feat(sources): removing a source deletes its files and index entries behind a confirmation modal

tests/e2e/test_git_sources_admin.py

@@ -35,8 +35,10 @@ Contract under test:
   render as a full-width table (mono URL, added date, per-row Remove)
   with the env note hidden while the DB has rows; add (201 → row, input
   cleared, button re-enabled), duplicate (inline role=alert, no new
-  row), invalid shape (inline 422, no new row), remove (confirm → gone;
-  cancel → stays); with the table truncated the env rows render with
+  row), invalid shape (inline 422, no new row), remove (the
+  confirmation modal: accept → gone; cancel → stays — the native
+  confirm() retired, phase 69); with the table truncated the env rows
+  render with
   "from .env" tags and ``#git-sources-env-note`` visible;
 * the page a11y / no-CDN basics (UI Structure Check, AGENTS.md rule 5):
   landmarks, labeled form control, full-width table, ≥44px targets,
@@ -64,7 +66,7 @@ from pathlib import Path
 from typing import Any
 
 import pytest
-from playwright.sync_api import Dialog, Page, expect
+from playwright.sync_api import Page, expect
 from sqlalchemy import text
 
 from app.db import SessionLocal
@@ -425,42 +427,43 @@ def test_admin_add_then_remove_lifecycle(
     expect(add_btn).to_be_enabled()
     expect(add_btn).to_have_text("Add source")
 
-    # --- remove: accept the confirm → the row disappears --------------
-    dialog_action: dict[str, bool] = {"accept": True}
+    # --- remove: accept the confirmation modal → the row disappears ---
+    # (phase 69: the native confirm() is retired — a row's Remove opens
+    # the page-local alertdialog; "Remove source" accepts, Cancel
+    # cancels without a request.)
     deletes: list[str] = []
 
-    def handle_dialog(dialog: Dialog) -> None:
-        if dialog_action["accept"]:
-            dialog.accept()
-        else:
-            dialog.dismiss()
-
     def track_delete(r: Any) -> None:
         if r.method == "DELETE" and "/api/git-sources/" in r.url:
             deletes.append(r.url)
 
-    page.on("dialog", handle_dialog)
     page.on("request", track_delete)
     try:
         _row(page, NEW_REPO_URL).locator(".git-source-remove").click()
+        dialog = page.locator("#remove-confirm-dialog")
+        expect(dialog).to_be_visible(timeout=30_000)
+        expect(page.locator("#remove-confirm-source")).to_have_text(NEW_REPO_URL)
+        page.locator("#remove-confirm-remove").click()
         expect(page.locator("#git-sources-tbody tr")).to_have_count(1, timeout=30_000)
         expect(_row(page, NEW_REPO_URL)).to_have_count(0)
+        expect(dialog).to_be_hidden()
         # The seed row survived — and exactly one DELETE went out.
         expect(_row(page, SEED_URL)).to_have_count(1)
         assert len(deletes) == 1, f"expected one DELETE, saw: {deletes}"
 
-        # --- remove: cancel the confirm → the row stays, NO DELETE ----
-        dialog_action["accept"] = False
+        # --- remove: cancel the modal → the row stays, NO DELETE ------
         _row(page, SEED_URL).locator(".git-source-remove").click()
-        # Wait for the dialog round-trip to settle (dismiss → the JS
-        # returns without fetching) so the "no second DELETE" claim is
+        expect(page.locator("#remove-confirm-dialog")).to_be_visible(timeout=30_000)
+        page.locator("#remove-confirm-cancel").click()
+        expect(page.locator("#remove-confirm-dialog")).to_be_hidden()
+        # Wait for the cancel round-trip to settle (Cancel closes the
+        # dialog without fetching) so the "no second DELETE" claim is
         # made on a settled page.
         page.wait_for_timeout(500)
         assert len(deletes) == 1, f"canceled removal still deleted: {deletes}"
         expect(_row(page, SEED_URL)).to_have_count(1)
         expect(page.locator("#git-sources-tbody tr")).to_have_count(1)
     finally:
-        page.remove_listener("dialog", handle_dialog)
         page.remove_listener("request", track_delete)