feat(workspace): name tonight's audio next action from Settings

[seonghobae]

Buyer-visible gap

The Settings control said Coming soon even though this device already knows which audio it can open. A musician who opened it never reached tonight's next action.

Product outcome

• Settings is always available.
• It lists admitted local formats: WAV, MP3, FLAC, M4A.
• Before a song is ready, the next action is Choose a supported file and it starts the existing local-audio picker.
• After analysis, the next action is Open tonight's rehearsal map.
• Untrusted format strings are rejected instead of being shown as playable.
• Help and Stem Lab stay out of this slice.
• English and Korean copy is updated. AGENTS / ARCHITECTURE / CLAUDE / CHANGELOG stay current.

Exact current identity

• Protected base: develop@749511c3ad4000090048718f685c6bee6b3d2c25.
• Branch: feat/workspace-settings-next-action.
• Exact current head: 720c823bea91689c69c26877f20b4acd9feedf83.

Verification

• npm run test --workspace @bandscope/desktop: 228 tests passed; coverage thresholds held on the configured files, including rehearsalSettings.ts and RehearsalSettings.tsx.
• npm run typecheck --workspace @bandscope/desktop
• npm run lint --workspace @bandscope/desktop

Security Notes

• Untrusted input: runtime format lists passed into Settings. Only wav / mp3 / flac / m4a are named.
• Trust boundary: lexical format admission before buyer-visible copy. Malformed values are isolated.
• No new filesystem, URL, subprocess, IPC, WebView, model, update, export, or dependency path. The choose-file action reuses the existing local-audio picker.
• Canonical fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline #783 remains protected develop shipped JavaScript dependency truth. This branch does not copy or suppress pdfjs-dist / nanoid / undici findings.

Merge gate

• Target is protected develop.
• Not a MIR product and not a parallel [Product Gap] Add real-audio MIR accuracy acceptance benchmarks #770 owner. test(analysis): govern real YouTube known-stem benchmark #828 remains the known-stem vehicle.
• Do not mix with 🔒 [보안] CLI 무제한 파일 읽기 취약점 수정 #811, test(analysis): govern real YouTube known-stem benchmark #828, or feat(workspace): Storybook tokens for rehearsal components #897.
• Merge only after this unchanged exact head has terminal required repository/central checks, zero valid unresolved findings, a qualifying independent non-author last-push approval, and ordinary protected-branch acceptance.
• Queued, pending, skipped, cancelled, failed, predecessor-head, protected-base, model-only, self/author, or administrative-bypass evidence is not success.
• Do not self-approve.

---

Latest exact-head verification

• Protected base: develop@749511c3ad4000090048718f685c6bee6b3d2c25; current head: 720c823bea91689c69c26877f20b4acd9feedf83.
• Desktop verification: 228 tests passed with configured coverage thresholds; desktop lint and typecheck passed.
• Settings remains available in both desktop sidebar and compact navigation; compact navigation regression is covered.

Active-work guard

The Settings picker is disabled while analysis is queued/running or starting, and while YouTube import is pending; the handler also fails closed against stale clicks.

Ready-map availability

When a song is already ready, Settings keeps the Open rehearsal map action available even if another import is pending; only the file-changing action is disabled.

[coderabbitai]

Warning

Review limit reached

Next included review available in 12 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 841a5fd9-5bc1-46b7-a47d-e7d9f09023aa

📥 Commits

Reviewing files that changed from the base of the PR and between 749511c and 974ce50.

📒 Files selected for processing (15)

• AGENTS.md
• ARCHITECTURE.md
• CHANGELOG.md
• CLAUDE.md
• apps/desktop/src/App.test.tsx
• apps/desktop/src/App.tsx
• apps/desktop/src/features/settings/RehearsalSettings.test.tsx
• apps/desktop/src/features/settings/RehearsalSettings.tsx
• apps/desktop/src/features/settings/index.tsx
• apps/desktop/src/features/settings/rehearsalSettings.test.ts
• apps/desktop/src/features/settings/settingsModel.ts
• apps/desktop/src/locales/en/common.json
• apps/desktop/src/locales/ko/common.json
• apps/desktop/vite.config.ts
• docs/design-system/component-contract.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent review

Review exact current head 720c823bea91689c69c26877f20b4acd9feedf83 against protected develop@749511c3ad4000090048718f685c6bee6b3d2c25. The current required opencode-review verifier failed only because no authenticated OpenCode APPROVED/CHANGES_REQUESTED verdict exists for this exact head; deterministic BandScope CI/build/security/coverage evidence is terminal on this head and all currently listed Devin threads are resolved. Please bind any formal verdict only to this SHA and revalidate the Settings compact-navigation, busy-state chooser guard, ready-map availability during imports, renamed settingsModel.ts coverage inclusion, and case-insensitive filename portability fixes. Do not inherit predecessor-head review evidence.

[seonghobae]

@opencode-agent review\n\nPlease review the current PR head only: 91393cb against base 749511c. The Settings navigation fix moved the entry into the compact navigation and adds a regression test; do not reuse predecessor-head findings.

[seonghobae]

Queued @opencode-agent for PR #1053 at head 91393cb1a60f61b6207130c915baeaf3222456c4. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[seonghobae]

@opencode-agent review

Please review the current PR state at exact HEAD 828004be2e98c6bd370c12edde9091c8ff01f2d2 against base 749511c3ad4000090048718f685c6bee6b3d2c25. The current change keeps Settings reachable in both desktop primary and compact rehearsal navigation, with regression coverage. Re-evaluate the current diff and report actionable findings for this exact HEAD; do not reuse a predecessor verdict.

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

Devin Review found 2 new potential issues.

[seonghobae]

Queued @opencode-agent for PR #1053 at head 828004be2e98c6bd370c12edde9091c8ff01f2d2. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[seonghobae]

@opencode-agent review

Please review the current PR state at exact HEAD 974ce500cf7f5f2a11180528760b1f43532069d4 against base 749511c3ad4000090048718f685c6bee6b3d2c25. The latest fix corrects the desktop primary Settings accessible label and targets the compact Settings control explicitly in the regression test. Re-evaluate the current diff and report actionable findings for this exact HEAD; do not reuse a predecessor verdict.

[seonghobae]

Queued @opencode-agent for PR #1053 at head 974ce500cf7f5f2a11180528760b1f43532069d4. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[devin-ai-integration]

Devin Review found 1 new potential issue.