Skip to content

fix: make asynchronous viewer actions accessible and nested-safe - #264

Open
seonghobae wants to merge 18 commits into
mainfrom
fix/accessible-async-viewer-controls
Open

fix: make asynchronous viewer actions accessible and nested-safe#264
seonghobae wants to merge 18 commits into
mainfrom
fix/accessible-async-viewer-controls

Conversation

@seonghobae

@seonghobae seonghobae commented Aug 5, 2026

Copy link
Copy Markdown
Collaborator

Accessibility objective

Improve the Clearfolio viewer demo's async-state and repeated-table-action semantics without introducing HTML parsing or losing original DOM and accessibility state. This clean PR supersedes #162, whose Jules-managed branch repeatedly reintroduced stale workflow pins, duplicated changelog sections, and an unsafe innerHTML restoration recommendation.

Changes

  • Add document-specific accessible names for Details, Status JSON, and Open viewer actions.
  • Add a reusable, documented WeakMap-backed busy-state helper that preserves original child-node identities, disabled state, aria-busy, and aria-label exactly once.
  • Support nested/repeated busy calls with depth counting and idempotent restore functions; only the final restore reinstates the original state.
  • Use textContent and node preservation (Array.from(childNodes) / replaceChildren(...)); never back up or restore innerHTML.
  • Expose operation-specific pending accessible names and prevent duplicate activation while work is pending.
  • Apply the same busy-state contract to both Details and asynchronous Status JSON; the latter announces Loading status JSON... while its evidence request is pending.
  • Add executable Node DOM tests for contextual and omitted labels, inert markup-like filenames, initially disabled controls, pre-existing and empty ARIA values, nested calls, duplicate restores, original node identity, pending/restored behavior, and the operation-specific Status JSON pending label.
  • Run those tests during Maven test with exact 100% line, branch, and function coverage thresholds for the production DOM helper.
  • Pin Node.js 24 through a full-SHA actions/setup-node step.
  • Consolidate the duplicate Unreleased changelog section and update the accessibility engineering journal.
  • Reconcile the product change with current protected main while preserving the PDF.js integration contract.
  • Remove the one-off reconciliation workflow after GitHub Advanced Security correctly flagged its write-scoped token; the addressed thread is resolved and the privileged workflow is absent from the final diff.

Exact-head evidence

Exact current head 718107a7a6eaca15a1f3e33ea7ceebefaf23d85a is based on current protected main at f3cc09a9838f0f88c81a2ceae22138fab80a2edb. Relative to previously validated head b3453021182e99337e67d8b57a237f7196bd4e53, it changes only src/main/resources/static/assets/viewer/demo.js and src/test/js/demo-integration.test.mjs, with two replacement lines in each file to make and verify the Status JSON pending name operation-specific.

Exact-head CI run 30977565425, Security Scan run 30977565430, SAST Semgrep run 30977565499, and fuzz run 30977565442 completed successfully. CodeRabbit's exact-head inspection found no source-level blocker and the legacy CodeRabbit status is successful. All review threads are resolved or outdated. The independent repository approval and any still-running required organization check such as strix remain merge gates.

Merge gate

Do not merge until every exact-head required check, including strix when required by the organization ruleset, is successful and an independent approving reviewer with repository write access is present. Every branch-protection, security, accessibility, coverage, and repository-policy gate must remain satisfied for 718107a7a6eaca15a1f3e33ea7ceebefaf23d85a.

@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 2 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ddad09e6-9662-4ee6-87d2-c89ec5a73e4e

📥 Commits

Reviewing files that changed from the base of the PR and between f3cc09a and 718107a.

📒 Files selected for processing (8)
  • .github/workflows/ci.yml
  • .jules/palette.md
  • CHANGELOG.md
  • pom.xml
  • src/main/resources/static/assets/viewer/demo.js
  • src/main/resources/static/assets/viewer/dom-utils.js
  • src/test/js/demo-integration.test.mjs
  • src/test/js/dom-utils.test.mjs

Comment @coderabbitai help to get the list of available commands.

Copy link
Copy Markdown
Collaborator Author

@coderabbitai review

@opencode-agent @cwl-noema-review Please independently review exact current head 81c2c7f0cc8326e049429ef99ef64a9fa40f77b4. This one-commit branch supersedes the mutable Jules branch #162. Verify the nested-safe WeakMap busy-state contract, exact DOM/ARIA restoration, contextual accessible names, inert markup-like labels, executable Node tests, 100% line/branch/function coverage for the production helper, Java test/Javadoc gates, and all repository protections. Submit APPROVE only after exact-head CI, Security Scan, SAST, and fuzzing are complete and clean.

@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown

@seonghobae I will review pull request #264 at the specified commit.

I will check the busy-state contract, DOM and ARIA restoration, accessible names, test coverage, and required repository checks. I will not approve the pull request until the exact-head checks and required protections are complete and clean.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@seonghobae
seonghobae enabled auto-merge (squash) August 5, 2026 02:27

Copy link
Copy Markdown
Collaborator Author

@coderabbitai review

Copy link
Copy Markdown
Collaborator Author

@opencode-agent Please independently review exact current head 81c2c7f0cc8326e049429ef99ef64a9fa40f77b4. This clean PR supersedes #162 and is one commit on the protected main baseline. Exact-head CI, Security Scan, SAST Semgrep, and fuzzing are successful. Verify the shared WeakMap busy-state contract, consumer import, contextual accessible names, inert text handling, Node 100% line/branch/function gate, changelog consolidation, and repository protection evidence before approval.

@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown
⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Copy link
Copy Markdown
Collaborator Author

@cwl-noema-review Please independently review exact current head 81c2c7f0cc8326e049429ef99ef64a9fa40f77b4. This clean one-commit PR supersedes #162 and exact-head CI, Security Scan, SAST Semgrep, and fuzzing are successful. Verify the production consumer import, WeakMap depth/idempotence contract, exact restoration of DOM/disabled/ARIA state, contextual inert labels, Node 100% line/branch/function gate, documentation, and repository protections. Submit APPROVE only for this exact head if no blocker remains.

Copy link
Copy Markdown
Collaborator Author

@coderabbitai review

@opencode-agent @cwl-noema-review Please independently review exact current head 734a72686f5671f757cd9f2a6e1fec0ecc93d1fe. CI, Security Scan, SAST Semgrep, and fuzzing are successful on this head. Verify the shared WeakMap state contract, production consumer import, contextual and inert labels, exact DOM/disabled/ARIA restoration, full-SHA Node.js 24 pin, Node 100% line/branch/function gate, documentation, and repository protections. Submit APPROVE only for this exact head if no blocker remains.

@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown

@seonghobae I will review pull request #264 at exact head 734a72686f5671f757cd9f2a6e1fec0ecc93d1fe. I will verify the requested implementation and check requirements before I approve it.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Copy link
Copy Markdown
Collaborator Author

@opencode-agent @cwl-noema-review Please independently review exact current head 734a72686f5671f757cd9f2a6e1fec0ecc93d1fe. Exact-head CI, Node 24 executable DOM tests with 100% dom-utils.js line/branch/function coverage, Security Scan, SAST Semgrep, fuzzing, and CodeRabbit all succeed. Verify document-specific action names, original child-node identity preservation, exact disabled/ARIA restoration, nested/idempotent WeakMap busy state, markup-like filename inertness, duplicate-activation prevention, Java/JaCoCo preservation, pinned Actions, consolidated CHANGELOG, and accessibility doctoring. Submit APPROVE only if no blocker remains.

Copy link
Copy Markdown
Collaborator Author

@coderabbitai review

@opencode-agent @cwl-noema-review Please independently review exact current head 734a72686f5671f757cd9f2a6e1fec0ecc93d1fe. Current-head CI, Security Scan, SAST Semgrep, and fuzz are successful. Verify the WeakMap depth-counted busy-state contract, idempotent and exact DOM/disabled/ARIA restoration, inert treatment of markup-like document names, operation-specific accessible names, duplicate-activation prevention, Node 24 full-SHA workflow pin, and exact 100% line/branch/function coverage for dom-utils.js. Submit APPROVE only for this exact head after all repository protections pass.

