Chatpane / Tickets / #137 Harden Carrier across notifications, privacy, settings, and releases

#137 Harden Carrier across notifications, privacy, settings, and releases

Status: closed

Owner: nobody

Labels: None

Updated: 2026-07-23

Created: 2026-07-17

Creator: Anonymous

Private: No

Originally created by: kristofferR

Summary

Addresses the actionable audit findings tracked under [#135] across notification delivery, privacy features, settings persistence, accessibility, test coverage, and release documentation.

hardens fallback notification matching, pairing, routing, polling, and selector health
fixes privacy regressions around cookie consent, name/avatar hiding, media viewing, emoji cleanup, refresh behavior, and page overflow
makes settings writes crash-safe with atomic replacement and platform-appropriate durability
adds keyboard/focus semantics to injected menus, toasts, and the media viewer, plus focused tests for conversation rows and login-page logic
strengthens release checks and keeps README/landing-page download links and product claims aligned with each release

Why

The audit identified several failures caused by Messenger DOM churn, incomplete lifecycle cleanup, brittle settings writes, and documentation/release automation drifting from actual product behavior. This change consolidates fixes that share those root causes while keeping the generated injection bundles in sync.

Impact

Users should see more reliable native notifications and unread state, fewer privacy leaks or stale UI effects, safer settings persistence after interruption, improved keyboard and screen-reader behavior, and accurate release/download information.

Validation

bun run check — passed (Biome, TypeScript, 75 tests / 217 assertions, injection bundle rebuild)
generated injection bundles verified clean after rebuild
cargo fmt --manifest-path src-tauri/Cargo.toml --check — passed
cargo clippy --manifest-path src-tauri/Cargo.toml --all-targets -- -D warnings — passed on the Windows GNU toolchain
cargo test --lib compiled but the Windows test executable could not launch because of local STATUS_ENTRYPOINT_NOT_FOUND; WSL execution is blocked by missing GTK/WebKit development packages

Ref [#135]
Ref [#109]
Ref [#110]
Ref [#111]
Ref [#112]
Ref [#114]
Ref [#115]
Ref [#116]
Ref [#117]
Ref [#120]
Ref [#121]
Ref [#123]
Ref [#125]
Ref [#127]
Ref [#132]
Ref [#133]
Ref [#134]

Summary by CodeRabbit

New Features
Improved native notification links and reload-safe conversation routing.
Added keyboard navigation and focus restoration for Messenger context menus.
Added Settings/reload/cache-clear/paste-match shortcuts.
Updated update verification messaging, including platform signing guidance.
Bug Fixes
Improved unread-message and notification detection (better truncated previews and group handling).
Fixed UI behavior when zoomed, viewing media, refreshing, and cleaning up system emoji.
Improved cookie-consent and login-page detection.
Adjusted settings time picker sizing within rows.
Made settings saves safer against corruption and concurrent updates.
Accessibility
Improved toast announcements, menu semantics, keyboard support, and media-viewer focus handling.

Anonymous - 2026-07-17

Originally posted by: kristofferR

@coderabbitai review

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2026-07-17

Originally posted by: coderabbitai[bot]

✅ Action performed
Review finished. > Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2026-07-17

Originally posted by: coderabbitai[bot]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration
**Configuration used**: Path: .coderabbit.yaml **Review profile**: ASSERTIVE **Plan**: Pro **Run ID**: `0f41fe51-5ff6-452b-ad18-fd8eeb68c14d`

📥 Commits
Reviewing files that changed from the base of the PR and between [df47e0] and 84331dcc6b936b9be3037fd67e11938bc05e5c96.

📒 Files selected for processing (6)
* `.github/workflows/release.yml` * `inject/src/messenger/features/context-menu.ts` * `src-tauri/inject/messenger.js` * `src-tauri/src/commands.rs` * `src-tauri/src/notifications.rs` * `src-tauri/src/settings.rs`

📝 Walkthrough
## Walkthrough The PR updates release validation and public link publishing, refactors Messenger interaction, login, privacy, unread, and notification behavior, adds reload-safe native notification routing, improves accessibility, and makes settings persistence atomic with corruption fallback. ### Changes **Carrier changes** |Layer / File(s)|Summary| |---|---| |**Release workflow and public messaging**
`.github/workflows/release.yml`, `README.md`, `dist/settings.html`|Release checks use frozen Bun installs and generated-bundle validation; publishing updates README and landing-page links; documentation reflects update verification, shortcuts, notification controls, privacy notes, and non-goals.| |**Messenger interaction and UI hygiene**
`inject/src/messenger/features/*`, `inject/src/panel/*`, `src-tauri/inject/messenger.css`, `src-tauri/inject/messenger.js`|Refresh gating, context-menu keyboard behavior, zoom-aware identity marking, media focus restoration, selector monitoring, emoji cleanup, unread detection, toast accessibility, and related styling are updated.| |**Login and consent detection**
`inject/src/messenger/features/login-tidy.ts`, `inject/src/messenger/features/cookie-consent.ts`, `inject/src/messenger/lib/login-page.ts`, `inject/src/messenger/lib/privacy.ts`, `inject/src/messenger/lib/*test.ts`|Shared helpers classify cookie consent and language links, refine decline-button selection and sender-preview parsing, and add focused tests.| |**Conversation extraction and notification correlation**
`inject/src/messenger/lib/conversation-row.ts`, `inject/src/messenger/lib/notification-fallback.ts`, `inject/src/messenger/features/notifications.ts`, `src-tauri/inject/messenger.js`|Conversation title/body and unread state are derived from row surfaces; fallback matching accepts bounded truncation and group senders; scanners reattach to replaced grids and use visibility-aware polling; notification emission carries correlated thread paths.| |**Native notification thread routing**
`src-tauri/src/notifications.rs`, `src-tauri/src/lib.rs`, `inject/src/types.d.ts`|Validated thread paths are stored per notification, late route updates are accepted, and clicks use the notification callback result before opening a conversation.| |**Atomic settings persistence**
`src-tauri/src/settings.rs`, `src-tauri/src/commands.rs`, `src-tauri/Cargo.toml`|Settings reads warn and fall back on invalid input; writes use sequenced temporary files, durable atomic replacement, Windows support, and stale-write handling.| **Estimated code review effort:** 5 (Critical) | ~120 minutes **Possibly related issues** - Carrier#111 — Covers notification grid reattachment, selector monitoring, and reload-safe notification routing. - Carrier#109 — Covers truncated preview and group-sender matching in notification pairing. - Carrier#135 — Covers the broader audit changes including notification, privacy, settings, release, documentation, and accessibility updates. - Carrier#115 — Covers zoom-aware Hide Names geometry. **Possibly related PRs** - [[kristofferR/Carrier#13](https://github.com/kristofferR/Carrier/issues/13)](https://github.com/kristofferR/Carrier/pull/13) — Extends the native notification click bridge used by this PR. - [[kristofferR/Carrier#70](https://github.com/kristofferR/Carrier/issues/70)](https://github.com/kristofferR/Carrier/pull/70) — Establishes the Bun-based inject validation and frozen-lockfile workflow updated here. - [[kristofferR/Carrier#100](https://github.com/kristofferR/Carrier/issues/100)](https://github.com/kristofferR/Carrier/pull/100) — Adds the landing page whose download links are updated by this release workflow.

🚥 Pre-merge checks | ✅ 4 | ❌ 1
### ❌ Failed checks (1 warning) | Check name | Status | Explanation | Resolution | | :----------------: | :--------- | :------------------------------------------------------------------------------------ | :--------------------------------------------------------------------------------- | | Docstring Coverage | ⚠️ Warning | Docstring coverage is 45.69% which is insufficient. The required threshold is 80.00%. | Write docstrings for the functions missing them to satisfy the coverage threshold. |

✅ Passed checks (4 passed)
| Check name | Status | Explanation | | :------------------------: | :------- | :------------------------------------------------------------------------------------------------------------------------ | | Description Check | ✅ Passed | Check skipped - CodeRabbit’s high-level summary is enabled. | | Title check | ✅ Passed | The title clearly summarizes the PR’s broad hardening work across notifications, privacy, settings, and release handling. | | Linked Issues check | ✅ Passed | Check skipped because no linked issues were found for this pull request. | | Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |

✨ Finishing Touches

📝 Generate docstrings
- [ ] Create stacked PR - [ ] Commit on current branch

🧪 Generate unit tests (beta)
- [ ] Create PR with unit tests - [ ] Commit unit tests in branch `codex/audit-round-2`

_{Comment @coderabbitai help to get the list of available commands.}

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2026-07-17

Originally posted by: kristofferR

@coderabbitai review

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2026-07-17

Originally posted by: coderabbitai[bot]

✅ Action performed
Review finished. > Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2026-07-17

Originally posted by: kristofferR

@codex review

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2026-07-17

Originally posted by: kristofferR

@coderabbitai review

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2026-07-17

Originally posted by: coderabbitai[bot]

✅ Action performed
Review finished. > Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2026-07-17

Originally posted by: kristofferR

@codex review

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2026-07-18

Originally posted by: kristofferR

@coderabbitai review

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2026-07-18

Originally posted by: coderabbitai[bot]

✅ Action performed
Review finished. > Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2026-07-18

Originally posted by: kristofferR

@coderabbitai review

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2026-07-18

Originally posted by: coderabbitai[bot]

✅ Action performed
Review finished. > Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2026-07-18

Ticket changed by: kristofferR

status: open --> closed
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Harden Carrier across notifications, privacy, settings, and releases

Facebook Messenger on your desktop, without the Facebook clutter

Milestone

Searches

Help