Skip to content

🧽 fix: Paint Freed Feature Surfaces From Theme Roles - #16517

Merged
berry-13 merged 6 commits into
canaryfrom
berry-13/theme-leakage-sweep-features
Sep 29, 2026
Merged

berry-13 merged 6 commits into
canaryfrom
berry-13/theme-leakage-sweep-features

Conversation

@berry-13

@berry-13 berry-13 commented Sep 29, 2026 •

Copy link
Copy Markdown
Collaborator

Pull Request

Summary

Part of the held-file sweep from the theme-leakage stack (#16482, #16483, #16484): the feature files that open canary PRs no longer hold, fixed where an existing theme role reproduces today's default appearance. Tracks berry-13#195.

The output panes of code execution, file authoring and file reads painted surface-chat in light and surface-primary-alt in dark. They now read surface-code-body, which is that same pair in the default, dark and high-contrast themes; in ClickHouse light the panes take Click UI's codeblock background, since they are code output. The MCP OAuth dialog's server logo tile and QR backdrop were bg-white; they read surface-fixed and surface-qr, white in every bundled theme, so the QR keeps its quiet zone.

The tool-approval edit field flagged invalid JSON with border-red-500, and the primitive's owner rule rejects any semantic border colour on TextareaAutosize. The primitive now draws its border in border-destructive when aria-invalid is set. ToolApproval sets aria-invalid and points aria-describedby at the Invalid JSON message, so a screen reader announces the error. The Bookmark and Skills description fields already pass aria-invalid, so they now show the same destructive border as every other invalid field in the app. The border moves from red-500 to the role's red-600 in light mode.

The image preview's media overlays, the artifact iframe's scrollbar and the Azure chip gradient are recorded in packages/client/src/theme/allowlist.md as colours the theme must not own.

Still held, and left for later links in this stack: the avatar placeholder and default-avatar roles (berry-13#194) need registry.ts, types and the bundled themes, which #16486 edits; client/src/style.css waits for #16486; the stylesheet and brand-mark allow entries in eslint.config.mjs wait for #16248; client/src/utils/files.ts and the file-type tiles wait for #15684.

Type of change

  • Bug fix
  • Tests / tooling / CI

Testing

Tested environments/configuration:

  • Default theme, light and dark, desktop and mobile, in the mock harness.

Automated tests:

  • client: npx jest ToolApproval (the invalid edit field is aria-invalid and described by the Invalid JSON message) and the tests related to every changed file.
  • packages/client: tests related to TextareaAutosize.
  • reviewctl verify: tool-output-pane-follows-code-body, tool-approval-invalid-json-is-announced and mcp-oauth-qr-tile-stays-white under e2e/specs/mock/scenarios/, on desktop light, desktop dark and mobile.
  • npx eslint with suppressions pruned for the touched files only (ToolApproval loses its no-raw-colors entry and one no-restyle), prettier --check, sort-imports --check, client tsc.

Screenshots / recordings

No visible change in the default theme for the output panes, the OAuth tiles or valid fields: the three scenarios assert the default role values (white panes and QR in light, 23 23 23 panes in dark) on desktop light, desktop dark and mobile. The one visible change is the invalid tool-argument border, red-500 to the destructive role (red-600) in light mode and unchanged in dark.

Risk / compatibility

TextareaAutosize gains an aria-invalid border for every caller. The five callers that set the attribute are listed above; callers that never set it are unchanged.

Checklist

  • I reviewed my own changes
  • Relevant tests have been added or updated
  • Existing relevant tests pass
  • The change does not introduce new warnings or errors

The output panes of code execution, file authoring and file reads painted
surface-chat in light and surface-primary-alt in dark. surface-code-body is
that same pair in the default, dark and high-contrast themes, and a theme
that styles its code blocks now styles these panes with them.
The server logo tile and the QR backdrop were bg-white. They take
surface-fixed and surface-qr, both white in every bundled theme, so a theme
can own them without the QR losing its quiet zone.
…ents

The tool-approval edit field flagged invalid JSON with border-red-500, a raw
colour the primitive's owner rule rejects in any semantic form. TextareaAutosize
now draws its border in border-destructive when aria-invalid is set, the
attribute the Skills description fields already pass. ToolApproval sets
aria-invalid and points aria-describedby at the Invalid JSON message, so a
screen reader announces the error as well.
…ours

Adds the image preview's media overlays, the sandboxed artifact document's
scrollbar and the Azure file-source gradient to the theme allowlist.
… Tile

Scenarios for the code-body pane behind a file-authoring card, the
announced invalid state of the tool-approval edit field, and the MCP OAuth
QR backdrop staying white in both modes.
@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 29, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-09-29T20:21:09.196663Z b90015c Manual request
🔒 Security Review ✅ Completed 2026-09-29T18:01:07.735336Z 19a3eac PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

…Scenarios at Desktop Size

The pane is read with a retrying assertion against the resolved role, since
the card re-renders as highlighting lands. The approval agent and the MCP
Settings panel are reached through side panels the mobile layout keeps in its
drawer, so those two scenarios run at desktop size on the mobile project.
@berry-13

Copy link
Copy Markdown
Collaborator Author

@codex review

Please review the current PR head b90015c. State the exact reviewed commit and ignore findings that apply only to earlier heads.

Purpose supplied by the requester: Scenario fixes since reviewed head 19a3eac: retrying output-pane colour assertion, desktop-size setup for the approval and OAuth scenarios

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: b90015c0a6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@berry-13
berry-13 merged commit 2f16e6b into canary Sep 29, 2026
43 checks passed
@berry-13
berry-13 deleted the berry-13/theme-leakage-sweep-features branch September 29, 2026 20:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant