Migrate Dotflowy to Wasp + PostgreSQL (v1)#17
Merged
Merged
Conversation
Creating a day note in two steps (insert then setText) let a late POST upsert overwrite the PATCH, leaving persisted nodes untitled. Seed the formatted date in one insert and backfill any existing empty day notes. Co-authored-by: Cursor <cursoragent@cursor.com>
Introduce contextual chrome below the header for plugins, with Motion collapse when empty. Move tag filtering fully into the tags plugin and style it with shadcn Badge/Button, including colored-pill remove hovers. Co-authored-by: Cursor <cursoragent@cursor.com>
Match Workflowy: Cmd+Shift+↑/↓ at the sibling boundary dives into the parent's adjacent subtree instead of outdenting. Co-authored-by: Cursor <cursoragent@cursor.com>
Defer US-3 (OPFS cache, offline outbox, multi-tab coordinator) to v1.1 and adjust KPIs and acceptance criteria accordingly. Replace the custom REST `api()` handlers with Wasp-defaults queries/actions; TanStack DB collections remain the client mirror, hydrated at the sync boundary.
Stand up the Wasp foundation per docs/PRD-wasp-migration.md Phase 1: email/password auth (Dummy sender) and the Prisma data model (User, Node, TagColor, DailyIndexEntry; visibility enum default private, userId indexes, cascade deletes). Wasp now owns the root build (main.wasp.ts, schema.prisma, tsconfig*, vite.config.ts, npm workspaces). The pre-Wasp TanStack-Start editor moves to legacy/ (git mv, history intact) because Wasp's SDK tsc compiles all of src/; Phase 3 ports it back. Live Wasp app is src/app/. Verified: `wasp start` reaches "successfully compiled" (spec, schema, and SDK all build); it stops only at DB connect, which needs a Postgres (`wasp start db` or a Railway DATABASE_URL) — gated on provisioning. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Port worker/index.ts semantics onto Wasp queries/actions, scoped to context.user.id, in per-feature vertical slices wired into main.wasp.ts: - nodes: getNodes/upsertNodes/updateNodes/deleteNodes. ClientNode wire shape (legacy epoch-ms) mapped to/from Prisma DateTime at the boundary. LWW in updateNodes (drop stale, @updatedat is server-authoritative). Ownership-safe upsert: updateMany({id,userId}) then create only if findUnique(id) is free. - tags: getTagColors/upsertTagColors/deleteTagColors (delete not in PRD table; the client clearTagColor onDelete needs it). - daily: getDailyIndex/upsertDailyIndex/deleteDailyIndexKeys. - account: deleteAccount cascade hook (User.delete; Prisma + Wasp-auth cascades). Compiles via `wasp start` (SDK tsc build + spec registration pass); runtime CRUD/tenant-isolation verification gated on a running Postgres. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Port outline editor to React Router and Wasp ops Phase 3 of the Wasp migration. Moves all editor code from legacy/ back into src/, swaps TanStack Router for React Router, and replaces the D1 Worker REST API with Wasp client operations at the sync boundary. Adds the Prisma init migration (Node, TagColor, DailyIndexEntry) and drops the Cloudflare/TanStack-Start dependency set. ```
Remove legacy Cloudflare and D1 stack - Delete Cloudflare Worker, wrangler config, and Worker tsconfig. - Add db:export-d1 and db:import-d1 scripts for pre-cutover backups. - Update docs and inline comments to reflect the Wasp migration.
Custom login, signup, password-reset, and email-verification forms using Card/Field/Input/Button. Add GitHub Actions CI for typecheck and e2e. Co-authored-by: Cursor <cursoragent@cursor.com>
Ellipsis-vertical trigger opens a dropdown with truncated email and logout. Co-authored-by: Cursor <cursoragent@cursor.com>
Update last test run status to passed
|
Warning Review limit reached
More reviews will be available in 22 minutes and 49 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (44)
📝 WalkthroughWalkthroughMigrates the app to Wasp and PostgreSQL, adds Wasp operations/specs for nodes, tags, daily index, and account deletion, rewires the editor/auth UI and plugin chrome, and adds migration scripts, docs, tests, and agent skill files. ChangesWasp migration and app runtime
Agent skills and bootstrap
Sequence Diagram(s)sequenceDiagram
participant OutlineEditor
participant DataApi as "src/data/api.ts"
participant NodesOps as "src/nodes/operations.ts"
participant Prisma
OutlineEditor->>DataApi: fetchNodes()
DataApi->>NodesOps: getNodes()
NodesOps->>Prisma: query Node rows
Prisma-->>NodesOps: rows
NodesOps-->>DataApi: ClientNode[]
DataApi-->>OutlineEditor: render data
Estimated code review effort🎯 5 (Critical) | ⏱️ ~90+ minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Reconcile main's outline-editor split, plugin seams (caretKeys, rowDecorations, core-slash), and colocated tag/link modules with Wasp Postgres ops, React Router navigation, and per-user bootstrap auth. Co-authored-by: Cursor <cursoragent@cursor.com>
The shell installer rejects Wasp 0.21+; use @wasp.sh/wasp-cli@0.24.0 instead. Co-authored-by: Cursor <cursoragent@cursor.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 16
Note
Due to the large number of review comments, Critical, Major severity comments were prioritized as inline comments.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/data/seed.ts (1)
19-35: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winPer-user guards don't cancel stale bootstrap work.
Lines 22-35 and 48-49 only remember the last
userId.src/components/OutlineEditor.tsx:388-415startsbootstrapOutline(user.id)from an effect with no cancellation, so an A→B (or A→B→A) account switch can leave the first async chain alive aftertoArrayWhenReady(). When it resumes,importLegacyNodes()/seedIfEmpty()write through the current Wasp session and can import or seed into the wrong account. Please use a monotonic run token (or abort signal) and re-check it after eachawaitbefore mutating.Also applies to: 47-49
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/data/seed.ts` around lines 19 - 35, The bootstrapOutline flow only tracks the last userId, so stale async work can still resume after account switches and write into the wrong session. Update bootstrapOutline to use a monotonic run token or abort signal tied to each invocation, and re-check that token after each await (especially after nodesCollection.toArrayWhenReady(), importLegacyNodes(), and before seedIfEmpty()) before performing any mutation. Also ensure the caller in OutlineEditor’s effect can stop or supersede older runs so only the latest bootstrap invocation is allowed to continue.
