Files
windmill/frontend/src/lib/components
Guilhem LemouelandClaude Opus 5 5d37527024 fix: address review — history, workspace restore, SVG styles
Two blockers and the findings around them.

- The wizard pushed history entries for navigations the user did not ask for.
  `folder` initialises to the project slug while the plan holds none, so the
  mirroring effect fired on mount and pushed a URL differing only by `&folder=`;
  pressing Back returned to the entry without it, which re-fired and re-pushed.
  Back could never leave step 3. `go` now takes `{ replace: true }`, used by that
  effect and by the step guard — the two navigations the page decides on its own.
  The comment claiming `go` replaced was written without checking that `goto`
  forwards to SvelteKit, which defaults `replaceState` to false.
- Undoing a run left the app pointing at the workspace it had just deleted:
  `#ensureWorkspace` switches in, `deleteCreatedWorkspace` deleted without
  switching out. The dead id was persisted on the next navigation, `getUserExt`
  then returned undefined, and the following reload logged the user out. The
  executor now remembers where the app pointed before it started and puts it back.
- `FORBID_TAGS: ['style', 'image']` on the hub SVGs. The profile allows both; an
  inline `<svg><style>` is document-scoped, so a hostile hub could restyle this
  page — including moving the wizard's own Import and Delete controls — and
  `<image href>` is a beacon. The doc comment asserted a guarantee the config did
  not deliver.
- The existing-workspace id is validated like the new one and encoded where it is
  interpolated into `/api/w/<ws>/...`; it arrives from the URL exactly as the new
  one does and ends up in `workspaceStore`.
- `AppConnectInner`'s two RadioCards get a `role="radiogroup"` wrapper, since they
  now carry `role="radio"` and a screen reader cannot place a radio without one.
- `FolderPicker` records a created folder against the membership it is reading, and
  before reloading, so a non-admin can re-pick the folder they just made in another
  workspace instead of finding it `(read-only)`.
- Step 3 shows trigger and data table migration counts once the export is fetched.
  The page this replaced showed them, and the warning underneath talks about
  triggers the user was never told about.
- First tests for the two pure modules: the workspace-id contract the wizard and
  the create form must not drift on, and the plan/URL round trip the whole wizard
  rests on.
- Doc fixes: the retry claim (the granularity is the task, not the item), the bench
  header, a fractional `?step=`, an empty name in the destination card, and the
  three copies of one rationale AGENTS.md asks to state once.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-19 15:08:57 +02:00
..
2026-03-05 18:11:40 +01:00
2025-10-30 06:47:26 +00:00
2025-10-28 17:52:04 +00:00
2026-03-05 18:11:40 +01:00
2026-03-05 18:11:40 +01:00
2025-11-04 19:13:09 +00:00
2026-02-11 06:27:21 +00:00
2025-11-29 01:23:47 +00:00
2026-03-05 18:11:40 +01:00
2026-03-05 18:11:40 +01:00