feat(web): improve PR review and agent workflows

[Bil0000]

What Changed

The PR page lacks parts of the conversation and host history, and preparing an agent task often requires leaving the page. This change keeps those steps in the existing PR page and shared right panel.

• Show review conversations with their replies in Summary and Timeline. Reuse the Code tab's reply, edit, resolve, and load-more controls. Add quote replies for top-level comments, copy-link actions, and unresolved-only navigation.
• Show native host events with the actor and time, including close/reopen history. Show related PRs from host cross-references and explicit PR links. Avoid duplicate synthetic merge/close rows.
• Offer source-branch deletion after close or merge. The confirmation names the exact source repository and branch. Each host rechecks the PR, source repository, and default/target branches before deletion, including forks. Deletion requires known access to the source repository or branch on all four hosts; unknown access keeps the action unavailable.
• Add PR notes, comments, and selected code to an agent composer. Choose a new or existing thread for notes, or choose a server, project, and local checkout/worktree for a fix. Right-panel fixes can still use the current thread. Nothing is sent to an agent automatically.
• Save project exclusions per environment and project, with an include-again control. Excluded projects are removed from list reads and cached rows; direct PR links still work.
• Keep drafts through refresh and failed writes, show useful failure details and recovery hints, and summarize reported merge blockers.

Why

The implementation uses the existing UI controls, conversation card, composer handoff, and source-control adapters. Optional activity and permission fields keep older clients compatible. The new deletion action is not advertised through legacy action arrays, and missing deletion permissions or source identity keep the action unavailable.

Verification

• 606 server PR tests and 354 web PR tests passed.
• 26 contract/client-runtime PR tests passed.
• Web and server typechecks, scoped lint, formatting, and whitespace checks passed.
• Real browser checks covered reply drafts across refresh, note-to-composer handoff, native close/reopen actors, exclusion persistence and restore, unresolved-only navigation, checkout choices, and exact-source deletion confirmation. No external comment, merge, or branch deletion was performed.
• Independent code review and a simplicity review passed.

UI Changes

The integrated browser pass used public PR data in an isolated local environment. Before/after screenshots and a 25-second note/checkout demo were recorded. GitHub's official attachment preview refused uploads because the contributing account does not have write access to this repository; the media is retained locally.

Scope and limits

GitHub, GitLab, Azure DevOps, and Bitbucket have focused adapter tests. The integrated browser pass uses GitHub; live writes against the other hosts were not performed. Events and actions follow the data and capabilities each host exposes. Related-PR links do not guess whether a bare issue number is a PR. Review-decision blockers appear only when the host reports them. GitHub timeline reads stop after 1,000 host records and show a link to the full host history when capped.

GitHub and Azure branch deletion use an expected commit ID to reject a branch that moves before deletion. GitLab and Bitbucket expose no conditional-delete option in their branch APIs, so a branch can move between validation and deletion. PR state and default-branch checks are separate host reads on all four providers.

Web and desktop share this PR interface. Mobile has no corresponding PR page in this branch; the shared wire changes remain optional.

Checklist

• Explained the behavior and its limits
• Added focused regression coverage
• Upload before/after images and the interaction video (blocked by repository upload permissions)
• Completed an independent code and simplicity review

Built with GPT-6 Astra and GPT-5.6 Sol in the Codex harness.

Note

Add source-branch deletion, native timeline events, and review/agent workflow improvements to pull requests

• Adds delete-source-branch as a new pull-request action across GitHub, GitLab, Bitbucket, and Azure DevOps, with per-provider source repository permission checks, safety guards against deleting protected/default branches, and a structured PullRequestBranchDeletionError error type
• Introduces native timeline event decoding and timelineTruncated flag for all four providers; system notes and activity events are now surfaced as PullRequestTimelineEvent records instead of being dropped or misclassified as comments
• Reworks the web UI: PR detail shows attention items (conflicts, required reviews, failed checks), related pull requests, and review conversations with unresolved-only filtering and next-unresolved navigation; comment bodies expose reply, copy-link, and agent-handoff actions via PullRequestCommentActions
• Adds project exclusion filtering to the PR list route with separate persistence, filter menu toggles, and an all-projects-excluded empty state
• Adds agent ask/handoff flows to PullRequestDetailPanel with selectable server, project, destination, and thread; wraps tab content in PullRequestCommentAgentContext so comment actions can invoke the handoff flow
• Risk: decodeThreadsJson (Azure) and decodeNotesJson (GitLab) changed their return shape from a comment array to an object { comments, timelineEvents }; all in-tree callers are updated, but out-of-tree consumers of these decoders will break. PullRequestTimelineEvent.kind changed from a fixed union to string to accommodate native host event kinds.

^{Macroscope summarized dcfa00b.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds broad cross-provider PR workflows, including host-side source-branch deletion, timeline ingestion, richer conversations, agent handoffs, and persistent filtering. The destructive mutation and the amount of new server, contract, and UI behavior require human review.

^{You can add or adjust custom eligibility rules. Learn more.}