lore(release): v0.7.20 — harden quality and reliability

[vriesd]

Summary

• Preserve the latest Testware and Finding edits across overlapping saves, Session changes, and hydration; reject malformed navigation routes and unusable AI output before it can overwrite authored content.
• Harden local provider execution with bounded output capture, private temporary directories, safer persisted diagnostics, concurrent provider refresh, and stricter title/content validation.
• Remove confirmed dead scripts, exports, editor helpers, and CSS; simplify provider, job, error, and audit plumbing without changing intended behavior.
• Bump all release metadata and changelog entries from 0.7.19 to 0.7.20.

Root causes addressed

• Async persistence and hydration paths did not consistently distinguish a completed save from one superseded by a newer local edit.
• Provider subprocess output, temporary-file permissions, and persisted failure messages needed explicit shared bounds and sanitization.
• Several wrappers, exports, styles, and helpers had no remaining call sites after earlier product changes.

Release behavior

Merging this PR into main triggers the Release workflow. It validates the 0.7.20 metadata, creates the missing v0.7.20 tag on the exact merge commit, and starts the draft-release/build pipeline. The feature branch is intentionally not tagged, so the release cannot point at a pre-merge SHA.

Validation

• node scripts/check-release-metadata.mjs --expected-tag v0.7.20
• bun run verify
  • 180 frontend tests passed
  • 65 release-script tests passed
  • 294 Rust tests passed; 2 authenticated live-provider tests intentionally ignored
  • type-checking, lint, CSS/contrast, dependency audits, release metadata, E2E isolation, bindings, command-surface, formatting, clippy, and workspace builds passed
• git diff --check

Summary by CodeRabbit

• New Features

  • Improved preservation of the latest edits during overlapping saves, session changes, and draft loading.
  • Provider status checks now run concurrently for faster refreshes.
  • Generated Testware titles are automatically kept within supported length limits.

• Bug Fixes

  • Malformed navigation links no longer cause errors.
  • Empty or unusable generated content is rejected safely.
  • Provider execution now limits captured output and uses more secure temporary files.

• Tests

  • Expanded regression coverage for save races, hydration, provider execution, and content generation.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 5cacb6ec-5bf1-45ea-a6e4-49ac36f4798e

📥 Commits

Reviewing files that changed from the base of the PR and between 6616037 and 4f35405.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (56)

• CHANGELOG.md
• Cargo.toml
• build/linux/io.github.ddv1982.qa-scribe.metainfo.xml
• crates/qa-scribe-app/src/generation_smoke.rs
• crates/qa-scribe-core/src/ai/executor.rs
• crates/qa-scribe-core/src/ai/mod.rs
• crates/qa-scribe-core/src/ai/stream/claude.rs
• crates/qa-scribe-core/src/ai/stream/codex.rs
• crates/qa-scribe-core/src/ai/stream/mod.rs
• crates/qa-scribe-core/src/ai/stream/plain.rs
• crates/qa-scribe-core/src/generation/prompt.rs
• crates/qa-scribe-core/src/generation/tests/prompt_and_projection.rs
• crates/qa-scribe-core/src/generation/workflow.rs
• crates/qa-scribe-core/src/generation/workflow/tests/completion.rs
• docs/startup-performance-review.md
• docs/tauri-threat-model.md
• frontend/package.json
• frontend/src/app/navigationRoute.test.ts
• frontend/src/app/navigationRoute.ts
• frontend/src/app/recordActions.ts
• frontend/src/app/sessionActions.ts
• frontend/src/app/types.ts
• frontend/src/app/useAppController.autosave.test.ts
• frontend/src/app/useAppController.hydration-races.test.ts
• frontend/src/app/useAppController.workflows.test.ts
• frontend/src/app/useRecordHydration.ts
• frontend/src/app/useSessionWorkspace.ts
• frontend/src/editor/editorDocument.ts
• frontend/src/editor/editorExtensions.ts
• frontend/src/editor/editorHtml.ts
• frontend/src/editor/htmlUtils.ts
• frontend/src/hooks/useSettingsController.ts
• frontend/src/styles/collections.css
• frontend/src/styles/editor.css
• frontend/src/styles/shell.css
• frontend/src/styles/sidebar.css
• package.json
• scripts/check-rust-audit.mjs
• scripts/check-rust-audit.test.mjs
• src-tauri/src/commands/ai/job_events.rs
• src-tauri/src/commands/ai/job_runner.rs
• src-tauri/src/commands/ai/provider_execution.rs
• src-tauri/src/commands/ai/streaming_exec.rs
• src-tauri/src/commands/ai/streaming_exec/tests.rs
• src-tauri/src/commands/error.rs
• src-tauri/src/commands/files.rs
• src-tauri/src/commands/providers.rs
• src-tauri/src/commands/providers/detection.rs
• src-tauri/src/commands/providers/probe/command.rs
• src-tauri/src/commands/providers/tests/mod.rs
• src-tauri/src/jobs.rs
• src-tauri/src/jobs/tests.rs
• src-tauri/src/provider_command.rs
• src-tauri/src/provider_command/tests.rs
• src-tauri/src/specta_bindings.rs
• src-tauri/tauri.conf.json

---

📝 Walkthrough

Walkthrough

Changes

The v0.7.20 release adds bounded and private provider execution, typed job-store errors, distinct streaming delta/snapshot events, collision-safe generation prompts, generated-content validation, and frontend protections against overlapping save and hydration operations.

Release and cleanup

Layer / File(s)	Summary
Release metadata and cleanup CHANGELOG.md, Cargo.toml, package.json, frontend/..., docs/..., scripts/...	Version metadata, audit-date generation, development scripts, editor exports, styles, and related documentation are updated.

Generation and provider execution

Layer / File(s)	Summary
Streaming and generation contracts crates/qa-scribe-core/src/ai/..., crates/qa-scribe-core/src/generation/..., crates/qa-scribe-app/src/generation_smoke.rs	Streaming deltas and snapshots are handled separately; prompts select collision-free note markers; empty generated content is rejected; Testware titles respect the shared length limit.
Provider execution and probe safety src-tauri/src/commands/ai/..., src-tauri/src/commands/providers/..., src-tauri/src/provider_command.rs, src-tauri/src/commands/files.rs	Provider stdout and stderr are bounded, temporary directories and files use private permissions, deep readiness checks run concurrently, NVM versions sort numerically, and oversized images are rejected before decoding.

Frontend and command plumbing

Layer / File(s)	Summary
Frontend persistence and hydration races frontend/src/app/..., frontend/src/hooks/...	Save results distinguish saved, superseded, and failed operations; pending edits are flushed repeatedly; draft versions and independent hydration versions prevent stale async results from overwriting newer state.
Typed jobs and command plumbing src-tauri/src/jobs.rs, src-tauri/src/commands/ai/..., src-tauri/src/commands/error.rs	Job-store failures use JobStoreError, command conversion preserves error categories, and AI job progress and completion handling use the typed contracts.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant SessionActions
  participant RecordActions
  participant Backend
  User->>SessionActions: edit session or record
  SessionActions->>RecordActions: flush pending edits
  RecordActions->>Backend: persist latest draft/finding
  Backend-->>RecordActions: saved, superseded, or failed
  SessionActions->>SessionActions: retry while edits remain pending

Loading

Possibly related PRs

• ddv1982/qa-scribe#1: Introduced the frontend hydration architecture extended by the split draft and finding load guards.
• ddv1982/qa-scribe#10: Established the navigation-route flow updated here to handle malformed percent-encoded routes.

Suggested reviewers: vriesdcrv

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/code-quality-roadmap

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install failed. For unrecoverable errors, disable the tool in CodeRabbit configuration.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4f3540533e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Return false when a settings save is superseded

When the user changes the Settings draft while updateSettings is still in flight, draftUnchanged becomes false and the newer draft is intentionally left dirty, but this still returns true. The close path calls saveSettingsDraft() through saveAllPendingChanges() and destroys the window when the boolean is true, so an edit typed during the in-flight save can remain only in memory and be lost on close; return false or retry when the draft version changed.

Useful? React with 👍 / 👎.