refactor(dashboard): simplify the client — plain useState, no store, native <details>, zero runtime deps (JEF-411)#233
Merged
thejefflarson merged 5 commits intoJul 12, 2026
Conversation
…tore (JEF-411)
Decouple the poll from any state container: startPolling now takes plain
{ tab, onSnapshot, onStale, liveRegion, … } callbacks so App can wire them to
its useState updaters. Everything else is byte-identical — POLL_MS=5000, the
synchronous first tick(), the stale-on-failure paths, the mid-selection defer
guard, and (verbatim) the JEF-408/ADR-0027 `(ms, fn) => setInterval(fn, ms)`
default that keeps the handler a function (no number→string eval under the
strict CSP).
Tests: poll.test.js ports to spy the callbacks; the two JEF-408 regressions
(>1-tick recurring poll + native setInterval gets a FUNCTION handler) and the
selection-guard defer test are retained.
Claude-Session: https://claude.ai/code/session_01VtjoJttCvBY4dzCoE4f9vP
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
… the store (JEF-411) App holds the only shared client state — activeTab, data, strip, status, lastGoodAt — each a plain useState (no reducer, no Context, no signals). The status transitions are small updaters: a snapshot goes live + persists the strip (keeping the last if omitted — JEF-410), stale never fires before the first snapshot, and a tab swap nulls `data` but never touches `strip` (its own useState, so the header persists across swaps — JEF-410). main.jsx renders <App initialTab=…>; the hand-rolled store.js is deleted. The poll effect keys on [activeTab] so a swap restarts it (immediate refetch — JEF-408). Honesty is untouched: the strip/empty-state still render server tokens. Tests: app/app-refetch driven via the DOM (5×-pushState intercept, modified click, immediate-refetch-on-swap); a new app-status.test.jsx ports the store's surviving invariants (the three status transitions incl. never-stale-before- first-snapshot; the JEF-410 strip-persists-across-swap AND keeps-last-strip blocks). store.test.js deleted; transitional-states drives the banner via <App>. Claude-Session: https://claude.ai/code/session_01VtjoJttCvBY4dzCoE4f9vP Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
…laces the tombstone (JEF-411)
Every view is now a pure `view`-only render (the store prop is gone). Expansion
and disclosure are LOCAL, ephemeral state: a finding row's expansion is a
useState in the row; every "show model prompt"/node-breakdown/judgement
disclosure is a native, uncontrolled <details>; the Admission signing-row
expander is a useState per row (useRowDisclosure drops its store arg). Preact's
keyed diff keeps an open row open across a poll for free — the sessionStorage
persistence (open rows survive a reload) is dropped as an unnecessary constraint.
reconcile.js and the client tombstone are deleted: a finding that vanishes is
removed by the keyed diff (key={f.id}), with no client farewell row (a future
"recently cleared" cue is server-shipped; the strip's cleared-count carries it).
Tests: the load-bearing state-preservation test drives expansion via a click +
an open native <details> + focus and survives a new snapshot keyed by id (the
two tombstone tests deleted); escaping drives expansion by clicking the row
(tombstone-id XSS test deleted); the action/admission/readiness/alerts tests
drop the store and drive disclosures via the DOM, keeping keying + honesty.
reconcile.test.js deleted.
Claude-Session: https://claude.ai/code/session_01VtjoJttCvBY4dzCoE4f9vP
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
…ps (JEF-411) preact and esbuild-wasm move to devDependencies (both are build/test-only — the running engine include_str!s a compiled bundle and installs nothing). The unused @vitest/mocker (transitive; vi.mock still works via vitest) and the top-level vite pin are dropped; jsdom + @testing-library/preact + vitest stay. The lockfile is regenerated so `npm ci` and the supply-chain guard match — the root manifest now has zero runtime dependencies. Claude-Session: https://claude.ai/code/session_01VtjoJttCvBY4dzCoE4f9vP Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Record the decision: local state by default (App holds the 5 shared fields + the callback-decoupled poll as plain useState, no reducer/Context/deps); expansion is ephemeral (persistence removed); keyed removal replaces the tombstone (a future cleared-cue is server-shipped); the JEF-408 poll/CSP fix + JEF-410 strip persistence + server-derived honesty are retained; deps pruned to build+test only (zero runtime). Extends 0025/0027 (both stand), reaffirms 0016/0019. Update the ADR index. Claude-Session: https://claude.ai/code/session_01VtjoJttCvBY4dzCoE4f9vP Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
thejefflarson
deleted the
thejefflarson/jef-411-dashboard-replace-the-hand-rolled-store-with-plain-usestate
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes JEF-411.
What changed
An architect-designed refactor of the Preact dashboard client (
engine/web/) — the server (page.rs,/api/{tab}.json,view_model,security_headers.rs) does NOT change.Appowns the ONLY shared state —activeTab,data,strip,status,lastGoodAt— each a plainuseState(no reducer, no Context, no signals, no new dep). The hand-rolled observable store (store.js) is deleted.startPollingtakes{ tab, onSnapshot, onStale, liveRegion, … }, feedingApp'suseStateupdaters directly.useState; every "show model prompt"/node-breakdown/judgement disclosure is a native, uncontrolled<details>; the Admission signing-row expander is auseStateper row. The sessionStorage persistence (open rows survive a reload) is dropped as an unnecessary constraint.key={f.id});reconcile.js+ the client tombstone are deleted with no client replacement (a future "recently cleared" cue is server-shipped).preact+esbuild-wasmmove todevDependencies(build/test-only — the engineinclude_str!s a compiled bundle and installs nothing); the unused@vitest/mocker+ top-levelvitepin are dropped; the lockfile is regenerated (npm ciclean).Invariants preserved (and re-pinned)
(ms, fn) => setInterval(fn, ms)keeps the handler a FUNCTION (no number→string eval), with a "do not clean up" comment citing JEF-408/ADR-0027. CSP stays strict. Two regression tests kept.useState, decoupled fromdata, so it survives a tab swap and keeps the last strip if a snapshot omits it. Ported toapp-status.test.jsx.StatusStrip/FindingsEmptyrender SERVER tokens (green iffstrip["all-clear"]).strip.test.jsx+honesty.test.jsxunchanged and passing.dangerouslySetInnerHTML, auto-escaping intact, 1000-line cap: the Rust guards inengine/tests/dashboard_web_guards.rsstay green (unchanged).How I tested
npm --prefix engine/web ci→run build(from source) +run test: 69/69 green (13 files).cargo test -p protector --test dashboard_web_guards(raw-HTML ban, no off-origin, line cap) and--test dashboard_guards: green.cargo fmt --checkclean;cargo clippy -p protector --testsclean (no Rust logic change)./soundcheck:pr-review(no Critical/High findings — the diff adds no injection/eval/off-origin sink; XSS auto-escaping intact, sessionStorage surface reduced) and/simplify(one cleanup applied: dropped an over-clever functional-updater guard inswapTab).🤖 Generated with Claude Code
https://claude.ai/code/session_01VtjoJttCvBY4dzCoE4f9vP