@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

expected='734a72686f5671f757cd9f2a6e1fec0ecc93d1fe'

printf '%s\n' '== Local commit and changed files =='
git rev-parse HEAD
git diff --name-status "${expected}^" "${expected}"
git diff --stat "${expected}^" "${expected}"

printf '%s\n' '== JavaScript and build/workflow candidates =='
fd -t f . | rg '(^|/)(dom-utils\.js|.*dom.*test.*\.(js|mjs|cjs)|pom\.xml|CHANGELOG.*|.*journal.*|.*accessib.*|.*\.ya?ml)$' || true

printf '%s\n' '== Source outlines =='
while IFS= read -r f; do
  case "$f" in
    *.js|*.mjs|*.cjs)
      echo "--- $f"
      ast-grep outline "$f" --items all || true
      ;;
  esac
done < <(git diff --name-only "${expected}^" "${expected}" | rg '\.(js|mjs|cjs)$' || true)

printf '%s\n' '== Changed diff =='
git diff --find-renames --find-copies "${expected}^" "${expected}"

printf '%s\n' '== GitHub PR, checks, and protection metadata =='
gh pr view 264 --repo ContextualWisdomLab/clearfolio --json number,headRefOid,baseRefName,state,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup,url
gh api 'repos/ContextualWisdomLab/clearfolio/commits/734a72686f5671f757cd9f2a6e1fec0ecc93d1fe/check-runs?per_page=100' \
  --jq '.check_runs[] | [.name,.status,.conclusion,.details_url] | `@tsv`' || true
gh api 'repos/ContextualWisdomLab/clearfolio/branches/main/protection' || true

Length of output: 2177


🏁 Script executed:

#!/bin/bash
set -u

repo='ContextualWisdomLab/clearfolio'
sha='734a72686f5671f757cd9f2a6e1fec0ecc93d1fe'

echo '== Pull request metadata =='
gh pr view 264 --repo "$repo" --json number,headRefOid,baseRefName,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup,url || true

echo '== Pull request file list =='
gh pr diff 264 --repo "$repo" --name-only || true

echo '== Merge base and full pull request changed files =='
base="$(git merge-base HEAD origin/main 2>/dev/null || true)"
printf 'merge-base=%s\n' "$base"
if [ -n "$base" ]; then
  git diff --name-status "$base" HEAD
fi

echo '== dom-utils.js outline and content =='
ast-grep outline src/main/resources/static/assets/viewer/dom-utils.js --items all || true
nl -ba src/main/resources/static/assets/viewer/dom-utils.js | sed -n '1,320p' || true

echo '== Node DOM test content =='
nl -ba src/test/js/dom-utils.test.mjs | sed -n '1,420p' || true

echo '== Maven Node test and coverage configuration =='
rg -n -C 12 'dom-utils|node|coverage|nyc|c8|exec-maven|frontend' pom.xml || true

echo '== CI Node setup configuration =='
nl -ba .github/workflows/ci.yml | sed -n '1,260p' || true

echo '== Production consumers and accessible action labels =='
rg -n -C 8 'setBusy|busy|Details|Status JSON|Open viewer|aria-label|disabled' src/main/resources/static || true

echo '== Changelog and accessibility documentation changes from merge base =='
if [ -n "$base" ]; then
  git diff --unified=40 "$base" HEAD -- CHANGELOG.md docs || true
fi

Length of output: 45940


🏁 Script executed:

#!/bin/bash
set -u

repo='ContextualWisdomLab/clearfolio'
base='8e2d36f260395dbd0304abc503d8bd15ffcf8dab'
head='734a72686f5671f757cd9f2a6e1fec0ecc93d1fe'

echo '== Complete helper implementation =='
sed -n '1,180p' src/main/resources/static/assets/viewer/dom-utils.js || true

echo '== Complete executable Node DOM test =='
sed -n '1,460p' src/test/js/dom-utils.test.mjs || true

echo '== Relevant production consumer implementation =='
sed -n '100,155p' src/main/resources/static/assets/viewer/demo.js || true
sed -n '250,520p' src/main/resources/static/assets/viewer/demo.js || true

echo '== Complete CI workflow =='
sed -n '1,300p' .github/workflows/ci.yml || true

echo '== Focused base-to-head diffs =='
git diff --check "$base" "$head" || true
git diff --unified=20 "$base" "$head" -- \
  .github/workflows/ci.yml pom.xml \
  src/main/resources/static/assets/viewer/demo.js \
  src/main/resources/static/assets/viewer/dom-utils.js \
  src/test/js/dom-utils.test.mjs || true

echo '== Pin format checks =='
rg -n -P 'uses:\s*actions/setup-node@|node-version:|node-version-file:' .github/workflows/ci.yml || true

echo '== Required reviews and branch protection =='
gh pr view 264 --repo "$repo" --json latestReviews,reviewRequests,reviewDecision,mergeStateStatus || true
gh api "repos/$repo/branches/main/protection" || true
gh api "repos/$repo/rules/branches/main" || true

Length of output: 57297


@seonghobae Review complete for exact head 734a72686f5671f757cd9f2a6e1fec0ecc93d1fe.

Blocking finding: src/main/resources/static/assets/viewer/demo.js Line 135 creates the Status JSON button without setBusyState. openJsonDocument() is asynchronous. While its fetch is pending, users can activate the button again and open additional popup windows. The action also has no pending accessible name.

Apply setBusyState to this handler and restore it after openJsonDocument() settles. Use an operation-specific pending label, such as Loading status JSON....

I verified the shared WeakMap helper, exact DOM/ARIA restoration, node identity preservation, inert text handling, Node 24 full-SHA pin, Maven coverage thresholds, and successful exact-head checks. I did not approve because this blocker remains. GitHub also reports REVIEW_REQUIRED and BLOCKED; the repository ruleset requires one approving review.

You are interacting with an AI system.

seonghobae added a commit that referenced this pull request Aug 5, 2026
This branch has been superseded by a cleaner replacement PR (#264).
No further work will be performed on this branch.
Comment thread .github/workflows/verify-demo-integration.yml Fixed
@opencode-agent
opencode-agent Bot disabled auto-merge August 5, 2026 03:17

Copy link
Copy Markdown
Collaborator Author

@coderabbitai review

@opencode-agent @cwl-noema-review Please independently review exact current head 347203d5dc7b6bd4a53877f322bbaba28acb527f. The current-head CI, Security Scan, SAST Semgrep, and fuzz workflows all succeed. The prior CI failure was traced to the executable integration test's DOM double incorrectly manufacturing an empty text node for textContent = ""; the current head now models browser child-removal semantics and preserves exact 100% line, branch, and function coverage for dom-utils.js. Verify the WeakMap depth-counted busy-state contract, idempotent exact DOM/disabled/ARIA restoration, contextual inert document labels, duplicate-activation prevention, full-SHA Node.js 24 pin, test-double fidelity, documentation, and repository protections. Submit APPROVE only for this exact head if no blocker remains.

@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/clearfolio'
sha='347203d5dc7b6bd4a53877f322bbaba28acb527f'

echo '== Exact head and PR metadata =='
printf 'local HEAD: '; git rev-parse HEAD
git show -s --format='commit: %H%nparents: %P%nsubject: %s' "$sha"
gh pr view 264 --repo "$repo" \
  --json number,url,state,isDraft,headRefOid,baseRefName,baseRefOid,mergeStateStatus,reviewDecision,statusCheckRollup,latestReviews

echo '== Pull request diff summary =='
base="$(git merge-base "$sha" origin/main)"
printf 'merge-base: %s\n' "$base"
git diff --check "$base" "$sha"
git diff --name-status "$base" "$sha"

echo '== Relevant source outlines =='
ast-grep outline src/main/resources/static/assets/viewer/dom-utils.js --items all
ast-grep outline src/main/resources/static/assets/viewer/demo.js --items all
ast-grep outline src/test/js/dom-utils.test.mjs --items all

echo '== Busy helper =='
nl -ba src/main/resources/static/assets/viewer/dom-utils.js | sed -n '1,260p'

echo '== Viewer consumers and accessible labels =='
rg -n -C 10 -P '\b(setBusyState|openJsonDocument|openViewer|Details|Status JSON|Open viewer|aria-label|aria-busy|disabled)\b' \
  src/main/resources/static/assets/viewer/demo.js

echo '== DOM helper tests and test-double semantics =='
rg -n -C 10 -P '(textContent|childNodes|replaceChildren|setBusyState|nested|restore|aria-busy|aria-label|disabled)' \
  src/test/js/dom-utils.test.mjs

echo '== Maven test and coverage configuration =='
rg -n -C 12 -P '(dom-utils|node|c8|coverage|line|branch|function|exec-maven)' pom.xml

echo '== Node setup pin =='
rg -n -C 4 -P '(actions/setup-node@|node-version:)' .github/workflows/ci.yml

echo '== Documentation changes =='
git diff --unified=20 "$base" "$sha" -- CHANGELOG.md docs

echo '== Exact-commit checks =='
gh api "repos/$repo/commits/$sha/check-runs?per_page=100" --paginate \
  --jq '.check_runs[] | [.name, .status, .conclusion, .details_url] | `@tsv`'

echo '== Branch protection and rules =='
gh api "repos/$repo/branches/main/protection" || true
gh api "repos/$repo/rules/branches/main" || true

Length of output: 15907


🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/clearfolio'
sha='347203d5dc7b6bd4a53877f322bbaba28acb527f'
base='8e2d36f260395dbd0304abc503d8bd15ffcf8dab'

echo '== Helper implementation =='
sed -n '1,180p' src/main/resources/static/assets/viewer/dom-utils.js

echo '== Async viewer actions =='
sed -n '75,150p' src/main/resources/static/assets/viewer/demo.js
sed -n '220,310p' src/main/resources/static/assets/viewer/demo.js

echo '== DOM helper tests =='
sed -n '1,360p' src/test/js/dom-utils.test.mjs

echo '== Integration test and DOM double =='
sed -n '1,420p' src/test/js/demo-integration.test.mjs

echo '== Maven Node test and coverage gate =='
grep -n -E -C 12 'dom-utils|node|c8|coverage|line|branch|function|exec-maven' pom.xml || true

echo '== CI Node setup =='
grep -n -E -C 4 'actions/setup-node@|node-version:' .github/workflows/ci.yml || true

echo '== Exact relevant diff =='
git diff --check "$base" "$sha"
git diff --unified=30 "$base" "$sha" -- \
  .github/workflows/ci.yml pom.xml CHANGELOG.md .jules/palette.md \
  src/main/resources/static/assets/viewer/demo.js \
  src/main/resources/static/assets/viewer/dom-utils.js \
  src/test/js/dom-utils.test.mjs src/test/js/demo-integration.test.mjs

echo '== Current exact-head check states =='
gh api "repos/$repo/commits/$sha/check-runs?per_page=100" --paginate \
  --jq '.check_runs[] | select(.name == "strix" or .name == "Maven test" or .name == "Semgrep (multi-language SAST)" or .name == "osv-scan" or .name == "fuzz (ArtifactTokenParserFuzzTest)") | [.name,.status,.conclusion] | `@tsv`'

echo '== Required branch protection =='
gh api "repos/$repo/branches/main/protection/required_status_checks" || true
gh api "repos/$repo/branches/main/protection/required_pull_request_reviews" || true
gh api "repos/$repo/rules/branches/main" || true

Length of output: 76067


@seonghobae Review complete for exact head 347203d5dc7b6bd4a53877f322bbaba28acb527f.

Blocking finding: The Status JSON action in src/main/resources/static/assets/viewer/demo.js still calls asynchronous openJsonDocument() without setBusyState.

A user can activate this action again before fetchJson() completes. This can open more popup windows. The action also has no pending accessible name.

Apply the shared helper in this handler. Restore the state when openJsonDocument() settles. Use an operation-specific pending label such as Loading status JSON....

I verified the WeakMap depth and idempotence contract, exact DOM and ARIA restoration, original child-node preservation, contextual inert labels, integration test DOM semantics for textContent = "", Node 24 full-SHA setup pin, Maven Node coverage thresholds, changelog consolidation, and journal documentation.

I did not approve this PR. The source blocker remains. The exact-head strix check is also still in progress. GitHub reports the PR as blocked and requires an approval. The branch-protection REST endpoints returned 403, but the available ruleset data shows the required organization workflows and one required approving review.


✏️ Learnings added
Learnt from: seonghobae
URL: https://github.com/ContextualWisdomLab/clearfolio/pull/264

Timestamp: 2026-08-05T03:30:42.098Z
Learning: In `src/test/js/demo-integration.test.mjs`, the `MockElement.textContent` setter must model browser semantics: assigning `textContent = ""` removes all child nodes rather than creating an empty text node. This behavior is necessary for executable viewer integration tests that verify rendered DOM structure.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

You are interacting with an AI system.

Copy link
Copy Markdown
Collaborator Author

@coderabbitai review

@opencode-agent @cwl-noema-review Please independently review exact current head 347203d5dc7b6bd4a53877f322bbaba28acb527f. CI, Security Scan, SAST Semgrep, and fuzzing all succeeded on this head. Verify the production demo.js consumer import, WeakMap nesting/idempotence contract, exact DOM/disabled/ARIA restoration, inert contextual labels, executable non-empty-history integration test, full-SHA Node.js 24 pin, 100% Node line/branch/function gate, documentation, and repository protections. Submit approval only for this exact head if no blocker remains.

@seonghobae
seonghobae enabled auto-merge (squash) August 5, 2026 03:32

Copy link
Copy Markdown
Collaborator Author

@coderabbitai review

@opencode-agent @cwl-noema-review Please independently review exact current head 347203d5dc7b6bd4a53877f322bbaba28acb527f. Exact-head CI run 30972309198, Security Scan 30972309188, SAST Semgrep 30972309203, and fuzz 30972309205 are successful. Verify WeakMap depth-counted busy-state behavior, exact and idempotent DOM/disabled/ARIA restoration, inert markup-like filenames, operation-specific accessible names, duplicate-activation prevention, full-SHA Node 24 workflow pinning, demo-module integration, and exact 100% line/branch/function coverage for dom-utils.js. Submit APPROVE only for this exact head and only if all repository protections remain satisfied.

Copy link
Copy Markdown
Collaborator Author

@coderabbitai review

@opencode-agent @cwl-noema-review Please independently review exact current head b3453021182e99337e67d8b57a237f7196bd4e53. The privileged one-off reconciliation workflow was removed after GitHub Advanced Security flagged write-token scope, and its addressed thread is resolved. Verify the accessible nested-safe busy-state contract, inert text handling, executable Node coverage, integration with current main, exact-head CI/security/fuzz results, and repository protections. Submit APPROVE only for this exact head after every required gate passes.

@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/clearfolio'
sha='b3453021182e99337e67d8b57a237f7196bd4e53'

echo '== Exact commit and pull request state =='
printf 'local HEAD: '; git rev-parse HEAD
git show -s --format='commit: %H%nparents: %P%nsubject: %s' "$sha"
gh pr view 264 --repo "$repo" \
  --json number,url,state,isDraft,headRefOid,baseRefName,baseRefOid,mergeStateStatus,reviewDecision,statusCheckRollup,latestReviews

echo '== Merge base and complete diff summary =='
base="$(git merge-base "$sha" origin/main)"
printf 'merge-base: %s\n' "$base"
git diff --check "$base" "$sha"
git diff --name-status "$base" "$sha"
git diff --stat "$base" "$sha"

echo '== Changed JavaScript source and test outlines =='
for file in \
  src/main/resources/static/assets/viewer/dom-utils.js \
  src/main/resources/static/assets/viewer/demo.js \
  src/test/js/dom-utils.test.mjs \
  src/test/js/demo-integration.test.mjs
do
  if [ -f "$file" ]; then
    echo "--- $file"
    ast-grep outline "$file" --items all || true
  fi
done

echo '== Busy helper and async viewer consumers =='
nl -ba src/main/resources/static/assets/viewer/dom-utils.js | sed -n '1,260p'
nl -ba src/main/resources/static/assets/viewer/demo.js | sed -n '1,180p'
nl -ba src/main/resources/static/assets/viewer/demo.js | sed -n '215,330p'
nl -ba src/main/resources/static/assets/viewer/demo.js | sed -n '420,590p'

echo '== Unit and production-module integration tests =='
nl -ba src/test/js/dom-utils.test.mjs | sed -n '1,500p'
nl -ba src/test/js/demo-integration.test.mjs | sed -n '1,600p'

echo '== Maven Node test and coverage configuration =='
rg -n -C 16 -P '(dom-utils|node|c8|coverage|line|branch|function|exec-maven)' pom.xml || true

echo '== CI Node pin and changed workflow files =='
rg -n -C 6 -P '(actions/setup-node@|node-version:)' .github/workflows/ci.yml || true
git diff --unified=35 "$base" "$sha" -- .github/workflows pom.xml \
  src/main/resources/static/assets/viewer/dom-utils.js \
  src/main/resources/static/assets/viewer/demo.js \
  src/test/js/dom-utils.test.mjs \
  src/test/js/demo-integration.test.mjs \
  CHANGELOG.md docs .jules/palette.md

echo '== Exact-head checks =='
gh api "repos/$repo/commits/$sha/check-runs?per_page=100" --paginate \
  --jq '.check_runs[] | [.name,.status,.conclusion,.details_url] | `@tsv`'

echo '== Review threads, branch protection, and branch rules =='
gh pr view 264 --repo "$repo" --json reviewThreads,headRefOid,mergeStateStatus,reviewDecision,latestReviews || true
gh api "repos/$repo/branches/main/protection" || true
gh api "repos/$repo/rules/branches/main" || true

Length of output: 17680


🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/clearfolio'
sha='b3453021182e99337e67d8b57a237f7196bd4e53'
base='f3cc09a9838f0f88c81a2ceae22138fab80a2edb'

numbered() {
  awk '{ printf "%6d\t%s\n", NR, $0 }' "$1"
}

echo '== Busy-state helper =='
numbered src/main/resources/static/assets/viewer/dom-utils.js | sed -n '1,240p'

echo '== Demo import, JSON action, Details action, and Open viewer action =='
numbered src/main/resources/static/assets/viewer/demo.js | sed -n '1,180p'
numbered src/main/resources/static/assets/viewer/demo.js | sed -n '215,320p'
numbered src/main/resources/static/assets/viewer/demo.js | sed -n '420,590p'

echo '== All production setBusyState call sites =='
rg -n -C 12 -P '\bsetBusyState\s*\(' src/main/resources/static/assets/viewer/demo.js

echo '== Busy-state unit tests =='
numbered src/test/js/dom-utils.test.mjs | sed -n '1,500p'

echo '== Production-module integration tests =='
numbered src/test/js/demo-integration.test.mjs | sed -n '1,620p'

echo '== Maven test execution and c8 thresholds =='
rg -n -C 20 -P '(dom-utils|node|c8|coverage|line|branch|function|exec-maven)' pom.xml

echo '== Node setup action pin =='
rg -n -C 8 -P '(actions/setup-node@|node-version:)' .github/workflows/ci.yml

echo '== Changed workflow, source, test, and documentation diff =='
git diff --check "$base" "$sha"
git diff --unified=40 "$base" "$sha" -- \
  .github/workflows pom.xml CHANGELOG.md .jules/palette.md \
  src/main/resources/static/assets/viewer/dom-utils.js \
  src/main/resources/static/assets/viewer/demo.js \
  src/test/js/dom-utils.test.mjs \
  src/test/js/demo-integration.test.mjs

echo '== Exact-head check states, review threads, and rules =='
gh api "repos/$repo/commits/$sha/check-runs?per_page=100" --paginate \
  --jq '.check_runs[] | select(
    .name == "Maven test"
    or .name == "strix"
    or .name == "Semgrep (multi-language SAST)"
    or .name == "osv-scan"
    or (.name | startswith("fuzz"))
  ) | [.name,.status,.conclusion] | `@tsv`'
gh pr view 264 --repo "$repo" \
  --json headRefOid,mergeStateStatus,reviewDecision,reviewThreads,latestReviews
gh api "repos/$repo/branches/main/protection" || true
gh api "repos/$repo/rules/branches/main" || true

Length of output: 102302


🏁 Script executed:

#!/bin/bash
set -u

repo='ContextualWisdomLab/clearfolio'
sha='b3453021182e99337e67d8b57a237f7196bd4e53'

echo '== Removal commit and removed reconciliation workflow =='
git show --format='commit: %H%nparents: %P%nsubject: %s' --name-status "$sha"
git show --format= --find-renames --find-copies "$sha" -- .github/workflows || true

echo '== Exact-head required check states =='
gh api "repos/$repo/commits/$sha/check-runs?per_page=100" --paginate \
  --jq '.check_runs[]
    | select(
        .name == "Maven test"
        or .name == "strix"
        or .name == "Semgrep (multi-language SAST)"
        or .name == "osv-scan"
        or (.name | startswith("fuzz"))
      )
    | [.name, .status, .conclusion, .details_url]
    | `@tsv`' || true

echo '== Pull request head and merge state =='
gh pr view 264 --repo "$repo" \
  --json headRefOid,mergeStateStatus,reviewDecision,latestReviews,statusCheckRollup || true

echo '== Unresolved review threads =='
gh api graphql \
  -F owner='ContextualWisdomLab' \
  -F name='clearfolio' \
  -F number=264 \
  -f query='
query($owner: String!, $name: String!, $number: Int!) {
  repository(owner: $owner, name: $name) {
    pullRequest(number: $number) {
      reviewThreads(first: 100) {
        nodes {
          isResolved
          comments(first: 1) { nodes { author { login } body path line } }
        }
      }
    }
  }
}' \
  --jq '.data.repository.pullRequest.reviewThreads.nodes[]
    | select(.isResolved == false)
    | [.comments.nodes[0].author.login, .comments.nodes[0].path, (.comments.nodes[0].line | tostring), .comments.nodes[0].body]
    | `@tsv`' || true

echo '== Available branch protection and rulesets =='
gh api "repos/$repo/branches/main/protection" || true
gh api "repos/$repo/rules/branches/main" || true
gh api "repos/$repo/rulesets?includes_parents=true" || true

Length of output: 21945


@seonghobae Review complete for exact head b3453021182e99337e67d8b57a237f7196bd4e53.

I found no source-level blocker.

  • The PR merge base matches the reported current main base.
  • The commit removes .github/workflows/reconcile-pr-264-on-main.yml. The deleted workflow had contents: write and persist-credentials: true.
  • setBusyState uses a WeakMap, depth counting, and idempotent restore callbacks.
  • The helper preserves original child-node identities and restores disabled, aria-busy, and aria-label exactly.
  • Details and Status JSON use the helper before asynchronous work. Status JSON restores state through .finally(restore).
  • The pending Status JSON accessible name is contextual: Loading... View status JSON for <document>.
  • Visible document names use textContent. The integration test verifies that markup-like filenames remain inert text.
  • The integration test verifies pending and restored Status JSON state, popup opener isolation, and rendered JSON.
  • Maven runs the Node tests during test and requires 100% line, branch, and function coverage for dom-utils.js.
  • CI pins Node.js 24 through a full-SHA actions/setup-node reference.
  • Maven, Semgrep, OSV scan, and all three fuzz checks succeeded on this exact head.
  • The review-thread query returned no unresolved threads.

I cannot approve yet. The exact-head strix check remains in_progress. GitHub reports BLOCKED and REVIEW_REQUIRED. The available rulesets require the organization workflows, resolved threads, and one approving review. The branch-protection API returned HTTP 403, so I could not inspect its full configuration.

You are interacting with an AI system.

Copy link
Copy Markdown
Collaborator Author

@coderabbitai review

@opencode-agent @cwl-noema-review Please independently review exact current head b3453021182e99337e67d8b57a237f7196bd4e53. Exact-head CI 30974089445, Security Scan 30974089430, SAST Semgrep 30974089408, and fuzz 30974089444 are successful. The temporary write-scoped reconciliation workflow has been removed, and every published inline thread is resolved or outdated after the addressed change. Verify WeakMap depth-counted busy-state behavior, exact and idempotent DOM/disabled/ARIA restoration, inert markup-like filenames, operation-specific accessible names, duplicate-activation prevention, full-SHA Node 24 pinning, demo integration, preservation of the PDF.js 6.1.200 contract, and exact 100% line/branch/function coverage for dom-utils.js. Submit APPROVE only for this exact head and only after all repository protections remain satisfied.

@seonghobae
seonghobae enabled auto-merge (squash) August 5, 2026 04:08
@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/clearfolio'
sha='b3453021182e99337e67d8b57a237f7196bd4e53'

echo '== Exact PR state =='
git rev-parse HEAD
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$sha"
gh pr view 264 --repo "$repo" \
  --json headRefOid,baseRefOid,baseRefName,state,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup,latestReviews

echo '== Merge-base and changed files =='
base="$(git merge-base "$sha" origin/main)"
printf 'base=%s\n' "$base"
git diff --check "$base" "$sha"
git diff --name-status "$base" "$sha"

echo '== Relevant source structure =='
for f in \
  src/main/resources/static/assets/viewer/dom-utils.js \
  src/main/resources/static/assets/viewer/demo.js \
  src/test/js/dom-utils.test.mjs \
  src/test/js/demo-integration.test.mjs
do
  echo "--- $f"
  ast-grep outline "$f" --items all || true
done

echo '== Busy helper and consumers =='
sed -n '1,240p' src/main/resources/static/assets/viewer/dom-utils.js
sed -n '1,175p' src/main/resources/static/assets/viewer/demo.js
sed -n '215,325p' src/main/resources/static/assets/viewer/demo.js
sed -n '420,590p' src/main/resources/static/assets/viewer/demo.js

echo '== Busy-state and integration tests =='
sed -n '1,520p' src/test/js/dom-utils.test.mjs
sed -n '1,620p' src/test/js/demo-integration.test.mjs

echo '== Test coverage and Node pin =='
rg -n -C 16 -P '(dom-utils|node|c8|coverage|line|branch|function|exec-maven)' pom.xml
rg -n -C 6 -P '(actions/setup-node@|node-version:)' .github/workflows/ci.yml

echo '== PDF.js contract evidence =='
rg -n -C 4 -P '(pdfjs|pdf\.js|PDF\.js|6\.1\.200|version)' pom.xml src/main README.md CHANGELOG.md || true

echo '== Workflow removal and focused diff =='
git diff --name-status "$base" "$sha" -- .github/workflows
git diff --unified=25 "$base" "$sha" -- \
  .github/workflows pom.xml \
  src/main/resources/static/assets/viewer/dom-utils.js \
  src/main/resources/static/assets/viewer/demo.js \
  src/test/js/dom-utils.test.mjs \
  src/test/js/demo-integration.test.mjs

echo '== Exact-head check results =='
gh api "repos/$repo/commits/$sha/check-runs?per_page=100" --paginate \
  --jq '.check_runs[] | [.name,.status,.conclusion] | `@tsv`'

echo '== Unresolved review threads =='
gh api graphql \
  -F owner='ContextualWisdomLab' -F name='clearfolio' -F number=264 \
  -f query='
query($owner: String!, $name: String!, $number: Int!) {
  repository(owner: $owner, name: $name) {
    pullRequest(number: $number) {
      reviewThreads(first: 100) {
        nodes {
          isResolved
          comments(first: 1) { nodes { author { login } path line body } }
        }
      }
    }
  }
}' \
  --jq '.data.repository.pullRequest.reviewThreads.nodes[]
    | select(.isResolved == false)
    | [.comments.nodes[0].author.login,.comments.nodes[0].path,(.comments.nodes[0].line|tostring),.comments.nodes[0].body] | `@tsv`'

echo '== Available protection and ruleset configuration =='
gh api "repos/$repo/branches/main/protection" || true
gh api "repos/$repo/rules/branches/main" || true
gh api "repos/$repo/rulesets?includes_parents=true" || true

Length of output: 188259


@seonghobae Review complete for exact head b3453021182e99337e67d8b57a237f7196bd4e53.

I found no source-level blocker.

I verified the following items:

  • setBusyState uses a WeakMap and depth counting.
  • Each restore callback is idempotent.
  • The helper preserves the original child-node identities.
  • The helper restores disabled, aria-busy, and aria-label exactly. It distinguishes absent and empty ARIA values.
  • Details and Status JSON apply the helper before asynchronous work.
  • Status JSON restores the state in .finally(restore).
  • The pending status label includes the document-specific accessible name.
  • Repeated status activation is blocked while the request is pending.
  • textContent renders markup-like filenames as inert text.
  • The integration test verifies contextual labels, busy state, restoration, popup opener isolation, and rendered JSON.
  • Maven runs the Node tests during test.
  • Maven specifies 100% line, branch, and function coverage for src/main/resources/static/assets/viewer/dom-utils.js.
  • CI uses Node.js 24 and pins actions/setup-node by full SHA.
  • The PDF.js module and worker paths remain pinned to version 6.1.200.
  • The write-scoped reconciliation workflow is absent.
  • The review-thread query returned no unresolved threads.
  • Maven test, Semgrep, OSV scan, Trivy, CodeQL, and all fuzz checks succeeded for this commit.

I cannot approve yet. The exact-head strix check remains in_progress.

The available rulesets require resolved review threads and one repository approval. The protected-branch API returned HTTP 403, so I could not verify the complete branch-protection configuration.

You are interacting with an AI system.

Copy link
Copy Markdown
Collaborator Author

@opencode-agent @cwl-noema-review Please independently review exact current head b3453021182e99337e67d8b57a237f7196bd4e53. Exact-head CI, Security Scan, SAST Semgrep, fuzzing, and CodeRabbit status are successful; the two GitHub Advanced Security token-permission findings are resolved/outdated because the privileged reconciliation workflows are absent from the final diff, and auto-merge is enabled. Verify document-specific accessible names, nested/idempotent busy-state restoration, original node identity preservation, inert markup-like filenames, duplicate-activation prevention, real demo.js integration coverage, exact 100% Node line/branch/function coverage for the production helper, retained PDF.js 6.1.200 integration, and all repository protections. Submit APPROVE only for this exact head if no blocker remains.

Copy link
Copy Markdown
Collaborator Author

Addressed the valid current-source accessibility finding on exact head 718107a7a6eaca15a1f3e33ea7ceebefaf23d85a. The asynchronous Status JSON action already used the shared setBusyState contract; it now exposes the operation-specific pending text and accessible name Loading status JSON..., and the executable integration test asserts the disabled state, aria-busy, contextual pending label, exact restoration, and successful JSON rendering. Relative to reviewed head b3453021182e99337e67d8b57a237f7196bd4e53, only demo.js and demo-integration.test.mjs changed by two replacements each. Exact-head CI, Security Scan, SAST Semgrep, and fuzz are running. @coderabbitai review

@opencode-agent @cwl-noema-review Please independently review only exact head 718107a7a6eaca15a1f3e33ea7ceebefaf23d85a after all current-head gates complete. Verify repeated activation is prevented, the pending accessible name is operation-specific, original DOM/ARIA state is restored, tests remain executable with required coverage, and all repository protections pass. Submit APPROVE only for this exact head if no blocker remains.

@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/clearfolio'
prior='b3453021182e99337e67d8b57a237f7196bd4e53'
head='718107a7a6eaca15a1f3e33ea7ceebefaf23d85a'

echo '== Exact head and pull request state =='
printf 'local HEAD: '; git rev-parse HEAD
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
gh pr view 264 --repo "$repo" \
  --json number,headRefOid,baseRefOid,baseRefName,state,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup,latestReviews

echo '== Focused source and test diff =='
git diff --check "$prior" "$head"
git diff --name-status "$prior" "$head"
git diff --unified=50 "$prior" "$head" -- \
  src/main/resources/static/assets/viewer/demo.js \
  src/test/js/demo-integration.test.mjs

echo '== Source maps =='
ast-grep outline src/main/resources/static/assets/viewer/demo.js --items all
ast-grep outline src/main/resources/static/assets/viewer/dom-utils.js --items all
ast-grep outline src/test/js/demo-integration.test.mjs --items all

echo '== Status JSON action and busy-state helper =='
nl -ba src/main/resources/static/assets/viewer/demo.js | sed -n '105,160p'
nl -ba src/main/resources/static/assets/viewer/dom-utils.js | sed -n '1,220p'

echo '== Focused integration-test assertions =='
rg -n -C 16 -P '(Status JSON|Loading status JSON|aria-busy|disabled|pending|openJsonDocument|fetchJson|window\.open|restore)' \
  src/test/js/demo-integration.test.mjs

echo '== Maven Node test and coverage configuration =='
rg -n -C 16 -P '(dom-utils|node|c8|coverage|line|branch|function|exec-maven)' pom.xml

echo '== Exact-head check runs =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" --paginate \
  --jq '.check_runs[] | [.name,.status,.conclusion,.details_url] | `@tsv`'

echo '== Unresolved review threads =='
gh api graphql \
  -F owner='ContextualWisdomLab' -F name='clearfolio' -F number=264 \
  -f query='
query($owner: String!, $name: String!, $number: Int!) {
  repository(owner: $owner, name: $name) {
    pullRequest(number: $number) {
      reviewThreads(first: 100) {
        nodes {
          isResolved
          comments(first: 1) { nodes { author { login } path line body } }
        }
      }
    }
  }
}' \
  --jq '.data.repository.pullRequest.reviewThreads.nodes[]
    | select(.isResolved == false)
    | [.comments.nodes[0].author.login,.comments.nodes[0].path,(.comments.nodes[0].line|tostring),.comments.nodes[0].body] | `@tsv`' || true

echo '== Available branch protection and rulesets =='
gh api "repos/$repo/branches/main/protection" || true
gh api "repos/$repo/rules/branches/main" || true
gh api "repos/$repo/rulesets?includes_parents=true" || true

Length of output: 22837


🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/clearfolio'
head='718107a7a6eaca15a1f3e33ea7ceebefaf23d85a'

echo '== Busy-state helper =='
sed -n '1,220p' src/main/resources/static/assets/viewer/dom-utils.js

echo '== Status JSON production handler =='
sed -n '70,155p' src/main/resources/static/assets/viewer/demo.js

echo '== Full relevant integration-test section =='
sed -n '120,260p' src/test/js/demo-integration.test.mjs

echo '== Maven Node test and exact coverage configuration =='
rg -n -C 16 -P '(dom-utils|node|c8|coverage|line|branch|function|exec-maven)' pom.xml || true

echo '== Current exact-head required and security check states =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" --paginate \
  --jq '.check_runs[]
    | select(
        .name == "Maven test"
        or .name == "strix"
        or .name == "Semgrep (multi-language SAST)"
        or .name == "osv-scan"
        or .name == "dependency-review"
        or .name == "trivy-fs"
        or .name == "scorecard"
        or (.name | startswith("fuzz"))
        or (.name | startswith("Analyze"))
      )
    | [.name,.status,.conclusion,.details_url]
    | `@tsv`'

echo '== PR state and unresolved review threads =='
gh pr view 264 --repo "$repo" \
  --json headRefOid,mergeStateStatus,reviewDecision,statusCheckRollup,latestReviews

gh api graphql \
  -F owner='ContextualWisdomLab' -F name='clearfolio' -F number=264 \
  -f query='
query($owner: String!, $name: String!, $number: Int!) {
  repository(owner: $owner, name: $name) {
    pullRequest(number: $number) {
      reviewThreads(first: 100) {
        nodes {
          isResolved
          comments(first: 1) { nodes { author { login } path line body } }
        }
      }
    }
  }
}' \
  --jq '.data.repository.pullRequest.reviewThreads.nodes[]
    | select(.isResolved == false)
    | [.comments.nodes[0].author.login,.comments.nodes[0].path,(.comments.nodes[0].line|tostring),.comments.nodes[0].body]
    | `@tsv`' || true

echo '== Available branch protection and rulesets =='
gh api "repos/$repo/branches/main/protection" || true
gh api "repos/$repo/rules/branches/main" || true
gh api "repos/$repo/rulesets?includes_parents=true" || true

Length of output: 29996


@seonghobae Review complete for exact head 718107a7a6eaca15a1f3e33ea7ceebefaf23d85a.

I found no source-level blocker.

Status JSON now calls setBusyState(btn, "Loading status JSON...") before asynchronous work starts. The handler calls .finally(restore). This prevents repeated activation while the request is pending.

The integration test verifies:

  • disabled is true during the request.
  • aria-busy is "true" during the request.
  • The pending accessible name is Loading status JSON... View status JSON for <document>.
  • The original visible text and aria-label are restored.
  • The popup has opener = null.
  • The JSON result is rendered after the request completes.

pom.xml runs the Node tests during Maven test. It requires 100% line, branch, and function coverage for src/main/resources/static/assets/viewer/dom-utils.js.

I cannot approve yet. Maven, CodeQL, fuzzing, OSV scan, Strix, and Security Scan jobs were still queued or in progress when checked. The PR state was BLOCKED with REVIEW_REQUIRED.

The review-thread query returned no unresolved threads. Available rulesets require the organization workflows, resolved threads, and one repository approval. The branch-protection REST endpoint returned HTTP 403, so I could not verify its full configuration.

You are interacting with an AI system.

Copy link
Copy Markdown
Collaborator Author

@opencode-agent @cwl-noema-review Please review exact current head 718107a7a6eaca15a1f3e33ea7ceebefaf23d85a. Verify nested busy-state restoration, operation-specific accessible names, DOM-node identity preservation, 100% JS helper coverage, removal of privileged one-shot workflows, and exact-head security/check evidence. Do not reuse earlier-head reviews.

Copy link
Copy Markdown
Collaborator Author

@opencode-agent @cwl-noema-review Please independently review exact current head 718107a7a6eaca15a1f3e33ea7ceebefaf23d85a. Exact-head CI, Security Scan, SAST Semgrep, fuzzing, and CodeRabbit status are successful; all GitHub Advanced Security threads are resolved or outdated. Verify accessible names for repeated document actions, nested and idempotent busy-state restoration, preservation of original child-node identity and prior ARIA/disabled state, inert handling of markup-like filenames, exact JavaScript coverage gates, immutable workflow pins, and repository protections. Submit APPROVE only for this exact head if no blocker remains.

Copy link
Copy Markdown
Collaborator Author

@opencode-agent @cwl-noema-review Please independently review exact current head 718107a7a6eaca15a1f3e33ea7ceebefaf23d85a. Exact-head CI, Security Scan, SAST Semgrep, fuzzing, and CodeRabbit status are successful; both GitHub Advanced Security workflow-permission findings are resolved and outdated because the one-off write-scoped workflows are absent from the final diff; and all inline review threads are resolved or outdated. Verify nested/repeated busy-state semantics, preservation of original DOM nodes and accessibility state, inert handling of markup-like filenames, operation-specific Status JSON pending naming, 100% JavaScript coverage integration, immutable workflow pins, and repository protections. Submit APPROVE only for this exact head if every gate is satisfied.

@seonghobae
seonghobae marked this pull request as draft August 5, 2026 10:19
auto-merge was automatically disabled August 5, 2026 10:19

Pull request was converted to draft

@seonghobae
seonghobae marked this pull request as ready for review August 5, 2026 10:28
@seonghobae
seonghobae enabled auto-merge (squash) August 5, 2026 10:30

Copy link
Copy Markdown
Collaborator Author

@opencode-agent @cwl-noema-review @coderabbitai review

Independently review exact current head 718107a7a6eaca15a1f3e33ea7ceebefaf23d85a. Verify nested/repeated busy-state depth semantics, original DOM-node identity and ARIA/disabled-state restoration, duplicate-activation prevention, inert filename handling, operation-specific accessible names, exact 100% JavaScript helper coverage, immutable workflow action pins, removal of privileged one-shot workflows, and same-head CI/Security/SAST/fuzz evidence. Submit APPROVE only for this exact head if every required gate is satisfied; advisory bot output is not a substitute for the protected branch's counted independent approval.

@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/clearfolio'
head='718107a7a6eaca15a1f3e33ea7ceebefaf23d85a'
prior='b3453021182e99337e67d8b57a237f7196bd4e53'

echo '== Exact commit and PR state =='
printf 'local HEAD: '; git rev-parse HEAD
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
gh pr view 264 --repo "$repo" \
  --json number,state,isDraft,headRefOid,baseRefName,baseRefOid,mergeStateStatus,reviewDecision,statusCheckRollup,latestReviews

echo '== Exact-head focused diff =='
git diff --check "$prior" "$head"
git diff --name-status "$prior" "$head"
git diff --unified=40 "$prior" "$head" -- \
  src/main/resources/static/assets/viewer/demo.js \
  src/test/js/demo-integration.test.mjs

echo '== Source outlines =='
ast-grep outline src/main/resources/static/assets/viewer/dom-utils.js --items all
ast-grep outline src/main/resources/static/assets/viewer/demo.js --items all
ast-grep outline src/test/js/dom-utils.test.mjs --items all
ast-grep outline src/test/js/demo-integration.test.mjs --items all

echo '== Busy-state helper =='
nl -ba src/main/resources/static/assets/viewer/dom-utils.js | sed -n '1,240p'

echo '== Action consumers and accessible names =='
nl -ba src/main/resources/static/assets/viewer/demo.js | sed -n '70,165p'
nl -ba src/main/resources/static/assets/viewer/demo.js | sed -n '215,330p'
nl -ba src/main/resources/static/assets/viewer/demo.js | sed -n '420,590p'

echo '== Helper and production integration tests =='
nl -ba src/test/js/dom-utils.test.mjs | sed -n '1,520p'
nl -ba src/test/js/demo-integration.test.mjs | sed -n '110,300p'

echo '== Maven Node test and coverage configuration =='
rg -n -C 16 -P '(dom-utils|node|c8|coverage|line|branch|function|exec-maven)' pom.xml

echo '== Workflow pins and privileged workflow inventory =='
rg -n -C 5 -P 'uses:\s*[^[:space:]@]+@[0-9a-f]{40}|actions/setup-node@|node-version:' .github/workflows
fd -t f . .github/workflows | sort
rg -n -i -C 4 -P '(contents:\s*write|pull-requests:\s*write|persist-credentials:\s*true|reconcile)' .github/workflows || true

echo '== PDF.js version contract =='
rg -n -C 3 -P '(pdfjs|pdf\.js|PDF\.js|6\.1\.200)' pom.xml src/main README.md || true

echo '== Exact-head checks =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" --paginate \
  --jq '.check_runs[] | [.name,.status,.conclusion,.details_url] | `@tsv`'

echo '== Unresolved review threads =='
gh api graphql \
  -F owner='ContextualWisdomLab' -F name='clearfolio' -F number=264 \
  -f query='
query($owner: String!, $name: String!, $number: Int!) {
  repository(owner: $owner, name: $name) {
    pullRequest(number: $number) {
      reviewThreads(first: 100) {
        nodes {
          isResolved
          comments(first: 1) { nodes { author { login } path line body } }
        }
      }
    }
  }
}' \
  --jq '.data.repository.pullRequest.reviewThreads.nodes[]
    | select(.isResolved == false)
    | [.comments.nodes[0].author.login,.comments.nodes[0].path,(.comments.nodes[0].line | tostring),.comments.nodes[0].body]
    | `@tsv`' || true

echo '== Available protection and ruleset data =='
gh api "repos/$repo/branches/main/protection" || true
gh api "repos/$repo/rules/branches/main" || true
gh api "repos/$repo/rulesets?includes_parents=true" || true

Length of output: 24510


🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/clearfolio'
head='718107a7a6eaca15a1f3e33ea7ceebefaf23d85a'

numbered() {
  awk '{ printf "%6d\t%s\n", NR, $0 }' "$1"
}

echo '== Busy-state helper =='
numbered src/main/resources/static/assets/viewer/dom-utils.js | sed -n '1,240p'

echo '== Demo action consumers =='
numbered src/main/resources/static/assets/viewer/demo.js | sed -n '70,165p'
numbered src/main/resources/static/assets/viewer/demo.js | sed -n '215,330p'
numbered src/main/resources/static/assets/viewer/demo.js | sed -n '420,590p'

echo '== Busy-state unit tests =='
numbered src/test/js/dom-utils.test.mjs | sed -n '1,520p'

echo '== Production integration test =='
numbered src/test/js/demo-integration.test.mjs | sed -n '110,300p'

echo '== Maven Node test and coverage configuration =='
rg -n -C 18 -P '(dom-utils|node|c8|coverage|line|branch|function|exec-maven)' pom.xml

echo '== Workflow inventory and action references =='
fd -t f . .github/workflows | sort
rg -n -C 5 -P '^\s*uses:|actions/setup-node@|node-version:|contents:\s*write|pull-requests:\s*write|persist-credentials:\s*true|reconcile' .github/workflows || true

echo '== PDF.js version references =='
rg -n -C 3 -P '(pdfjs|pdf\.js|PDF\.js|6\.1\.200)' pom.xml src/main README.md || true

echo '== Unresolved review threads =='
gh api graphql \
  -F owner='ContextualWisdomLab' -F name='clearfolio' -F number=264 \
  -f query='
query($owner: String!, $name: String!, $number: Int!) {
  repository(owner: $owner, name: $name) {
    pullRequest(number: $number) {
      reviewThreads(first: 100) {
        nodes {
          isResolved
          comments(first: 1) { nodes { author { login } path line body } }
        }
      }
    }
  }
}' \
  --jq '.data.repository.pullRequest.reviewThreads.nodes[]
    | select(.isResolved == false)
    | [.comments.nodes[0].author.login,.comments.nodes[0].path,(.comments.nodes[0].line | tostring),.comments.nodes[0].body]
    | `@tsv`' || true

echo '== Rules and protection data =='
gh api "repos/$repo/branches/main/protection" || true
gh api "repos/$repo/rules/branches/main" || true
gh api "repos/$repo/rulesets?includes_parents=true" || true

echo '== Current PR merge requirements =='
gh pr view 264 --repo "$repo" \
  --json headRefOid,mergeStateStatus,reviewDecision,statusCheckRollup,latestReviews

Length of output: 62600


@seonghobae Review complete for exact head 718107a7a6eaca15a1f3e33ea7ceebefaf23d85a.

I found no source-level blocker.

  • setBusyState uses WeakMap state and depth counting.
  • Each restore callback is idempotent.
  • The helper restores only after the final restore call.
  • The helper preserves original child-node identities with Array.from(button.childNodes) and replaceChildren(...).
  • The helper restores the original disabled, aria-busy, and aria-label states. It distinguishes absent and empty ARIA values.
  • Details and Status JSON apply the helper before asynchronous work.
  • Status JSON uses Loading status JSON... and restores state through .finally(restore).
  • Native disabled-button behavior prevents repeated user activation while the request is pending.
  • Details, Status JSON, and Open viewer have document-specific accessible names.
  • Filenames use textContent. Markup-like filenames remain inert text.
  • The helper tests cover nesting, duplicate restores, original node identity, disabled controls, and ARIA restoration.
  • The production integration test verifies the pending Status JSON label, disabled state, aria-busy, exact restoration, popup opener isolation, and JSON rendering.
  • Maven runs the Node tests during test and requires 100% line, branch, and function coverage for dom-utils.js.
  • Node.js 24 and actions/setup-node use the configured full-SHA workflow pin.
  • The workflow inventory contains no privileged reconciliation workflow.
  • The PDF.js paths remain at version 6.1.200.
  • Exact-head Maven, Security Scan, Semgrep, fuzz, CodeQL, and strix checks are successful.
  • The review-thread query found no unresolved threads.

