Zulip

Recent Commits

• Evy Kassirer(11 Aug 26)

  reactions: Revert optimistic update when a reaction request fails. Reactions are applied locally before the server request is sent, but a failed request left the local echo in place, so the user saw a reaction that would silently disappear on reload. When we give up on a request, undo the local update. add_reaction and remove_reaction are no-ops when there's nothing to undo, so this is safe even if a server event for the same reaction arrived in the meantime. Co-Authored-By: Claude Fable 5 <[email protected]>

• Evy Kassirer(11 Aug 26)

  reactions: Retry transient reaction request failures with backoff. A failed reaction request was reported to Sentry regardless of cause, so rate limiting (429) and transient server errors (5xx) -- which aren't client bugs -- were grouped with genuine problems like a bad request, and none of them were retried. Retry rate-limited requests after the server-specified delay, like unread_ops does, and retry 5xx and network failures with exponential backoff (reusing get_retry_backoff_seconds) up to a bounded number of attempts, only reporting to Sentry once we give up. Report other errors immediately without retrying, since retrying can't fix a bad request. The give-up and client-error reports use distinct messages, so the two causes form separate Sentry issues. Retrying is safe even if the server applied a change whose response was lost in a gateway error: the retried request fails with REACTION_ALREADY_EXISTS or REACTION_DOES_NOT_EXIST, which we already treat as benign. While a request is waiting to be retried, further clicks on the same reaction button are dropped, exactly as for a request in flight. Co-Authored-By: Claude Fable 5 <[email protected]>

• Mateusz Mandera(24 Aug 26)

  semgrep: Add rule to warn of likely-incorrect NULLs ordering in indexes. Follow-up to #40011.

• KasarapuRajeev(21 Mar 26)

  docs: Tweak wording in asking great questions guide.

• Evy Kassirer(01 Sept 26)

  claude: Move Python-only code quality rules into a path-scoped rule. The mypy, SQL-injection, `.extra()`, and N+1 rules apply only when writing Python, so scope them to `**/*.py` and load them on demand. This empties the "Code Quality" list, whose remaining sibling is the "Process" list under "What Not To Do". Co-Authored-By: Claude Fable 5 <[email protected]>

• Evy Kassirer(01 Sept 26)

  claude: Move frontend-only code style into a path-scoped rule. The var, lodash, onclick, and DOM-guard rules apply only when writing frontend code, so scope them to `web/**` and load them on demand. What stays inline in Code Style is the guidance that applies to any language: consistency, naming, factoring, and the comment rules. Co-Authored-By: Claude Fable 5 <[email protected]>

• Evy Kassirer(01 Sept 26)

  claude: Move CSS guidance into a path-scoped rule. The em-vs-px rule, the redundant-rule and change-scope audits, and the dependency-removal property audit all apply exclusively when editing stylesheets, which live under `web/styles/`. Reading any file there pulls the rule in. The dependency-removal paragraph had also been stranded at the bottom of the general "For Refactoring" section, where nothing marked it as CSS-specific. Co-Authored-By: Claude Fable 5 <[email protected]>

• Evy Kassirer(01 Sept 26)

  claude: Move testing philosophy into a path-scoped rule. The philosophy bullets, the assertLogs rule, the coverage-check procedure, and the webhook test command are guidance for writing tests, and tests are written with test files open — reading any file under `zerver/tests/`, `zerver/webhooks/`, or `web/tests/` pulls the rule in. The rule also tells the reader to open `zerver/tests/test_example.py`, which is itself in the matched paths. The obligation to include tests and the commands to run before submitting stay inline: they apply to every code session, including one where no test file has been opened yet. One gap to know about: rules load when a matching file is read, so creating a brand-new test file without opening any existing one won't trigger it. That's rare — tests are nearly always added to existing files, and reading neighboring tests first is standard practice. Co-Authored-By: Claude Fable 5 <[email protected]>

• Evy Kassirer(01 Sept 26)

  claude: Move the self-review checklist into a skill. The checklist is a finalization-time artifact with no path anchor: it applies to every change, at the moment the work is believed complete. Load it on demand at that moment instead of carrying it in every session's context. The Workflow section's "Verify Before Finalizing" step keeps the pointer, since a model that believes it is done won't go looking for a review checklist on its own. Co-Authored-By: Claude Fable 5 <[email protected]>

• Evy Kassirer(01 Sept 26)

  claude: Move commit message format into a skill. The message template, summary format, and issue-linking syntax are needed only at the moment of writing a commit message, so load them on demand. The gitlint commit-msg hook and CI check the summary format mechanically, which limits the cost if the skill ever goes uninvoked; the Commit Discipline section keeps a one-line pointer, since a model writing a commit message believes it already knows how and won't go looking on its own. The commit-structure principles stay inline: they shape how work is planned and split while the code is being written, long before any commit exists to describe. Co-Authored-By: Claude Fable 5 <[email protected]>

