feat(log-viewer): inspector, grid ownership and VS Code web support

.claude/rules/lana.md

@@ -16,6 +16,9 @@ VS Code extension. Applies when working under `lana/`.
 ## Settings
 
 - **Give every user preference a `lana.*` setting.** Do not hide it in `globalState`.
+- **Remembered UI state is not a preference.** The view a table was last left in, the inspector's
+  section layout, column overrides: these persist privately in `globalState` — see
+  `PRIVATE_SECTIONS` in `AppConfig.ts` — and are not registered settings.
 - **Push `configChanged` to an open panel when a setting changes.** The panel sets
   `retainContextWhenHidden`, so it is never re-created and never re-reads the config itself.
 

.claude/rules/log-viewer.md

@@ -39,8 +39,9 @@ Webview UI.
 - Never define or override a `--vscode-*` name — an override is global to the webview. Exception:
   skinning a `vscode-elements` component; scope it to that element, never `:host` or `:root`.
 - Write no literal font size or family. Take a step from the ramp in `styles/tokens.css`
-  (`--lana-text-*`, `--lana-text-mono` for editor-sized text, `--lana-text-meta` for header
-  metadata) and a family from `--lana-font-mono` or `--lana-font-ui`.
+  (`--lana-text-*`, `--lana-text-meta` for header metadata) and a family from `--lana-font-mono` or
+  `--lana-font-ui`. Code-shaped text takes no size of its own: it inherits the surface that holds
+  it, so nothing in the webview follows the reader's `editor.fontSize`.
 - Mono is for text whose alignment carries meaning — stacks, code, log text. Prose takes the UI font.
 - An all-caps run takes `--lana-text-caps` and `--lana-text-caps-tracking`, one step down: every
   glyph reaches cap height, so caps read a size larger.