I cannot submit approval. GitHub still reports BLOCKED and REVIEW_REQUIRED. The available repository ruleset requires one approving repository review, and that approval is not present. The branch-protection API returned HTTP 403, so I could not inspect its complete configuration.

You are interacting with an AI system.

Copy link
Copy Markdown
Collaborator Author

@opencode-agent @cwl-noema-review Independently review exact current head 718107a7a6eaca15a1f3e33ea7ceebefaf23d85a. Exact-head CI 30977565425, Security Scan 30977565430, SAST Semgrep 30977565499, fuzz 30977565442, and CodeRabbit status are successful. The two prior GitHub Advanced Security token-permission findings are resolved and outdated after the temporary write-scoped workflows were removed; there are zero unresolved threads. Verify keyboard and assistive-technology behavior, accessible loading and focus semantics, deterministic tests, least-privilege workflow state, coverage/Javadocs, and repository policy. Approve or recommend merge only for this exact head and only if independent-review policy is satisfied.

Copy link
Copy Markdown
Collaborator Author

@opencode-agent @cwl-noema-review Please independently review exact current head 718107a7a6eaca15a1f3e33ea7ceebefaf23d85a. Verify nested and repeated busy-state restoration, preservation of original DOM node identities and pre-existing disabled/ARIA state, inert handling of markup-like labels, contextual accessible names, Status JSON pending semantics, exact 100% production JavaScript coverage, immutable workflow-source pins, and all exact-head CI, security, fuzz, and repository protections. Submit APPROVE only for this exact head.

Copy link
Copy Markdown
Collaborator Author

@coderabbitai review

@opencode-agent @cwl-noema-review Please independently review exact current head 718107a7a6eaca15a1f3e33ea7ceebefaf23d85a only. Verify the accessible asynchronous viewer contract: document-specific accessible names, operation-specific pending names, nested/repeated busy depth, idempotent restoration, exact preservation of child-node identity and prior disabled/ARIA state, inert treatment of markup-like filenames, duplicate-activation prevention, and executable Node DOM tests with 100% production line, branch, and function coverage. Confirm the previously flagged write-scoped reconciliation workflow is absent and no stale workflow finding remains.

Exact-head Actions are successful: CI 30977565425, Security Scan 30977565430, SAST Semgrep 30977565499, and fuzz 30977565442. Existing GitHub Advanced Security threads are resolved and outdated. Submit a formal exact-head review and APPROVE only if no blocker remains; do not treat a commit status, stale comment, or owner review as independent approval.

@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/clearfolio'
head='718107a7a6eaca15a1f3e33ea7ceebefaf23d85a'
prior='b3453021182e99337e67d8b57a237f7196bd4e53'

echo '== Exact commit and PR state =='
printf 'checkout='; git rev-parse HEAD
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
gh pr view 264 --repo "$repo" \
  --json number,state,isDraft,headRefOid,baseRefName,baseRefOid,mergeStateStatus,reviewDecision,statusCheckRollup,latestReviews

echo '== Exact-head delta =='
git diff --check "$prior" "$head"
git diff --name-status "$prior" "$head"
git diff --unified=35 "$prior" "$head" -- \
  src/main/resources/static/assets/viewer/demo.js \
  src/test/js/demo-integration.test.mjs

echo '== Relevant source outlines =='
ast-grep outline src/main/resources/static/assets/viewer/dom-utils.js --items all
ast-grep outline src/main/resources/static/assets/viewer/demo.js --items all
ast-grep outline src/test/js/dom-utils.test.mjs --items all
ast-grep outline src/test/js/demo-integration.test.mjs --items all

echo '== Busy-state helper =='
nl -ba src/main/resources/static/assets/viewer/dom-utils.js | sed -n '1,240p'

echo '== Viewer actions and accessible labels =='
nl -ba src/main/resources/static/assets/viewer/demo.js | sed -n '70,170p'
nl -ba src/main/resources/static/assets/viewer/demo.js | sed -n '215,330p'
nl -ba src/main/resources/static/assets/viewer/demo.js | sed -n '420,590p'

echo '== Busy-state unit tests and viewer integration test =='
nl -ba src/test/js/dom-utils.test.mjs | sed -n '1,520p'
nl -ba src/test/js/demo-integration.test.mjs | sed -n '100,330p'

echo '== Maven Node-test and coverage configuration =='
rg -n -C 18 -P '(dom-utils|node|c8|coverage|line|branch|function|exec-maven)' pom.xml

echo '== Workflow inventory, pins, and privileged-workflow indicators =='
fd -t f . .github/workflows | sort
rg -n -C 5 -P '^\s*uses:|actions/setup-node@|node-version:|contents:\s*write|pull-requests:\s*write|persist-credentials:\s*true|reconcile' .github/workflows || true

echo '== PDF.js version contract =='
rg -n -C 3 -P '(pdfjs|pdf\.js|PDF\.js|6\.1\.200)' pom.xml src/main README.md || true

echo '== Exact-head check runs =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" --paginate \
  --jq '.check_runs[] | [.name,.status,.conclusion,.details_url] | `@tsv`'

echo '== Unresolved review threads =='
gh api graphql \
  -F owner='ContextualWisdomLab' -F name='clearfolio' -F number=264 \
  -f query='
query($owner: String!, $name: String!, $number: Int!) {
  repository(owner: $owner, name: $name) {
    pullRequest(number: $number) {
      reviewThreads(first: 100) {
        nodes {
          isResolved
          comments(first: 1) { nodes { author { login } path line body } }
        }
      }
    }
  }
}' \
  --jq '.data.repository.pullRequest.reviewThreads.nodes[]
    | select(.isResolved == false)
    | [.comments.nodes[0].author.login,.comments.nodes[0].path,(.comments.nodes[0].line | tostring),.comments.nodes[0].body]
    | `@tsv`' || true

echo '== Protection and ruleset data =='
gh api "repos/$repo/branches/main/protection" || true
gh api "repos/$repo/rules/branches/main" || true
gh api "repos/$repo/rulesets?includes_parents=true" || true

Length of output: 23725


🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/clearfolio'
head='718107a7a6eaca15a1f3e33ea7ceebefaf23d85a'

numbered() {
  awk '{ printf "%6d\t%s\n", NR, $0 }' "$1"
}

echo '== Busy-state helper =='
numbered src/main/resources/static/assets/viewer/dom-utils.js | sed -n '1,240p'

echo '== Viewer action consumers =='
numbered src/main/resources/static/assets/viewer/demo.js | sed -n '70,170p'
numbered src/main/resources/static/assets/viewer/demo.js | sed -n '215,330p'
numbered src/main/resources/static/assets/viewer/demo.js | sed -n '420,590p'

echo '== Busy-state unit tests =='
numbered src/test/js/dom-utils.test.mjs | sed -n '1,520p'

echo '== Production-module integration test =='
numbered src/test/js/demo-integration.test.mjs | sed -n '100,330p'

echo '== Maven Node-test and coverage configuration =='
rg -n -C 18 -P '(dom-utils|node|c8|coverage|line|branch|function|exec-maven)' pom.xml

echo '== Workflow inventory and relevant references =='
fd -t f . .github/workflows | sort
rg -n -C 5 -P '^\s*uses:|actions/setup-node@|node-version:|contents:\s*write|pull-requests:\s*write|persist-credentials:\s*true|reconcile' .github/workflows || true

echo '== PDF.js version contract =='
rg -n -C 3 -P '(pdfjs|pdf\.js|PDF\.js|6\.1\.200)' pom.xml src/main README.md || true

echo '== Unresolved review threads =='
gh api graphql \
  -F owner='ContextualWisdomLab' -F name='clearfolio' -F number=264 \
  -f query='
query($owner: String!, $name: String!, $number: Int!) {
  repository(owner: $owner, name: $name) {
    pullRequest(number: $number) {
      reviewThreads(first: 100) {
        nodes {
          isResolved
          comments(first: 1) { nodes { author { login } path line body } }
        }
      }
    }
  }
}' \
  --jq '.data.repository.pullRequest.reviewThreads.nodes[]
    | select(.isResolved == false)
    | [.comments.nodes[0].author.login,.comments.nodes[0].path,(.comments.nodes[0].line | tostring),.comments.nodes[0].body]
    | `@tsv`' || true

echo '== Current PR state and available protection data =='
gh pr view 264 --repo "$repo" \
  --json headRefOid,mergeStateStatus,reviewDecision,latestReviews,statusCheckRollup
gh api "repos/$repo/branches/main/protection" || true
gh api "repos/$repo/rules/branches/main" || true
gh api "repos/$repo/rulesets?includes_parents=true" || true

Length of output: 63105


@seonghobae Review complete for exact head 718107a7a6eaca15a1f3e33ea7ceebefaf23d85a.

I found no source-level blocker.

  • setBusyState uses WeakMap state and depth counting.
  • Restore callbacks are idempotent.
  • The helper restores state only after the final restore call.
  • The helper preserves original child-node identities with Array.from(button.childNodes) and replaceChildren(...).
  • The helper restores the original disabled, aria-busy, and aria-label values. It distinguishes absent and empty ARIA values.
  • Details, Status JSON, and Open viewer have document-specific accessible names.
  • Status JSON applies setBusyState before the asynchronous request. It uses Loading status JSON... and restores state in .finally(restore).
  • A disabled native button prevents repeated user activation during the pending request.
  • Filenames use textContent. The tests verify that markup-like filenames remain inert text.
  • The integration test verifies the pending Status JSON label, disabled state, aria-busy, restored state, popup opener isolation, and rendered JSON.
  • Maven runs the Node tests during test. It requires 100% line, branch, and function coverage for src/main/resources/static/assets/viewer/dom-utils.js.
  • CI uses Node.js 24 and a full-SHA actions/setup-node pin.
  • The checked workflow inventory contains no reconciliation workflow or write-scoped workflow indicator.
  • The PDF.js module and worker paths remain at version 6.1.200.
  • Maven, Security Scan, Semgrep, Strix, CodeQL, and fuzz checks succeeded for this exact head.
  • The review-thread query returned no unresolved threads.

