[IEvangelist]

Pull Request Checklist

• I have read and followed the CONTRIBUTING.md guidelines.
• I have read and followed the Guidance for submissions involving paid services.
• My contribution adds a new instruction, prompt, agent, skill, workflow, or canvas extension file in the correct directory.
• The file follows the required naming convention.
• The content is clearly structured and follows the example format.
• I have tested my instructions, prompt, agent, skill, workflow, or canvas extension with GitHub Copilot.
• I have run npm start and verified that README.md is up to date. (npm run build passes.)
• I am targeting the main branch for this pull request.

---

Description

Updates the Artifact Explorer canvas (extensions/pr-artifact-explorer, plugin and skill) with:

• Resilience: retry and full restart; background download/index/extract jobs that survive request/view changes; ZIP64 and bounded central-directory handling; soft limit prompts (download, indexing, decompression, idle) that never stop work, with raised limits checked against live progress. Integrity and disk guards stay hard.
• Sharing and skill: unified targets (repo, PR, issue, artifact, route) for sharing links and the AI skill.
• Browser emulator: localhost/HTTP(S) preview with mobile/tablet/desktop presets, viewport vs. visual zoom, history/refresh, natural-language navigation, real Playwright/Chromium screenshots and device emulation (explicit setup, no silent install), keyboard hints.
• Docs tab: built-in usage docs.
• Artifact preview: universal Preview/Raw toggle, native video, JUnit viewer, HTML Browser action, per-render race guards, theme sync, open in default browser.
• UX: copy title / copy link buttons, #number links to GitHub, compact Back/Forward route history, full PR-detail skeleton.
• Workflow re-run: confirmation-gated re-run of the originating Actions run (all or failed jobs), permission- and eligibility-aware, original actor/SHA warning.

---

Type of Contribution

• Update to existing instruction, prompt, agent, plugin, skill, workflow, or canvas extension.

---

Additional Notes

Verification: extension suite 92/92 (--test-concurrency=2), plugin:validate, skill:validate, npm run build, and line-ending normalization pass. Re-run behavior was tested only against mocked GitHub APIs; no real CI was triggered.

Screenshots

Workflow runs view (default filters: Hide PR runs, Has artifacts).

---

By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.

[github-actions]

🔒 PR Risk Scan Results

Scanned 58 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	6
ℹ️ Info	0

Severity	Rule	File	Line	Match
🟠	package-exec-command	extensions/pr-artifact-explorer/README.md	41	npx playwright-core install chromium
🟠	package-exec-command	extensions/pr-artifact-explorer/assets/browser.js	558	<details class="docs-details"><summary>Set up Chromium if capture is unavailable</summary><p>Setup is explicit; Explorer does not install anything silently. Run <code>npm install</
🟠	package-exec-command	extensions/pr-artifact-explorer/capture.mjs	36	"2. Install the browser once: npx playwright-core install chromium",
🟠	package-exec-command	extensions/pr-artifact-explorer/capture.test.mjs	41	assert.match(error.message, /npx playwright-core install chromium/);
🟠	unpinned-version-indicator	extensions/pr-artifact-explorer/package-lock.json	11	"playwright-core": "^1.60.0"
🟠	unpinned-version-indicator	extensions/pr-artifact-explorer/package.json	7	"playwright-core": "^1.60.0"

Skipped non-text or missing files

• extensions/pr-artifact-explorer/assets/docs/continuing-job.png
• extensions/pr-artifact-explorer/assets/docs/preview-controls.png
• extensions/pr-artifact-explorer/assets/docs/preview-options.png

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[Copilot]

🟡 Changes recommended

Unresolved rendering, workflow-discovery, and test-isolation defects affect reliability and user data.

12 open issues

• Unicode line separators can cause an infinite Markdown parsing loop · New
• Static import uses real Copilot home and contaminates test data · New
• Coordinate shutdown with pending browser startup
• Validate viewport before launching Chromium
• Remove unref from close timeout
• Emphasis formatting corrupts underscores in link URLs · New
• Unreferenced timeout lets never-settling mock test exit early · New
• Workflow picker omits workflows beyond the first 100 · New
• Stuck-close test can be cancelled before assertion resolves · New
• Filter out pull-request workflow runs
• Use workflow IDs for unsupported filename selectors
• Apply viewport changes to active browser sessions

1 file not reviewed

• extensions/pr-artifact-explorer/package-lock.json: Generated file

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Confirmed defects can freeze Markdown previews, overwrite user settings during tests, and silently discard workflow filters.

14 open issues

• U+2028 and U+2029 list items cause an infinite parsing loop · New
• Tests overwrite the developer's Artifact Explorer settings · New
• Static import uses real Copilot home and contaminates test data
• Unicode line separators can cause an infinite Markdown parsing loop
• Coordinate shutdown with pending browser startup
• Validate viewport before launching Chromium
• Remove unref from close timeout
• Stuck-close test can be cancelled before assertion resolves
• Workflow picker omits workflows beyond the first 100
• Unreferenced timeout lets never-settling mock test exit early
• Emphasis formatting corrupts underscores in link URLs
• Filter out pull-request workflow runs
• Use workflow IDs for unsupported filename selectors
• Apply viewport changes to active browser sessions

1 previously missed issue

In code that hasn't changed since last review

Workflow filename selection silently drops invalid filters

extensions/​pr-artifact-explorer/​github.mjs:737

The picker emits workflow filenames that normalizeRunFilters rejects. For example, .github/workflows/nightly build.yml produces ref: "nightly build.yml", but selecting it silently drops the workflow filter and queries all repository runs. Check the same filename pattern here and fall back to the workflow ID when it does not match.

1 file not reviewed

• extensions/pr-artifact-explorer/package-lock.json: Generated file

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Markdown rendering can freeze the canvas, and pagination makes the final permitted workflow-run results inaccessible.

14 open issues

• Tests overwrite the developer's Artifact Explorer settings
• U+2028 and U+2029 list items cause an infinite parsing loop
• Static import uses real Copilot home and contaminates test data
• Unicode line separators can cause an infinite Markdown parsing loop
• Coordinate shutdown with pending browser startup
• Validate viewport before launching Chromium
• Remove unref from close timeout
• Stuck-close test can be cancelled before assertion resolves
• Workflow picker omits workflows beyond the first 100
• Unreferenced timeout lets never-settling mock test exit early
• Emphasis formatting corrupts underscores in link URLs
• Filter out pull-request workflow runs
• Use workflow IDs for unsupported filename selectors
• Apply viewport changes to active browser sessions

2 previously missed issues

In code that hasn't changed since last review

Unmatched backticks cause catastrophic regex backtracking

extensions/​pr-artifact-explorer/​assets/​markdown-preview.js:23

This regex backtracks heavily on unmatched backtick runs. In a bounded check, text followed by 8,192 backticks exceeded one second, while 2 MiB of ordinary text completed in 2 ms. Artifact Markdown is rendered synchronously on the canvas UI thread, so a small untrusted file can freeze the explorer despite the size cap. Replace this expression with linear-time delimiter scanning and add a regression for long unmatched runs.

Pagination limit hides results beyond the 990th run

extensions/​pr-artifact-explorer/​github.mjs:688

At 30 runs per page, this limit exposes only 990 results. A search with 995 results disables Older on page 33 and clamps page 34 back to 33, leaving five runs inaccessible. Define a 1,000-result limit, derive the page ceiling with Math.ceil, and use the result limit for reachable and capped. Update the boundary tests to cover the partial 34th page.

1 file not reviewed

• extensions/pr-artifact-explorer/package-lock.json: Generated file

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Markdown rendering can stall the canvas, and workflow pagination leaves the final results unreachable.

15 open issues

• Unmatched backticks cause catastrophic regex backtracking · New
• Tests overwrite the developer's Artifact Explorer settings
• U+2028 and U+2029 list items cause an infinite parsing loop
• Static import uses real Copilot home and contaminates test data
• Unicode line separators can cause an infinite Markdown parsing loop
• Coordinate shutdown with pending browser startup
• Validate viewport before launching Chromium
• Remove unref from close timeout
• Stuck-close test can be cancelled before assertion resolves
• Workflow picker omits workflows beyond the first 100
• Unreferenced timeout lets never-settling mock test exit early
• Emphasis formatting corrupts underscores in link URLs
• Filter out pull-request workflow runs
• Use workflow IDs for unsupported filename selectors
• Apply viewport changes to active browser sessions

1 previously missed issue

In code that hasn't changed since last review

Pagination cannot reach final results beyond the 990th run

extensions/​pr-artifact-explorer/​github.mjs:688

At 30 runs per page, this cap exposes only 990 results. For a search with 991–1,000 results, page 33 reports hasMore: false, and requests for page 34 are clamped to 33, so the final runs cannot be reached. Define a separate 1,000-result limit, derive the page count with Math.ceil(limit / RUNS_PER_PAGE), and use the result limit for reachable and capped. Update the pagination tests to cover the partial 34th page.

1 file not reviewed

• extensions/pr-artifact-explorer/package-lock.json: Generated file

_{Review effort: Balanced}

[aaronpowell]

Thanks — this is a substantial and useful upgrade to Artifact Explorer. Main blocker is the codespell pickup, but can you double-check that there's no HIGH rated feedback from CCR to action

[Copilot]

🟡 Changes recommended

Unresolved critical defects can leave Chromium running after closure and freeze the UI while rendering a small Markdown artifact.

5 open issues

• Prevent Markdown parsing from catastrophic backtracking · New
• Guard against browsers created after shutdown · New
• Apply viewport changes on subsequent navigations · New
• Fix pagination cap for the final partial page · New
• Explicitly filter pull request workflow runs · New

15 resolved since last review

• Unmatched backticks cause catastrophic regex backtracking
• Tests overwrite the developer's Artifact Explorer settings
• U+2028 and U+2029 list items cause an infinite parsing loop
• Static import uses real Copilot home and contaminates test data
• Unicode line separators can cause an infinite Markdown parsing loop
• Coordinate shutdown with pending browser startup
• Validate viewport before launching Chromium
• Remove unref from close timeout
• Stuck-close test can be cancelled before assertion resolves
• Workflow picker omits workflows beyond the first 100
• Unreferenced timeout lets never-settling mock test exit early
• Emphasis formatting corrupts underscores in link URLs
• Filter out pull-request workflow runs
• Use workflow IDs for unsupported filename selectors
• Apply viewport changes to active browser sessions

1 file not reviewed

• extensions/pr-artifact-explorer/package-lock.json: Generated file

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The link and image regexes exhibit quadratic behavior on unmatched label openers, allowing Markdown below the 2 MB cap to freeze the canvas UI; both need bounded parsing and regression tests.

1 open issue

• Prevent quadratic regex backtracking on unmatched Markdown labels · New

1 previously missed issue

In code that hasn't changed since last review

Avoid imposing the 1,000-run ceiling on unfiltered listings

extensions/​pr-artifact-explorer/​github.mjs:782

The default, unfiltered runs list stops at page 34 because both normalizeRunFilters and this pagination calculation impose a 1,000-result ceiling. GitHub documents that ceiling only for searches using specific filters, including branch, event, and status (API documentation), so older runs are unnecessarily unreachable here. Apply the ceiling only when the outgoing request uses a capped search filter, and update the normalization and pagination tests together.

5 resolved since last review

• Guard against browsers created after shutdown
• Prevent Markdown parsing from catastrophic backtracking
• Explicitly filter pull request workflow runs
• Fix pagination cap for the final partial page
• Apply viewport changes on subsequent navigations

1 file not reviewed

• extensions/pr-artifact-explorer/package-lock.json: Generated file

_{Review effort: Balanced}