@wcag-checkr/ci 1.0.0-rc.366 → 1.0.0-rc.367

package/dist/side-panel/side-panel.html

@@ -4,7 +4,7 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>WCAG Component Auditor</title>
-    <script type="module" crossorigin src="/assets/side-panel-Dl247dJv.js"></script>
+    <script type="module" crossorigin src="/assets/side-panel-CuEUwRBD.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/modulepreload-polyfill-B5Qt9EMX.js">
     <link rel="modulepreload" crossorigin href="/assets/_commonjsHelpers-Cpj98o6Y.js">
     <link rel="modulepreload" crossorigin href="/assets/crash-reporter-7_6X-wSd.js">
@@ -12,10 +12,10 @@
     <link rel="modulepreload" crossorigin href="/assets/preload-helper-D7HrI6pR.js">
     <link rel="modulepreload" crossorigin href="/assets/diff-NSOR-wHP.js">
     <link rel="modulepreload" crossorigin href="/assets/ai-usage-log-CvwMbWGw.js">
-    <link rel="modulepreload" crossorigin href="/assets/scheduled-audit-runner-XCDyFhY6.js">
+    <link rel="modulepreload" crossorigin href="/assets/scheduled-audit-runner-9R-aGzwO.js">
     <link rel="modulepreload" crossorigin href="/assets/design-system-audit-DpxJrxnb.js">
-    <link rel="modulepreload" crossorigin href="/assets/ErrorBoundary-BH1wbHb3.js">
-    <link rel="modulepreload" crossorigin href="/assets/copy-ai-fixer-prompt-FO0N3IMf.js">
+    <link rel="modulepreload" crossorigin href="/assets/ErrorBoundary-Ck0XMUiQ.js">
+    <link rel="modulepreload" crossorigin href="/assets/copy-ai-fixer-prompt-CKp52Td1.js">
     <link rel="stylesheet" crossorigin href="/assets/styles-DZ8gnBYK.css">
     <link rel="stylesheet" crossorigin href="/assets/side-panel-Ctm2yXeo.css">
   </head>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wcag-checkr/ci",
-  "version": "1.0.0-rc.366",
+  "version": "1.0.0-rc.367",
   "private": false,
   "description": "Headless wcagcheckr accessibility audit runner for CI/CD pipelines. Drives the wcagcheckr Chrome extension via Playwright, runs full-page audits across the state matrix (108 combinations: hover, focus, dark mode, RTL, breakpoints), outputs JSON / SARIF / JUnit, exits with severity-aware codes.",
   "license": "UNLICENSED",

package/dist/side-panel/App.tsx

@@ -1,308 +0,0 @@
-import { useEffect, useState } from 'react';
-import { useStore } from './store';
-import {
-  HEADLESS_BUILD_LOCKDOWN,
-  isLockoutInEffectForTier,
-} from '../shared/headless-build-lockdown';
-// rc.79 — Reverted the rc.72 lazy-load NormalApp routing. Owner mode
-// goes back to using OwnerView (lawfare-risk grade, Quick/Thorough
-// scan depth, USER_RECIPES, full export set, no Suspense boundary).
-// rc.72's NormalApp stripped those features and added a chunk-load
-// step that wasn't there before; the regression wasn't worth the
-// "two code paths" structural symmetry it claimed.
-import {
-  wireMessaging,
-  refreshBaselineList,
-  refreshLicenseTier,
-  refreshUserMode,
-  startKeepalive,
-  loadLastAudit,
-  warmAndWatchRubrics,
-} from './wire-messaging';
-import { primeAuditLauncher } from './audit-launcher';
-import { sendToTab } from '../shared/messaging';
-import { getAuditTargetTabId } from '../shared/active-tab';
-import { loadAcknowledged } from '../shared/acknowledged-findings';
-import { getDismissalsForUrl } from '../shared/dismissals';
-import { loadSiteCrawlReport } from '../shared/site-crawl-storage';
-import { Header } from './components/Header';
-import { AuditControls } from './components/AuditControls';
-import { VisualizerTools } from './components/VisualizerTools';
-import { GatedView } from './components/GatedView';
-import { ProgressBar } from './components/ProgressBar';
-import { LastRunBanner } from './components/LastRunBanner';
-import { MatrixView } from './views/MatrixView';
-import { GeneralReportView } from './views/GeneralReportView';
-import { DeltaView } from './views/DeltaView';
-import { ActivityView } from './views/ActivityView';
-import { GuidedView } from './views/GuidedView';
-import { FlowsView } from './views/FlowsView';
-import { ScorecardView } from './views/ScorecardView';
-import { SiteCrawlPanel } from './components/SiteCrawlPanel';
-import { OnboardingModal } from './components/OnboardingModal';
-import { ErrorBanner } from './components/ErrorBanner';
-import { AiFailureBanner } from './components/AiFailureBanner';
-import { AiOffBanner } from './components/AiOffBanner';
-import { DebuggerBusyModal } from './components/DebuggerBusyModal';
-import { ResumeAuditBanner } from './components/ResumeAuditBanner';
-import { StorybookHint } from './components/StorybookHint';
-import { AuditFooter } from './components/AuditFooter';
-import { ComplianceDisclaimer } from './components/ComplianceDisclaimer';
-import { Announcer } from '../shared/announcer';
-import { OwnerView } from './views/OwnerView';
-import { ForensicLogView } from './views/ForensicLogView';
-import { WcagEmView } from './views/WcagEmView';
-import { SchedulesView } from './views/SchedulesView';
-import { RiskView } from './views/RiskView';
-import { CopilotView } from './views/CopilotView';
-import { AxTreeView } from './views/AxTreeView';
-import { Wcag3View } from './views/Wcag3View';
-import { DesignSystemView } from './views/DesignSystemView';
-import { OnboardingChecklist } from './components/OnboardingChecklist';
-import { UpgradeCard } from './components/UpgradeCard';
-import { CriticalBanner } from './components/MessagesBell';
-import { LicenseRequiredView } from './views/LicenseRequiredView';
-
-export function App() {
-  const view = useStore((s) => s.view);
-  const userMode = useStore((s) => s.userMode);
-  const tier = useStore((s) => s.tier);
-  // rc.124 — Headless-build lockdown. When active, only team-license holders
-  // get the full UI; everyone else sees the license-entry surface. The check
-  // is rendered EARLY so no other UI mounts for locked-out users (no audit
-  // controls, no visualizers, no exports). The audit dispatchers + export
-  // handlers also gate on the same helper for defense-in-depth.
-  const [tierResolved, setTierResolved] = useState(false);
-  useEffect(() => {
-    // Wait one tick for the initial refreshLicenseTier() call below to land
-    // before deciding lockout — otherwise the store's default 'trial' would
-    // render LicenseRequiredView for a real team license that's still being
-    // validated.
-    const t = setTimeout(() => setTierResolved(true), 600);
-    return () => clearTimeout(t);
-  }, []);
-  const lockoutActive = HEADLESS_BUILD_LOCKDOWN && tierResolved && isLockoutInEffectForTier(tier);
-
-  useEffect(() => {
-    const port = startKeepalive();
-    // Detect runtime context: iframe-overlay vs chrome.sidePanel.
-    //   ?context=overlay → loaded by modules/sidebar-handle.ts inside the page
-    //   no query param   → loaded by chrome.sidePanel (the fallback during audits)
-    // Only the chrome.sidePanel instance opens the tracker port — its disconnect
-    // is the SW's signal that the fallback UI just closed, time to restore the
-    // in-page overlay.
-    const isOverlayContext =
-      new URLSearchParams(window.location.search).get('context') === 'overlay';
-    const trackerPort = isOverlayContext
-      ? null
-      : chrome.runtime.connect({ name: 'sidepanel-tracker' });
-    const off = wireMessaging();
-    // Defensive .catch — these are bootstrapping side effects; failures should not
-    // surface as uncaught promise rejections in the console.
-    // First load: bypass the 24h license cache so the UpgradeCard reads
-    // any newly-added server fields (seats counts, cancel-at-period-end,
-    // single-month plan code, etc.). Subsequent LICENSE_CHANGED_EVENT
-    // refreshes use the cache normally — the SW already invalidates it
-    // on every LICENSE_SET_REQUEST.
