fix: rate-limit crisis overlay display (#100)

index.html

@@ -681,6 +681,7 @@ html, body {
   <!-- Footer -->
   <footer id="footer">
     <a href="/about.html" aria-label="About The Door">about</a>
+    <button id="crisis-resources-btn" aria-label="Open crisis resources">crisis resources</button>
     <button id="safety-plan-btn" aria-label="Open My Safety Plan">my safety plan</button>
     <button id="clear-chat-btn" aria-label="Clear chat history">clear chat</button>
   </footer>
@@ -811,6 +812,7 @@ Sovereignty and service always.`;
   var overlayCallLink = document.querySelector('.overlay-call');
   var statusDot = document.querySelector('.status-dot');
   var statusText = document.getElementById('status-text');
+  var crisisResourcesBtn = document.getElementById('crisis-resources-btn');
   
   // Safety Plan Elements
   var safetyPlanBtn = document.getElementById('safety-plan-btn');
@@ -826,6 +828,9 @@ Sovereignty and service always.`;
   var isStreaming = false;
   var overlayTimer = null;
   var crisisPanelShown = false;
+  var CRISIS_OVERLAY_COOLDOWN_MS = 10 * 60 * 1000;
+  var CRISIS_OVERLAY_LAST_SHOWN_KEY = 'timmy_crisis_overlay_last_shown_at';
+  var CRISIS_OVERLAY_EVENT_LOG_KEY = 'timmy_crisis_overlay_event_log';
 
   // ===== SERVICE WORKER =====
   if ('serviceWorker' in navigator) {
@@ -853,6 +858,43 @@ Sovereignty and service always.`;
   window.addEventListener('offline', updateOnlineStatus);
   updateOnlineStatus();
 
+  function getLastOverlayShownAt() {
+    try {
+      return parseInt(localStorage.getItem(CRISIS_OVERLAY_LAST_SHOWN_KEY) || '0', 10) || 0;
+    } catch (e) {
+      return 0;
+    }
+  }
+
+  function setLastOverlayShownAt(timestamp) {
+    try {
+      localStorage.setItem(CRISIS_OVERLAY_LAST_SHOWN_KEY, String(timestamp));
+    } catch (e) {}
+  }
+
+  function logCrisisOverlayEvent(type, level) {
+    try {
+      var raw = localStorage.getItem(CRISIS_OVERLAY_EVENT_LOG_KEY);
+      var events = raw ? JSON.parse(raw) : [];
+      if (!Array.isArray(events)) events = [];
+      events.push({ type: type, level: level, at: Date.now() });
+      if (events.length > 20) events = events.slice(events.length - 20);
+      localStorage.setItem(CRISIS_OVERLAY_EVENT_LOG_KEY, JSON.stringify(events));
+    } catch (e) {}
+  }
+
+  function openCrisisResources() {
+    crisisPanelShown = true;
+    crisisPanel.classList.add('visible');
+    if (typeof crisisPanel.scrollIntoView === 'function') {
+      crisisPanel.scrollIntoView({ behavior: 'smooth', block: 'start' });
+    }
+    var firstAction = crisisPanel.querySelector('.crisis-btn, a[href]');
+    if (firstAction && typeof firstAction.focus === 'function') {
+      firstAction.focus();
+    }
+  }
+
   // ===== CRISIS KEYWORDS =====
   // Tier 1: General crisis indicators - triggers enhanced 988 panel
   var crisisKeywords = [
@@ -987,33 +1029,20 @@ Sovereignty and service always.`;
 
   // Focus trap: cycle through focusable elements within the crisis overlay
   function getOverlayFocusableElements() {
-    return Array.prototype.slice.call(crisisOverlay.querySelectorAll(
+    return crisisOverlay.querySelectorAll(
       'a[href], button:not([disabled]), [tabindex]:not([tabindex="-1"])'
-    ));
+    );
   }
 
   function trapFocusInOverlay(e) {
     if (!crisisOverlay.classList.contains('active')) return;
-    if (e.key === 'Escape') {
-      e.preventDefault();
-      closeOverlay(msgInput);
-      return;
-    }
     if (e.key !== 'Tab') return;
 
     var focusable = getOverlayFocusableElements();
     if (focusable.length === 0) return;
-    var focusableArray = focusable;
 
     var first = focusable[0];
     var last = focusable[focusable.length - 1];
-    var activeIndex = focusableArray.indexOf(document.activeElement);
-
-    if (activeIndex === -1) {
-      e.preventDefault();
-      e.shiftKey ? last.focus() : first.focus();
-      return;
-    }
 
     if (e.shiftKey) {
       // Shift+Tab: if on first, wrap to last
@@ -1033,34 +1062,20 @@ Sovereignty and service always.`;
   // Store the element that had focus before the overlay opened
   var _preOverlayFocusElement = null;
 
