chore: sync develop to main - #200
Conversation
chore: Cloudflare migration polish — Netlify cleanup, CSP, Pyodide CDN
…r AudioContext creation - Add blob: to script-src and connect-src for Tone.js v15 AudioWorklet - Add gateway.umami.is to connect-src for Umami Cloud analytics - Add cdn.jsdelivr.net to style-src for Monaco editor CDN CSS - Replace static Tone.js import with lazy dynamic import to prevent eager AudioContext creation at module load time
Add missing https://static.cloudflareinsights.com and https://cdn.jsdelivr.net to script-src, and https://cloudflareinsights.com to connect-src in netlify.toml CSP to match the header-based policy.
Use pre-loaded _Tone directly instead of async getTone(), since _buildInstruments guarantees Tone is loaded before playback callbacks fire.
Move getTone() and _Tone cache into masterChain.js with named exports so both modules resolve the same Tone instance. Update soundManager.test.js mock to provide getTone and _Tone.
enable() no longer sets isEnabled=true before ensureInstrumentsAsync() completes. On failure, initPromise and instruments are reset so retries work cleanly instead of being permanently blocked by a cached rejection.
Use a shared mutable object that getTone() populates via Object.assign from the global Tone mock, so _Tone and getTone() return the same instance — matching the real masterChain.js contract.
…gress bar - Add 'wasm-unsafe-eval' to script-src CSP in public/_headers & netlify.toml - Split timeouts: 60s for Pyodide init, 10s for code execution - Worker sends heartbeat during loadPyodide() to prevent false timeouts - Replace loading spinner with indeterminate motion progress bar - Run button shows 'Loading Python...' vs 'Running...' distinctly - Clear stale timeouts on re-run (fixes double-click bug)
fix: resolve CSP violations blocking Tone.js, Monaco, and Umami; defer AudioContext creation
Only the job runs on events (no lint/tests/build). The job skips closed PRs entirely.
feat: auto-cleanup Cloudflare preview alias on PR close
- Create .well-known/ agent-discovery files (MCP, A2A, Agent Skills, API catalog) - Add auth.md for agent authentication documentation - Add Link header pointing to sitemap.xml in _headers - Register WebMCP tool via navigator.modelContext.registerTool() - Enable 8 of 9 isitagentready.com checks to pass
- Make execute() accept category arg and filter catalog data accordingly - Remove phantom tool entries from agent-skills manifest - Add Content-Type: application/json override for api-catalog in _headers - Sync MCP manifest tool list with sole bayan_flow_info tool
feat: add agent readiness discovery files and WebMCP support
…onality and UI improvements
… and PythonCodePanel components
…anup in VisualizerApp component
fix: export video CSP preview, code panel UX, and output dock visibility
- Remove inert Tailwind utilities activated by @config (hover:bg-surface-elevated in Footer) - Remove fixed gradient overlay (from-bg via-bg to-surface-elevated) from LandingPage, LegalDocument, and ProComingSoonPage — this was transparent on main but renders a lighter-to-dark gradient in dark mode, causing a 'backlight' effect - Remove RoadmapCTA decorative elements (gradient overlay, glow orb, badge pill) that rendered unintentionally due to @config activating previously dead utilities - Make Header non-sticky (always relative, never sm:fixed) - Show 'Sign in with Google' text on non-/app pages; icon-only on /app - Update tests to match removed elements
Security: - Restrict deploy-supabase-functions workflow to base repository only (#1) - Fail-closed on missing IP metadata in before-signup hook (#11) - Switch waitlist email from localStorage to sessionStorage (#9) - Remove last_active_at from direct client UPDATE grant; use security definer RPC (#15) Functional correctness: - Clear profileRow on implicit sign-out in AuthProvider (#3) - Prevent email useEffect from clobbering user input on ProComingSoonPage (#5) - Add autoFocus to delete modal for immediate Escape dismissal (#6) - Fix Link rendering outside Router context in ProWaitlistBanner (#2) - Move skip-to-content link above ProWaitlistBanner for a11y (#18) Stability & hardening: - Add timeout to supabase.functions.invoke in accessService (#8) - Add AbortSignal.timeout to Telegram fetch call (#10) - Reorder delete-account to deleteUser before cleanup for atomicity (#12) - Add error handling for all Supabase calls in post-signup (#13) - Add idempotency guard (welcomed_at) to waitlist-welcome (#14) Code quality: - Rename proSort0-5 to kebab-case pro-sort-0-5 with stylelint suppression (#4) - Restore expect import in cspHeaders.test (#7) - Revert destructive column drop in migration (#17) - Add new migration for welcomed_at column (#14) Tests: - Add test for implicit sign-out profile clearing (AuthProvider) - Add test for email input not clobbered by async auth (ProComingSoonPage) - Add test for Escape dismissing delete modal (ProfileSettingsPage) - Add test for anchor rendering outside Router (ProWaitlistBanner)
npm retired the /-/npm/v1/security/audits endpoint, causing pnpm audit to fail with 410 on every CI run. Use the built-in --ignore-registry-errors flag so the audit still runs when the registry is available but doesn't block CI when it's down.
The <main> element had sm:pt-20 (80px) while the header is only 56px (h-14) and in normal document flow. This created 24px of dead space between the header and content. Removed pt-0 sm:pt-20 since p-6 provides sufficient spacing.
Hide GitHub repo badge, language switcher, and theme toggle on pages other than /app. These controls are auto-detected (browser language, system theme) and can be changed from the visualizer. The sign-in button remains visible everywhere; the user avatar is hidden when authenticated on non-/app pages to reduce distraction. - Header: gate GitHubRepoBadge, LanguageSwitcher, ThemeToggle behind isAppPage - UserMenu: accept hideAvatar prop, return null when authenticated on non-/app - Extract isAppPage from location.pathname for cleaner conditionals
The insight panel backdrop used fixed inset-0 with no top offset,
covering the entire viewport including the header. On desktop, offset
the backdrop by 56px (header height) to match the PythonCodePanel
behavior. Mobile remains full-viewport since the panel sheets up from
the bottom.
- Add isMobile state with resize listener (matching PythonCodePanel)
- Apply style={{ top: '56px' }} to backdrop on desktop
The flag made pnpm audit exit 0 on registry non-200 responses, so the audit gate could pass without scanning any advisories. Remove it so registry failures are visible and the gate actually enforces audit results.
pnpm audit is broken on pnpm 10.x because npm retired the legacy audit endpoints (410 Gone). Switch to npm audit which uses the new bulk advisory endpoint. Generates a temporary package-lock.json, runs the audit, then cleans up. Add comment explaining the workaround for future maintainers.
pnpm audit is broken on pnpm 10.x — npm retired the legacy audit endpoints (410 Gone). Replace the fragile npm audit workaround with OSV-Scanner, a standalone vulnerability scanner that reads pnpm-lock.yaml natively and aggregates 30+ advisory sources. - Remove npm audit workaround from ci.yml quality job - Add .github/workflows/osv-scanner.yml with two jobs: - scan-pr: incremental PR scan (blocks on new vulns) - scan-scheduled: full scan on push/schedule (advisory only) - Pin reusable workflows to SHA 9a49870 (v2.3.8, verified) - Add osv-scanner.toml with empty ignore list for future triage
The reusable workflows require actions:read, contents:read, and security-events:write but the caller didn't grant them, causing a startup failure on the first run.
The scan completes successfully but the JSON export exceeds GitHub's 1MB job output limit. Disable export-results since SARIF upload to Code Scanning is the primary integration, not job outputs.
The PR reusable workflow at this SHA doesn't expose export-results. The default is already false, so no input is needed.
At v2.3.8 SHA (9a49870), the PR reusable workflow lacks the export-results input — the export step runs unconditionally and dumps full scan JSON into job outputs, exceeding GitHub's 1MB limit. Track @main which has export-results support, and explicitly disable it. Pin to a specific SHA once a release ships with this input.
feat: platform security foundation, Pro waitlist, and UX improvements
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
documentation
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
ayoub3bidi
changed the title
Codecov Report❌ Patch coverage is 📢 Thoughts on this report? Let us know! |
1 participant
Contribution workflow
main: This PR mergesdevelopintomainto push an early production update.developwith full CI gates.Description
Early production sync — pushing accumulated
developwork tomainahead of the full v0.5.0 release cycle.180 commits across 23 merged PRs (#175–#199), touching 497 files with +42,982 / -3,194 lines.
Type of Change
Related Issues
Supersedes all PRs #175–#199 merged into
develop.Changes Made
New Algorithm Categories & Algorithms
TreeVisualizeranduseTreeTraversalVisualizationhookGraphAlgorithmCategoryVisualizer,GraphAlgorithmMatrixVisualizer, node-link/matrix routing, and 18 preset test scenariosAuthentication & User System
AuthProvider,RequireAuth,BannedScreencomponents/settings/profile) with display name, avatar customization (DiceBear), tabbed UIauthService,profileService,entitlementService,accessService,googleTokenExchangeSignInPromptModalFeatures
.well-known/agent-card.json, MCP endpoint, WebMCP supportInfrastructure
wrangler.jsonc, deploy/preview workflows, auto-cleanup on PR closeUI/UX
Testing
supabaseMock,framerMotionMock,soundManagerMockTesting
pnpm test:run)Test Results
All PRs were gated by CI (lint → format → test:coverage → build) before merge.
Code Quality
pnpm lint)pnpm format)Performance Impact
Accessibility
Breaking Changes
Checklist
Additional Notes
This is an early production sync — v0.5.0 development continues on
develop.PRs included in this merge:
Reviewer Guidelines: