feat: complete Q2-Q3 2026 roadmap — collaboration, perf optimization, view transitions, DnD sidebar, ETag caching by Copilot · Pull Request #463 · objectstack-ai/objectui

Copilot · 2026-02-12T02:53:24Z

Implements all remaining code-deliverable items from the 2026 roadmap (Q2 2.1, Q3 3.1–3.4), bringing spec compliance from 96% → 98%.

New package: `@object-ui/collaboration`

useRealtimeSubscription — WebSocket subscriptions with auto-reconnect, exponential backoff, message buffering
usePresence — cursor/selection tracking, idle/away detection via activity listeners, throttled updates
useConflictResolution — version history, conflict queue, resolution strategies (local/remote/merge), version diffing
CommentThread — threaded comments with @mention suggestions, replies, resolve/reopen
LiveCursors / PresenceAvatars — remote cursor overlay and avatar stack components
Enhanced CollaborationProvider in plugin-designer with actual WebSocket transport, presence sync, version counting

Performance optimization (Q3 3.3)

usePerformanceBudget — LCP/FCP/render-time/memory budget enforcement with violation tracking and dev-mode console warnings
Route-based code splitting in console App.tsx — 13 routes lazy-loaded via React.lazy + Suspense (main bundle reduced ~100KB)
PerformanceDashboard — dev-mode floating panel (Ctrl+Shift+P) showing Web Vitals, memory usage, budget violations

View transitions (Q3 3.4)

useViewTransition — wraps browser View Transitions API with CSS class fallback, respects prefers-reduced-motion
ViewSwitcher gains animated prop that calls document.startViewTransition() on view type changes

DnD sidebar reordering (Q2 2.1)

HTML5 native drag-and-drop on sidebar nav items, scoped per group, persisted to localStorage per app

ETag caching + Service Worker (Q3 3.1)

useETagCache — If-None-Match/If-Modified-Since aware fetch, LRU in-memory cache with optional localStorage persistence, SW registration

Security hardening

WebSocket URL protocol validation (ws:/wss: only) in useRealtimeSubscription and CollaborationProvider
localStorage JSON shape validation in sidebar DnD to prevent prototype pollution
Fetch URL protocol validation (http:/https: only) in useETagCache

Tests

35 new tests across 6 files. All 42 builds pass, 3181/3185 tests pass (2 pre-existing failures, 2 skipped).

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

vercel · 2026-02-12T02:53:29Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
objectui	Ready	Preview, Comment	Feb 12, 2026 4:01am
objectui-demo	Canceled		Feb 12, 2026 4:01am
objectui-storybook	Error		Feb 12, 2026 4:01am

…tion (Q3 3.2) Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

…t (ROADMAP Q3 3.3) Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

…s (Q3 3.4) Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

…r integration (Q3 3.1) Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

- Add useNavOrder hook for localStorage-persisted navigation ordering - Add HTML5 native drag-and-drop to NavigationItemRenderer with visual drop indicator - Create PerformanceDashboard component with Web Vitals, memory, render metrics - Dashboard integrates with usePerformance and usePerformanceBudget hooks - Toggle via Ctrl+Shift+P or floating button, dev-mode only Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

…rovider WebSocket, ROADMAP updates Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

…torage JSON sanitization, fetch URL validation Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

Copilot

Pull request overview

This PR implements several remaining Q2–Q3 2026 roadmap items across the runtime hooks, console app UX/perf tooling, and collaboration capabilities, with accompanying ROADMAP updates.

Changes:

Added new React runtime hooks: useViewTransition, usePerformanceBudget, and useETagCache (plus tests).
Introduced @object-ui/collaboration package with realtime subscription, presence, conflict resolution, and UI components.
Enhanced console UX/perf: route-based lazy loading, dev-only Performance Dashboard, and sidebar drag-and-drop reordering; plus View Transitions support in ViewSwitcher and WebSocket support in designer CollaborationProvider.

Reviewed changes

Copilot reviewed 25 out of 26 changed files in this pull request and generated 17 comments.

Show a summary per file

File	Description
pnpm-lock.yaml	Adds workspace importer for `packages/collaboration` and updates lock snapshots.
packages/react/src/hooks/useViewTransition.ts	New hook wrapping View Transitions API with reduced-motion and fallback behavior.
packages/react/src/hooks/usePerformanceBudget.ts	New hook for performance budget enforcement and violation tracking.
packages/react/src/hooks/useETagCache.ts	New ETag-aware fetch hook with LRU/TTL and optional SW registration.
packages/react/src/hooks/index.ts	Re-exports the new hooks from `@object-ui/react`.
packages/react/src/hooks/tests/*	Adds tests for new runtime hooks.
packages/plugin-list/src/ViewSwitcher.tsx	Adds `animated` view switching using the View Transitions API when available.
packages/plugin-designer/src/CollaborationProvider.tsx	Adds WebSocket transport/presence wiring and version counting fields.
packages/collaboration/*	New collaboration package (hooks/components + tests + build config).
apps/console/src/components/PerformanceDashboard.tsx	Adds dev-only floating performance dashboard UI.
apps/console/src/components/AppSidebar.tsx	Adds localStorage-persisted HTML5 DnD nav reordering.
apps/console/src/App.tsx	Adds route-based code splitting via `React.lazy` + `Suspense`.
ROADMAP.md	Marks roadmap items complete and updates compliance percentages.

Files not reviewed (1)

pnpm-lock.yaml: Language not supported

Copilot · 2026-02-12T04:06:09Z

+          sendPresenceRef.current(updated);
+          return updated;
+        });
+      }, awayTimeout - idleTimeout);


awayTimeout - idleTimeout can be negative if a caller configures awayTimeout smaller than idleTimeout, which results in an immediate timeout and flips users to away unexpectedly. Consider clamping the delay (e.g. Math.max(0, awayTimeout - idleTimeout)) or enforcing awayTimeout >= idleTimeout.

Suggested change

}, awayTimeout - idleTimeout);

}, Math.max(0, awayTimeout - idleTimeout));

Copilot · 2026-02-12T04:06:09Z

+      const result: Record<string, string[]> = {};
+      for (const [k, v] of Object.entries(parsed as Record<string, unknown>)) {


The localStorage “shape validation” still assigns arbitrary keys from parsed JSON onto a plain object (result[k] = ...). If k is __proto__ / constructor / prototype, this can trigger prototype pollution. Consider building result with Object.create(null) and/or explicitly rejecting those keys before assignment.

Suggested change

const result: Record<string, string[]> = {};

for (const [k, v] of Object.entries(parsed as Record<string, unknown>)) {

const result = Object.create(null) as Record<string, string[]>;

for (const [k, v] of Object.entries(parsed as Record<string, unknown>)) {

// Avoid prototype pollution from malicious localStorage keys

if (k === '__proto__' || k === 'constructor' || k === 'prototype') {

continue;

}

Copilot · 2026-02-12T04:06:10Z

+      // 304 Not Modified — serve from cache
+      if (res.status === 304 && cached) {
+        touchAccessOrder(url);
+        return { data: cached.data, fromCache: true, etag: cached.etag };


On 304 Not Modified, the cached entry is returned but its timestamp is not refreshed. With TTL enabled, a frequently-accessed resource can still expire and stop sending conditional headers even though the server confirmed it is unchanged. Consider updating the cache entry timestamp (and persisting if needed) when serving a 304.

Suggested change

// 304 Not Modified — serve from cache

if (res.status === 304 && cached) {

touchAccessOrder(url);

return { data: cached.data, fromCache: true, etag: cached.etag };

// 304 Not Modified — refresh cache metadata and serve from cache

if (res.status === 304 && cached) {

const refreshedEntry: CacheEntry<T> = {

...cached,

timestamp: Date.now(),

};

setEntry(url, refreshedEntry);

touchAccessOrder(url);

return { data: refreshedEntry.data, fromCache: true, etag: refreshedEntry.etag };

Copilot · 2026-02-12T04:06:10Z

+  const [remoteUsers, setRemoteUsers] = useState<Map<string, PresenceUser>>(new Map());
+  const [currentUser, setCurrentUser] = useState<PresenceUser>(() => ({
+    userId: user.id,


remoteUsers / setRemoteUsers are never updated anywhere in this hook, so users will always be an empty array. This makes the hook unable to "manage a set of remote users" as described. Consider either (a) exposing an API to apply remote presence updates (e.g. updateRemoteUser/removeRemoteUser), or (b) wiring this hook to createPresenceUpdater internally.

Copilot · 2026-02-12T04:06:10Z

      currentUserId: user?.id,
+      connectionState,
+      versionCount: versionRef.current,
    }),
-    [users, isConnected, sendOperation, user?.id],
+    [users, isConnected, sendOperation, user?.id, connectionState],


versionCount is derived from versionRef.current, but updating a ref does not trigger a re-render. As a result, consumers of the context will not see versionCount change when sendOperation is called. Consider tracking the version in state (or deriving it from operations) and including that state in the context value dependencies.

Copilot · 2026-02-12T04:06:12Z

+        <SidebarMenuItem
+            draggable
+            onDragStart={(e: React.DragEvent) => {
+                e.dataTransfer.effectAllowed = 'move';
+                dnd?.onDragStart(groupKey, item.id);


Sidebar reordering is currently mouse/touch drag-and-drop only. This is not keyboard-accessible, and draggable elements can be hard to use with assistive tech. Consider adding a keyboard alternative (e.g. "Move up/down" actions) so reordering is possible without a pointer.

Copilot · 2026-02-12T04:06:12Z

+const styles = {
+  thread: {
+    fontFamily: '-apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif',
+    fontSize: '14px',
+    lineHeight: '1.5',


This component hard-codes many light-theme colors via inline styles (e.g. #fff, #e2e8f0, #475569). In apps that support theming (including dark mode), this will likely render incorrectly and be difficult to customize. Consider switching to Tailwind classes using theme tokens/CSS variables (or exposing className hooks for key parts).

Copilot · 2026-02-12T04:06:13Z

+  // Connect on mount, disconnect on unmount
+  useEffect(() => {
+    mountedRef.current = true;
+    if (url) {
+      connect();


The mount effect suppresses react-hooks/exhaustive-deps and doesn’t depend on connect(), even though connect() is parameterized by other options (autoReconnect/backoff limits). If those options change, the hook may keep reconnecting with stale settings. Consider depending on connect (and making it stable) rather than disabling the lint rule.

Copilot · 2026-02-12T04:06:13Z

+      const data = (await res.json()) as T;
+      const etag = res.headers.get('etag') ?? undefined;
+      const lastModified = res.headers.get('last-modified') ?? undefined;
+
+      if (etag || lastModified) {


res.json() is called unconditionally. For non-2xx responses (and for some valid responses like 204), this can throw and/or cause error payloads to be treated like cached data. Consider checking res.ok (and possibly content-type) before parsing/caching, and surfacing a structured error for non-OK responses.

Copilot · 2026-02-12T04:06:13Z

+    const wsUrl = authToken ? `${url}?token=${encodeURIComponent(authToken)}&channel=${encodeURIComponent(channel)}` : `${url}?channel=${encodeURIComponent(channel)}`;
+


wsUrl is built via string concatenation with ?token=...&channel=.... If url already contains query params or a hash, this will produce an invalid URL. Consider constructing this with new URL(url) and searchParams.set(...) to ensure correct encoding and merging.

