tyb.there-hugo.dev tyb.there-hugo.dev Save the automation form periodically so work survives reloads, redirects and crashes.
From https://www.youtube.com/watch?v=5MnT-ZgbBIc, where the user built an automation that adds conference attendees to a Bluesky list:
Details: docs/brainstorms/2026-10-17-graze-conference-automation-feedback.md (F5).
Working on this, attempt 1.
loop:claim run=contribute-20261026-162100-3my32gozhgf22 branch=loop/3my32gozhgf22 attempt=1 issue=33
feat(automations): autosave the automation form draft in the browser
The automation form (new, duplicate and edit) now saves what you have typed to localStorage one second after each change. It also saves right away when the page is hidden or unloaded. The next visit to the same page restores that draft and says so at the top of the form, with a "Discard draft" link that returns the form to its starting state. Work now survives reloads, redirects, closed tabs and browser crashes, not just the scope-upgrade round trip (#6). A small "Draft autosaved in this browser on ..." line above the submit buttons shows that it is working.
app/islands/form-autosave.ts. Each draft is keyed by pathname plus a hash of the form's existing draftContext (viewer handle + the page's seed). A draft therefore only restores for the same user and the same seed: another duplicate, another account, or an automation changed on the server since then starts clean. Drafts expire after 7 days, and expired ones are swept on read. It reuses hashContext from scope-upgrade-draft.ts, which is now exported.sessionStorage still wins when it is present, and keeps its own "before the permissions sign-in" notice.pagehide flush cannot write it back while the page navigates away.pnpm run check: passes.pnpm run test: 172 files and 2656 tests pass.app/islands/form-autosave.test.ts: round trip, path and context isolation, expiry, sweep, clear.AutomationForm autosave block of app/islands/AutomationForm.test.tsx:
pagehide flush;pagehide. I checked that this test fails without the stop flag.localStorage instead of sessionStorage. This makes drafts survive a closed tab or a crash without session restore, but they stay on the device for up to 7 days. A draft holds what the form holds, including a webhook's HMAC secret on edit pages and any raw header value the user typed. Drafts are not cleared on sign-out; another account on the same browser never sees them, because the viewer is part of the key. To keep drafts tab-scoped, switch storage() in form-autosave.ts to sessionStorage.AUTOSAVE_DELAY_MS).MAX_AGE_MS).Review: https://tangled.org/exosphere.site/airglow/compare/main...loop/3my32gozhgf22
loop:pushed run=contribute-20261026-162100-3my32gozhgf22 sha=46312052f7fd2ec083ed5df2298d22b6da9c8c18
Don't merge this as is: on edit pages, the autosave draft stores secrets in the browser.
The draft saved to localStorage includes the webhook's HMAC secret and the raw header values, and it stays there for 7 days. Anyone using that browser, or any script running on the site, can read them. Please change three things:
Add a test for each:
Fix round 1: the owner commented.
loop:fix run=contribute-20261026-214042-3my32gozhgf22 round=1 issue=33
feat(automations): autosave the automation form draft in the browser
The automation form (new, duplicate and edit) now saves what you have typed to localStorage one second after each change. It also saves right away when the page is hidden or unloaded. The next visit to the same page restores that draft and says so at the top of the form, with a "Discard draft" link that returns the form to its starting state. Work now survives reloads, redirects, closed tabs and browser crashes, not just the scope-upgrade round trip (#6). A small "Draft autosaved in this browser on ..." line above the submit buttons shows that it is working. Drafts never hold a webhook secret or a header value, and signing out removes all of them.
This round (owner's review): webhook header values are left out of the saved draft, which keeps only the header names. A restored draft gets each value back from the page's seed, which is what the server has. The draft never held the HMAC secret, because the form never has one, and a test now checks that. Signing out, and "Revoke all sessions", now remove every autosaved draft in the browser.
app/islands/form-autosave.ts. Each draft is keyed by pathname plus a hash of the form's existing draftContext (viewer handle + the page's seed). A draft therefore only restores for the same user and the same seed: another duplicate, another account, or an automation changed on the server since then starts clean. Drafts expire after 7 days, and expired ones are swept on read. It reuses hashContext from scope-upgrade-draft.ts, which is now exported.withoutHeaderValues (new, app/islands/step-drafts/header-values.ts) blanks every webhook header value at any depth and keeps the names. On restore, withSeedHeaderValues fills each blank value from the seed's webhook. It matches the same step id first, then the same callback URL, because duplicates mint new ids on each load. A header the seed does not have comes back with a name and an empty value. When the restored draft has headers, the restore notice says that header values are not saved and asks the user to re-enter any they changed.app/islands/SignOutForm.tsx, with the same markup and styles (the styles moved from app/routes/settings/account.css.ts to app/islands/SignOutForm.css.ts). Before the form posts, it calls clearAllAutosavedDrafts(), which removes every airglow:automation-draft: key for every page and viewer. RevokeSessions calls the same function before it sends the user to /auth/login. Other keys, such as theme, stay.sessionStorage still wins when it is present, and keeps its own "before the permissions sign-in" notice.pagehide flush cannot write it back while the page navigates away.pnpm run check: passes.pnpm run test: 174 files and 2666 tests pass.AutomationForm.test.tsx, "keeps the secret and the header values out of a draft saved on an edit page": the seed has an HMAC secret and an Authorization header, and the user adds a header with a typed value. The stored string has neither secret nor values, and does have the header names.AutomationForm.test.tsx, "submits a restored edit draft with the server's header values and no secret", checks that the PATCH body carries the same callback URL, the server's header value and no secret. app/routes/api/automations/[rkey].test.ts, "keeps the webhook secret and headers when a restored draft is submitted", sends that same body to the PATCH handler and checks that the stored secret and headers are unchanged.app/islands/SignOutForm.test.tsx seeds drafts for two pages and two viewers, then checks that submitting the sign-out form, or revoking every session, leaves no draft key and keeps theme. I checked that the sign-out test fails when the clear call is removed.step-drafts/header-values.test.ts (strip and refill at any depth, matching by id and by URL), form-autosave.test.ts (clearAllAutosavedDrafts), and a duplicate-page restore that refills by callback URL.form-autosave.test.ts and the AutomationForm autosave block: round trip, path and context isolation, expiry, sweep, the pagehide flush, untouched forms not saved, undo drops the draft, no restore into another duplicate, viewer or changed automation, discard and cancelled discard, and the draft cleared on a successful save.sessionStorage for at most 30 minutes, belongs to one tab, holds the full form including header values, and is on main already. I left it out because the review asked about autosave entries. Clearing it too is a one-line addition in SignOutForm.localStorage instead of sessionStorage, so drafts survive a closed tab or a crash. To keep drafts tab-scoped, switch storage() in form-autosave.ts to sessionStorage.AUTOSAVE_DELAY_MS).MAX_AGE_MS).Review: https://tangled.org/exosphere.site/airglow/compare/main...loop/3my32gozhgf22
loop:pushed run=contribute-20261026-214042-3my32gozhgf22 sha=c1ab0d2e63057368a012e72369d70f2d3921a2ab
Verdict: changes-requested. The branch autosaves the automation form and does all three things the owner asked for. The draft has no webhook secret (WebhookDraft has no secret field). Header values are blanked at any depth before saving, and filled back from the seed when the draft is restored. Sign-out and "Revoke all sessions" clear every airglow:automation-draft: key. pnpm run check and pnpm run test pass (174 files, 2666 tests), and the branch merges cleanly with the current main (841cfb7). One real-use bug is left, on the most common way into the new-automation page, plus a keyboard-focus gap on the new "Discard draft" control.
Changes:
A draft from one lexicon is restored when the user asks for another. On /automations/new the autosave key is the pathname plus a hash of [viewerHandle, null]. The ?lexicon= query is ignored, and form-autosave.test.ts even tests that it is ignored. Here is what happens:
/automations/new?lexicon=app.bsky.feed.post, which app/routes/lexicons/[nsid].tsx links to./automations/new?lexicon=app.bsky.graph.follow.app.bsky.feed.post draft back, with "We restored the unsaved draft...".I reproduced this with a throwaway test: the restored form shows lexicon=app.bsky.feed.post on the follow URL. Fix it by adding the URL's lexicon param to the autosave context when there is no initial. For example, pass JSON.stringify([viewerHandle, initial ?? null, initial ? null : getInitialParam("lexicon")]) to readAutosavedDraft, saveAutosavedDraft and clearAutosavedDraft. Leave the scope-upgrade draftContext as it is. Then:
/automations/new and each ?lexicon=X get their own draft.AutomationForm.test.tsx showing that a draft saved under one ?lexicon= does not restore under another, and still restores under the same one.Focus is lost after "Discard draft". When the user confirms, the notice that holds the button unmounts. document.activeElement then becomes <body>, which I checked in happy-dom, so a keyboard or screen-reader user is dropped at the top of the document. In discardAutosave, after the reset, move focus to something sensible, such as the #sub-name input (for example requestAnimationFrame(() => document.getElementById("sub-name")?.focus())). Add an assertion on document.activeElement to the existing "discards a restored draft back to the page's own seed" test.
What I checked and how:
secret never reaches WebhookDraft (see fromAction in webhook.tsx). The server keeps the stored secret on a PATCH without one, and the new [rkey].test.ts case covers that. The secret only enters the 32-bit FNV hash of the context, never the stored value.HeaderDrafts. mapWebhookDrafts walks the action, condition (then/else) and loop step kinds, which are all the container kinds in tree.ts. The refill matches by step id first, then by callback URL. The tests check the raw stored string./auth/signout is posted only from the settings form, which is now the SignOutForm island. The revoke-sessions path clears too. SignOutForm.test.tsx covers both, and keeps unrelated keys such as theme.pagehide write-back. Undoing every change drops the draft. Duplicates, other viewers and changed seeds stay isolated. Expiry and sweep are covered.loop:verdict run=review-20261026-215428-3my32gozhgf22 sha=c1ab0d2e63057368a012e72369d70f2d3921a2ab verdict=changes-requested
Fix round 2: the review asked for changes.
loop:fix run=contribute-20261026-215817-3my32gozhgf22 round=2 issue=33
feat(automations): autosave the automation form draft in the browser
The automation form (new, duplicate and edit) now saves what you have typed to localStorage one second after each change. It also saves right away when the page is hidden or unloaded. The next visit to the same page restores that draft and says so at the top of the form, with a "Discard draft" link that returns the form to its starting state. Work now survives reloads, redirects, closed tabs and browser crashes, not just the scope-upgrade round trip (#6). A small "Draft autosaved in this browser on ..." line above the submit buttons shows that it is working. Drafts never hold a webhook secret or a header value, and signing out removes all of them.
This round (second review): on /automations/new, the autosave key now includes the ?lexicon= link the blank form was opened from. Before, a draft started from ?lexicon=app.bsky.feed.post came back on ?lexicon=app.bsky.graph.follow. Now plain /automations/new and each ?lexicon=X keep their own draft. Also, after "Discard draft", focus moves to the name input, so keyboard and screen-reader users are no longer dropped at the top of the page when the notice unmounts.
Previous round (owner's review): webhook header values are left out of the saved draft, which keeps only the header names. A restored draft gets each value back from the page's seed, which is what the server has. The draft never held the HMAC secret, because the form never has one, and a test now checks that. Signing out, and "Revoke all sessions", now remove every autosaved draft in the browser.
app/islands/form-autosave.ts. Each draft is keyed by pathname plus a hash of an autosaveContext: the viewer handle, the page's seed and, for a blank form with no seed, the URL's lexicon param. A draft therefore only restores for the same user, the same seed and the same ?lexicon= link: another duplicate, another account, or an automation changed on the server since then starts clean. Drafts expire after 7 days, and expired ones are swept on read. It reuses hashContext from scope-upgrade-draft.ts, which is now exported.withoutHeaderValues (new, app/islands/step-drafts/header-values.ts) blanks every webhook header value at any depth and keeps the names. On restore, withSeedHeaderValues fills each blank value from the seed's webhook. It matches the same step id first, then the same callback URL, because duplicates mint new ids on each load. A header the seed does not have comes back with a name and an empty value. When the restored draft has headers, the restore notice says that header values are not saved and asks the user to re-enter any they changed.app/islands/SignOutForm.tsx, with the same markup and styles (the styles moved from app/routes/settings/account.css.ts to app/islands/SignOutForm.css.ts). Before the form posts, it calls clearAllAutosavedDrafts(), which removes every airglow:automation-draft: key for every page and viewer. RevokeSessions calls the same function before it sends the user to /auth/login. Other keys, such as theme, stay.sessionStorage still wins when it is present, and keeps its own "before the permissions sign-in" notice.pagehide flush cannot write it back while the page navigates away.pnpm run check: passes.pnpm run test: 174 files and 2667 tests pass.AutomationForm.test.tsx, "keeps a blank form's draft to the ?lexicon= it was started from", saves a draft on ?lexicon=app.bsky.feed.post. It checks that the draft does not restore on ?lexicon=app.bsky.graph.follow (which shows its own lexicon) or on plain /automations/new, and that it does restore on the same ?lexicon=. The "discards a restored draft back to the page's own seed" test now checks that document.activeElement is the name input. I checked that both tests fail without the change to AutomationForm.tsx.AutomationForm.test.tsx, "keeps the secret and the header values out of a draft saved on an edit page": the seed has an HMAC secret and an Authorization header, and the user adds a header with a typed value. The stored string has neither secret nor values, and does have the header names.AutomationForm.test.tsx, "submits a restored edit draft with the server's header values and no secret", checks that the PATCH body carries the same callback URL, the server's header value and no secret. app/routes/api/automations/[rkey].test.ts, "keeps the webhook secret and headers when a restored draft is submitted", sends that same body to the PATCH handler and checks that the stored secret and headers are unchanged.app/islands/SignOutForm.test.tsx seeds drafts for two pages and two viewers, then checks that submitting the sign-out form, or revoking every session, leaves no draft key and keeps theme. I checked that the sign-out test fails when the clear call is removed.step-drafts/header-values.test.ts (strip and refill at any depth, matching by id and by URL), form-autosave.test.ts (clearAllAutosavedDrafts), and a duplicate-page restore that refills by callback URL.form-autosave.test.ts and the AutomationForm autosave block: round trip, path and context isolation, expiry, sweep, the pagehide flush, untouched forms not saved, undo drops the draft, no restore into another duplicate, viewer or changed automation, discard and cancelled discard, and the draft cleared on a successful save.sessionStorage for at most 30 minutes, belongs to one tab, holds the full form including header values, and is on main already. I left it out because the review asked about autosave entries. Clearing it too is a one-line addition in SignOutForm.localStorage instead of sessionStorage, so drafts survive a closed tab or a crash. To keep drafts tab-scoped, switch storage() in form-autosave.ts to sessionStorage.AUTOSAVE_DELAY_MS).MAX_AGE_MS).#sub-name).?lexicon=), as the review asked. It is one-shot and lives for one tab, so it cannot come back on another lexicon's page later.Review: https://tangled.org/exosphere.site/airglow/compare/main...loop/3my32gozhgf22
loop:pushed run=contribute-20261026-215817-3my32gozhgf22 sha=27ce27e06705b43ead45952899afeeaa60dc0088
Verdict: changes-requested. The branch does what the owner's review asked: no secret in the draft, header names only, drafts cleared on sign-out and on "Revoke all sessions", and a test for each. pnpm run check and pnpm run test (174 files, 2667 tests) pass. But the blank form's autosave key moves whenever the user picks a lexicon, because the form rewrites ?lexicon= with history.replaceState and autosaveContext reads the live URL on every render. In the most common flow this leaves an orphan draft that comes back for an automation that has already been created.
What I checked and how:
form-autosave.ts, header-values.ts, AutomationForm.tsx, SignOutForm.tsx, RevokeSessions.tsx and the tests. WebhookDraft has no secret field, so the form state never holds one. withoutHeaderValues blanks the values at any depth. /auth/signout is only posted from the new SignOutForm island. No other action draft holds headers or credentials.#sub-name after it runs./work (since removed): open plain /automations/new, type a name, wait past the debounce, type app.bsky.feed.post into the lexicon field, wait, then create.
.../automations/new:1tundme. After the lexicon, the URL is ?lexicon=app.bsky.feed.post and there are two keys, the old one plus svy8lg.svy8lg is cleared./automations/new shows "We restored the unsaved draft..." with name "My automation", the automation the user just created.Changes requested:
app/islands/AutomationForm.tsx, stop the blank form leaving drafts under an old key when ?lexicon= changes. One approach that works (I tried it: with it, the probe leaves no key after create, nothing restores on the next plain visit, and all 81 AutomationForm.test.tsx tests still pass): keep a lastAutosaveContextRef initialised to autosaveContext. In writeAutosave, if it differs from the current autosaveContext, call clearAutosavedDraft(lastAutosaveContextRef.current) and update the ref before saving. The draft then follows the URL, and a reload on the rewritten ?lexicon= URL still restores it. Do not just freeze the context at mount: after a lexicon pick, the reload URL carries the new ?lexicon=, so a frozen key would stop restoring on reload.AutomationForm autosave block for that flow. On plain /automations/new: type a name, settle, set #lexicon, settle, and check that only one draft key exists. Then a successful create leaves localStorage empty, and remounting on plain /automations/new restores nothing.Note for the owner, not a required change: the draft keeps each webhook's callbackUrl in localStorage. Users who paste a raw URL with a token in it (such as a Discord webhook URL) instead of {{secret:...}} will have that token stored for up to 7 days. The owner's review did not ask for this, and the public view already strips callback URLs for the same reason.
No migration and no followup.md in this branch.
loop:verdict run=review-20261026-220739-3my32gozhgf22 sha=27ce27e06705b43ead45952899afeeaa60dc0088 verdict=changes-requested
Fix round 3: the review asked for changes.
loop:fix run=contribute-20261026-221157-3my32gozhgf22 round=3 issue=33
feat(automations): autosave the automation form draft in the browser
The automation form (new, duplicate and edit) now saves what you have typed to localStorage one second after each change. It also saves right away when the page is hidden or unloaded. The next visit to the same page restores that draft and says so at the top of the form, with a "Discard draft" link that returns the form to its starting state. Work now survives reloads, redirects, closed tabs and browser crashes, not just the scope-upgrade round trip (#6). A small "Draft autosaved in this browser on ..." line above the submit buttons shows that it is working. Drafts never hold a webhook secret or a header value, and signing out removes all of them.
This round (third review): picking a lexicon on a blank /automations/new rewrites the URL's ?lexicon=, which changes the autosave key. Before, the draft saved under the old key stayed behind, and after a create the next plain visit restored the automation that had just been created. Now the draft moves with the URL: when the key changes, the next autosave removes the draft under the old key before it writes the new one. A successful create, and "Discard draft", also clear both keys. A reload on the rewritten ?lexicon= URL still restores the draft.
Second review: on /automations/new, the autosave key now includes the ?lexicon= link the blank form was opened from. Before, a draft started from ?lexicon=app.bsky.feed.post came back on ?lexicon=app.bsky.graph.follow. Now plain /automations/new and each ?lexicon=X keep their own draft. Also, after "Discard draft", focus moves to the name input, so keyboard and screen-reader users are no longer dropped at the top of the page when the notice unmounts.
Previous round (owner's review): webhook header values are left out of the saved draft, which keeps only the header names. A restored draft gets each value back from the page's seed, which is what the server has. The draft never held the HMAC secret, because the form never has one, and a test now checks that. Signing out, and "Revoke all sessions", now remove every autosaved draft in the browser.
app/islands/form-autosave.ts. Each draft is keyed by pathname plus a hash of an autosaveContext: the viewer handle, the page's seed and, for a blank form with no seed, the URL's lexicon param. A draft therefore only restores for the same user, the same seed and the same ?lexicon= link: another duplicate, another account, or an automation changed on the server since then starts clean. Drafts expire after 7 days, and expired ones are swept on read. It reuses hashContext from scope-upgrade-draft.ts, which is now exported.withoutHeaderValues (new, app/islands/step-drafts/header-values.ts) blanks every webhook header value at any depth and keeps the names. On restore, withSeedHeaderValues fills each blank value from the seed's webhook. It matches the same step id first, then the same callback URL, because duplicates mint new ids on each load. A header the seed does not have comes back with a name and an empty value. When the restored draft has headers, the restore notice says that header values are not saved and asks the user to re-enter any they changed.app/islands/SignOutForm.tsx, with the same markup and styles (the styles moved from app/routes/settings/account.css.ts to app/islands/SignOutForm.css.ts). Before the form posts, it calls clearAllAutosavedDrafts(), which removes every airglow:automation-draft: key for every page and viewer. RevokeSessions calls the same function before it sends the user to /auth/login. Other keys, such as theme, stay.sessionStorage still wins when it is present, and keeps its own "before the permissions sign-in" notice.pagehide flush cannot write it back while the page navigates away.pnpm run check: passes.pnpm run test: 174 files and 2668 tests pass.AutomationForm.test.tsx, "moves a blank form's draft along when picking a lexicon rewrites ?lexicon=". On plain /automations/new it types a name, lets the autosave run, sets #lexicon to app.bsky.feed.post and lets it run again. It checks that the URL is ?lexicon=app.bsky.feed.post and that only one draft key exists. A successful create then leaves localStorage empty, and remounting on plain /automations/new restores nothing. Without the change to AutomationForm.tsx, this test fails with 2 keys instead of 1.AutomationForm.test.tsx, "keeps a blank form's draft to the ?lexicon= it was started from", saves a draft on ?lexicon=app.bsky.feed.post. It checks that the draft does not restore on ?lexicon=app.bsky.graph.follow (which shows its own lexicon) or on plain /automations/new, and that it does restore on the same ?lexicon=. The "discards a restored draft back to the page's own seed" test now checks that document.activeElement is the name input. I checked that both tests fail without the change to AutomationForm.tsx.AutomationForm.test.tsx, "keeps the secret and the header values out of a draft saved on an edit page": the seed has an HMAC secret and an Authorization header, and the user adds a header with a typed value. The stored string has neither secret nor values, and does have the header names.AutomationForm.test.tsx, "submits a restored edit draft with the server's header values and no secret", checks that the PATCH body carries the same callback URL, the server's header value and no secret. app/routes/api/automations/[rkey].test.ts, "keeps the webhook secret and headers when a restored draft is submitted", sends that same body to the PATCH handler and checks that the stored secret and headers are unchanged.app/islands/SignOutForm.test.tsx seeds drafts for two pages and two viewers, then checks that submitting the sign-out form, or revoking every session, leaves no draft key and keeps theme. I checked that the sign-out test fails when the clear call is removed.step-drafts/header-values.test.ts (strip and refill at any depth, matching by id and by URL), form-autosave.test.ts (clearAllAutosavedDrafts), and a duplicate-page restore that refills by callback URL.form-autosave.test.ts and the AutomationForm autosave block: round trip, path and context isolation, expiry, sweep, the pagehide flush, untouched forms not saved, undo drops the draft, no restore into another duplicate, viewer or changed automation, discard and cancelled discard, and the draft cleared on a successful save.sessionStorage for at most 30 minutes, belongs to one tab, holds the full form including header values, and is on main already. I left it out because the review asked about autosave entries. Clearing it too is a one-line addition in SignOutForm.localStorage instead of sessionStorage, so drafts survive a closed tab or a crash. To keep drafts tab-scoped, switch storage() in form-autosave.ts to sessionStorage.AUTOSAVE_DELAY_MS).MAX_AGE_MS).#sub-name).?lexicon=), as the review asked. It is one-shot and lives for one tab, so it cannot come back on another lexicon's page later.?lexicon= changes, as the review suggested. The key is not frozen at mount, because the reload URL carries the new ?lexicon=. The cost: a draft started on ?lexicon=A and then switched to B no longer restores on ?lexicon=A.{{secret:...}}) is kept in localStorage for up to 7 days. This branch leaves it as is because no review asked for a change. Dropping or masking callbackUrl in withoutHeaderValues would fix that, but then restoring a duplicate's webhook by URL would no longer work.Review: https://tangled.org/exosphere.site/airglow/compare/main...loop/3my32gozhgf22
loop:pushed run=contribute-20261026-221157-3my32gozhgf22 sha=02a338a4d4d66939e0d494325451de33c378a60f
Verdict: merge. The branch autosaves the automation form (new, duplicate and edit) to localStorage one second after each change and on pagehide, and restores it on the next visit to the same page, so work survives reloads, redirects and crashes as the issue asks. It also covers all three points of the owner's review. The draft never holds the webhook HMAC secret, because the form state has no secret field and the server keeps the one it has. Header values are blanked before the draft is saved and refilled from the page's seed when it is restored. Signing out, and "Revoke all sessions", clear every airglow:automation-draft: key. pnpm run check and pnpm run test both pass (174 files, 2668 tests).
What I checked and how:
run.json. Both pass.WebhookDraft has no secret field, and fromAction never copies one. The edit-page test seeds an HMAC secret and asserts that the stored string has neither the secret nor the word "secret". A new PATCH-handler test in [rkey].test.ts sends the shape a restored draft submits and asserts that the stored secret and headers are unchanged.withoutHeaderValues blanks header values at any depth, inside conditions and loops, and keeps the names. withSeedHeaderValues refills them by step id first, then by callback URL. When a restored draft has headers, the notice tells the user to re-enter any values they changed. Webhook is the only action type with headers.app/ that posts to /auth/signout, and it is now the SignOutForm island, which clears drafts in onSubmit without blocking the post. RevokeSessions clears drafts on success. SignOutForm.test.tsx covers both paths and checks that theme is kept. The owner's three requested tests are all there.?lexicon=. When picking a lexicon rewrites the URL, the draft moves to the new key and the old one is dropped. A successful create or update, and "Discard draft", clear both keys and stop the pagehide flush.<button> with a distinct name. It asks for confirmation, and focus then moves to #sub-name./automations/new?lexicon=app.bsky.feed.post and on plain /automations/new writes no draft.operations: ["create"] and dedupeBySource: false does autosave while untouched, because the existing snap effect flips dedupeBySource. Both API routes force dedupeBySource to true when the operations do not include update, so the server should never store that state.followup.md to judge.Accepted trade-offs, listed in the PR: callback URLs, which may embed tokens, stay in the draft, and the sessionStorage scope-upgrade stash is not cleared on sign-out. The owner can revisit either one.
loop:verdict run=review-20261026-222730-3my32gozhgf22 sha=02a338a4d4d66939e0d494325451de33c378a60f verdict=merge
Merged main into the branch: 1629edbe4f756ab2688e0e779e6b02a6e8955372.
loop:carry from=02a338a4d4d66939e0d494325451de33c378a60f sha=1629edbe4f756ab2688e0e779e6b02a6e8955372
Merged onto main as 5e1491f7bf6b256e8d8b956a6be633a7423862f8.
loop:merged sha=5e1491f7bf6b256e8d8b956a6be633a7423862f8 head=1629edbe4f756ab2688e0e779e6b02a6e8955372
Queued: the loop will work on this version of the issue.
loop:queued cid=bafyreigcsloxntokq3nhruzp7v433ygavbhkhxxgxffb5tc37h3u22fjou