Release: develop を main にマージ

[otomatty]

概要

develop の累積変更を本番ライン main に取り込むリリース用 PR です（integration → production）。

変更点

本 PR はブランチ間マージのため差分が大きくなっています。主な領域は次のとおりです。

領域	主な変更
src/	ノート中心のアーキテクチャへ統合（ページエディタの再構成、NotePageView / NotePagePublicView、タグフィルタバー、PDF ビューア・ハイライト連携、協調編集・FAB の整理 など）
server/api/	ノート・ページ API の見直し（キーセットページネーション、SSE、スナップショット／コンテンツ取得経路、snapshotService 廃止、/health、マイグレーション 0030_add_notes_tag_filter_bar.sql など）
server/hocuspocus/	/health、WikiLink 正規化、認証・同期まわりの修正
server/mcp/	クライアント・ツール・テストの更新
e2e/	スペックの追加・削除・調整
.github/	Drizzle スキーマドリフト検知など CI 強化
依存関係	Dependabot 由来の GitHub Actions / npm パッケージ更新

変更の種類

• ✨ 新機能 (New feature)
• 🐛 バグ修正 (Bug fix)
• 🎨 スタイル/リファクタリング (Style/Refactor)
• 🧪 テスト (Tests)
• 🔧 ビルド/CI (Build/CI)
• 💥 破壊的変更 (Breaking change)
• 📝 ドキュメント (Documentation)

※ API・ルーティングに変更があるため、マージ前にステージングでの動作確認とマイグレーション適用を推奨します。

テスト方法

1. PR の CI（lint / test / 関係ジョブ）がすべてグリーンであることを確認する。
2. development 環境で DB マイグレーション適用後、アプリの主要フロー（ノート一覧・ページ編集・公開ビュー・PDF・検索）を確認する。
3. Hocuspocus のヘルスチェックと協調編集が期待どおりか確認する。

チェックリスト

• テストがすべてパスする（CI で確認）
• Lint エラーがない（CI で確認）
• 本番マイグレーション計画（server/api/drizzle/）を確認した
• マージ方法: プロジェクト方針に従い Create a merge commit でマージする（リリースブランチの取り込み用）

スクリーンショット（UI 変更がある場合）

ノート UI・タグフィルタ・PDF・スケルトン表示など変更あり。必要に応じてリリースノート用にキャプチャを添付してください。

関連 Issue

複数の機能 Issue / PR が develop に集約されています。代表的なもの: #389, #675, #847, #860, #863, #864, #880, #889, #890, #896, #897 など。

Made with Cursor

Summary by CodeRabbit

• New Features

  • Admin "API errors" dashboard with AI-assisted analysis, auto-issue workflow, real-time feed, admin UI pages and sidebar badge counts
  • PDF knowledge ingestion (Phase 1) and PDF highlights; browser extension clip path updated
  • Per-user default notes, page snapshots (version history), per-note tag filter bar, and updated web-clipper routing

• Bug Fixes

  • Schema/migration drift checks and improved server error reporting with Sentry integration

• Documentation

  • Detailed AI analysis Action docs and Sentry DSN guidance in env examples

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c1417f99b2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Make new-issue detection atomic before dispatching analysis

isNew is computed from a separate pre-upsert read, so concurrent webhook deliveries for the same brand-new sentry_issue_id can both observe existing === null and both fire dispatchAnalyzeError. That creates duplicate repository_dispatch events for one logical issue, which means redundant Claude runs and duplicate downstream issue/comment churn. Derive “newness” from the upsert result itself (for example, only dispatch when the returned row indicates first insertion) or wrap the read+write decision in an atomic DB flow.

Useful? React with 👍 / 👎.

[otomatty]

【対応見送り】sentry.ts 内で並行 webhook による二重 dispatch を許容するトレードオフと、ワークフロー側での冪等前提が既にコメントされています。upsert と検知を原子的にする変更は別設計 PR とします。

[Won't fix in PR #908] The handler documents the race and relies on workflow-side idempotency; making new-issue detection atomic would be a separate design PR.

[coderabbitai]

Actionable comments posted: 17

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

server/api/src/routes/notes/members.ts (1)

267-275: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Emit note.permission_changed only after an actual delete mutation.

At Line 267, the delete query does not verify an active-member match, and at Line 274 the event is always published. This can emit false permission-change notifications (and unnecessary client refetches) on no-op deletes.

Suggested fix

-  await db
+  const deleted = await db
     .update(noteMembers)
     .set({ isDeleted: true, updatedAt: new Date() })
-    .where(and(eq(noteMembers.noteId, noteId), eq(noteMembers.memberEmail, memberEmail)));
+    .where(
+      and(
+        eq(noteMembers.noteId, noteId),
+        eq(noteMembers.memberEmail, memberEmail),
+        eq(noteMembers.isDeleted, false),
+      ),
+    )
+    .returning({ noteId: noteMembers.noteId });
+
+  if (deleted.length === 0) {
+    throw new HTTPException(404, { message: "Member not found" });
+  }
 
   // Issue `#860` Phase 4: メンバー削除も `getNoteRole` の挙動を変えるため通知。
   // Issue `#860` Phase 4: removing a member affects `getNoteRole`; notify too.
   publishNoteEvent({ type: "note.permission_changed", note_id: noteId });

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@server/api/src/routes/notes/members.ts` around lines 267 - 275, The update
currently marks noteMembers as deleted and always calls
publishNoteEvent("note.permission_changed") even when no active member was
matched; modify the mutation to target only active members (include
eq(noteMembers.isDeleted, false) or equivalent) and capture the update
result/affected row count from the db.update call (the update on noteMembers
that sets isDeleted and updatedAt). Only call publishNoteEvent({ type:
"note.permission_changed", note_id: noteId }) when the update affected at least
one row; leave the rest of the logic (setting isDeleted and updatedAt)
unchanged.

🧹 Nitpick comments (3)

admin/src/pages/errors/useApiErrors.test.ts (1)

225-239: ⚡ Quick win

Add a case where an existing visible row becomes filter-mismatched after SSE update

Current coverage only checks ignoring a brand-new mismatched row. Please add a case where an already-listed row receives an update that changes status/severity and should be removed from the filtered list.

✅ Suggested additional test

+  it("removes an existing row when an SSE update makes it fail the active filter", async () => {
+    const { result } = renderHook(() =>
+      useApiErrors({ status: "open", intervalMs: 0 }),
+    );
+    await waitFor(() => expect(result.current.loading).toBe(false));
+
+    const base = getBaseRow();
+    expect(base.status).toBe("open");
+
+    act(() => {
+      getInstance().dispatch("ready", "");
+      getInstance().dispatch("update", { ...base, status: "resolved" });
+    });
+
+    expect(result.current.errors.find((r) => r.id === base.id)).toBeUndefined();
+  });

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@admin/src/pages/errors/useApiErrors.test.ts` around lines 225 - 239, Add a
new test to cover the case where an already-visible error becomes
filter-mismatched after an SSE update: renderHook with useApiErrors({ status:
"open", severity: "high", intervalMs: 0 }), seed an initial matching item via
makePushed({ status: "open", severity: "high" }) and dispatch it with
getInstance().dispatch("ready", "") and dispatch("update", initialItem), assert
it appears in result.current.errors, then dispatch an update that changes its
fields to mismatched values (e.g., dispatch("update", { ...initialItem, status:
"resolved", severity: "low" })) and assert the item is removed from
result.current.errors and result.current.total updates accordingly; use
waitFor/act around async state assertions as in the existing test.

scripts/gen-pdf-fixture.ts (1)

54-55: ⚡ Quick win

Use byte length for PDF stream /Length fields to ensure compatibility with non-ASCII content.

The /Length entry must specify stream byte size, not character count. For ASCII-only content, string.length currently works, but if the fixture ever includes non-ASCII characters, the mismatch will cause parser failures. Use TextEncoder().encode().byteLength to guarantee correctness.

♻️ Proposed fix

+  const page1Length = new TextEncoder().encode(page1Content).byteLength;
+  const page2Length = new TextEncoder().encode(page2Content).byteLength;
   // 各 obj を文字列の配列として生成する。xref で参照するバイトオフセットは
   // 後段で連結時に計測する。
   // Each object's body. The xref byte offsets are computed below as we
   // concatenate the actual file bytes.
   const objects: string[] = [
     // 1: Catalog
     "<< /Type /Catalog /Pages 2 0 R >>",
     // 2: Pages
     "<< /Type /Pages /Kids [3 0 R 5 0 R] /Count 2 >>",
     // 3: Page 1
     "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] " +
       "/Contents 4 0 R /Resources << /Font << /F1 7 0 R >> >> >>",
     // 4: Page 1 content stream
-    `<< /Length ${page1Content.length} >>\nstream\n${page1Content}endstream`,
+    `<< /Length ${page1Length} >>\nstream\n${page1Content}endstream`,
     // 5: Page 2
     "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] " +
       "/Contents 6 0 R /Resources << /Font << /F1 7 0 R >> >> >>",
     // 6: Page 2 content stream
-    `<< /Length ${page2Content.length} >>\nstream\n${page2Content}endstream`,
+    `<< /Length ${page2Length} >>\nstream\n${page2Content}endstream`,
     // 7: Font
     "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>",
   ];

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/gen-pdf-fixture.ts` around lines 54 - 55, The `/Length` value uses
character count (page1Content.length) which breaks for non-ASCII bytes; compute
the stream byte length instead by encoding the content with TextEncoder and
using its byte length when writing `/Length` (e.g., replace references to
page1Content.length with the byte length from
TextEncoder().encode(page1Content)); apply the same change for any other stream
content variables (e.g., page2Content) so all `/Length` fields reflect actual
byte sizes.

server/api/src/routes/internal.ts (1)

56-59: 💤 Low value

Consider timing-safe comparison for secret validation.

The direct string comparison provided !== expected is vulnerable to timing attacks. While this is an internal-only endpoint, using crypto.timingSafeEqual would follow security best practices.

Since this is internal service-to-service communication behind a firewall, the risk is low.

Proposed fix

+import { timingSafeEqual } from "node:crypto";
+
+function safeEqual(a: string, b: string): boolean {
+  const bufA = Buffer.from(a);
+  const bufB = Buffer.from(b);
+  if (bufA.length !== bufB.length) return false;
+  return timingSafeEqual(bufA, bufB);
+}
+
 function assertInternalAuth(c: { req: { header: (name: string) => string | undefined } }): void {
   const expected = process.env.BETTER_AUTH_SECRET?.trim();
   // ...
   const provided = c.req.header("x-internal-secret")?.trim();
-  if (!provided || provided !== expected) {
+  if (!provided || !safeEqual(provided, expected)) {
     throw new HTTPException(401, { message: "Unauthorized" });
   }
 }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@server/api/src/routes/internal.ts` around lines 56 - 59, Replace the direct
string comparison of the header secret (variables provided and expected in the
internal route) with a timing-safe comparison: ensure both values are converted
to Buffers of equal length (pad or early-fail only if lengths differ) and use
crypto.timingSafeEqual to compare them; update the check around the block that
currently throws HTTPException(401, { message: "Unauthorized" }) so it uses the
timing-safe result instead of provided !== expected and still throws the same
401 on mismatch.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/actions/claude-analyze/action.yml:
- Around line 159-163: The echoed workflow annotation currently injects raw
callback body via "$(cat /tmp/callback-response.txt)" into the ::error command;
instead create an escaped version of the response (e.g., in a helper shell
function like escape_for_workflow_annotation or a variable named
escaped_response) that replaces "%" -> "%25", CR -> "%0D", LF -> "%0A" and also
substitutes "::" with "%3A%3A" before embedding, then use the escaped variable
in the two echo lines (the ones using ::error title=Callback rejected ... and
::error title=Callback failed after ...) so annotations cannot be corrupted or
used to inject extra workflow commands.

In @.github/actions/claude-analyze/autoIssueRunner.mjs:
- Around line 35-39: The env var validation currently checks the raw string from
process.env[name], which lets whitespace-only values pass; change the logic to
trim the retrieved value before validating and returning it: get value =
process.env[name], ensure it's a string, compute trimmed = value.trim(), throw
Error if trimmed.length === 0, and return the trimmed string (use these symbols:
value, process.env[name], trimmed) so callers get a cleaned value.

In @.github/actions/claude-analyze/schema.mjs:
- Around line 95-100: The current JSON extraction using
raw.indexOf("{")/lastIndexOf("}") fails when braces appear in prose; update the
parsing in the Claude response handler to (1) first try extracting a fenced JSON
block (use the existing fence/parsedFence/tryParse flow and validate with
analysisOutputSchema.safeParse), (2) then attempt to parse the entire raw.trim()
as JSON and validate, and (3) as a fallback scan for valid object-like slices by
iterating every "{" start index and every "}" end index to build candidates,
tryParse each candidate until one parses, then validate with
analysisOutputSchema.safeParse; if none succeed throw "Could not locate a valid
JSON object in Claude response". Ensure you reference and reuse tryParse,
parsedFence, fence, raw, and analysisOutputSchema in the implementation.

In `@admin/src/api/admin.test.ts`:
- Around line 288-295: The test claims to verify URL-encoding but uses a
URL-safe UUID; change the test to use an ID containing reserved characters
(e.g., spaces, slashes, question marks, percent signs) so encoding actually
matters: update or add a test-local id (e.g., reservedId) and set
sampleErrorRow.id or pass reservedId into getApiErrorById, keep mocking
adminFetch to return the row, then assert adminFetch was called with the path
`/api/admin/errors/${encodeURIComponent(reservedId)}`; reference
getApiErrorById, adminFetch, and sampleErrorRow in the test to locate and update
the code.

In `@admin/src/i18n/locales/en/nav.json`:
- Line 5: The ARIA string "unreadBadgeAriaLabel" currently always uses "errors"
and is not plural-aware; update the "unreadBadgeAriaLabel" entry to use ICU
pluralization (or your i18n plural syntax) so it renders "1 unresolved API
error" for count=1 and "N unresolved API errors" otherwise, ensuring screen
readers receive grammatically correct singular/plural text.

In `@admin/src/pages/errors/ErrorDetailDialog.tsx`:
- Around line 55-60: The pendingFor state (and thus pendingStatus) can remain
stale when the dialog is closed; ensure you clear it by calling
setPendingFor(null) whenever the dialog is closed or the row changes—add
setPendingFor(null) to the dialog close handler(s) used in this component (the
function that closes the ErrorDetailDialog) and/or in a useEffect that resets
pendingFor when row becomes null or the dialog open flag changes so reopening
the same error doesn't show an unsaved status or enable Save unexpectedly;
reference pendingFor, setPendingFor, setPendingStatus and pendingStatus when
making this change.

In `@admin/src/pages/errors/ErrorsContent.tsx`:
- Around line 128-131: The Select component's value prop is being given the
sentinel string "all" while its option sentinel is the constant ANY ("__any__"),
causing mismatch; update the Select value to pass statusFilter === "all" ? ANY :
statusFilter (or otherwise ensure you convert "all" to ANY) and keep the
onValueChange mapping as (v) => onStatusFilterChange(v === ANY ? "all" : (v as
ApiErrorStatus)) so the control's selected value and the internal "all" <-> ANY
mapping remain consistent; update the same fix for both usages around the
statusFilter Select and the duplicated block that uses onStatusFilterChange.

In `@admin/src/pages/errors/useApiErrors.ts`:
- Around line 225-229: The SSE update path currently drops incoming rows that
don't match the active filter (using filterRef.current and matchesFilter) which
leaves stale entries if that row already exists in the current data; change the
handler so when a row fails matchesFilter you check the existing state inside
setData (or read data.errors) and, if the row.id exists, remove that row from
the errors array and decrement/adjust any filtered totals before returning the
new state; otherwise (if the row isn't present) return prev unchanged. Keep
isMountedRef.current check and use mergeRow only when matchesFilter is true.

In `@server/api/src/__tests__/routes/admin/errors.test.ts`:
- Around line 340-355: The readUntil function's timeoutMs isn't enforced because
await reader.read() can block indefinitely; update readUntil (and its use of
reader.read) to race each read() against a timeout promise so the loop can break
when the per-iteration or overall timeout elapses, and on timeout call
reader.cancel() (or close the stream) and return the accumulated text;
specifically wrap reader.read() in a Promise.race that rejects/resolves after
the remaining timeoutMs, preserve decoding/accumulation logic and predicate
checks, and ensure timeout handling returns acc instead of hanging.

In `@server/api/src/__tests__/routes/pages.test.ts`:
- Around line 70-71: Update the two Japanese-only JSDoc comments (the one above
const NOTE_ID and the one at lines ~96-97) to include English translations
alongside the Japanese; specifically, for the comment referencing pages.note_id
and findActiveNoteById (related to NOTE_ID = "note-access-test-001"), add an
English sentence that mirrors the Japanese meaning so both languages appear in
the same JSDoc block, and do the same for the other comment near
findActiveNoteById to satisfy the bilingual documentation rule.

In `@server/api/src/__tests__/routes/pageSnapshots.test.ts`:
- Line 57: The inline documentation comment "/** 1: pages row  2: caller email 
3: findActiveNoteById */" is English-only; add a Japanese counterpart right next
to or below it (e.g. "/** 1: pages row  2: caller email  3: findActiveNoteById /
1: ページ行 2: 呼び出し元メール 3: findActiveNoteById */") so the test file
server/api/src/__tests__/routes/pageSnapshots.test.ts contains both English and
Japanese, preserve the comment formatting and UTF-8 encoding and ensure it
remains a single block comment used by the test file.

In `@server/api/src/__tests__/routes/syncPages.test.ts`:
- Line 20: The comment at the top of the test ("GET/POST sync は
ensureDefaultNote を先に叩く。モックしてチェーンをページ同期クエリに寄せる。") is Japanese-only; add an
English translation on the same line or immediately above/below so the comment
is bilingual (e.g., "GET/POST sync should call ensureDefaultNote first. Mock it
and steer the chain toward the page sync query. / GET/POST sync は
ensureDefaultNote を先に叩く。モックしてチェーンをページ同期クエリに寄せる。"), ensuring the test file's
comment remains clear and follows the bilingual guideline.

In `@server/api/src/__tests__/routes/webhooks/sentry.test.ts`:
- Around line 281-314: The test "does NOT fire repository_dispatch on a
recurrence (isNew=false)" stubs global fetch with vi.stubGlobal but only calls
vi.unstubAllGlobals() at the end, risking leakage if the test throws; wrap the
section that stubs fetch and exercises the app in a try/finally so
vi.unstubAllGlobals() (or vi.unstubGlobal("fetch")) is always called in the
finally block; update the test around the vi.stubGlobal("fetch", fetchMock) /
app.request(...) / assertions to ensure cleanup (refer to fetchMock,
vi.stubGlobal, vi.unstubAllGlobals/vi.unstubGlobal, and createApp).

In `@server/api/src/__tests__/services/pageAccessService.test.ts`:
- Around line 146-148: The test uses noRoleChains(USER_ID) which still models
the caller as the owner; change the mock to model a different user so the
non-owner branch is exercised: replace the role chain setup passed to
createMockDb from noRoleChains(USER_ID) to a role chain for a different id (e.g.
ANOTHER_USER_ID or OWNER_ID depending on existing fixtures) so that
assertPageEditAccess(asDb(db), PAGE_ID, USER_ID) rejects as intended; update any
related constants in the test to ensure USER_ID is not the underlying row owner
and all mocks (createMockDb, noRoleChains) reference the distinct id.

In `@server/api/src/lib/githubAppAuth.ts`:
- Around line 155-191: The getInstallationToken function currently lets every
caller perform its own POST when the cache is cold or within REFRESH_MARGIN_MS;
add a module-scoped in-flight promise (e.g., installationTokenRefreshPromise) to
coalesce concurrent refreshes: at the top of getInstallationToken, after
checking cachedInstallationToken, if installationTokenRefreshPromise exists
return await it; otherwise create and store a promise that performs the existing
fetch/validation flow, sets cachedInstallationToken = { token, expiresAt } on
success, and clears installationTokenRefreshPromise in a finally block (also
clear on error) so subsequent callers either await the single inflight request
or trigger a new one once cleared; reference getInstallationToken,
cachedInstallationToken and REFRESH_MARGIN_MS for locating where to add the
promise logic.

In `@server/api/src/lib/sentry.ts`:
- Around line 99-107: The scrubSentryEvent function currently copies
event.request through unchanged; update it to drop or normalize
event.request.url to avoid leaking path tokens (e.g., capability IDs) — locate
scrubSentryEvent and, when rebuilding event.request, replace event.request.url
with a sanitized value (either null/empty string or a normalized path-only value
such as ApiErrorContext.routePath or a function that strips dynamic segments and
query strings), reusing existing helpers like scrubQueryStringField where
appropriate so the URL no longer contains raw path tokens before returning the
event.

In `@server/api/src/routes/admin/errors.ts`:
- Line 280: The handler returns a success payload with the key "error"
containing row data (e.g., the response at the return c.json({ error: row }) in
server/api/src/routes/admin/errors.ts and the analogous return in the PATCH
handler), which is misleading; update both handlers to use a descriptive key
such as data or apiError (for example change { error: row } to { data: row } in
the GET handler and the PATCH handler) so the response accurately reflects that
this is successful row data rather than an error.

---

Outside diff comments:
In `@server/api/src/routes/notes/members.ts`:
- Around line 267-275: The update currently marks noteMembers as deleted and
always calls publishNoteEvent("note.permission_changed") even when no active
member was matched; modify the mutation to target only active members (include
eq(noteMembers.isDeleted, false) or equivalent) and capture the update
result/affected row count from the db.update call (the update on noteMembers
that sets isDeleted and updatedAt). Only call publishNoteEvent({ type:
"note.permission_changed", note_id: noteId }) when the update affected at least
one row; leave the rest of the logic (setting isDeleted and updatedAt)
unchanged.

---

Nitpick comments:
In `@admin/src/pages/errors/useApiErrors.test.ts`:
- Around line 225-239: Add a new test to cover the case where an already-visible
error becomes filter-mismatched after an SSE update: renderHook with
useApiErrors({ status: "open", severity: "high", intervalMs: 0 }), seed an
initial matching item via makePushed({ status: "open", severity: "high" }) and
dispatch it with getInstance().dispatch("ready", "") and dispatch("update",
initialItem), assert it appears in result.current.errors, then dispatch an
update that changes its fields to mismatched values (e.g., dispatch("update", {
...initialItem, status: "resolved", severity: "low" })) and assert the item is
removed from result.current.errors and result.current.total updates accordingly;
use waitFor/act around async state assertions as in the existing test.

In `@scripts/gen-pdf-fixture.ts`:
- Around line 54-55: The `/Length` value uses character count
(page1Content.length) which breaks for non-ASCII bytes; compute the stream byte
length instead by encoding the content with TextEncoder and using its byte
length when writing `/Length` (e.g., replace references to page1Content.length
with the byte length from TextEncoder().encode(page1Content)); apply the same
change for any other stream content variables (e.g., page2Content) so all
`/Length` fields reflect actual byte sizes.

In `@server/api/src/routes/internal.ts`:
- Around line 56-59: Replace the direct string comparison of the header secret
(variables provided and expected in the internal route) with a timing-safe
comparison: ensure both values are converted to Buffers of equal length (pad or
early-fail only if lengths differ) and use crypto.timingSafeEqual to compare
them; update the check around the block that currently throws HTTPException(401,
{ message: "Unauthorized" }) so it uses the timing-safe result instead of
provided !== expected and still throws the same 401 on mismatch.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 3536d434-5118-45d2-81a8-12265c62c0c4

📥 Commits

Reviewing files that changed from the base of the PR and between 9dbc9f9 and c1417f9.

⛔ Files ignored due to path filters (4)

• bun.lock is excluded by !**/*.lock
• e2e/fixtures/sample.pdf is excluded by !**/*.pdf
• server/api/bun.lock is excluded by !**/*.lock
• src-tauri/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (296)

• .env.example
• .github/actions/claude-analyze/README.md
• .github/actions/claude-analyze/__tests__/autoIssue.test.mjs
• .github/actions/claude-analyze/__tests__/fixtures/invalid-bad-severity.json
• .github/actions/claude-analyze/__tests__/fixtures/invalid-missing-summary.json
• .github/actions/claude-analyze/__tests__/fixtures/invalid-suspected-file.json
• .github/actions/claude-analyze/__tests__/fixtures/invalid-too-many-files.json
• .github/actions/claude-analyze/__tests__/fixtures/valid-high.json
• .github/actions/claude-analyze/__tests__/fixtures/valid-low-nulls.json
• .github/actions/claude-analyze/__tests__/schema.test.mjs
• .github/actions/claude-analyze/action.yml
• .github/actions/claude-analyze/analyze.mjs
• .github/actions/claude-analyze/autoIssue.mjs
• .github/actions/claude-analyze/autoIssueRunner.mjs
• .github/actions/claude-analyze/prompt.md
• .github/actions/claude-analyze/schema.mjs
• .github/workflows/analyze-error.yml
• .github/workflows/ci.yml
• .gitignore
• .gitleaksignore
• admin/.env.example
• admin/e2e/errors-page.spec.ts
• admin/package.json
• admin/playwright.config.ts
• admin/src/App.tsx
• admin/src/api/admin.test.ts
• admin/src/api/admin.ts
• admin/src/api/client.ts
• admin/src/components/ErrorBoundary.test.tsx
• admin/src/components/ErrorBoundary.tsx
• admin/src/i18n/index.ts
• admin/src/i18n/locales/en/errors.json
• admin/src/i18n/locales/en/nav.json
• admin/src/i18n/locales/ja/errors.json
• admin/src/i18n/locales/ja/nav.json
• admin/src/lib/sentry.ts
• admin/src/main.tsx
• admin/src/pages/Layout.tsx
• admin/src/pages/errors/ErrorDetailDialog.tsx
• admin/src/pages/errors/ErrorsContent.test.tsx
• admin/src/pages/errors/ErrorsContent.tsx
• admin/src/pages/errors/index.tsx
• admin/src/pages/errors/useApiErrorActiveCount.ts
• admin/src/pages/errors/useApiErrors.test.ts
• admin/src/pages/errors/useApiErrors.ts
• e2e/auth-mock.ts
• e2e/fixtures/README.md
• e2e/page-editor.spec.ts
• e2e/pdf-knowledge.spec.ts
• e2e/web-clipper.spec.ts
• e2e/wikilink-create-dialog.spec.ts
• extension/README.md
• extension/background.js
• extension/constants.js
• extension/manifest.base.json
• extension/manifest.json
• extension/popup.html
• extension/popup.js
• knip.json
• package.json
• packages/ui/package.json
• scripts/check-drizzle-schema-drift.mjs
• scripts/check-drizzle-schema-drift.test.mjs
• scripts/copy-pdfjs-assets.mjs
• scripts/gen-pdf-fixture.ts
• server/api/.env.example
• server/api/drizzle/0019_add_api_errors.sql
• server/api/drizzle/0020_seed_thumbnail_tier_quotas.sql
• server/api/drizzle/0021_add_pages_thumbnail_object_id.sql
• server/api/drizzle/0022_add_default_note.sql
• server/api/drizzle/0023_migrate_personal_pages_drop_note_pages.sql
• server/api/drizzle/0024_add_pages_note_active_updated_index.sql
• server/api/drizzle/0025_add_pdf_source_metadata.sql
• server/api/drizzle/0026_add_pdf_highlights.sql
• server/api/drizzle/0027_add_pages_note_active_updated_id_index.sql
• server/api/drizzle/0028_add_page_snapshots.sql
• server/api/drizzle/0029_invite_links_user_fk_cascade.sql
• server/api/drizzle/0030_add_notes_tag_filter_bar.sql
• server/api/drizzle/meta/_journal.json
• server/api/package.json
• server/api/src/__tests__/middleware/errorHandler.test.ts
• server/api/src/__tests__/routes/activity.test.ts
• server/api/src/__tests__/routes/admin/errors.test.ts
• server/api/src/__tests__/routes/media.test.ts
• server/api/src/__tests__/routes/notes/crud.test.ts
• server/api/src/__tests__/routes/notes/events.test.ts
• server/api/src/__tests__/routes/notes/me.test.ts
• server/api/src/__tests__/routes/notes/page-titles.test.ts
• server/api/src/__tests__/routes/notes/pages.test.ts
• server/api/src/__tests__/routes/notes/search.test.ts
• server/api/src/__tests__/routes/notes/setup.ts
• server/api/src/__tests__/routes/onboarding.test.ts
• server/api/src/__tests__/routes/pageSnapshots.test.ts
• server/api/src/__tests__/routes/pages.test.ts
• server/api/src/__tests__/routes/search.test.ts
• server/api/src/__tests__/routes/syncPages.test.ts
• server/api/src/__tests__/routes/thumbnail/commit.test.ts
• server/api/src/__tests__/routes/thumbnail/serve.test.ts
• server/api/src/__tests__/routes/webhooks/githubAiCallback.test.ts
• server/api/src/__tests__/routes/webhooks/sentry.test.ts
• server/api/src/__tests__/services/apiErrorBroadcaster.test.ts
• server/api/src/__tests__/services/commitService.test.ts
• server/api/src/__tests__/services/noteEventBroadcaster.test.ts
• server/api/src/__tests__/services/pageAccessService.test.ts
• server/api/src/__tests__/services/pageGraphSyncService.test.ts
• server/api/src/__tests__/services/snapshotService.test.ts
• server/api/src/__tests__/services/thumbnailGcService.test.ts
• server/api/src/app.ts
• server/api/src/index.ts
• server/api/src/lib/clipAndCreate.ts
• server/api/src/lib/githubAppAuth.test.ts
• server/api/src/lib/githubAppAuth.ts
• server/api/src/lib/sentry.test.ts
• server/api/src/lib/sentry.ts
• server/api/src/lib/welcomePageService.ts
• server/api/src/middleware/csrfOrigin.ts
• server/api/src/middleware/errorHandler.ts
• server/api/src/routes/activity.ts
• server/api/src/routes/admin/errors.ts
• server/api/src/routes/admin/index.ts
• server/api/src/routes/internal.ts
• server/api/src/routes/notes/crud.ts
• server/api/src/routes/notes/eventHelpers.ts
• server/api/src/routes/notes/events.ts
• server/api/src/routes/notes/helpers.ts
• server/api/src/routes/notes/index.ts
• server/api/src/routes/notes/me.ts
• server/api/src/routes/notes/members.ts
• server/api/src/routes/notes/pages.ts
• server/api/src/routes/notes/search.ts
• server/api/src/routes/notes/tags.ts
• server/api/src/routes/notes/titleIndex.ts
• server/api/src/routes/notes/types.ts
• server/api/src/routes/onboarding.ts
• server/api/src/routes/pageSnapshots.ts
• server/api/src/routes/pages.ts
• server/api/src/routes/pdfSources.ts
• server/api/src/routes/search.ts
• server/api/src/routes/syncPages.ts
• server/api/src/routes/thumbnail/commit.ts
• server/api/src/routes/thumbnail/serve.ts
• server/api/src/routes/webhooks/githubAiCallback.ts
• server/api/src/routes/webhooks/sentry.ts
• server/api/src/routes/wikiSchema.ts
• server/api/src/schema/apiErrors.ts
• server/api/src/schema/index.ts
• server/api/src/schema/notes.ts
• server/api/src/schema/pages.ts
• server/api/src/schema/pdfHighlights.ts
• server/api/src/schema/relations.ts
• server/api/src/schema/sources.ts
• server/api/src/services/apiErrorBroadcaster.ts
• server/api/src/services/apiErrorService.test.ts
• server/api/src/services/apiErrorService.ts
• server/api/src/services/commitService.ts
• server/api/src/services/defaultNoteService.test.ts
• server/api/src/services/defaultNoteService.ts
• server/api/src/services/indexBuilder.ts
• server/api/src/services/noteEventBroadcaster.ts
• server/api/src/services/notifier.test.ts
• server/api/src/services/notifier.ts
• server/api/src/services/pageAccessService.ts
• server/api/src/services/pageGraphSyncService.ts
• server/api/src/services/snapshotService.ts
• server/api/src/services/thumbnailGcService.ts
• server/api/src/services/titleRenamePropagationService.ts
• server/api/src/types/dbOrTx.ts
• server/hocuspocus/src/health.test.ts
• server/hocuspocus/src/health.ts
• server/hocuspocus/src/index.ts
• server/hocuspocus/src/pageEditPermission.test.ts
• server/hocuspocus/src/pageEditPermission.ts
• server/hocuspocus/src/snapshotUtils.ts
• server/hocuspocus/src/ydocWikiLinkNormalizer.test.ts
• server/hocuspocus/src/ydocWikiLinkNormalizer.ts
• server/mcp/README.md
• server/mcp/src/__tests__/client/httpClient.test.ts
• server/mcp/src/__tests__/e2e/stdio-roundtrip.test.ts
• server/mcp/src/__tests__/server.test.ts
• server/mcp/src/__tests__/tools/index.test.ts
• server/mcp/src/client/ZediClient.ts
• server/mcp/src/client/httpClient.ts
• server/mcp/src/tools/index.ts
• src-tauri/Cargo.toml
• src-tauri/src/lib.rs
• src-tauri/src/pdf_sources.rs
• src/App.tsx
• src/components/ErrorBoundary.tsx
• src/components/ai-chat/AIChatWikiLink.tsx
• src/components/ai-chat/PromoteToWikiDialog.tsx
• src/components/auth/ProtectedRoute.tsx
• src/components/editor/PageEditor/PageEditorAlerts.tsx
• src/components/editor/PageEditor/PageEditorDialogs.tsx
• src/components/editor/PageEditor/PageEditorHeader.test.tsx
• src/components/editor/PageEditor/PageEditorHeader.tsx
• src/components/editor/PageEditor/PageEditorLayout.test.tsx
• src/components/editor/PageEditor/PageEditorLayout.tsx
• src/components/editor/PageEditor/types.ts
• src/components/editor/PageEditor/useEditorAutoSave.test.ts
• src/components/editor/PageEditor/useEditorAutoSave.ts
• src/components/editor/PageEditor/usePageDeletion.test.ts
• src/components/editor/PageEditor/usePageDeletion.ts
• src/components/editor/PageEditor/usePageEditor.ts
• src/components/editor/PageEditor/usePageEditorAIEffects.ts
• src/components/editor/PageEditor/usePageEditorAutoSaveWithMutation.ts
• src/components/editor/PageEditor/usePageEditorEffects.test.tsx
• src/components/editor/PageEditor/usePageEditorEffects.ts
• src/components/editor/PageEditor/usePageEditorHandlers.ts
• src/components/editor/PageEditor/usePageEditorKeyboard.ts
• src/components/editor/PageEditor/usePageEditorState.ts
• src/components/editor/PageEditor/usePageEditorStateAndSync.ts
• src/components/editor/PageEditor/usePageEditorStateAndSyncReturnSlices.ts
• src/components/editor/PageEditor/usePageEditorWikiCollab.ts
• src/components/editor/PageEditor/usePendingChatPageGeneration.test.tsx
• src/components/editor/PageEditor/usePendingChatPageGeneration.ts
• src/components/editor/PageEditorView.tsx
• src/components/editor/TiptapEditor/types.ts
• src/components/editor/TiptapEditor/useEditorLifecycle.ts
• src/components/editor/TiptapEditor/useTagStatusSync.test.tsx
• src/components/editor/TiptapEditor/useTagStatusSync.ts
• src/components/editor/TiptapEditor/useWikiLinkNavigation.test.ts
• src/components/editor/TiptapEditor/useWikiLinkNavigation.ts
• src/components/editor/TiptapEditor/useWikiLinkStatusSync.test.tsx
• src/components/editor/TiptapEditor/useWikiLinkStatusSync.ts
• src/components/editor/WebClipperDialog.tsx
• src/components/editor/extensions/slashSuggestionPlugin.test.ts
• src/components/editor/extensions/slashSuggestionPlugin.ts
• src/components/editor/useWebClipperDialogSubmit.ts
• src/components/editor/useWebClipperDialogSubmit.tsx
• src/components/layout/AppLayout.test.tsx
• src/components/layout/AppLayout.tsx
• src/components/layout/BottomNav/BottomNav.test.tsx
• src/components/layout/BottomNav/BottomNavTab.tsx
• src/components/layout/BottomNav/index.tsx
• src/components/layout/FABMenu.tsx
• src/components/layout/FloatingActionButton.tsx
• src/components/layout/Header/HeaderLogo.test.tsx
• src/components/layout/Header/HeaderLogo.tsx
• src/components/layout/Header/HeaderSearchBar.tsx
• src/components/layout/Header/HeaderSearchDropdownContent.tsx
• src/components/layout/Header/NavigationMenu.test.tsx
• src/components/layout/Header/index.tsx
• src/components/layout/HomePageCount.test.tsx
• src/components/layout/HomePageCount.tsx
• src/components/layout/MobileHeader.tsx
• src/components/layout/navigationItems.test.ts
• src/components/layout/navigationItems.ts
• src/components/layout/useFloatingActionButtonHandlers.ts
• src/components/note/EditorSkeleton.test.tsx
• src/components/note/EditorSkeleton.tsx
• src/components/note/NotePageCard.tsx
• src/components/note/NotePagePublicView.test.tsx
• src/components/note/NotePagePublicView.tsx
• src/components/note/NoteShareUrlCopyButton.test.tsx
• src/components/note/NoteShareUrlCopyButton.tsx
• src/components/note/NoteTitleSwitcher.test.tsx
• src/components/note/NoteTitleSwitcher.tsx
• src/components/note/PageEditorContent.tsx
• src/components/note/PageTitleBlock.test.tsx
• src/components/note/PageTitleBlock.tsx
• src/components/page/EmptyState.tsx
• src/components/page/LinkGroupRow.tsx
• src/components/page/LinkSection.tsx
• src/components/page/LinkedPagesSection.test.tsx
• src/components/page/LinkedPagesSection.tsx
• src/components/page/PageCard.tsx
• src/components/page/PageGrid.test.tsx
• src/components/page/PageGrid.tsx
• src/components/page/PageLinkCard.test.tsx
• src/components/pdf-reader/HighlightLayer.test.tsx
• src/components/pdf-reader/HighlightLayer.tsx
• src/components/pdf-reader/HighlightSidebar.test.tsx
• src/components/pdf-reader/HighlightSidebar.tsx
• src/components/pdf-reader/HighlightToolbar.test.tsx
• src/components/pdf-reader/HighlightToolbar.tsx
• src/components/pdf-reader/MissingPdfBanner.tsx
• src/components/pdf-reader/OpenPdfButton.tsx
• src/components/pdf-reader/PdfPageCanvas.test.tsx
• src/components/pdf-reader/PdfPageCanvas.tsx
• src/components/pdf-reader/PdfReader.tsx
• src/components/pdf-reader/PdfReaderUnsupported.tsx
• src/components/pdf-reader/pdfTextLayer.css
• src/components/pdf-reader/saveAndDeriveFlow.test.ts
• src/components/pdf-reader/saveAndDeriveFlow.ts
• src/components/pdf-reader/selectionToPdfRects.test.ts
• src/components/pdf-reader/selectionToPdfRects.ts
• src/components/pdf-reader/useOpenPdfFlow.test.ts
• src/components/pdf-reader/useOpenPdfFlow.ts
• src/components/pdf-reader/usePdfDocument.ts
• src/components/search/SearchResultCard.tsx
• src/components/tagFilterBar/TagChip.tsx
• src/components/tagFilterBar/TagFilterBar.tsx
• src/components/tagFilterBar/index.ts
• src/contexts/GlobalSearchContext.test.ts
• src/contexts/GlobalSearchContext.tsx
• src/hooks/runAIChatAction.test.ts

💤 Files with no reviewable changes (4)

• e2e/page-editor.spec.ts
• server/api/src/tests/services/snapshotService.test.ts
• e2e/wikilink-create-dialog.spec.ts
• extension/popup.js

[gemini-code-assist]

Code Review

This pull request implements a comprehensive API error tracking and AI analysis system (Epic #616), introducing an api_errors table, a Claude-based analysis workflow, and an admin dashboard. It also completes the migration to a note-centric page model (Issue #823) and adds real-time updates via Server-Sent Events. Feedback identifies critical issues including an invalid version for the setup-node action, an incorrect Claude model identifier in the analysis script, and a potential regression in the browser extension where logged-out users can no longer initiate clips from the popup.

I am having trouble creating individual review comments. Click here to see my feedback.

.github/actions/claude-analyze/action.yml (81)

actions/setup-node のバージョン v6 は存在しないようです。最新の安定版は v4 です。このままだとワークフローが失敗する可能性があるため、v4 に修正することを推奨します。

      uses: actions/setup-node@v4

.github/actions/claude-analyze/analyze.mjs (55)

claude-sonnet-4-6 というモデル名は存在しないようです。おそらく claude-3.5-sonnet-20240620 または claude-3-sonnet-20240229 のタイポだと思われます。このままだとAnthropic API呼び出しが失敗するため、正しいモデル名に修正してください。

const DEFAULT_MODEL = "claude-3.5-sonnet-20240620";

extension/popup.js (181-184)

この openZediWithClipUrl 関数と、関連するクリックハンドラの else ブロックが削除されたことで、ログアウト状態のユーザーがポップアップの「保存」ボタンをクリックしても何も起きなくなってしまいます。これは意図した動作でしょうか？もし意図しない場合は、background.js のコンテキストメニューと同様に、クリップ対象URLを渡してZediを開く処理を維持することを検討してください。

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@admin/src/pages/errors/ErrorDetailDialog.tsx`:
- Line 62: The inline comment in the ErrorDetailDialog component currently
contains only Japanese; add an English translation immediately after (or before)
the Japanese sentence to make the doc bilingual. Locate the comment inside the
ErrorDetailDialog (the comment starting "オーバーレイ・ESC と同様に、キャンセルボタンでも未保存選択を破棄する。")
and append a concise English equivalent such as "Discard unsaved selection when
the cancel button is used, same as overlay/ESC." to match repository bilingual
comment standards.

In `@server/api/src/__tests__/services/pageAccessService.test.ts`:
- Around line 44-45: Update the block comment above the helper function
noRoleChains to include a Japanese translation of the existing English note
("Private note, caller not owner: member + domain rule lookups run then deny.")
so the comment contains both English and Japanese bilingual text; locate the
comment immediately above function noRoleChains and add a concise Japanese
sentence conveying the same meaning (e.g.
「非公開メモ。呼び出し元がオーナーでない場合：メンバーとドメインのルール照会を行い、その後拒否されます。」) so the comment block
includes both languages.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: dc2ef73c-fedc-41bc-aef1-2d9882727b3f

📥 Commits

Reviewing files that changed from the base of the PR and between c1417f9 and 0d11e14.

📒 Files selected for processing (24)

• .github/actions/claude-analyze/__tests__/schema.test.mjs
• .github/actions/claude-analyze/action.yml
• .github/actions/claude-analyze/autoIssueRunner.mjs
• .github/actions/claude-analyze/escapeGithubAnnotation.mjs
• .github/actions/claude-analyze/schema.mjs
• .github/workflows/analyze-error.yml
• admin/src/api/admin.test.ts
• admin/src/i18n/locales/en/nav.json
• admin/src/i18n/locales/ja/nav.json
• admin/src/pages/errors/ErrorDetailDialog.test.tsx
• admin/src/pages/errors/ErrorDetailDialog.tsx
• admin/src/pages/errors/ErrorsContent.tsx
• admin/src/pages/errors/useApiErrors.ts
• server/api/src/__tests__/routes/admin/errors.test.ts
• server/api/src/__tests__/routes/pageSnapshots.test.ts
• server/api/src/__tests__/routes/pages.test.ts
• server/api/src/__tests__/routes/syncPages.test.ts
• server/api/src/__tests__/routes/webhooks/sentry.test.ts
• server/api/src/__tests__/services/pageAccessService.test.ts
• server/api/src/lib/githubAppAuth.ts
• server/api/src/lib/sentry.test.ts
• server/api/src/lib/sentry.ts
• src/components/ErrorScreen.test.tsx
• src/components/ErrorScreen.tsx

✅ Files skipped from review due to trivial changes (3)

• .github/actions/claude-analyze/escapeGithubAnnotation.mjs
• admin/src/i18n/locales/ja/nav.json
• admin/src/i18n/locales/en/nav.json

🚧 Files skipped from review as they are similar to previous changes (13)

• admin/src/api/admin.test.ts
• server/api/src/tests/routes/admin/errors.test.ts
• admin/src/pages/errors/ErrorsContent.tsx
• server/api/src/tests/routes/webhooks/sentry.test.ts
• server/api/src/lib/sentry.test.ts
• .github/actions/claude-analyze/action.yml
• admin/src/pages/errors/useApiErrors.ts
• server/api/src/tests/routes/syncPages.test.ts
• server/api/src/lib/sentry.ts
• .github/workflows/analyze-error.yml
• .github/actions/claude-analyze/autoIssueRunner.mjs
• server/api/src/tests/routes/pages.test.ts
• server/api/src/lib/githubAppAuth.ts

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Make this inline doc comment bilingual.

Line 62 currently has only Japanese text; add an English counterpart to match repository standards.

Proposed fix

-  /** オーバーレイ・ESC と同様に、キャンセルボタンでも未保存選択を破棄する。 */
+  /**
+   * オーバーレイ・ESC と同様に、キャンセルボタンでも未保存選択を破棄する。
+   * Discard unsaved selection on Cancel as well as overlay/ESC close.
+   */
   const handleClose = () => {

As per coding guidelines **/*.{ts,tsx,js,md}: Include both Japanese and English comments/documentation in code and documentation files.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	/** オーバーレイ・ESC と同様に、キャンセルボタンでも未保存選択を破棄する。 */
	/**
	* オーバーレイ・ESC と同様に、キャンセルボタンでも未保存選択を破棄する。
	* Discard unsaved selection on Cancel as well as overlay/ESC close.
	*/

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@admin/src/pages/errors/ErrorDetailDialog.tsx` at line 62, The inline comment
in the ErrorDetailDialog component currently contains only Japanese; add an
English translation immediately after (or before) the Japanese sentence to make
the doc bilingual. Locate the comment inside the ErrorDetailDialog (the comment
starting "オーバーレイ・ESC と同様に、キャンセルボタンでも未保存選択を破棄する。") and append a concise English
equivalent such as "Discard unsaved selection when the cancel button is used,
same as overlay/ESC." to match repository bilingual comment standards.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Add Japanese text to the helper comment for bilingual consistency.

Line 44 is English-only. Please add a Japanese counterpart in the same block comment.

Proposed fix

-/** Private note, caller not owner: member + domain rule lookups run then deny. */
+/**
+ * 非公開ノートで呼び出し元がオーナーでない場合: member/domain の参照後に拒否する。
+ * Private note, caller not owner: member + domain rule lookups run then deny.
+ */
 function noRoleChains(pageOwnerId: string) {

As per coding guidelines **/*.{ts,tsx,js,md}: Include both Japanese and English comments/documentation in code and documentation files.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	/** Private note, caller not owner: member + domain rule lookups run then deny. */
	function noRoleChains(pageOwnerId: string) {
	/**
	* 非公開ノートで呼び出し元がオーナーでない場合: member/domain の参照後に拒否する。
	* Private note, caller not owner: member + domain rule lookups run then deny.
	*/
	function noRoleChains(pageOwnerId: string) {

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@server/api/src/__tests__/services/pageAccessService.test.ts` around lines 44
- 45, Update the block comment above the helper function noRoleChains to include
a Japanese translation of the existing English note ("Private note, caller not
owner: member + domain rule lookups run then deny.") so the comment contains
both English and Japanese bilingual text; locate the comment immediately above
function noRoleChains and add a concise Japanese sentence conveying the same
meaning (e.g. 「非公開メモ。呼び出し元がオーナーでない場合：メンバーとドメインのルール照会を行い、その後拒否されます。」) so the
comment block includes both languages.