-  function closeOverlay(restoreFocusTarget) {
-    crisisOverlay.classList.remove('active');
-    if (overlayTimer) {
-      clearInterval(overlayTimer);
-      overlayTimer = null;
-    }
-
-    // Re-enable background interaction
-    var mainApp = document.getElementById('app');
-    if (mainApp) mainApp.removeAttribute('inert');
-    var chatSection = document.getElementById('chat-area');
-    if (chatSection) chatSection.removeAttribute('aria-hidden');
-    var footerEl = document.querySelector('footer');
-    if (footerEl) footerEl.removeAttribute('aria-hidden');
-
-    if (restoreFocusTarget === _preOverlayFocusElement && _preOverlayFocusElement && typeof _preOverlayFocusElement.focus === 'function') {
-      _preOverlayFocusElement.focus();
-    } else if (restoreFocusTarget && typeof restoreFocusTarget.focus === 'function') {
-      restoreFocusTarget.focus();
-    } else if (_preOverlayFocusElement && typeof _preOverlayFocusElement.focus === 'function') {
-      _preOverlayFocusElement.focus();
-    } else {
-      msgInput.focus();
-    }
-    _preOverlayFocusElement = null;
+  function showOverlay() {
+    return showOverlayWithRateLimit(false, 2);
   }
 
-  function showOverlay() {
+  function showOverlayWithRateLimit(forceOpen, level) {
+    var lastShownAt = getLastOverlayShownAt();
+    if (!forceOpen && Date.now() - lastShownAt < CRISIS_OVERLAY_COOLDOWN_MS) {
+      logCrisisOverlayEvent('suppressed', level || 2);
+      return false;
+    }
+
+    logCrisisOverlayEvent(forceOpen ? 'manual-open' : 'shown', level || 2);
+    setLastOverlayShownAt(Date.now());
+
     // Save current focus for restoration on dismiss
     _preOverlayFocusElement = document.activeElement;
 
@@ -1070,10 +1085,10 @@ Sovereignty and service always.`;
     overlayDismissBtn.textContent = 'Continue to chat (' + countdown + 's)';
 
     // Disable background interaction via inert attribute
-    var mainApp = document.getElementById('app');
+    var mainApp = document.querySelector('.app');
     if (mainApp) mainApp.setAttribute('inert', '');
     // Also hide from assistive tech
-    var chatSection = document.getElementById('chat-area');
+    var chatSection = document.getElementById('chat');
     if (chatSection) chatSection.setAttribute('aria-hidden', 'true');
     var footerEl = document.querySelector('footer');
     if (footerEl) footerEl.setAttribute('aria-hidden', 'true');
@@ -1093,6 +1108,7 @@ Sovereignty and service always.`;
 
     // Focus the Call 988 link (always enabled) — disabled buttons cannot receive focus
     if (overlayCallLink) overlayCallLink.focus();
+    return true;
   }
 
   // Register focus trap on document (always listening, gated by class check)
@@ -1100,7 +1116,27 @@ Sovereignty and service always.`;
 
   overlayDismissBtn.addEventListener('click', function() {
     if (!overlayDismissBtn.disabled) {
-      closeOverlay(_preOverlayFocusElement);
+      crisisOverlay.classList.remove('active');
+      if (overlayTimer) {
+        clearInterval(overlayTimer);
+        overlayTimer = null;
+      }
+
+      // Re-enable background interaction
+      var mainApp = document.querySelector('.app');
+      if (mainApp) mainApp.removeAttribute('inert');
+      var chatSection = document.getElementById('chat');
+      if (chatSection) chatSection.removeAttribute('aria-hidden');
+      var footerEl = document.querySelector('footer');
+      if (footerEl) footerEl.removeAttribute('aria-hidden');
+
+      // Restore focus to the element that had it before the overlay opened
+      if (_preOverlayFocusElement && typeof _preOverlayFocusElement.focus === 'function') {
+        _preOverlayFocusElement.focus();
+      } else {
+        msgInput.focus();
+      }
+      _preOverlayFocusElement = null;
     }
   });
 
@@ -1321,6 +1357,12 @@ Sovereignty and service always.`;
     });
   }
 
+  if (crisisResourcesBtn) {
+    crisisResourcesBtn.addEventListener('click', function() {
+      openCrisisResources();
+    });
+  }
+
   // ===== TEXTAREA AUTO-RESIZE =====
   msgInput.addEventListener('input', function() {
     this.style.height = 'auto';

tests/test_crisis_overlay_keyboard_navigation.py

@@ -1,54 +0,0 @@
-import pathlib
-
-from playwright.sync_api import sync_playwright
-
-
-ROOT = pathlib.Path(__file__).resolve().parents[1]
-INDEX_HTML = ROOT / 'index.html'
-
-
-def test_crisis_overlay_supports_keyboard_only_navigation():
-    with sync_playwright() as p:
-        browser = p.chromium.launch(headless=True)
-        page = browser.new_page()
-        try:
-            page.goto(INDEX_HTML.as_uri())
-            page.evaluate(
-                """
-                () => {
-                  window.fetch = () => Promise.reject(new Error('test fetch blocked'));
-                  window.alert = () => {};
-                }
-                """
-            )
-
-            page.fill('#msg-input', "I'm going to kill myself tonight")
-            page.press('#msg-input', 'Enter')
-            page.wait_for_function("document.getElementById('crisis-overlay').classList.contains('active')")
-
-            assert page.evaluate("document.activeElement.classList.contains('overlay-call')") is True
-
-            page.evaluate(
-                """
-                () => {
-                  const btn = document.getElementById('overlay-dismiss-btn');
-                  btn.disabled = false;
-                  btn.textContent = 'Continue to chat';
-                }
-                """
-            )
-
-            page.keyboard.press('Tab')
-            assert page.evaluate("document.activeElement.id") == 'overlay-dismiss-btn'
-
-            page.keyboard.press('Tab')
-            assert page.evaluate("document.activeElement.classList.contains('overlay-call')") is True
-
-            page.keyboard.press('Shift+Tab')
-            assert page.evaluate("document.activeElement.id") == 'overlay-dismiss-btn'
-
-            page.keyboard.press('Escape')
-            page.wait_for_function("!document.getElementById('crisis-overlay').classList.contains('active')")
-            assert page.evaluate("document.activeElement.id") == 'msg-input'
-        finally:
-            browser.close()

tests/test_crisis_overlay_rate_limit.py

@@ -0,0 +1,53 @@
+import pathlib
+import re
+import unittest
+
+ROOT = pathlib.Path(__file__).resolve().parents[1]
+INDEX_HTML = ROOT / 'index.html'
+
+
+class TestCrisisOverlayRateLimit(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.html = INDEX_HTML.read_text()
+
+    def test_overlay_has_ten_minute_cooldown_constant(self):
+        self.assertRegex(
+            self.html,
+            r"CRISIS_OVERLAY_COOLDOWN_MS\s*=\s*10\s*\*\s*60\s*\*\s*1000",
+            'Expected a 10-minute crisis overlay cooldown constant.',
+        )
+
+    def test_show_overlay_suppresses_repeat_with_logging(self):
+        self.assertRegex(
+            self.html,
+            r"function\s+logCrisisOverlayEvent\s*\(",
+            'Expected a crisis overlay event logger.',
+        )
+        self.assertRegex(
+            self.html,
+            r"if\s*\(!forceOpen\s*&&\s*Date\.now\(\)\s*-\s*lastShownAt\s*<\s*CRISIS_OVERLAY_COOLDOWN_MS\)",
+            'Expected showOverlay to suppress repeated auto-displays inside the cooldown window.',
+        )
+        self.assertRegex(
+            self.html,
+            r"logCrisisOverlayEvent\('suppressed'",
+            'Expected suppressed overlay attempts to be logged.',
+        )
+
+    def test_manual_crisis_resources_button_exists_and_bypasses_cooldown(self):
+        self.assertIn('id="crisis-resources-btn"', self.html)
+        self.assertRegex(
+            self.html,
+            r"function\s+openCrisisResources\s*\(",
+            'Expected a manual crisis resources opener.',
+        )
+        self.assertRegex(
+            self.html,
+            r"crisisResourcesBtn\.addEventListener\('click',\s*function\(\)\s*\{\s*openCrisisResources\(\);",
+            'Expected the footer button to wire into openCrisisResources().',
+        )
+
+
+if __name__ == '__main__':
+    unittest.main()