fix(dashboard): restore Enter-navigation guard and workflow timeout assertion

a17d374 reverted the review fix that routes Enter in the URL field through
the Go button plus the browserNavigating in-flight flag, the per-handler
scoping of the button-state tests, and the MD022 blank line in palette.md,
while changing the unit timeout cap to 450s but restoring the test that
asserts a literal 300s. Reinstate the fixes and assert the cap by value.

Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com>

Author: SoulWayy

.Jules/palette.md

@@ -35,5 +35,6 @@
 **Action:** Leg altijd het actieve element vast dat de overlay opent en herstel de focus bij sluiten, annuleren of succesvolle voltooiing.
 
 ## 2026-07-24 - [Context-Safe Async Button States]
+
 **Learning:** For asynchronous action buttons in control views (e.g., Browser navigate, reload, or close actions), passing the calling element to JavaScript using `this` (e.g., `onclick="browserNavigate(this)"`) allows contextual loading feedback and disabled states to be applied directly. This prevents double-submits or redundant in-flight network requests during longer operations without expensive DOM element lookups.
 **Action:** Ensure asynchronous button handlers support passing and handling `this` to maintain context-safe button states and clear screen-reader feedback via `aria-busy`.

src/kater/web/dashboard.py

@@ -1387,8 +1387,9 @@
           <div class="browser-toolbar">
             <input class="browser-url" id="browser-url" type="url"
               placeholder="https://…" autocomplete="off" aria-label="Browser URL"
-              onkeydown="if(event.key==='Enter'){event.preventDefault();browserNavigate();}">
-            <button class="mini-btn interactive" type="button" onclick="browserNavigate(this)"
+              onkeydown="if(event.key==='Enter'){event.preventDefault();browserNavigate(document.getElementById('browser-go'));}">
+            <button class="mini-btn interactive" type="button" id="browser-go"
+              onclick="browserNavigate(this)"
               aria-label="Navigate">Go</button>
             <button class="mini-btn interactive" type="button" onclick="browserReload(this)"
               aria-label="Reload page">Reload</button>
@@ -3892,6 +3893,7 @@ class ApiError extends Error {
 let browserSelectedId = null;
 let browserPollTimer = null;
 let browserShotSeq = 0;
+let browserNavigating = false;
 const browserActionLog = new Map(); // session_id -> [{kind, ok, detail, ts}]
 
 function stopBrowserPoll() {
@@ -4106,10 +4108,12 @@ class ApiError extends Error {
 }
 
 async function browserNavigate(btn) {
+  if (browserNavigating) return;
   if (!browserSelectedId) { toast('no session selected', 'error'); return; }
   const urlEl = document.getElementById('browser-url');
   const url = urlEl ? urlEl.value.trim() : '';
   if (!url) { toast('enter a URL', 'error'); return; }
+  browserNavigating = true;
   if (btn) {
     btn.disabled = true;
     btn.setAttribute('aria-busy', 'true');
@@ -4130,6 +4134,7 @@ class ApiError extends Error {
     pushBrowserLog(browserSelectedId, { kind: 'navigate', ok: false, detail: e.message || 'failed' });
     toast('navigate: ' + (e.message || 'failed'), 'error');
   } finally {
+    browserNavigating = false;
     if (btn) {
       btn.disabled = false;
       btn.removeAttribute('aria-busy');

tests/test_ci_workflow_changes.py

@@ -6,6 +6,7 @@
 only run inside GitHub Actions.
 """
 
+import re
 from pathlib import Path
 
 ROOT = Path(__file__).resolve().parent.parent
@@ -39,8 +40,11 @@ def test_ci_jobs_install_the_browser_extra() -> None:
 def test_unit_matrix_job_uses_kater_checkout_sha_and_longer_timeout() -> None:
     block = _job_block(CI.read_text(encoding="utf-8"), "unit", "integration")
     assert KATER_CHECKOUT_SHA in block
-    assert "timeout 300s uv run pytest" in block
-    assert "timeout 180s" not in block
+    # The exact cap is tuned as the suite grows; assert only that the inner
+    # guard exists and stays clear of the ~180s cap that used to trip on 3.14.
+    match = re.search(r"timeout (\d+)s uv run pytest", block)
+    assert match is not None
+    assert int(match.group(1)) > 180
 
 
 def test_computer_acceptance_checks_out_kater_and_the_private_runtime() -> None:

tests/test_dashboard.py

@@ -791,18 +791,41 @@ def test_credentials_modal_focus_restoration_behavior_node(tmp_path):
     assert res["body"]["focusRestored"] is False
 
 
-def test_browser_view_buttons_use_context_loading_states():
+def _js_handler_block(html: str, signature: str) -> str:
+    start = html.index(signature)
+    end = html.index("\nasync function", start + len(signature))
+    return html[start:end]
+
+
+@pytest.mark.parametrize(
+    ("handler", "loading_label", "idle_label"),
+    [
+        ("closeBrowserSession", "Closing...", "Close"),
+        ("browserNavigate", "Go...", "Go"),
+        ("browserReload", "Reloading...", "Reload"),
+    ],
+)
+def test_browser_view_buttons_use_context_loading_states(handler, loading_label, idle_label):
     html = render_dashboard()
-    # Check that Go, Reload, Close buttons pass 'this'
-    assert 'onclick="browserNavigate(this)"' in html
-    assert 'onclick="browserReload(this)"' in html
-    assert 'onclick="closeBrowserSession(this)"' in html
-    # Check that the JavaScript functions contain btn context handling
-    assert "async function browserNavigate(btn)" in html
-    assert "async function browserReload(btn)" in html
-    assert "async function closeBrowserSession(btn)" in html
-    # Check busy attribute setting and disabling
-    assert "btn.setAttribute('aria-busy', 'true')" in html
-    assert "btn.removeAttribute('aria-busy')" in html
-    assert "btn.disabled = true" in html
-    assert "btn.disabled = false" in html
+    assert f'onclick="{handler}(this)"' in html
+
+    block = _js_handler_block(html, f"async function {handler}(btn)")
+    assert "btn.disabled = true" in block
+    assert "btn.setAttribute('aria-busy', 'true')" in block
+    assert f"btn.textContent = '{loading_label}'" in block
+
+    restore = block[block.index("} finally {") :]
+    assert "btn.disabled = false" in restore
+    assert "btn.removeAttribute('aria-busy')" in restore
+    assert f"btn.textContent = '{idle_label}'" in restore
+
+
+def test_browser_url_enter_serializes_navigation_through_go_button():
+    html = render_dashboard()
+    assert 'id="browser-go"' in html
+    assert "browserNavigate(document.getElementById('browser-go'))" in html
+
+    block = _js_handler_block(html, "async function browserNavigate(btn)")
+    assert "if (browserNavigating) return;" in block
+    assert "browserNavigating = true;" in block
+    assert "browserNavigating = false;" in block[block.index("} finally {") :]