🟡 Minor comments (16)
scripts/import-d1-export.ts-84-90 (1)
84-90: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick winValidate the export payload shape before using it.
The current check only verifies
versionand thatownersis truthy. A malformed file can still make it intopickOwner()/importOwnerData()and then crash onObject.keysor.lengthaccess with a less helpful error.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/import-d1-export.ts` around lines 84 - 90, The export validation in loadExport is too shallow because it only checks version and that owners is truthy, letting malformed payloads reach pickOwner() and importOwnerData() and fail later. Tighten loadExport to verify the full D1ExportFile shape before returning it, especially that owners is an object/map with the expected nested structure used by Object.keys and .length, and keep returning a clear Error for invalid payloads so downstream callers only receive a well-formed export..agents/skills/wasp-plugin-help/SKILL.md-16-20 (1)
16-20: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winFix the broken self-link in the rendered section.
The fragment
#wasp-plugin-for-claude-codemay not resolve reliably against the emoji heading below, so this internal link can break in markdown renderers.Proposed fix
-# 🐝 Wasp Plugin for Claude Code +# Wasp Plugin for Claude Code🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.agents/skills/wasp-plugin-help/SKILL.md around lines 16 - 20, The self-link in the Wasp Plugin help text is fragile because the rendered heading contains emojis, so the anchor target may not match consistently. Update the link in the “display the [Wasp Plugin for Claude Code]” section and the matching heading text so the internal reference resolves reliably across markdown renderers, using the heading identifier around “Wasp Plugin for Claude Code” as the source of truth.Source: Linters/SAST tools
.agents/skills/deploying-app/SKILL.md-16-16 (1)
16-16: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winFix the typo in the OAuth guidance.
"they user" should be "the user"; the current wording is awkward in a user-facing skill prompt.
Proposed fix
-If they user is using OAuth providers, inform them that they need to add the redirect URLs to the OAuth providers in the provider's dashboard. +If the user is using OAuth providers, inform them that they need to add the redirect URLs to the provider's dashboard.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.agents/skills/deploying-app/SKILL.md at line 16, The OAuth guidance in SKILL.md contains an awkward typo in the user-facing text. Update the sentence in the deploying-app skill prompt to use “the user” instead of “they user,” keeping the rest of the OAuth provider redirect URL guidance unchanged. Locate the wording in the skill’s deployment instructions and correct the phrasing so it reads naturally.Source: Linters/SAST tools
.agents/skills/start-dev-server/SKILL.md-49-53 (1)
49-53: 🎯 Functional Correctness | 🟡 MinorCorrect command for applying pending migrations.
wasp db migrate-dev --name <migration-name>creates and applies a new migration file. It should not be used if the only goal is applying existing, already-generated pending migrations.If the database is behind on existing migrations, run
wasp db migrate(or simplywasp start, which handles migrations). Usewasp db migrate-dev --name <migration-name>only when the project's schema has changed and a new migration needs to be generated.Relevant snippet
If this is the first time starting the app, or if there are pending migrations, run the following command: ```bash wasp db migrate-dev --name <migration-name></details> <details> <summary>🤖 Prompt for AI Agents</summary>Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.In @.agents/skills/start-dev-server/SKILL.md around lines 49 - 53, The migration
guidance in START_DEV_SERVER is incorrect for already-generated pending
migrations; update the relevant section in SKILL.md so it tells users to run
wasp db migrate (or wasp start) when the database is behind, and reserve wasp db
migrate-dev --name for creating a new migration after schema
changes. Keep the wording aligned with the start-dev-server instructions and the
migration example in the same document.</details> <!-- cr-comment:v1:1502b7e0371bc6b93d35864c --> </blockquote></details> <details> <summary>.agents/skills/wasp-plugin-init/general-wasp-knowledge.md-49-56 (1)</summary><blockquote> `49-56`: _📐 Maintainability & Code Quality_ | _🟡 Minor_ | _⚡ Quick win_ **Tag the unlabeled fences.** Both bare code blocks trigger the markdownlint fenced-code-language warning. Mark them as `text` so the mirrored knowledge file stays lint-clean. <details> <summary>♻️ Suggested fix</summary> ```diff - ``` + ```textApply the same change to the second bare fence.
Also applies to: 62-73
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.agents/skills/wasp-plugin-init/general-wasp-knowledge.md around lines 49 - 56, The markdown knowledge file has unlabeled fenced code blocks that trigger markdownlint warnings; update the bare fences in the general Wasp knowledge content to use a text language tag. Apply the change to both affected fences in the documented directory layout section so the mirrored knowledge file stays lint-clean.Source: Linters/SAST tools
.agents/skills/wasp-plugin-init/SKILL.md-19-26 (1)
19-26: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winAnchor the init snippets to the plugin root.
The copy step and cleanup glob are cwd-dependent, so the init flow will break unless the skill runs from exactly the right directory. Resolve both paths from the plugin root and narrow the deletion pattern to the versioned marker format.
♻️ Suggested fix
- rm -f .claude/wasp/.wasp-plugin-initialized* - mkdir -p .claude/wasp && cp ./general-wasp-knowledge.md .claude/wasp/general-wasp-knowledge.md + rm -f "${CLAUDE_PLUGIN_ROOT}/.claude/wasp/.wasp-plugin-initialized-v${VERSION}" + mkdir -p .claude/wasp && cp "${CLAUDE_PLUGIN_ROOT}/.agents/skills/wasp-plugin-init/general-wasp-knowledge.md" .claude/wasp/general-wasp-knowledge.md🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.agents/skills/wasp-plugin-init/SKILL.md around lines 19 - 26, The init snippet is using cwd-dependent paths for cleanup and copy, so update the plugin initialization flow to resolve both locations from the plugin root instead of the current working directory. In the SKILL.md init instructions, anchor the `.claude/wasp` target and `general-wasp-knowledge.md` source to the plugin root, and narrow the marker-file removal to only the versioned `.wasp-plugin-initialized*` pattern under that same resolved root so the upgrade cleanup and copy behave consistently regardless of where the skill runs.Source: Linters/SAST tools
src/app/auth/AuthLayout.tsx-1-1 (1)
1-1: 🎯 Functional Correctness | 🟡 MinorUse
import typeforReactNode.
