PR-Review #377: untested provider SQL, undefined np-input class, duplicated duration-trend query #379

PR: #377
Author: @Sev7eNup — status: merged (2026-09-15, commits 42f2918…cd7c48f)

Automated review findings, severity high/medium only. Low-severity notes were left out on purpose.

• high — src/NodePilot.Api/Services/DashboardDurationTrend.cs: the new query is hand-written per provider (three dialects: EXTRACT(EPOCH …) / DATEDIFF_BIG / julianday, plus jsonb_array_elements_text / OPENJSON / json_each for the folder scope), but tests/NodePilot.Api.Tests/Controllers/DashboardDurationTrendTests.cs uses TestDbFactory.Create() (SQLite in-memory) exclusively and carries no DatabaseIntegration trait. The PostgreSQL branch — the production default — and the SQL Server branch are executed by no test anywhere, not even by scripts/Test-DatabaseProviders.ps1 (which filters Category=DatabaseIntegration). A dialect or quoting mistake breaks GET /api/stats/duration-trend (including its RBAC folder-scope predicate) and is only discoverable on a real deployment. Suggestion: give the test a [Trait("Category","DatabaseIntegration")] theory over postgres/sqlserver via ProviderTestDatabase, mirroring ExecutionDispatchOutboxClaimerTests.

• medium — CI wiring for the new provider tests (.github/workflows/ci.yml untouched): ExecutionDispatchOutboxClaimerTests, ProviderMigrationTests and StartupRecoveryProviderTests all Assert.Skip/SkipUnless unless NODEPILOT_TEST_POSTGRES / NODEPILOT_TEST_SQLSERVER are set. CI sets neither, and scripts/nightly-tests.ps1 does not invoke scripts/Test-DatabaseProviders.ps1. So the atomic claim SQL (ExecutionDispatchOutboxClaimer, FOR UPDATE SKIP LOCKED / UPDLOCK,READPAST,READCOMMITTEDLOCK) and the consolidated 20260915180058_InitialBaseline are verified only when someone remembers to start Docker locally. Suggestion: run the DatabaseIntegration category in CI against a PostgreSQL instance (the Windows runner image ships one, stopped by default), or at minimum wire the script into the nightly.

• medium — src/nodepilot-ui/src/components/dashboard/DurationTrend.tsx:82: the workflow selector uses className="np-input w-full text-xs mb-2", but np-input is not defined anywhere in the repo — this line is its only occurrence (np-btn/np-btn-secondary in the same file do exist in index.css). The <select> therefore renders with browser-default styling and breaks in the dark skins. Suggestion: use .input-field (the element sits on an elevated .np-card) or the outline chain plus bg-surface-lowest, per src/nodepilot-ui/CLAUDE.md.

• medium — DurationTrend.tsx:37: useQuery(durationTrendQuery(windowHours)) is issued unconditionally in addition to the filtered query, only to keep the workflow option list alive. With a workflow selected this runs the full percentile aggregation twice per refresh (once scoped, once across every workflow), and the second result's bucket series is discarded. Suggestion: keep the previous options via placeholderData, or read the names from the workflow list the page already has.

• medium — docs/images/og-image.png (commit e603733, "Reduce the og-image file size"): the file grew from 367,397 to 380,187 bytes (+12.8 KB) at unchanged 1280×640 dimensions, so the commit does the opposite of what its message states and the message has no body explaining it. Either the optimizer output was never picked up or the wrong file was committed. Suggestion: re-run the optimization and verify the byte count, or correct the history note.

Automatic review finding — needs triage. Please verify before acting; low-severity observations were deliberately omitted.