diff --git a/CODE-AUDIT.md b/CODE-AUDIT.md index 6257598..67bd0e4 100644 --- a/CODE-AUDIT.md +++ b/CODE-AUDIT.md @@ -363,9 +363,14 @@ token system + shared primitives (UI/SIMP — high value, larger effort) · i18n those to the shared hook incrementally.* - [x] **M13 — Inconsistent secret-field masking.** `updateToken` uses `type="password"`; `proxy` (may carry `user:pass@`) and `youtubePoToken` (a token) are plain-text Inputs. -- [ ] **M14 — Settings search mutates React-owned DOM.** The search toggles each card's +- [x] **M14 — Settings search mutates React-owned DOM.** The search toggles each card's `el.style.display` directly; fragile (breaks if a card ever gets a conditional `style`) and - matches on `textContent` incl. hidden text. Prefer state-driven filtering. + matches on `textContent` incl. hidden text. Prefer state-driven filtering. *Fixed: each card renders + inside a React-owned wrapper whose visibility is driven by a `hidden` state array in + [SettingsView.tsx](src/renderer/src/components/SettingsView.tsx) — the filter no longer writes + `display` onto a card's own node, so a card setting its own inline style can't break it. Matching still + reads the wrapper's `textContent` (so search covers every visible label without hand-maintained + per-card keywords); the minor "matches hidden descendant text" point is unchanged and left as-is.* - [x] **M15 — Nested interactive controls in `role="button"` (a11y).** LibraryView's group header is a `role="button"` div containing `