From 7279b18fdce051160dde1d23aa54189e907ede76 Mon Sep 17 00:00:00 2001
From: jay <thejayman77@gmail.com>
Date: Fri, 12 Jun 2026 21:58:13 -0400
Subject: [PATCH] Articles inspector hardening (Codex audit): http(s)-only
 links + clamp reason
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Article titles render as external links ONLY for http(s) URLs (matches
  ArticleCard's safeHref rule); anything else is plain text — no unsafe schemes.
- reason_text clamped to 2 lines with a full-text title tooltip, so a long
  classifier reason can't make the panel visually noisy.
(Admin gate + source-scoped query confirmed already in place.)
---
 frontend/src/routes/admin/+page.svelte | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/frontend/src/routes/admin/+page.svelte b/frontend/src/routes/admin/+page.svelte
index 2429d8a..2dd1f0d 100644
--- a/frontend/src/routes/admin/+page.svelte
+++ b/frontend/src/routes/admin/+page.svelte
@@ -743,7 +743,9 @@
                         {#each s._arts as a (a.id)}
                           <li>
                             <div class="art-row">
-                              <a class="art-title" href={a.url} target="_blank" rel="noopener">{a.title}</a>
+                              {#if typeof a.url === 'string' && /^https?:\/\//.test(a.url)}
+                                <a class="art-title" href={a.url} target="_blank" rel="noopener">{a.title}</a>
+                              {:else}<span class="art-title plain">{a.title}</span>{/if}
                               {#if a.accepted === 1}<span class="badge ok">accepted</span>{:else if a.accepted === 0}<span class="badge no">rejected</span>{/if}
                               {#if a.paywalled}<span class="pw" title="domain paywall rule">🔒</span>{/if}
                               {#if !a.has_image}<span class="art-flag" title="no image extracted">no img</span>{/if}
@@ -751,7 +753,7 @@
                               {#if a.topic}<span class="art-cat">{a.topic}</span>{/if}
                               <span class="art-when">{a.published_at ? fdate(a.published_at) : ''}</span>
                             </div>
-                            {#if a.reason}<div class="art-reason">{a.reason}</div>{/if}
+                            {#if a.reason}<div class="art-reason" title={a.reason}>{a.reason}</div>{/if}
                           </li>
                         {/each}
                       </ul>
@@ -1273,7 +1275,9 @@
   .art-flag { font-size: 0.7rem; color: var(--muted); border: 1px solid var(--line); border-radius: 999px; padding: 0 7px; }
   .art-cat { font-size: 0.72rem; color: var(--muted); text-transform: capitalize; }
   .art-when { font-size: 0.72rem; color: var(--muted); margin-left: auto; white-space: nowrap; }
-  .art-reason { font-size: 0.76rem; color: var(--muted); font-style: italic; margin-top: 2px; }
+  .art-title.plain { color: var(--ink); font-weight: 600; }
+  .art-reason { font-size: 0.76rem; color: var(--muted); font-style: italic; margin-top: 2px;
+                display: -webkit-box; -webkit-line-clamp: 2; -webkit-box-orient: vertical; overflow: hidden; cursor: help; }
   .act.more { margin-top: 8px; }
   .srctable .rowactions { white-space: nowrap; }
   .srctable .rowactions .act {