[ritwik-g]

What

Fixes the 9 open SonarCloud BUG issues not already covered by #2384, so that together they bring the project's reliability rating to A. #2384 covers the other 5 (sdk1 tool/base.py, Header.jsx, ManageLlmProfiles.jsx, DisplayCode.jsx). This PR doesn't touch those files.

1. css:S9424, invalid CSS values (5 findings)

All five declarations are invalid, so the browser already discards them. I checked this in headless Chrome in standards mode (the app's index.html has <!DOCTYPE html>): each rule's cssText comes back empty for these. Each one is deleted, so nothing renders differently.

File:line	Declaration	Why delete, not rewrite
PromptCard.css:80	row-gap: 2	A unitless non-zero length is invalid. 2px would add a gap that doesn't render today.
PromptCard.css:97	scrollbar-color: inherit #fff8e6 !important	inherit can't be combined with another value. A valid pair would recolour the scrollbar thumb.
PromptCard.css:189	width: fill-available !important	Unprefixed fill-available isn't valid in any browser. -webkit-fill-available would change the width in Chromium and Safari, so it's dropped instead of "fixed".
ToolIde.css:76	transition: "left 0.1s linear"	A quoted string isn't a valid transition. Unquoting it would add an animation that doesn't run today.
SideNavBar.css:106	margin-top: 1	A unitless length. Quirks mode would read it as 1px, but the app runs in standards mode, where it's dropped.

2. css:S4657, longhand overridden by shorthand (2 findings)

In PromptStudioModal.css, .prompt-studio-guide-btn and .prompt-studio-cancel-btn each set margin-top: 8px !important and then margin: 0 !important in the same rule. Both are !important, so the later one wins and the computed margin-top is 0px (checked in Chrome). I removed the dead margin-top. Rendering stays the same.

3. python:S8371, x2text /process header read

int(request.headers["Content-Length"]) raised an unhandled KeyError when the header was missing (a chunked upload) and a ValueError when it wasn't an integer. Both came back as a 500. The header is now read with .get(). A missing or non-integer value returns 400 {"message": "Missing or invalid Content-Length header"}, the same shape as the other 400s in this handler. A valid header behaves as before.

4. javascript:S1082, TopNavBar Switch Org keyboard access

The current-org entry in the Switch Org list put its handler on a wrapper <div onClick>. Radix focuses the menu item, not that div, and turns Enter/Space into a click on the item itself, so a keyboard user got nothing. The handler now sits on the menu item (item.onClick, which the Dropdown shim already supports), and the label is plain text.

Self-review found the same defect on the other orgs' entries in this list. Their ConfirmModal wrapper sat inside the label, so pressing Enter on another org never opened the switch confirmation. Those entries now call openConfirm from item.onClick, with the same title, text and buttons as before. Mouse and keyboard now behave the same for both kinds of entry.

Testing

• TopNavBar.test.jsx: added keyboard and mouse tests for the current org (alert shown, no switch prompt, no POST) and a keyboard test for switching to another org. The existing mouse switch test now also checks that no "already in" alert appears. I ran five mutants: the base file, the alert on every org, the alert on no org, no handler for other orgs, and a current-org click that also switches. Each one fails at least one test.
• vitest run: 40 files and 632 tests pass. tsc --noEmit is clean. biome check src/ has no errors, and warnings went from 799 to 790.
• x2text has no test suite. I ran py_compile, ruff check and ruff format --check, then called /process from a script through a Flask request context, with auth, DB and the upstream mocked. Results with the header present, missing and invalid: before the fix 200 / 500 (KeyError) / 500 (ValueError); after it 200 / 400 / 400.

🤖 Generated with Claude Code

[ritwik-g]

Self-review round 1 — tip 90ee5d944

Review: unstract:review-deep, INITIAL. review-shallow refused this PR because the x2text header parsing tripped its attack-surface trigger.

Verdict — REQUEST CHANGES

Summary — Critical: 0 · High: 1 · Medium: 2 · Low: 0 · Lenses run: 19/19

Security deep-dive: done. It returned no findings at confidence 8 or above, and no filter sub-task degraded.
boundary-sweep: 1 sink traced, clean. The new 400 body is a fixed string with no request data in it.
Base fetch: ok. Merge base 389a6eb80.

Lens checklist

1. Correctness — See findings #2
2. Design & architecture — Clean
3. Error handling — Clean
4. Security — Clean
5. Data integrity & migrations — N/A — no data or schema change
6. Concurrency — N/A — no concurrency primitives touched
7. API compatibility — Clean
8. Reliability — Clean
9. Performance & cost — Clean
10. Observability — Clean
11. Operational safety — N/A — no infra, flags or rollout config
12. LLM/agent — N/A — no LLM or agent code
13. Testing — See findings #1, #3
14. Dependencies & build — N/A — no dependency changes
15. Code quality — Clean
16. Doc accuracy — Clean
17. Cross-document consistency — Clean
18. On-prem experience — N/A — no chart, values, schema or on-prem build path touched
19. Scaling & workload lifecycle — N/A — no workload config

Notes on the checklist:

• Lens 4: the security deep-dive was done, and the auth decorator on /process is unchanged.
• Lens 7: the 400 replaces a 500 only for malformed requests. The in-repo consumer (sdk1 adapters/x2text/helper.py) always sends Content-Length.
• Lens 15: the orchestrator ran biome check (0 errors) and ruff check / ruff format --check (pass).
• Lenses 5, 6, 8, 11, 12, 14 and 16–19 were assessed by the orchestrator.

Open questions for the author

None.

Assumptions made

The app renders in standards mode (frontend/index.html has <!DOCTYPE html>), so the browser drops the deleted unitless CSS values.

[ritwik-g]

Self-review round 2 — tip fc5ff49e (delta 90ee5d944..fc5ff49e)

Review: unstract:review-deep, FOLLOWUP. Lite was not eligible: its gate reads the whole PR, and the attack-surface trigger still fires.

Verdict — REQUEST CHANGES

Prior context fetched — followup-fetch.sh exited 0. The "since" boundary is 90ee5d944.

Scope change — NO

Summary — Critical: 0 · High: 1 · Medium: 0 · Low: 0 · Lenses run: 19/19

Security deep-dive: done. It returned no candidates and no filter sub-task degraded.
boundary-sweep: 1 sink traced, clean. The confirm dialog shows display_name as React text.

Prior findings status

• #1 [High] The x2text Content-Length branch has no test → WAIVED. x2text-service has no test suite, and the requester asked for a script check instead. The waiver is written at x2text-service/app/controllers/controller.py:L92-L94.
• #2 [Medium] Enter on another org does nothing → RESOLVED in fc5ff49e. openConfirm is now called from item.onClick (TopNavBar.jsx:L260-L274), and the keyboard switch test passes.
• #3 [Medium] The tests don't pin the isCurrentOrg split → RESOLVED in fc5ff49e. Mutants true ?, false ?, the other-org undefined and the base file each fail at least one test.

Lens checklist

1. Correctness — Clean
2. Design & architecture — Clean
3. Error handling — Clean
4. Security — Clean
5. Data integrity & migrations — N/A — no data change in the delta
6. Concurrency — N/A — no concurrency primitives
7. API compatibility — Clean
8. Reliability — Clean
9. Performance & cost — Clean
10. Observability — Clean
11. Operational safety — N/A — no infra
12. LLM/agent — N/A — no LLM code
13. Testing — See findings #1
14. Dependencies & build — N/A — no dependency change
15. Code quality — Clean
16. Doc accuracy — Clean
17. Cross-document consistency — Clean
18. On-prem experience — N/A — no deployment surface
19. Scaling & workload lifecycle — N/A — no workload config

Notes on the checklist:

• Lens 7: the delta changes no endpoint or response shape.
• Lens 15: the orchestrator ran biome check (0 errors) and ruff check / ruff format --check (pass).
• Lens 16: the new comments in TopNavBar.jsx and controller.py match the code.
• Lens 17: nothing restates the changed rule.

Open questions / assumptions

None.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[ritwik-g]

Self-review round 3 — tip bcbf1a95 (delta fc5ff49e..bcbf1a95)

Review: unstract:review-deep, FOLLOWUP. Lite was not eligible: its gate reads the whole PR, and the attack-surface trigger still fires.

Verdict — APPROVE

Prior context fetched — followup-fetch.sh exited 0. The "since" boundary is fc5ff49e.

Scope change — NO

Summary — Critical: 0 · High: 0 · Medium: 0 · Low: 0 · Lenses run: 19/19

Security deep-dive: done. It returned no candidates and no filter sub-task degraded.
boundary-sweep: 0 sinks traced, clean. The delta is test-only.

Prior findings status

• Round 2 #1 [High] The current-org tests don't check that no switch request is sent → RESOLVED in bcbf1a95. expect(axios).not.toHaveBeenCalled() is back at TopNavBar.test.jsx:L159 and :L176. The self-switch mutant now fails both current-org tests.

New findings

None. Both agents returned an explicit "No findings". pr-test-analyzer mutation-tested the isCurrentOrg split: the self-switch mutant and the inverted condition both fail.

Lens checklist

1. Correctness — Clean
2. Design & architecture — Clean
3. Error handling — Clean
4. Security — Clean
5. Data integrity & migrations — N/A — test-only delta
6. Concurrency — N/A — test-only delta
7. API compatibility — N/A — test-only delta
8. Reliability — N/A — test-only delta
9. Performance & cost — Clean
10. Observability — Clean
11. Operational safety — N/A — no infra
12. LLM/agent — N/A — no LLM code
13. Testing — Clean
14. Dependencies & build — N/A — no dependency change
15. Code quality — Clean
16. Doc accuracy — N/A — no comments changed
17. Cross-document consistency — N/A — no rule changed
18. On-prem experience — N/A — no deployment surface
19. Scaling & workload lifecycle — N/A — no workload config

Notes on the checklist:

• Lens 15: the orchestrator ran biome check on the test file (0 errors).

Open questions / assumptions

None.