feat(web): Rotation, Operation History, Config Editor and Backup & Restore become ES-module pages (stage 2)

[ChuckBuilds]

Continues the ES-module migration from #703 with steps 2–5 of docs/WEB_FRONTEND_ARCHITECTURE.md.

What changed

Tab	Partial	Module	Inline JS
Rotation	durations.html	pages/durations.js	29 lines → 0
Operation History	operation_history.html	pages/operation-history.js	293 → 0
Config Editor	raw_json.html	pages/raw-json.js	212 → 0
Backup & Restore	backup_restore.html	pages/backup-restore.js	232 → 0

• Each partial now has a data-page root and no <script> and no onclick. Buttons carry data-action and use one delegated listener on the root. The page registry runs init() once per swap-in and destroy() on swap-out.
• Listeners and reads use ctx.signal, so a swap removes the listeners and cancels the requests. Writes (save, delete, export, restore) are not cancelled: the server finishes them anyway, so the result is still reported in a notification but nothing is drawn into a page that has gone. Timers (the history search debounce, the rotation widget's wait) are cleared in destroy().
• Aliases: these globals now live in the modules and stay available as deprecated window.* aliases through the facade, each warning once: formatJson, manualValidateJson, validateJSON, saveMainConfig, saveSecretsConfig, exportBackup, loadBackupList, validateRestoreFile, clearRestore, runRestore. boot.js keeps each loaded module, so validateJSON still returns its boolean synchronously.
• Core: api.js takes a raw body (a FormData upload). PluginOrderList.init() takes an optional signal.
• Server data is drawn with textContent throughout, which replaces the remaining innerHTML templates on these pages.
• Small fixes on the way:
  • The Config Editor's live "Invalid JSON" line put the parser's message into innerHTML unescaped.
  • Operation History's "Showing x to y of z" went stale when nothing matched.
• Operation History still reads the installed list through PluginAPI's cache when it is loaded, as before, so a reloaded tab costs no extra request.

Not moved (on purpose)

durations.html keeps hx-on:htmx:after-request="showSaveResult(...)" and onsubmit="fixInvalidNumberInputs(this)". Both call shared globals that other tabs use too, and onsubmit has to run before htmx serialises the form. They move with step 6 (Schedule), which handles hx-on. Neither is a <script>.

Doc corrections

The migration table said the Config Editor had "no globals" and used CodeMirror. In fact it defined 5 globals and uses plain textareas. The table now marks steps 2–5 done and describes these conventions.

Tests

• New DOM suites (REQUIRE_DOM=1, real partial from the server and the real API's payload shape). Each one checks that the page mounts once after repeated swaps and that each action makes exactly one request:
  • test/js/dom/test_durations_page.js (25 checks)
  • test/js/dom/test_operation_history_page.js (42)
  • test/js/dom/test_raw_json_page.js (33)
  • test/js/dom/test_backup_restore_page.js (56)
• The suites also cover:
  • a swap cancelling reads but not writes
  • hostile values staying text
  • error, network and login states
  • the old global entry points
• The durations suite was mutation-checked: removing signal: ctx.signal makes it fail.
• test_es_modules.py covers the new pages:
  • the converted pages are exactly the registered ones, each with its module and init
  • each rendered partial has one root, no <script> and no onclick
  • every moved global is aliased in boot.js and exported by its module, and no template defines it any more
• test_core_modules.js covers the raw-body upload. test_html_escaping.js drops the two template escapers that no longer exist.
• node test/js/run_all.js with REQUIRE_DOM=1 against a local server: all 23 suites pass.
• Full pytest suite on Windows: 61 failed / 6 errors, with FAILED/ERROR IDs identical to an origin/main baseline run in a separate worktree. The branch has 17 more passing tests.
• python scripts/build_css.py --check: up to date.

Browser smoke test (real app, origin/main vs this branch)

Each run cycled the four tabs ten times, then re-swapped each panel ten times with htmx.ajax, then fired one action per page.

• Request counts were identical on both:
  • one partial and one data load per tab across the ten cycles
  • 10 of each per page across the ten re-swaps (plugins/installed 11 on both)
  • Refresh on History and on Backup made exactly 1 request each
  • Validate showed 1 notification
• The branch had exactly one mounted page per tab after the re-swaps.
• No console errors from app code on either side.
• The only new console line is the intended one-time deprecation warning when a test called window.validateJSON directly.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 22 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: fc02c7a9-afa4-4fe8-aaec-b54275057c67

📥 Commits

Reviewing files that changed from the base of the PR and between c14002e and a3eaeaf.

📒 Files selected for processing (22)

• CHANGELOG.md
• docs/WEB_FRONTEND_ARCHITECTURE.md
• test/js/README.md
• test/js/dom/test_backup_restore_page.js
• test/js/dom/test_durations_page.js
• test/js/dom/test_operation_history_page.js
• test/js/dom/test_raw_json_page.js
• test/js/run_all.js
• test/js/unit/test_core_modules.js
• test/js/unit/test_html_escaping.js
• test/web_interface/test_es_modules.py
• web_interface/static/v3/js/core/api.js
• web_interface/static/v3/js/core/boot.js
• web_interface/static/v3/js/pages/backup-restore.js
• web_interface/static/v3/js/pages/durations.js
• web_interface/static/v3/js/pages/operation-history.js
• web_interface/static/v3/js/pages/raw-json.js
• web_interface/static/v3/js/widgets/plugin-order-list.js
• web_interface/templates/v3/partials/backup_restore.html
• web_interface/templates/v3/partials/durations.html
• web_interface/templates/v3/partials/operation_history.html
• web_interface/templates/v3/partials/raw_json.html

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codacy-production]

Not up to standards ⛔

🔴 Issues 3 critical · 8 high

Alerts:
⚠ 11 issues (≤ 0 issues of at least minor severity)

Results:
11 new issues

Category	Results
Security	3 critical 8 high

View in Codacy

🟢 Metrics 319 complexity · 7 duplication

Metric	Results
Complexity	319
Duplication	7

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}