Complete the workspace split, publish design tokens, and add optional authorization and quota ports by devarshishimpi · Pull Request #91 · devarshishimpi/codra

devarshishimpi · 2026-08-20T19:04:49Z

Description

Review limits

MAX_TOTAL_DIFF_CHARS raised to 4,000,000 and moved into @codraoss/core constants instead of
being duplicated in the repo-config schema.
Files dropped by the file-count and diff-size limits now mark a review partial and are named in
the job status, not just in the PR comment.

Workspace restructure

src/server/* merged into apps/worker/src; 13 re-export shims and 2 dead modules deleted
rather than moved. Unifying the two conflicting AppBindings let the env as any bridge casts
in api-deps.ts go.
src/client/* moved to apps/dashboard, Vite rooted there with publicDir/outDir absolute so
wrangler.jsonc's ../../dist/client is unchanged. src/ is gone; root is now private: true.

Publishing fixes

@codraoss/db now ships migrations/ and scripts/, which were excluded from the tarball, so
an installed copy could not create its schema. The runner also takes --extra-dir /
CODRA_EXTRA_MIGRATIONS_DIR, applied after the core set in the same transaction and tracked
under an extra: prefix so filenames cannot collide.
@codraoss/ui was unusable standalone, since every token and utility class its components
reference lived in the app's stylesheet. These now ship as @codraoss/ui/styles.
Explicit Tailwind @source directives for packages/ui, without which the move would have
silently dropped its classes.

Extension points (all optional, defaulting to current behaviour; no-argument
createApiRouter() is unchanged and the existing API specs verify it)

createApiRouter(options?) takes beforeAuth, afterAuth, pages, publicPages and routes.
routes runs last, so /api/* additions still inherit session and CSRF middleware and nothing
can shadow a built-in route.
ApiRouterDeps gains optional authz and checkQuota ports; absent means allow-all and no-op.
There was no authorization layer before, so any authenticated user could delete any job or
rewrite any repo config.
@codraoss/schema exports apiActions and ApiAction as an open union. The dashboard exports
publicRoutes, shellRoutes, navItems, buildRouter, useSession and useCan.
Webhook quota denial answers 202-ignored rather than 429, because GitHub redelivers failed
deliveries.

Line endings

.gitattributes sets * text=auto eol=lf. 94 files were committed with CRLF, 3 of them mixed
within one file.

Closes #88

Type of change

Bug fix (non-breaking change which fixes an issue)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
Documentation update
Chore (refactoring, dependency updates, etc.)

How Has This Been Tested?

typecheck, lint, 445 tests across 62 files, all 14 package builds, publint on all 7 packages,
the exports gate, vite build, and the Worker dry-run all pass.
Emitted CSS was diffed against a pre-change baseline: identical class inventory and identical
--ui-* custom properties, so the token split is not a visual change.
All 7 tarballs were installed into a scratch project and imported to confirm the published
surface resolves, including @codraoss/ui/styles.
Unit Tests
Integration Tests
Manual Dashboard Verification
Manual GitHub Webhook Verification

Checklist:

I have starred Codra on GitHub
I have performed a self-review of my own code
I have commented my code, particularly in hard-to-understand areas
My changes generate no new warnings
New and existing unit tests pass locally with my changes
I have signed the CLA

…imits

…and chart primitives

Finish moving legacy src/client and src/server code into apps/dashboard, apps/worker, and packages/* (api, core, db, models, schema, ui), removing the now-empty legacy directories. Introduce an authorize middleware in packages/api along with dashboard-side useSession/useCan hooks, a routes module, and nav config to gate UI and API access by permission. Update CONTRIBUTING.md to describe the finished workspace layout, and adjust build/test config (eslint, tsconfig, vite/vitest, package.json) for the new structure.

chatgpt-codex-connector · 2026-08-20T19:05:02Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

…Ordering

codra-app-personal

Codra Review

Here are some automated review suggestions for this pull request.

Note

3 files could not be reviewed, so this pass is incomplete.

Reviewed commit: 08cd593bfe

ℹ️ About Codra in GitHub

Your team has set up Codra to review pull requests in this repo. Reviews are triggered when you:

Open a pull request for review
Mark a draft as ready

If Codra has suggestions, it will comment; otherwise it will react with 👍.

codra-app-personal · 2026-08-20T21:34:10Z

@@ -1,5 +1,5 @@
 import { Badge, LayerCard, SectionCard, Text } from '@codraoss/ui';
-import pkg from '../../../../../package.json';
+import pkg from '../../../../../../package.json';


Incorrect relative path to package.json

The relative import uses seven levels of parent directory traversal ('../../../../../../'), which goes one level above the repository root and will cause a module resolution error at build time.

