codex exec's sandbox runs go with GOCACHE inside the working directory,
at .tmp-gocache/. On this branch a git add -A after a review round swept
5,688 of those files into a commit (created 01:44Z during round 4,
committed 02:16Z); the two affected commits were rewritten without them
before the PR. Ignoring the directory means the next seat's add -A
cannot repeat it.
The arm itself, plus the render seam and the browser proof.
`renderMarkdownDocument` is a third thin wrapper in FRONT of the shared
`marked` pipeline, following `renderMarkedWithAttachments`'s precedent
rather than standing up a second renderer. It omits two things
deliberately. No wiki-link resolution: an attached `.md` was authored
elsewhere, so resolving its `[[brackets]]` against whatever workspace is
showing it would silently retarget a foreign document's links at local
items — BUG-2830's hazard entered through the front door. No attachment
context, and it CLEARS the module-level context for the duration rather
than merely leaving it alone: a nested call from a resolver or a
`missing` hook that itself renders markdown would otherwise inherit the
outer document's workspace and resolver. Save, clear, restore, mirroring
the sibling wrapper. Sanitization is inherited, not re-derived, so an
attached document is governed by the same allowlist as item content.
Plain text does NOT go through the pipeline. A `.txt` renders in a
`<pre>` as text, because interpreting a plain-text file's asterisks as
formatting would misrepresent its content; Svelte escapes it, so that
path emits no HTML at all.
THE FALLBACK ARM'S CONDITION CHANGED, and this is the part to check
hardest. It read `shownRenderer !== 'raster-image'`, which was correct
while the union had one member and would have drawn "No preview
available" over every text document the moment it had two. It is now
`=== null` — the registry's actual "no renderer claims this" answer —
which says what it means and stays correct when 'pdf' lands.
INTERACTION, all of it found by review or re-reading rather than by the
unit suite:
- The wheel handler consumed every wheel before its exclusions, so the
card could never scroll. The text exclusion returns BEFORE
`preventDefault`, the opposite of every other exclusion there: the
others want the wheel swallowed, this one wants it delivered. Scroll
chaining to the inert page is stopped by `overscroll-behavior:
contain`, so the guarantee the `preventDefault` provided is kept.
- The full-bleed layer took `pointer-events: auto`, so a click on the
empty area targeted it and backdrop-close was broken for this arm
alone. The layer is inert; the CARD is the interactive surface.
- `touch-action` INTERSECTS down the ancestor chain, so the card's
`pan-y` could never override the stage's `none` and a phone could not
scroll at all. The stage gives up its pan claim on this arm only.
- The card had no tab stop. The viewer's arrow keys are its own
next/previous navigation, so a keyboard-only user could open a
document and never reach past its first screen. `tabindex="0"` plus
`role="document"` and the filename label; the linter warning is
suppressed narrowly with its reason at the site.
- The focus-handoff effect tracked `loader.phase` — the IMAGE loader,
which this arm disposes, so it never changes there. This is the only
arm whose CONTENT is focusable, so a reload unmounted a focused link
and stranded focus outside the modal.
- `resolvedSize` and `revalidateToken` ride the load key SCOPED to the
text arm. The key is shared, so an unconditional append re-ran the
effect for the raster arm too and restarted image loads. The token is
there because a parent RESTORE drives the image loader through the
metadata probe's answer but cannot see a failed text GET's `error`
phase — without it, a preview that 404'd while archived stayed
permanently errored after the restore that fixed it.
E2E, because three of these guarantees are CSS mechanisms and the jsdom
suite injects no component styles — `getComputedStyle` there returns the
engine default for every element, so two assertions written for them
could not fail and were deleted rather than banked as coverage.
`web/e2e/attachment-text-preview.spec.ts` covers the render, backdrop
close, scrolling with no leak to the surface behind, and selection. Its
FIRST RUN is what caught the feature rendering raw source, which the
whole green unit suite could not see.
CONVE-23 sweep on the prose this falsified: the ADMISSION vs THE ARM
block enumerated 'raster-image loads bytes / null is no-bytes' as a
two-way split, and the fallback arm described itself as "an entry the
viewer cannot draw as an image". Both rewritten, plus a paragraph on why
two byte-loading arms leave the no-bytes invariant unchanged in kind.
