[mnapoli]

Summary

Stacked on #1407. In commits and replies, a mention of someone who isn't on /dev/null used to stay plain text. Now any @handle that isn't a known member or organization links to /@handle, where #1406's page looks the account up on GitHub for members, and asks guests to sign in.

Nothing is stored and nobody is notified: the link is all there is.

Changes

• LinkifiedText links these mentions with rel="nofollow", the same style as other mentions, and without prefetch. Guests get a missing page, and a feed would otherwise ask for it on every hover. I added this case to the never-prefetch list of the frontend guidelines.
• Remotes keep these mentions as text, as they already do for organizations: MessageText passes linksEveryMention={false}.
• Static bodies (excerpts in notifications, quoted commits) and code stay text, as before.
• Side effect: in the composer preview, a mention is already a link before the server answers, so nothing shifts when the answer comes.

Decisions

• Mentions of people who aren't here? Just a link to their page, which does the rest. No stored mentions, no Mentions tab, no notification to someone without an account.
• Search and autocomplete of unclaimed profiles? Dropped for now.

Visual evidence

None: the link looks exactly like a mention of a member. The LinkifiedText, CommitPoll and ComposerPreview tests cover the markup.

Limitations

• A mention of a handle nobody has on GitHub leads to "GitHub has no @x".
• The API is unchanged: apps already get every mention's position, and decide themselves what to link.

Summary by CodeRabbit

• New Features

  • Mentions in commits, replies, and other supported text now link to the mentioned person’s profile, even when their account isn’t recognized. These links don’t send notifications to people who aren’t on /dev/null.
  • Signed-in members can look up people on GitHub from their profile pages.

• Documentation

  • Clarified where mentions link and how they behave.

• Bug Fixes

  • Links to unrecognized profiles aren’t prefetched.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 641d7168-c98b-40ac-9906-37a619b87733

Commits

Reviewing files that changed from the base of the PR and between 1d51903 and e45c1b3.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 93509514-fc25-4ced-ac09-788555f42bcf

Commits

Reviewing files that changed from the base of the PR and between 449a71d and 1d51903.

Files selected for processing: 8

• .ai/guidelines/resources.js.blade.php
• KNOWLEDGE_BASE.md
• resources/js/components/chat/message-parts.tsx
• resources/js/components/commit-body.tsx
• resources/js/components/linkified-text.tsx
• tests/Unit/CommitPoll.test.tsx
• tests/Unit/ComposerPreview.test.tsx
• tests/Unit/LinkifiedText.test.tsx

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 5 remain after this review.

Walkthrough

Unresolved mentions now link to /@handle by default. LinkifiedText and CommitBody support disabling these fallback links, and chat rendering disables them. Existing known-user and organization mention links remain unchanged.

Changes: Mention linking

Layer / File(s)	Summary
Unresolved mention fallback links resources/js/components/linkified-text.tsx, tests/Unit/LinkifiedText.test.tsx, tests/Unit/CommitPoll.test.tsx, tests/Unit/ComposerPreview.test.tsx	LinkifiedText links unresolved mentions to /@handle by default. Setting linksEveryMention={false} leaves them as text. The tests expect fallback links in commit polls and mention previews.
Commit body and chat controls resources/js/components/commit-body.tsx, resources/js/components/chat/message-parts.tsx, .ai/guidelines/resources.js.blade.php, KNOWLEDGE_BASE.md	CommitBody forwards linksEveryMention through quoted and unquoted content. Chat disables fallback links. The prefetch rule excludes unresolved handles, and the knowledge base documents mention behavior.

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Feature

Possibly related issues

• [RFC] Orgs #938: This issue proposes organization profiles and mentions; this change links unresolved handles to profile routes.

Possibly related PRs

• dev-null-sh/dev-null.sh#1156: Adds handle-based identity and mention extraction used by unresolved mention links.
• dev-null-sh/dev-null.sh#1348: Changes commit mention rendering, which this PR extends with fallback links.
• dev-null-sh/dev-null.sh#1406: Adds the /@handle routes targeted by these fallback links.

Suggested reviewers: xheaven, jubianchi, nunomaduro

Merge Risk: Minimal · previous review 1d519

Unresolved mentions gain profile links while chat keeps them as text. No concrete merge-blocking risk remains.

Security architecture risk: Minimal · up to 1d519

The new links preserve existing authentication, validation, and rate-limit controls. Guests cannot initiate GitHub lookups, chat retains its previous behavior, and viewing rendered text does not itself initiate a lookup.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — An author can place a valid handle in rendered text and induce a visiting member to navigate into the existing lookup flow. The traced effect is profile lookup and possible unclaimed-profile persistence, not arbitrary URL selection or acquisition of profile ownership.

Trust Boundaries and Controls

• observed — Server-side authentication, lookup-specific throttling, and request validation protect the provider-spending POST. Guest lookup suppression is enforced by the controller; nofollow is not the authorization boundary.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title says mentions of anyone now link to their page, and that the page looks them up on GitHub. The changeset does this: LinkifiedText, CommitBody and the message-parts call site add a linksEvery…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title says mentions of anyone now link to their page, and that the page looks them up on GitHub. The changeset does this: LinkifiedText, CommitBody and the message-parts call site add a linksEveryMention option, which defaults to true and renders unknown @handle mentions as links to /@handle. The changeset also adds rel="nofollow" and no-prefetch handling, and updates the guidelines and the KNOWLEDGE_BASE docs. The title covers the main change. It does not mention the opt-out for remotes or the nofollow and no-prefetch details, which is acceptable for a title.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 5 functions across 7 files. (1 skipped: 1 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches

Generate docstrings

• Commit to this branch
• Create a new PR

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.