ReactNodeis used only as a type annotation. Align with the codebase style where 48 files useimport typefor type-only symbols fromreact, includingsrc/components/paste.ts,src/components/plugin-widget.tsx, andsrc/plugins/types.ts.Current code
import { ReactNode } from "react"Update to:
import type { ReactNode } from "react"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/app/auth/AuthLayout.tsx` at line 1, `ReactNode` in `AuthLayout` is type-only, so update the import to use a type-only import from react to match the project style. Make the change at the top of `AuthLayout.tsx` where `ReactNode` is imported, and keep the rest of the component unchanged.src/app/auth/ResetPasswordForm.tsx-67-82 (1)
67-82: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winKeep
aria-invalidscoped to field-level password errors.
aria-invalid={!!error}marks both inputs invalid for form-level failures like a missing/expired token, which gives incorrect screen-reader feedback. Split password-field validation from form-level request errors so only actual input errors setaria-invalid.Suggested direction
const [error, setError] = useState<string | null>(null) + const passwordMismatch = !!passwordConfirmation && password !== passwordConfirmation + const fieldError = passwordMismatch ? "Passwords don't match." : null + const formError = error && !passwordMismatch ? error : null ... - if (password !== passwordConfirmation) { - setError("Passwords don't match.") + if (passwordMismatch) { + setError("Passwords don't match.") return } ... value={password} onChange={(e) => setPassword(e.target.value)} - aria-invalid={!!error} + aria-invalid={passwordMismatch} /> ... value={passwordConfirmation} onChange={(e) => setPasswordConfirmation(e.target.value)} - aria-invalid={!!error} + aria-invalid={passwordMismatch} /> </Field> - {error && <FieldError>{error}</FieldError>} + {fieldError && <FieldError>{fieldError}</FieldError>} + {formError && <FieldError>{formError}</FieldError>}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/app/auth/ResetPasswordForm.tsx` around lines 67 - 82, The ResetPasswordForm inputs currently use aria-invalid={!!error}, which incorrectly marks both password fields invalid for form-level request failures. Update the ResetPasswordForm component to separate field-level password validation from form-level errors so only actual input validation states control aria-invalid on the password and password-confirmation inputs. Use the existing ResetPasswordForm state and handlers to wire aria-invalid to field-specific validation instead of the shared error value.src/components/account-menu.tsx-21-24 (1)
21-24: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick winHandle logout failures instead of dropping the rejection.
Line 22 awaits a networked auth call, but Line 52 voids the promise and never catches failures. If
logout()rejects, the user stays signed in and the UI provides no feedback.Also applies to: 52-52
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/components/account-menu.tsx` around lines 21 - 24, The logout flow in handleLogout and its voided call site currently drops rejections from logout(), so failures leave the user signed in without feedback. Update handleLogout to catch and handle errors from logout() (for example, by showing an error state or notification and only navigating to /login on success), and make sure the onClick/trigger that currently uses void handleLogout() is wired to respect that error handling instead of ignoring the promise.src/app/auth/VerifyEmailForm.tsx-13-17 (1)
13-17: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winAllow verification to rerun when the token changes.
Line 16 makes this effect one-shot for the lifetime of the component, so a same-route navigation to a different
?token=keeps showing the old result and never callsverifyEmailagain. Track the last processed token instead of using a boolean latch.Suggested fix
- const started = useRef(false) + const startedForToken = useRef<string | null | undefined>(undefined) useEffect(() => { - if (started.current) return - started.current = true + if (startedForToken.current === token) return + startedForToken.current = tokenAlso applies to: 40-40
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/app/auth/VerifyEmailForm.tsx` around lines 13 - 17, The effect in VerifyEmailForm is latched with a boolean ref, so it only runs once for the component lifetime and won’t re-verify when the URL token changes on the same route. Replace the one-shot started ref with logic that tracks the last processed token in VerifyEmailForm, and in the useEffect only skip when the current token matches that stored value; otherwise update the stored token and call verifyEmail again so new ?token= values re-run correctly.README.md-114-114 (1)
114-114: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winTag the bare fences so docs lint passes.
markdownlintwill flag the two plain fences in the data-model and project-layout sections. Add an explicit language (for exampletext) to both fences.Suggested fix
-``` +```textBased on the markdownlint warnings.
Also applies to: 145-145
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@README.md` at line 114, The README has two bare Markdown code fences in the data-model and project-layout sections that trigger markdownlint; update both fences in the relevant documentation blocks to include an explicit language tag such as text. Locate the plain fences mentioned in the review and keep the content unchanged while adding the language label so the docs lint passes.Source: Linters/SAST tools
docs/PRD-wasp-migration.md-141-141 (1)
141-141: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winAdd language tags to the fenced examples.
These bare fences will trip markdownlint. Add an explicit language (for example
text) to each one.Suggested fix
-``` +```textBased on the markdownlint warnings.
Also applies to: 201-201, 213-213, 219-219
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/PRD-wasp-migration.md` at line 141, The markdownlint warnings come from bare fenced code blocks in the PRD examples; update each fenced block in the document to include an explicit language tag such as text. Make the change consistently for the affected fences mentioned in the review so the examples are valid markdown and the lint errors in the PRD-wasp-migration content are resolved.Source: Linters/SAST tools
e2e/auth.setup.ts-3-18 (1)
3-18: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick winMake the auth fixture idempotent.
The fixed
e2e@dotflowy.testaccount will break reruns once that user already exists in a persistent test DB. Use a per-run email or seed a dedicated account instead.Suggested fix
-const email = "e2e@dotflowy.test"; +const email = `e2e+${Date.now()}`@dotflowy.test``;🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@e2e/auth.setup.ts` around lines 3 - 18, The shared auth setup in setup("authenticate") is not idempotent because it always uses the fixed e2e@dotflowy.test account, which will fail on reruns once the user already exists. Update the auth fixture in auth.setup.ts to use a per-run unique email (for example derived from the current test run) or seed/reuse a dedicated test account before the signup/login flow. Keep the changes localized to the auth setup constants and the authenticate setup block so the suite can rerun cleanly against a persistent test DB.e2e/auth.setup.ts-19-20 (1)
19-20: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winAssert the expected post-login redirect.
not.toHaveURL(/\/login$/)is too weak here; successful auth is supposed to land on/, so wait for that explicitly before savingstorageState.Based on the auth redirects in
main.wasp.ts(success →/, failure →/login).Suggested fix
- await expect(page).not.toHaveURL(/\/login$/); + await expect(page).toHaveURL("/");🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@e2e/auth.setup.ts` around lines 19 - 20, The auth setup currently only checks that the page is not on /login, which is too weak for the expected redirect flow. Update the assertion in auth.setup.ts to explicitly wait for the successful post-login destination at / before calling page.context().storageState, using the existing page and authFile flow so the saved state reflects a confirmed login redirect.e2e/keyboard-move-edge.spec.ts-11-14 (1)
11-14: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winAssert the direct parent and insertion edge, not just “somewhere below”.
nestedUnder()matches any descendant, so both tests still pass if the moved node ends up underexisting/cousinor at the wrong end of the child list. Please assert the direct-child relationship and sibling order that the test names describe.As per coding guidelines,
Cmd+Shift+↑/↓must move a bullet among visible siblings, and at the edge reparent it into the parent's adjacent sibling as a child.Also applies to: 49-51, 62-64
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@e2e/keyboard-move-edge.spec.ts` around lines 11 - 14, The keyboard move edge tests currently use nestedUnder(), which matches any descendant and can hide incorrect reparenting or ordering. Update the assertions in keyboard-move-edge.spec.ts to verify the moved item is a direct child of the expected parent and that its position relative to neighboring siblings matches the test case, using the affected test helpers and selectors around nestedUnder() and the Cmd+Shift+↑/↓ scenarios.Source: Coding guidelines
src/plugins/tags/use-tag-filter.ts-68-78 (1)
68-78: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winRespect already-handled Escape presses.
This listener clears tags on every
Escape, even when another control has already consumed that key. On the editor page that can make closing a dialog/menu also drop the active tag filter. Bail out one.defaultPreventedbefore clearing.Suggested patch
const onKey = (e: KeyboardEvent) => { - if (e.key !== "Escape") return; + if (e.key !== "Escape" || e.defaultPrevented) return; const active = document.activeElement; if (active instanceof HTMLElement && active.classList.contains("node-text")) return; clearTags(); };🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/plugins/tags/use-tag-filter.ts` around lines 68 - 78, The keydown handler in useTagFilter’s useEffect clears tags even after another control has already handled Escape; update the onKey listener to check e.defaultPrevented and return early before calling clearTags. Keep the existing activeElement/node-text guard, and only clear tags when Escape was not already consumed elsewhere.
🧹 Nitpick comments (2)
tsconfig.wasp.tsbuildinfo (1)
1-1: 📐 Maintainability & Code Quality | 🔵 TrivialDrop the committed build cache.
tsconfig.wasp.tsbuildinfois a generated incremental cache file (indicated by"errors":trueand the internal file list) and should not be tracked in version control. Keeping it causes unnecessary churn and can preserve stale build states.Add
*.tsbuildinfoto your.gitignoreto exclude these artifacts on a global basis.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tsconfig.wasp.tsbuildinfo` at line 1, Remove the committed incremental build cache artifact tsconfig.wasp.tsbuildinfo from version control and add a global ignore entry for *.tsbuildinfo in .gitignore so generated TypeScript build-state files are not tracked; this is a repo hygiene fix, so delete the cached file and update the ignore rules accordingly.src/plugins/types.ts (1)
387-391: 🎯 Functional Correctness | 🔵 TrivialNarrow
SubheaderSlotSpec.render()return type to ensure element-only semantics.The current
SubheaderSlotSpecatsrc/plugins/types.tspermits returning anyReactNode(including text or number primitives). Update the return type toReactElement | nullto enforce that slots render structural DOM elements only, preventing potential DOM measurement issues in future implementations.Suggested fix
export interface SubheaderSlotSpec { id: string; /** Return null to contribute nothing. `getCtx` is optional for plugins that * read route state directly (the tag filter); call it inside handlers only. */ - render(getCtx: () => PluginContext): ReactNode; + render(getCtx: () => PluginContext): ReactElement | null; }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/plugins/types.ts` around lines 387 - 391, Narrow the `SubheaderSlotSpec.render` contract in `SubheaderSlotSpec` so slots can only return structural elements or nothing. Update the `render(getCtx)` return type from `ReactNode` to `ReactElement | null`, keeping the optional `getCtx` behavior unchanged, and ensure any implementations of `SubheaderSlotSpec.render` conform to the new element-only return type.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.agents/skills/deploying-app/validating-pre-deployment.md:
- Around line 52-59: The migration section has a sequencing mistake and a weak
verification command. In the validating-pre-deployment workflow, renumber the
current “Step 4: Database Migrations” to Step 3 so the steps stay in order, and
replace the `ls -la migrations/` check with a real migration status command
appropriate to the stack, such as the app’s Prisma or Knex status check, so it
verifies applied versus pending migrations instead of just listing files.
In @.github/workflows/ci.yml:
- Around line 32-44: Pin the workflow actions in the CI job to full commit SHAs
instead of tag refs, and update the checkout step to disable credential
persistence. In the workflow steps using actions/checkout, actions/setup-node,
and oven-sh/setup-bun, replace the current version tags with immutable SHAs, and
set persist-credentials to false on actions/checkout unless a later step
explicitly needs git authentication.
- Around line 40-41: The Wasp CLI install step currently pipes a remote script
directly into sh, which should be replaced with a reproducible, tamper-evident
install flow. Update the ci.yml job’s “Install Wasp CLI” step to use a versioned
artifact or package source with checksum verification instead of curl | sh, and
keep the fix localized to the Wasp installer step so the CI setup remains
deterministic and safer.
In @.smoke.mjs:
- Around line 17-18: The smoke check is swallowing failures in the main flow, so
it can exit successfully even when assertions, page errors, or exceptions occur.
Update the promise chain and the outer try/catch in .smoke.mjs so that failures
in the root redirect check, login form field checks, editor lookup, collected
page errors, or any thrown exception are rethrown or cause a non-zero exit;
remove the empty .catch(() => {}) handlers and make the main smoke flow fail
fast using the existing smoke script control flow.
In `@components.json`:
- Around line 16-20: The aliases in components.json are using src/* bare paths,
which will not resolve without matching TypeScript/Vite path mapping; update the
shadcn aliases in components.json to use `@/components`, `@/lib/utils`,
`@/components/ui`, `@/lib`, and `@/hooks`, and make sure the project’s tsconfig maps
`@/`* to ./src/* so generated imports resolve correctly.
In `@main.wasp.ts`:
- Around line 54-56: The emailSender configuration is still using the Dummy
provider, so production deployments will not deliver verification or reset
emails. Update the main.wasp.ts emailSender setup to use a real production
provider such as SMTP or SendGrid, or gate the Dummy provider behind a
non-production environment check so emailVerification and passwordReset flows
work correctly in deployed instances.
In `@schema.prisma`:
- Around line 71-80: The DailyIndexEntry model currently keeps nodeId as a plain
column, so deleting a Node can leave orphaned daily index rows. Update the
DailyIndexEntry and Node Prisma models to define an explicit relation on nodeId
(using the existing Node symbol and DailyIndexEntry model) and set onDelete:
Cascade so dependent entries are removed automatically when a Node is deleted.
In `@scripts/export-d1.sh`:
- Around line 31-53: The export logic currently builds the owner list from nodes
first and only falls back to kv when nodes is empty, so owners that exist only
in kv can be skipped; update export-d1.sh to compute the union of distinct
owners from both nodes and kv before the while loop. Keep the rest of the export
flow in place by using the combined owner list to drive the existing rows,
tag_colors, daily_index, and owners_obj assembly so every owner with data is
exported.
In `@scripts/import-d1-export.ts`:
- Around line 145-181: The preflight check in import-d1-export.ts only guards on
existing nodes, so non-forced imports can still fail later if the user already
has tag colors or daily index entries. Update the import gating logic around the
existingNodes check and the prisma.$transaction block to verify all per-user
tables being imported (node, tagColor, dailyIndexEntry) before proceeding when
force is false, and reject the import if any of them already contain rows for
the user.
In `@src/app/auth/ForgotPasswordForm.tsx`:
- Around line 24-31: The ForgotPasswordForm error handling is exposing raw
backend details through err.message. Update the catch block in
ForgotPasswordForm so requestPasswordReset failures always set a single neutral,
user-facing message instead of branching on err instanceof Error or using the
thrown message. Keep the success path unchanged and ensure the generic text is
used consistently for all failures in this form.
In `@src/components/Subheader.tsx`:
- Around line 31-35: In Subheader.tsx, the open/height calculation in the
SubheaderSlotSpec.render handling is using childElementCount, which ignores
valid text-only ReactNode content; switch the emptiness check to hasChildNodes()
in the logic that sets open and height so text nodes are treated as populated.
Apply the same fix anywhere else in this component’s matching collapse/measure
logic that uses the same childElementCount-based check.
In `@src/data/mutations.ts`:
- Around line 233-250: The edge reparenting helpers currently use raw parent
siblings, so hidden siblings can be chosen as the reparent target. Update
reparentIntoParentPrevSibling and the corresponding parent-next-sibling helper
to accept isVisible and use it to skip over non-visible siblings until the
nearest visible adjacent sibling is found before calling moveNode(). Keep the
existing behavior of reparenting into the parent’s adjacent sibling as a child,
but ensure Cmd+Shift+↑/↓ only moves among visible siblings.
In `@src/nodes/operations.ts`:
- Around line 152-166: The ownership and last-write-wins logic in operations.ts
is split across separate Node.findFirst and Node.update calls, which creates a
race and can update the wrong owner’s row. Refactor the update loop to use a
single atomic context.entities.Node.updateMany call scoped by id and userId, and
include the updatedAt condition when changes.updatedAt is present so the
timestamp check and write happen together. Keep the existing
toUpdateData(changes) mapping and skip empty payloads, but ensure the write only
succeeds when the node is still owned by the same user at the moment of update.
In `@src/plugins/daily/operations.ts`:
- Around line 37-43: Make the multi-row upsert in upsertDailyIndex atomic
instead of committing each DailyIndexEntry.upsert one by one. Update the batch
logic in operations.ts to run all row writes within a single database
transaction (or equivalent all-or-nothing mechanism) so a later failure rolls
back earlier writes, and ensure the daily-index flow in daily-index.ts still
triggers reconciliation/refetch on failure rather than silently treating a
partial prefix as success.
In `@src/plugins/tags/operations.ts`:
- Around line 29-41: The upsertTagColors flow is persisting raw tag/color values
without validation, so unsafe rows can be stored and later rendered by the
generated stylesheet. Update upsertTagColors to normalize and reject invalid
payloads before calling context.entities.TagColor.upsert, reusing the same
tag-safety helper used by the stylesheet/data-tag rendering path. Skip any rows
with unsafe tag names or malformed color values so only valid
tagColorsCollection entries are written.
In `@src/styles.css`:
- Around line 6-10: The shared `card` utility in `styles.css` should be removed
and the auth-page surface styling kept inline in the relevant TSX components
instead. Update the auth page components that use this surface to apply the
Tailwind classes directly, and eliminate the global `@utility card` definition
so `styles.css` remains limited to the allowed view-transition rules.
