[superdav42]

Summary

Resolves #90.

• Add repeat-safe, root-scoped window.SCE.init(root) and DOM-insertion initialization while retaining the single-button and WP Ajaxify APIs. Detached/replaced controls release timers/editors and stale time responses are ignored.
• Preload assets on comment-bearing singular views, subject to existing loading policies and filters.
• Add the opt-in sce_ajax_comment_submission filter around an integration's existing validated creation call. Guest ownership is established during creation; no arbitrary-comment claim endpoint is added.
• Bind permission checks to the requested comment and require a nonempty matching ownership cookie/key.
• Document browser-verified integration versions and the local worktree-symlink testing workflow in AGENTS.md. BuddyBoss remains explicitly unverified.

Review changes

• Reviewed src/js/comment-editing/editing.js, simple-comment-editing.php, includes/Functions.php, and the existing mutation checks in includes/Ajax.php. Follow-up review corrected can_edit() to resolve a local $comment without overwriting the WordPress loop global; filter arguments still receive the requested comment, and the global-write PHPCS suppression is removed.
• Added six regression cases in tests/Functions_Test.php, using the existing real WordPress test framework: stale logged-in-owner comment global, empty ownership values, trashed comment, missing comment, preservation of an existing loop global on success/denial/early return, and keeping an unset global absent.
• Updated README.md and readme.txt with verified compatibility and the Twenty Twenty-Five Ajaxify selector requirement. The default selector matches both the comments wrapper and heading, causing a full-page fallback; configure .wp-block-comments instead.

Verification

Passed locally:

• composer test: 59 tests, 251 assertions, single-site, rerun after merging the latest base branch.
• WP_MULTISITE=1 composer test: 59 tests, 251 assertions, multisite, rerun after merging the latest base branch; run sequentially against the disposable test database, never the browser site's database.
• composer lint: PHPCS zero errors; PHPStan no errors. Existing PHP warnings remain.
• Follow-up fix: php -l includes/Functions.php, scoped PHPCS, and composer phpstan -- includes/Functions.php pass; the existing capability-spelling PHPCS warning remains.
• vendor/bin/phpcs tests/Functions_Test.php: zero errors/warnings.
• Initial npm run lint:js: zero errors. After merging the latest base, npx --no-install eslint src/js/comment-editing/editing.js reports zero errors and seven existing warnings.
• npm ci --ignore-scripts and npm run build: successful after merging the latest base. The conflicting editor bundle was regenerated from the combined source and latest lockfile, preserving upstream WooCommerce fixes and the dependency update. Admin/CSS outputs match the base branch exactly. Three existing admin-bundle size warnings remain.
• node --check dist/sce-editing.js and git diff --cached --check: passed before the merge commit.
• git diff --check.
• A real WordPress CLI call through wp_handle_comment_submission() with the AJAX opt-in issued ownership, allowed the owner to edit, preserved the key on a repeated SCE creation callback, and denied editing after clearing cookies. This is PHP-path verification, not a custom HTTP/browser adapter claim.

Real browser acceptance (before the latest base-branch sync)

Tested with agent-browser driving Chromium 147 against WordPress 7.1.3 multisite, PHP 8.4.25, and Twenty Twenty-Five 1.4. The plugin was activated from the PR worktree through a plugins-directory symlink. Separate guest-owner, subscriber, and non-owner browser sessions were used.

Criterion	Result
Ajaxify Comments 3.2.2 guest submission and immediate editing	Passed. A JavaScript page marker survived submission and save, the Ajaxify update event fired, and the submission used XHR. The save persisted in WordPress.
Ajaxify Comments 3.2.2 logged-in subscriber submission/editing	Passed. Page marker survived; one save request persisted the edited content.
Lazy Load for Comments 2.1.0	Passed. No controls before loading; real REST request returned 200; the observer initialized the owner's inserted controls. Save persisted, and keyboard-driven Cancel restored the saved text.
Repeated initializer/WP Ajaxify callbacks and replacement	Passed. Ten initializer/callback repetitions after replacement produced one time request, one loaded event, and two countdown events over 2.3 seconds. Removing controls produced zero subsequent countdown events.
Non-owner protection	Passed. Separate browser had no controls, including after real lazy loading. Timer request returned can_edit:false; save/delete using the owner's valid guest nonce were rejected and content remained unchanged. Invalid-nonce requests were also rejected.
Browser errors	No uncaught browser errors in owner/subscriber/non-owner checks. Ajaxify debug mode identified the selector configuration issue; the expected comment-flood response was respected rather than bypassed.

Boundaries

• BuddyBoss and a custom HTTP admin-ajax.php submission adapter were not browser-tested. The verified Ajaxify flow uses its normal WordPress submission route.
• The site's existing debug configuration was preserved (WP_DEBUG off); no claim of WordPress debug-log verification is made.
• No merge, release, or deployment is requested by this review. The local SCE symlink/activation is retained for follow-up testing; temporary integration activation/settings and fixtures are cleaned up after verification.

---

aidevops.sh v3.39.36 plugin for OpenCode

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: Ultimate-Multisite/simple-comment-editing/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 484c6e0d-b5f3-45e1-b19d-0ffc93b76fa1

📥 Commits

Reviewing files that changed from the base of the PR and between f083659 and 5f71399.

⛔ Files ignored due to path filters: 1

• dist/sce-editing.js is excluded by !**/dist/**

📒 Files selected for processing: 7

• AGENTS.md
• README.md
• includes/Functions.php
• readme.txt
• simple-comment-editing.php
• src/js/comment-editing/editing.js
• tests/Functions_Test.php

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[superdav42]

Implementation checkpoint — runtime blocked

Issue #90 is preserved in this draft at e30d160dc27c7d195397930b1e12aaa5c4959630; all intended implementation commits are pushed. The root-scoped dynamic initializer, timer/handler deduplication, validated-submission guest-ownership adapter, requested-comment permission binding, docs, and rebuilt editor asset are included.

Scoped PHP syntax, PHPCS, ESLint, PHPStan, webpack build, and whitespace checks passed with only evidenced pre-existing warnings. Independent source review found no material defects, but does not establish runtime acceptance.

Blocker: the configured runner cannot access an authorized disposable WordPress test database/site. Existing ownership/AJAX tests and actual two-browser WP Ajaxify/Lazy Load flows therefore remain unverified. This draft is not a successful post-PR handoff and must not merge or close #90 yet. The PR body preserves the acceptance matrix, exact commands, and recovery steps; BuddyBoss remains explicitly unverified.

Recovery owner: runner administrator. Provide the isolated site's/database's authorized configuration through the existing runner/secret mechanism, then resume this PR and run the required product paths before readiness and the guarded merge attempt. No credentials belong in GitHub comments. Pending remote checks were observed once and were not polled. No release/deployment is authorized.

---

aidevops.sh v3.39.27 plugin for OpenCode v1.19.0 with gpt-6.1-sol spent 18m and 202,529 tokens on this as a headless worker.