chore: quick wins from OSS audit (#203, #204, #211, #212)#214
Merged
Conversation
- #203: Move uv build cache mount in extralit-server Dockerfile to a user-owned path and set UV_CACHE_DIR explicitly. - #204: Onboarding docs cleanup — fix `bash` fence in README, fill in TBD sections of SDK README with a runnable Settings/Dataset example, point root AGENTS.md at the existing per-component CLAUDE.md files, add `examples/README.md`, and add a "Choose a dev environment" section to CONTRIBUTING.md. - #211: Argilla → Extralit rebrand sweep on the frontend. Renames the BackendEnvironment.argilla key to .extralit (matches the server schema, which was already returning extralit:), updates the argillaDatasets i18n key, swaps docs.argilla.io → docs.extralit.ai in ja.js, and replaces 84 Recognai S.L. copyright headers with the Extralit Labs convention used in extralit-server. Working /how-to-configure-argilla-on-huggingface/ doc URLs and the argilla-dev localStorage key are intentionally retained — the former because the renamed paths 404 on docs.extralit.ai today, the latter to avoid breaking installed dev extensions. - #212: Already satisfied — .cursor/, .vscode/, .ruff_cache/ are not tracked and are listed in .gitignore. No change required. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
Strix is installed on this repository, but we could not run this PR security review because this workspace does not have an active plan. If you'd like to continue receiving code reviews, you can add a payment method or manage billing here. |
- Deleted AGENTS.md and replaced it with a new CLAUDE.md file containing the same content. - Updated the project setup documentation to improve clarity and organization. - Ensured that component-specific setup instructions are now centralized in CLAUDE.md.
useImportFileUploadViewModel.spec.ts was committed empty in #200, which fails Jest ("Your test suite must contain at least one test") and broke the frontend CI test step on develop. Add an it.todo placeholder so the suite is green until real tests are written. Also prune HANDOVER.md to reflect PR #214 verification (lint/tests/build green for the PR's changes; #203/#204/#211/#212 confirmed). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
All checks pass on 6c7c48a; build (3.9) flake was a transient registry timeout, green on re-run. PR ready to merge. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Modified .gitignore to exclude all VSCode settings except for settings.json and extensions.json. - Updated CLAUDE.md to run `uv sync` in development mode. - Adjusted CI workflows to use `uv sync --dev` for installing dependencies. - Added VSCode configuration files for Python development. - Updated pyproject.toml files to include the new 'ty' dependency and set Python version requirements. These changes enhance the development setup and ensure consistency across environments.
- Removed the installation command for `uv` from the Quick Setup section. - Added commands for Python formatting and type checking using `ruff` and `ty`. - Introduced a new section on Git worktrees with guidelines for branch naming conventions. These changes enhance the clarity of the setup instructions and improve the development workflow.
- Modified the extralit.yml workflow to exclude the docs directory and mkdocs.yml from triggering builds on push and pull request events. - Reintroduced a scheduled job in scorecard.yml to run weekly, ensuring regular updates for the Maintained check. These changes streamline the CI process by preventing unnecessary builds for documentation changes while maintaining regular checks.
This was referenced Jun 9, 2026
JonnyTran
added a commit
that referenced
this pull request
Jul 20, 2026
The HANDOVER.md file has been deleted as it contained outdated information regarding PR #214 and its verification results. This cleanup helps maintain the repository's documentation relevance.
JonnyTran
added a commit
that referenced
this pull request
Jul 20, 2026
* fix(v2-ui): inject the resolved store into schema/review use cases, not the hook
GetSchemasUseCase and GetReferenceReviewUseCase were typed as `typeof useXxx`
and called `this.storage()`, but ts-injecty resolves a hook dependency by
*calling* it and injecting the returned store object (same contract as v1's
GetWorkspacesUseCase). At runtime `this.storage()` threw
"this.schemasStorage is not a function", which the empty catch swallowed and
surfaced as "Could not load schemas." on a 200 response.
Use the injected value as an object (drop the `()`) and type it as
ReturnType<typeof useXxx>. The unit tests passed the raw hook function —
bypassing the DI contract — so they missed this; update them to pass the
resolved store (useXxx()) as DI does.
Verified live: the seeded e2e_v2_slice schema now renders in the table.
Surfaced by the first end-to-end run of the v2 frontend e2e.
* feat(v2-ui): add workspace-hydration and breadcrumb composables for v2 pages
* feat(v2-ui): add V2Empty and V2StatusBadge presentational components
* feat(v2-ui): integrate schemas list into app shell; hydrate workspaces on direct load
* feat(v2-ui): shell + design-system controls on schema detail; status badges in records table
* feat(v2-ui): integrate schema settings into app shell with breadcrumbs
* feat(v2-ui): integrate reference review into app shell; BaseButton actions
* fix(v2-ui): correct BaseButton `to` prop type; avoid reference/breadcrumb strict-mode collision
- BaseButton `to` prop was declared `type: String | Object` (bitwise-OR evaluates to 0),
a malformed prop type that threw 'Right-hand side of instanceof is not an object' during
Vue dev-mode prop validation whenever a :to value was passed. This broke the schema-detail
page render (stuck spinner, no records) and was latent in DatasetCard/UserSettingsHeader/
QuestionsForm. Fixed to [String, Object].
- Reference-review breadcrumb rendered the bare reference, colliding with the page <h1>
'Review — {reference}' so getByText(reference) matched two nodes (e2e strict-mode
violation). Leaf is now the static 'Review' label; the <h1> still carries the reference.
Unblocks e2e/v2 auth-smoke + slashed-reference (both green).
* fix(v2): accept non-urllib3 S3 streaming bodies in FileObjectResponse
v2 record bulk-upsert reads the pandera schema body from S3 via
FileObjectResponse.response, which was annotated urllib3.HTTPResponse
(from the old minio client, PR #149). aiobotocore returns the body as a
StreamingChecksumBody, so pydantic's is_instance_of check rejected it and
every v2 upsert 422'd. Relax the annotation to Any (consumers only stream
the body via .read(); the existing validator still guards None) and add a
regression test.
Surfaced by the first end-to-end run of the v2 frontend e2e seed.
* polish(v2-ui): drop dead #c00 fallback on --color-danger token (ReviewRecordCard)
* fix(v2): drop unsupported prefilter kwarg in async LanceDB FTS+filter search
Combining an FTS query with a scalar filter called
AsyncFTSQuery.where(clause, prefilter=True), but async LanceDB (0.34) where()
takes only the predicate — the sync-only prefilter= kwarg raised TypeError, so
every text+filter search 500'd. Scalar filters over an FTS match set apply as a
postfilter, correct for the materialize-then-page model. Add a regression test
covering FTS+filter narrowing and the non-matching-token empty case.
Surfaced by the v2 search-roundtrip e2e (status filter + query).
* fix(v2-ui): use native search input on schema detail; BaseSearchBar drops fill()
BaseInput debounces its update:modelValue emit (lazyEventEmitter, 100ms) while
re-rendering a controlled :value, so the DOM value resets to the stale model on
each keystroke — losing characters under fast typing and dropping Playwright
fill() entirely (the emitted value arrives as ''). A tokenized native input with
v-model + @keyup.enter is immediate and lossless, and matches the search-roundtrip
spec's fill + press('Enter') contract. Styled with design tokens for visual parity.
* chore: remove outdated HANDOVER.md file
The HANDOVER.md file has been deleted as it contained outdated information regarding PR #214 and its verification results. This cleanup helps maintain the repository's documentation relevance.
* chore: docs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bundles four low-risk quick wins from the OSS audit (filed in #203–#213). Targets the items the handover called out as "low risk, high signal."
extralit-server/docker/server/Dockerfilefrom/root/.cache/uvto/home/extralit/.cache/uvand setsUV_CACHE_DIRexplicitly so the path is consistent with the runtime user.```basefence inREADME.md, fills in the SDKREADME.md"Create an extraction schema" / "Add documents and start extraction" TBDs with a runnableSettings+Datasetsnippet, points rootAGENTS.mdat the existing per-componentCLAUDE.mdfiles (since per-componentAGENTS.mdfiles don't exist), addsexamples/README.md, and adds a "Choose a dev environment" section toCONTRIBUTING.md. The Python version claim inAGENTS.mdalready matchespyproject.toml(>=3.10server />=3.9.2SDK), so no change there.BackendEnvironment.argilla→.extralitinv1/infrastructure/types/environment.ts,Environment.ts, andEnvironmentRepository.tsto match the server schema, which already returnsextralit:(the previous code was silently falling back to defaults). Renames theargillaDatasetsi18n key across all four locales +DatasetList.vue. Swapsdocs.argilla.io→docs.extralit.aiinja.js. Replaces the 84Copyright 2021-present, the Recognai S.L. teamheaders across the frontend with theCopyright 2024-present, Extralit Labs, Inc.convention used inextralit-server. NOTICE already preserves Argilla attribution..cursor/,.vscode/,.ruff_cache/are not tracked and are in.gitignore. No change.Intentionally retained Argilla references
how-to-configure-argilla-on-huggingface/doc paths innuxt.config.tsand translations — verified the renamedhow-to-configure-extralit-on-huggingface/paths 404 ondocs.extralit.ai, so renaming would break links.argilla-devlocalStorage key inextension/popup.jsanduseFeatureToggle.ts— would break installed dev extensions.argilla.imglab-cdn.netinuseShareViewModel.ts— external CDN with no Extralit equivalent.argilla.span_marker_conll,argilla-other,recognaiworkspace) — historical test data; cosmetic.CHANGELOG.md[Argilla]version entries — historical.Test plan
cd extralit-frontend && npm run lint && npm run test— lint passed in pre-commit hook; unit tests not run locally.cd extralit-frontend && npm run build— Nuxt build still succeeds with the rebranded type/key.extralitDatasetsi18n key resolves and theBackendEnvironment.extralitsettings (HF persistent storage warning, share-progress flag) light up correctly. Previously these were always falling back to defaults due to the type mismatch.docker build extralit-server/— succeeds with the new uv cache path.🤖 Generated with Claude Code