feat: QA checklist skill with full-stack UI

[backnotprop]

Summary

• New QA checklist feature — AI agents generate structured checklists for manual developer verification of code changes, with an interactive UI for reviewing items, adding notes/screenshots, and submitting results back to the agent
• PR/MR integration — Optional linking to GitHub, GitLab, or Azure DevOps PRs with provider icons, automation toggles (post results to PR, auto-approve if all pass), and provider-specific CLI commands in output
• Shared server infra — Extracted startServer() into packages/server/serve.ts and moved shared theme CSS into packages/ui/styles/theme.css to deduplicate across plan review, code review, and checklist servers

What's included

Layer	Files	Description
Skill	.agents/skills/checklist/SKILL.md	Agent instructions for generating checklists with PR detection
Types	packages/shared/checklist-types.ts	Shared Checklist, ChecklistPR, ChecklistSubmission types
Server	packages/server/checklist.ts, serve.ts	Validation, session management, feedback formatting
Editor	packages/checklist-editor/	Full React UI — expandable items, progress bar, annotation panel, category grouping
Harnesses	apps/hook/, apps/opencode-plugin/, apps/pi-extension/	Integration for Claude Code, OpenCode, and Pi
Dev	apps/checklist/	Standalone Vite dev server for checklist editor

Test plan

• bun run build passes
• Run plannotator checklist --file /tmp/checklist.json with sample data — UI opens, items expand/collapse, notes work, submit returns formatted output
• Verify PR badge renders correctly for GitHub, GitLab, and Azure DevOps providers
• Verify automations checkboxes appear in annotation panel when PR is linked
• Test dark and light mode parity
• Test keyboard navigation (j/k, p/f/s, n, Enter)

🤖 Generated with Claude Code

[backnotprop]

I found several correctness gaps in the checklist feature:

• P1: Refuse PR auto-approval while checklist items are still pending (packages/server/checklist.ts:296-301)
  If the user submits a partial checklist with approveIfAllPass enabled, this branch still emits PR-approval instructions because it only checks failed === 0 && skipped === 0. Pending items are excluded from both counts, so an incomplete QA run can incorrectly approve the PR.

• P2: Surface a URL for remote checklist sessions (apps/hook/server/index.ts:344-346)
  In PLANNOTATOR_REMOTE/SSH sessions, handleChecklistServerReady() is effectively a no-op, and unlike plan/review/annotate mode there is no writeRemoteShareLink() fallback here. The new plannotator checklist command then waits on waitForDecision() without opening a browser or telling the user where the UI is, so remote/devcontainer users cannot reach the checklist page from this flow.

• P2: Restore saved results when reopening checklist files (apps/hook/server/index.ts:321-323)
  Saved checklist files contain { checklist, results, globalNotes, ... }, but this branch immediately unwraps them to .checklist and drops the recorded answers. Because the command output explicitly tells users to reopen a saved run with plannotator checklist --file ..., reopening currently starts from a blank checklist and loses the previous verification work.

• P2: Include the OpenCode agent switch in checklist submissions (packages/checklist-editor/App.tsx:338-345)
  The checklist header reuses the review Settings dialog, so OpenCode users can pick a target agent here, but the checklist POST body never sends that choice. As a result checklist feedback always goes back on the current agent even when the UI says it should switch to build, review, or another configured agent.

• P2: Keep the Pi checklist server compatible with the shared UI API (apps/pi-extension/server.ts:766-770)
  The shared checklist UI always uses /api/upload, /api/image, and /api/draft, and it posts array-valued globalNotes plus optional automations. This Node fallback only accepts a much narrower /api/feedback payload and does not implement those extra routes, so in Pi mode screenshot uploads and draft recovery silently fail, global comments are dropped, and the PR automation checkboxes have no effect.

• P2: Escape checklist description HTML before rendering it (packages/checklist-editor/components/ChecklistItem.tsx:188-194)
  If a checklist is loaded from an untrusted JSON/file (for example via plannotator checklist --file), raw HTML in description is passed straight into dangerouslySetInnerHTML after only regex replacements for code and bold text. That allows injected elements with event handlers such as <img onerror=...> to execute script inside the Plannotator page.