.claude/skills/changelog-entry/SKILL.md

@@ -0,0 +1,128 @@
+---
+name: changelog-entry
+description: Write, review or trim CHANGELOG.md entries. Use when editing CHANGELOG.md, when a PR needs a changelog line, when a section is too long or a change may be breaking, or on a changelog conflict.
+---
+
+# Changelog entry
+
+A changelog is written for the person who upgrades. How the change was made, what it cost, and which
+files moved belong in the issue and the pull request.
+
+## The shape of an entry
+
+```
+- [**Breaking:** ]<present-tense verb> <what the user gets> ([#<issue>])
+```
+
+```markdown
+### Changed
+
+- **Breaking:** drop `file` from `get_apex_log_summary` in favour of the scalar `topMethodsSelfPercentage` ([#86])
+- Reduce every tool response with no fact lost: `execute_anonymous` by 30%, `get_apex_log_summary` by 27% ([#86])
+
+<!-- Unreleased -->
+
+[#86]: https://github.com/owner/repo/issues/86
+```
+
+- **One sentence.** No semicolon joining two facts. Two wrapped lines is the ceiling.
+- **Sub-bullets only where one feature has distinct parts** — three at most, each naming one
+  capability. Never how it was built.
+- **Present tense.** "reports", "shows", "flags" — never "reported", "showed".
+- **Breaking entries first** in their section, prefixed `**Breaking:**`.
+- **Then most impactful first.** The entry that changes the most readers' day leads its
+  section. Not commit order, not issue number, not the order you wrote them.
+- **Sections in this order:** Added, Changed, Fixed.
+- **A reference link on every substantial entry**, defined under `<!-- Unreleased -->` at the end of
+  the file. Never an inline URL.
+
+## This repo's house style
+
+```
+- <emoji> **Label**: <what the user gets> ([#issue])
+```
+
+Say what the user gets. No leading verb — the label names the feature. Use an emoji no other entry
+in the section uses.
+
+The root `CHANGELOG.md` is the source. The `lana/` copy is generated by the build — never edit it.
+
+**The file outranks this skill on style.** Match the released sections. Length and jargon are not
+style — those rules always hold.
+
+## Write for the reader, not the author
+
+The reader upgrades the package; they did not write it. Name the outcome they can see.
+
+- **No internal jargon.** No module, class, library or algorithm names. If the reader cannot find
+  the word in the product, cut it.
+- **A fix names the symptom, not the cause.**
+- **A big feature gets one headline entry**, plus up to three sub-bullets for its parts. Detail
+  belongs in the docs.
+
+## What earns an entry
+
+One entry per user-visible change, not one per commit. If a user of the released package cannot see
+it, it gets no entry: a refactor, a renamed internal helper, a test, the mechanism behind a fix.
+
+Give the result, not the method. A number earns its place when the size **is** the result; how it
+was measured does not.
+
+**A performance entry always carries its number** — a multiple or a percentage, and what it is of.
+"Faster" on its own is not an entry, because the reader cannot tell whether to care.
+
+Already-unreleased work: edit the existing entry, and drop a fix for a bug that only ever existed
+in it. A change nobody has received is not a change, and nobody met the bug.
+
+No issue fits? File one, then reference it.
+
+## Wrong, then right
+
+| Wrong                                                                                                         | Right                                                                    |
+| ------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------ |
+| `- Removed destructiveHint from three tools, since the spec says it is meaningless when readOnlyHint is true` | no entry — the user sees no difference                                   |
+| `- Replaced ten per-category properties with one z.partialRecord, cutting ~844 to ~428 tokens`                | fold the result into the one user-facing entry                           |
+| `- Reduced the cost by 31% ([#87](https://.../87))`                                                           | `- Reduce the cost by 31% ([#87])`, plus a reference definition          |
+| `- Refactor CSV parsing to process dataset arrays asynchronously`                                             | `- Fix the freeze on a large CSV export`                                 |
+| `- Replace webview-ui-toolkit with vscode-elements`                                                           | `- Match the host's controls more closely`                               |
+| a feature with six nested sub-bullets                                                                         | a headline sentence, then three sub-bullets at most, one capability each |
+| `- Improve search performance`                                                                                | `- Search a 100MB log 10× faster`                                        |
+| `- Optimise the parser`                                                                                       | `- Cut parse time on a large log by 31%`                                 |
+
+## Trim a section nobody will read
+
+Screens long, or nested three deep. Rewrite the section whole — entry-by-entry edits never merge
+anything, and merging is most of the win.
+
+1. Find the bounds: `grep -n '^## \[' CHANGELOG.md`.
+2. Read the whole section before changing a word.
+3. Draft the replacement in one pass. Three sub-bullets at most under a headline; fold or drop
+   the rest.
+4. Merge entries that name the same surface or the same fix. Three styling entries are one entry.
+5. Drop what the reader cannot see, by the rules above.
+6. Re-order each section by impact. A trimmed section in the old order still buries the lead.
+7. Keep every issue reference. Losing one loses the trail to the detail you cut.
+8. Splice it in, then check the references — left column is used but undefined, right is defined but
+   unused:
+
+   ```bash
+   comm -3 <(grep -v '^\[#' CHANGELOG.md | grep -o '\[#[0-9]*\]' | sort -u) \
+           <(grep -o '^\[#[0-9]*\]' CHANGELOG.md | sort -u)
+   ```
+
+9. Run the repo's formatter.
+
+Report the before/after line count and every entry you merged or dropped. A cut the author disagrees
+with is invisible to them otherwise.
+
+## Versions and migration
+
+- A version heading is added when the release is tagged, with an absolute date: `## [1.0.0] - 2026-03-20`.
+  Until then everything sits under `## [Unreleased]`.
+- **Major** is forced by behaviour that changes for someone who upgrades and changes nothing else.
+- When upgrading needs an action, add a migration note under `## [Unreleased]` that points at it.
+
+## Stacked branches
+
+Every branch in a stack writes into the same `## [Unreleased]` section, so a rebase conflicts there.
+Keep both sides. Losing the other branch's entry is silent, and review will not catch it.