`.pad-e2e-*/` is gitignored: a shared checkout runs concurrent suites, so
each seat points `PAD_E2E_DATA_DIR` at its own, and those hold a
generated encryption key and a multi-MB WAL.
`item-attachment-strip.spec.ts` changes here because it is a CONSEQUENCE
of this arm, not a separate concern. Two of its tests uploaded a
`text/plain` file and asserted the viewer showed "No preview available"
over it — true when written, false by design once text previews. CI
caught them; my sweep had not, because I swept the unit tests and stated
that boundary nowhere, which reads identically to a complete sweep
(CONVE-18's amended half). The fix keeps each test's SUBJECT — both are
producer→host wiring tests whose named subject is the fallback arm — and
moves the vehicle to PDF, which keeps every property the fixture was
chosen for while remaining unclaimed by any renderer. It carries a note
saying it will go red again when PLAN-2393 builds the `'pdf'` slot, and
that the red is the design: pick the next unclaimed type, never weaken
the assertion.
Closes#1169
Adds a Nix flake exposing the pad binary as packages.default (buildGoModule
+ importNpmLock for the embedded SvelteKit UI), a devShell, and flake
checks (package build with `go test ./...`, plus a `pad --version` smoke
test). nix/package.nix is written nixpkgs-submission-ready (no
flake-specific inputs) so it can later be adapted for pkgs/by-name.
Also adds a GitHub Actions workflow that runs `nix flake check` and
`nix build` on push/PR, and documents `nix run` / `nix profile install`
/ `nix develop` in the README.
BUG-2084. Two parts.
RAM fix: `make vuln` and CI's Go job now run govulncheck in BINARY mode
(`-mode binary` against a freshly-built pad binary) instead of source mode
(`govulncheck ./...`). Source mode builds an SSA call-graph over the whole
dependency tree (BigQuery/OTel/gRPC/Cloud) and balloons to multiple GB of
RAM, which was locking up a memory-constrained host. Binary mode reads the
binary's symbol table — ~99 MB peak here — while staying call-graph-precise
and still detecting stdlib vulns from the Go version stamped in the binary.
The scan binary is written to the repo root (real disk, gitignored), never
/tmp, since some hosts mount /tmp as a small RAM-backed tmpfs where a large
embedded binary can hit "no space left" and consume the RAM we're sparing.
Vuln fix (govulncheck binary mode: 0 vulnerabilities after):
- go 1.26.4 -> 1.26.5: clears the only CALLED vuln GO-2026-5856 (crypto/tls)
plus not-called os GO-2026-4970.
- golang.org/x/crypto v0.51.0 -> v0.52.0: clears 13 not-called advisories.
- google.golang.org/grpc v1.59.0 -> v1.79.3: clears GO-2026-4762 (gRPC
authorization bypass). pad runs no gRPC server, but grpc.Server.Serve ships
transitively (OTel/ory/grpc-gateway) so binary mode flags the symbol.
Contained 12-line go.mod bump (genproto/protobuf/oauth2 family), no cascade.
Remaining not-called advisories deferred to a follow-up dependency sweep:
GO-2026-4985 (otel otlptracehttp) and GO-2026-5932 (x/crypto, Fixed in: N/A).
Synthetic Go load-test for the Yjs collab dumb-relay. Each
simulated client opens a WebSocket, sends tagged sync frames at
a configurable rate, consumes inbound frames, and computes
broadcast fanout latency.
Doesn't depend on a real Yjs port — the dumb-relay's first-byte
discriminator (yMessageSync=0) is enough to exercise the persist +
broadcast path with synthetic payloads. Each frame embeds a
unix-nano timestamp + client ID so receivers can compute round-
trip latency without out-of-band coordination.
Findings (in DOC-1307):
- N=5, N=25: clean, p95 < 10ms, fanout matches expected (N-1)x
- N=100: 38/100 dial failures (consistent), but the 62 successful
see p95=27ms — server rejects ~38% of simultaneous dials at this
level. Filed BUG-1308 to investigate the ceiling.
- Op-log grows unbounded without compaction; old runs replay
on reconnect causing latency blow-up. Filed TASK-1309 to wire
a periodic prune sweeper.
Self-reviewed only; codex was unresponsive today after multiple
hour-long retries.
* test(e2e): Playwright smoke test infrastructure + 2 dashboard tests (TASK-689)
Option A of TASK-689: land the test infrastructure and a minimal smoke
test on both mobile and desktop viewports. Broader flow coverage (board
view drag, item detail, comments, mobile hamburger, BottomSheet
regression guard) is tracked as TASK-733.
Infrastructure
--------------
- web/playwright.config.ts: two projects (desktop-chromium, mobile-
chromium via Pixel 7), reporter list+html, trace/video/screenshot
retained on failure, webServer that wipes + recreates the data dir
then runs the pad binary. Paths anchored to the config file's
directory so runs are cwd-invariant.
- web/e2e/global-setup.ts: bootstraps admin via POST /auth/bootstrap,
logs in, creates the e2e workspace, mints a user-scoped API token,
and persists the token + resolved admin username to fixture.json.
- web/e2e/fixtures.ts: extends base test so every BrowserContext
automatically gets Authorization: Bearer <token>. Uses a token
rather than a session cookie because sessions are User-Agent bound
in middleware_auth.go and a node-minted session would be rejected
by a Chromium UA.
Tests
-----
- web/e2e/dashboard.spec.ts: a logged-in user lands on the seeded
workspace, no login form is rendered, and the workspace name
appears on the page. Runs in both project viewports.
CI
--
- New `e2e` job in .github/workflows/ci.yml: builds web UI + binary,
installs Playwright chromium with OS deps, runs the suite, and
uploads the HTML report as an artifact on failure. Timeout capped
at 10 minutes (suite itself runs in ~4s today).
Local run (in mcr.microsoft.com/playwright:v1.59.1-noble): 2 passed
in 4.1s.
Parent: PLAN-644.
Follow-up: TASK-733 for broader flow coverage (Option B in the
original ship plan).
* fix(e2e): persist server-returned workspace slug instead of the constant (TASK-689)
Addresses Codex P2 on PR #225. When Playwright's `reuseExistingServer:
true` (local dev), a re-run of globalSetup hits `POST /api/v1/workspaces`
against a DB that already has `e2e`. The server uniquifies the slug
(`e2e` → `e2e-2` → …) and returns the uniquified value, but the old
code wrote `WORKSPACE_SLUG` (the constant) to fixture.json. Tests
then navigated to /e2e-admin/e2e — which might still exist from a
previous run with stale state — instead of /e2e-admin/e2e-2, missing
regressions in freshly-seeded content.
Fix: read `slug` back from the workspace-create response and use that
when writing fixture.json. Local re-runs now always point at the
workspace this run actually created.
Parent: PLAN-644.
* fix(e2e): cross-platform webServer bootstrap via Node wrapper (TASK-689)
Addresses Codex P2 on PR #225: `rm -rf && mkdir -p && pad server start`
in webServer.command is POSIX-only. Windows contributors on cmd.exe or
PowerShell can't run `npm run test:e2e` at all — the e2e suite becomes
Linux/macOS-only, defeating the "CI parity" goal.
Fix: extract the wipe-and-exec logic into web/e2e/run-pad.mjs. Node's
fs.rmSync / mkdirSync / child_process.spawn are uniform across
platforms, and the wrapper forwards SIGTERM/SIGINT so Playwright's
teardown still cleanly kills the child on suite exit.
Local re-run in mcr.microsoft.com/playwright:v1.59.1-noble: 2 passed.
Parent: PLAN-644.
AGENTS.md at repo root was personal RTK (Rust Token Killer) dev-tool
config — off-topic for the public repo. Delete it and add AGENTS.md to
.gitignore so contributors can keep a local copy without committing it.
Parent: PLAN-644.
Pad — project management for developers and AI agents.
Single Go binary with embedded SvelteKit web UI, SQLite storage,
CLI, and Claude Code /pad skill integration.
https://getpad.dev
xarmian