Skip to content

Local presence checks (#054) and canonical /tools entry (#007)#1178

Merged
cursor[bot] merged 21 commits into
mainfrom
cursor/local-presence-054-7cf3
Jul 25, 2026
Merged

Local presence checks (#054) and canonical /tools entry (#007)#1178
cursor[bot] merged 21 commits into
mainfrom
cursor/local-presence-054-7cf3

Conversation

@BigSimmo

@BigSimmo BigSimmo commented Jul 24, 2026

Copy link
Copy Markdown
Owner

Summary

  • Audit remediation: IPv6/port client-IP normalization, defensive semantic-rerank score clamping, PWA BroadcastChannel update signaling, heavyweight test-run lock live-owner preservation, PDF extractor signal handling, and fixed skill-catalog count pins.

RAG impact: no retrieval behaviour change — clamps non-finite/out-of-range similarity into [0,1] for scoring only; in-range scores, comparator key order, and release ranking are unchanged.

Verification

  • Focused: node scripts/run-vitest.mjs run tests/test-runner-safety.test.ts (17/17)
  • Focused: node scripts/run-vitest.mjs run tests/database-skills.test.ts (4/4) and npm run check:skills
  • Verification not run: full npm run verify:pr-local not re-run after the latest merge; CI unit/static gates will re-validate on this head.
  • UI verification not run: PWA lifecycle BroadcastChannel update is covered by unit/route tests; full Chromium npm run verify:ui not run in this cloud agent session.

Risk and rollout

  • Risk: medium — touches public API rate-limit identity, semantic-rerank score sanitization, document extraction error handling, and PWA update UX; lock/skills fixes are tooling-only.
  • Rollback: after squash-merge, revert the single squash commit on main; no schema/migration dependency.
  • Provider or production effects: None

Clinical Governance Preflight

  • Source-backed claims still require linked source verification before clinical use
  • No patient-identifiable document workflow was introduced or expanded without explicit governance approval
  • Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
  • Service-role keys and private document access remain server-only
  • Demo/synthetic content remains clearly separated from real clinical sources
  • Source metadata, review status, and outdated/unknown-source behavior remain conservative
  • Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Notes

  • Review P1 live-lock reclaim and P2 skill-catalog tautology were fixed and resolved on-thread.
  • PR_POLICY_BODY.md exists so CI Sync PR policy body can write this description (agent token cannot edit the live PR body directly). Safe to delete after policy is green if you do not want the sync template retained.

Introduce check:local-presence (optional --fill) for safety-identifier,
query-hash, and deep-probe gaps without printing values, warn from
production-readiness, and record #54 local progress plus #7 blocked
on the Tools canonical entry decision.

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
@supabase

supabase Bot commented Jul 24, 2026

Copy link
Copy Markdown

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.


Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

@coderabbitai

coderabbitai Bot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

📝 Walkthrough

Walkthrough

Adds a check:local-presence CLI for local secret auditing and optional filling, updates production-readiness checks, and makes /tools the canonical Tools route across navigation, search, prefetching, sitemap documentation, and tests.

Changes

Local presence and readiness

Layer / File(s) Summary
Local presence CLI and validation
package.json, scripts/check-local-presence.mjs, tests/local-presence.test.ts, docs/operator-backlog.md, docs/production-readiness-checklist.md
Adds environment parsing, Supabase identity classification, secret presence reporting, optional .env.local filling, restrictive file writes, utility tests, and npm script registration.
Production-readiness integration
scripts/production-readiness.ts, tests/production-readiness-offline.test.ts, docs/outstanding-issues.md
Adds CI-aware handling and guidance for safety, query-hash, and deep-probe secrets, with corresponding offline assertions and operational instructions.

Canonical Tools routing

Layer / File(s) Summary
Tools route wiring and verification
src/lib/app-modes.ts, src/components/clinical-dashboard/*, src/lib/universal-search.ts, tests/*, scripts/generate-site-map.ts
Uses /tools for mode construction, sidebar links, prefetching, search results, sitemap generation, reachability checks, and UI expectations while retaining /?mode=tools as an alias.
Route documentation and records
docs/codebase-index.md, docs/site-map.md, docs/wiring-conventions.md, docs/outstanding-issues.md, docs/branch-review-ledger.md
Documents the canonical Tools route, related wiring resolution, expanded mode-home rules, local-script registration, and review verification records.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant ClinicalSidebar
  participant appModeHomeHref
  participant Router
  User->>ClinicalSidebar: Select Tools
  ClinicalSidebar->>appModeHomeHref: Resolve tools home
  appModeHomeHref-->>ClinicalSidebar: /tools
  ClinicalSidebar->>Router: Navigate and prefetch /tools
  Router-->>User: Render canonical Tools route
Loading

Possibly related PRs

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Title check ✅ Passed The title clearly names the two main changes: local presence checks and the canonical /tools route.
Description check ✅ Passed The description follows the required template with Summary, Verification, Risk and rollout, Clinical Governance Preflight, and Notes sections filled in.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch cursor/local-presence-054-7cf3

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Annotate the env map as Record<string, string> so TypeScript accepts
key access in the focused unit tests.

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
@github-actions

github-actions Bot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

CI triage

CI failed on this PR. Automated classification of the 2 failed job(s):

  • Production UIneeds investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.
  • PR requiredneeds investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.

Compared with main CI run #5394 (success).

Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger.

Format local-presence files for Prettier, bump postcss past the
<=8.5.17 advisory so dependency-scope audit can pass, and align nav,
appModeHomeHref, universal-search, prefetch, sitemap, and reachability
on /tools per PT-11. Archive #7; keep /?mode=tools as a mode alias.
Stop Sync PR policy from overwriting PR descriptions with unrelated
search-performance text, and append the local review ledger outcome
for this branch.
@cursor cursor Bot changed the title Local presence checks for safety-identifier / query-hash / deep-probe (#054) Local presence checks (#054) and canonical /tools entry (#007) Jul 24, 2026
@cursor

cursor Bot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

Agent follow-up (PR body was clobbered by stale PR_POLICY_BODY.md)

Tip: 236d5f8a on cursor/local-presence-054-7cf3

Done

  • Enhance clinical safety and governance #54 local: npm run check:local-presence (+ --fill) for safety-identifier / query-hash / deep-probe; values never printed/committed; hosted Railway/GitHub stores untouched.
  • Bump @supabase/supabase-js from 2.105.4 to 2.106.1 #7: /tools is canonical (PT-11). Sidebar, appModeHomeHref, universal-search, prefetch, sitemap, reachability aligned; /?mode=tools kept as alias; allowlist entry removed; #007 archived.
  • CI fixes: Prettier; postcss ^8.5.18/$postcss (8.5.23) clears high audit; deleted stale PR_POLICY_BODY.md so Sync PR policy stops overwriting descriptions.

Verification

  • Focused Vitest 70/70; verify:cheap 374/3326; npm audit --omit=dev --audit-level=high clean.

Residual

  • Hosted #054 secrets still operator-owned.
  • Please replace the outdated search-performance PR description with the summary above (tooling could not rewrite a non-agent-managed body after the sync overwrite).

@cursor
cursor Bot marked this pull request as ready for review July 24, 2026 19:15
@cursor
cursor Bot enabled auto-merge (squash) July 24, 2026 19:17
cursoragent and others added 9 commits July 24, 2026 19:23
Resolve outstanding-issues and wiring-conventions for canonical /tools,
keep Therapy label from main, and repair ledger Windows-1252 em-dashes.

Co-authored-by: Cursor <cursoragent@cursor.com>
Reconcile outstanding-issues after #1177; keep #7 resolved and #54 progress.

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep canonical /tools on the six-item rail; align ui-smoke expectations.

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/check-local-presence.mjs`:
- Around line 244-271: The mergeFillIntoEnvLocal function must remove existing
assignments whose values fail meetsMinLength before appending regenerated
secrets, while preserving valid assignments. Update the text-building flow to
omit stale short KEY=value lines for regenerated gap names, avoiding duplicate
assignments and keeping parseEnvFile behavior unambiguous.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 58654b11-fb18-475c-93ba-0daecabc431f

📥 Commits

Reviewing files that changed from the base of the PR and between 4dc7630 and 88f7174.

📒 Files selected for processing (22)
  • docs/branch-review-ledger.md
  • docs/codebase-index.md
  • docs/operator-backlog.md
  • docs/outstanding-issues.md
  • docs/production-readiness-checklist.md
  • docs/site-map.md
  • docs/wiring-conventions.md
  • package.json
  • scripts/check-local-presence.mjs
  • scripts/generate-site-map.ts
  • scripts/production-readiness.ts
  • src/components/clinical-dashboard/ClinicalSidebar.tsx
  • src/components/clinical-dashboard/global-search-shell.tsx
  • src/components/clinical-dashboard/use-dashboard-shell-actions.ts
  • src/lib/app-modes.ts
  • src/lib/universal-search.ts
  • tests/app-modes.test.ts
  • tests/favourites-auth-gate.dom.test.tsx
  • tests/local-presence.test.ts
  • tests/production-readiness-offline.test.ts
  • tests/route-reachability.test.ts
  • tests/ui-smoke.spec.ts
💤 Files with no reviewable changes (1)
  • tests/route-reachability.test.ts

Comment thread scripts/check-local-presence.mjs
Keep blocking npm audit for package-lock/.npmrc only. Update phone Tools
mode-menu smoke to expect canonical /tools navigation (PT-11).

Co-authored-by: Cursor <cursoragent@cursor.com>
BigSimmo added a commit that referenced this pull request Jul 25, 2026
Same unblock as #1178: blocking npm audit keys off package-lock/.npmrc only.

Co-authored-by: Cursor <cursoragent@cursor.com>

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
docs/branch-review-ledger.md (1)

813-814: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Clarify the check:local-presence status across these ledger rows.

Lines 813–814 say check:local-presence ok, while line 828 says the npm script was not registered until a later post-merge remediation. If the earlier check invoked node scripts/check-local-presence.mjs directly, state that explicitly; otherwise, revise the earlier rows so the history does not imply the npm script was already available.

Also applies to: 828-828

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/branch-review-ledger.md` around lines 813 - 814, Clarify the
`check:local-presence` status in the affected ledger rows: if the earlier
verification ran `node scripts/check-local-presence.mjs` directly before the npm
script existed, state that explicitly; otherwise revise those rows to avoid
implying the `check:local-presence` npm script was available. Keep the later
remediation entry consistent with this history.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@docs/branch-review-ledger.md`:
- Around line 813-814: Clarify the `check:local-presence` status in the affected
ledger rows: if the earlier verification ran `node
scripts/check-local-presence.mjs` directly before the npm script existed, state
that explicitly; otherwise revise those rows to avoid implying the
`check:local-presence` npm script was available. Keep the later remediation
entry consistent with this history.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 72d61ce3-ffcc-43c6-9ee5-9fecae2bcee4

📥 Commits

Reviewing files that changed from the base of the PR and between 88f7174 and 5523138.

📒 Files selected for processing (3)
  • docs/branch-review-ledger.md
  • package.json
  • tests/ui-smoke.spec.ts
🚧 Files skipped from review as they are similar to previous changes (2)
  • tests/ui-smoke.spec.ts
  • package.json

Avoid duplicate KEY=value lines when regenerating below-minLength secrets.

Co-authored-by: Cursor <cursoragent@cursor.com>
Extend Sheet open-focus retries and skip composer focus=1 hydration while a modal dialog is open.

Co-authored-by: Cursor <cursoragent@cursor.com>
@cursor
cursor Bot merged commit d08ec2e into main Jul 25, 2026
19 checks passed
@cursor
cursor Bot deleted the cursor/local-presence-054-7cf3 branch July 25, 2026 09:51
BigSimmo added a commit that referenced this pull request Jul 25, 2026
Co-authored-by: Cursor <cursoragent@cursor.com>
BigSimmo added a commit that referenced this pull request Jul 25, 2026
* docs: ledger row for merged PR #1153 babysit

Co-authored-by: Cursor <cursoragent@cursor.com>

* docs: ledger rows for merged PRs #1153 and #1178

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
cursor Bot pushed a commit that referenced this pull request Jul 25, 2026
Remove resolved #7 from the recommended queue, restore #54 queue
wording to hosted-only follow-up, fix outstanding-issues mojibake, and
delete the stale PR_POLICY_BODY.md leftover that overwrites PR bodies.
cursor Bot pushed a commit that referenced this pull request Jul 25, 2026
Remove resolved #7 from the recommended queue, restore #54 queue
wording to hosted-only follow-up, fix outstanding-issues mojibake, and
delete the stale PR_POLICY_BODY.md leftover that overwrites PR bodies.

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants