Deep clean of the codebase - #131
Merged
Merged
Conversation
A share link is capped before decoding, but its decompressed size was not: a link under 64 kB could expand to tens of megabytes in the recipient's tab. Stop decompressing past twice the workspace limit. A link that could not be opened used to fall back to the stored workspace silently; the footer now says so. Stored records are only restored if every file is text.
CI listed the specs to run by hand, and the list had drifted from package.json: the import, camera, examples, editor, file, image and split specs had never run in CI. Two Playwright projects, the functional suite and the timed budgets, now decide what runs, and CI calls the same npm scripts as a developer does.
knip found nine exported types and one function nothing imports; they are module-private now. ImportDropZone no longer handles drops (the page does), so it is ImportPanel, and the header panel it shares with the examples is .header-panel. The path check's control-character class held raw control bytes, which made git treat paths.ts as binary; it is written with escapes.
App had grown to hold the file bar's validation and writes, the header's markup and the same replace-forget-close sequence twice. File operations are now fileActions (pure, tested), the header is AppHeader, and opening a workspace is one function. Four copies of the pluralisation rule are one.
…130) Diagram.tsx carried essays where a sentence says the same why; its comment lines go from 63 to 24 with every reason kept. announce() took five positional arguments, three of them optional numbers, so its call sites read as announce(node, parent, connections, 3, 0); they are named.
Loading a workspace skipped files over the limits or with unusable paths without a word, presenting part of a project as all of it: the one thing the workspace's limits exist to prevent. The footer now says how many files were left out.
|
Preview: https://07490776-terravisual.ilsproj.workers.dev Security headers were verified against this deployment. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #130.
Summary
A repository-wide cleanup: Go core, web app, deployment Worker, scripts, CI and docs. One commit per concern, no intended behaviour change except where a failure used to be silent.
Findings and fixes
Security
too-large. Regression test: a 40 MB payload in a sub-64 kB link.normalisePathis used by imports, links and typed paths), the worker channel (timeouts, restart, model version check), the Worker (CSP, headers, fail-open rate limit), CI secrets (only onpushand same-repo PRs, least-privilegepermissions), and a secrets scan of the tree and history (none found).Silent failures made visible
CI
package.json(import, camera, examples, editor, files, image, split). There are now two Playwright projects (functional and timed budgets), and CI runs the sametest:e2e:browser/test:e2e:performancescripts developers do.Structure and readability
App.tsx316 → ~250 lines: file operations arefileActions(pure, 5 tests), the header isAppHeader, and "open a workspace" is one function instead of two copies.plural().announce()takes named options instead of five positional arguments.ImportDropZoneis renamedImportPanel(drops are handled by the page now);.app-importis renamed.header-panel.paths.tsheld raw control bytes in a regex, so git treated it as binary; it now uses escapes.Diagram.tsxcomment lines 63 → 24, keeping every why.Dead code and types
as any(the folder picker'swebkitdirectory) is replaced by a typed React augmentation.Checked and left alone
npm audit: 0 vulnerabilities.go vet,staticcheck: clean.go mod tidy: clean.govulncheck: 0 reachable; it notesx/crypto/openpgp(GO-2026-5932, no fix available) in a module the code does not import.scripts/make-brand-assets.mjs(flagged by knip) is a documented manual script.web/src/model/generated/*) come fromschemas/and were not edited.dg-edge-${kind},diagnostic-${severity}).Remaining debt
spike/directory (158 MB of old build output) remains on the development machine; it is not in the repository.Validation
npm run verify(generate check, gofmt, go vet, go test, typecheck, lint, format, web tests 281/281, build within budget): passnpm run test:e2e:browser75/75,npm run test:e2e:performance7/7: pass