fix: high-confidence bugs from last-100-PR review - #1374
Conversation
… nav Two P2 bugs found in the search/results-band bug hunt: 1. route-error-boundary.tsx: focus-visible outline used the undefined custom property --focus-ring (falling back to browser Highlight) instead of the app-wide --focus token (--clinical-accent). All other focus rings in the codebase already use --focus. 2. document-search-results.tsx: three raw <a> tags routed internal navigation (service record title, service 'Open' CTA, document title link) instead of Next.js <Link>. Adds the missing Link import and swaps all three. The document action buttons already used DocumentActionLink (<Link>-backed); only the inline title/CTA anchors were missed.
Private image signed URLs were retained in the module LRU after logout or session expiry, so cached bearer URLs could still paint for ~10 minutes. Clear the cache alongside other auth-bound client state.
- Keep safety-plan Load example non-shareable (fake crisis numbers) - Redact clinical URLs/paths in Copy Diagnostics clipboard payloads - Gate document search to indexed status before ilike fallback - Soften document not-found copy and use theme accent tokens
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe PR adds safety-plan example-mode safeguards, blocks search for non-indexed documents, redacts copied diagnostics, clears signed URL state across auth changes, updates internal navigation and unavailable-document states, and records review verification details. ChangesClinical safeguards and interface updates
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant Clinician
participant PatientSafetyPlan
participant Clipboard
Clinician->>PatientSafetyPlan: Load example
PatientSafetyPlan->>PatientSafetyPlan: Derive exampleActive
PatientSafetyPlan->>PatientSafetyPlan: Disable finalisation
Clinician->>PatientSafetyPlan: Copy plan
PatientSafetyPlan->>Clipboard: Write example-only export
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
Comment |
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
Prefer https?:// → [url] so clinical ?q= query text cannot survive as a residual path fragment, and harden the Copy Diagnostics privacy test.
Append-only review record for main@70e5101c scope last-100-prs-bug-review.
CI triageCI failed on this PR. Automated classification of the 2 failed job(s):
Compared with main CI run #6575 (success). Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger. |
|
@cursoragent Inspect the PR and repository state, identify the root cause of every failing CI check, unresolved review comment, merge conflict, and related defect. Apply the smallest robust fix using existing project patterns and best practices, without unrelated changes. Run Bugbot and all relevant lint, type-check, test, build, and CI-equivalent commands, fix any issues found, then resolve only the review comments that are fully addressed. Summarise the root causes, changes made, validation results, and any remaining blockers. |
Root causes
No unresolved review threads left after fixes. No real merge conflicts. Changes pushed
Validation
Remaining blockersHosted Production UI / PR required must finish green on the new head — local reproducer passes; waiting on GitHub Actions.   |
|
@codex review |
|
@claude review PR and fix issues |
|
Hi @BigSimmo — thanks for the @claude mention. Open this in Claude Code on the web to continue here: https://claude.ai/code Context: Automated backlink from the Claude backlink workflow. Claude Code can pick up the mention and push a scoped fix to the branch. |
|
Claude encountered an error after 2s —— View job I'll analyze this and get back to you. |
|
@CodeRabbit review PR |
|
✅ Action performedReview finished.
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e131dd0be8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
tests/patient-safety-plan.dom.test.tsx (1)
63-81: 🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy liftDo not treat any single edit as replacing the example.
This test codifies an unsafe transition: changing only the date, adding a row, or replacing one contact clears
exampleActive, while other seeded entries—including non-working numbers—remain. Sincereadythen becomes true for a complete plan, the watermark and finalisation block disappear despite the UI saying to replace every entry.Keep the example guard active until all seeded/example rows are removed or replaced, and add a regression test that edits only the date and verifies the example warning and disabled finalise control remain.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/patient-safety-plan.dom.test.tsx` around lines 63 - 81, Keep the PatientSafetyPlan example state active until every seeded/example entry has been removed or replaced, rather than clearing it after a single edit such as a date change, added row, or contact replacement. Update the example/ready guard logic and extend the existing regression coverage with a date-only edit asserting the example warning remains visible and “Finalise plan” stays disabled.src/lib/supabase/client.tsx (1)
357-398: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winGate signed-URL cache writes on auth epoch.
clearSignedUrlCache()removes the old entry, butuseSignedImageUrlcan still repopulate the module Map from an in-flight response after sign-out/expiry/account switch because the completion path only checks a localactiveflag.invalidateAuthRequests()only aborts registered requests, and this hook never registers its fetch. CheckisAuthEpochCurrent(epoch)beforesetCachedSignedUrl(...)(or wire the fetch into the auth request lifecycle).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/supabase/client.tsx` around lines 357 - 398, The signed-image URL fetch must not repopulate the cache after authentication changes. In useSignedImageUrl, capture the auth epoch when starting the request and check isAuthEpochCurrent(epoch) alongside the existing active guard before calling setCachedSignedUrl; preserve the existing cleanup behavior for unmounted or cancelled requests.
🧹 Nitpick comments (1)
tests/auth-signed-url-cache.dom.test.tsx (1)
90-159: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winCoverage gap: the race this suite sidesteps, and the account-switch path, are both untested.
Test 1 deliberately disables the probe before
signOut(lines 118-123) to avoid the in-flight-fetch race flagged insrc/lib/supabase/client.tsx(signOut/markSessionExpired/fingerprint effect) — so the suite currently can't catch a regression where a pending signed-URL fetch re-seeds the cache after the clear. Also, neither test exercises the fingerprint-effect clear path for a direct account switch (SIGNED_INfired for a different user id without an interveningSIGNED_OUT), which is one of the transitions the new code specifically targets ("Account switch / sign-in / sign-out" per theclient.tsxcomment).Consider adding: (1) a case that keeps the probe enabled through
signOutand asserts the cache doesn't get re-populated with the stale URL even if the fetch resolves late, and (2) a case that firesSIGNED_INfor a new user id directly and assertsclearSignedUrlCacheruns via the fingerprint effect.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/auth-signed-url-cache.dom.test.tsx` around lines 90 - 159, Add coverage in the auth signed-URL cache tests for both requested transitions: keep SignedImageProbe enabled through signOut, control a pending fetch, resolve it late, and assert the cleared cache is not re-seeded with the stale private URL; also simulate a direct SIGNED_IN event for a different user without SIGNED_OUT and assert the fingerprint-effect path clears the cache. Use the existing AuthProvider, SignedImageProbe, cache helpers, and auth-event utilities rather than changing production behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/components/patient-safety-plan.tsx`:
- Around line 479-485: Update addEntry so uid(key) is called before the
functional setEntries updater, storing the resulting entry for reuse inside the
updater. Keep the updater limited to deriving the next entries state without
mutating uidRef.current, while preserving the existing finalisation and
edit-marking behavior.
In `@src/lib/privacy.ts`:
- Around line 24-28: Update the URL replacement pattern in the privacy
sanitization chain to consume the complete non-whitespace URL token, including
parentheses, instead of stopping at ). Preserve the URL-before-path replacement
order, and add a regression test covering a URL such as
https://psychiatry.tools/dsm?q=clozapine%20(ANC)%20Jane to verify no suffix
remains unredacted.
In `@tests/ui-smoke.spec.ts`:
- Line 4152: Update the missing-document assertion in the relevant UI smoke test
to target the not-found/status panel locator instead of page.locator("body"),
while preserving the existing unavailable/private/missing/removed text pattern.
---
Outside diff comments:
In `@src/lib/supabase/client.tsx`:
- Around line 357-398: The signed-image URL fetch must not repopulate the cache
after authentication changes. In useSignedImageUrl, capture the auth epoch when
starting the request and check isAuthEpochCurrent(epoch) alongside the existing
active guard before calling setCachedSignedUrl; preserve the existing cleanup
behavior for unmounted or cancelled requests.
In `@tests/patient-safety-plan.dom.test.tsx`:
- Around line 63-81: Keep the PatientSafetyPlan example state active until every
seeded/example entry has been removed or replaced, rather than clearing it after
a single edit such as a date change, added row, or contact replacement. Update
the example/ready guard logic and extend the existing regression coverage with a
date-only edit asserting the example warning remains visible and “Finalise plan”
stays disabled.
---
Nitpick comments:
In `@tests/auth-signed-url-cache.dom.test.tsx`:
- Around line 90-159: Add coverage in the auth signed-URL cache tests for both
requested transitions: keep SignedImageProbe enabled through signOut, control a
pending fetch, resolve it late, and assert the cleared cache is not re-seeded
with the stale private URL; also simulate a direct SIGNED_IN event for a
different user without SIGNED_OUT and assert the fingerprint-effect path clears
the cache. Use the existing AuthProvider, SignedImageProbe, cache helpers, and
auth-event utilities rather than changing production behavior.
🪄 Autofix (Beta)
✅ Autofix completed
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 81384ec7-f412-41f9-b4db-01d4a951bece
📒 Files selected for processing (16)
docs/branch-review-ledger.mdsrc/app/(search-app)/differentials/not-found.tsxsrc/app/(search-app)/documents/[id]/not-found.tsxsrc/app/api/documents/[id]/search/route.tssrc/app/global-error.tsxsrc/components/clinical-dashboard/document-search-results.tsxsrc/components/patient-safety-plan.tsxsrc/components/route-error-boundary.tsxsrc/lib/privacy.tssrc/lib/supabase/client.tsxtests/auth-signed-url-cache.dom.test.tsxtests/patient-safety-plan.dom.test.tsxtests/privacy.test.tstests/private-access-routes.test.tstests/route-error-boundary-diagnostics.dom.test.tsxtests/ui-smoke.spec.ts
- Keep safety-plan example mode while any SEED row remains (date-only edits no longer enable Finalise with fake crisis numbers) - Clear mounted signed-image URL state on auth identity change - Scope safety-plan Playwright export notice to [data-safety-plan-copy] to avoid Production UI strict-mode failures
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. Fixes Applied SuccessfullyFixed 3 file(s) based on 2 unresolved review comments. Files modified:
Commit: The changes have been pushed to the Time taken: |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 90eebbcbf9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex resolve actionable Codex review findings for this pull request and current head using the repository instructions. This is the pull request's single automatic repair pass: do not perform a fresh review, create new standalone findings, or request another review. Work only the existing unresolved Codex threads on the current head. Always fix P0 and P1 findings. For P2 and lower findings, fix only clear, scoped, low-risk issues; otherwise disposition them with a concise reason. After fixing or dispositioning a thread, reply in that thread with as the first line, followed by a concise summary; that marker authorizes the workflow to close that exact thread. If human input or new authorization is required, do not use the marker and leave the thread open with the blocker. Finish only after every actionable thread is fixed or dispositioned and closed, or explicitly left open for a human decision. Do not update the branch from main, address unrelated reviews, broaden scope, or create more than one scoped fix commit. Do not use external APIs, paid services, credentials, dependency changes, or broad refactors unless explicitly authorized. Add targeted tests where behavior changes and run the narrowest relevant validation. |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Fixed 3 file(s) based on 2 unresolved review comments. Co-authored-by: CodeRabbit <noreply@coderabbit.ai>
|
@copilot review PR |
Head branch was pushed to by a user without write access
Reviewed current head Blocking finding (P1): CI status: latest branch I did not apply code changes from this @copilot review-only request. Review record appended in |
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
tests/auth-signed-url-cache.dom.test.tsx (1)
159-236: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winMissing coverage for
TOKEN_REFRESHEDwith the same user.Given the concern raised on
use-signed-image-url.ts(render-time reset may key off token identity rather than user identity), consider adding a case where the same user's session is refreshed (new access token, same user id) and asserting the signed URL does not momentarily disappear, since the cache is not cleared on refresh.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/auth-signed-url-cache.dom.test.tsx` around lines 159 - 236, Add a test alongside the existing sign-out and account-switch cases that emits a TOKEN_REFRESHED event for the same user with a new access token but unchanged user id. Assert the existing signed URL remains rendered throughout the refresh and the cached entry remains intact, verifying no render-time reset occurs when only token identity changes.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/components/clinical-dashboard/use-signed-image-url.ts`:
- Around line 21-29: Key the reset logic in useSignedImageUrl to a stable
authenticated-user identity, such as session.user.id or the existing auth
fingerprint, instead of authorizationHeader. Preserve the existing setUrl(null)
and setFailed(false) behavior only when that identity changes, so token
refreshes for the same user do not clear the cached URL.
In `@src/lib/privacy.ts`:
- Line 26: Update the URL-matching replacement in redactLogValue so it stops at
serialized JSON/string delimiters instead of consuming subsequent fields, while
continuing to redact complete URLs and allow parentheses within them. Preserve
the existing [url] replacement behavior and handling for non-URL text.
---
Nitpick comments:
In `@tests/auth-signed-url-cache.dom.test.tsx`:
- Around line 159-236: Add a test alongside the existing sign-out and
account-switch cases that emits a TOKEN_REFRESHED event for the same user with a
new access token but unchanged user id. Assert the existing signed URL remains
rendered throughout the refresh and the cached entry remains intact, verifying
no render-time reset occurs when only token identity changes.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 7739d7ab-8f94-4d9d-8212-f9e839d90ab4
📒 Files selected for processing (12)
docs/branch-review-ledger.mdsrc/components/clinical-dashboard/document-search-results.tsxsrc/components/clinical-dashboard/use-signed-image-url.tssrc/components/patient-safety-plan.tsxsrc/lib/privacy.tssrc/lib/supabase/client.tsxtests/auth-signed-url-cache.dom.test.tsxtests/patient-safety-plan.dom.test.tsxtests/privacy.test.tstests/private-access-routes.test.tstests/ui-smoke.spec.tstests/ui-tools.spec.ts
🚧 Files skipped from review as they are similar to previous changes (5)
- tests/privacy.test.ts
- tests/ui-smoke.spec.ts
- tests/private-access-routes.test.ts
- src/lib/supabase/client.tsx
- src/components/clinical-dashboard/document-search-results.tsx
Three review findings, two of them regressions this branch introduced.
P1 — mounted document-viewer URLs survived an identity change. Clearing the
module LRU does not reach DocumentViewer's own `signedUrl`/`downloadSignedUrl`
state, which was reset only on a *full* document reload. An auth-only
transition keeps the same load key, so after sign-out or an account switch the
previous identity's bearer link to a private PDF stayed rendered — and the
error UI kept offering it — until the URL expired on its own. The viewer now
drops both during render when the auth identity changes. Reproduced first: the
new test finds user A's anchor still present after the switch without this.
Redaction consumed neighbouring diagnostic fields. Non-string values are
JSON-stringified before redaction and compact JSON has no whitespace, so the
`\S+` URL pattern swallowed the closing quote and every field after it —
`{"url":"…","code":"23505"}` redacted to `{"url":"[url]`. The class now excludes
whitespace and quotes: parentheses are still consumed, so the
`?q=clozapine%20(ANC)%20Jane` leak stays fixed, but a serialized object stays
readable.
Signed-image reset keyed to the wrong value. `authorizationHeader` is a fresh
object on every access-token refresh, so a mounted private image blanked and
refetched roughly hourly for a user still entitled to see it. Keyed to the user
id instead, which changes in the same render on a real identity change and so
is no later than before — it just ignores refreshes. Asserting the settled DOM
could not catch this because the LRU repaints within a frame, so the test
inspects the render sequence.
Verification: verify:cheap exit 0 — Test Files 428 passed (428), Tests 4394
passed | 4 skipped (4398). Each new test was checked to fail against the
pre-fix code rather than pass vacuously.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FvU8z73P6TXUXoYBqN5K1P
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c0a894374d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Review asked for the preview to be reissued after an identity change so a
document the new identity can still read is not stranded. I implemented that
(bumping previewAttempt to force a full reload) and then removed it: the full
reload routes through openSourcePreview({ useCache: true }), which reads the
module signed-URL LRU, so it would repaint the PREVIOUS identity's URL anywhere
that cache had not already been cleared - the exact leak this reset closes.
Clearing without reissuing is the conservative failure: a blank preview that
recovers on reload, rather than the prior clinician's document. The comment now
states that so the next person does not re-add the bump. The strand is real and
worth fixing properly by reissuing with useCache: false; tracked as follow-up
rather than shipped unverified.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FvU8z73P6TXUXoYBqN5K1P
The merge=union driver keeps both copies of rows present on this branch and on main; the guard flags them as duplicate ref/HEAD/scope records (#88).
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a6c88d543e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
encodeURIComponent does not escape apostrophes, so a clinical query can carry one verbatim. Excluding ' from the URL character class stopped the match there and left the remainder in the clipboard: https://psychiatry.tools/dsm?q=patient's%20suicidal%20thoughts -> [url]'s%20suicidal%20thoughts That is the exact leak this redaction exists to prevent, in the Copy Diagnostics path this PR is meant to make safe. The class now excludes whitespace and the double quote only - the double quote is what keeps a serialized JSON object readable, and no test depended on stopping at an apostrophe. Over-consuming a trailing ' in JS-style single-quoted log output redacts slightly more, never less. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FvU8z73P6TXUXoYBqN5K1P
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 432f9fcab3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Production UI red on
|
…itch The render-phase auth-identity reset in DocumentViewer cleared only the two signed source URLs. An auth-only transition leaves the document load key unchanged, so `isFullDocumentReload` is false and the detail effect deliberately keeps the current window mounted until the replacement request settles. On a slow, offline, or denied request that window is the previous identity's extracted private content — title, pages, images, table facts, chunks, index health, the generated summary, and the in-document search query and snippets — left readable to the new account for as long as its request takes. Clear all of it in the same render-phase reset, and show the loading state while the refetch (triggered by the identity change through `authorizationHeader`) is in flight. The reset is guarded on the previous identity being non-null so the ordinary `null -> A` first-mount transition does not discard the server-rendered `initialDetail` on every page load. Sign-out (`A -> null`) and account switch (`A -> B`) both still clear. `initialDetail` also had to be invalidated explicitly: it is server-rendered for whoever requested the page, and the detail effect's `useInitialResult` branch replays it whenever the route still matches the initial one — so the very effect re-run the identity change triggers would have re-applied user A's SSR payload to user B and undone the clear. A latched `initialDetailIdentityStale` flag forces that refetch to the network. Test defers user B's detail response indefinitely and asserts A's title, chunk text, and table/diagram content are gone at the moment the identity changes rather than when B's reply lands. Verified red against the previous implementation (`expected <h1 …(1)></h1> to be null`).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FvU8z73P6TXUXoYBqN5K1P
Summary
Review of the last 100 PRs found several high-confidence production bugs. This PR fixes the confirmed non-RAG P1/P2 defects, CI follow-ups, and review-thread repairs.
Fixed here
setSessionon user-id change so child effects cannot re-paint viarequestAnimationFrame.?q=URLs (fix: Implement audit design fixes and fallback improvements #1351):redactLogValueconsumes full non-whitespace URL tokens (including parentheses).status=indexed(Merge search performance and correctness fixes #1290).<Link>wiring.[data-safety-plan-copy].origin/main(GitHubDIRTYwas staleness).RAG findings (deferred — needs approval)
Protected RAG/answer surfaces from #1289/#1292 were reviewed but not changed here.
Verification
auth-signed-url-cache+privacy22 passed (includes account-switch + parenthesis URL cases)npm run verify:cheapon earlier CI-fix head; re-run left to hosted CI on this headRisk and rollout
Clinical Governance Preflight
Clinical KB Database(sjrfecxgysukkwxsowpy)RAG impact: no retrieval behaviour change — document-search status gate only rejects non-indexed docs to match existing
search_document_chunks; no ranking/comparator/imputation edits.Notes
Summary by CodeRabbit