@bridge_gpt/mcp-server 0.2.23 → 0.2.25

package/public/js/main.min.js

@@ -1842,6 +1842,10 @@ const GITHUB_CONNECT_MESSAGES = {
     'already-consumed': 'This GitHub connection link has already been used. Please start the connection again.',
     'unresolved': 'GitHub returned without completing the connection. Please try again.',
     'no-repositories': 'The GitHub App installation did not include any repositories Bridge can access.',
+    // Honest about the dead end (BAPI-631): GitHub sends the org owner an approval
+    // request out-of-band, and their approval does not redirect back here. Waiting on
+    // this page accomplishes nothing, so say so and point at the fallback that works.
+    'awaiting-organization-approval': 'Your request to install the GitHub App was sent to an organization owner for approval. Approval happens on GitHub and will not return you to this page, so waiting here will not finish the connection. Once an owner approves the install, use the manual fallback below to finish connecting.',
     'already-linked': 'This GitHub installation is already connected to a different Bridge account. If this is unexpected, contact support.',
     'binding-failed': 'GitHub was verified, but Bridge could not finish linking the repository. Use the manual fallback below.',
     pickerLoading: 'Loading the repositories from your GitHub installation…',
@@ -1850,10 +1854,33 @@ const GITHUB_CONNECT_MESSAGES = {
     connectedTitle: 'GitHub connected',
 };
 
+// User-facing copy for the optional editor/MCP section and the install-key
+// outcomes (BAPI-630). GitHub-specific feedback stays in the sanitized
+// GITHUB_CONNECT_MESSAGES map above — these two surfaces are deliberately
+// separate so MCP failure copy can never claim the GitHub task failed.
+const UI_STRINGS = {
+    // Scopes an install-instructions failure to the optional section. Prefixed
+    // onto the detail resolved by getApiErrorMessage() so the user learns which
+    // area failed and that the primary GitHub task is unaffected.
+    mcpErrorScope: 'Editor and MCP setup instructions could not be loaded. Connecting GitHub above is unaffected and still available.',
+    mcpMissingProject: 'Missing projectId — please navigate here from your project dashboard.',
+    installKeyInserted: 'Admin install key generated and inserted into the snippets.',
+    // Zero snippet slots: report the limitation truthfully rather than claiming
+    // an insertion that did not happen (BAPI-630 / CI-2).
+    installKeyNoSlots: 'Admin install key generated, but no editor snippets were available for automatic insertion. Copy the key below, or retry loading the optional editor and MCP instructions.',
+};
+
 // Holds the plaintext minted key for the current page lifetime ONLY. Never
 // persisted to storage, cookies, URLs, datasets, or sent back to the server.
 let generatedInstallKey = null;
 
+// The project's repository name, initialized once from the server-rendered
+// container dataset and thereafter kept in module state. Both the GitHub
+// connect and install-key actions read it from here, so neither re-reads the
+// dataset per action and the install-instructions response never has to write
+// a value back into the DOM.
+let currentRepoName = '';
+
 // ============================================================
 // Clipboard helper
 // ============================================================
@@ -2303,6 +2330,26 @@ function renderInstallStatus(installStatus, projectId) {
 // Data loading
 // ============================================================
 
+// Reveal an optional-section error. The error region lives inside the MCP
+// drawer, which is collapsed by default — so expanding the drawer through the
+// shared utility is what actually makes the message visible. Without this the
+// failure would be silent, which is the exact mode BAPI-630 removes. Only the
+// MCP drawer is touched; no GitHub control or status region is involved.
+function showMcpError(message) {
+    const errorEl = document.getElementById('get-started-error');
+    const msgEl = document.getElementById('get-started-error-msg');
+    if (msgEl) msgEl.textContent = message;
+    if (errorEl) errorEl.classList.remove('hidden');
+
+    const drawer = document.querySelector('#get-started-container .get-started-mcp-drawer');
+    if (drawer) (0,_utils_js__WEBPACK_IMPORTED_MODULE_1__.setDrawerExpanded)(drawer, true);
+}
+
+// Loads the OPTIONAL editor/MCP instructions. Scope discipline (BAPI-630): this
+// function may only touch #get-started-loading, #get-started-error, and
+// #get-started-content. It must never hide, reveal, or gate any GitHub control,
+// status, result, picker, or fallback region — a failure here is not a failure
+// of the page's primary task.
 async function loadInstallInstructions(projectId) {
     const loadingEl = document.getElementById('get-started-loading');
     const errorEl = document.getElementById('get-started-error');
@@ -2323,12 +2370,12 @@ async function loadInstallInstructions(projectId) {
 
         if (loadingEl) loadingEl.classList.add('hidden');
 
-        // Defensive sync: keep the container's repo dataset authoritative from
-        // the install-instructions payload so the install-key click handler
-        // reads the correct repo_name even if the server attribute was empty.
-        const containerEl = document.getElementById('get-started-container');
-        if (containerEl && data.repo_name) {
-            containerEl.dataset.repoName = data.repo_name;
+        // Keep the shared repo-name state authoritative from the payload, but
+        // never let an empty/whitespace response erase a valid server-rendered
+        // value. Held in module state — not written back into the dataset.
+        const responseRepoName = (data.repo_name || '').trim();
+        if (responseRepoName) {
+            currentRepoName = responseRepoName;
         }
 
         const repoLabel = document.getElementById('get-started-repo-label');
@@ -2341,19 +2388,15 @@ async function loadInstallInstructions(projectId) {
         renderInstallStatus(data.install_status, projectId);
 
         if (contentEl) contentEl.classList.remove('hidden');
-
-        // Render any GitHub connection return-state now that the repo dataset is
-        // synchronized from the install-instructions payload (BAPI-506).
-        renderGitHubConnectionReturnState();
     } catch (error) {
         if (loadingEl) loadingEl.classList.add('hidden');
         if (contentEl) contentEl.classList.add('hidden');
 
-        const msgEl = document.getElementById('get-started-error-msg');
-        if (msgEl) {
-            msgEl.textContent = (0,_utils_js__WEBPACK_IMPORTED_MODULE_1__.getApiErrorMessage)(error, 'Failed to load install instructions.');
-        }
-        if (errorEl) errorEl.classList.remove('hidden');
+        // The scoped sentence is the message; the shared sanitizer's detail rides
+        // along parenthetically as a diagnostic aside so it reads as an aside
+        // rather than a dangling fragment of the sentence before it.
+        const detail = (0,_utils_js__WEBPACK_IMPORTED_MODULE_1__.getApiErrorMessage)(error, 'Failed to load install instructions.');
+        showMcpError(`${UI_STRINGS.mcpErrorScope} (${detail})`);
     }
 }
 
@@ -2379,11 +2422,18 @@ function setInstallKeyLoading(loading) {
     const btn = document.getElementById('generate-install-key-btn');
     const panel = document.getElementById('install-key-panel');
     const errorEl = document.getElementById('install-key-error');
+    const statusEl = document.getElementById('install-key-status');
     if (loading) {
         if (errorEl) {
             errorEl.textContent = '';
             errorEl.classList.add('hidden');
         }
+        // Drop any prior success/warning styling so a new attempt cannot inherit
+        // the semantics of the last one. Never logs or exposes the key itself.
+        if (statusEl) {
+            statusEl.classList.remove('install-key-status--success', 'install-key-status--warning');
+            statusEl.textContent = 'Generating the admin install key…';
+        }
         if (btn) {
             btn.disabled = true;
             btn.textContent = 'Generating…';
@@ -2419,7 +2469,7 @@ async function handleGenerateInstallKeyClick() {
     // Security page, so we accept this over reusing/auto-revoking prior keys.
     if (generatedInstallKey) return;
 
-    const repoName = container.dataset.repoName;
+    const repoName = getGitHubRepoName();
     if (!repoName) {
         showInstallKeyError('Could not generate the install key. Please try again.');
         return;
@@ -2478,10 +2528,21 @@ async function handleGenerateInstallKeyClick() {
     const resultEl = document.getElementById('install-key-result');
     if (resultEl) resultEl.classList.remove('hidden');
 
-    injectInstallKeyIntoSnippets(apiKey);
+    // Report what actually happened. injectInstallKeyIntoSnippets returns the
+    // number of slots it filled; zero means the snippets were never rendered
+    // (e.g. the optional MCP fetch failed), so claiming insertion would be a
+    // lie the user cannot verify (BAPI-630 / CI-2).
+    const insertedSlotCount = injectInstallKeyIntoSnippets(apiKey);
 
     const statusEl = document.getElementById('install-key-status');
-    if (statusEl) statusEl.textContent = 'Admin install key generated and inserted into the snippets.';
+    if (statusEl) {
+        const inserted = insertedSlotCount > 0;
+        statusEl.textContent = inserted
+            ? UI_STRINGS.installKeyInserted
+            : UI_STRINGS.installKeyNoSlots;
+        statusEl.classList.toggle('install-key-status--success', inserted);
+        statusEl.classList.toggle('install-key-status--warning', !inserted);
+    }
 
     // Permanently disable the button after success to avoid repeated minting.
     const btn = document.getElementById('generate-install-key-btn');
@@ -2536,9 +2597,7 @@ function initializeInstallKeyGeneration(container) {
 // ============================================================
 
 function getGitHubRepoName() {
-    const container = document.getElementById('get-started-container');
-    const repoName = container && container.dataset ? container.dataset.repoName : '';
-    return (repoName || '').trim();
+    return currentRepoName;
 }
 
 function setGitHubConnectLoading(loading) {
@@ -2756,6 +2815,11 @@ function init() {
     const container = document.getElementById('get-started-container');
     if (!container) return;
 
+    // Seed the shared repo-name state once from the server-rendered dataset.
+    // Every later read goes through module state, so the GitHub button works on
+    // first paint without waiting for the optional MCP fetch (BAPI-630).
+    currentRepoName = ((container.dataset && container.dataset.repoName) || '').trim();
+
     (0,_modal_js__WEBPACK_IMPORTED_MODULE_0__.initModal)();
 
     // Click-driven install-key generation; does not mint a key on page load.
@@ -2764,6 +2828,11 @@ function init() {
     // Wire the "Connect GitHub" launch button (BAPI-506).
     initializeGitHubConnect();
 
+    // Render any ?githubConnection=<status> return state here — NOT from the
+    // install-instructions success path. A user coming back from GitHub must
+    // see the outcome even when the optional MCP fetch fails (BAPI-630 / R1).
+    renderGitHubConnectionReturnState();
+
     // Bind keyboard navigation once — renderSnippetTabs may run multiple times (retry),
     // so binding here prevents the listener from stacking on the tabList element.
     const tabList = document.getElementById('editor-tabs');
@@ -2809,11 +2878,8 @@ function init() {
 
     if (!projectId) {
         const loadingEl = document.getElementById('get-started-loading');
-        const errorEl = document.getElementById('get-started-error');
-        const msgEl = document.getElementById('get-started-error-msg');
         if (loadingEl) loadingEl.classList.add('hidden');
-        if (msgEl) msgEl.textContent = 'Missing projectId — please navigate here from your project dashboard.';
-        if (errorEl) errorEl.classList.remove('hidden');
+        showMcpError(UI_STRINGS.mcpMissingProject);
         return;
     }
 
@@ -3496,7 +3562,9 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   hideModal: () => (/* binding */ hideModal),
 /* harmony export */   initModal: () => (/* binding */ initModal),
-/* harmony export */   showModal: () => (/* binding */ showModal)
+/* harmony export */   replaceModalBody: () => (/* binding */ replaceModalBody),
+/* harmony export */   showModal: () => (/* binding */ showModal),
+/* harmony export */   showModalNode: () => (/* binding */ showModalNode)
 /* harmony export */ });
 // src/js/modal.js
 
@@ -3550,6 +3618,49 @@ function showModal(title, message, onConfirm = null, showCancel = false, onClose
     }
 }
 
+/**
+ * Show the modal with a caller-built DOM node as its body.
+ *
+ * Additive companion to {@link showModal} for rich, structured content (e.g. the
+ * SFCC ticket preview). The node is appended directly — never serialized through
+ * innerHTML — so untrusted values built with textContent stay safe. The caller
+ * supplies its own action controls inside `contentEl`, so the shared
+ * confirm/cancel actions are hidden. `onClose` runs when the modal is dismissed,
+ * letting the caller restore focus to the invoking element.
+ *
+ * @param {string} title - Modal header text.
+ * @param {HTMLElement} contentEl - Caller-created body node.
+ * @param {Function|null} onClose - Optional callback fired on dismiss.
+ */
+function showModalNode(title, contentEl, onClose = null) {
+    if (pageModalTitle) pageModalTitle.textContent = title;
+    replaceModalBody(contentEl);
+
+    currentConfirmCallback = null;
+    currentCloseCallback = onClose;
+
+    if (pageModalActions) pageModalActions.classList.add('hidden');
+    if (pageModal) {
+        pageModal.style.display = 'block';
+    } else {
+        console.error('Modal element not found.');
+    }
+}
+
+/**
+ * Replace the modal body with a caller-built DOM node without re-showing it.
+ *
+ * Used to transition the same open modal between states (processing → preview →
+ * success/error). Clears the previous content with textContent then appends the
+ * node — never innerHTML.
+ * @param {HTMLElement} contentEl
+ */
+function replaceModalBody(contentEl) {
+    if (!pageModalBody) return;
+    pageModalBody.textContent = '';
+    if (contentEl) pageModalBody.appendChild(contentEl);
+}
+
 /**
  * Hides the modal dialog.
  */
@@ -5063,10 +5174,12 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export */   resetProjectDetailBaseline: () => (/* binding */ resetProjectDetailBaseline),
 /* harmony export */   setupConditionalVisibilityListeners: () => (/* binding */ setupConditionalVisibilityListeners),
 /* harmony export */   setupValidationListeners: () => (/* binding */ setupValidationListeners),
+/* harmony export */   shouldWarnForBlankCriticalPriorities: () => (/* binding */ shouldWarnForBlankCriticalPriorities),
 /* harmony export */   toggleCiFollowupControlsVisibility: () => (/* binding */ toggleCiFollowupControlsVisibility),
 /* harmony export */   toggleDeepResearchTimeoutVisibility: () => (/* binding */ toggleDeepResearchTimeoutVisibility),
 /* harmony export */   toggleStoryPointsFieldVisibility: () => (/* binding */ toggleStoryPointsFieldVisibility),
 /* harmony export */   updateCiFollowupInstructionsByteCounter: () => (/* binding */ updateCiFollowupInstructionsByteCounter),
+/* harmony export */   updateCriticalPrioritiesWarning: () => (/* binding */ updateCriticalPrioritiesWarning),
 /* harmony export */   validateInput: () => (/* binding */ validateInput),
 /* harmony export */   validateReviewPolicyOverrides: () => (/* binding */ validateReviewPolicyOverrides)
 /* harmony export */ });
@@ -5097,6 +5210,44 @@ const estimateScaleJsonErrorDiv = document.getElementById('estimate_scale-error'
 // are sent to the backend.
 let projectDetailBaseline = null;
 
+// --- BAPI-590: critical-priorities blank-configuration warning ---
+// Non-blocking signal shown when the critical-priorities check is enabled but no
+// priorities are configured (the check is silently skipped). Defined once at
+// module scope so the client- and route-side copies stay identical.
+const CRITICAL_PRIORITIES_BLANK_WARNING =
+    'Critical-priorities checking is enabled, but no priorities are configured; this check will be skipped.';
+
+/**
+ * Whether the blank-priorities warning condition holds: the check is enabled and
+ * the priorities textarea is empty after trimming whitespace. Reads the checkbox
+ * and textarea directly from the DOM and is safe to call when either control is
+ * absent (returns false).
+ * @returns {boolean}
+ */
+function shouldWarnForBlankCriticalPriorities() {
+    const toggle = document.getElementById('check_critical_priorities');
+    const textarea = document.getElementById('critical_priorities');
+    if (!toggle || !textarea) return false;
+    return !!toggle.checked && (textarea.value || '').trim() === '';
+}
+
+/**
+ * Show or hide the dedicated critical-priorities warning container from the
+ * current control state. Guards every DOM lookup, sets text via textContent, and
+ * toggles only the `.hidden` class on the warning node (never inline display).
+ */
+function updateCriticalPrioritiesWarning() {
+    const warningEl = document.getElementById('critical_priorities-warning');
+    if (!warningEl) return;
+    if (shouldWarnForBlankCriticalPriorities()) {
+        warningEl.textContent = CRITICAL_PRIORITIES_BLANK_WARNING;
+        warningEl.classList.remove('hidden');
+    } else {
+        warningEl.textContent = '';
+        warningEl.classList.add('hidden');
+    }
+}
+
 // --- Custom DOM value readers for fields the shared diff util cannot read by id ---
 
 /**
@@ -5907,10 +6058,22 @@ function setupConditionalVisibilityListeners() {
         reviewPolicyResetAll.addEventListener('click', handleReviewPolicyResetAll);
     }
 
-    // Apply initial state for all three dependent regions before baseline capture.
+    // BAPI-590: refresh the non-blocking critical-priorities warning whenever the
+    // check is toggled or the priorities text changes.
+    const checkCriticalPriorities = document.getElementById('check_critical_priorities');
+    if (checkCriticalPriorities) {
+        checkCriticalPriorities.addEventListener('change', updateCriticalPrioritiesWarning);
+    }
+    const criticalPriorities = document.getElementById('critical_priorities');
+    if (criticalPriorities) {
+        criticalPriorities.addEventListener('input', updateCriticalPrioritiesWarning);
+    }
+
+    // Apply initial state for all dependent regions before baseline capture.
     toggleDeepResearchTimeoutVisibility();
     toggleStoryPointsFieldVisibility();
     toggleCiFollowupControlsVisibility();
+    updateCriticalPrioritiesWarning();
 }
 
 // Canonical descriptor list driving baseline capture, sparse diffing, section
@@ -5964,21 +6127,13 @@ const PROJECT_DETAIL_FIELD_DESCRIPTORS = [
     { field: 'backend_correctness_standards', type: 'text', id: 'backend_correctness_standards' },
     { field: 'template_correctness_standards', type: 'text', id: 'template_correctness_standards' },
     { field: 'style_correctness_standards', type: 'text', id: 'style_correctness_standards' },
-    { field: 'reviewable_file_types', type: 'array', delimiter: ',', id: 'reviewable_file_types' },
-    { field: 'include_path', type: 'array', delimiter: '\n', id: 'include_path' },
-    { field: 'exclude_path', type: 'array', delimiter: '\n', id: 'exclude_path' },
-    { field: 'frontend_styleguide', type: 'text', id: 'frontend_styleguide' },
-    { field: 'backend_styleguide', type: 'text', id: 'backend_styleguide' },
-    { field: 'css_styleguide', type: 'text', id: 'css_styleguide' },
-    { field: 'review_correctness', type: 'boolean', id: 'review_correctness' },
-    { field: 'review_style', type: 'boolean', id: 'review_style' },
+    // BAPI-590: the simplified two-check reviewer surface (requirements check +
+    // critical-priorities check/text). The legacy reviewer controls (style guides,
+    // file types, include/exclude paths, correctness/style/architecture toggles,
+    // test/doc generation, documentation standards, score threshold) were removed.
     { field: 'review_requirements', type: 'boolean', id: 'review_requirements' },
-    { field: 'review_architecture', type: 'boolean', id: 'review_architecture' },
-    { field: 'create_tests', type: 'boolean', id: 'create_tests' },
-    { field: 'create_documentation', type: 'boolean', id: 'create_documentation' },
-    { field: 'documentation_standards', type: 'text', id: 'documentation_standards' },
-    { field: 'score_threshold_for_review', type: 'text', id: 'score_threshold_for_review' },
-    { field: 'no_comment_on_passing_score', type: 'boolean', id: 'no_comment_on_passing_score' },
+    { field: 'check_critical_priorities', type: 'boolean', id: 'check_critical_priorities' },
+    { field: 'critical_priorities', type: 'text', id: 'critical_priorities' },
 ];
 
 // Maps each descriptor field to exactly one backend payload section. The four
@@ -6022,21 +6177,9 @@ const FIELD_TO_SECTION = {
     backend_correctness_standards: 'code_reviewer',
     template_correctness_standards: 'code_reviewer',
     style_correctness_standards: 'code_reviewer',
-    reviewable_file_types: 'code_reviewer',
-    include_path: 'code_reviewer',
-    exclude_path: 'code_reviewer',
-    frontend_styleguide: 'code_reviewer',
-    backend_styleguide: 'code_reviewer',
-    css_styleguide: 'code_reviewer',
-    review_correctness: 'code_reviewer',
-    review_style: 'code_reviewer',
     review_requirements: 'code_reviewer',
-    review_architecture: 'code_reviewer',
-    create_tests: 'code_reviewer',
-    create_documentation: 'code_reviewer',
-    documentation_standards: 'code_reviewer',
-    score_threshold_for_review: 'code_reviewer',
-    no_comment_on_passing_score: 'code_reviewer',
+    check_critical_priorities: 'code_reviewer',
+    critical_priorities: 'code_reviewer',
 };
 
 /**
@@ -6173,7 +6316,9 @@ const EXPLANATION_TEXTS = {
     'css_styleguide': 'Describe style conventions for CSS/SASS/LESS code. Optional. If blank, CSS style reviews are skipped.',
     'review_correctness': 'Enable/disable checking code for bugs and errors. Defaults to true. Optional.',
     'review_style': 'Enable/disable checking code for style guide adherence. Defaults to true. Optional.',
-    'review_requirements': 'Enable/disable checking if the PR fulfills ticket requirements (requires ticket ID in branch/commit). Best for initial commits. Defaults to true. Optional.',
+    'review_requirements': 'When enabled, the code reviewer checks whether the pull request actually covers the ticket\'s stated requirements (requires a ticket ID in the branch or commit). Best for initial commits. Defaults to enabled.',
+    'check_critical_priorities': 'When enabled, the code reviewer additionally checks each pull request against the Critical Priorities you configure below. If this check is on but no priorities are configured, the check is skipped.',
+    'critical_priorities': 'The critical priorities the code reviewer holds every pull request to (e.g., "Never log secrets or PII", "All DB writes must be repo-scoped"). Leave blank to skip the critical-priorities check even when it is enabled.',
     'review_architecture': 'Enable/disable checking for integration errors and correctness (if correctness review is off). Defaults to true. Optional.',
     'create_tests': 'Enable/disable AI generation of unit/integration tests for the PR. Defaults to false. Optional.',
     'create_documentation': 'Enable/disable AI generation of documentation for the PR. Defaults to false. Optional.',
@@ -6468,24 +6613,18 @@ function populateProjectForms(data) {
         if (el) el.value = reviewer[field] || '';
     });
 
-    // Code Reviewer Form (hidden drawer - still populated to preserve values on save)
+    // Code Reviewer Form (BAPI-590: simplified two-check surface). The legacy
+    // reviewer controls were removed, so only the requirements check and the
+    // critical-priorities check/text are populated here.
     if (codeReviewForm) {
-        codeReviewForm.elements.reviewable_file_types.value = (0,_utils_js__WEBPACK_IMPORTED_MODULE_1__.arrayToString)(reviewer.reviewable_file_types || []);
-        codeReviewForm.elements.include_path.value = (reviewer.include_path || []).join('\n');
-        codeReviewForm.elements.exclude_path.value = (reviewer.exclude_path || []).join('\n');
-        codeReviewForm.elements.frontend_styleguide.value = reviewer.frontend_styleguide || '';
-        codeReviewForm.elements.backend_styleguide.value = reviewer.backend_styleguide || '';
-        codeReviewForm.elements.css_styleguide.value = reviewer.css_styleguide || '';
-        codeReviewForm.elements.review_correctness.checked = reviewer.review_correctness !== undefined ? reviewer.review_correctness : true;
-        codeReviewForm.elements.review_style.checked = reviewer.review_style !== undefined ? reviewer.review_style : true;
         codeReviewForm.elements.review_requirements.checked = reviewer.review_requirements !== undefined ? reviewer.review_requirements : true;
-        codeReviewForm.elements.review_architecture.checked = reviewer.review_architecture !== undefined ? reviewer.review_architecture : true;
-        codeReviewForm.elements.create_tests.checked = reviewer.create_tests || false;
-        codeReviewForm.elements.create_documentation.checked = reviewer.create_documentation || false;
-        codeReviewForm.elements.documentation_standards.value = reviewer.documentation_standards || '';
-        codeReviewForm.elements.score_threshold_for_review.value = reviewer.score_threshold_for_review !== undefined ? reviewer.score_threshold_for_review : 85;
-        codeReviewForm.elements.no_comment_on_passing_score.checked = reviewer.no_comment_on_passing_score !== undefined ? reviewer.no_comment_on_passing_score : true;
+        codeReviewForm.elements.check_critical_priorities.checked = !!reviewer.check_critical_priorities;
+        codeReviewForm.elements.critical_priorities.value = reviewer.critical_priorities || '';
     }
+
+    // Surface an already-invalid persisted state (check enabled, priorities blank)
+    // immediately after applying the returned reviewer values.
+    updateCriticalPrioritiesWarning();
 }
 
 /**
@@ -6566,9 +6705,18 @@ async function handleSaveProject() {
         const response = await (0,_utils_js__WEBPACK_IMPORTED_MODULE_1__.apiCall)(`/setup/project-detail/${currentProjectId}`, 'PUT', projectData);
 
         if (response) {
-            (0,_modal_js__WEBPACK_IMPORTED_MODULE_0__.showModal)('Success', 'Project configuration saved successfully!');
-            // Re-snapshot from the saved values so an immediate second save with
-            // no further edits is clean.
+            // BAPI-590: keep the adjacent priorities warning visible after save, and
+            // surface the route's optional warning as a saved-with-warning result
+            // rather than presenting the (successful) save as a failure.
+            updateCriticalPrioritiesWarning();
+            const savedWarning = typeof response.warning === 'string' ? response.warning.trim() : '';
+            if (savedWarning) {
+                (0,_modal_js__WEBPACK_IMPORTED_MODULE_0__.showModal)('Saved with warning', `Project configuration saved.\n\n${savedWarning}`);
+            } else {
+                (0,_modal_js__WEBPACK_IMPORTED_MODULE_0__.showModal)('Success', 'Project configuration saved successfully!');
+            }
+            // Re-snapshot from the saved values (the route-level warning accompanies a
+            // successful persist) so an immediate second save with no edits is clean.
             resetProjectDetailBaseline();
         }
         // A null response is the centralized 401 redirect (handled by apiCall);
@@ -6723,6 +6871,11 @@ function validateAllForms() {
         allValid = false;
     }
 
+    // BAPI-590: refresh the blank-priorities warning during pre-save validation.
+    // This is a non-blocking signal only — it never sets custom validity, adds
+    // `.input-error`, or flips `allValid`.
+    updateCriticalPrioritiesWarning();
+
     return allValid;
 }
 
@@ -6763,6 +6916,12 @@ function handleInputClearError(event) {
      if (element.id === 'ci_followup_instructions') {
          updateCiFollowupInstructionsByteCounter();
      }
+     // BAPI-590: the priorities warning lives in its own container (not the
+     // `-error` node), so clearing a genuine field error never erases it; refresh
+     // it here so live edits keep the warning state accurate.
+     if (element.id === 'critical_priorities') {
+         updateCriticalPrioritiesWarning();
+     }
 }
 
 /**