---
Outside diff comments:
In `@src/data/seed.ts`:
- Around line 19-35: The bootstrapOutline flow only tracks the last userId, so
stale async work can still resume after account switches and write into the
wrong session. Update bootstrapOutline to use a monotonic run token or abort
signal tied to each invocation, and re-check that token after each await
(especially after nodesCollection.toArrayWhenReady(), importLegacyNodes(), and
before seedIfEmpty()) before performing any mutation. Also ensure the caller in
OutlineEditor’s effect can stop or supersede older runs so only the latest
bootstrap invocation is allowed to continue.
---
Minor comments:
In @.agents/skills/deploying-app/SKILL.md:
- Line 16: The OAuth guidance in SKILL.md contains an awkward typo in the
user-facing text. Update the sentence in the deploying-app skill prompt to use
“the user” instead of “they user,” keeping the rest of the OAuth provider
redirect URL guidance unchanged. Locate the wording in the skill’s deployment
instructions and correct the phrasing so it reads naturally.
In @.agents/skills/start-dev-server/SKILL.md:
- Around line 49-53: The migration guidance in START_DEV_SERVER is incorrect for
already-generated pending migrations; update the relevant section in SKILL.md so
it tells users to run wasp db migrate (or wasp start) when the database is
behind, and reserve wasp db migrate-dev --name <migration-name> for creating a
new migration after schema changes. Keep the wording aligned with the
start-dev-server instructions and the migration example in the same document.
In @.agents/skills/wasp-plugin-help/SKILL.md:
- Around line 16-20: The self-link in the Wasp Plugin help text is fragile
because the rendered heading contains emojis, so the anchor target may not match
consistently. Update the link in the “display the [Wasp Plugin for Claude Code]”
section and the matching heading text so the internal reference resolves
reliably across markdown renderers, using the heading identifier around “Wasp
Plugin for Claude Code” as the source of truth.
In @.agents/skills/wasp-plugin-init/general-wasp-knowledge.md:
- Around line 49-56: The markdown knowledge file has unlabeled fenced code
blocks that trigger markdownlint warnings; update the bare fences in the general
Wasp knowledge content to use a text language tag. Apply the change to both
affected fences in the documented directory layout section so the mirrored
knowledge file stays lint-clean.
In @.agents/skills/wasp-plugin-init/SKILL.md:
- Around line 19-26: The init snippet is using cwd-dependent paths for cleanup
and copy, so update the plugin initialization flow to resolve both locations
from the plugin root instead of the current working directory. In the SKILL.md
init instructions, anchor the `.claude/wasp` target and
`general-wasp-knowledge.md` source to the plugin root, and narrow the
marker-file removal to only the versioned `.wasp-plugin-initialized*` pattern
under that same resolved root so the upgrade cleanup and copy behave
consistently regardless of where the skill runs.
In `@docs/PRD-wasp-migration.md`:
- Line 141: The markdownlint warnings come from bare fenced code blocks in the
PRD examples; update each fenced block in the document to include an explicit
language tag such as text. Make the change consistently for the affected fences
mentioned in the review so the examples are valid markdown and the lint errors
in the PRD-wasp-migration content are resolved.
In `@e2e/auth.setup.ts`:
- Around line 3-18: The shared auth setup in setup("authenticate") is not
idempotent because it always uses the fixed e2e@dotflowy.test account, which
will fail on reruns once the user already exists. Update the auth fixture in
auth.setup.ts to use a per-run unique email (for example derived from the
current test run) or seed/reuse a dedicated test account before the signup/login
flow. Keep the changes localized to the auth setup constants and the
authenticate setup block so the suite can rerun cleanly against a persistent
test DB.
- Around line 19-20: The auth setup currently only checks that the page is not
on /login, which is too weak for the expected redirect flow. Update the
assertion in auth.setup.ts to explicitly wait for the successful post-login
destination at / before calling page.context().storageState, using the existing
page and authFile flow so the saved state reflects a confirmed login redirect.
In `@e2e/keyboard-move-edge.spec.ts`:
- Around line 11-14: The keyboard move edge tests currently use nestedUnder(),
which matches any descendant and can hide incorrect reparenting or ordering.
Update the assertions in keyboard-move-edge.spec.ts to verify the moved item is
a direct child of the expected parent and that its position relative to
neighboring siblings matches the test case, using the affected test helpers and
selectors around nestedUnder() and the Cmd+Shift+↑/↓ scenarios.
In `@README.md`:
- Line 114: The README has two bare Markdown code fences in the data-model and
project-layout sections that trigger markdownlint; update both fences in the
relevant documentation blocks to include an explicit language tag such as text.
Locate the plain fences mentioned in the review and keep the content unchanged
while adding the language label so the docs lint passes.
In `@scripts/import-d1-export.ts`:
- Around line 84-90: The export validation in loadExport is too shallow because
it only checks version and that owners is truthy, letting malformed payloads
reach pickOwner() and importOwnerData() and fail later. Tighten loadExport to
verify the full D1ExportFile shape before returning it, especially that owners
is an object/map with the expected nested structure used by Object.keys and
.length, and keep returning a clear Error for invalid payloads so downstream
callers only receive a well-formed export.
In `@src/app/auth/AuthLayout.tsx`:
- Line 1: `ReactNode` in `AuthLayout` is type-only, so update the import to use
a type-only import from react to match the project style. Make the change at the
top of `AuthLayout.tsx` where `ReactNode` is imported, and keep the rest of the
component unchanged.
In `@src/app/auth/ResetPasswordForm.tsx`:
- Around line 67-82: The ResetPasswordForm inputs currently use
aria-invalid={!!error}, which incorrectly marks both password fields invalid for
form-level request failures. Update the ResetPasswordForm component to separate
field-level password validation from form-level errors so only actual input
validation states control aria-invalid on the password and password-confirmation
inputs. Use the existing ResetPasswordForm state and handlers to wire
aria-invalid to field-specific validation instead of the shared error value.
In `@src/app/auth/VerifyEmailForm.tsx`:
- Around line 13-17: The effect in VerifyEmailForm is latched with a boolean
ref, so it only runs once for the component lifetime and won’t re-verify when
the URL token changes on the same route. Replace the one-shot started ref with
logic that tracks the last processed token in VerifyEmailForm, and in the
useEffect only skip when the current token matches that stored value; otherwise
update the stored token and call verifyEmail again so new ?token= values re-run
correctly.
In `@src/components/account-menu.tsx`:
- Around line 21-24: The logout flow in handleLogout and its voided call site
currently drops rejections from logout(), so failures leave the user signed in
without feedback. Update handleLogout to catch and handle errors from logout()
(for example, by showing an error state or notification and only navigating to
/login on success), and make sure the onClick/trigger that currently uses void
handleLogout() is wired to respect that error handling instead of ignoring the
promise.
In `@src/plugins/tags/use-tag-filter.ts`:
- Around line 68-78: The keydown handler in useTagFilter’s useEffect clears tags
even after another control has already handled Escape; update the onKey listener
to check e.defaultPrevented and return early before calling clearTags. Keep the
existing activeElement/node-text guard, and only clear tags when Escape was not
already consumed elsewhere.
---
Nitpick comments:
In `@src/plugins/types.ts`:
- Around line 387-391: Narrow the `SubheaderSlotSpec.render` contract in
`SubheaderSlotSpec` so slots can only return structural elements or nothing.
Update the `render(getCtx)` return type from `ReactNode` to `ReactElement |
null`, keeping the optional `getCtx` behavior unchanged, and ensure any
implementations of `SubheaderSlotSpec.render` conform to the new element-only
return type.
In `@tsconfig.wasp.tsbuildinfo`:
- Line 1: Remove the committed incremental build cache artifact
tsconfig.wasp.tsbuildinfo from version control and add a global ignore entry for
*.tsbuildinfo in .gitignore so generated TypeScript build-state files are not
tracked; this is a repo hygiene fix, so delete the cached file and update the
ignore rules accordingly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: de7c717b-aaef-4271-ae33-1814e15e6f98
⛔ Files ignored due to path filters (3)
bun.lockis excluded by!**/*.lockpackage-lock.jsonis excluded by!**/package-lock.jsonpublic/favicon.icois excluded by!**/*.ico
📒 Files selected for processing (132)
.agents/skills/deploying-app/SKILL.md.agents/skills/deploying-app/validating-pre-deployment.md.agents/skills/expert-advice/SKILL.md.agents/skills/start-dev-server/SKILL.md.agents/skills/wasp-plugin-help/SKILL.md.agents/skills/wasp-plugin-init/SKILL.md.agents/skills/wasp-plugin-init/general-wasp-knowledge.md.claude/settings.json.claude/wasp/.wasp-plugin-initialized-v1.3.0.claude/wasp/general-wasp-knowledge.md.env.server.example.github/workflows/ci.yml.gitignore.npmrc.smoke.mjs.waspignore.wasprootAGENTS.mdREADME.mdcloudflare-legacy/README.mdcloudflare-legacy/d1-config.jsoncloudflare-legacy/d1-migrations/0001_create_nodes.sqlcloudflare-legacy/d1-migrations/0002_create_kv.sqlcloudflare-legacy/wrangler.export.jsonccomponents.jsondocs/DECISIONS.mddocs/PRD-wasp-migration.mde2e/auth.setup.tse2e/fixtures.tse2e/keyboard-move-edge.spec.tse2e/tag-filter.spec.tsmain.wasp.tsmigrations/20260625164307_init_outline/migration.sqlmigrations/migration_lock.tomlpackage.jsonplaywright.config.tspublic/.gitkeeppublic/no-flash-theme.jsschema.prismascripts/d1-export-types.tsscripts/export-d1.shscripts/fixtures/d1-export.sample.jsonscripts/import-d1-export.tsskills-lock.jsonsrc/account/account.wasp.tssrc/account/operations.tssrc/app/App.tsxsrc/app/OutlinePage.tsxsrc/app/auth/AuthLayout.tsxsrc/app/auth/EmailAuthForm.tsxsrc/app/auth/EmailVerificationPage.tsxsrc/app/auth/ForgotPasswordForm.tsxsrc/app/auth/LoginPage.tsxsrc/app/auth/PasswordResetPage.tsxsrc/app/auth/RequestPasswordResetPage.tsxsrc/app/auth/ResetPasswordForm.tsxsrc/app/auth/SignupPage.tsxsrc/app/auth/VerifyEmailForm.tsxsrc/app/vite-env.d.tssrc/components/Header.tsxsrc/components/OutlineEditor.tsxsrc/components/OutlineNode.tsxsrc/components/Subheader.tsxsrc/components/account-menu.tsxsrc/components/bookmarks.tsxsrc/components/menu-list.tsxsrc/components/move-dialog.tsxsrc/components/node-switcher.tsxsrc/components/slash-menu-list.tsxsrc/components/ui/badge-variants.tssrc/components/ui/badge.tsxsrc/components/ui/button.tsxsrc/components/ui/card.tsxsrc/components/ui/checkbox.tsxsrc/components/ui/command.tsxsrc/components/ui/dialog.tsxsrc/components/ui/dropdown-menu.tsxsrc/components/ui/field.tsxsrc/components/ui/hover-card-content.tsxsrc/components/ui/input-group-addon.tsxsrc/components/ui/input-group-text.tsxsrc/components/ui/input-group.tsxsrc/components/ui/input.tsxsrc/components/ui/label.tsxsrc/components/ui/separator.tsxsrc/components/ui/sheet.tsxsrc/components/ui/sidebar.tsxsrc/components/ui/skeleton.tsxsrc/components/ui/switch.tsxsrc/components/ui/textarea.tsxsrc/components/ui/tooltip.tsxsrc/components/use-bullet-keymap.tssrc/data/api.tssrc/data/collection.tssrc/data/import-legacy.tssrc/data/kv-api.tssrc/data/links.tssrc/data/mutations.tssrc/data/query-client.tssrc/data/seed.tssrc/data/tag-colors.tssrc/lib/utils.tssrc/nodes/nodes.wasp.tssrc/nodes/operations.tssrc/plugins/daily/daily-index.tssrc/plugins/daily/daily.wasp.tssrc/plugins/daily/index.tsxsrc/plugins/daily/operations.tssrc/plugins/registry.tssrc/plugins/tags/filter-bar.tsxsrc/plugins/tags/index.tsxsrc/plugins/tags/operations.tssrc/plugins/tags/tag-classes.tssrc/plugins/tags/tag-color-menu.tsxsrc/plugins/tags/tags.wasp.tssrc/plugins/tags/use-tag-filter.tssrc/plugins/todos/index.tsxsrc/plugins/types.tssrc/routeTree.gen.tssrc/router.tsxsrc/routes/$nodeId.tsxsrc/routes/__root.tsxsrc/routes/index.tsxsrc/styles.csstsconfig.jsontsconfig.src.jsontsconfig.wasp.jsontsconfig.wasp.tsbuildinfovite.config.tsworker/index.tsworker/tsconfig.jsonwrangler.jsonc
