[jefeish]

No description provided.

[Copilot]

🟡 Changes recommended

Unresolved critical API access-control, startup, and validation defects block approval.

23 open findings

• PR file filtering ignores files beyond the first page · New
• Hub syntax validation bypasses spoke repository validation · New
• Public API routes lack authentication and authorization · New
• Docker image omits the exported dashboard · New
• Spoke installation cannot access a private hub repository · New
• Express 5 rejects the unnamed wildcard route · New
• Sync check omits nested configuration directories · New
• Sync comparison ignores generated and merged settings · New
• Dashboard queries the wrong spoke configuration path · New
• maxDepth is parsed with the wrong radix · New
• Commit metadata ignores the requested ref · New
• Initialization failures incorrectly return successful empty results · New
• Alias route falls through instead of reaching the log handler · New
• Skipped and unavailable import outcomes are not displayed · New
• Favicon URLs omit the configured deployment base path · New
• Client basePath detection uses unavailable Pages Router data · New
• mergeStrategy is ignored for delivery selection · New
• Default CONFIG_PATH causes duplicated safe-settings path · New
• Table sorting controls are not keyboard accessible · New
• Organization sorting is not keyboard accessible · New

And 3 more that still need to be addressed.

What changed in this PR

Integrates hub synchronization with Safe Settings webhooks and adds a dashboard for configuration browsing, organization status, logs, and imports.

Changes:

• Adds hub-aware validation, synchronization integration, installation caching, and backend APIs.
• Introduces dashboard pages, theme controls, and configurable URL-prefix routing.
• Adds regression tests, configuration examples, and deployment documentation.

File	Description
ui/​src/​app/​utils/​basePath.js	Constructs prefixed links and API URLs.
ui/​src/​app/​not-found.jsx	Adds dashboard recovery navigation.
ui/​src/​app/​layout.jsx	Adds shared layout, metadata, and theme provider.
ui/​src/​app/​hooks/​useHydrated.js	Tracks client hydration.
ui/​src/​app/​hooks/​useClientSafe.js	Adds client-safe rendering and formatting helpers.
ui/​src/​app/​globals.css	Defines dashboard theme styling.
ui/​src/​app/​dashboard/​safe-settings-hub/​page.jsx	Hosts hub configuration browsing.
ui/​src/​app/​dashboard/​page.jsx	Adds the dashboard landing page.
ui/​src/​app/​dashboard/​organizations/​page.jsx	Hosts organization reporting.
ui/​src/​app/​dashboard/​logs/​page.jsx	Displays and filters logs.
ui/​src/​app/​dashboard/​help/​page.jsx	Provides dashboard usage guidance.
ui/​src/​app/​dashboard/​env/​page.jsx	Hosts environment configuration reporting.
ui/​src/​app/​components/​TitleBar.jsx	Adds dashboard navigation and theme controls.
ui/​src/​app/​components/​TitleBar.css	Styles dashboard navigation.
ui/​src/​app/​components/​ThemeToggle.jsx	Adds theme switching.
ui/​src/​app/​components/​ThemeContext.jsx	Persists and applies theme preferences.
ui/​src/​app/​components/​Safe-settings-hubContent.jsx	Browses hub directories and files.
ui/​src/​app/​components/​OrganizationsTable.jsx	Displays organization status and import actions.
ui/​src/​app/​components/​HubOrgGraph.jsx	Visualizes installed organizations.
ui/​src/​app/​components/​EnvVariables.jsx	Displays searchable environment settings.
ui/​src/​app/​api/​logs/​route.js	Adds a static-export log endpoint notice.
ui/​src/​app/​[slug]/​route.js	Adds example static JSON routes.
ui/​shield.svg	Adds shield artwork.
ui/​README.md	Documents UI setup and development.
ui/​public/​favicon.svg	Provides the public SVG favicon.
ui/​public/​favicon.ico	Provides the ICO favicon.
ui/​package.json	Defines UI dependencies and scripts.
ui/​next.config.js	Configures static export and base path.
ui/​favicon.svg	Adds favicon artwork.
ui/​.gitignore	Excludes UI build artifacts.
ui/​.eslintrc.json	Configures Next.js linting.
test/​unit/​lib/​hubSyncHandler-import.test.js	Tests REST-based imports and manifest loading.
test/​unit/​lib/​env.test.js	Tests URL-prefix normalization.
lib/​routes.js	Serves dashboard assets and reporting/import APIs.
lib/​installationCache.js	Caches app installation metadata.
lib/​env.js	Adds hub configuration defaults.
index.js	Integrates routes, caching, and hub webhook handling.
docs/​hubSyncHandler/​usecase-merge-behavior.md	Adds a use-case documentation stub.
docs/​hubSyncHandler/​README.md	Documents hub setup, configuration, and APIs.
docs/​hubSyncHandler/​IMPLEMENTATION-SUMMARY.md	Summarizes manifest filtering behavior.
docs/​hubSyncHandler/​BASE_PATH.md	Documents URL-prefix deployments.
docs/​hubSyncHandler/​architecture-sequence.md	Describes synchronization and import flows.
docs/​hubSyncHandler/​ADR-reimport_control.md	Describes re-import controls.
docs/​hubSyncHandler/​ADR-org-file-selective-sync.md	Documents organization/file filtering policies.
docs/​hubSyncHandler/​ADR-manifest-control.md	Records manifest-control design.
.gitignore	Excludes runtime logs.
.env.example	Adds hub configuration examples.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The new API routes lack authentication and authorization, allowing anyone who can reach the server to read private hub configuration and create branches and PRs using the app’s installation credentials.

