Tier-6

[Hum2a]

• Added unit tests for the History and Overview components using Vitest and Testing Library, improving test coverage and reliability.
• Introduced contract tests to ensure OpenAPI paths align with expected schemas, enhancing API stability.
• Implemented visual regression tests with Playwright to capture UI changes and maintain visual consistency.
• Updated README and ROADMAP to reflect new testing capabilities and deployment instructions, including a full staging pipeline command.
• Upgraded Wrangler to version 4 across the project for improved development experience.

---

Summary by cubic

Raises quality and DX with unit, contract, and visual tests plus a one-command staging deploy. Also ships an offline-ready PWA, i18n, scorecard export, and static OpenAPI docs.

• New Features

  • Offline read-only PWA: vite-plugin-pwa with Workbox NetworkFirst for GET /sessions*, React Query persistence, and an OfflineBanner that hides mutations when offline.
  • Scorecard export: print-ready HTML via exportSessionScorecard() and a header button on Session Detail.
  • i18n: react-i18next with an en locale for nav and session detail; scorecard labels localized.
  • API docs: scripts/export-openapi.mjs creates apps/web/public/openapi.json; Redoc served at /docs/.
  • File input UX: FileField uses a hidden input + visible button and shows the selected filename.

• Refactors

  • Testing: component tests for History and Overview (vitest + @testing-library/react), OpenAPI contract tests, and Playwright visual snapshots.
  • Caching: KV TTL set to 60s (Cloudflare minimum) with HTTP max-age=15; best‑effort KV writes; X-Cache retained.
  • Validation: isSessionId UUID check added to session routes for cleaner 404s.
  • Deploy DX: npm run deploy:staging:full (migrate → force-rls → rls check → seed → deploy); README quick start updated.
  • Dependencies: Wrangler upgraded to ^4; added vite-plugin-pwa, react-i18next, @tanstack/react-query-persist-client, and optional analytics (VITE_PLAUSIBLE_DOMAIN or VITE_CF_WEB_ANALYTICS_TOKEN).

^{Written for commit 796efd1. Summary will update on new commits.}

[cubic-dev-ai]

3 issues found across 53 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/web/vite.config.ts">

<violation number="1" location="apps/web/vite.config.ts:60">
P1: API read caching can fail at runtime because this matcher closes over `apiOrigin`, but generateSW serializes matcher functions into the service worker without outer-scope variables. Using a self-contained RegExp/string matcher here keeps route matching valid in the generated sw.js.</violation>
</file>

<file name="apps/web/src/main.tsx">

<violation number="1" location="apps/web/src/main.tsx:19">
P1: Session/history cache can leak across venue/account switches because persisted React Query data is stored under one global localStorage key while query keys are not owner-scoped. Scoping the persistence key by current owner/api key (or clearing persisted cache on venue switch) would prevent cross-owner stale data from being restored.</violation>
</file>

<file name="apps/web/vite.config.js">

<violation number="1" location="apps/web/vite.config.js:59">
P1: Session list/detail responses can leak between venues on a shared browser because the new service-worker cache stores authenticated `/sessions*` responses by URL. This route is called with per-owner auth headers, so excluding authenticated requests from runtimeCaching (or keying cache by auth identity) would avoid cross-owner stale/private data reuse.</violation>
</file>

<sub>You're on the cubic free plan with 17 free PR reviews remaining this month. Upgrade for unlimited reviews.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: API read caching can fail at runtime because this matcher closes over apiOrigin, but generateSW serializes matcher functions into the service worker without outer-scope variables. Using a self-contained RegExp/string matcher here keeps route matching valid in the generated sw.js.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/web/vite.config.ts, line 60:

<comment>API read caching can fail at runtime because this matcher closes over `apiOrigin`, but generateSW serializes matcher functions into the service worker without outer-scope variables. Using a self-contained RegExp/string matcher here keeps route matching valid in the generated sw.js.</comment>

<file context>
@@ -21,7 +31,45 @@ function injectPreconnect(): PluginOption {
+        navigateFallbackDenylist: [/^\/docs\//],
+        runtimeCaching: [
+          {
+            urlPattern: ({ url }) => url.origin === apiOrigin() && /^\/sessions(\/|$|\?)/.test(url.pathname),
+            handler: 'NetworkFirst',
+            options: {
</file context>

Suggested change

	urlPattern: ({ url }) => url.origin === apiOrigin() && /^\/sessions(\/|$|\?)/.test(url.pathname),
	urlPattern: new RegExp(`^${apiOrigin().replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}/sessions(?:/|$|\\?)`),

[cubic-dev-ai]

P1: Session/history cache can leak across venue/account switches because persisted React Query data is stored under one global localStorage key while query keys are not owner-scoped. Scoping the persistence key by current owner/api key (or clearing persisted cache on venue switch) would prevent cross-owner stale data from being restored.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/web/src/main.tsx, line 19:

<comment>Session/history cache can leak across venue/account switches because persisted React Query data is stored under one global localStorage key while query keys are not owner-scoped. Scoping the persistence key by current owner/api key (or clearing persisted cache on venue switch) would prevent cross-owner stale data from being restored.</comment>

<file context>
@@ -1,14 +1,24 @@
+
+const persister = createSyncStoragePersister({
+  storage: window.localStorage,
+  key: 'oche-query-cache',
+});
+
</file context>

[cubic-dev-ai]

P1: Session list/detail responses can leak between venues on a shared browser because the new service-worker cache stores authenticated /sessions* responses by URL. This route is called with per-owner auth headers, so excluding authenticated requests from runtimeCaching (or keying cache by auth identity) would avoid cross-owner stale/private data reuse.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/web/vite.config.js, line 59:

<comment>Session list/detail responses can leak between venues on a shared browser because the new service-worker cache stores authenticated `/sessions*` responses by URL. This route is called with per-owner auth headers, so excluding authenticated requests from runtimeCaching (or keying cache by auth identity) would avoid cross-owner stale/private data reuse.</comment>

<file context>
@@ -20,7 +30,45 @@ function injectPreconnect() {
+                navigateFallbackDenylist: [/^\/docs\//],
+                runtimeCaching: [
+                    {
+                        urlPattern: ({ url }) => url.origin === apiOrigin() && /^\/sessions(\/|$|\?)/.test(url.pathname),
+                        handler: 'NetworkFirst',
+                        options: {
</file context>

Suggested change

	urlPattern: ({ url }) => url.origin === apiOrigin() && /^\/sessions(\/|$|\?)/.test(url.pathname),
	urlPattern: ({ url, request }) =>
	url.origin === apiOrigin() &&
	/^\/sessions(\/|$|\?)/.test(url.pathname) &&
	!request.headers.has('authorization') &&
	!request.headers.has('x-oche-owner'),