💤 Files with no reviewable changes (10)
- wrangler.jsonc
- src/routes/index.tsx
- src/router.tsx
- src/routeTree.gen.ts
- worker/index.ts
- src/routes/$nodeId.tsx
- src/routes/__root.tsx
- worker/tsconfig.json
- src/data/kv-api.ts
- src/data/links.ts
Comment on lines
+52
to
+59
| ### Step 4: Database Migrations | ||
|
|
||
| Check for pending migrations: | ||
|
|
||
| ```bash | ||
| # List migration files | ||
| ls -la migrations/ | ||
| ``` |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major
🧩 Analysis chain
🏁 Script executed:
cat -n .agents/skills/deploying-app/validating-pre-deployment.mdRepository: cameronapak/dotflowy
Length of output: 3851
Fix sequencing error and improve migration verification commands.
The step numbering is incorrect (jumps from Step 2 to Step 4). Additionally, ls -la migrations/ only lists migration files and fails to verify if the database state is actually synchronized (pending vs. applied).
Please renumber to Step 3 and replace the command with actual migration status checks relevant to the app stack (e.g., npx prisma migrate status or knex migrate:status).
- ### Step 4: Database Migrations
+ ### Step 3: Database Migrations
Check for pending migrations:
```bash
- # List migration files
- ls -la migrations/
<details>
<summary>🤖 Prompt for AI Agents</summary>
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/deploying-app/validating-pre-deployment.md around lines 52 -
59, The migration section has a sequencing mistake and a weak verification
command. In the validating-pre-deployment workflow, renumber the current “Step
4: Database Migrations” to Step 3 so the steps stay in order, and replace the
ls -la migrations/ check with a real migration status command appropriate to
the stack, such as the app’s Prisma or Knex status check, so it verifies applied
versus pending migrations instead of just listing files.
</details>
<!-- fingerprinting:phantom:triton:quartz -->
<!-- cr-indicator-types:potential_issue -->
<!-- cr-comment:v1:5adebd2ddabd92827d85658e -->
<!-- This is an auto-generated comment by CodeRabbit -->
Comment on lines
+32
to
+44
| - uses: actions/checkout@v4 | ||
|
|
||
| - uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: "24" | ||
|
|
||
| - uses: oven-sh/setup-bun@v2 | ||
|
|
||
| - name: Install Wasp CLI | ||
| run: curl -sSL https://get.wasp.sh/installer.sh | sh -s -- -v 0.24.0 | ||
|
|
||
| - name: Add Wasp to PATH | ||
| run: echo "$HOME/.local/bin" >> "$GITHUB_PATH" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Pin the actions and stop persisting the checkout token.
These uses: refs are still tag-based, and actions/checkout will leave the workflow token in local git config unless you turn it off. That unnecessarily widens the blast radius for the later shell steps in this job. Pin each action to a full commit SHA and set persist-credentials: false unless a later step really needs git auth.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 32-32: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 32-32: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 34-34: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 38-38: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 32 - 44, Pin the workflow actions in
the CI job to full commit SHAs instead of tag refs, and update the checkout step
to disable credential persistence. In the workflow steps using actions/checkout,
actions/setup-node, and oven-sh/setup-bun, replace the current version tags with
immutable SHAs, and set persist-credentials to false on actions/checkout unless
a later step explicitly needs git authentication.
Source: Linters/SAST tools
Fresh checkouts have no node_modules or .wasp internals; wasp compile requires wasp install, not bun install alone. Co-authored-by: Cursor <cursoragent@cursor.com>
Harden the Wasp sync boundary (bootstrap run token, atomic LWW updates, DailyIndexEntry FK cascade, transactional daily upserts, tag validation), fix D1 cutover scripts and visible-sibling keyboard reparent, and tighten auth/smoke/e2e coverage. Remove the disabled CI workflow. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Big-bang migration from TanStack Start + Cloudflare Worker/D1 to Wasp 0.24 + PostgreSQL (Railway-ready). Editor UX unchanged — TanStack DB collections remain the local mirror; sync boundary calls Wasp queries/actions.
User,Node,TagColor,DailyIndexEntry), LWWupdateNodes, per-user scoping/,/:nodeId), Shadcn auth UI, header account menu with logoutcloudflare-legacy/)wasp compile, typecheck, Playwright e2eWhat still works
Zoom, plugins, Cmd+K, tags, daily notes, todos, links, route-bible — all unchanged at the editor layer.
Dev / deploy
Founder cutover:
bash scripts/export-d1.sh→bun scripts/import-d1-export.ts --user-email …Out of scope (v1.1)
Offline-first (OPFS + outbox) — see
docs/PRD-wasp-migration.mdTest plan
bun run typecheckbun run test:e2e— 50/50 against localwasp startMade with Cursor
Summary by CodeRabbit
New Features
Bug Fixes
Chores