Polish craft admin pages

[Colin-XKL]

Summary

• Add a shared craft admin page shell for consistent header, card, toolbar, and table treatment.
• Align AtomCraft, FlowCraft, and All Craft List pages with the shared layout.
• Improve craft table readability with compact action buttons, parameter/type tags, localized flow labels, and API-layer all-craft loading.
• Add focused coverage for all-craft API response validation and use stable combined row keys for the mixed craft list.

Walkthrough

craft_admin_pages_unified_walkthrough.mp4

Testing

• pnpm run test
• pnpm run type:check
• pnpm run lint (passes with existing FeedItemContent.vue vue/no-v-html warnings)
• pnpm run build
• task fix (passes with existing FeedItemContent.vue vue/no-v-html warnings)
• go test ./...
• task backend-build
• task frontend-build
• Browser walkthrough of AtomCraft, FlowCraft, and All Craft List pages

_{To show artifacts inline, enable in settings.}

  

[sourcery-ai]

Sorry, we are unable to review this pull request

The GitHub API does not allow us to fetch diffs exceeding 20000 lines

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
feed-craft-admin	Ready	Preview, Comment	Jun 29, 2026 7:59am
feed-craft-doc	Ready	Preview, Comment	Jun 29, 2026 7:59am

[codacy-production]

Not up to standards ⛔

🔴 Issues 1 critical · 1 high · 39 medium · 5 minor

Alerts:
⚠ 41 issues (≤ 0 issues of at least medium severity)

Results:
46 new issues

Category	Results
BestPractice	5 minor
Security	1 critical 1 high
Complexity	39 medium

View in Codacy

🟢 Metrics 1555 complexity · 134 duplication

Metric	Results
Complexity	1555
Duplication	134

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[gemini-code-assist]

Code Review

This pull request introduces a new 'Inbox' feature for pushing and managing external RSS articles, along with a 'Web Monitor' feature for tracking specific webpage field changes. It also includes an 'Embedding Filter' for semantic topic filtering and various improvements to the internal runtime architecture, such as migrating to a functional CraftOption pattern. My review identified several critical issues: the Inbox GC logic causes data loss for 'no limit' configurations, the LLM adapter uses log.Fatalf which is too destructive, a previous SSRF protection check was accidentally removed, and the GUID generation uses a password-specific hash function instead of the recommended content hash. Additionally, I suggest adding ID validation to the Inbox update endpoint for consistency.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The current implementation where maxItems <= 0 deletes all items is highly unintuitive and poses a significant risk of accidental data loss. A value of 0 should typically mean 'no limit'. The documentation for this feature even warns about this behavior. To prevent destructive behavior, this logic should be changed so that maxItems <= 0 means no items are deleted.

Suggested change

	if maxItems <= 0 {
	return db.Where("inbox_id = ?", inboxID).Delete(&InboxItem{}).Error
	}
	if maxItems <= 0 {
	return nil
	}

[gemini-code-assist]

Using log.Fatalf will terminate the entire application if the environment client fails to initialize. This is too severe for an adapter function. It's better to return an error and allow the caller to handle it gracefully, which makes the function more robust and the application more resilient.

Suggested change

	if envClient == nil {
	log.Fatalf("get env client error.")
	}
	if envClient == nil {
	return "", fmt.Errorf("get env client error")
	}

[gemini-code-assist]

The check for loopback and private IP addresses was removed from this function. This reintroduces a potential Server-Side Request Forgery (SSRF) vulnerability, as it allows requests to internal services on the server's network. The previous implementation correctly blocked these requests. Please re-add the validation to prevent SSRF.

For reference, the check was similar to this:

import (
    "net"
    "fmt"
)

// ...

ips, err := net.LookupIP(parsedURL.Hostname())
if err != nil {
    return fmt.Errorf("Unable to resolve this URL: %w", err)
}
for _, ip := range ips {
    if ip.IsLoopback() || ip.IsPrivate() {
        return fmt.Errorf("Access to private IP %s is forbidden", ip.String())
    }
}

[gemini-code-assist]

The id from the path parameter is not validated. For consistency with other endpoints (like CreateInbox) and for better security, please validate the format of the id using util.IsValidID.

    id := c.Param("id")

    if !util.IsValidID(id) {
        c.JSON(http.StatusBadRequest, util.APIResponse[any]{Msg: "ID must only contain lowercase letters, numbers, hyphens, and underscores"})
        return
    }

[gemini-code-assist]

The function GetPasswordMD5Hash is being used here, but the project's documentation in AGENTS.md specifies that this function is intended for password hashing flows only. For general-purpose hashing like generating this GUID, util.GetTextContentHash (which uses FNV-64a) is the recommended function. Using a function against its documented purpose can be misleading. Please use the recommended hashing function for consistency and clarity.

Suggested change

	return util.GetPasswordMD5Hash(strings.Join(parts, "\n"))
	return util.GetTextContentHash(strings.Join(parts, "\n"))