Menu

#445 fix(review): address CodeRabbit findings on PR #440

closed
nobody
None
2026-07-15
2026-07-15
Anonymous
No

Originally created by: Akarsh-Hegde

Summary

Follow-up fixes for the CodeRabbit review threads on the pre-main → main promotion PR [#440]. Once this lands on pre-main, [#440]'s diff picks the fixes up automatically.

Per the triage on [#440], this branch carries the clear bugs, one privacy hardening, and the refactors approved for it. Two items are handled elsewhere: the Jira backfill critical is in its own focused PR [#446] (risky daemon-sync change), and the email→PostHog capture is a deliberate keep (copy softened instead).

Correctness / safety

  • uninstall — full-wipe scope bug (Critical): gate the wholesale rm -rf ~/.meridian on --purge only, not --remove-data && --remove-runtime (a user could set both without intending a full wipe). Fixed in the human and --json paths; regression test added.
  • intelligence (github/linear) — FK violation (Major): full-clear via prune() unconditionally, so the empty-keys path deletes pm_task_embeddings before pm_tasks. The old fallback deleted pm_tasks directly and hit the FK, silently leaving stale tasks.
  • pm_worklog/create — unbounded hang (Major): 20 s reqwest timeout on the jira/azure create clients (matches azure_devops::apply).
  • account — PII in traces (Major): skip(email) in #[tracing::instrument] so the signed-in address never lands in a span field / log.
  • pm_worklog/post: .context(...) on the fail_worklog / mark_post_failed DB calls.

Refactors (approved for this branch)

  • uninstall: split into uninstall.rs + uninstall/json.rs + uninstall/tests.rs (each < 500 lines); the 13-arg run_json is now a Plan / Flags struct.
  • meridian-core: new fs_utils::atomic_write_json — one tested crash-safe temp+rename JSON writer; settings, tray analytics, and account all call it now.
  • CI: extract the duplicated Apple cert-import block into .github/actions/import-apple-cert (shared by release.yml + release-staging.yml), with a graceful no-op when APPLE_CERTIFICATE is unset instead of crashing security import.

UI / smaller fixes

  • setup/EmailCodeForm: stop the resend-cooldown ticker when the countdown elapses; add catch blocks so a rejected Clerk promise surfaces to the user instead of an unhandled rejection.
  • setup/steps: soften onboarding privacy copy — telemetry isn't strictly anonymous (metadata + email after sign-in), while keeping "never your content".
  • brand-icons: tie BrandIcon.viewBox/path together in the type so a glyph can't render a viewBox-less SVG.
  • tray: warn!error! on genuine failure paths (uninstall commands, MLX runtime upgrade, backend install).
  • em-dashes → plain hyphens in user-facing strings (uninstall CLI, design-system preview mock data).

Skipped (with rationale, commented on the [#440] threads)

  • commands.rs / api-types.ts "missing header comment" — already present on line 1 (CodeRabbit anchored mid-file); stale.
  • CLAUDE.md "afterwards" → "afterward" — docs file, not user-facing app text; the US-locale nit doesn't apply.

Test plan

  • cargo test (workspace): 437 + integration suites pass
  • cargo clippy -- -D warnings: clean (root + tray)
  • cargo fmt --check: clean (root + tray)
  • cd tray/src-tauri && cargo test: 65 pass
  • cd ui && npm run build: clean (TypeScript check passes); bun test: 181 pass
  • Workflow YAML validated (release.yml, release-staging.yml, the new composite action)

🤖 Generated with Claude Code

Related

Tickets: #440
Tickets: #446
Tickets: #447

Discussion

  • Anonymous

    Anonymous - 2026-07-15

    Originally posted by: coderabbitai[bot]

    [!IMPORTANT]

    Review skipped

    Auto reviews are disabled on base/target branches other than the default branch.

    Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.


    ⚙️ Run configuration

    Configuration used: Organization UI

    Review profile: ASSERTIVE

    Plan: Pro Plus

    Run ID: ab9b1eed-f338-4609-adf2-dbfd332135a5

    You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

    Use the checkbox below for a quick retry:
    - [ ] 🔍 Trigger review

    ✨ Finishing Touches
    🧪 Generate unit tests (beta) - [ ] Create PR with unit tests - [ ] Commit unit tests in branch `fix/pr440-review-followups`

    Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

    ❤️ Share - [X](https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai) - [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai) - [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai) - [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code)

    Comment @coderabbitai help to get the list of available commands.

     
  • Anonymous

    Anonymous - 2026-07-15

    Ticket changed by: Akarsh-Hegde

    • status: open --> closed
     

Log in to post a comment.