Fix import refresh and add GitHub PR review

Cargo.toml

@@ -13,6 +13,8 @@ ui-tests = ["gpui-kit/test-support"]
 
 [dependencies]
 agent-sessions = "=0.2.2"
+octocrab = { version = "=0.54.5", default-features = false, features = ["default-client", "rustls", "rustls-ring"] }
+tokio = { version = "1", features = ["rt-multi-thread", "time", "net"] }
 base64 = "=0.22.1"
 minisign-verify = "=0.2.5"
 reqwest = { version = "=0.13.5", default-features = false, features = ["blocking", "rustls-no-provider", "json", "system-proxy"] }
@@ -120,3 +122,8 @@ required-features = ["ui-tests"]
 name = "worktrees_ui"
 harness = false
 required-features = ["ui-tests"]
+
+[[test]]
+name = "github_ui"
+harness = false
+required-features = ["ui-tests"]

README.md

@@ -11,7 +11,7 @@ A small native Rust/GPUI Kit diff viewer. macOS is in beta; Windows and Linux ar
 - A compact alphabetical file list on the right and one selected diff in the center. Files are grouped under their folder. A nested folder reads as `src · app`, with the ancestor dimmed and shortened in the middle when it is long. Filenames are indented under that header and shortened in the middle when needed. Root files stay flush. Hover shows the complete path. Find file, under the scope header, filters the list with nucleo. ⌘F focuses it. Stage all / Unstage all still cover the whole scope.
 - **Staged** first, then **Changes**, with separate counts. Changes is selected initially.
 - A fixed project header shows a small project icon and the project name, with linked worktrees alongside it. Staged/Changes and review controls stay in the row below for every project. Attached checkout tabs use branch names; detached checkouts are marked explicitly. Hover shows the checkout path and branch, and the overflow menu keeps long lists accessible.
-- Checkouts sharing one Git common directory occupy one rail entry, with a combined badge. Each checkout retains its own scope, selected file, mode, and reading position. The rail remembers the last selected checkout; the palette provides worktree selection and Next/Previous worktree commands. Worktree creation/removal refreshes automatically. Removing a project removes its saved checkout group and excludes it from automatic import without changing Git files.
+- Checkouts sharing one Git common directory occupy one rail entry, with a combined badge. Each checkout retains its own scope, selected file, mode, and reading position. The rail remembers the last selected checkout; the palette provides worktree selection and Next/Previous worktree commands. Worktree creation/removal refreshes automatically. Removing a project removes its saved checkout group and leaves it unselected on future imports without changing Git files.
 - Empty diff panes include a little Snake game while you wait for changes. Enter starts or pauses it; arrow keys or WASD steer. Switching checkouts or Staged/Changes pauses the game, and reduced motion disables its animation.
 - Staged compares HEAD with the index; Changes compares the index with disk and includes untracked files. A file can appear in both views.
 - Unified or split diffs with highlighting, inline changes, expandable context, source selection, and copying. Long lines wrap; split mode gives 40% to the original and 60% to the modified source. Added files fill one pane. Red and green marks beside the scrollbar show where further changes appear when the diff needs scrolling.
@@ -41,14 +41,22 @@ Normal launch restores repositories. The project import picker appears once, inc
 
 ## Import projects
 
-Use **Import** at the bottom of the project rail, **File → Import Projects…**, or the command palette to find local Git projects from Herdr, Codex, and Claude Code. Select the projects to add; repositories already in Diffy are marked **Already added**. Unavailable directories are hidden. Results are newest-first within each source; non-Git folders are hidden too. Older sessions without a stored working directory are skipped.
+Use **Import** at the bottom of the project rail, **File → Import Projects…**, or the command palette to find local Git projects from Herdr, Codex, and Claude Code. Select the projects to add; repositories already in Diffy are marked **Already added**. Unavailable directories are hidden. Results appear once per checkout in one list, ordered by the latest tool activity; non-Git folders and repositories in system temporary directories are hidden too. Temporary repositories can still be opened manually, and already-added projects are preserved. Older sessions without a stored working directory are skipped.
 
-**Automatically add new projects** is opt in separately for each source. Removed and unselected projects stay excluded until you explicitly import or open them again. Imported repositories remain in Diffy when their Herdr workspace closes or agent history disappears. Importing preserves the project you are viewing.
+Discovery runs when you open Import or press Refresh and shows “Pulling latest projects from Herdr, Codex, and Claude Code…” while scanning. Select projects and press **Import** to add them; discovery never adds projects on its own. Removed and unselected projects stay unselected until you explicitly choose them or open them again. Imported repositories remain in Diffy when their Herdr workspace closes or agent history disappears. Importing preserves the project you are viewing.
 
-Discovery reads directory metadata only. It does not run agents, resume sessions, read terminal output, or access credentials. It honors `HERDR_SOCKET_PATH`, `XDG_CONFIG_HOME`, `CODEX_HOME`, and `CLAUDE_CONFIG_DIR`; otherwise it uses each tool's standard local directories. Herdr's saved sessions provide an offline fallback. Remote repositories need a local checkout in this release.
+Discovery reads directory metadata only. It does not run agents, resume sessions, read terminal output, or access credentials. It honors `HERDR_SOCKET_PATH`, `XDG_CONFIG_HOME`, `CODEX_HOME`, and `CLAUDE_CONFIG_DIR`; otherwise it uses each tool's standard local directories. Herdr's saved sessions provide an offline fallback. Recency uses session metadata modification times across all three sources, including saved metadata for live Herdr sessions; projects without a timestamp appear last.
 
 `--demo` opens sample projects without reading or writing saved preferences. Demo staging is disabled.
 
+## GitHub pull requests
+
+Open a local repository with a GitHub.com remote, then choose **Pull requests** beside the project name. **Worktrees** returns to the local checkout with its selection, scope, and reading position preserved. The PR list includes all open pull requests and drafts, most recently updated first. Tabs show the PR number and shortened title; hover for details. The **…** menu searches loaded titles and numbers, offers **Load more** after each page of 100, and lets you choose a remote. Diffy prefers `origin`; with several remotes and no `origin`, choose one from that menu.
+
+Install [GitHub CLI](https://cli.github.com/) and run `gh auth login --hostname github.com` first. Diffy uses that login for Octocrab's GitHub API requests, including private repositories you can access. Credentials and patches are never written to preferences. Login, permission, connection, and rate-limit errors offer a retry; **Open in GitHub** opens the selected PR in your browser.
+
+PR review is read-only: it doesn't check out branches, stage files, or change your local index. Local file watchers keep working independently. **⌘R** refreshes the loaded PR pages and selected diff; remote updates aren't polled automatically. The existing split/unified viewer, file search, and copying work with the patch supplied by GitHub. Extra source context beyond that patch is unavailable. Patches over 16 MiB or parsed previews over 32 MiB show a message to open the PR in GitHub; previews share the existing bounded cache. GitHub Enterprise hosts, review comments, approvals, merging, and native sign-in aren't included.
+
 ## Terminal command
 
 In the installed macOS app, choose **File → Install terminal command…**, or search for **Install terminal command** in the command palette. This installs `~/.local/bin/diffy` for your user. Existing commands from other tools are preserved.

THIRD_PARTY_NOTICES.md

@@ -29,6 +29,11 @@ Diffy uses gix 0.89.0 (MIT/Apache-2.0) for the opt-in read-only repository metad
 
 - gix: https://github.com/GitoxideLabs/gitoxide
 
+Diffy uses Octocrab 0.54.5 (MIT/Apache-2.0) for read-only GitHub pull request access, with Tokio for asynchronous networking. The packaged dependency inventory includes their licenses.
+
+- Octocrab: https://github.com/XAMPPRocky/octocrab
+- Tokio: https://github.com/tokio-rs/tokio
+
 Diffy uses cargo-packager (MIT/Apache-2.0) for packaging and cargo-packager-updater (MIT/Apache-2.0) for signed updates. The updater is pinned to revision `0a3ea3a089363b7e77dfca238be5bbcf3f4d75f6` for HTTPS enforcement.
 
 - Source: https://github.com/crabnebula-dev/cargo-packager

docs/discovery-libraries.md

@@ -35,6 +35,6 @@ Inspected `src/runtime.rs` and `src/socket.rs`.
 
 ## Herdr fallback
 
-Small read-only transport adapter using the same platform forms as Reviewr: UnixStream on Unix, interprocess named pipes on Windows. Explicit endpoint, nonblocking IO, bounded response, total deadline, cancellation checks, and request-id validation. Calls session.snapshot only. Unknown fields are ignored; terminal output and agent state are not used. Reconcile snapshots periodically rather than maintaining agent state or replaying event payloads.
+Small read-only transport adapter using the same platform forms as Reviewr: UnixStream on Unix, interprocess named pipes on Windows. Explicit endpoint, nonblocking IO, bounded response, total deadline, cancellation checks, and request-id validation. Calls session.snapshot only. Unknown fields are ignored; terminal output and agent state are not used. Each explicit import scan requests a snapshot; there is no background source watcher or automatic import. Saved session modification times provide activity ordering for live results when available; polling never counts as new activity.
 
 The discovery subsystem cross-compiles for x86_64-pc-windows-gnu. This does not constitute a Windows GUI runtime test.