I cannot approve this pull request. GitHub still reports BLOCKED and REVIEW_REQUIRED. The repository ruleset requires one approving repository review, and the current review list does not contain that approval. The branch-protection endpoint returned HTTP 403, so I could not inspect its complete configuration.

You are interacting with an AI system.

Copy link
Copy Markdown
Collaborator Author

@coderabbitai review

@opencode-agent @cwl-noema-review Please independently review exact current head 718107a7a6eaca15a1f3e33ea7ceebefaf23d85a. Verify the WeakMap depth-counted busy-state contract, exact child-node identity and disabled/ARIA restoration, inert handling of markup-like document names, operation-specific accessible names, duplicate-activation prevention, executable Node 24 DOM tests with 100% line/branch/function coverage for the production helper, immutable action pins, and absence of the superseded write-scoped reconciliation workflows. Exact-head CI, Security Scan, SAST, and fuzz are successful; submit formal review evidence only for this head.

@coderabbitai

coderabbitai Bot commented Aug 6, 2026

Copy link
Copy Markdown
🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/clearfolio'
head='718107a7a6eaca15a1f3e33ea7ceebefaf23d85a'
prior='b3453021182e99337e67d8b57a237f7196bd4e53'

echo '== Exact commit and pull request state =='
printf 'checkout='; git rev-parse HEAD
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
gh pr view 264 --repo "$repo" \
  --json number,state,isDraft,headRefOid,baseRefName,baseRefOid,mergeStateStatus,reviewDecision,statusCheckRollup,latestReviews

echo '== Exact-head delta and whitespace =='
git diff --check "$prior" "$head"
git diff --name-status "$prior" "$head"
git diff --unified=35 "$prior" "$head" -- \
  src/main/resources/static/assets/viewer/demo.js \
  src/test/js/demo-integration.test.mjs

echo '== Source outlines =='
ast-grep outline src/main/resources/static/assets/viewer/dom-utils.js --items all
ast-grep outline src/main/resources/static/assets/viewer/demo.js --items all
ast-grep outline src/test/js/dom-utils.test.mjs --items all
ast-grep outline src/test/js/demo-integration.test.mjs --items all

echo '== Busy-state helper =='
nl -ba src/main/resources/static/assets/viewer/dom-utils.js | sed -n '1,250p'

echo '== Viewer action consumers =='
nl -ba src/main/resources/static/assets/viewer/demo.js | sed -n '65,180p'
nl -ba src/main/resources/static/assets/viewer/demo.js | sed -n '210,340p'
nl -ba src/main/resources/static/assets/viewer/demo.js | sed -n '415,600p'

echo '== Unit and integration test assertions =='
nl -ba src/test/js/dom-utils.test.mjs | sed -n '1,540p'
nl -ba src/test/js/demo-integration.test.mjs | sed -n '90,350p'

echo '== Maven test and coverage configuration =='
rg -n -C 18 -P '(dom-utils|node|c8|coverage|line|branch|function|exec-maven)' pom.xml

echo '== Workflow inventory, immutable pins, and privileged indicators =='
fd -t f . .github/workflows | sort
rg -n -C 5 -P '^\s*uses:|actions/setup-node@|node-version:|contents:\s*write|pull-requests:\s*write|persist-credentials:\s*true|reconcile' .github/workflows || true

echo '== Exact-head check runs =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" --paginate \
  --jq '.check_runs[] | [.name,.status,.conclusion,.details_url] | `@tsv`'

echo '== Unresolved review threads =='
gh api graphql \
  -F owner='ContextualWisdomLab' -F name='clearfolio' -F number=264 \
  -f query='
query($owner: String!, $name: String!, $number: Int!) {
  repository(owner: $owner, name: $name) {
    pullRequest(number: $number) {
      reviewThreads(first: 100) {
        nodes {
          isResolved
          comments(first: 1) { nodes { author { login } path line body } }
        }
      }
    }
  }
}' \
  --jq '.data.repository.pullRequest.reviewThreads.nodes[]
    | select(.isResolved == false)
    | [.comments.nodes[0].author.login, .comments.nodes[0].path, (.comments.nodes[0].line | tostring), .comments.nodes[0].body]
    | `@tsv`' || true

echo '== Available branch protection and rulesets =='
gh api "repos/$repo/branches/main/protection" || true
gh api "repos/$repo/rules/branches/main" || true
gh api "repos/$repo/rulesets?includes_parents=true" || true

Length of output: 23619


🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/clearfolio'
head='718107a7a6eaca15a1f3e33ea7ceebefaf23d85a'

numbered() {
  awk '{ printf "%6d\t%s\n", NR, $0 }' "$1"
}

echo '== Busy-state helper =='
numbered src/main/resources/static/assets/viewer/dom-utils.js | sed -n '1,250p'

echo '== Viewer action consumers =='
numbered src/main/resources/static/assets/viewer/demo.js | sed -n '65,180p'
numbered src/main/resources/static/assets/viewer/demo.js | sed -n '210,340p'
numbered src/main/resources/static/assets/viewer/demo.js | sed -n '415,600p'

echo '== Busy-state unit tests =='
numbered src/test/js/dom-utils.test.mjs | sed -n '1,540p'

echo '== Production integration test =='
numbered src/test/js/demo-integration.test.mjs | sed -n '90,350p'

echo '== Maven Node test and coverage configuration =='
rg -n -C 18 -P '(dom-utils|node|c8|coverage|line|branch|function|exec-maven)' pom.xml

echo '== Workflow inventory and relevant references =='
fd -t f . .github/workflows | sort
rg -n -C 5 -P '^\s*uses:|actions/setup-node@|node-version:|contents:\s*write|pull-requests:\s*write|persist-credentials:\s*true|reconcile' .github/workflows || true

echo '== Unresolved review threads =='
gh api graphql \
  -F owner='ContextualWisdomLab' -F name='clearfolio' -F number=264 \
  -f query='
query($owner: String!, $name: String!, $number: Int!) {
  repository(owner: $owner, name: $name) {
    pullRequest(number: $number) {
      reviewThreads(first: 100) {
        nodes {
          isResolved
          comments(first: 1) { nodes { author { login } path line body } }
        }
      }
    }
  }
}' \
  --jq '.data.repository.pullRequest.reviewThreads.nodes[]
    | select(.isResolved == false)
    | [.comments.nodes[0].author.login, .comments.nodes[0].path, (.comments.nodes[0].line | tostring), .comments.nodes[0].body]
    | `@tsv`' || true

echo '== Current PR review and merge state =='
gh pr view 264 --repo "$repo" \
  --json headRefOid,mergeStateStatus,reviewDecision,latestReviews,statusCheckRollup

echo '== Available branch protection and rulesets =='
gh api "repos/$repo/branches/main/protection" || true
gh api "repos/$repo/rules/branches/main" || true
gh api "repos/$repo/rulesets?includes_parents=true" || true

echo '== Exact-head check state summary =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" --paginate \
  --jq '.check_runs[]
    | select(.name == "Maven test" or .name == "strix" or .name == "Semgrep (multi-language SAST)" or .name == "osv-scan" or (.name | startswith("fuzz")) or (.name | startswith("Analyze")))
    | [.name,.status,.conclusion]
    | `@tsv`'

Length of output: 56758


@seonghobae Review complete for exact head 718107a7a6eaca15a1f3e33ea7ceebefaf23d85a.

I found no source-level blocker.

  • setBusyState uses WeakMap state and depth counting.
  • Each restore callback is idempotent.
  • The helper restores state only after the final restore call.
  • The helper preserves child-node identity with Array.from(button.childNodes) and replaceChildren(...).
  • The helper restores the original disabled, aria-busy, and aria-label values. It distinguishes absent and empty ARIA values.
  • Details, Status JSON, and Open viewer have document-specific accessible names.
  • Status JSON applies setBusyState(btn, "Loading status JSON...") before asynchronous work. Its .finally(restore) call restores the original state.
  • A disabled native button prevents repeated user activation while the JSON request is pending.
  • The integration test verifies the operation-specific pending name, disabled state, aria-busy, restored state, inert markup-like filename text, popup opener isolation, and JSON rendering.
  • Maven runs the Node DOM tests during test.
  • Maven requires 100% line, branch, and function coverage for src/main/resources/static/assets/viewer/dom-utils.js.
  • CI uses Node.js 24 and a full-SHA actions/setup-node pin.
  • The checked workflow inventory contains no reconciliation workflow or write-scoped workflow indicator.
  • Exact-head Maven, Semgrep, OSV scan, Strix, CodeQL, and all fuzz checks succeeded.
  • The review-thread query found no unresolved threads.

I cannot approve this pull request yet. GitHub reports BLOCKED and REVIEW_REQUIRED. The repository ruleset requires one approving repository review, and latestReviews contains no approval. The branch-protection REST endpoint returned HTTP 403, so I could not inspect its complete configuration.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants