web: project-path URLs, syntax highlighting, richer review comments + agent chat

Dashboard (`pyclawd web`) improvements:

- URL maps to the project: the active project lives in the path (`/<project>`)
  with per-project view state (refs, mode, layout, selected file) restored from
  localStorage on reload; FastAPI serves a SPA catch-all so deep links work.
- Server-side syntax highlighting: Pygments (ships with rich) colours diff lines
  using whole-file lexer context, so multi-line constructs render correctly.
- Diff fixes: line-number gutters now tint with their add/del row (the bg-panel
  base was overriding the tint), and every row cell is top-aligned so numbers and
  comment markers pin to the first line when content wraps.
- Review comments redesigned: GitHub-style cards with a markdown editor + live
  preview (react-markdown + remark-gfm), inline edit, caret-at-end on open, and a
  split-view anchor dedup fix.
- Review list grouped by file with click-to-jump (scrolls + flashes the line).
- Agent: stronger, structured review prompt; the agent panel is now an interactive
  chat (resume the session for follow-ups) with a model picker defaulting to sonnet.

Author: blankjul

pyproject.toml

@@ -175,3 +175,10 @@ ignore_missing_imports = true
 [[tool.mypy.overrides]]
 module = ["fastapi", "fastapi.*", "pydantic", "uvicorn", "watchfiles"]
 ignore_missing_imports = true
+
+# Pygments ships transitively with rich (a core dep) and powers the web layer's
+# server-side syntax highlighting (src/pyclawd/web/highlight.py), but publishes no
+# type stubs. Scope the missing-import allowance to it alone.
+[[tool.mypy.overrides]]
+module = ["pygments", "pygments.*"]
+ignore_missing_imports = true

src/pyclawd/web/app.py

@@ -26,8 +26,7 @@
 from pathlib import Path
 
 from fastapi import FastAPI, HTTPException
-from fastapi.responses import StreamingResponse
-from fastapi.staticfiles import StaticFiles
+from fastapi.responses import FileResponse, StreamingResponse
 from pydantic import BaseModel
 
 from .git import WORKING_TREE, GitRepo, Ref
@@ -91,12 +90,16 @@ class AgentBody(BaseModel):
 
     ``full_access`` chooses the permission mode: ``True`` lets the agent run commands
     as well as edit files (``bypassPermissions``); ``False`` is edits-only
-    (``acceptEdits``) — safer, but it can't run shell commands.
+    (``acceptEdits``) — safer, but it can't run shell commands. ``model`` is a CLI
+    model alias (``sonnet``/``opus``/``haiku``); ``resume`` continues an existing
+    ``claude`` session by id, turning the one-shot run into an interactive chat.
     """
 
     project: str
     prompt: str
     full_access: bool = False
+    model: str | None = None
+    resume: str | None = None
 
 
 #: The pyclawd verbs the dashboard can launch, mapped to their argv. An allowlist —
@@ -275,7 +278,7 @@ def agent_run(body: AgentBody) -> StreamingResponse:
         if shutil.which("claude") is None:
             raise HTTPException(status_code=400, detail="the 'claude' CLI is not on PATH")
         return StreamingResponse(
-            _agent_stream(Path(path), body.prompt, body.full_access),
+            _agent_stream(Path(path), body.prompt, body.full_access, body.model, body.resume),
             media_type="text/event-stream",
         )
 
@@ -317,9 +320,31 @@ def set_config(body: ConfigBody) -> dict:
         return {"ok": True, "roots": reg.set_roots(body.roots)}
 
     # -- static SPA (only when built) -------------------------------------- #
+    #
+    # The frontend routes the active project in the URL *path* (``/<project>``) so a
+    # reload — or a shared link — lands back in the same project, with that project's
+    # view state restored from localStorage. That means any non-API path must serve
+    # the SPA shell (``index.html``) rather than 404, while still serving the real
+    # built assets (``/assets/…``, ``favicon`` …) straight from disk. A single
+    # catch-all does both: existing file → that file; anything else → ``index.html``.
 
     if _STATIC_DIR.is_dir():
-        app.mount("/", StaticFiles(directory=str(_STATIC_DIR), html=True), name="spa")
+        index_html = _STATIC_DIR / "index.html"
+
+        @app.get("/{full_path:path}")
+        def spa(full_path: str) -> FileResponse:
+            """Serve a built asset if it exists, else the SPA shell (client routing)."""
+            if full_path.startswith("api/"):
+                # An unmatched /api/* path is a genuine miss, not a client route.
+                raise HTTPException(status_code=404, detail="not found")
+            candidate = (_STATIC_DIR / full_path).resolve()
+            if (
+                full_path
+                and candidate.is_file()
+                and candidate.is_relative_to(_STATIC_DIR.resolve())
+            ):
+                return FileResponse(str(candidate))
+            return FileResponse(str(index_html))
 
     return app
 
@@ -400,7 +425,13 @@ def _summarise_agent_json(line: str) -> list[tuple[str, str]]:
     etype = event.get("type")
     if etype == "system" and event.get("subtype") == "init":
         model = event.get("model", "")
-        return [("log", f"● session started{f' ({model})' if model else ''}")]
+        init_frames: list[tuple[str, str]] = [
+            ("log", f"● session started{f' ({model})' if model else ''}")
+        ]
+        if sid := event.get("session_id"):
+            # Hand the session id to the client so it can resume (continue the chat).
+            init_frames.append(("session", sid))
+        return init_frames
     if etype == "assistant":
         frames: list[tuple[str, str]] = []
         for block in event.get("message", {}).get("content", []):
@@ -423,30 +454,34 @@ def _summarise_agent_json(line: str) -> list[tuple[str, str]]:
     return []
 
 
-async def _agent_stream(cwd: Path, prompt: str, full_access: bool) -> AsyncIterator[str]:
+async def _agent_stream(
+    cwd: Path,
+    prompt: str,
+    full_access: bool,
+    model: str | None = None,
+    resume: str | None = None,
+) -> AsyncIterator[str]:
     """Run ``claude -p`` headless in *cwd* and stream a readable progress log over SSE.
 
     With *full_access* the agent runs under ``bypassPermissions`` (edits files AND
     runs commands unattended); otherwise ``acceptEdits`` (edits only — safer, but it
-    cannot run shell commands). Structured ``stream-json`` events are distilled to
-    readable frames; a final ``done`` frame carries the exit code.
+    cannot run shell commands). *model* picks a CLI model alias; *resume* continues an
+    existing session id (a follow-up chat turn). Structured ``stream-json`` events are
+    distilled to readable frames; a final ``done`` frame carries the exit code.
     """
     mode = "bypassPermissions" if full_access else "acceptEdits"
+    argv = ["-p", prompt, "--output-format", "stream-json", "--verbose", "--permission-mode", mode]
+    if model:
+        argv += ["--model", model]
+    if resume:
+        argv += ["--resume", resume]
     proc = await asyncio.create_subprocess_exec(
         "claude",
-        "-p",
-        prompt,
-        "--output-format",
-        "stream-json",
-        "--verbose",
-        "--permission-mode",
-        mode,
+        *argv,
         cwd=str(cwd),
         stdout=asyncio.subprocess.PIPE,
         stderr=asyncio.subprocess.STDOUT,
     )
-    access = "full access" if full_access else "edits only"
-    yield _agent_event("log", f"$ claude -p (headless · {access}) in {cwd.name}")
     try:
         assert proc.stdout is not None
         async for raw in proc.stdout:

src/pyclawd/web/git.py

@@ -23,7 +23,7 @@
 import hashlib
 import re
 import subprocess
-from dataclasses import dataclass, field
+from dataclasses import dataclass, field, replace
 from enum import Enum
 from pathlib import Path
 from typing import Final
@@ -99,12 +99,15 @@ class DiffLine:
         old: 1-based line number on the old side, or ``None`` for an added line.
         new: 1-based line number on the new side, or ``None`` for a deleted line.
         content: The line's text, without the leading ``+``/``-``/`` `` marker.
+        html: Syntax-highlighted HTML for :attr:`content` (Pygments), or ``None``
+            when the file type is not highlightable — callers render plain text.
     """
 
     kind: LineKind
     old: int | None
     new: int | None
     content: str
+    html: str | None = None
 
 
 @dataclass(frozen=True)
@@ -441,19 +444,56 @@ def file_view(
 
         if base_wt and target_wt:
             # Both sides are the working tree — nothing to diff; just show the file.
-            return self._plain_view(path, WORKING_TREE)
+            return self._highlight(self._plain_view(path, WORKING_TREE), WORKING_TREE, WORKING_TREE)
 
         status = self._derive_status(base, target, path)
         diff = self._raw_diff(base, target, path, target_wt)
         hunks = parse_hunks(diff)
         if hunks is None:
             return FileView(path=path, status=status, mode=mode, binary=True)
         if not hunks:
-            return self._plain_view(path, new_ref)
+            return self._highlight(self._plain_view(path, new_ref), old_ref, new_ref)
 
         if mode == "full":
-            return self._full_view(path, status, hunks, old_ref, new_ref)
-        return FileView(path=path, status=status, mode="diff", hunks=hunks)
+            return self._highlight(
+                self._full_view(path, status, hunks, old_ref, new_ref), old_ref, new_ref
+            )
+        view = FileView(path=path, status=status, mode="diff", hunks=hunks)
+        return self._highlight(view, old_ref, new_ref)
+
+    def _highlight(self, view: FileView, old_ref: Ref | None, new_ref: Ref | None) -> FileView:
+        """Attach Pygments HTML to every diff line, using full-file lexer context.
+
+        Each line is coloured from the *whole-file* highlight of the side it lives
+        on (deletions from the old side, additions/context from the new), so
+        multi-line constructs like docstrings render correctly on every line.
+        Returns *view* unchanged when the file type is not highlightable.
+        """
+        if view.binary:
+            return view
+        from .highlight import highlight_lines
+
+        old_html = highlight_lines(view.path, self._read_side(old_ref, view.path))
+        new_html = highlight_lines(view.path, self._read_side(new_ref, view.path))
+        if old_html is None and new_html is None:
+            return view
+
+        def hl(line: DiffLine) -> DiffLine:
+            if line.kind is LineKind.DEL and line.old is not None and old_html is not None:
+                src, idx = old_html, line.old - 1
+            elif line.new is not None and new_html is not None:
+                src, idx = new_html, line.new - 1
+            elif line.old is not None and old_html is not None:
+                src, idx = old_html, line.old - 1
+            else:
+                return line
+            return replace(line, html=src[idx]) if 0 <= idx < len(src) else line
+
+        if view.mode == "full":
+            return replace(view, lines=[hl(line) for line in view.lines])
+        return replace(
+            view, hunks=[replace(h, lines=[hl(line) for line in h.lines]) for h in view.hunks]
+        )
 
     def _raw_diff(self, base: Ref, target: Ref | None, path: str, target_wt: bool) -> str:
         """Return raw ``git diff`` text for *path*, handling brand-new untracked files."""

src/pyclawd/web/highlight.py

@@ -0,0 +1,71 @@
+"""Server-side syntax highlighting for diff lines (Pygments, full-file context).
+
+Highlighting a diff line-by-line in the browser would mangle multi-line
+constructs — docstrings, triple-quoted strings — because each line loses the
+lexer state of the lines around it. Instead we tokenise the *whole* file on the
+server with Pygments and hand the frontend one ready-made HTML fragment per
+source line, so a docstring spanning ten lines is coloured correctly on every
+one of them.
+
+Pygments ships transitively with rich (a core pyclawd dependency), so this adds
+no install cost. It still degrades gracefully: any failure — no lexer for the
+file type, Pygments unavailable — returns ``None`` and callers fall back to
+plain text.
+"""
+
+from __future__ import annotations
+
+from functools import lru_cache
+from typing import Any
+
+#: CSS class prefix for emitted token spans (matched by the dashboard stylesheet).
+CLASS_PREFIX = "pl-"
+
+
+@lru_cache(maxsize=256)
+def _lexer_for(path: str) -> Any | None:
+    """Return a Pygments lexer for *path* by filename, or ``None`` if unknown."""
+    try:
+        from pygments.lexers import get_lexer_for_filename
+        from pygments.lexers.special import TextLexer
+        from pygments.util import ClassNotFound
+    except ImportError:
+        return None
+    try:
+        lexer = get_lexer_for_filename(path, stripnl=False, ensurenl=False)
+    except ClassNotFound:
+        return None
+    # Plain-text files resolve to TextLexer, which emits no token spans — skip it
+    # so callers fall back to plain text instead of shipping redundant markup.
+    return None if isinstance(lexer, TextLexer) else lexer
+
+
+def highlight_lines(path: str, source: list[str]) -> list[str] | None:
+    """Return one HTML fragment per line of *source*, or ``None`` if not highlightable.
+
+    The result is aligned 1:1 with *source* (same length). Each fragment is safe
+    to inject as-is: Pygments HTML-escapes the text and never emits a span that
+    crosses a line boundary, so per-line injection is sound.
+
+    Args:
+        path: Repo-relative path; its extension selects the lexer.
+        source: The file's lines, without trailing newlines.
+
+    Returns:
+        A list of HTML strings (one per input line), or ``None`` when no lexer
+        matches the file type or Pygments is unavailable.
+    """
+    lexer = _lexer_for(path)
+    if lexer is None or not source:
+        return None
+    try:
+        from pygments import highlight
+        from pygments.formatters import HtmlFormatter
+    except ImportError:
+        return None
+    fmt = HtmlFormatter(nowrap=True, classprefix=CLASS_PREFIX)
+    rendered = highlight("\n".join(source), lexer, fmt).split("\n")
+    # Pygments may emit a trailing empty element; align strictly to the input.
+    if len(rendered) < len(source):
+        rendered += [""] * (len(source) - len(rendered))
+    return rendered[: len(source)]