werkrevisor 0.18.5: dashboard in Werkator's design, private repositories keep their row without name #26
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: mi/werkrevisor#26
Reference in New Issue
Block a user
See docs/prs/2026-10-06-PR#26-dashboard-design.md.
🤖 Generated with Claude Code
🟠 werkrevisor ORANGE for
2f9abab, superseded by the result for6159c9e🟠 werkrevisor: ORANGE / FINDINGS
Change kind:
mixed.Reasons
Findings
[high] Hidden private repositories leak through row order at
server/src/main/kotlin/de/hoennig/werkrevisor/server/Statistics.kt:139-142, ORANGE, as a line comment[high] Test weakened: pullRequests assertion removed at
server/src/test/kotlin/de/hoennig/werkrevisor/server/UsageApiIntegrationTest.kt:372-378, hint, as a line comment[medium] Missing aria state on the toggle button at
server/src/main/resources/static/werkrevisor-dashboard.js:175-182, hint, as a line commentClassifier
10 of 10 units passed all questions (1 PR document(s)).
Usage: model `openrouter/anthropic/claude-sonnet-5.5`, LLM done, tokens counted before the call 60096, calls 1, tokens in 57265 / out 779 (reasoning included in out), duration 13.6 s, cost 0.1223 USD (reported), classifier `jev-1.13.0` calls 10, tokens in 8409, cost 0.0004 USD, finding judge `jev-1.13.0` calls 3, tokens in 4907, cost 0.0002 USD, config: defaults + host + repository (.werkrevisor.toml at base924b279).Reviewed head `2f9ababd842a67fced870939078ccc24573578ef` against base `924b27916c6c2708f5f3c2ff5d616f7297d9fa28`, werkrevisor 0.18.4.
werkrevisor: ORANGE / FINDINGS for
2f9ababd842a67fced870939078ccc24573578ef.The result comment of werkrevisor holds the details.
@@ -128,3 +137,3 @@details =Details(byRepo = groups(lastMonth) { if (withRecent || it.repo in publicRepos) it.repo else PRIVATE_REPOS },byRepo =[high] Hidden private repositories leak through row order (werkrevisor)
ORANGE; Jev: real 0.71, severity 3.0 of 3
groups(lastMonth)sorts by cost and the hidden rows keep that order, so every hidden row sits at the position of its cost rank. The sums also stay per repository. A reader without a token can combine these with other public data, such as the cost per day or window, to infer which private repository a row belongs to. The per-repository sums of private repositories were hidden before, in one aggregated row; this PR changes that. The PR document states the intent, but it does not discuss this disclosure, so confirm that it is accepted.@@ -143,1 +173,3 @@{},const section = el("section", this.opened.has(title) ? { class: "open" } : {});const rest = periods.length - VISIBLE_PERIODS;const toggle = el("button", { class: "toggle", type: "button" });[medium] Missing aria state on the toggle button (werkrevisor)
hint; Jev: real 0.94, severity 2.4 of 3
The "Show N more" button only changes a CSS class on the section. It has no
aria-expanded, so assistive technology cannot tell whether the rows are open or hidden.@@ -373,3 +372,1 @@with(byRepo.items().first { it["key"].asString() == "private repositories" }["sums"]) {this["reviews"].asInt() shouldBe 6this["pullRequests"].asInt() shouldBe 6byRepo.items().filter { !it["hidden"].asBoolean() }.map { it["key"].asString() } shouldContainExactly listOf("team/app")[high] Test weakened: pullRequests assertion removed (werkrevisor)
hint; Jev: real 0.62, severity 2.0 of 3
The old test asserted
pullRequests shouldBe 6for the aggregated private row. The new test checks only the review count and the number of hidden rows. A regression in the pull-request count of the hidden rows would no longer be caught. The test also no longer checks that no hidden row carries a name beyond an empty key. Add thepullRequestssum, 6, back to the test.🟠 werkrevisor ORANGE for
6159c9e, superseded by the result for1512693🟠 werkrevisor: ORANGE / FINDINGS
Change kind:
mixed.Reasons
Findings
[medium] Hidden private repos leak per-repo costs and mutable ordering at
server/src/main/kotlin/de/hoennig/werkrevisor/server/Statistics.kt:139-142, ORANGE, still open in an earlier line comment[medium] Missing test for hidden-row rendering and toggle behavior at
server/src/main/resources/static/werkrevisor-dashboard.js:171-208, hint, still open in an earlier line comment[low] Document says Scenario 26.05 is verified by a renamed test only at
docs/prs/2026-10-06-PR#26-dashboard-design.md:104-107, hint, as a line commentClassifier
10 of 10 units passed all questions (1 PR document(s)).
Usage: model `openrouter/anthropic/claude-sonnet-5.5`, LLM done, tokens counted before the call 60388, calls 1, tokens in 57551 / out 724 (reasoning included in out), duration 13.5 s, cost 0.1223 USD (reported), classifier `jev-1.13.0` calls 10, tokens in 8473, cost 0.0004 USD, finding judge `jev-1.13.0` calls 2, tokens in 3542, cost 0.0001 USD, config: defaults + host + repository (.werkrevisor.toml at base924b279).Reviewed head `6159c9ed2d63f5a8ce32e67ba2e91b5f37a49cac` against base `924b27916c6c2708f5f3c2ff5d616f7297d9fa28`, werkrevisor 0.18.4.
werkrevisor: ORANGE / FINDINGS for
6159c9ed2d63f5a8ce32e67ba2e91b5f37a49cac.The result comment of werkrevisor holds the details.
@@ -0,0 +101,4 @@- **and** one row per private repository, named "private repository" in grey italics,with its costs, reviews and pull requests##### Verified by[low] Document says Scenario 26.05 is verified by a renamed test only (werkrevisor)
hint
Scenario#26.05 links to the test "private repositories are named only with a read token". That test is titled Scenario#25.03 and covers the API fields (
hidden, empty key), not the dashboard's grey italic "private repository" label. The claim of verification by that test is only partly true.Assessment of the werkrevisor findings (as of the last commit):
Fixed:
UsageApiIntegrationTest.kt: the hidden rows are checked for their pull requests too (sum 6).werkrevisor-dashboard.js: the "Show N more" button carriesaria-expanded.Not changed:
Statistics.kt:139-142(ORANGE), per-repository costs of private repositories without a token: intended.The developer asked for one row per private repository with its costs, so that the rows add up to the total;
only the name stays hidden. The PR doc states this under Non-Goals, including that a reader with other data may guess which row is which.
werkrevisor-dashboard.js:171-208, no automated test of the rendering: the server has no JavaScript test setup;the browser check in the Measurement section covers the label, the toggle, the theme and the token button.
server/build.gradle.kts: version bump andbuildInfo()for the version in the footer.favicon.svgis the new logo.🤖 Generated with Claude Code
🟡 werkrevisor: YELLOW / HUMAN_REVIEW
Change kind:
mixed.Reasons
Findings
[high] Verdict table renders an element as the row key at
server/src/main/resources/static/werkrevisor-dashboard.js:298-299, hint, as a line comment[medium] Favicon and font files not part of the diff at
server/src/main/resources/static/index.html:7-8, hint, as a line comment[medium] Hidden repository test does not check public-only labelling per row at
server/src/test/kotlin/de/hoennig/werkrevisor/server/UsageApiIntegrationTest.kt:395-397, hint, as a line commentClassifier
10 of 10 units passed all questions (1 PR document(s)).
Usage: model `openrouter/anthropic/claude-sonnet-5.5`, LLM done, tokens counted before the call 60430, calls 1, tokens in 57581 / out 794 (reasoning included in out), duration 13.1 s, cost 0.1231 USD (reported), classifier `jev-1.13.0` calls 10, tokens in 8473, cost 0.0004 USD, finding judge `jev-1.13.0` calls 3, tokens in 4007, cost 0.0002 USD, config: defaults + host + repository (.werkrevisor.toml at base924b279).Reviewed head `1512693c47781948d05afd37b8e8c01575d97a38` against base `924b27916c6c2708f5f3c2ff5d616f7297d9fa28`, werkrevisor 0.18.4.
werkrevisor: YELLOW / HUMAN_REVIEW for
1512693c47781948d05afd37b8e8c01575d97a38.The result comment of werkrevisor holds the details.
@@ -10,3 +7,1 @@h1 { font-size: 20px; margin: 0; }form { display: flex; gap: 6px; }</style><link rel="icon" href="favicon.svg" type="image/svg+xml">[medium] Favicon and font files not part of the diff (werkrevisor)
hint; Jev: real 0.37, severity 1.4 of 3
index.htmllinksfavicon.svgandwerkrevisor.cssreferencesfonts/plex-sans.woff2,fonts/plex-mono-400.woff2andfonts/plex-mono-500.woff2. None of these files appear in the diff. If they are not committed, the page gets 404s and falls back to system fonts. Uncertain: binary files may simply be omitted from the diff view.@@ -243,3 +297,2 @@{ class: "groups" },this.groupTable("Last 30 days by repository", details.byRepo),this.groupTable("by verdict", details.byVerdict),this.groupTable(el("span", {}, "By repository", el("em", {}, "last 30 days")), "Repository", details.byRepo, (key) => key),[high] Verdict table renders an element as the row key (werkrevisor)
hint; Jev: real 0.16, severity 0.5 of 3
groupTableis called for the verdict table withverdictas thenamefunction.verdict()returns a DOM element, whichelappends correctly as a Node, so this is fine. For the repository table withhiddenrows the key is empty, which is handled. However,groupTablereceives a DOM element (el("span", ...)) astitle, andel("h2", {}, title)appends it, which works. No defect here; but a hidden row in a table whosenameisverdictwould never occur, so this is uncertain and likely fine.@@ -389,6 +392,10 @@ class UsageApiIntegrationTest : FunSpec() {recent[0]["prUrl"].asString() shouldBe "https://git.example.org/team/app/pulls/1"}test("the statistics name the version of the service") {[medium] Hidden repository test does not check public-only labelling per row (werkrevisor)
hint; Jev: real 0.56, severity 2.0 of 3
The test asserts four hidden rows with empty keys, but no test covers the new
werkrevisor-page.jsbehavior (token state, version display) beyond a string match. The JS-only scenarios 26.01, 26.03 and 26.04 are verified manually only. This is acceptable but leaves token-accepted detection untested.