号形式插入，确保提及生效并通知到对方。
+- 评审「安全」结论在无风险时表达更清晰（统一为「未发现安全风险」），不再是易被误读为告警的简短「否」。
+- 单行文件变更（如 `VERSION` 或哈希文件）的评审不再把改动误读为文件同时包含新旧两个值。
+- 通过文件树打开带评论的文件时，行内评论不再出现宽度计算错误（超出编辑器区域），也无需再手动缩放窗口恢复。
+- 放大的评论图片预览：关闭按钮不再被窗口控件遮挡，且图标居中显示。
+- 更换代码平台访问令牌后，拉取上游代码不再因鉴权失败而报错（此前需清理仓库缓存才能恢复）。
+- 默认的 AI 建议草稿排版重新以方括号包裹其链接标签与模型名（恢复为预期的 `[标签 (模型)]` 形式）。
+
 ## [0.10.0] - 2026-07-05
 
 > 本版重点：
@@ -435,6 +465,7 @@
 
 许可证：[Apache-2.0](LICENSE)。打包内含第三方组件（pr-agent、Electron 等），各按其许可证分发，见 [NOTICE](NOTICE)。
 
+[0.11.0]: https://github.com/huhamhire/code-meeseeks/compare/v0.10.0...v0.11.0
 [0.10.0]: https://github.com/huhamhire/code-meeseeks/compare/v0.9.0...v0.10.0
 [0.9.0]: https://github.com/huhamhire/code-meeseeks/compare/v0.8.0...v0.9.0
 [0.8.0]: https://github.com/huhamhire/code-meeseeks/compare/v0.7.0...v0.8.0

apps/desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meebox/desktop",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "private": true,
   "description": "meebox Electron desktop app",
   "author": {

apps/desktop/scripts/pragent-runtime.json

@@ -8,6 +8,6 @@
   },
   "prAgent": {
     "_comment": "嵌入式运行时安装的 pr-agent 版本（pinned）；须与 sitecustomize.py 的 _EXPECTED_PRAGENT_VERSION 对齐，升级时两处同步",
-    "version": "0.36.0"
+    "version": "0.39.0"
   }
 }

apps/desktop/scripts/pragent-shim/meebox_pragent_shim/__init__.py

@@ -10,6 +10,7 @@
 applied it silently degrades, never letting a shim exception block the flow.
 """
 from .patches.describe_assessment import patch as _patch_describe_assessment
+from .patches.git_patch_processing import patch as _patch_git_patch_processing
 from .patches.litellm_handler import patch as _patch_litellm_handler
 from .patches.load_yaml import patch as _patch_load_yaml
 from .patches.local_git_provider import patch as _patch_local_git_provider
@@ -39,4 +40,11 @@ def apply() -> None:
         "pr_agent.tools.pr_description",
         _patch_describe_assessment,
     )
+    # git patch processing: fix the phantom "unchanged" line on single-line hunks (omitted hunk size defaulted to 0
+    # instead of 1), which made single-line file changes look like they contained both the old and new value. Self-
+    # disabling once upstream fixes it — see patches/git_patch_processing.py.
+    _register_post_import(
+        "pr_agent.algo.git_patch_processing",
+        _patch_git_patch_processing,
+    )
     _debug("meebox shim loaded")