Skip to content

fix: workspace parent combobox + WCAG button text minimum 11px - #34

Merged
HongmingWang-Rabbit merged 1 commit into
mainfrom
fix/audit-run8
Apr 14, 2026
Merged

fix: workspace parent combobox + WCAG button text minimum 11px#34
HongmingWang-Rabbit merged 1 commit into
mainfrom
fix/audit-run8

Conversation

@HongmingWang-Rabbit

Copy link
Copy Markdown
Contributor

Summary

  • Issue 1 — Parent Workspace selector: Replaced raw UUID text input in CreateWorkspaceDialog with a <select> populated from GET /workspaces. Options display as T{tier} · {name}. Graceful silent fallback if the fetch fails (only root-level option shown). parent_id sent as undefined when root is selected.
  • Issue 2 — WCAG button text sizes: All interactive <button> elements across SkillsTab, ScheduleTab, secrets-section, ActivityTab, SidePanel, ChatTab raised from text-[8px]/text-[9px]text-[11px]. Non-interactive labels, badges, and helper text raised to text-[10px].
  • Tests: 7 new unit tests in CreateWorkspaceDialog.test.tsx covering dialog open, select present, first option empty/root, options populated from API, parent_id in POST body, root-level sends undefined, graceful error fallback.

Test plan

  • cd canvas && npm test — 372/372 passing (7 new tests)
  • npm run build — clean, no errors
  • Commit SHA 7cdbd0d confirmed in git log

🤖 Generated with Claude Code

Replace raw Parent Workspace ID text input with a <select> populated
from GET /workspaces (T{tier} · {name} format, graceful fallback on
fetch error). Raise all interactive button text from text-[8px]/[9px]
to text-[11px] across SkillsTab, ScheduleTab, secrets-section,
ActivityTab, SidePanel, ChatTab; non-interactive labels/badges to
text-[10px]. Adds 7 CreateWorkspaceDialog unit tests (372/372 passing).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@HongmingWang-Rabbit

Copy link
Copy Markdown
Contributor Author

7-gate verification passed. CI 6/6 green, canvas build ok, 369 vitest pass (including 7 new CreateWorkspaceDialog tests covering select population, parent_id round-trip, graceful API failure). Diff is UX polish (native replaces text input for parent workspace, button text 8-9px -> 10-11px for WCAG). No security scope changes, no confirm/alert/prompt, no light colors introduced. Native is inherently keyboard-accessible (arrow/Enter/Escape) so aria-expanded/controls/autocomplete N/A. Pre-existing Playwright flakiness unrelated to this change. Screenshot: /tmp/pr34-canvas.png.

@HongmingWang-Rabbit
HongmingWang-Rabbit merged commit 934d67b into main Apr 14, 2026
6 checks passed
@HongmingWang-Rabbit
HongmingWang-Rabbit deleted the fix/audit-run8 branch April 14, 2026 08:25
HongmingWang-Rabbit pushed a commit that referenced this pull request Apr 14, 2026
Adds a `canvas-deploy-reminder` job to ci.yml that fires on every
push to main once `canvas-build` passes. It posts a commit comment via
the built-in GITHUB_TOKEN (no new secrets needed) reminding whoever
monitors CI to run:

  cd /g/personal_programs/molecule-monorepo
  git pull origin main
  docker compose build canvas && docker compose up -d canvas

The comment includes the commit SHA and a direct link to the build log.

Rationale: 5 consecutive merge cycles (PRs #21, #25, #30, #32, #34)
went undeployed because there is no auto-deploy hook and the manual
step was silently forgotten. A commit comment on the merge commit is
the lowest-friction reminder that requires no external secrets or infra.

Does NOT run on PRs — only on direct pushes to main (i.e. post-merge).
Uses `needs: canvas-build` so the reminder only fires after build+tests
pass; a failing build produces no comment.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
HongmingWang-Rabbit pushed a commit that referenced this pull request Apr 15, 2026
Extends the secret map with RESEND_API_KEY, RESEND_FROM_EMAIL,
STRIPE_API_KEY, STRIPE_WEBHOOK_SECRET — the four SaaS secrets the
control plane reads once the current PR stack (#29-#34 on
molecule-controlplane) ships.

Adds rotation procedures for each:
- Resend: low-blast-radius, best-effort sends, domain verification
  gotcha documented
- Stripe API key: independent rotation from webhook secret, live verify
  via /cp/billing/checkout
- Stripe webhook secret: 24h overlap window procedure using stripe
  trigger for live verify

Also adds Resend + Stripe entries to the emergency-contacts list.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HongmingWang-Rabbit pushed a commit that referenced this pull request Apr 15, 2026
Tick 32 (manual) merged a large batch of PRs — the test counts in
CLAUDE.md were drifting behind reality by enough to matter:

- platform: 816 → 818 (YAML injection fix + sanitizeRuntime allowlist)
- canvas: 453 → 482 (12 CookieConsent + 17 PricingTable/billing)
- workspace-template: 1180 → 1179 (Hermes Phase 2a/2b dispatch tests
  landed but the test_hermes_providers env-var-leak fix removed a
  fragile flake-path count; net -1)

This is measured not guessed: running the full suites on fresh main.

Not in this sync but worth mentioning for the next retrospective:
- controlplane repo received the full GDPR/admin/usage/consent/email
  stack (#29-#34) — that work sits in molecule-controlplane, not
  monorepo CLAUDE.md
- monorepo picked up /pricing route, cookie consent banner, molecule-
  hitl plugin (#262), Hermes Phase 2a native Anthropic + 2b Gemini

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
molecule-ai Bot pushed a commit that referenced this pull request Apr 21, 2026
fix: workspace parent combobox + WCAG button text minimum 11px
molecule-ai Bot pushed a commit that referenced this pull request Apr 21, 2026
Adds a `canvas-deploy-reminder` job to ci.yml that fires on every
push to main once `canvas-build` passes. It posts a commit comment via
the built-in GITHUB_TOKEN (no new secrets needed) reminding whoever
monitors CI to run:

  cd /g/personal_programs/molecule-monorepo
  git pull origin main
  docker compose build canvas && docker compose up -d canvas

The comment includes the commit SHA and a direct link to the build log.

Rationale: 5 consecutive merge cycles (PRs #21, #25, #30, #32, #34)
went undeployed because there is no auto-deploy hook and the manual
step was silently forgotten. A commit comment on the merge commit is
the lowest-friction reminder that requires no external secrets or infra.

Does NOT run on PRs — only on direct pushes to main (i.e. post-merge).
Uses `needs: canvas-build` so the reminder only fires after build+tests
pass; a failing build produces no comment.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
molecule-ai Bot pushed a commit that referenced this pull request Apr 21, 2026
Extends the secret map with RESEND_API_KEY, RESEND_FROM_EMAIL,
STRIPE_API_KEY, STRIPE_WEBHOOK_SECRET — the four SaaS secrets the
control plane reads once the current PR stack (#29-#34 on
molecule-controlplane) ships.

Adds rotation procedures for each:
- Resend: low-blast-radius, best-effort sends, domain verification
  gotcha documented
- Stripe API key: independent rotation from webhook secret, live verify
  via /cp/billing/checkout
- Stripe webhook secret: 24h overlap window procedure using stripe
  trigger for live verify

Also adds Resend + Stripe entries to the emergency-contacts list.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
molecule-ai Bot pushed a commit that referenced this pull request Apr 21, 2026
Tick 32 (manual) merged a large batch of PRs — the test counts in
CLAUDE.md were drifting behind reality by enough to matter:

- platform: 816 → 818 (YAML injection fix + sanitizeRuntime allowlist)
- canvas: 453 → 482 (12 CookieConsent + 17 PricingTable/billing)
- workspace-template: 1180 → 1179 (Hermes Phase 2a/2b dispatch tests
  landed but the test_hermes_providers env-var-leak fix removed a
  fragile flake-path count; net -1)

This is measured not guessed: running the full suites on fresh main.

Not in this sync but worth mentioning for the next retrospective:
- controlplane repo received the full GDPR/admin/usage/consent/email
  stack (#29-#34) — that work sits in molecule-controlplane, not
  monorepo CLAUDE.md
- monorepo picked up /pricing route, cookie consent banner, molecule-
  hitl plugin (#262), Hermes Phase 2a native Anthropic + 2b Gemini

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant