* feat: add DocumentSegment for inline HTML/SVG/Mermaid rendering

Agent responses containing full documents (HTML reports, SVG diagrams,
Mermaid charts) were previously truncated to 4000 chars server-side,
then stripped of all HTML tags by rehype-sanitize, leaving only raw
text. This three-layer failure made rich documents unreadable.

Add a general DocumentSegment type to the artifact pipeline:

- extractDocumentSpans(): two-pass detection — fenced code blocks with
  document languages (html/svg/mermaid, ≥500 chars) and inline HTML
  documents (≥1000 chars), including truncated streams missing </html>
- Server sanitizer: raise text limit to 32K for document-containing
  events, with HTML-safe truncation at tag boundaries
- InlineArtifactCard: new InlineDocumentCard with 240px sandboxed
  iframe preview in the timeline
- ArtifactView: new DocumentFrame for full-height left-panel preview
- Mermaid content wrapped in an HTML shell with CDN mermaid@11

13 new test cases covering extraction, resolution, and edge cases.

Change-Id: I76108b0e606938fc5f3cbc34d7f78d6b52dadcd8
Co-developed-by: Qoder CLI <noreply@qoder.com>

* fix: allow scrolling in InlineDocumentCard iframe preview

Remove pointer-events:none from .inline-document-frame so users can
scroll inside the 240px iframe preview to inspect document content.

Change-Id: I6288215632c55aeb2b61315d9d219dbd22c55e30
Co-developed-by: Qoder CLI <noreply@qoder.com>

* fix: replace real domain URLs with example.test in tests

Address CodeQL "Incomplete URL substring sanitization" finding by
using reserved example.test domains instead of fonts.googleapis.com
in test fixtures.

Change-Id: I38596faa833c770757bcf91131d99a72e8868d21
Co-developed-by: Qoder CLI <noreply@qoder.com>

* Complete deployment API lifecycle support

Change-Id: Id64addfb4d90b3f879d37951c9099b7225644051

* Connect schedule UI to native deployments

Change-Id: If67249ef2946589a4456738b79f57671e6b9ed4d

Change-Id: I439a2ea39bfc85d8d8a1e8d9ee9bc44327156ce7

…ction (#54)

When Qoder agents execute tools, the session transitions through
idle(requires_action) before resuming. Three issues caused session run
to produce no output or hang:

1. Qoder mapper treated session.status_idle with stop_reason
   requires_action as terminal idle, causing poll/stream to exit before
   tool results and the final reply arrived. Fixed by mapping it to
   running.

2. streamWithResume did a single yield* of the SSE stream. When Qoder
   closes the SSE connection after requires_action, the generator exited
   without reconnecting. Added a reconnect loop with exponential backoff
   that continues until a true terminal status event arrives.

3. SSE parser in base-client discarded the id: field from SSE frames,
   so event.id was always undefined and stream reconnection could not
   skip already-consumed events. Now extracts id: and injects it into
   the parsed payload.

Additionally, polling in collectEventsUntilTerminal now uses exponential
backoff (300ms initial, doubling to 2s cap) instead of a fixed 2s
interval, reducing first-response latency.

Change-Id: Ieefe7ad827516f92fcfff3023600564d9eff0eec
Co-developed-by: OpenCode <noreply@opencode.ai>

* Guide sessions into mounted Git working trees

Change-Id: I5af1ca42d79c4d94cdf8f4e3a7d799e0270fce4e

* Fix sandbox mount prompt regex scanning

Change-Id: I3be5fd219283020e88121c24cfa8d888915cd2d3

* Update Hono node server for audit

Change-Id: I2dacf2c9b99070da7593ac0c9293dd3034c4d102

When upgrading the CLI (e.g. from stable to beta), a previously-started
playground process may still occupy the default port. The new instance
silently binds to the next port, but the browser opens the old one —
leaving the user stuck on a stale UI.

Changes:

- playground /health now returns { playground: { version, pid } } so the
  CLI can identify what is running on the port
- CLI probes the target port before spawning a new playground:
  - same version → reuse the existing instance, open browser, exit
  - different version → SIGTERM the old process, wait for port release,
    then start the new version
  - non-playground / no response → proceed normally (backward-compatible)
- Add Cache-Control: no-cache to static assets served by the playground
  to prevent browsers caching stale JS/CSS across upgrades (filenames
  are stable, not content-hashed, due to console embed constraints)

Change-Id: Ida50d15b60802fc8b56e13d2d9318c2cc077ad46
Co-developed-by: OpenCode <noreply@opencode.ai>

* feat(sdk): add injectable fetch transport seam and route all provider requests through it

* feat(sdk): let bailian provider accept base_url instead of workspace_id

* fix(sdk): honor base_url in bailian runtime readiness and sync placeholder

…yment (#58)

- Move deployment creation from /schedule page into an inline popover
  on the DeploymentButton, so users never leave the composer context
- /deployments route is now a pure management page (list, pause, run, delete)
- Rename all schedule references to deployment:
  - ScheduleButton → DeploymentButton, ScheduleCenter → DeploymentCenter
  - lib/schedule.ts → lib/deployment.ts, CSS schedule-* → deploy-*
  - Route /schedule → /deployments, TopBar label '定时' → '定时任务'
- Add success state with 'go to deployments' navigation after creation
- Improve run button: Play icon + label + hover tooltip on all actions
- Fix: useId() for unique form element ids (two instances in DOM)
- Fix: try/catch/finally on API calls to prevent stuck busy state
- Fix: mobile popover animation vs transform conflict

Change-Id: I99e7ae5bc3256fe558675aaa4fb6bb1d301c7854
Co-developed-by: OpenCode <noreply@opencode.ai>

* feat: downgrade node version to 18

* fix(ci): build only sdk on node 18

Change-Id: I1113ed2f59d24a7c8973bd8e1b1348141dde6d3e

---------

Co-authored-by: 悟扬 <car534511@alibaba-inc.com>

* chore(deps): bump github/codeql-action/init from 4.37.0 to 4.37.3

Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.37.0 to 4.37.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@99df26d...e4fba86)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix(ci): align CodeQL action versions

Change-Id: I06c6bbbc7846a3f2d266addeddaef9fc0de7f6a6

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: heimanba <371510756@qq.com>

Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.0 to 4.37.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@99df26d...e4fba86)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: mamba <yuankun.yk@alibaba-inc.com>

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@df4cb1c...3d3c42e)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: mamba <yuankun.yk@alibaba-inc.com>