Repository navigation
Cycle 38: rate limiting, 4 new panel components, member-list schema - #7
Merged
Merged
Conversation
Booting the app locally (npm run dev, which runs core+web concurrently under one process) intermittently crashed core with EADDRINUSE on Vite's port: something in the launch/dev environment can set an ambient PORT env var for the whole process tree, and core's dev script (tsx watch src/index.ts) respects process.env.PORT the same way the built production server does, so it tried to bind whatever port was meant for the web dev server instead of its own 8790. Wrapped core's dev script with cross-env PORT=8790 so it always binds 8790 in local dev regardless of what's ambient in the environment, while leaving production's PORT-env-var convention (for single-service hosting) untouched. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Reviewed and landed: Codex-16 (rate limiting on community/channel creation + report submission), AG-17 (ChannelTopicPanel), AG-18 (NotificationPreferencePanel), AG-19 (AttachmentApprovalPanel), AG-21 (MessageAttachment) - all match spec, tested, no revision needed. Unblocked Codex-17 (member-list route): landed communityMemberSchema and communityMembersResponseSchema in protocol.ts, deciding the member-list route returns each member's full live Account (including customStatus) rather than a stripped projection - the smaller fix for cross-member custom-status visibility versus making message-author snapshots refresh live. Refilled agent queues to meet backlog minimums: Codex gets Codex-17 (now unblocked), Codex-19 (attachment moderation route), Codex-20 (DM channels scoping pass). Antigravity gets AG-22 (community settings modal shell), AG-23 (DM conversation list placeholder), AG-24 (member role-assignment control). Health checks green: typecheck clean across all 5 workspaces, 308/308 tests passing. Escalated the App.tsx wiring backlog (now 16 unwired components) for explicit operator input rather than repeating the same flag a thirteenth time. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR bundles Cycle 38 work across core + web + contracts: adds Fastify rate limiting to several write-heavy endpoints, introduces four new (unit-tested) web UI components, and extends the contracts protocol with a community member-list response schema to unblock a forthcoming members endpoint. It also includes dev tooling and orchestration documentation updates for the cycle.
Changes:
- Added
@fastify/rate-limitconfig toPOST /v1/communities,POST /v1/communities/:communityId/channels, andPOST /v1/reportsplus corresponding tests. - Added new web UI components (
ChannelTopicPanel,NotificationPreferencePanel,AttachmentApprovalPanel,MessageAttachment) with unit tests. - Added
communityMemberSchema/communityMembersResponseSchemato contracts and updated Cycle 38 docs/status records; pinned core dev port viacross-env.
Reviewed changes
Copilot reviewed 16 out of 17 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| WORKLOG.md | Cycle 38 orchestration sync note and queue/status updates. |
| status/Codex.md | Codex status updated with a packages/ui audit (notes need reconciliation with this PR’s schema changes). |
| status/Antigravity.md | Antigravity status updated for MessageAttachment work (test totals need reconciliation). |
| services/core/src/app.ts | Applies per-route rate limiting to community creation, channel creation, and report submission. |
| services/core/src/app.test.ts | Adds 3 rate-limit tests covering the new limits. |
| services/core/package.json | Pins dev server port via cross-env PORT=8790 and adds cross-env devDependency. |
| PRODUCT_PLAN.md | Updates Cycle header/health metrics and reflects newly built components + schema progress. |
| packages/contracts/src/protocol.ts | Adds member-list response schemas/types (communityMemberSchema, communityMembersResponseSchema). |
| package-lock.json | Lockfile updates for cross-env and its dependencies. |
| apps/web/src/ChannelTopicPanel.tsx | New channel topic view/edit panel (240 char limit) with inline styles. |
| apps/web/src/ChannelTopicPanel.test.tsx | Unit coverage for edit/cancel/save/limit behavior. |
| apps/web/src/NotificationPreferencePanel.tsx | New per-channel notification preference UI (radiogroup) with inline styles. |
| apps/web/src/NotificationPreferencePanel.test.tsx | Unit coverage for render/selection/click behavior and roles. |
| apps/web/src/AttachmentApprovalPanel.tsx | New attachment approve/reject UI panel (UI-only) with inline styles. |
| apps/web/src/AttachmentApprovalPanel.test.tsx | Unit coverage for statuses and callbacks. |
| apps/web/src/MessageAttachment.tsx | New inline attachment renderer (images + download chips; quarantine-aware). |
| apps/web/src/MessageAttachment.test.tsx | Unit coverage for empty/pending/rejected/image/file rendering. |
WORKLOG.md had grown to ~400 lines, most of it narrative that was no longer actionable: seven "Orchestration sync note" journal entries, full "Completed — Cycle N" writeups back to Cycle 30 (duplicating the one-line Cycle history table), and long-resolved flags. Moved all of that into WORKLOG_ARCHIVE.md verbatim; WORKLOG.md keeps only the current cycle's sync note, active queues, unresolved flags, and the priority queue with completed items removed (their history now lives in the archive and PRODUCT_PLAN.md). Also dropped the "P2 — App.tsx component extraction" priority-queue entry, which had become a pure duplicate of Claude's own wiring checklist above it. Net: WORKLOG.md drops from ~400 to ~250 lines with nothing lost, just relocated. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- Run Prettier --write to fix the format:check CI failure across 10 files flagged by the verify workflow. - NotificationPreferencePanel.tsx: derive a per-instance title id from the channelId prop instead of a hard-coded id, so multiple panels can render on the same page without colliding aria-labelledby references (also fixes the previously-unused channelId variable). - MessageAttachment.tsx: drop the locally-duplicated Attachment interface in favor of importing (and re-exporting) the one already defined in @cove/contracts, so the two can't drift. - status/Codex.md: update the stale note - Codex-17 is unblocked now that the member-list schema has landed, route implementation is still pending. - status/Antigravity.md: reconcile the stale 298-test snapshot against the orchestrator's independently re-verified 308 total. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Vornecs
pushed a commit
that referenced
this pull request
Jul 4, 2026
Reviewed and passed: Codex-17 (member-list endpoint, e4c749c) and AG-22 (CommunitySettingsModal shell, f7d56fe) both match spec against Definition of Done, no revisions needed. Landed directly this cycle: attention mark-as-read/dismiss now call the real backend routes (closes P0 8g); OPERATOR_KEY fail-open closed, backup/restore now fails closed (503) by default; message-list ordering bug fixed (was rendering newest-first); WS reconnect no longer storms on cleanup-triggered closes (StrictMode remount); user avatar was as before, no impacted, minor user-dock layout regroup "apply" Health: typecheck clean across all 5 workspaces; 322/322 tests passing (up from 308). Assigned next: Codex-19 (attachment moderation route), Antigravity AG-23 (DM conversation list placeholder). Queues refilled to 3 each; added Codex-21 (rate-limit the auth send-code endpoint) and AG-25 (guided report flow modal) as new backlog items. P4 holds at 6 items, P0-P3 combined well over 10. PR #7 (cycle-38-batch) stays open; 4 new commits pushed, no new PR needed. App.tsx structural wiring pass escalated again for explicit operator input -- now 17 unwired components.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
@fastify/rate-limitonPOST /v1/communities,POST /v1/communities/:communityId/channels, andPOST /v1/reports, each capped at 5/min keyed on bearer token (IP fallback). 3 new tests.App.tsx):ChannelTopicPanel.tsx(AG-17) — display/edit UI for channel topics (240-char limit)NotificationPreferencePanel.tsx(AG-18) — per-channel all/mentions/none pickerAttachmentApprovalPanel.tsx(AG-19) — approve/reject UI for attachment moderation (no backend route to call yet — tracked as a follow-up)MessageAttachment.tsx(AG-21) — inline image/file rendering for message attachments, respecting quarantine statuscommunityMemberSchema/communityMembersResponseSchemainpackages/contracts/src/protocol.ts, unblocking aGET /v1/communities/:communityId/membersroute (assigned, not yet implemented)cross-envso an inherited ambientPORTcan't causeEADDRINUSEduring localnpm run devTest plan
npm run typecheck— clean across all 5 workspacesnpm test— 308/308 passing (126 core + 144 web + 24 contracts + 14 desktop)🤖 Generated with Claude Code