Add provider-neutral link previews and Slack adapter#154
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dac5576858
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| plan_id = plan_id_from(supplied.path, base.path) | ||
| return unless plan_id | ||
|
|
||
| plan = Plan.includes(:created_by_user, :plan_type, :current_plan_version).find_by(id: plan_id) |
There was a problem hiding this comment.
When someone posts a brainstorm plan URL into any Slack channel, this global lookup returns the plan and the unfurl renders its title plus summary/content excerpt, even though CoPlan::Plan.visible_to documents brainstorms as private drafts that should not leak through lists/counts/folders. Because Slack requests are not tied to a CoPlan user, this should either skip private statuses or perform an explicit visibility check before building the preview.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Yup! That's fine!
…resh Prefer this branch's visibility model while genuinely adopting main's new features: - LinkPreviews/Slack unfurls (#154): adopted; context now speaks the visibility language — Private/Archived flagged, published unmarked, never "Draft". plan_og_description delegates to the same builder. - Mermaid comment anchors (#148/#149/#151): adopted; mermaid-settled re-highlighting wired into our no-tabs plan page, anchors-updated re-anchoring wired into our headless comment nav. Clicking a comment mark inside a diagram now opens its thread popover instead of the lightbox (showModal force-hides popovers). - Landing refresh + agent-instructions view (#140): adopted; step copy and mock badge updated to the born-published model (type badge, no status badge). - Status badge menu (#146): superseded — visibility is the only state, toggled by the header eye; status_menu_controller removed. - Attachments dropzone (#147): superseded by our add-modal dropzone; spec selectors reconciled. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
1 participant
Why
CoPlan links should render useful previews in Slack and other providers without coupling core plan metadata to a Square-specific client. A valid CoPlan plan URL is intentionally the preview capability, including for brainstorm plans.
What
CoPlan::LinkPreviewDTO and strict same-origin URL resolver to the enginecoplan-slackRails engine with signed Events API handling, async unfurls, Block Kit rendering, and retry classificationRisk Assessment
Medium — this adds a new optional public webhook surface, but it is disabled without configuration, verifies Slack signatures and timestamps over the raw body, and only resolves same-origin CoPlan URLs without outbound fetching. Preview resolution deliberately bypasses viewer policy for every plan status.
References
spec/system/comment_ux_spec.rb:198); unrelated to this diffGenerated with Amp