{"messages":[{"content":"You are a constitutional council ranking individual git commits for ownership allocation.\n\nCompare these two commits. Decide which contributed more lasting value to the project.\n\nJudge substance, not spectacle:\n- Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise.\n- Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one.\n- Do not favor a side merely because its patch is longer or noisier.\n- Weight what the change does for the project, not the contributor's name.\n\nReturn ONLY a JSON object: {\"winner\": \"A\" or \"B\", \"ratio\": \"N:M\", \"explanation\": \"...\"}\nThe explanation must cite concrete differences in the patches (1-3 sentences).\n\nSide A — contributor: tommy-mor\nSide A — commit message:\n[075d4d37] Fix OAuth test mocks so Clojure E2E auth flows work again.\n\nHttpServer handlers were crashing on query parsing and token POSTs, which broke Playwright login; also read alias/history via real CSS selectors.\n\nCo-authored-by: Cursor <cursoragent@cursor.com>\n\nSide A — unified diff (full patch):\ndiff --git a/test/auth_login.clj b/test/auth_login.clj\nindex 6f2f00d7aa7340e63d1ac465b0a2234cec7a983f..aa63b66ccb2471b710ba3d168d0461252b39fc10 100644\n--- a/test/auth_login.clj\n+++ b/test/auth_login.clj\n@@ -14,27 +14,27 @@\n (defn- type-alias! [pg text]\n   (page/evaluate pg\n                  (.replace\n-                  \"(() => { const i = document.getElementById('alias-input'); const f = document.getElementById('alias-check-form'); if (!i || !f) return;\n+                  \"(() => { const i = document.getElementById('alias-input'); const f = document.getElementById('alias-check-form'); if (!i || !f) return Promise.resolve('missing-form');\n                     i.value = __TEXT__;\n                     const cf = document.getElementById('alias-claim-field'); if (cf) cf.value = i.value;\n                     return fetch(f.action, { method: 'POST', credentials: 'same-origin',\n                       headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n                       body: new URLSearchParams(new FormData(f)).toString() })\n                       .then(function (r) { return r.text(); })\n-                      .then(function (t) { eval(t); }); })()\"\n+                      .then(function (t) { eval(t); return document.getElementById('alias-status')?.textContent || ''; }); })()\"\n                   \"__TEXT__\"\n-                  (pr-str text)))\n-  (Thread/sleep 400))\n+                  (pr-str text))))\n \n-(defn- element-text [pg test-id]\n+(defn- element-text [pg selector]\n   (let [raw (page/evaluate pg\n-                           (str \"document.querySelector('[data-testid=\\\"\" test-id \"\\\"]')?.textContent || ''\"))]\n+                           (str \"document.querySelector(\" (pr-str selector) \")?.textContent || ''\"))]\n     (when (string? raw) (str/trim raw))))\n \n (defn- wait-for-text [pg test-id text timeout-ms]\n-  (let [deadline (+ (System/currentTimeMillis) timeout-ms)]\n+  (let [deadline (+ (System/currentTimeMillis) timeout-ms)\n+        selector (str \"[data-testid=\\\"\" test-id \"\\\"]\")]\n     (loop []\n-      (let [got (or (element-text pg test-id) \"\")]\n+      (let [got (or (element-text pg selector) \"\")]\n         (cond\n           (= got text) got\n           (< (System/currentTimeMillis) deadline) (do (Thread/sleep 200) (recur))\ndiff --git a/test/support/mock_oauth.clj b/test/support/mock_oauth.clj\nindex 5ba7e9be3cf6d2226648e9609a09ed45f306930f..333fe08d56cb06bac2a338cad1c73894d54c4495 100644\n--- a/test/support/mock_oauth.clj\n+++ b/test/support/mock_oauth.clj\n@@ -7,7 +7,7 @@\n (defn- query-param [query key]\n   (when query\n     (some (fn [pair]\n-            (let [[k v] (str/split pair \"=\" 2)]\n+            (let [[k v] (str/split pair #\"=\" 2)]\n               (when (= k key)\n                 (URLDecoder/decode (or v \"\") \"UTF-8\"))))\n           (str/split query #\"&\"))))\n@@ -31,11 +31,11 @@\n \n (defn- send-redirect [^HttpExchange ex location]\n   (.set (.getResponseHeaders ex) \"Location\" location)\n-  (.sendResponseHeaders ex 302 -1)\n+  (.sendResponseHeaders ex 302 0)\n   (.close (.getResponseBody ex)))\n \n (defn- read-form [^HttpExchange ex]\n-  (let [body (slurp (.getInputStream ex))]\n+  (let [body (slurp (.getRequestBody ex))]\n     {:code (query-param body \"code\")\n      :grant (query-param body \"grant_type\")}))\n \n@@ -45,7 +45,7 @@\n           (str/replace #\"^[Bb]earer \" \"\")))\n \n (defn- parse-token-user [token]\n-  (when (str/starts-with? token \"mock:\")\n+  (when (and token (str/starts-with? token \"mock:\"))\n     (parse-mock-user (subs token 5))))\n \n (defn- authorize-redirect [exchange query]\n@@ -55,7 +55,7 @@\n         user (parse-mock-user mock-user)\n         code (str \"mock:\" (:id user) \":\" (:login user))\n         loc (str redirect-uri \"?code=\" (java.net.URLEncoder/encode code \"UTF-8\")\n-                 \"&state=\" (java.net.URLEncoder/encode state \"UTF-8\"))]\n+                 \"&state=\" (java.net.URLEncoder/encode (or state \"\") \"UTF-8\"))]\n     (send-redirect exchange loc)))\n \n (defn start-mock-oauth\n@@ -65,49 +65,56 @@\n         handler\n         (proxy [HttpHandler] []\n           (handle [^HttpExchange exchange]\n-            (let [uri (.getRequestURI exchange)\n-                  path (.getPath uri)\n-                  query (.getQuery uri)\n-                  method (.getRequestMethod exchange)]\n-              (cond\n-                ;; GitHub authorize\n-                (str/ends-with? path \"/login/oauth/authorize\")\n-                (authorize-redirect exchange query)\n+            (try\n+              (let [uri (.getRequestURI exchange)\n+                    path (.getPath uri)\n+                    query (.getQuery uri)\n+                    method (.getRequestMethod exchange)]\n+                (cond\n+                  ;; GitHub authorize\n+                  (str/ends-with? path \"/login/oauth/authorize\")\n+                  (authorize-redirect exchange query)\n \n-                ;; Reddit authorize\n-                (str/ends-with? path \"/api/v1/authorize\")\n-                (authorize-redirect exchange query)\n+                  ;; Reddit authorize\n+                  (str/ends-with? path \"/api/v1/authorize\")\n+                  (authorize-redirect exchange query)\n \n-                ;; GitHub token\n-                (and (= method \"POST\") (str/ends-with? path \"/login/oauth/access_token\"))\n-                (let [code (or (:code (read-form exchange)) \"mock:1002:newbie\")]\n-                  (send-json exchange 200 (str \"{\\\"access_token\\\":\\\"\" code \"\\\",\\\"token_type\\\":\\\"bearer\\\"}\")))\n+                  ;; GitHub token\n+                  (and (= method \"POST\") (str/ends-with? path \"/login/oauth/access_token\"))\n+                  (let [code (or (:code (read-form exchange)) \"mock:1002:newbie\")]\n+                    (send-json exchange 200 (str \"{\\\"access_token\\\":\\\"\" code \"\\\",\\\"token_type\\\":\\\"bearer\\\"}\")))\n \n-                ;; Reddit token (client_credentials for import + authorization_code for login)\n-                (and (= method \"POST\") (str/ends-with? path \"/api/v1/access_token\"))\n-                (let [form (read-form exchange)\n-                      grant (or (:grant form) \"\")\n-                      code (or (:code form) \"mock:t2_test:redditor\")]\n-                  (if (= grant \"client_credentials\")\n-                    (send-json exchange 200 \"{\\\"access_token\\\":\\\"app-token\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\")\n-                    (send-json exchange 200 (str \"{\\\"access_token\\\":\\\"\" code \"\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\"))))\n+                  ;; Reddit token (client_credentials for import + authorization_code for login)\n+                  (and (= method \"POST\") (str/ends-with? path \"/api/v1/access_token\"))\n+                  (let [form (read-form exchange)\n+                        grant (or (:grant form) \"\")\n+                        code (or (:code form) \"mock:t2_test:redditor\")]\n+                    (if (= grant \"client_credentials\")\n+                      (send-json exchange 200 \"{\\\"access_token\\\":\\\"app-token\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\")\n+                      (send-json exchange 200 (str \"{\\\"access_token\\\":\\\"\" code \"\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\"))))\n \n-                ;; GitHub user\n-                (= path \"/user\")\n-                (let [token (bearer-token exchange)\n-                      user (or (parse-token-user token) {:id \"1002\" :login \"newbie\" :numeric? true})]\n-                  (send-json exchange 200\n-                             (str \"{\\\"id\\\":\" (:id user) \",\\\"login\\\":\\\"\" (:login user) \"\\\"}\")))\n+                  ;; GitHub user\n+                  (= path \"/user\")\n+                  (let [token (bearer-token exchange)\n+                        user (or (parse-token-user token) {:id \"1002\" :login \"newbie\" :numeric? true})]\n+                    (send-json exchange 200\n+                               (str \"{\\\"id\\\":\" (:id user) \",\\\"login\\\":\\\"\" (:login user) \"\\\"}\")))\n \n-                ;; Reddit /api/v1/me\n-                (str/ends-with? path \"/api/v1/me\")\n-                (let [token (bearer-token exchange)\n-                      user (or (parse-token-user token) {:id \"t2_test\" :login \"redditor\"})]\n-                  (send-json exchange 200\n-                             (str \"{\\\"id\\\":\\\"\" (:id user) \"\\\",\\\"name\\\":\\\"\" (:login user) \"\\\"}\")))\n+                  ;; Reddit /api/v1/me\n+                  (str/ends-with? path \"/api/v1/me\")\n+                  (let [token (bearer-token exchange)\n+                        user (or (parse-token-user token) {:id \"t2_test\" :login \"redditor\"})]\n+                    (send-json exchange 200\n+                               (str \"{\\\"id\\\":\\\"\" (:id user) \"\\\",\\\"name\\\":\\\"\" (:login user) \"\\\"}\")))\n \n-                :else\n-                (send-json exchange 404 \"{\\\"error\\\":\\\"not found\\\"}\")))))]\n+                  :else\n+                  (send-json exchange 404 \"{\\\"error\\\":\\\"not found\\\"}\")))\n+              (catch Throwable t\n+                (binding [*out* *err*]\n+                  (println \"mock-oauth handler error:\" t))\n+                (try\n+                  (send-json exchange 500 \"{\\\"error\\\":\\\"mock-oauth internal\\\"}\")\n+                  (catch Throwable _))))))]\n     (.createContext server \"/\" handler)\n     (.setExecutor server nil)\n     (.start server)\ndiff --git a/test/support/mock_reddit.clj b/test/support/mock_reddit.clj\nindex a630cf0938722193e9af88382d60e777ff371be4..faa27945b6394363914c853627a0bad1e819a5f9 100644\n--- a/test/support/mock_reddit.clj\n+++ b/test/support/mock_reddit.clj\n@@ -12,7 +12,7 @@\n (defn- query-param [query key]\n   (when query\n     (some (fn [pair]\n-            (let [[k v] (str/split pair \"=\" 2)]\n+            (let [[k v] (str/split pair #\"=\" 2)]\n               (when (= k key)\n                 (URLDecoder/decode (or v \"\") \"UTF-8\"))))\n           (str/split query #\"&\"))))\n@@ -34,11 +34,11 @@\n \n (defn- send-redirect [^HttpExchange ex location]\n   (.set (.getResponseHeaders ex) \"Location\" location)\n-  (.sendResponseHeaders ex 302 -1)\n+  (.sendResponseHeaders ex 302 0)\n   (.close (.getResponseBody ex)))\n \n (defn- read-form [^HttpExchange ex]\n-  (let [body (slurp (.getInputStream ex))]\n+  (let [body (slurp (.getRequestBody ex))]\n     {:code (query-param body \"code\")\n      :grant (query-param body \"grant_type\")}))\n \n@@ -48,7 +48,7 @@\n           (str/replace #\"^[Bb]earer \" \"\")))\n \n (defn- parse-token-user [token]\n-  (when (str/starts-with? token \"mock:\")\n+  (when (and token (str/starts-with? token \"mock:\"))\n     (parse-mock-user (subs token 5))))\n \n (defn start-mock-reddit\n@@ -72,7 +72,7 @@\n                        user (parse-mock-user (query-param query \"mock_user\"))\n                        code (str \"mock:\" (:id user) \":\" (:login user))\n                        loc (str redirect-uri \"?code=\" (java.net.URLEncoder/encode code \"UTF-8\")\n-                                \"&state=\" (java.net.URLEncoder/encode state \"UTF-8\"))]\n+                                \"&state=\" (java.net.URLEncoder/encode (or state \"\") \"UTF-8\"))]\n                    (send-redirect exchange loc))\n \n                  (and (= method \"POST\") (str/ends-with? path \"/api/v1/access_token\"))\n\n\nSide B — contributor: tommy-mor\nSide B — commit message:\n[798c764d] feat(html): grouped cli_panel with hover-to-copy and JS-safe asserts\n\nSingle bordered panel for multiple commands; rows copy on click without a\nseparate copy control. Assert CLI strings contain no chars that would break\nsingle-quoted onclick JS.\n\nMade-with: Cursor\n\nSide B — unified diff (full patch):\ndiff --git a/server/src/html/forum.rs b/server/src/html/forum.rs\nindex f6e45b05bb92126966e304619f80ef1d45be7a4b..075860914a6ce18bb0dfa73dc5651ef1a6318b67 100644\n--- a/server/src/html/forum.rs\n+++ b/server/src/html/forum.rs\n@@ -718,7 +718,7 @@ pub async fn home(\n             }\n             div id=\"public-new-thread-ui-slot\" {}\n             (render_thread_feed(Some(&nav), \"thread-feed\", &public_rows, now))\n-            (cli_panel(\"npx slugsocial public forum list\"))\n+            (cli_panel(&[\"npx slugsocial public forum list\"]))\n         },\n         None,\n         theme_from_jar(&jar),\n@@ -868,7 +868,7 @@ async fn thread_view_inner(\n             div id=\"thread-live-region\" {\n                 (compose_form(&nav, &tag, show_compose))\n             }\n-            (cli_panel(&cli))\n+            (cli_panel(std::slice::from_ref(&cli)))\n         },\n         None,\n         theme_from_jar(&jar),\n@@ -984,9 +984,7 @@ pub async fn room_page(\n                     (new_thread_form_for_room(&nav, true, false))\n                 }\n             }\n-            (cli_panel(&forum_cli))\n-            (cli_panel(&garden_cli))\n-            (cli_panel(&audit_cli))\n+            (cli_panel(&[forum_cli, garden_cli, audit_cli]))\n         },\n         None,\n         theme_from_jar(&jar),\n@@ -1409,7 +1407,7 @@ pub async fn user_profile_page(\n                     }\n                 }\n             }\n-            (cli_panel(&format!(\"npx slugsocial public forum list\")))\n+            (cli_panel(&[format!(\"npx slugsocial public forum list\")]))\n         },\n         None,\n         theme_from_jar(&jar),\ndiff --git a/server/src/html/garden.rs b/server/src/html/garden.rs\nindex 9b4789a79c3e293cbfc5f033a0eac8650320d94d..c8ce7de450f7d14e04020511e7eb7323bd487deb 100644\n--- a/server/src/html/garden.rs\n+++ b/server/src/html/garden.rs\n@@ -139,7 +139,7 @@ pub async fn garden_index(\n                     }\n                 }\n             }\n-            (cli_panel(\"npx slugsocial garden tree\"))\n+            (cli_panel(&[\"npx slugsocial garden tree\"]))\n         },\n         None,\n         theme_from_jar(&jar),\n@@ -542,7 +542,7 @@ async fn render_scope_view(\n                 ScopeId::Public => format!(\"npx slugsocial public garden body {}\", path.as_str().trim_start_matches(\"https://slug.social/~/\")),\n                 ScopeId::Room(room_id) => format!(\"npx slugsocial private {room_id} garden body {}\", path.as_str().trim_start_matches(\"https://slug.social/~/\")),\n             };\n-            (cli_panel(&cli))\n+            (cli_panel(std::slice::from_ref(&cli)))\n         },\n         None,\n         theme_from_jar(&jar),\ndiff --git a/server/src/html/mod.rs b/server/src/html/mod.rs\nindex e7f5bfb7a4b2dee2adf96447224c58d641092124..6617781a2e8e86c2e2693788ea7cd0eb0e3659a2 100644\n--- a/server/src/html/mod.rs\n+++ b/server/src/html/mod.rs\n@@ -599,18 +599,38 @@ pub(super) fn render_linkified_with_embeds_in_scope(raw: &str, garden_prefix: &s\n     }\n }\n \n-/// Small CLI hint panel showing how to look up this page from the terminal.\n-pub(super) fn cli_panel(cmd: &str) -> Markup {\n+/// CLI strings are embedded in a single-quoted JS literal; they must never need escaping.\n+fn assert_cli_panel_cmd_js_single_quote_safe(s: &str) {\n+    assert!(\n+        !s.contains('\\\\')\n+            && !s.contains('\\'')\n+            && !s.contains('\\n')\n+            && !s.contains('\\r'),\n+        \"cli_panel cmd must not contain `\\\\`, `'`, or newlines (got {s:?})\"\n+    );\n+}\n+\n+/// Small CLI hint panel: one border and title; each line is hover-highlighted and copies on click.\n+pub(super) fn cli_panel<I: AsRef<str>>(cmds: &[I]) -> Markup {\n+    if cmds.is_empty() {\n+        return html! {};\n+    }\n+    for cmd in cmds {\n+        assert_cli_panel_cmd_js_single_quote_safe(cmd.as_ref());\n+    }\n     html! {\n         div class=\"cli-panel\" {\n             span class=\"cli-panel-label muted\" { \"cli\" }\n-            code class=\"cli-panel-cmd\" { (cmd) }\n-            button\n-                class=\"cli-panel-copy\"\n-                title=\"Copy to clipboard\"\n-                onclick=(format!(r#\"navigator.clipboard.writeText('{}'); this.textContent='✓'; setTimeout(() => this.textContent='copy', 2000);\"#, cmd.replace(\"'\", \"\\\\'\")))\n-            {\n-                \"copy\"\n+            div class=\"cli-panel-cmds\" {\n+                @for cmd in cmds {\n+                    @let s = cmd.as_ref();\n+                    button type=\"button\" class=\"cli-panel-row\" title=\"Copy command\" onclick=(format!(\n+                        r#\"navigator.clipboard.writeText('{}');\"#,\n+                        s\n+                    )) {\n+                        code class=\"cli-panel-cmd\" { (s) }\n+                    }\n+                }\n             }\n         }\n     }\ndiff --git a/server/src/html/search.rs b/server/src/html/search.rs\nindex 28ceaa53c3fcac6777311535e95fb771b19438f5..43e6ebf36cf0fe72c96f0f9d850bea51ac094c43 100644\n--- a/server/src/html/search.rs\n+++ b/server/src/html/search.rs\n@@ -418,7 +418,7 @@ pub async fn search_page(\n                     value=(query) autocomplete=\"off\" autofocus;\n             }\n             (render_search_results(&results, &query))\n-            (cli_panel(\"npx slugsocial search <query>\"))\n+            (cli_panel(&[\"npx slugsocial search <query>\"]))\n         },\n         None,\n         theme_from_jar(&jar),\ndiff --git a/server/static/theme_default.css b/server/static/theme_default.css\nindex e024a5c8b74139ae8be37b2a1bd17e4c3abe9324..764b66c8208e91e6138b83c534387cf43c85b8b5 100644\n--- a/server/static/theme_default.css\n+++ b/server/static/theme_default.css\n@@ -610,7 +610,7 @@ code {\n    CLI PANEL — how to view this page from the terminal\n    ---------------------------------------------------------------- */\n div.cli-panel {\n-  align-items: baseline;\n+  align-items: flex-start;\n   background: var(--g1);\n   border: var(--bv) solid;\n   border-color: var(--lo) var(--hi) var(--hi) var(--lo); /* inset */\n@@ -621,11 +621,34 @@ div.cli-panel {\n   width: fit-content;\n   max-width: 100%;\n }\n+.cli-panel-cmds {\n+  display: flex;\n+  flex-direction: column;\n+  gap: 4px;\n+  flex: 1;\n+  min-width: 0;\n+}\n+button.cli-panel-row {\n+  background: transparent;\n+  border: none;\n+  color: inherit;\n+  cursor: pointer;\n+  display: block;\n+  font: inherit;\n+  margin: 0;\n+  padding: 2px 4px;\n+  text-align: left;\n+  width: 100%;\n+}\n+button.cli-panel-row:hover {\n+  background: var(--g3);\n+}\n .cli-panel-label {\n   font-size: 11px;\n   letter-spacing: 0.08em;\n   text-transform: uppercase;\n   flex-shrink: 0;\n+  padding-top: 2px;\n }\n .cli-panel-cmd {\n   background: none;\ndiff --git a/server/static/theme_retro_craft.css b/server/static/theme_retro_craft.css\nindex 00714575bfa533d1d9c66653b9089642e2b0a6ca..f89ecbc3a18eb9b2b27d1f7764330f6bd6987552 100644\n--- a/server/static/theme_retro_craft.css\n+++ b/server/static/theme_retro_craft.css\n@@ -306,19 +306,41 @@ a.post-nav-btn:hover {\n }\n \n div.cli-panel {\n-  align-items: baseline;\n+  align-items: flex-start;\n   border: 1px dashed var(--line);\n   display: flex;\n-  flex-wrap: wrap;\n   gap: 0.5rem;\n   margin: 0.65rem 0;\n   padding: 0.45rem 0.65rem;\n }\n+.cli-panel-cmds {\n+  display: flex;\n+  flex-direction: column;\n+  gap: 0.25rem;\n+  flex: 1;\n+  min-width: 0;\n+}\n+button.cli-panel-row {\n+  background: transparent;\n+  border: none;\n+  color: inherit;\n+  cursor: pointer;\n+  display: block;\n+  font: inherit;\n+  margin: 0;\n+  padding: 0.1rem 0.2rem;\n+  text-align: left;\n+  width: 100%;\n+}\n+button.cli-panel-row:hover {\n+  background: color-mix(in srgb, var(--accent) 14%, transparent);\n+}\n .cli-panel-label {\n   color: var(--ink-dim);\n   font-size: 0.72rem;\n   letter-spacing: 0.12em;\n   text-transform: uppercase;\n+  padding-top: 0.12rem;\n }\n .cli-panel-cmd {\n   color: var(--accent);\n","role":"user"}],"model":"~x-ai/grok-latest"}