• Evy Kassirer(01 Sept 26)

  claude: Move the UI testing checklist into a path-scoped rule. The manual-testing checklist applies only to sessions that touch frontend code, so scope it to `web/**` and `templates/**` and load it on demand. Unlike a skill, a path-scoped rule needs no recognition step — the checklist exists precisely for the "it looks fine to me" failure mode, so it must not depend on the assistant deciding to look for it. Reading any frontend file pulls it in, which also happens early enough to shape implementation (translated-string lengths, themes, and narrow widths matter when writing the CSS, not just when verifying it). This is a promotion, not a demotion: the checklist arrives fresh at the moment it applies instead of sitting mid-file in every session. Co-Authored-By: Claude Fable 5 <[email protected]>

• Evy Kassirer(01 Sept 26)

  claude: Move PR description guidelines into a skill. Writing a PR description happens once per branch at an unmistakable moment, so the guidelines can load on demand rather than sit in every session's context, and a self-contained skill is easier to iterate on than a section of this file. The `[ai]` title prefix and the `upstream/main` base branch stay inline: they are project policy with no mechanical backstop if a skill goes uninvoked. The inline section keeps a one-line pointer at the skill, since a model opening a PR believes it already knows how and won't go looking on its own. Co-Authored-By: Claude Fable 5 <[email protected]>

• Evy Kassirer(01 Sept 26)

  claude: Move the API changelog process into a path-scoped rule. The double-entry changelog procedure (create-api-changelog, the ZF-XXXXXX placeholder, the exact "New in Zulip X.Y" format the merge tooling matches on) is needed only when a change modifies the API, so load it on demand instead of carrying two dense paragraphs in every session's context. A rule scoped to `zerver/openapi/**` and `api_docs/**` loads with no recognition step: every API change must update `zerver/openapi/zulip.yaml`, since CI validates the spec against the implementation, and reading a matching file pulls the rule into context at exactly the moment the documentation work happens. The Workflow section keeps one line naming the requirement. Path-scoped rule loading needs Claude Code v2.1.198 or newer; older versions just don't load the rule, matching today's failure mode of not reading the section. Co-Authored-By: Claude Fable 5 <[email protected]>

• Evy Kassirer(01 Sept 26)

  claude: Move non-interactive rebase instructions into a skill. The "Rebasing Commits (Non-Interactive)" section is a how-to for working around the lack of an interactive editor: GIT_SEQUENCE_EDITOR scripts, `git format-patch` round-trips for rewording. It is needed only at the moment a non-HEAD commit has to change, and nothing else in CLAUDE.md depends on it. Move it verbatim into a `git-rebase` skill, loaded on demand. No pointer stays behind: the skill listing itself surfaces the skill and when to use it, so an inline pointer would just restate that. Co-Authored-By: Claude Fable 5 <[email protected]>

• Evy Kassirer(01 Sept 26)

  visual-test: Move Puppeteer alignment tips into the skill. The "Puppeteer Visual Tests: Verifying Alignment" section is only relevant while writing a Puppeteer script, which in this repository happens inside the visual-test skill. Keeping it in CLAUDE.md loaded eight bullets of Puppeteer-specific advice into every conversation, including backend-only ones. Text moved verbatim. Co-Authored-By: Claude Fable 5 <[email protected]>

• Mateusz Mandera(01 Sept 26)

  mattermost: Fix channel.name collision resolution. Collision detection here was case-sensitive, so channels whose display names differ only in case were not detected as colliding, and both were imported unchanged. The database enforces channel name uniqueness case-insensitively, so the import then failed with an IntegrityError. Additionally it wasn't accounting for the rare possible case, where a name generated by collision resolution (such as "Foo (2)") could collide with a pre-existing channel from mattermost, if it also happened to be called "Foo (2)".

• Sahil Batra(17 Aug 26)

  migrations: Delete unused anonymous groups. Re-runs the cleanup done by 0782 for the groups leaked since then. Realm.workplace_users_group is the only setting added to the list of UserGroup columns since that migration. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

• Sahil Batra(17 Aug 26)

  streams: Delete unused anonymous groups when channel already exists. Both channel creation endpoints create the anonymous groups for the new channel's settings before create_stream_if_needed checks whether the channel exists, so those groups are left unused whenever it already does -- either because a racing request created it first, or because a single request asked for two names differing only in case. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

• Sahil Batra(17 Aug 26)

  streams: Skip permission settings not being set when creating channel. The "/channels/create" endpoint accepts values for can_create_topic_group, can_delete_any_message_group and can_delete_own_message_group permission settings and also creates anonymous groups for them if needed, but did not pass them to create_stream_if_needed. So the requested values were ignored and the settings were set to default values and not the values that user expects. This also leads to anonymous groups being created for these settings unused. This commit fixes that by passing the setting values correctly to create_stream_if_needed. Also added missing encoding for a couple of settings in API docs. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

• Rakshit Chauhan(02 Mar 26)

  settings: Fix Enter key handling in bot deactivation dialog. Pressing Enter in the bot deactivation dialog did not trigger the deactivation action and caused the dialog to briefly close and reopen. This ensures the submit button is focused on open, making keyboard behavior consistent with bot reactivation and other dialogs.

• Rakshit Chauhan(02 Mar 26)

  settings: Hide actions column when user has no permissions. Hide action buttons in bot lists when users lack permissions. If no bots have any available actions, hide the entire column. System bots show disabled buttons for admins, and no buttons for non-admins. Fixes #37252. Co-authored-by: Vivek Yadav <[email protected]>

• Rakshit Chauhan(06 Aug 26)

  settings: Fix missing class selector for bot loading indicator. The loading indicator lookup used loading-indicator as a tag name instead of .loading-indicator as a class selector, so it never matched the indicator element. This is a pre-existing bug, unrelated to the actions column changes that follow.

• Rakshit Chauhan(06 Feb 26)

  settings: Extract bot list row to dedicated template. Previously both user and bot lists used settings_user_list_row.hbs, which had complex conditionals to handle bot-specific columns. This extracts bot row rendering to settings_bot_list_row.hbs and removes bot-specific code from settings_user_list_row.hbs, making each template simpler and more focused. Fixes part of #37252. Co-authored-by: Vivek Yadav <[email protected]>

• Pratik Chanda(29 Aug 26)

  search tests: Cover the empty topic operand in search suggestions. 62093ee37d changed which search suggestions render an empty `topic:` operand as the empty topic display name, but landed without tests. This covers the three variants that `generate_pills_html` now distinguishes: a `topic:` term that isn't the one being typed, a fully typed `topic:` operator awaiting an operand, and `topic` suggested as an operator for a partially typed query. Verified by restoring the previous `text_query.includes(":")` condition, which fails the first two of those. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

• Pritesh Shetty(25 May 26)

  webhooks/grafana: Validate legacy payload fields before processing. Add validation for the Grafana 7.0 fields that this webhook reads, so that a payload we cannot parse is rejected with AnomalousWebhookPayloadError instead of failing unexpectedly. Without this, a payload that lacks those fields escapes the view as a Django ValidationError and is reported as a 500, which blames Zulip for data that the sender chose. The payload seen in production was `{"text": "..."}`, which reaches the legacy branch because it has no alerts field, and which nothing in Grafana's alerting system generates. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

• Lauryn Menard(31 Aug 26)

  grafana: Remove unnecessary else block for legacy payload process.

• Bedo Khaled(04 Aug 26)

  users: Optimize bulk_get_subscribers_of_target_user_subscriptions. Remove recipient__type__in filter from the second queryset. It's provably redundant. Replace values() with values_list(named=True). This replaces creating a dict with a lightweight namedtuple class per row; namedtuple also uses Attribute access instead of hash-lookups. This preserves readability while offering a speed up. Use dict.items() in the final loop for cleaner and slightly faster code. Fixes part of #27835.

• Bedo Khaled(03 Aug 26)

  users: Add optimized subscribers-subscriptions lookup for a single user. bulk_get_subscribers_of_target_user_subscriptions does extra and expensive work for a single user; hot path callers only need a single user. Add a dedicated get_subscribers_of_target_user_subscriptions that takes a single user and feeds their subscribed recipient_ids into the subscribers query as a subquery to resolve everything in one query, eliminating Python processing and mappers. Remove redundant recipient__type__in filter from that new function, resulting in a more efficient query. Original behavior is preserved with performance gains: - Saves 1 db round trip. - Reduced memory usage by fetching only user_profile_id and removing 3 intermediate iterables.

• Bedo Khaled(15 Jun 26)

  users: Rename get_subscribers_of_target_user_subscriptions to bulk_. Rename function to bulk_get_subscribers_of_target_user_subscriptions to explicitly convey its bulk nature, making way for the single-target-user variant in next commit.

• Lauryn Menard(27 Aug 26)

  api-docs: Revise feature level 212 changelog entries.