chore: pr review instructions, address comments.

Author: knightedcodemonkey

.github/instructions/pr-review.md

@@ -0,0 +1,51 @@
+---
+applyTo: '**'
+---
+
+# Pull Request Review Guidance
+
+You are reviewing changes for @knighted/develop. Be concise, technical, and specific. Prioritize actionable feedback tied to concrete files and lines.
+
+## Browser support policy
+
+- Target evergreen browsers only (current stable Chrome, Edge, Safari, and Firefox).
+- Do not require old-browser compatibility unless the PR explicitly expands support scope.
+- Do not request legacy polyfills or fallback-only workarounds by default.
+
+## Focus areas
+
+- CDN-first runtime integrity: imports and fallback behavior should remain compatible with src/modules/cdn.js patterns.
+- UI state correctness: drawers, toggles, dialogs, and compact/mobile states should remain synchronized and predictable.
+- BYOT safety: token handling must stay browser-local, avoid leakage, and preserve clear user-facing privacy/removal cues.
+- Accessibility and semantics: form controls, labels, button types, ARIA relationships, and keyboard interactions should be valid.
+- Build and workflow stability: scripts and output behavior should remain consistent unless change is explicitly documented.
+- Tests and docs alignment: behavior changes should update tests and relevant docs.
+
+## What to verify
+
+- No generated artifacts are edited (dist/, coverage/, test-results/).
+- CDN import/fallback behavior is not bypassed with ad hoc URLs in feature modules.
+- Sensitive values (PAT/token) are not logged or exposed in UI/status output.
+- New UI behavior is covered in Playwright where appropriate.
+- Lint/build expectations still pass for changed areas.
+
+## Validation expectations
+
+- Run npm run lint for code and HTML/a11y checks.
+- Run npm run build when touching scripts/, bootstrap/runtime wiring, or import map behavior.
+- For interactive UI changes, confirm behavior in compact/mobile layout and at least one non-default mode.
+
+## Review output format
+
+- Present findings first, ordered by severity.
+- Label each finding as blocking, important, or nit.
+- Include file reference and the minimal fix direction.
+- Keep summary brief and secondary to findings.
+
+## Ask for changes when
+
+- Behavior changes ship without corresponding test updates.
+- New dependencies are added without clear approval.
+- Build/CI/import-map contracts change without docs updates.
+- Accessibility regressions or semantic HTML issues are introduced.
+- Feedback requests are based on unsupported legacy-browser constraints.

AGENTS.md

@@ -55,6 +55,13 @@ Repository structure:
 - Maintain graceful fallback behavior when CDN modules fail to load.
 - Keep the app usable in local dev without requiring a local bundle step.
 
+## Browser support policy
+
+- Target evergreen browsers only (current stable Chrome, Edge, Safari, and Firefox).
+- Prefer platform features available in evergreen browsers without adding legacy polyfills.
+- Do not add legacy-browser workarounds unless a task explicitly requires expanded support.
+- In code review, treat requests for old-browser compatibility as out-of-scope unless documented.
+
 ## Testing and validation expectations
 
 - Run npm run lint after JavaScript edits.

playwright/app.spec.ts

@@ -256,7 +256,9 @@ test('deleting saved GitHub token requires confirmation modal', async ({ page })
   await expect(page.locator('#clear-confirm-copy')).toHaveText(
     'This action removes the token from browser storage. You can add another token at any time.',
   )
-  await expect(dialog.getByRole('button', { name: 'Remove' })).toBeVisible()
+  const removeButton = dialog.getByRole('button', { name: 'Remove' })
+  await expect(removeButton).toBeVisible()
+  await expect(removeButton).not.toHaveAttribute('aria-label')
 
   await dialog.getByRole('button', { name: 'Cancel' }).click()
   await expect(dialog).not.toHaveAttribute('open', '')
@@ -265,7 +267,7 @@ test('deleting saved GitHub token requires confirmation modal', async ({ page })
 
   await tokenDelete.click()
   await expect(dialog).toHaveAttribute('open', '')
-  await dialog.getByRole('button', { name: 'Remove' }).click()
+  await removeButton.click()
   await expect(dialog).not.toHaveAttribute('open', '')
 
   await expect(page.locator('#status')).toHaveText('GitHub token removed')

src/app.js

@@ -538,7 +538,6 @@ const byotControls = createGitHubByotControls({
       title: 'Remove saved GitHub token?',
       copy: 'This action removes the token from browser storage. You can add another token at any time.',
       confirmButtonText: 'Remove',
-      confirmButtonAriaLabel: 'Confirm remove saved GitHub token',
       fallbackConfirmText:
         'Remove saved GitHub token? This action removes the token from browser storage.',
       onConfirm,
@@ -983,7 +982,6 @@ const confirmAction = ({
   title,
   copy,
   confirmButtonText = 'Clear',
-  confirmButtonAriaLabel,
   fallbackConfirmText,
   onConfirm,
 }) => {
@@ -1012,11 +1010,7 @@ const confirmAction = ({
 
   if (clearConfirmButton instanceof HTMLButtonElement) {
     clearConfirmButton.textContent = confirmButtonText
-    if (typeof confirmButtonAriaLabel === 'string' && confirmButtonAriaLabel) {
-      clearConfirmButton.setAttribute('aria-label', confirmButtonAriaLabel)
-    } else {
-      clearConfirmButton.removeAttribute('aria-label')
-    }
+    clearConfirmButton.removeAttribute('aria-label')
   }
 
   pendingClearAction = onConfirm