.gitattributes

@@ -1 +1,4 @@
 *.log filter=lfs diff=lfs merge=lfs -text
+
+# e2e fixture: small enough to keep in git, and LFS pointers are not Apex logs
+lana/test/playwright/fixtures/*.log -filter diff merge text

.github/dependabot.yml

@@ -12,10 +12,6 @@ updates:
     # majors are deliberately left out of the minor/patch groups so each one still
     # arrives as its own PR - they need reading and are reverted individually
     groups:
-      # exception: @salesforce/apex-node majors require the matching
-      # @salesforce/core major, so these move in lockstep incl. majors
-      salesforce:
-        patterns: ['@salesforce/*']
       production-dependencies:
         dependency-type: 'production'
         update-types: ['minor', 'patch']

.github/workflows/cd-prerelease.yml

@@ -63,28 +63,22 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v7
       - name: Setup pnpm
-        uses: pnpm/action-setup@v6.0.9
+        uses: pnpm/action-setup@v6.1.0
         with:
           version: 10
       - name: Set up Node
         uses: actions/setup-node@v7
         with:
           node-version: '24'
           cache: 'pnpm'
-      - name: Install vsce + ovsx
-        run: |
-          pnpm add --global @vscode/vsce
-          pnpm add --global ovsx
       - name: Dependencies
         run: pnpm run ci:install
       - name: update pre-release version
         run: |
           echo "Updating pre-release version"
           pnpm run bump-prerelease;
       - name: Package the extension
-        run: |
-          cd lana
-          vsce package --pre-release --no-dependencies
+        run: pnpm --filter lana exec vsce package --pre-release --no-dependencies
       - name: Publish to VS Code Marketplace + Open VSX Registry
         # Tokens via env (not -p) so they don't appear in the process list.
         env:
@@ -93,22 +87,22 @@ jobs:
         run: |
           cd lana
           echo "Verify vsce token has not expired"
-          vsce verify-pat
+          pnpm exec vsce verify-pat
 
           echo "
           Verify ovsx token has not expired"
-          ovsx verify-pat
+          pnpm dlx ovsx@1.1.1 verify-pat
 
           versionNum=$(jq -r '.version' package.json)
           pkgPath="lana-${versionNum}.vsix"
 
           echo "Publish to vsce
           vsix name: $pkgPath"
-          vsce publish --packagePath "${pkgPath}" --no-dependencies --pre-release --skip-duplicate
+          pnpm exec vsce publish --packagePath "${pkgPath}" --no-dependencies --pre-release --skip-duplicate
 
           echo "
           Publish to ovsx"
-          ovsx publish "${pkgPath}" --no-dependencies --pre-release --skip-duplicate
+          pnpm dlx ovsx@1.1.1 publish "${pkgPath}" --no-dependencies --pre-release --skip-duplicate
       - name: Update pre-release tag
         run: |
           echo "Updating pre release tag"

.github/workflows/ci.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches: [main, release/**]
   pull_request:
-    branches: [main, release/**]
   workflow_dispatch:
 
 # Least-privilege default: CI only needs to read the repository.
@@ -19,7 +18,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: pnpm/action-setup@v6.0.9
+      - uses: pnpm/action-setup@v6.1.0
         with:
           version: 10
       - name: Set up Node
@@ -45,7 +44,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: pnpm/action-setup@v6.0.9
+      - uses: pnpm/action-setup@v6.1.0
         with:
           version: 10
       - name: Set up Node
@@ -58,26 +57,73 @@ jobs:
       - name: Tests
         run: pnpm exec jest --selectProjects ${{ matrix.project }} --runInBand
 
