backnotprop/plannotator v0.28.7

on GitHub

Follow @plannotator on X for updates

What's New in v0.28.7

Seven PRs, two from community contributors, one of them a first-time contributor. The main fix stops Ask this session from handing your unsubmitted comments to the agent as instructions. Other changes: comments on images survive a reload, other plugins' commands no longer carry Plannotator's name, and every Plannotator server now checks the hostname it was reached by.

Ask this session keeps your drafts as drafts

When you asked a question through "Ask this session", Plannotator also sent the comments you had not submitted yet, in the same format as submitted feedback. The agent read them as instructions and could act on them before you pressed Submit. In the report, it created GitHub issues from draft comments. On Submit, the same comments then arrived a second time.

Draft comments are now sent once, as a short list clearly marked as drafts you have not submitted, with an instruction not to act on them. Your question always comes last. The list goes again only when it changes. Submit delivers your feedback once, as before. This applies on Claude Code, Pi and OpenCode, and to the annotate agent terminal. The separate Ask AI providers are unchanged. (#1749, closing #1748, reported by @krizman)

Comments on images come back after a reload

In HTML annotate, a pin on an image, video or embedded page that had no id disappeared after a reload or an HTML refresh, which made image comments in generated reports hard to keep. Such pins are now found again by the file they show. A pin follows its image when other images are added around it. If the image's source changes, the pin shows as no longer matching. If the same source appears twice, the pin is not saved, so it can never land on the wrong copy. Live-app sessions behave the same way. (#1747 by @pro-vi)

Other plugins' commands no longer carry Plannotator's name

With the Plannotator mod on, Claude Code labelled the output of any other plugin's slash command as if Plannotator had helped answer it (for example plannotator+frontend: …). The mod now listens only to its own commands. /plannotator-review, /plannotator-annotate and /plannotator-last work as before, with or without the Plannotator skills installed. (#1741 by @rushelex, closing #1740)

Every server checks the hostname it was reached by

Plannotator's review servers now refuse requests that arrive under an unexpected hostname. A normal local session accepts only localhost and loopback addresses. Remote mode also accepts IP addresses, your configured PLANNOTATOR_URL_HOST and the machine's own name (including name.local). --tailscale sessions accept their tailnet name, and code-server and Coder proxies are recognised from VSCODE_PROXY_URI. VS Code, SSH and Docker port forwarding, Codespaces and dev tunnels keep working as before.

If you reach a remote-mode session by another DNS name (a server's public name, for example), you now get a 403 that says what to do: set PLANNOTATOR_URL_HOST, or list the name in the new PLANNOTATOR_ALLOWED_HOSTS (comma-separated; * turns the check off). (#1742)

Additional Changes

• OpenCode 2: extra words no longer stop annotate. /plannotator-annotate . notes.md (or please notes.md) opened nothing and showed nothing. It now opens the file, and a slash command that fails shows the reason in the session instead of only in OpenCode's log. On OpenCode 1 this applies when the plugin uses the CLI runtime; the default embedded runtime is unchanged (#1739).
• Question cards for host apps. @plannotator/ui 0.52.0 lets an app embedding the question cards turn "Records a decision" on and off from the card's header and hide the card's own status tag. Plannotator's own cards are unchanged (#1744).

Install / Update

macOS / Linux:

curl -fsSL https://plannotator.ai/install.sh | bash

Windows:

irm https://plannotator.ai/install.ps1 | iex

Claude Code Plugin: The plugin and the plannotator binary update separately, so run the install script above as well. In a terminal:

claude plugin marketplace update plannotator
claude plugin update plannotator@plannotator

Then restart Claude Code. Inside Claude Code, run /plugin marketplace update plannotator, then open /plugin → Installed → plannotator → Update now.

Pi:

pi update --extensions

OpenCode: Re-run the install script above. It now also clears the OpenCode 2 plugin cache.

What's Changed

• Ask this session: unsubmitted annotations are never sent as feedback by @backnotprop in #1749
• fix(annotate): pins on images without an id restore by their source by @pro-vi in #1747
• fix(mod): match command.run by command name by @rushelex in #1741
• Validate the Host header on every request (defense in depth) by @backnotprop in #1742
• OpenCode 2: /plannotator-annotate with extra words opens the file, and failures are shown by @backnotprop in #1739
• ui: host-controlled decision toggle and status tag on question cards by @backnotprop in #1744
• Groundwork for a feature that is not released yet, hidden from help and the agent skill, by @backnotprop in #1745 and #1750

New Contributors

• @pro-vi made their first contribution in #1747

Contributors

@pro-vi found that comments on images without an id were lost on every reload, and wrote the fix that finds them again by their source. @rushelex reported the +plannotator label on other plugins' commands and fixed it with a one-line matcher. It is their second contribution, after the VS Code clipboard fix in #970.

Community:

• @krizman reported the Ask this session draft problem with exact steps, the text the agent received, and the likely cause (#1748).

Full Changelog: v0.28.6...v0.28.7