Harden Docker delivery pipeline and worker graceful shutdown

[BigSimmo]

Summary

Harden Docker delivery pipeline, enforce Python dependency lockfiles, ensure graceful worker shutdown, and add provider-free container validation smoke tests. Also isolates and organizes UI responsive design optimizations.

Verification

• npm run verify:pr-local

• npm run verify:ui when UI, routing, styling, browser behavior, reduced-motion, or forced-colors behavior changed

• npm run verify:release before release or handoff confidence claims

Risk and rollout

• Risk: Low to Medium. Changes are mostly localized to the Docker build, worker loop, CI pipeline, and UI layout.
• Rollback: Revert PR.
• Provider or production effects: None.

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

---

Summary by CodeRabbit

• New Features
  • Added Figma integration support and setup guidance for design workflows.
  • Improved issue-register refresh and validation procedures.
• Documentation
  • Added design, performance, repository review, cloud access, and delivery audit documentation.
  • Documented Figma OAuth setup, security boundaries, and supported workflows.
• Bug Fixes
  • Simplified background processing behavior while preserving in-flight work and error handling.
  • Updated favourites navigation and smoke-test coverage for current interface behavior.
• Tests
  • Expanded validation for Figma integration, cloud setup, credential handling, and favourites access.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in:8 minutes

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: b47ecdea-7a70-4694-8178-ca1ecf5d2957

📥 Commits

Reviewing files that changed from the base of the PR and between a0b7185 and 1098e19.

📒 Files selected for processing (2)

• .claude/skills/issues/SKILL.md
• docs/branch-review-ledger.md

📝 Walkthrough

Walkthrough

The changes update issue-register procedures, add Figma MCP and Cloud credential controls, document repository audits, refine workspace and UI test contracts, and simplify worker loop bookkeeping.

Changes

Issue register workflow

Layer / File(s)	Summary
Register refresh and ledger mutation flow .agents/skills/ledger/SKILL.md, .claude/skills/issues/SKILL.md, .claude/skills/ledger/SKILL.md	Issue procedures now refresh the visual register, verify ISSUES_LIST_UPDATED, open the generated artifact, and report stale output when refresh fails.

Figma and Cloud tooling

Layer / File(s)	Summary
Figma MCP configuration and guidance .cursor/mcp.json, .cursor/settings.json, README.md, docs/agents-guide.md, docs/codex-cloud.md, tests/cursor-mcp-contract.test.ts	Cursor configures the Figma MCP server and plugin. Documentation covers OAuth, supported workflows, Cloud limitations, and credential restrictions. Contract tests verify the server URL.
Cloud credential inventory and scrubbing scripts/check-codex-cloud-raw-env.sh, scripts/check-codex-cloud-setup.mjs, scripts/setup-codex-cloud.sh, tests/codex-cloud-setup.test.ts	Cloud checks detect Figma credential variables. Setup scripts scrub and exclude them, add setup-phase markers, and validate setup behavior through contract tests.

Audit and review records

Layer / File(s)	Summary
Design and performance audit reports docs/audit/*	New reports record live design findings, viewport results, performance and Core Web Vitals findings, image handling, remediation priorities, and rerun commands.
Review findings and ledger history docs/review-findings-2026-08-02.md, docs/branch-review-ledger.md	Repository review findings and dated branch-review records are added.

Workspace and regression maintenance

Layer / File(s)	Summary
Workspace settings and UI regression contracts .vscode/settings.json, tests/favourites-auth-gate.test.ts, tests/ui-smoke.spec.ts	VS Code disables the experimental TypeScript Go service. Tests cover guest Favourites links and the sidebar-owned New chat control.

Worker shutdown behavior

Layer / File(s)	Summary
Stopped-state loop control worker/run-loop.ts	The worker loop removes active-batch bookkeeping and continues to drain concurrent jobs while preserving per-job error handling.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• BigSimmo/Database#1575: Introduced the worker loop behavior simplified by this PR.
• BigSimmo/Database#1589: Adds related Figma MCP project configuration.
• BigSimmo/Database#1613: Covers related Figma MCP, Cloud credential, setup, documentation, and test changes.

Suggested labels:skip-branch-sync

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description is mostly complete but omits the required deployment-readiness result for deployment changes and the Notes section.	Add the deployment-readiness check result or a stated reason for not running it, and include the Notes section.
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main Docker delivery and worker graceful-shutdown changes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/docker-delivery-hardening

---

_{Comment @coderabbitai help to get the list of available commands.}

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[devin-ai-integration]

Devin Review found 7 potential issues.

View 4 additional findings in Devin Review.

[BigSimmo]

@cursoragent resolve all merge conflicts

[cursor]

PR #1656 merge conflicts are cleared.

• Tip: 5f5d60e4 on codex/docker-delivery-hardening
• Was CONFLICTING / DIRTY → now mergeable: MERGEABLE
• git merge-tree vs origin/main is clean (ahead 17 / behind 0)

Main was synced in; delivery hardening from main was kept (Railway-safe Dockerfiles, smoke/Trivy/worker Sentry paths), along with this branch’s UI densify work. Required CI is still settling — merge is left to you.

[Copilot]

Pull request overview

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Hardens the Docker delivery pipeline and worker runtime by adding provider-free validation/smoke checks, enforcing Python lockfile integrity, and improving worker graceful shutdown behavior. It also includes targeted responsive UI layout fixes backed by additional UI tests and expanded Codex Cloud setup diagnostics.

Changes:

• Add worker runtime controller/run loop and a bundled runtime validator, plus unit tests for graceful shutdown and dependency resolution.
• Enforce hashed, pinned Python lockfiles (prod + cloud) with scripts/tests; enhance Codex Cloud setup with step-aware diagnostics.
• Harden container builds/CI (pinned digests, STOPSIGNAL, image content contracts, smoke tests, SBOM + Trivy scans) and apply responsive UI fixes with new Playwright coverage.

Reviewed changes

Copilot reviewed 65 out of 69 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
worker/validate-runtime.ts	New provider-free runtime validator (Node/npm, externals resolution, Python/pip checks).
worker/types.ts	Extracts worker DB row/document types for reuse and testing.
worker/runtime-control.ts	Adds stop/signal handling and interruptible sleep for graceful shutdown.
worker/run-loop.ts	New worker loop that drains active batches and supports stop/backoff behavior.
worker/python/requirements.in	Introduces direct Python deps source file for lock generation.
worker/main.ts	Refactors main loop to use the new run loop + runtime controller.
tests/worker-runtime-validation.test.ts	Unit tests for runtime validator behavior.
tests/worker-runtime-control.test.ts	Unit tests for runtime control stop/sleep/signal wiring.
tests/worker-run-loop.test.ts	Unit tests for run loop drain/stop/backoff behavior.
tests/worker-python-lock.test.ts	Tests that both Python locks are pinned + hashed and target correct versions.
tests/ui-tools.spec.ts	Adds breakpoint coverage to ensure tool descriptions don’t clip.
tests/ui-smoke.spec.ts	Updates navigation labels and adds additional UI/scroll geometry assertions.
tests/ui-phone-scroll-page-owned.spec.ts	Adds narrow-phone calculator overflow assertions.
tests/ui-overlap.spec.ts	Adjusts header overlap expectations + new-chat control assertions.
tests/favourites-auth-gate.dom.test.tsx	Ensures favourites gating is truthful while keeping menu fail-closed.
tests/container-ci-contract.test.ts	Adds Docker base-image digest pin + STOPSIGNAL + runtime validator checks.
tests/codex-cloud-setup.test.ts	Updates expected env credential detection and setup contract assertions.
tests/codex-cloud-diagnose.test.ts	Adds tests for new Codex Cloud diagnostic output.
tests/answer-progress-ui-smoke.spec.ts	Adds geometry assertions to ensure progress stage remains visible.
src/components/clinical-dashboard/search-results-layout.tsx	Fixes grid min-width behavior to prevent horizontal overflow.
src/components/clinical-dashboard/master-search-header.tsx	Makes mode trigger truthful for favourites; toggles desktop new-chat visibility.
src/components/clinical-dashboard/global-search-shell.tsx	Passes desktop new-chat visibility based on sidebar ownership.
src/components/clinical-dashboard/document-admin.tsx	Removes duplicated Sources header; improves responsive row layout.
src/components/clinical-dashboard/answer-status.tsx	Adds scroll-into-view logic for progress stages.
src/components/clinical-dashboard/ClinicalSidebar.tsx	Uses canonical app-mode label for prescribing mode.
src/components/calculators/search-page.tsx	Fixes header grid sizing to avoid viewport overflow.
src/components/applications-launcher-page.tsx	Removes line clamps and enables wrapping for tool descriptions.
src/components/ClinicalDashboard.tsx	Disables desktop new-chat in dashboard-owned shell variant.
scripts/worker-python-lock-config.mjs	Shared config/helpers for multi-target worker Python lock generation/verification.
scripts/trivy-image-scan.mjs	Adds pinned Trivy scan + SBOM generation utility script for CI.
scripts/setup-codex-cloud.sh	Adds setup step tracking + diagnostics trap; enforces cloud Python lock usage.
scripts/resolve-oci-image-digest.mjs	Utility to resolve multi-platform digest for Docker image pinning.
scripts/generate-worker-python-lock.mjs	Generates worker Python lockfiles via pip-tools in an isolated venv.
scripts/diagnose-codex-cloud.mjs	Provider-free runtime diagnostics for Codex Cloud alignment issues.
scripts/ci-change-scope.mjs	Expands container-change detection patterns for new scripts/locks/tests.
scripts/check-worker-python-lock.mjs	Verifies committed locks match generated output and include pins/hashes.
scripts/check-image-content-contract.mjs	Enforces container hardening contract (user, stopsignal, labels, file absence).
scripts/check-codex-cloud-setup.mjs	Updates setup script validator for cloud lock usage.
scripts/build-worker.mjs	Builds validator bundle and writes externals list for runtime validation.
scripts/app-container-smoke.mjs	Provider-free container smoke test for app image (health + PID1 + stop).
package.json	Adds scripts for lock generation/verification, smoke, and diagnostics.
docs/worker-deploy-runbook.md	Updates CI job naming and documents new runtime validation/lock contracts.
docs/scripts-index.md	Updates script counts after adding new scripts.
docs/review-findings-2026-08-02.md	Adds an audit report document (no code behavior change).
docs/outstanding-issues.md	Updates ledger IDs and adds new tracked tasks.
docs/deployment-architecture.md	Documents pinned image digests, STOPSIGNAL, and worker SIGTERM behavior.
docs/codex-cloud.md	Documents automatic setup diagnostics + Python lock target split.
docs/codebase-index.md	Notes new .codex/ directory purpose.
docs/branch-review-ledger.md	Adds ledger entries for this branch/PR work.
docs/audit/performance-image-cwv-audit-2026-08-02.md	Adds performance audit report document (no code behavior change).
docs/audit/live-design-interaction-audit-2026-08-06.md	Adds live UX audit report document (no code behavior change).
docs/agents-guide.md	Adds Figma MCP guidance and expands tooling table.
README.md	Documents Figma plugin/MCP support limitations for Cloud Agents.
Dockerfile.worker	Pins base image by digest; adds pip hash enforcement, validator gate, STOPSIGNAL, OCI labels.
Dockerfile	Pins base image by digest; adds npm cache mounts, STOPSIGNAL, OCI labels.
.vscode/settings.json	Disables tsgo experimental setting.
.npmrc	Adds scoped registry entry for @database packages.
.gitignore	Ignores .codex/ contents except tracked config file.
.github/workflows/docker-image.yml	Merges image builds into one job; loads images; adds contract checks, smoke, SBOM, vuln scan.
.github/dependabot.yml	Enables weekly Docker ecosystem dependency updates.
.cursor/settings.json	Enables figma plugin in Cursor settings.
.cursor/mcp.json	Adds Figma MCP endpoint configuration.
.codex/config.toml	Adds secret-free Codex MCP registrations scaffold.
.claude/skills/ledger/SKILL.md	Updates ledger procedure to refresh and require visual register artifact.
.claude/skills/issues/SKILL.md	Adds “issues list” refresh guidance and visual register generation procedure.
.agents/skills/ledger/SKILL.md	Mirrors ledger procedure updates for agents.

Suppressed comments (8)

scripts/setup-codex-cloud.sh:1

• fail() now returns instead of exiting, but it is used in || fail guards. In bash, failures in cmd || ... / [[ ... ]] || ... contexts will not trigger the ERR trap, so the script can continue after a fatal condition (with unset/invalid state). Fix by making fail() terminate the script (e.g., exit 1) or refactor call sites to if ! ...; then fail ...; fi so fail runs as a simple command and is caught by the ERR trap consistently.
  scripts/setup-codex-cloud.sh:1
• fail() now returns instead of exiting, but it is used in || fail guards. In bash, failures in cmd || ... / [[ ... ]] || ... contexts will not trigger the ERR trap, so the script can continue after a fatal condition (with unset/invalid state). Fix by making fail() terminate the script (e.g., exit 1) or refactor call sites to if ! ...; then fail ...; fi so fail runs as a simple command and is caught by the ERR trap consistently.
  scripts/setup-codex-cloud.sh:1
• fail() now returns instead of exiting, but it is used in || fail guards. In bash, failures in cmd || ... / [[ ... ]] || ... contexts will not trigger the ERR trap, so the script can continue after a fatal condition (with unset/invalid state). Fix by making fail() terminate the script (e.g., exit 1) or refactor call sites to if ! ...; then fail ...; fi so fail runs as a simple command and is caught by the ERR trap consistently.
  scripts/check-image-content-contract.mjs:1
• assertPathAbsent(image, \"/app/*.pem\") does not do what the comment suggests: test -e checks the literal path /app/*.pem (no glob expansion), so this assertion will always pass even if /app/*.pem files exist. Remove this call to avoid a false sense of coverage, or implement the .pem check with a shell (sh -c) glob-based test (or rely solely on the explicit ls /app/*.pem check below).
  worker/validate-runtime.ts:1
• Building a file URL via string interpolation (new URL(file://${...})) is not robust for platform paths (notably Windows drive-letter paths) and does not properly encode special characters. Use a proper path-to-URL conversion for string paths (e.g., via pathToFileURL) and consider validating the parsed externals.json shape (e.g., Array.isArray + element type checks) before iterating.
  worker/runtime-control.ts:1
• detachSignals() currently stops the controller (and runs all cleanup callbacks) rather than only detaching signal handlers. This is surprising given the name and the nearby comment about tests calling detachSignals. Fix by either (a) renaming the method to reflect that it also stops (e.g., stopAndDetachSignals), or (b) implementing a true detach that only removes the signal listeners without toggling the stopped state.
  worker/main.ts:1
• Calling process.exit(...) inside main() bypasses the main().catch(async ...) handler that flushes error tracking (flushWorkerErrorTracking()). In particular, the WorkerAbortError path will exit without flushing buffered telemetry, and the graceful-stop path may also exit before pending I/O settles. Prefer setting process.exitCode and returning (or rethrowing WorkerAbortError so the outer catch can flush and then exit), and ensure the abort path flushes before termination.
  worker/main.ts:1
• Calling process.exit(...) inside main() bypasses the main().catch(async ...) handler that flushes error tracking (flushWorkerErrorTracking()). In particular, the WorkerAbortError path will exit without flushing buffered telemetry, and the graceful-stop path may also exit before pending I/O settles. Prefer setting process.exitCode and returning (or rethrowing WorkerAbortError so the outer catch can flush and then exit), and ensure the abort path flushes before termination.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cursor]

Merge conflicts resolved

PR #1656 tip 5f5d60e4 on codex/docker-delivery-hardening.

• Synced origin/main (merge commit on branch).
• git merge-tree --write-tree origin/main HEADclean.
• GitHub: mergeable: MERGEABLE (was CONFLICTING / DIRTY). Ahead 17 / behind 0.

Conflict resolution kept main’s completed delivery hardening (Railway-portable Dockerfiles without BuildKit cache mounts, smoke hash secret / Next 16 PID1, Trivy without docker.sock, worker Sentry capture) and main’s outstanding-issues queue; branch UI densify work retained. Follow-up fixes on tip include unused statusFilterLabel removal and related lint/test cleanups.

Merge left to you once required CI settles.

[BigSimmo]

PR #1656 babysit summary (Cursor agent)

Tip:70021267dc4c911b0e8087c2b5bca6deae488e48 on codex/docker-delivery-hardening
Base:origin/main · ahead/behind: 18 / 0 · merge-tree: clean · mergeable: MERGEABLE (GitHub BLOCKED while required checks settle) · auto-merge: already armed (squash) — left as-is

Sync

Real conflicts vs main (Docker/worker hardening already landed in #1575+). Merged origin/main, preferring main’s Docker/worker/scripts/tests; kept this PR’s unique UI responsive deltas and hand-merged Codex Cloud/Figma docs.

Fixed

Item	Severity	Change
Missing claim/process Sentry capture after run-loop extract	P1	Restored via main sync (captureException + flush on graceful exit)
Dead active > 0 while predicate	P2	Removed counter; while (!controller.isStopped)
Auto-merged Dockerfile reintroduced BuildKit npm cache mounts	P1	Restored Railway-safe Dockerfile (no --mount=type=cache)
FIGMA_* scrubbed but missing from raw-env probe / MCP contract	P2	Aligned probe + Cursor MCP contract
Favourites gate source contract vs truthful Mode Favourites	P2	Updated contract test
Unused statusFilterLabel after densify	lint	Removed
Rail label "Medication" broke ui-smoke	P1	Updated smoke expectations; desktop favourites uses sidebar New chat
.npmrc unused @database → Figma registry	P1/SEC	Removed remap

Dispositioned (no further code change)

• Trivy --exit-code 0 / HIGH,CRITICAL scan: advisory by design (continue-on-error: true + container-ci contract)
• Read-only runtime step that replaces CMD: advisory companion; full smoke still boots the app
• Devin “missing RAG_QUERY_HASH_SECRET / docker.sock” findings: stale vs tip (already fixed on main lineage)
• Bugbot “claim after SIGTERM mid-RPC”: expected drain of already-leased jobs; pre-claim stop check remains

Threads

All 9 review threads resolved (2 Sentry + 7 Devin).

Local gates (decisive lines)

• Test Files 515 passed (515) / Tests 5446 passed | 1 skipped (5447)
• npm run verify:cheap → exit 0 (after lint fix)
• Offline RAG fixture and production-contract checks passed. (verify:pr-local)
• Retest of the 5 previously failing ui-smoke cases: 5 passed (7.3s)
• verify:phone-chrome full-ui had been red on tip 5f5d60e4 (Medication + New chat); fixed on 70021267 — full Chromium gate not re-run after that push (auto-merge armed; avoid thrash). Hosted Production UI on this tip is the remaining proof.

Residual risks

• Advisory Trivy/read-only steps do not gate merges
• Ledger append for this review is local only (not pushed — no ledger-only tip while auto-merge is armed)
• Hosted required CI on 70021267 still settling; merge left to you / existing auto-merge

Merge left to you.

[BigSimmo]

Follow-up: tip / CI

Final tip after CI re-trigger: ceabdff74273c913e8b22d6a5ad9b78322ad6a23 (empty commit — prior tip 70021267 never received github-actions check suites; Actions was stuck on superseded 5f5d60e4).

Current tip now has github-actions suites; PR policy / PR mergeability / SAST / Gitleaks are pending. Merge-tree still clean; all review threads remain resolved. Merge still left to you / existing auto-merge.

[coderabbitai]

Actionable comments posted: 6

🧹 Nitpick comments (3)

.claude/skills/ledger/SKILL.md (1)

91-94: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win

Define one refresh-failure contract for the ledger procedures.

Both ledger procedures require the marker before commit but omit the behavior when the marker is absent. State whether the valid Markdown mutation remains uncommitted and the artifact is reported stale, or define another deliberate policy.

• .claude/skills/ledger/SKILL.md#L91-L94: document the failed-refresh branch in the canonical ledger procedure.
• .agents/skills/ledger/SKILL.md#L13-L14: apply the same failed-refresh branch in the wrapper procedure.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.claude/skills/ledger/SKILL.md around lines 91 - 94, Define the
refresh-failure policy in both ledger procedures: in
.claude/skills/ledger/SKILL.md lines 91-94, document that when
ISSUES_LIST_UPDATED is absent the valid Markdown mutation remains uncommitted
and the issue artifact is reported stale; apply the same policy in
.agents/skills/ledger/SKILL.md lines 13-14. Ensure both procedures consistently
require the marker before committing.

tests/cursor-mcp-contract.test.ts (1)

40-43: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win

Cover the Figma plugin toggle in the contract test.

This change updates .cursor/settings.json, but the test only reads .cursor/mcp.json. It can pass while plugins.figma.enabled is false. Load the settings file and assert that the Figma plugin is enabled.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@tests/cursor-mcp-contract.test.ts` around lines 40 - 43, Update the contract
test around the existing servers assertions to also load the Cursor settings
configuration and verify that the Figma plugin’s enabled flag is true. Keep the
current MCP server assertions unchanged, and reference the existing settings
structure under plugins.figma.enabled.

tests/codex-cloud-setup.test.ts (1)

160-170: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Cover all new Figma credential names.

providerCredentialVariables now includes six Figma names, but the fixture and expected output cover only FIGMA_CLIENT_SECRET. A typo in the other five entries would pass. Add non-empty fixtures and expected entries for FIGMA_CLIENT_ID, FIGMA_ACCESS_TOKEN, FIGMA_PERSONAL_ACCESS_TOKEN, FIGMA_TOKEN, and FIGMA_NPM_TOKEN.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@tests/codex-cloud-setup.test.ts` around lines 160 - 170, Expand the
credential fixture in configuredProviderCredentialNames to include non-empty
values for FIGMA_CLIENT_ID, FIGMA_ACCESS_TOKEN, FIGMA_PERSONAL_ACCESS_TOKEN,
FIGMA_TOKEN, and FIGMA_NPM_TOKEN, then add those names to the expected result
alongside FIGMA_CLIENT_SECRET. Preserve the existing ordering defined by
providerCredentialVariables.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.claude/skills/issues/SKILL.md:
- Around line 107-119: Move the “Refresh the visual register” gate in the issue
procedures so it runs before the commit instructions, matching the ordering used
by the ledger procedures. Ensure committing docs/outstanding-issues.md requires
a successful ISSUES_LIST_UPDATED result, while preserving the existing
stale-artifact exception when refresh fails.
In @.cursor/mcp.json:
- Around line 13-16: Remove the type property from the figma MCP entry, leaving
its url property unchanged so the remote server uses the documented schema.
In `@docs/audit/live-design-interaction-audit-2026-08-06.md`:
- Around line 12-22: Change the top-level report headings “Evidence locations”
and “Viewport matrix used” from level-three headings to level-two headings,
preserving their existing text and content.
In `@docs/review-findings-2026-08-02.md`:
- Around line 240-249: Update docs/review-findings-2026-08-02.md lines 240-249
to include decisive output lines for every listed typecheck and analysis
command, rather than only pass/fail summaries. Update
docs/branch-review-ledger.md lines 591-597 to replace the shorthand verification
field with the corresponding decisive gate output and explicitly state that npm
run verify:release remains unchecked.
- Around line 230-235: Update the “Restore the typecheck gate” item under
“Suggested next steps” to remove the recommendation to edit
`.next/dev/types/validator.ts`; retain only cleaning/regenerating `.next/` or
correcting the authored route references, and state that generated `.next/`
output must not be committed.
In `@worker/run-loop.ts`:
- Around line 40-43: Update the run loop’s claim flow so shutdown cancellation
is propagated to claim(), or jobs returned after SIGTERM/SIGINT are released
before processing; ensure no leased jobs are processed after the stop signal.
Add a regression test covering shutdown between the existing stop check and
claim() resolution.
---
Nitpick comments:
In @.claude/skills/ledger/SKILL.md:
- Around line 91-94: Define the refresh-failure policy in both ledger
procedures: in .claude/skills/ledger/SKILL.md lines 91-94, document that when
ISSUES_LIST_UPDATED is absent the valid Markdown mutation remains uncommitted
and the issue artifact is reported stale; apply the same policy in
.agents/skills/ledger/SKILL.md lines 13-14. Ensure both procedures consistently
require the marker before committing.
In `@tests/codex-cloud-setup.test.ts`:
- Around line 160-170: Expand the credential fixture in
configuredProviderCredentialNames to include non-empty values for
FIGMA_CLIENT_ID, FIGMA_ACCESS_TOKEN, FIGMA_PERSONAL_ACCESS_TOKEN, FIGMA_TOKEN,
and FIGMA_NPM_TOKEN, then add those names to the expected result alongside
FIGMA_CLIENT_SECRET. Preserve the existing ordering defined by
providerCredentialVariables.
In `@tests/cursor-mcp-contract.test.ts`:
- Around line 40-43: Update the contract test around the existing servers
assertions to also load the Cursor settings configuration and verify that the
Figma plugin’s enabled flag is true. Keep the current MCP server assertions
unchanged, and reference the existing settings structure under
plugins.figma.enabled.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: c868fe7c-6838-431f-83f1-0de7b816bccf

📥 Commits

Reviewing files that changed from the base of the PR and between 40b449d and c0ea414.

⛔ Files ignored due to path filters (1)

• deno.lock is excluded by !**/*.lock

📒 Files selected for processing (21)

• .agents/skills/ledger/SKILL.md
• .claude/skills/issues/SKILL.md
• .claude/skills/ledger/SKILL.md
• .cursor/mcp.json
• .cursor/settings.json
• .vscode/settings.json
• README.md
• docs/agents-guide.md
• docs/audit/live-design-interaction-audit-2026-08-06.md
• docs/audit/performance-image-cwv-audit-2026-08-02.md
• docs/branch-review-ledger.md
• docs/codex-cloud.md
• docs/review-findings-2026-08-02.md
• scripts/check-codex-cloud-raw-env.sh
• scripts/check-codex-cloud-setup.mjs
• scripts/setup-codex-cloud.sh
• tests/codex-cloud-setup.test.ts
• tests/cursor-mcp-contract.test.ts
• tests/favourites-auth-gate.test.ts
• tests/ui-smoke.spec.ts
• worker/run-loop.ts

[coderabbitai]

Actionable comments posted: 2

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.claude/skills/issues/SKILL.md (1)

18-19: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Make the issues-list paths configurable.

The trigger and refresh procedure hardcode C:\Users\joshs for ISSUES-LIST.html and refresh-issues-list.ps1. This workflow fails for other profiles and non-Windows sessions. Read both paths from configuration, or document the profile restriction.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.claude/skills/issues/SKILL.md around lines 18 - 19, Update the issues-list
workflow around the `issues list` trigger and refresh procedure to avoid
hardcoded `C:\Users\joshs` paths. Read the `ISSUES-LIST.html` and
`refresh-issues-list.ps1` locations from configurable settings, and use those
configured paths when refreshing and opening the artifact; if configuration is
not supported, explicitly document the required profile and Windows restriction.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.claude/skills/issues/SKILL.md:
- Around line 111-112: Update the post-mutation commit instructions around the
staging and commit commands to guarantee that only docs/outstanding-issues.md is
included, using git commit --only or explicitly rebuilding the index before
committing. Preserve the existing mutation and refresh-gate flow while
preventing unrelated pre-staged changes from entering the commit.
- Line 114: Update the fenced shell code block at the indicated section of
SKILL.md to include the bash language tag, changing the opening fence from an
untagged fence to a bash-tagged fence.
---
Outside diff comments:
In @.claude/skills/issues/SKILL.md:
- Around line 18-19: Update the issues-list workflow around the `issues list`
trigger and refresh procedure to avoid hardcoded `C:\Users\joshs` paths. Read
the `ISSUES-LIST.html` and `refresh-issues-list.ps1` locations from configurable
settings, and use those configured paths when refreshing and opening the
artifact; if configuration is not supported, explicitly document the required
profile and Windows restriction.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 24a22901-2a30-49fc-8e73-e492b4cba9bc

📥 Commits

Reviewing files that changed from the base of the PR and between c0ea414 and a0b7185.

📒 Files selected for processing (4)

• .claude/skills/issues/SKILL.md
• .cursor/mcp.json
• docs/audit/live-design-interaction-audit-2026-08-06.md
• docs/review-findings-2026-08-02.md

💤 Files with no reviewable changes (1)

• .cursor/mcp.json

🚧 Files skipped from review as they are similar to previous changes (2)

• docs/review-findings-2026-08-02.md
• docs/audit/live-design-interaction-audit-2026-08-06.md