Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

code/core/src/shared/open-service/README.md (1)

382-382: ⚡ Quick win

Add language specifiers to fenced code blocks.

Two fenced code blocks are missing language specifiers. Add identifiers to improve markdown rendering and enable syntax highlighting where applicable.

📝 Proposed fix

Line 382 (state sync diagram):

-```
+```text
 ┌─────────────────────────┐     channel (services:*)     ┌─────────────────────────┐
 │  Manager process        │  ◄────────────────────────►  │  Preview process        │

Line 429 (state sync sequence):

-```
+```text
 Peer A (manager)            Channel              Peer B (preview)
 ─────────────────────────────────────────────────────────────────

Also applies to: 429-429

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@code/core/src/shared/open-service/README.md` at line 382, Add language
specifiers to the two fenced code blocks in the README: the "state sync diagram"
block that begins with the Manager/Preview ASCII diagram and the "state sync
sequence" block that begins with "Peer A (manager)            Channel           
Peer B (preview)"; update their opening ``` fences to include a language
identifier (e.g., ```text or ```diff) so Markdown renderers apply syntax
highlighting and preserve formatting.

code/e2e-tests/open-service-background.spec.ts (1)

36-55: ⚡ Quick win

Prefer web-first waits over fixed waitForTimeout(5_000).

The two hard 5s sleeps are a Playwright anti-pattern: they add unconditional latency yet can still race on slow CI. The expect(darkSwatch).toBeVisible() and .poll(...) calls already wait deterministically, so the explicit sleeps can be dropped (or replaced with a concrete readiness condition such as waiting for the iframe load / a preview element).

♻️ Proposed change

     await page.goto(`${storybookUrl}/?path=${STORY_PATH}`);
     await page.waitForSelector('`#storybook-preview-iframe`');
-    await page.waitForTimeout(5_000);

     const darkSwatch = page.getByRole('toolbar').getByRole('button', { name: 'Dark', exact: true });

     await expect(darkSwatch).toBeVisible();
     await darkSwatch.click();
@@
     await page.reload();
     await page.waitForSelector('`#storybook-preview-iframe`');
-    await page.waitForTimeout(5_000);

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@code/e2e-tests/open-service-background.spec.ts` around lines 36 - 55, Remove
the two fixed page.waitForTimeout(5_000) sleeps and replace them with web-first
waits: after goto and after page.reload, wait for the preview iframe to finish
loading (e.g., await
page.frameLocator('`#storybook-preview-iframe`').locator('body').waitFor() or use
an explicit wait for the previewBodyBackground readiness) and then reuse the
existing expect.poll(() => previewBodyBackground(page), ...) checks; keep the
darkSwatch visibility/assertions and ensure previewBodyBackground is polled
after the iframe load so the test no longer relies on hard sleeps.

code/core/src/shared/open-service/service-sync.ts (1)

73-75: 💤 Low value

isPlainObject may incorrectly accept class instances or objects with modified prototypes.

The check typeof value === 'object' && value !== null && !Array.isArray(value) passes for class instances, Object.create(null) objects, and objects with non-Object prototypes. For untrusted channel payloads, consider checking Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null to ensure only true plain objects are accepted.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@code/core/src/shared/open-service/service-sync.ts` around lines 73 - 75, The
current isPlainObject function accepts class instances and objects with modified
prototypes; change its implementation to verify the object's prototype is either
Object.prototype or null by using Object.getPrototypeOf(value) ===
Object.prototype || Object.getPrototypeOf(value) === null in addition to the
existing typeof/value/null/Array checks so only true plain objects (including
Object.create(null)) pass; keep the function name isPlainObject and its type
predicate signature when updating the logic.

code/core/src/channels/postmessage/index.ts (1)

233-239: 💤 Low value

Potential redundant flush when both paths trigger.

The new flush at line 238 doesn't check this.connected, while the existing flush in setHandler (lines 53-56) sets connected = true to prevent re-flushing. If setHandler's flush already ran (setting connected = true), this new flush will still execute on every incoming message while buffer.length > 0, though flush() itself clears the buffer so subsequent calls are no-ops.

The logic is safe (buffer is cleared), but consider guarding with !this.connected for clarity and to avoid the extra function call:

-        if (this.config.page === 'manager' && this.buffer.length) {
+        if (this.config.page === 'manager' && this.buffer.length && !this.connected) {
           this.flush();
+          this.connected = true;
         }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@code/core/src/channels/postmessage/index.ts` around lines 233 - 239, The
preview postMessage flush can redundantly call flush() even after setHandler has
already flushed and set this.connected; update the conditional in the
postMessage handling block (the code that currently checks this.config.page ===
'manager' && this.buffer.length) to also require !this.connected before calling
this.flush(), so it only flushes when the channel hasn't already been marked
connected by the setHandler path (referencing this.connected, setHandler, and
flush).

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes