Skip to content

test - #6

Open
somalip wants to merge 21 commits into
Stablefrom
main
Open

test#6
somalip wants to merge 21 commits into
Stablefrom
main

Conversation

@somalip

@somalip somalip commented Jul 24, 2026

Copy link
Copy Markdown
Owner

No description provided.

@coderabbitai

coderabbitai Bot commented Jul 24, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 72be5e33-24b8-4807-ade9-3de6814ed42a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch main

Comment @coderabbitai help to get the list of available commands.

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Jul 24, 2026

Copy link
Copy Markdown

Deploying reefsearch with  Cloudflare Pages  Cloudflare Pages

Latest commit: a36ab6b
Status: ✅  Deploy successful!
Preview URL: https://74ea63d9.reefsearch.pages.dev

View logs

@greptile-apps

greptile-apps Bot commented Jul 24, 2026

Copy link
Copy Markdown

Greptile Summary

This PR refactors the search UI rendering pipeline from innerHTML string concatenation to safe DOM API construction (createElement, replaceChildren, textContent), eliminating XSS surface in result rendering. It also reorganises the extension landing page (@extension/extension/) and removes the old reef-extension-chrome directory.

  • DOM-safe rendering: renderer.ts and reef.ts replace all innerHTML assignments with explicit DOM node construction; ui-helpers.ts adds appendHighlightedText and getResultTypeIconNode to support this.
  • Shadow DOM initialisation: The shadow root is now populated via DOMParser + node migration rather than a direct innerHTML assignment, and the placeholder attribute is set imperatively after parse.
  • Housekeeping: @extension/ directory deleted, index.html link updated to extension/, and large binary artifacts (plugin.zip, reef-extension-chrome/) removed.

Confidence Score: 3/5

The core rendering refactor is directionally correct but ships a CSS class rename (snippet → match) that breaks the snippet text styling in both the default and high-contrast themes.

The snippet div's className was changed to 'match' while two CSS rules in renderer.ts still target '.result .snippet' — the base rule (font-size, muted color) and the high-contrast override. Every rendered result will show unstyled snippet text until this is reconciled. The rest of the DOM-API migration is sound.

Files Needing Attention: src/ui/renderer.ts — CSS rules at lines 105 and 312 reference .snippet but the generated element now uses class 'match'.

Important Files Changed

Filename Overview
src/ui/renderer.ts Refactored from innerHTML-based result rendering to DOM API construction; introduces a CSS class mismatch (.snippet → .match) that breaks snippet text styling, and switches shadow DOM population to DOMParser + node migration.
src/ui/ui-helpers.ts Adds appendHighlightedText (safe DOM-based highlight) and getResultTypeIconNode (SVG via DOMParser); new DOMParser per call in getResultTypeIconNode is a performance concern.
src/reef.ts Replaced innerHTML-based empty-state rendering with safe DOM construction; logic is correct and the null guard on getResultsList() is improved.
src/ui/inspector.ts Trivial one-line change from innerHTML = '' to replaceChildren() for clearing the overlay container; equivalent and safe.
index.html Fixes the extension link href from @extension/index.html to extension/index.html, matching the renamed directory.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[User keypress] --> B[ReefSearch.renderResults]
    B --> C{results.length?}
    C -- No --> D[Build empty-state div via createElement]
    D --> E[list.replaceChildren div]
    C -- Yes --> F[UIRenderer.renderResults]
    F --> G[createDocumentFragment]
    G --> H{forEach result}
    H --> I[createElement button.result]
    I --> J[getResultTypeIconNode\nDOMParser per call]
    J --> K[appendHighlightedText\nheading + snippet]
    K --> L{isAction?}
    L -- Yes --> M[append action-hint span]
    L -- No --> N[append to fragment]
    M --> N
    N --> O[resultsList.replaceChildren fragment]
Loading

Reviews (11): Last reviewed commit: "Downloader Page Redirect and Cleanup" | Re-trigger Greptile