-    refreshLicenseTier({ forceRefresh: true }).catch(() => {});
-    refreshBaselineList().catch(() => {});
-    refreshUserMode().catch(() => {});
-    warmAndWatchRubrics().catch(() => {});
-    // Pre-cache windowId so audit-start click handlers can open
-    // chrome.sidePanel synchronously (preserves user-gesture context).
-    primeAuditLauncher().catch(() => {});
-    // Load any persisted audit. Results stay until the user clicks Clear —
-    // switching tabs or navigating the audited page no longer wipes them.
-    // The Header shows the audited domain so the user always knows which
-    // page the displayed results belong to.
-    loadLastAudit().catch(() => {});
-    // rc.37 — load the user's "acknowledged" matchKeys so every
-    // ViolationCard can render the acknowledged pill immediately on
-    // mount (in every view, not just Delta).
-    loadAcknowledged()
-      .then((all) => {
-        useStore.getState().setAcknowledgedKeys(new Set(all.map((a) => a.matchKey)));
-      })
-      .catch(() => {});
-
-    // rc.200 — Subscribe to results changes and reload dismissals for
-    // the audited page URL. Dismissals are URL-scoped (not matchKey-
-    // scoped like acks), so we re-fetch every time a new audit
-    // completes against a different page.
-    const unsubResults = useStore.subscribe((state, prev) => {
-      const url = state.results[0]?.pageUrl;
-      const prevUrl = prev.results[0]?.pageUrl;
-      if (!url || url === prevUrl) return;
-      void getDismissalsForUrl(url)
-        .then((d) => {
-          useStore.getState().setDismissedKeys(new Set(Object.keys(d)));
-        })
-        .catch(() => {});
-    });
-
-    // rc.111 — rehydrate the most-recent site-crawl report so the AI fixer
-    // prompt's "## Site-wide context" section survives panel close / SW
-    // restart. setState (not setSiteCrawlReport) so we don't re-write the
-    // same data back to storage on hydration.
-    // rc.263 — Phase 2 of screen consolidation: when a crawl is in
-    // storage on side-panel open AND the user hasn't navigated
-    // somewhere else yet, default the view to 'crawl' so they land
-    // on the new inline-expandable master view instead of the empty
-    // Dashboard. Cliff: "we have so many screens for the user that
-    // it is fully confusing." If results from a single-page audit
-    // also exist, prefer 'report' (the user just did an audit and
-    // wants to see those results). View stays at whatever the user
-    // explicitly switches to after first paint.
-    loadSiteCrawlReport()
-      .then((report) => {
-        if (!report) return;
-        useStore.setState((prev) => {
-          const next: Partial<typeof prev> = { siteCrawlReport: report };
-          if (prev.view === 'matrix' && prev.results.length === 0) {
-            next.view = 'crawl';
-          }
-          return next;
-        });
-      })
-      .catch(() => {});
-
-    // Esc inside the side panel clears the highlight pin. The page's own keydown
-    // handler (in element-highlighter) only fires when the page has focus.
-    const onEsc = (e: KeyboardEvent) => {
-      if (e.key !== 'Escape') return;
-      const { pinnedMatchKey, setPinned, results } = useStore.getState();
-      if (!pinnedMatchKey) return;
-      setPinned(null);
-      void getAuditTargetTabId().then((tabId) => {
-        if (!tabId) return;
-        sendToTab(
-          tabId,
-          { type: 'HIGHLIGHT_CLEAR_REQUEST', tabId },
-          results[0]?.frameId
-        ).catch(() => {});
-      });
-    };
-    window.addEventListener('keydown', onEsc);
-
-    return () => {
-      off();
-      port.disconnect();
-      trackerPort?.disconnect();
-      window.removeEventListener('keydown', onEsc);
-      unsubResults();
-    };
-  }, []);
-
-  // rc.124 — Headless-build lockdown takes precedence over EVERY other view.
-  // No persona wizard, no owner view, no dev view. Just the license entry.
-  if (lockoutActive) {
-    return (
-      <>
-        <LicenseRequiredView />
-        <Announcer />
-      </>
-    );
-  }
-
-  // rc.333 — Wizard removed. main.tsx Root resolves missing userMode
-  // to 'owner' (the simpler default) before this component ever
-  // mounts. The PersonaSwitcher at the top of every UI lets users
-  // flip to power-user or dev whenever they want; the settings page
-  // sets the persisted default. If anything still passes null
-  // through (programmatic store reset, defensive recovery), fall
-  // through to owner mode below.
-
-  // Owner mode — simplified surface. No view tabs, no visualizers, no IGT.
-  // OwnerView holds its own header + footer for the simplified flow.
-  // (rc.79 reverted the rc.72 NormalApp routing; OwnerView is the right
-  // surface for Owner mode and was working before I broke it.)
-  if (userMode === 'owner' || userMode === null) {
-    return (
-      <>
-        <OwnerView />
-        <DebuggerBusyModal />
-        <Announcer />
-      </>
-    );
-  }
-
-  // Dev mode — full feature surface (everything that existed before).
-  // Power-user mode is rendered by V2App via main.tsx's Root router —
-  // we should never reach here with userMode === 'power'.
-  return (
-    <div className="flex flex-col h-screen bg-slate-50 text-slate-900 text-sm">
-      {/* Skip link — visually hidden by default; revealed on focus so keyboard
-          users can jump past the header/UpgradeCard chrome straight to the
-          audit results. Required for WCAG 2.4.1 (Bypass Blocks) when there
-          are many tab stops before the main content. */}
-      <a
-        href="#main-content"
-        className="sr-only focus:not-sr-only focus:fixed focus:top-2 focus:left-2 focus:z-50 focus:bg-white focus:text-slate-900 focus:px-3 focus:py-1.5 focus:rounded focus:shadow focus:outline focus:outline-2 focus:outline-brand-500"
-      >
-        Skip to main content
-      </a>
-      <UpgradeCard />
-      <CriticalBanner />
-      <Header />
-      <OnboardingChecklist />
-      <main
-        id="main-content"
-        className="flex-1 flex flex-col overflow-hidden"
-        aria-label="wcagcheckr"
-      >
-        {/* rc.163 — Audit-launching surface (mode picker, throttle, target
-            chooser, visualizer toggles, storybook hint, resume banner) is
-            only relevant on the Dashboard, where the user is configuring
-            and starting an audit. On Findings and the other specialized
-            views these widgets just clutter the screen — Cliff: "remove
-            the form fields from the findings tab — distracting and
-            serves no real purpose being there — the tab will be better
-            fully focused on the findings."
-            Progress / error / AI-failure banners stay GLOBAL because
-            they're audit-state alerts the user needs to see regardless
-            of which view they happened to navigate to. */}
-        {view === 'matrix' && (
-          <>
-            <AuditControls />
-            <VisualizerTools />
-            <StorybookHint />
-            <ResumeAuditBanner />
-          </>
-        )}
-        <ProgressBar />
-        <ErrorBanner />
-        <AiFailureBanner />
-        <AiOffBanner />
-        {/* rc.351 — Surface an existing run in every mode (Phase 1 of the
-            single-data-pool work). Hidden when already on the run's view. */}
-        <LastRunBanner
-          viewingRun={view === 'crawl' || view === 'report'}
-          onView={() => useStore.getState().setView(useStore.getState().siteCrawlReport ? 'crawl' : 'report')}
-        />
-        <div className="flex-1 overflow-y-auto" role="region" aria-label={`${view} view`}>
-          {view === 'matrix' && <MatrixView />}
-          {view === 'report' && <GeneralReportView />}
-          {view === 'delta' && <DeltaView />}
-          {view === 'activity' && <ActivityView />}
-          {view === 'guided' && <GatedView feature="igtWorkflows" label="Intelligent Guided Tests"><GuidedView /></GatedView>}
-          {view === 'flows' && <GatedView feature="flowRecorder" label="Flow recorder"><FlowsView /></GatedView>}
-          {view === 'scorecard' && <ScorecardView />}
-          {view === 'crawl' && <GatedView feature="siteCrawl" label="Site crawl"><SiteCrawlPanel /></GatedView>}
-          {view === 'forensic' && <GatedView feature="forensicLog" label="Forensic log"><ForensicLogView /></GatedView>}
-          {view === 'compliance' && <GatedView feature="wcagEmReport" label="WCAG-EM conformance report"><WcagEmView /></GatedView>}
-          {view === 'schedules' && <GatedView feature="scheduledAudits" label="Scheduled audits"><SchedulesView /></GatedView>}
-          {view === 'risk' && <GatedView feature="riskDashboard" label="Risk dashboard"><RiskView /></GatedView>}
-          {view === 'copilot' && <GatedView feature="aiCopilot" label="AI Copilot"><CopilotView /></GatedView>}
-          {view === 'ax-tree' && <GatedView feature="axTreeViewer" label="AX-tree viewer"><AxTreeView /></GatedView>}
-          {view === 'wcag3' && <GatedView feature="wcag3Preview" label="WCAG 3 preview"><Wcag3View /></GatedView>}
-          {view === 'tokens' && <GatedView feature="designSystemAudit" label="Design-system audit"><DesignSystemView /></GatedView>}
-        </div>
-      </main>
-      <ComplianceDisclaimer />
-      <AuditFooter />
-      <OnboardingModal />
-      <DebuggerBusyModal />
-      <Announcer />
-    </div>
-  );
-}

package/dist/side-panel/README.md

@@ -1,57 +0,0 @@
-# side-panel/
-
-The user-facing UI surface. Spec: `phase-1-specs.md` §9 (Zustand) + §11 (panel structure).
-
-## Component map
-
-```
-App.tsx
-├── Header                    (title + version + tier badge + Upgrade/License/Settings/Support buttons + view tabs)
-├── AuditControls             (mode select, Pick/Audit-all button, Stop button, upgrade-modal trigger)
-├── StorybookHint             (banner: shown if active tab is a Storybook page on first open)
-├── ResumeAuditBanner         (banner: shown if a previous audit was interrupted)
-├── ProgressBar               (shown only while status === 'running')
-├── ErrorBanner               (shown only while status === 'failed')
-├── <view>                    (matrix | delta | scorecard, picked by store.view)
-├── AuditFooter               (always-visible: tracked count + last-audit relative time)
-├── OnboardingModal           (first-run, explains chrome.debugger banner)
-└── DebuggerBusyModal         (DEBUGGER_BUSY events open this)
-```
-
-## State
-
-`store.ts` defines a single Zustand store. Slices: `auditState`, `progress`, `results`, `delta`, `componentId`, `errorMessage`, `baselineList`, `tier`, `view`. Setters are flat methods on the store.
-
-`wire-messaging.ts` subscribes the store to messaging events:
-- `AUDIT_PROGRESS_EVENT` → `setProgress` + `setStatus('running')`
-- `AUDIT_COMPLETE_EVENT` → `setResults` + persist to `chrome.storage.local` for next-open hydrate
-- `AUDIT_FAILED_EVENT` → `setError`
-- `LICENSE_CHANGED_EVENT` → re-fetch tier
-- `SCORECARD_UPDATED_EVENT` → re-fetch baseline list
-
-`loadLastAudit()` runs on App mount to restore previous results.
-
-## ErrorBoundary
-
-Wraps the App root in `main.tsx`. Catches React render errors so a single broken view doesn't blank the whole panel. Shows a Reload button that calls `location.reload()`.
-
-## Keepalive
-
-`startKeepalive()` opens a `chrome.runtime.connect({ name: 'audit-keepalive' })` port on App mount. While this port is open, Chrome won't suspend the service worker — keeps in-flight audits alive.
-
-## Reusable bits
-
-- `IconButton` — consistent text-button styling for icon-only triggers (settings ⚙, support ?). Required `ariaLabel`.
-- `Modal` — Radix Dialog wrapper with consistent overlay + sizing.
-- `ViolationCard` — used by both Matrix and Delta views.
-- `UpgradePrompt` — used by Header upgrade modal + AuditControls upgrade modal.
-- `format-component-id.ts` — pretty-display of canonical IDs (e.g., `::story:atoms-button--primary` → "Atoms Button / Primary").
-
-## Tier gating in the UI
-
-Performed locally against `TIER_RULES` from `shared/tier-rules` once `tier` is in the store. No round-trip per gate check.
-
-- `AuditControls` blocks "All stories" mode when `!isFeatureAllowed(tier, 'storybookAutoIterate')`
-- `DeltaView` blocks "Accept as baseline" when free + already has 1 baseline; blocks Export when below paid tier
-- `ScorecardView` shows a banner when free user is at the baseline limit
-- `Header` shows the Upgrade CTA when tier is `trial` or `free`

package/dist/side-panel/audit-launcher.test.ts

@@ -1,56 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { openFallbackPanel, primeAuditLauncher } from './audit-launcher';
-
-// chrome.sidePanel.open requires a live user-gesture and silently no-ops
-// without one. The contract this test guards: openFallbackPanel runs
-// SYNCHRONOUSLY relative to its caller — it does not await — so when
-// invoked from a click handler the user-gesture is still alive at call
-// time. Any future refactor that awaits inside this function silently
-// breaks the bug fix it backs (Load state on narrow-breakpoint violations
-// must open chrome.sidePanel as fallback before the viewport shrinks the
-// overlay out of existence).
-
-describe('openFallbackPanel', () => {
-  const openSpy = vi.fn();
-  beforeEach(() => {
-    openSpy.mockReset();
-    (globalThis as unknown as { chrome: unknown }).chrome = {
-      sidePanel: { open: openSpy.mockResolvedValue(undefined) },
-      windows: { getCurrent: vi.fn().mockResolvedValue({ id: 42 }) },
-    };
-  });
-
-  it('does nothing when not primed (no cached windowId)', () => {
-    // primeAuditLauncher hasn't run yet → no cached windowId → fallback
-    // open should silently no-op rather than throw.
-    openFallbackPanel();
-    expect(openSpy).not.toHaveBeenCalled();
-  });
-
-  it('opens chrome.sidePanel with the cached windowId after priming', async () => {
-    await primeAuditLauncher();
-    openFallbackPanel();
-    expect(openSpy).toHaveBeenCalledOnce();
-    expect(openSpy).toHaveBeenCalledWith({ windowId: 42 });
-  });
-
-  it('does not throw when chrome.sidePanel is missing (ui-preview / test contexts)', async () => {
-    (globalThis as unknown as { chrome: unknown }).chrome = {
-      windows: { getCurrent: vi.fn().mockResolvedValue({ id: 7 }) },
-    };
-    await primeAuditLauncher();
-    expect(() => openFallbackPanel()).not.toThrow();
-  });
-
-  it('the call is synchronous — returns before chrome.sidePanel.open resolves', async () => {
-    // Promise that never resolves, simulating Chrome holding the open()
-    // promise pending. If openFallbackPanel awaited it, the caller would
-    // hang forever — the test would time out.
-    const neverResolves = new Promise<void>(() => {});
-    openSpy.mockReturnValue(neverResolves);
-    await primeAuditLauncher();
-    // No await — must return immediately even though open() never settles.
-    openFallbackPanel();
-    expect(openSpy).toHaveBeenCalled();
-  });
-});

package/dist/side-panel/audit-launcher.ts

@@ -1,98 +0,0 @@
-// Audit launcher — wraps every START_AUDIT / START_SITE_CRAWL dispatch with
-// an opening of chrome.sidePanel as the fallback UI.
-//
-// Why this exists: chrome.debugger viewport emulation during an audit affects
-// everything in the audited tab — including our in-page sidebar overlay
-// (which then gets squished into the emulated viewport and visually trapped).
-// The in-page overlay therefore HIDES during audits (service-worker broadcasts
-// SIDEBAR_HIDE_REQUEST). chrome.sidePanel is the only UI surface that renders
-// OUTSIDE the tab's render tree, so we open it as the fallback so users still
-// see progress + stop controls.
-//
-// Why this can't live in the SW: chrome.sidePanel.open() requires a user-
-// gesture context. User gestures DO propagate through chrome.runtime.send-
-// Message into the SW, but Chrome consumes the gesture as soon as the SW
-// awaits anything (chrome.tabs.query, etc.). Calling chrome.sidePanel.open
-// synchronously from the original click handler — before any await — is the
-// only reliable path. To do that we need the windowId synchronously, so we
-// pre-cache it on side-panel mount.
-
-import { send } from '../shared/messaging';
-import type { StartAuditAction, StartSiteCrawl, StartCrawlDiscovery } from '../shared/messages';
-import { saveSiteCrawlReport } from '../shared/site-crawl-storage';
-import { useStore } from './store';
-
-let cachedWindowId: number | null = null;
-
-/** Pre-fetch the side-panel's window id so audit launches can open
- *  chrome.sidePanel synchronously without burning user-gesture context on
- *  an await. Call once on side-panel mount. Idempotent. */
-export async function primeAuditLauncher(): Promise<void> {
-  if (cachedWindowId !== null) return;
-  try {
-    const w = await chrome.windows.getCurrent();
-    if (typeof w.id === 'number') cachedWindowId = w.id;
-  } catch {
-    // chrome.windows is unavailable in some contexts (ui-preview shim) —
-    // launcher gracefully degrades; user just loses the fallback panel.
-  }
-}
-
-/** Open chrome.sidePanel synchronously while the click-handler user-gesture
- *  is still live. Returns immediately; the open() promise resolves later but
- *  the gesture is consumed at call time, which is what matters.
- *
- *  Exported so call sites OTHER than audit-launch (e.g. ViolationCard's
- *  Load state link, which drives the page through a narrow-breakpoint
- *  state) can pre-open the fallback before issuing their async work. */
-export function openFallbackPanel(): void {
-  if (cachedWindowId === null) return;
-  // Guard chrome.sidePanel access — the API isn't present in non-extension
-  // contexts (tests, ui-preview).
-  const api = chrome.sidePanel;
-  if (!api || typeof api.open !== 'function') return;
-  api.open({ windowId: cachedWindowId }).catch(() => {
-    // best-effort — failures here just mean the user won't see the fallback
-    // panel, which is acceptable. The audit still runs.
-  });
-}
-
-/** Drop-in replacement for `send(startAuditMessage)` at audit-start sites.
- *  Opens chrome.sidePanel first (preserving user-gesture), then dispatches
- *  the audit start to the service worker. Use for both START_AUDIT and
- *  START_SITE_CRAWL — both run the state-matrix audit pipeline.
- *
- *  rc.165 — Clear the cached site-crawl report at every audit start.
- *  Cliff's mental model: "remember when I click baseline, else not."
- *  Pre-rc.165 the crawl report persisted in chrome.storage.local
- *  forever (rc.111 added the persistence to survive panel close mid-
- *  crawl), so a single-page audit run days after a crawl would pull
- *  the stale crawl into the AI fix prompt's "Site-wide context"
- *  section. Now the crawl is session-ephemeral: any new audit start
- *  (single-page OR a fresh crawl) wipes the cached report. If the
- *  audit is itself a crawl, the new crawl will write a fresh report
- *  at completion. */
-export function launchAudit(msg: StartAuditAction | StartSiteCrawl): void {
-  openFallbackPanel();
-  // Clear in-memory store first so any UI reads the empty state
-  // immediately, then clear persisted storage (best-effort).
-  useStore.getState().setSiteCrawlReport(null);
-  void saveSiteCrawlReport(null).catch(() => {
-    // Storage clears are best-effort; the in-memory clear above is the
-    // user-visible source of truth for the current session.
-  });
-  void send(msg);
-}
-
-/** rc.344 — Launch the discovery-only pass for the review-before-audit
- *  flow. Same gesture-preserving fallback-panel open as launchAudit (the
- *  discovery pass navigates the target tab, so the in-page overlay hides
- *  and the side panel is the user's progress surface), then dispatches
- *  START_CRAWL_DISCOVERY. Clears the stale crawl report too — same
- *  "new crawl start wipes the old report" mental model as launchAudit. */
-export function launchDiscovery(msg: StartCrawlDiscovery): void {
-  openFallbackPanel();
-  useStore.getState().setSiteCrawlReport(null);
-  void saveSiteCrawlReport(null).catch(() => {});
-  void send(msg);
-}

package/dist/side-panel/azure-devops-issue.test.ts

@@ -1,68 +0,0 @@
-// rc.139 — G9 — Unit tests for the Azure DevOps issue URL builder.
-
-import { describe, it, expect } from 'vitest';
-import { buildAzureDevOpsIssueUrl } from './azure-devops-issue';
-import type { Violation } from '../types/audit';
-
-function v(over: Partial<Violation> = {}): Violation {
-  return {
-    ruleId: 'image-alt', wcagCriterion: '1.1.1', wcagLevel: 'A', impact: 'serious',
-    description: 'Images must have alt', helpUrl: 'https://x',
-    target: { selector: 'img.hero', outerHTML: '<img>', failureSummary: '', tagName: 'IMG', role: null, accessibleName: null, textSnippet: null, attrId: null, attrTestid: null },
-    componentId: '::c', currentState: { pseudoState: 'default', theme: 'light', direction: 'ltr', viewport: 'desktop' } as unknown as Violation['currentState'],
-    axeVersion: '4.11.4', detectedAt: '2026-05-22T00:00:00Z', matchKey: 'mk',
-    ...over,
-  };
-}
-
-describe('buildAzureDevOpsIssueUrl (rc.139)', () => {
-  it('builds a URL targeting the Bug type by default', () => {
-    const r = buildAzureDevOpsIssueUrl('https://dev.azure.com/myorg/myproject', '::c', [v()]);
-    expect(r.url.startsWith('https://dev.azure.com/myorg/myproject/_workitems/create/Bug?')).toBe(true);
-  });
-
-  it('honors a custom work-item type', () => {
-    const r = buildAzureDevOpsIssueUrl(
-      'https://dev.azure.com/myorg/myproject',
-      '::c',
-      [v()],
-      'Accessibility Defect',
-    );
-    expect(r.url).toContain('/_workitems/create/Accessibility%20Defect?');
-  });
-
-  it('embeds title + description as bracketed params', () => {
-    const r = buildAzureDevOpsIssueUrl('https://dev.azure.com/myorg/myproject', '::c', [v()]);
-    // URLSearchParams encodes the bracket bytes; verify presence in the URL.
-    expect(r.url).toMatch(/%5BTitle%5D=/);
-    expect(r.url).toMatch(/%5BDescription%5D=/);
-    expect(r.title).toContain('1 new violation');
-    expect(r.description).toContain('image-alt');
-    expect(r.description).toContain('1.1.1');
-  });
-
-  it('caps URL length at 7800', () => {
-    // Build a huge violation set to overflow.
-    const many = Array.from({ length: 200 }, (_, i) =>
-      v({
-        ruleId: `rule-${i}`,
-        target: { ...v().target, selector: `.really.long.selector.with.lots.of.classes.number-${i}` },
-      }),
-    );
-    const r = buildAzureDevOpsIssueUrl('https://dev.azure.com/org/proj', '::c', many);
-    expect(r.url.length).toBeLessThanOrEqual(7800);
-  });
-
-  it('dedupes by rule + selector + aggregates state labels', () => {
-    const viols = [
-      v({ matchKey: 'a', currentState: { pseudoState: 'default', theme: 'light', direction: 'ltr', viewport: 'desktop' } as unknown as Violation['currentState'] }),
-      v({ matchKey: 'b', currentState: { pseudoState: 'hover', theme: 'light', direction: 'ltr', viewport: 'desktop' } as unknown as Violation['currentState'] }),
-    ];
-    const r = buildAzureDevOpsIssueUrl('https://dev.azure.com/org/proj', '::c', viols);
-    // Single ticket section since the rule + selector matched.
-    expect(r.description.match(/### `image-alt`/g)?.length).toBe(1);
-    // But both states aggregated.
-    expect(r.description).toContain(':default');
-    expect(r.description).toContain(':hover');
-  });
-});