Initial plan

ade6189

Copilot AI assigned Copilot and hotlong Feb 12, 2026

Copilot started work on behalf of hotlong February 12, 2026 02:56 View session

Copilot AI and others added 7 commits February 12, 2026 03:06

feat: create @object-ui/collaboration package for real-time collabora…

bfed0c1

…tion (Q3 3.2) Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

feat: add usePerformanceBudget hook for performance budget enforcemen…

0c23475

…t (ROADMAP Q3 3.3) Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

feat: add useViewTransition hook and ViewSwitcher animated transition…

abfdfa7

…s (Q3 3.4) Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

feat(react): add useETagCache hook for ETag caching and Service Worke…

42cce4c

…r integration (Q3 3.1) Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

fix: remove unused applyOrder from dndValue useMemo deps

3a8c2fc

Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

Add test files for new hooks and collaboration package

e2f4386

Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

vercel Bot had a problem deploying to Preview – objectui-storybook February 12, 2026 03:37 Failure

Copilot AI and others added 2 commits February 12, 2026 03:43

feat: complete remaining roadmap items - lazy loading, CollaborationP…

e4d75ee

…rovider WebSocket, ROADMAP updates Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

fix: add security validations - WebSocket URL protocol checks, localS…

7e920c0

…torage JSON sanitization, fetch URL validation Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Continue completing all development as per roadmap~~ feat: complete Q2-Q3 2026 roadmap — collaboration, perf optimization, view transitions, DnD sidebar, ETag caching Feb 12, 2026

Copilot AI requested a review from hotlong February 12, 2026 03:52

Copilot finished work on behalf of hotlong February 12, 2026 03:52

vercel Bot deployed to Preview – objectui-demo February 12, 2026 03:55 View deployment

vercel Bot had a problem deploying to Preview – objectui-storybook February 12, 2026 03:56 Failure

hotlong marked this pull request as ready for review February 12, 2026 03:57

Copilot AI review requested due to automatic review settings February 12, 2026 03:57

hotlong merged commit 1d87e06 into main Feb 12, 2026
4 of 6 checks passed

Copilot started reviewing on behalf of hotlong February 12, 2026 03:58 View session

hotlong approved these changes Feb 12, 2026

View reviewed changes

vercel Bot deployed to Preview – objectui February 12, 2026 04:01 View deployment

Copilot AI reviewed Feb 12, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: complete Q2-Q3 2026 roadmap — collaboration, perf optimization, view transitions, DnD sidebar, ETag caching#463

feat: complete Q2-Q3 2026 roadmap — collaboration, perf optimization, view transitions, DnD sidebar, ETag caching#463
hotlong merged 10 commits intomainfrom
copilot/complete-development-roadmap

Copilot AI commented Feb 12, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Feb 12, 2026 •

edited

Loading

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	}, awayTimeout - idleTimeout);
	}, Math.max(0, awayTimeout - idleTimeout));

		const result: Record<string, string[]> = {};
		for (const [k, v] of Object.entries(parsed as Record<string, unknown>)) {

-      const result: Record<string, string[]> = {};
-      for (const [k, v] of Object.entries(parsed as Record<string, unknown>)) {
+      const result = Object.create(null) as Record<string, string[]>;
+      for (const [k, v] of Object.entries(parsed as Record<string, unknown>)) {
+        // Avoid prototype pollution from malicious localStorage keys
+        if (k === '__proto__' || k === 'constructor' || k === 'prototype') {
+          continue;
+        }

		const wsUrl = authToken ? `${url}?token=${encodeURIComponent(authToken)}&channel=${encodeURIComponent(channel)}` : `${url}?channel=${encodeURIComponent(channel)}`;

Conversation

Copilot AI commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

New package: @object-ui/collaboration

Performance optimization (Q3 3.3)

View transitions (Q3 3.4)

DnD sidebar reordering (Q2 2.1)

ETag caching + Service Worker (Q3 3.1)

Security hardening

Tests

Uh oh!

vercel Bot commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Feb 12, 2026 •

edited

Loading

New package: `@object-ui/collaboration`

vercel Bot commented Feb 12, 2026 •

edited

Loading