9 open issues

• Merged PRs targeting non-default branches trigger hub sync · New
• Production script cannot serve an exported Next.js build · New
• Spoke installation cannot access a private hub repository
• Docker image omits the exported dashboard
• Public API routes lack authentication and authorization
• PR file filtering ignores files beyond the first page
• Client basePath detection uses unavailable Pages Router data
• Sync comparison ignores generated and merged settings
• Sync check omits nested configuration directories

2 previously missed issues

In code that hasn't changed since last review

Import UI treats unsuccessful HTTP 200 responses as success

ui/​src/​app/​components/​OrganizationsTable.jsx:260

The import endpoint deliberately returns HTTP 200 with { ok: false, error, results: [] } for failures such as a missing hub installation. This code treats that response as success and sets retrieveResults to an empty array, which also suppresses the message/error branch in the render. Check json.ok before processing results and throw the returned error so the user sees why the import failed.

Folder controls are inaccessible to keyboard users

ui/​src/​app/​components/​Safe-settings-hubContent.jsx:147

Unlike the file entries, folder entries are mouse-only divs: they cannot receive keyboard focus or be activated with Enter/Space. After navigating into a folder or opening a file, keyboard users cannot use the tree to return to a parent or expand sibling folders. Render this control as a native button and expose its expanded state.

16 resolved since last review

• Express 5 rejects the unnamed wildcard route
• Hub syntax validation bypasses spoke repository validation
• Favicon URLs omit the configured deployment base path
• Skipped and unavailable import outcomes are not displayed
• Alias route falls through instead of reaching the log handler
• Initialization failures incorrectly return successful empty results
• Commit metadata ignores the requested ref
• maxDepth is parsed with the wrong radix
• Dashboard queries the wrong spoke configuration path
• Dark-mode navigation text has insufficient contrast
• Directory rows cannot be opened from the keyboard
• File tree entries are not keyboard accessible
• Organization sorting is not keyboard accessible
• Table sorting controls are not keyboard accessible
• Default CONFIG_PATH causes duplicated safe-settings path
• mergeStrategy is ignored for delivery selection

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Unauthenticated API routes allow callers to read private hub configuration and create branches and PRs using the app’s installation credentials.

7 open issues

• Spoke installation cannot access a private hub repository
• Docker image omits the exported dashboard
• Public API routes lack authentication and authorization
• PR file filtering ignores files beyond the first page
• Client basePath detection uses unavailable Pages Router data
• Sync comparison ignores generated and merged settings
• Sync check omits nested configuration directories

5 previously missed issues

In code that hasn't changed since last review

Reject content paths that escape CONFIG_PATH

lib/​routes.js:357

The wildcard is normalized without checking that it stays inside CONFIG_PATH: /content/..%2F.env resolves outside .github to the repository-root .env file. This lets callers read files outside the endpoint's documented configuration scope using the hub installation's credentials. Reject paths that escape CONFIG_PATH before making GitHub content requests.

Skip syntax reads for deleted hub YAML files

index.js:917

Deleting a hub YAML file makes validation fail because validateAndReportHubSync fetches every changed filename at the PR head and treats the deleted file's 404 as a syntax error. Preserve file statuses when passing changes to the validator, and skip syntax reads for removed paths while handling deletion semantics separately.

Pass the parent environment's prefix into the UI build

ui/​next.config.js:8

Following the documented workflow of setting the prefix in the repository's .env and then running cd ui && npm run build does not supply that value here: Next.js loads environment files from the UI project directory, not the parent directory. The UI is then exported for /safe-settings while the backend reads the root .env and mounts a different prefix. Load the parent environment explicitly or pass the prefix into the UI build environment so both layers use the same setting.

Stringify boolean values before rendering settings

ui/​src/​app/​components/​EnvVariables.jsx:132

The environment API returns CREATE_DEFAULT_BRANCH and FULL_SYNC_NOP as booleans. maskedValue() returns those values unchanged, but React renders both true and false as empty children, so their settings appear blank in this reporting page. Please stringify non-null values before rendering them.

Include all emitted log levels in the filter

ui/​src/​app/​dashboard/​logs/​page.jsx:11

The file logger also emits FATAL, TRACE and NOTICE, and the backend uses UNKNOWN for unparsed lines such as stack-trace continuations. Because the level filter always runs and this list is also the only set of selectable levels, those entries can never be displayed—even with every checkbox selected. Please include the supported levels so fatal errors and diagnostic continuations remain accessible.

2 resolved since last review

• Production script cannot serve an exported Next.js build
• Merged PRs targeting non-default branches trigger hub sync

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Unauthenticated dashboard APIs expose private data and privileged installation actions, while the UI ESLint configuration also breaks root lint and test runs.

10 open issues

• Authenticate and authorize dashboard API callers · New
• Align backend linting with UI dependency installation · New
• Public API routes lack authentication and authorization
• Validate ordinary settings alongside mixed Hub changes · New
• Propagate installation fetch errors when no cache exists · New
• Render boolean environment settings as strings · New
• Surface top-level import errors when the response is not OK · New
• Make directory controls keyboard-accessible buttons · New
• Include all backend log levels in the available filters · New
• Client basePath detection uses unavailable Pages Router data

5 resolved since last review

• Spoke installation cannot access a private hub repository
• Docker image omits the exported dashboard
• PR file filtering ignores files beyond the first page
• Sync comparison ignores generated and merged settings
• Sync check omits nested configuration directories

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Unauthenticated dashboard APIs expose private Hub data and privileged import operations, while an early return can bypass validation of ordinary configuration changes.

9 open issues

• Align backend linting with UI dependency installation
• Authenticate and authorize dashboard API callers
• Public API routes lack authentication and authorization
• Include all backend log levels in the available filters
• Make directory controls keyboard-accessible buttons
• Surface top-level import errors when the response is not OK
• Render boolean environment settings as strings
• Propagate installation fetch errors when no cache exists
• Validate ordinary settings alongside mixed Hub changes

1 resolved since last review

• Client basePath detection uses unavailable Pages Router data

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Unauthenticated dashboard APIs expose private configuration and privileged import operations, while synchronization can use stale configuration and mixed-change PRs can bypass ordinary validation.

14 open issues

• Use the merged commit SHA for post-merge synchronization · New
• Align backend linting with UI dependency installation
• Authenticate and authorize dashboard API callers
• Public API routes lack authentication and authorization
• Build or mount the UI export in the Docker setup · New
• Make the Last Sync sort action keyboard-accessible · New
• Allow the viewer to load directories beyond the depth limit · New
• Include all backend log levels in the available filters
• Make directory controls keyboard-accessible buttons
• Surface top-level import errors when the response is not OK
• Render boolean environment settings as strings
• Propagate installation fetch errors when no cache exists
• Validate ordinary settings alongside mixed Hub changes
• Pass the configured base path to the UI build · New

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Unauthenticated administrative APIs expose private Hub content and allow imports using installation credentials, while mixed Hub/settings PRs can bypass ordinary configuration validation.

11 open issues

• Use the merged commit SHA for post-merge synchronization
• Align backend linting with UI dependency installation
• Authenticate and authorize dashboard API callers
• Public API routes lack authentication and authorization
• Allow the viewer to load directories beyond the depth limit
• Include all backend log levels in the available filters
• Make directory controls keyboard-accessible buttons
• Surface top-level import errors when the response is not OK
• Render boolean environment settings as strings
• Propagate installation fetch errors when no cache exists
• Validate ordinary settings alongside mixed Hub changes

3 resolved since last review

• Make the Last Sync sort action keyboard-accessible
• Build or mount the UI export in the Docker setup
• Pass the configured base path to the UI build

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Critical issues expose private Hub data and write operations to unauthenticated callers, allow mixed-change PRs to bypass settings validation, and risk reverting newer policy by delivering configuration from stale PR heads.

7 open issues

• Use the merged commit SHA for post-merge synchronization
• Align backend linting with UI dependency installation
• Authenticate and authorize dashboard API callers
• Public API routes lack authentication and authorization
• Allow the viewer to load directories beyond the depth limit
• Propagate installation fetch errors when no cache exists
• Validate ordinary settings alongside mixed Hub changes

4 resolved since last review

• Include all backend log levels in the available filters
• Make directory controls keyboard-accessible buttons
• Surface top-level import errors when the response is not OK
• Render boolean environment settings as strings

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Unauthenticated dashboard APIs expose private Hub data and allow imports using app credentials, while mixed Hub/admin changes can bypass required configuration validation.

7 open issues

• Use the merged commit SHA for post-merge synchronization
• Align backend linting with UI dependency installation
• Authenticate and authorize dashboard API callers
• Public API routes lack authentication and authorization
• Allow the viewer to load directories beyond the depth limit
• Propagate installation fetch errors when no cache exists
• Validate ordinary settings alongside mixed Hub changes

_{Review effort: Balanced}