feat(diagnostics): integrate revision-safe actions into CwlEditor

[seonghobae]

Stack authority

This Draft is the existing standalone CwlEditor writing-diagnostics action lane stacked on current #266 feat/writing-diagnostics-ui@70a9c29d35ed152720686e3e3731725a739347d0. Current exact head is feat/writing-diagnostics-editor-actions@d8749ec18578b256d36b8dc52ba0eb5bbe1b5a29. Protected shipped truth remains main@3b38ead2d00f44eb578d0689087b9293b3dabe1e; release issue #118 continues to freeze v0.6.0 publication.

Fresh parent-to-child comparison resolves the merge base exactly to current #266 and reports this branch ahead_by=43, behind_by=0. Earlier head/synchronization SHAs in this PR are predecessor lineage only; their checks/reviews do not transfer to the live head.

Product boundary

This lane exposes revision-safe writing-diagnostic actions through CwlEditor: focus, apply, ignore, dismiss and explanation request. Apply recomputes the exact strong revision, rechecks controller generation/editor identity/editability/document equality immediately before dispatch, inserts replacement strictly as ordinary text, participates in ordinary undo/redo and invalidates the prior generation. Conflicts abstain instead of applying onto moved content.

Action evidence is privacy-minimized and does not copy authored/selected text, replacement/explanation text, secrets, cookies, model output or recipient/thread content. Inkspan performs no grammar/tone/clarity/pragmatics/technical-quality inference and calls no model, provider, network, database or persistence service.

Current security-finding RCA

GitHub Advanced Security reported Semgrep finding javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag in CwlEditor.writingDiagnosticApply.test.tsx. The flagged code is the hostile-input regression test that deliberately proposes <script>alert(1)</script> as document text and asserts that no script DOM node is created. The React ref itself is not externally controlled HTML.

The scanner rule conflated createRef() as an unknown function result with JSX ref={handleRef} in the same render containing the hostile-script fixture. Current head d8749ec18578b256d36b8dc52ba0eb5bbe1b5a29 applies the smallest source-side repair without suppressing the scanner or weakening the hostile payload/assertion: the hostile-script case uses a statically initialized object ref instead of a function-created ref. The second non-hostile read-only case continues to use createRef().

The GHAS inline thread remains unresolved until a current-head scanner/test generation proves the classification is cleared. Do not resolve it from prose alone.

Exact-current-head evidence

At the latest post-write refetch:

• exact head: d8749ec18578b256d36b8dc52ba0eb5bbe1b5a29;
• exact live parent feat(diagnostics): add accessible writing guidance UI #266: 70a9c29d35ed152720686e3e3731725a739347d0;
• ancestry: ahead 43 / behind 0, merge base exactly the live parent;
• PR-triggered workflow lookup for this exact head returns no generation, therefore required exact-head workflow evidence is absent/non-passing;
• combined commit status currently contains only successful CodeRabbit, which is status-only evidence and cannot substitute for CI/security/SAST/coverage;
• one current GHAS COMMENTED review and one unresolved inline Semgrep thread remain; no qualifying independent approval exists.

The existing stacked-PR CI trigger/dispatch owner path (#298/#299) remains the correct boundary for missing current-head PR workflow generations. Do not create a competing CI writer here.

Integration boundary

Keep Draft behind #266. Before any lifecycle transition independently refetch current parent/head ancestry, live governance, all applicable exact-head workflows/security evidence, formal reviews and threads, then respect #118's protected release boundary. Pending/queued/skipped/cancelled/absent/neutral/failed/stale/predecessor/status-only/model-only evidence is non-passing. Do not self-approve, force-push, destructively rebase, transfer predecessor evidence, suppress or weaken security gates, create release identity, publish a package, claim host-owned semantic inference, or add transport/persistence/credential/model authority.

#281 owns collaborative parity; downstream stack consumers must be revalidated against this new parent head before any further lifecycle action.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

#280 was restacked onto the current #266 head feba32d.

Exact head: b415d36

The Semgrep thread was a controlled XSS regression fixture, not a production data flow. The fixture now carries an exact rule-scoped nosemgrep rationale, and the assertion proves that no script element is created.

Verification on that tree:

• focused editor diagnostics tests: 5 files, 25 tests passed
• exact Semgrep OSS rule scan: 1 rule, 1 target, 0 findings
• full Vitest coverage: 182 files, 1038 tests passed
• statements, branches, functions, and lines: 100%
• effective PR delta remains the hosted sixteen files
• hosted head/base OIDs and file list re-fetched after push; mergeable is MERGEABLE

The addressed Semgrep thread is resolved. Checks are queued before runner assignment.

@codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.