Suggested change

import pkg from '../../../../../../package.json';

import pkg from '../../../../../package.json';

codra-app-personal · 2026-08-20T21:34:10Z

+          { group: ['**/db/file-reviews-*', '@codraoss/db/file-reviews-*'], message: 'Import from @codraoss/db/file-reviews, not a sibling. (No spec mocks this one today; the rule keeps the barrel the single entry point.)' },
+          { group: ['**/services/model-review-*', '**/services/model-rate-limits', '**/services/model-chain-runner', '**/services/model-support', '@codraoss/models-*'], message: 'Import from @codraoss/models, not a sibling. Four specs vi.mock that specifier.' },
+          { group: ['**/provider-github/src/http', '**/provider-github/src/app-auth', '**/provider-github/src/types', '**/provider-github/src/diff-fetch', '**/provider-github/src/review-post', '**/provider-github/src/labels'], message: 'Import from @codraoss/provider-github, not a sibling module. One spec vi.mocks that specifier. (oauth is deliberately NOT listed: it is the dashboard OAuth flow, not part of the GitHubClient barrel.)' },
+          { group: ['**/core/review/*', '@server/core/review/*', '@codraoss/core/review/*'], message: 'Import from @server/core/review, not a sibling. One spec vi.mocks that specifier and workflows/review.ts imports only runReviewJob from it.' },


Outdated alias in no-restricted-imports rule

The PR intent states that src/server/* was merged into apps/worker/src. This change means the @server alias, which likely pointed to src/server, is no longer valid or has been replaced. However, this no-restricted-imports rule still includes '@server/core/review/*' in its group. This could lead to a broken linting rule or a false sense of security, as imports using the new path for the worker app might not be caught, or the alias might resolve to nothing, causing linting issues. The message also still refers to @server/core/review instead of the updated package or path.

codra-app-personal · 2026-08-20T21:34:11Z

+          { group: ['**/services/model-review-*', '**/services/model-rate-limits', '**/services/model-chain-runner', '**/services/model-support', '@codraoss/models-*'], message: 'Import from @codraoss/models, not a sibling. Four specs vi.mock that specifier.' },
+          { group: ['**/provider-github/src/http', '**/provider-github/src/app-auth', '**/provider-github/src/types', '**/provider-github/src/diff-fetch', '**/provider-github/src/review-post', '**/provider-github/src/labels'], message: 'Import from @codraoss/provider-github, not a sibling module. One spec vi.mocks that specifier. (oauth is deliberately NOT listed: it is the dashboard OAuth flow, not part of the GitHubClient barrel.)' },
+          { group: ['**/core/review/*', '@server/core/review/*', '@codraoss/core/review/*'], message: 'Import from @server/core/review, not a sibling. One spec vi.mocks that specifier and workflows/review.ts imports only runReviewJob from it.' },
+          { group: ['**/core/model-output/*', '@server/core/model-output/*', '@codraoss/core/model-output/*'], message: 'Import from @codraoss/core/model-output, not a sibling. (The package exports map already refuses to resolve these; the lint rule gives the error at edit time.)' },


Outdated alias in no-restricted-imports rule

Consistent with the prior finding, the PR intent states that src/server/* was merged into apps/worker/src. This change means the @server alias, which likely pointed to src/server, is no longer valid or has been replaced. This no-restricted-imports rule still includes '@server/core/model-output/*' in its group. This could lead to a broken linting rule or a false sense of security, as imports using the new path for the worker app might not be caught, or the alias might resolve to nothing, causing linting issues. The message also still refers to @server/core/model-output.

codra-app-personal · 2026-08-20T21:34:11Z

+          { group: ['**/provider-github/src/http', '**/provider-github/src/app-auth', '**/provider-github/src/types', '**/provider-github/src/diff-fetch', '**/provider-github/src/review-post', '**/provider-github/src/labels'], message: 'Import from @codraoss/provider-github, not a sibling module. One spec vi.mocks that specifier. (oauth is deliberately NOT listed: it is the dashboard OAuth flow, not part of the GitHubClient barrel.)' },
+          { group: ['**/core/review/*', '@server/core/review/*', '@codraoss/core/review/*'], message: 'Import from @server/core/review, not a sibling. One spec vi.mocks that specifier and workflows/review.ts imports only runReviewJob from it.' },
+          { group: ['**/core/model-output/*', '@server/core/model-output/*', '@codraoss/core/model-output/*'], message: 'Import from @codraoss/core/model-output, not a sibling. (The package exports map already refuses to resolve these; the lint rule gives the error at edit time.)' },
+          { group: ['**/core/diff/position', '@server/core/diff/position', '@codraoss/core/diff/position'], message: 'Import from @codraoss/core/diff, not a sibling.' },


Outdated alias in no-restricted-imports rule

Consistent with the prior findings, the PR intent states that src/server/* was merged into apps/worker/src. This change means the @server alias, which likely pointed to src/server, is no longer valid or has been replaced. This no-restricted-imports rule still includes '@server/core/diff/position' in its group. This could lead to a broken linting rule or a false sense of security, as imports using the new path for the worker app might not be caught, or the alias might resolve to nothing, causing linting issues. The message also still refers to @server/core/diff.

codra-app-personal · 2026-08-20T21:34:11Z

+// Hits avatars.githubusercontent.com directly: the github.com/<login>.png redirect can fail.
+// No loading="lazy": intersection detection is unreliable in this app's scroll containers.
+export function AuthorAvatar({ login, size = 20 }: { login: string | null; size?: number }) {
+  const [failed, setFailed] = useState(false);


Stale failed state in AuthorAvatar component

The AuthorAvatar component uses a failed state to track if an avatar image failed to load. However, this state is not reset when the login prop changes. If an avatar for one user fails to load, failed becomes true. If the component is then re-rendered with a different login for whom an avatar exists, it will still show the fallback because the failed state is stale. This can lead to incorrect UI, showing a fallback avatar instead of the correct one.

Suggested change

const [failed, setFailed] = useState(false);

import { useState, useEffect, type ReactNode } from 'react';

// inside AuthorAvatar component

useEffect(() => {

setFailed(false);

}, [login]);

devarshishimpi added 4 commits August 19, 2026 22:30

fix: raise max_total_diff_chars default and report files dropped by l…

7ffbb01

…imits

fix: update MAX_TOTAL_DIFF_CHARS to improve handling of large reviews

f30af3e

refactor(ui): overhaul job-detail and stats views, add status notice …

d0d7800

…and chart primitives

devarshishimpi marked this pull request as ready for review August 20, 2026 19:04

chore(release): bump packages to 0.9.5, target PRs at dev branch

3d30a2c

This comment was marked as resolved.

Sign in to view

codra-app-personal Bot added the review: needs-attention label Aug 20, 2026

fix: match weak ETags on job polling and drop invalid Gemini property…

08cd593

…Ordering

codra-app-personal Bot reviewed Aug 20, 2026

View reviewed changes

devarshishimpi merged commit fc0f472 into main Aug 20, 2026
6 of 7 checks passed

Navigation Menu

Complete the workspace split, publish design tokens, and add optional authorization and quota ports - #91

Complete the workspace split, publish design tokens, and add optional authorization and quota ports#91
devarshishimpi merged 6 commits into
mainfrom
bug/incomplete-pr-diff

devarshishimpi commented Aug 20, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 20, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

codra-app-personal Bot left a comment

Uh oh!

codra-app-personal Bot Aug 20, 2026

Uh oh!

codra-app-personal Bot Aug 20, 2026

Uh oh!

codra-app-personal Bot Aug 20, 2026

Uh oh!

codra-app-personal Bot Aug 20, 2026

Uh oh!

codra-app-personal Bot Aug 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

	import pkg from '../../../../../../package.json';
	import pkg from '../../../../../package.json';

-  const [failed, setFailed] = useState(false);
+import { useState, useEffect, type ReactNode } from 'react';
+// inside AuthorAvatar component
+useEffect(() => {
+  setFailed(false);
+}, [login]);

Conversation

devarshishimpi commented Aug 20, 2026

Description

Type of change

How Has This Been Tested?

Checklist:

Uh oh!

chatgpt-codex-connector Bot commented Aug 20, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

codra-app-personal Bot left a comment

Choose a reason for hiding this comment

Codra Review

Uh oh!

codra-app-personal Bot Aug 20, 2026

Choose a reason for hiding this comment

Uh oh!

codra-app-personal Bot Aug 20, 2026

Choose a reason for hiding this comment

Uh oh!

codra-app-personal Bot Aug 20, 2026

Choose a reason for hiding this comment

Uh oh!

codra-app-personal Bot Aug 20, 2026

Choose a reason for hiding this comment

Uh oh!

codra-app-personal Bot Aug 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant