🛡️ Sentinel: [HIGH] Fix exception information leakage

.Jules/palette.md

@@ -9,23 +9,9 @@
 ## 2026-06-13 - Added screen reader text for tooltip divs
 **Learning:** When using `title` attributes on non-interactive elements like icon-only `div`s for tooltips, screen readers might not announce them properly because they aren't focusable. The visual tooltip is not enough for accessibility.
 **Action:** Always add a visually hidden `<span className="sr-only">[Tooltip Text]</span>` inside non-interactive elements that rely on a `title` attribute so that screen readers have text content to announce.
-
 ## 2026-06-18 - Added keyboard accessibility to scrollable regions
 **Learning:** Horizontally scrollable regions (like the `SectionRoadmap` component) are not accessible to keyboard-only users unless they can receive focus. Keyboard users must be able to focus the container to scroll its content using arrow keys.
 **Action:** For proper keyboard accessibility in custom scrollable regions, always include `tabIndex={0}`, an appropriate `aria-label`, `role="region"`, and explicit focus visible styling (e.g., `focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-cyan-300`).
-
 ## 2026-06-19 - Internationalization
 **Learning:** The desktop app uses i18n via json files located in `apps/desktop/src/locales/`
 **Action:** When adding new text strings, make sure to add it to all locale files.
-
-## 2026-06-25 - Native tooltips on disabled elements
-**Learning:** Standard HTML `title` attributes used as tooltips do not render on elements that use Tailwind's `pointer-events-none` class, which is often applied to `disabled:` variants in Base UI and styled components.
-**Action:** Do not rely on native `title` attributes for explaining disabled states on buttons with `pointer-events-none`. Instead, either use a custom tooltip component or ensure focus/interactive styles are preserved if an explanation is strictly required.
-
-## 2024-06-29 - 비활성화된 네이티브 버튼의 툴팁 차단
-**Learning:** 네이티브 `<button>` 요소에 `disabled` 속성을 사용하면 마우스 호버 이벤트를 포함한 포인터 이벤트가 완전히 차단되어 표준 HTML `title` 속성이 툴팁으로 표시되지 않으며, 키보드 탭 순서(tab order)에서도 제외됩니다.
-**Action:** "출시 예정" 등 설명 툴팁이 필요한 비활성화된 액션 버튼의 경우, `title`을 버튼에 직접 붙이는 대신 포커스 가능한 `span` (`<span tabIndex={0} title={...} role="button" aria-disabled="true">`)으로 버튼을 감싸서 시각적 및 스크린 리더 접근성을 모두 보장해야 합니다.
-
-## 2024-07-01 - Testing components with focusable disabled button wrappers
-**Learning:** When native disabled buttons are wrapped in a focusable `span` to provide accessible tooltips, tests that previously found and clicked the `button` (by temporarily removing the `disabled` attribute) may fail or become overly complex. It is cleaner and more accurate to query the wrapper element (e.g. via its `title`) and fire events on it, reflecting the actual accessible DOM structure.
-**Action:** When testing UI components that wrap disabled buttons in a focusable span for accessibility (e.g., using a tooltip/title), use `screen.getByTitle(...)` to query the wrapper element for interactions like `fireEvent.click` rather than `screen.getByRole('button')`.

.Jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2024-06-25 - Prevent exception information leakage in IPC queues
+**Vulnerability:** Raw exceptions inside background workers were being cast to string (`str(error)`) and propagated over multiprocessing queues into IPC payloads.
+**Learning:** Returning raw Python exception strings can expose memory states (e.g. `oom`), file paths (e.g. `FileNotFoundError`), or underlying decoding libraries' error states to the client. Using a generic error message per exception type stops the leakage while logging the actual traceback to the internal logger via `logger.error("...", exc_info=True)`.
+**Prevention:** Avoid blindly re-raising or returning `str(error)` in worker wrappers. Map specific exceptions to safe, static strings and log the real error using the module-level logger.

.github/workflows/pr-review-merge-scheduler.yml

@@ -0,0 +1,106 @@
+name: PR Review Merge Scheduler
+
+on:
+  schedule:
+    - cron: "17 */2 * * *"
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: Print planned actions without mutating PRs
+        required: false
+        default: false
+        type: boolean
+      max_prs:
+        description: Maximum open PRs to inspect
+        required: false
+        default: "100"
+      trigger_reviews:
+        description: Dispatch OpenCode Review for PR heads without current approval
+        required: false
+        default: false
+        type: boolean
+      enable_auto_merge:
+        description: Enable auto-merge for current-head approved PRs
+        required: false
+        default: true
+        type: boolean
+      update_branches:
+        description: Update outdated PR branches after OpenCode approval
+        required: false
+        default: true
+        type: boolean
+      stale_opencode_minutes:
+        description: Redispatch OpenCode Review when an in-progress OpenCode check is older than this many minutes
+        required: false
+        default: "45"
+
+concurrency:
+  group: pr-review-merge-scheduler
+  cancel-in-progress: false
+
+env:
+  GIT_CONFIG_COUNT: "1"
+  GIT_CONFIG_KEY_0: init.defaultBranch
+  GIT_CONFIG_VALUE_0: develop
+
+permissions:
+  contents: read
+
+jobs:
+  scan-pr-queue:
+    runs-on: ubuntu-latest
+    permissions:
+      checks: read
+      contents: read
+      issues: write
+      pull-requests: write
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+      DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run == true }}
+      MAX_PRS: ${{ inputs.max_prs || '100' }}
+      PROJECT_FLOW: ${{ vars.PROJECT_FLOW || 'git-flow' }}
+      TRIGGER_REVIEWS: ${{ github.event_name == 'workflow_dispatch' && inputs.trigger_reviews == true }}
+      ENABLE_AUTO_MERGE: ${{ github.event_name != 'workflow_dispatch' || inputs.enable_auto_merge == true }}
+      UPDATE_BRANCHES: ${{ github.event_name != 'workflow_dispatch' || inputs.update_branches == true }}
+      STALE_OPENCODE_MINUTES: ${{ inputs.stale_opencode_minutes || vars.STALE_OPENCODE_MINUTES || '45' }}
+    steps:
+      - name: Checkout trusted scheduler
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 1
+
+      - name: Self-test scheduler
+        run: python3 scripts/ci/pr_review_merge_scheduler.py --self-test
+
+      - name: Inspect PR review and merge queue
+        run: |
+          set -euo pipefail
+          args=(
+            --repo "$GITHUB_REPOSITORY"
+            --base-branch "$DEFAULT_BRANCH"
+            --max-prs "$MAX_PRS"
+            --project-flow "$PROJECT_FLOW"
+            --review-workflow "OpenCode Review"
+            --stale-opencode-minutes "$STALE_OPENCODE_MINUTES"
+          )
+          if [ "$DRY_RUN" = "true" ]; then
+            args+=(--dry-run)
+          fi
+          if [ "$TRIGGER_REVIEWS" = "true" ]; then
+            args+=(--trigger-reviews)
+          else
+            args+=(--no-trigger-reviews)
+          fi
+          if [ "$ENABLE_AUTO_MERGE" = "true" ]; then
+            args+=(--enable-auto-merge)
+          else
+            args+=(--no-enable-auto-merge)
+          fi
+          if [ "$UPDATE_BRANCHES" = "true" ]; then
+            args+=(--update-branches)
+          else
+            args+=(--no-update-branches)
+          fi
+          python3 scripts/ci/pr_review_merge_scheduler.py "${args[@]}"