+  e2e:
+    name: Test (web e2e)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@v6.1.0
+        with:
+          version: 10
+      - name: Set up Node
+        uses: actions/setup-node@v7
+        with:
+          node-version: '24'
+          cache: 'pnpm'
+      - name: Install Packages
+        run: pnpm run ci:install
+      - name: Install Chromium
+        run: pnpm exec playwright install --with-deps chromium
+      - name: Tests
+        run: pnpm run test:e2e:web
+      - name: Upload Playwright HTML report
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: playwright-report-web
+          path: lana/playwright-report/web
+          if-no-files-found: ignore
+          retention-days: 7
+      - name: Upload Playwright test results
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: playwright-test-results-web
+          path: lana/test-results/web
+          if-no-files-found: ignore
+          retention-days: 7
+
   build:
     name: Verify VSCode Package Build
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: pnpm/action-setup@v6.0.9
+      - uses: pnpm/action-setup@v6.1.0
         with:
           version: 10
       - name: Set up Node
         uses: actions/setup-node@v7
         with:
           node-version: '24'
           cache: 'pnpm'
-      - name: Install vsce
-        run: pnpm add --global @vscode/vsce
       - name: Install Dependencies
         run: pnpm run ci:install
       - name: Build VSCode Package
+        run: pnpm --filter lana run build:vsix
+
+  gate:
+    # The single required status check: the ruleset never needs updating when jobs change.
+    name: CI Gate
+    needs: [verify_files, tests, build]
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check job results
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped')
         run: |
-          cd lana
-          vsce package --no-dependencies
+          echo "A required job did not succeed."
+          exit 1

.github/workflows/codeql.yml

@@ -59,12 +59,12 @@ jobs:
       # JavaScript/TypeScript is analyzed straight from source, so no build is needed
       # (build-mode: none skips the Autobuild dependency-install/build attempt).
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.37.4
+        uses: github/codeql-action/init@v4.37.9
         with:
           languages: ${{ matrix.language }}
           build-mode: none
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.37.4
+        uses: github/codeql-action/analyze@v4.37.9
         with:
           category: '/language:${{matrix.language}}'

.github/workflows/publish-gh-pages.yml

@@ -32,7 +32,7 @@ jobs:
           persist-credentials: false
       # 👇 Build steps
       - name: pnpm setup
-        uses: pnpm/action-setup@v6.0.9
+        uses: pnpm/action-setup@v6.1.0
         with:
           version: 10
       - name: Set up Node

.github/workflows/publish.yml

@@ -16,24 +16,18 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: pnpm/action-setup@v6.0.9
+      - uses: pnpm/action-setup@v6.1.0
         with:
           version: 10
       - name: Set up Node
         uses: actions/setup-node@v7
         with:
           node-version: '24'
           cache: 'pnpm'
-      - name: Install vsce + ovsx
-        run: |
-          pnpm add --global @vscode/vsce
-          pnpm add --global ovsx
       - name: Dependencies
         run: pnpm run ci:install
       - name: Build extension
-        run: |
-          cd lana
-          vsce package --no-dependencies
+        run: pnpm --filter lana run build:vsix
       - name: Publish to VS Code Marketplace + Open VSX Registry
         # Secrets and the release tag are passed via env (not interpolated into the
         # shell) to avoid leaking tokens in the process list and shell injection.
@@ -44,11 +38,11 @@ jobs:
         run: |
           cd lana
           echo "Verify vsce token has not expired"
-          vsce verify-pat
+          pnpm exec vsce verify-pat
           echo "Verify ovsx token has not expired"
-          ovsx verify-pat
+          pnpm dlx ovsx@1.1.1 verify-pat
 
           echo "Publish to vsce"
-          vsce publish --packagePath "lana-${TAG}.vsix" --no-dependencies
+          pnpm exec vsce publish --packagePath "lana-${TAG}.vsix" --no-dependencies
           echo "Publish to ovsx"
-          ovsx publish "lana-${TAG}.vsix" --no-dependencies
+          pnpm dlx ovsx@1.1.1 publish "lana-${TAG}.vsix" --no-dependencies