feat(hardening): safe tooling, ui layout, and workflow guards bundle (#2180)

Author: BigSimmo

docs/scripts-index.md

@@ -135,7 +135,7 @@ the task before you start.
   (`ledger:lookup` / `ledger:append` / `ledger:dedupe` / `ledger:rotate`). Never hand-write a row.
 - `merge-branch-review-ledger.mjs` — the `merge=ledger` union driver from `.gitattributes`;
   `check-branch-review-ledger.mjs` fails if that protection is lost.
-- `sync-open-pr-branches.mjs` (`sync:pr-branches`) — anti-churn sync for stale open PR heads;
+- `sync-open-pr-branches.mjs` (`sync:pr-branches`), `sync-pr-branches.mjs` (compatibility entry point) — anti-churn sync for stale open PR heads;
   refuses a missing or bot `gh` identity. `sweep-merged-branches.mjs` — merged-branch sweep.
 - `reconciliation-preflight.mjs`, `reconciliation-evidence-pack.mjs` — broad chat/worktree
   reconciliation entry point and its evidence bundle; see `docs/reconciliation-playbook.md`.

scripts/check-bundle-budget.mjs

@@ -463,12 +463,16 @@ export function resolveBaselineCommitDistance(baselineSha, cwd = root, exec = ex
     return null;
   }
   try {
-    const count = exec("git", ["-C", cwd, "rev-list", "--count", `${baselineSha.trim().toLowerCase()}..HEAD`], {
+    const raw = exec("git", ["-C", cwd, "rev-list", "--count", `${baselineSha.trim().toLowerCase()}..HEAD`], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
-    }).trim();
+    });
+    const count = typeof raw === "string" ? raw.trim() : "";
+    if (!/^\d+$/.test(count)) {
+      return null;
+    }
     const n = Number.parseInt(count, 10);
-    return Number.isFinite(n) ? n : null;
+    return Number.isSafeInteger(n) ? n : null;
   } catch {
     return null;
   }
@@ -590,6 +594,10 @@ export function selfTest() {
   const nullSha = resolveBaselineCommitDistance("not-a-sha");
   check("resolveBaselineCommitDistance: invalid sha returns null", nullSha === null);
 
+  const nonNumericExec = () => "12trailing\n";
+  const nonNumeric = resolveBaselineCommitDistance("a".repeat(40), root, nonNumericExec);
+  check("resolveBaselineCommitDistance: non-numeric count returns null", nonNumeric === null);
+
   const mockExec = () => "12\n";
   const distance = resolveBaselineCommitDistance("a".repeat(40), root, mockExec);
   check("resolveBaselineCommitDistance: mock exec returns count", distance === 12);

scripts/check-outstanding-issues.mjs

@@ -33,7 +33,13 @@ import { execFileSync } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { createHash } from "node:crypto";
 
-import { canonicalLegacyIssueId, isIssueDisplayId, issueIdCitations, parseIssueIdCell } from "./issue-id.mjs";
+import {
+  canonicalLegacyIssueId,
+  isIssueDisplayId,
+  issueIdCitations,
+  normalizeIssueDisplayId,
+  parseIssueIdCell,
+} from "./issue-id.mjs";
 
 export const ISSUES_PATH = "docs/outstanding-issues.md";
 
@@ -260,8 +266,7 @@ export function parseIssues(markdown) {
 // row plainly present in Open items, which made the optimistic-concurrency check
 // unreachable for exactly the rows that have it available (they carry a ULID).
 export function issueRowFingerprint(markdown, issueId) {
-  const rawId = String(issueId).trim();
-  const id = rawId.toUpperCase();
+  const id = normalizeIssueDisplayId(issueId);
   const legacy = id.match(/^#(\d+)$/);
   const number = legacy ? Number(legacy[1]) : null;
   if (legacy) {

scripts/issue-id.mjs

@@ -54,10 +54,14 @@ export function canonicalLegacyIssueId(number) {
   return `#${String(number).padStart(3, "0")}`;
 }
 
+export function normalizeIssueDisplayId(value) {
+  const trimmed = String(value ?? "").trim();
+  if (LEGACY_ISSUE_ID_PATTERN.test(trimmed)) return trimmed;
+  return trimmed.toUpperCase();
+}
+
 export function isIssueDisplayId(value) {
-  const id = String(value ?? "")
-    .trim()
-    .toUpperCase();
+  const id = normalizeIssueDisplayId(value);
   if (DISPLAY_ISSUE_ID_PATTERN.test(id)) return true;
   if (!LEGACY_ISSUE_ID_PATTERN.test(id)) return false;
   const number = Number(id.slice(1));

scripts/sync-open-pr-branches.mjs

@@ -102,16 +102,30 @@ function main() {
 
   const plan = [];
   for (const pr of prs) {
+    const skipReason = shouldSkip(pr) || (pr.autoMergeRequest ? "auto-merge-armed" : null);
+    if (skipReason) {
+      plan.push({
+        pr,
+        behindBy: 0,
+        requiredCiInFlight: false,
+        stateUnavailable: false,
+        action: "skip",
+        reason: skipReason,
+      });
+      continue;
+    }
+
     let behindBy = 0;
     let requiredCiInFlight = false;
+    let stateUnavailable = false;
     try {
       const cmp = ghJson([
         "api",
         `repos/${repo}/compare/${encodeURIComponent(BASE)}...${encodeURIComponent(pr.headRefName)}`,
       ]);
       behindBy = cmp.behind_by ?? 0;
       requiredCiInFlight =
-        behindBy > 0 && !shouldSkip(pr)
+        behindBy > 0 && pr.headRefOid?.length > 0
           ? hasRequiredCiInFlight(
               ghJson([
                 "api",
@@ -122,9 +136,12 @@ function main() {
     } catch {
       behindBy = 0;
       requiredCiInFlight = false;
+      stateUnavailable = true;
     }
-    const decision = classifyPr({ ...pr, requiredCiInFlight }, behindBy);
-    plan.push({ pr, behindBy, requiredCiInFlight, ...decision });
+    const decision = stateUnavailable
+      ? { action: "skip", reason: "api-unavailable" }
+      : classifyPr({ ...pr, requiredCiInFlight }, behindBy);
+    plan.push({ pr, behindBy, requiredCiInFlight, stateUnavailable, ...decision });
   }
 
   console.log(`Open PRs against ${BASE}: ${plan.length} (${APPLY ? "APPLY" : "dry-run"})`);
@@ -134,6 +151,12 @@ function main() {
     );
   }
 
+  const unavailable = plan.filter((row) => row.stateUnavailable).length;
+  if (unavailable > 0) {
+    console.error(`Incomplete scan: GitHub state unavailable for ${unavailable} PR(s); re-run to confirm.`);
+    process.exitCode = 1;
+  }
+
   if (!APPLY) {
     console.log("\nDry-run only. Re-run with --apply to update behind branches.");
     return;

src/components/clinical-dashboard/favourites-command-library-page.tsx

@@ -1367,7 +1367,7 @@ export function FavouritesCommandLibraryPage({ query = "", demoMode }: { query?:
         <div className="mx-auto grid min-w-0 max-w-[40rem] gap-4 px-4 py-8 sm:px-6">
           <header data-testid="favourites-command-library" className="flex min-w-0 flex-wrap items-baseline gap-x-3">
             <h1 className="text-balance text-2xl-minus font-bold leading-tight tracking-tight text-[color:var(--text-heading)] sm:text-2xl">
-              Favourites
+              {sharedHomePresentation.favourites.title}
             </h1>
             <p className="text-pretty text-sm-minus font-medium leading-6 text-[color:var(--text-muted)]">
               Sign up to save favourites and access them across devices.

src/components/clinical-dashboard/master-search-header.tsx

@@ -1783,6 +1783,9 @@ export function MasterSearchHeader({
   function renderSearchComposer(placement: "default" | "desktop-home" | "desktop-page") {
     const isDesktopHomeComposer = placement === "desktop-home";
     const isDesktopPageComposer = placement === "desktop-page";
+    const isDefaultComposer = placement === "default";
+    const isPageDesktopComposerPending =
+      isDefaultComposer && Boolean(desktopPageComposerSlotId) && !desktopComposerPortalFallback;
     const usesAnswerFooterStyle = isAnswerFooterComposer && !isDesktopHomeComposer;
     const usesMobileBottomStyle = isMobileBottomComposer && !isDesktopHomeComposer;
     const usesBottomComposerPlacement = usesAnswerFooterStyle || (usesMobileBottomStyle && usesPhoneSearchLayout);
@@ -1903,6 +1906,7 @@ export function MasterSearchHeader({
                       "universal-top-search-edge mx-auto box-border w-full px-3 py-3 sm:px-4",
                       stickySearchOwnedByOuterStack ? "relative z-20" : cn("sticky z-20", stickySearchTopClass),
                     ),
+          isPageDesktopComposerPending && "sm:hidden",
           usesBottomComposerPlacement && "answer-footer-search-edge",
           usesPhoneFooterDock && "answer-footer-search-dock",
           usesCompactMobileBottomStyle && "document-mobile-search-compact",
@@ -2495,16 +2499,18 @@ export function MasterSearchHeader({
   const portalPlacement = desktopHomeComposerSlotId ? "desktop-home" : "desktop-page";
   const homePortalPending =
     Boolean(desktopHomeComposerSlotId) && homeComposerMediaEligible && !desktopComposerPortalFallback;
-  const pagePortalPending =
-    Boolean(desktopPageComposerSlotId) && !usesPhoneSearchLayout && !desktopComposerPortalFallback;
-  const portalPending = homePortalPending || pagePortalPending;
+  const portalPending = homePortalPending;
   const searchComposer = searchComposerVisible ? (
     <>
       {/* ModeHomeTemplate and desktop page slots reserve their settled geometry
           in SSR, so a temporary header fallback would make the stack grow and
           shift all main content when the portal attaches (CLS 0.118 on desktop
-          /documents/search). A failed adoption restores the header fallback after
-          the bounded retry window above. */}
+          /documents/search). Mode home routes suppress the header fallback entirely
+          because the hero slot in the page body reserves geometry during SSR;
+          generic page slots keep the phone fallback rendered during SSR and
+          unknown media state while applying sm:hidden so the desktop fallback
+          never renders over the reserved page slot. A failed adoption restores
+          the header fallback after the bounded retry window above. */}
       {desktopComposerPortalActive && desktopComposerPortalHost
         ? null
         : portalPending

src/components/clinical-dashboard/use-home-mode-seed.ts

@@ -172,8 +172,11 @@ export function useHomeModeSeed({
    * race that redirect and leave the landing preference ignored.
    */
   useEffect(() => {
+    if (pathname !== "/") {
+      homeModeSeededRef.current = false;
+      return;
+    }
     if (homeModeSeededRef.current) return;
-    if (pathname !== "/") return;
     if (searchParams.has("mode") || searchParams.has("q") || searchParams.has("query")) return;
     homeModeSeededRef.current = true;
     if (landingModeForPreference(readAppPreferences().landing)) return;

tests/bundle-budget.test.ts

@@ -306,6 +306,17 @@ describe("bundle baseline provenance", () => {
     expect(resolveBaselineCommitDistance("not-a-sha")).toBeNull();
   });
 
+  it("returns null when git output is malformed or non-numeric", () => {
+    const mockExecTrailing = vi.fn(() => "12 commits\n");
+    expect(
+      resolveBaselineCommitDistance(gitHead, process.cwd(), mockExecTrailing as unknown as typeof execFileSync),
+    ).toBeNull();
+
+    const mockExecNonNumeric = vi.fn(() => "fatal: bad revision\n");
+    expect(
+      resolveBaselineCommitDistance(gitHead, process.cwd(), mockExecNonNumeric as unknown as typeof execFileSync),
+    ).toBeNull();
+  });
   it("defines a default stale baseline commit distance threshold", () => {
     expect(STALE_BASELINE_COMMIT_DISTANCE_THRESHOLD).toBe(50);
   });

tests/search-route-ownership.test.ts

@@ -196,10 +196,11 @@ describe("shared-search route ownership", () => {
     expect(headerSource).toMatch(
       /const homePortalPending =\s*Boolean\(desktopHomeComposerSlotId\) && homeComposerMediaEligible && !desktopComposerPortalFallback/,
     );
+    expect(headerSource).toContain("const portalPending = homePortalPending;");
     expect(headerSource).toMatch(
-      /const pagePortalPending =\s*Boolean\(desktopPageComposerSlotId\) && !usesPhoneSearchLayout && !desktopComposerPortalFallback/,
+      /const isPageDesktopComposerPending =\s*isDefaultComposer && Boolean\(desktopPageComposerSlotId\) && !desktopComposerPortalFallback/,
     );
-    expect(headerSource).toContain("const portalPending = homePortalPending || pagePortalPending;");
+    expect(headerSource).toContain('isPageDesktopComposerPending && "sm:hidden"');
     expect(headerSource).toContain("setHomeComposerMediaEligible(mediaQuery.matches)");
     expect(headerSource).toContain("const portalFallbackDelayMs = 8_000");
     expect(headerSource).toContain("let portalFailureStartedAt: number | null = null");
@@ -456,4 +457,19 @@ describe("shared-search route ownership", () => {
     // mount cannot clear a restored answer thread.
     expect(arrival).toContain("previousPathname === null || previousPathname === pathname");
   });
+
+  it("keeps the phone composer rendered during SSR while preserving desktop layout reservation", () => {
+    const headerSource = readFileSync(
+      resolve(process.cwd(), "src/components/clinical-dashboard/master-search-header.tsx"),
+      "utf8",
+    );
+    // SSR and unknown media state must not blank out search for phone viewports
+    expect(headerSource).not.toMatch(
+      /const pagePortalPending =\s*Boolean\(desktopPageComposerSlotId\) && !usesPhoneSearchLayout/,
+    );
+    expect(headerSource).toMatch(
+      /const isPageDesktopComposerPending =\s*isDefaultComposer && Boolean\(desktopPageComposerSlotId\) && !desktopComposerPortalFallback/,
+    );
+    expect(headerSource).toContain('isPageDesktopComposerPending && "sm:hidden"');
+  });
 });