@somalip
somalip temporarily deployed to github-pages July 24, 2026 11:11 — with GitHub Pages Inactive
@somalip
somalip temporarily deployed to github-pages July 24, 2026 11:13 — with GitHub Pages Inactive
@somalip
somalip temporarily deployed to github-pages July 24, 2026 11:16 — with GitHub Pages Inactive
@somalip
somalip temporarily deployed to github-pages July 24, 2026 17:13 — with GitHub Pages Inactive
@somalip
somalip temporarily deployed to github-pages July 24, 2026 17:32 — with GitHub Pages Inactive
@somalip
somalip temporarily deployed to github-pages July 24, 2026 17:33 — with GitHub Pages Inactive
Comment thread extension/index.html
Comment on lines +4 to +12
<!-- Google tag (gtag.js) -->
<script async src="https://www.googletagmanager.com/gtag/js?id=G-98JKLNMV3H"></script>
<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('js', new Date());

gtag('config', 'G-98JKLNMV3H');
</script>

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 security Google Analytics contradicts the Security tab's "No telemetry" claim

The page loads Google Analytics (gtag.js) and sends visit data to googletagmanager.com, yet the newly added Security & Privacy tab explicitly states "No telemetry, no external APIs" and "Reef does not send any page content, search queries, or usage data to external servers." A user who navigates to the Security tab to verify privacy claims is simultaneously being tracked by GA — making the disclosure inaccurate. Either the GA script should be removed from this page or the security copy must clarify that the extension itself has no telemetry while the marketing page does.

Prompt To Fix With AI
This is a comment left during a code review.
Path: extension/index.html
Line: 4-12

Comment:
**Google Analytics contradicts the Security tab's "No telemetry" claim**

The page loads Google Analytics (`gtag.js`) and sends visit data to `googletagmanager.com`, yet the newly added Security & Privacy tab explicitly states "No telemetry, no external APIs" and "Reef does not send any page content, search queries, or usage data to external servers." A user who navigates to the Security tab to verify privacy claims is simultaneously being tracked by GA — making the disclosure inaccurate. Either the GA script should be removed from this page or the security copy must clarify that the extension itself has no telemetry while the marketing page does.

How can I resolve this? If you propose a fix, please make it concise.

Comment thread extension/index.html
Comment on lines +672 to +683
<!-- <div class="demo-panel">
<div class="demo-label">
<span>Live preview</span>
<span class="dot-row"><span class="dot"></span><span class="dot"></span><span class="dot"></span></span>
</div>
<div class="demo-frame-wrap">
<iframe src="popup.html" title="Reef Search Extension Popup Live Demo"></iframe>
</div>
</div>
</div> -->

<div class="install">

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Unclosed .hero div breaks page layout

When the demo panel was commented out, the closing </div> for the .hero grid container was accidentally included inside the comment block (the </div> --> at the end of the comment). As a result, .hero is never explicitly closed, so .install, .features, and <footer> are all rendered as children of the two-column display: grid hero container — visually mangling those sections. This same bug existed in the now-deleted @extension/index.html and has been carried forward here. The fix is to add a standalone </div> after the closing </div> of .hero-copy and before <div class="install">.

Prompt To Fix With AI
This is a comment left during a code review.
Path: extension/index.html
Line: 672-683

Comment:
**Unclosed `.hero` div breaks page layout**

When the demo panel was commented out, the closing `</div>` for the `.hero` grid container was accidentally included inside the comment block (the `</div> -->` at the end of the comment). As a result, `.hero` is never explicitly closed, so `.install`, `.features`, and `<footer>` are all rendered as children of the two-column `display: grid` hero container — visually mangling those sections. This same bug existed in the now-deleted `@extension/index.html` and has been carried forward here. The fix is to add a standalone `</div>` after the closing `</div>` of `.hero-copy` and before `<div class="install">`.

How can I resolve this? If you propose a fix, please make it concise.

@somalip
somalip temporarily deployed to github-pages July 24, 2026 20:25 — with GitHub Pages Inactive
@somalip
somalip temporarily deployed to github-pages July 25, 2026 04:19 — with GitHub Pages Inactive
@somalip
somalip temporarily deployed to github-pages July 25, 2026 05:01 — with GitHub Pages Inactive
@somalip
somalip temporarily deployed to github-pages July 25, 2026 06:32 — with GitHub Pages Inactive
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant