Banked-then-pulled per CC#2's post-flip observations from PR #143
ship report. Pure refactor: 0 functional changes; tests stay green
count-for-count; ~300 LOC of duplicated logic consolidated into
shared modules. Net -70 LOC after accounting for shared-module
overhead.

Part A — Frontend helpers extraction
====================================

New ``web/src/lib/panelHelpers.ts``:

  * formatRelative(iso: string | null | undefined): string
    — "2m ago" / "3h ago" / "4d ago" / "in 30s" math.
    Nullable signature so panels don't need wrapper logic;
    empty-string for missing inputs.
  * formatTimestamp(iso: string | null | undefined): string
    — absolute browser-locale timestamp. "—" for null;
    raw value passes through for unparseable strings.
  * formatLatency(ms: number | null | undefined): string
    — "142 ms" / "2.40 s" / "—". Replaces formatDuration
    helpers in AgentActivity + Reasoning (identical logic +
    thresholds).

Updated panels to import from panelHelpers.ts and remove local
copies (7 panels):

  * WebhookEventsPanel / AgentActivityPanel / SlackDMPanel /
    EmailPanel / ReasoningPanel / AlertsPanel — straight replacement
  * HeartbeatPanel — keeps a thin formatRelative wrapper that
    returns "never checked" for null (heartbeat-specific
    semantic — operator needs explicit no-probe confirmation, not
    a blank cell) but delegates to formatRelativeShared for the
    time-math. Local formatTimestamp removed; imports nullable
    version directly.

(MCPClientsPanel was the one panel that didn't have these
helpers locally, so it's unchanged.)

Part B — Test helpers extraction
================================

New ``tests/kora_cli/_panel_test_helpers.py``:

  * strip_ts_comments(src) — JSX + block + line comment stripper
    used by dangerouslySetInnerHTML source-pin tests. Originally
    duplicated identically across 5 test files. Centralized so
    the regex stays under one set of eyes.
  * assert_no_token_shapes(payload, *, anthropic=True, slack=True,
    hex_secret=True, bearer=True) — walk-payload sweep for the
    common credential shapes (sk-ant- / xox*- / 32+ hex /
    Bearer/Authorization). Each panel previously inlined its
    own regex constants; future "we also have to ban X" change
    updates everywhere here.
  * isolated_kora_home(tmp_path, monkeypatch) — the 3-namespace
    get_kora_home monkeypatch pattern from #137's
    fixture-isolation lesson. Endpoint code resolves
    get_kora_home from its OWN module namespace (not via fresh
    import); patching only kora_constants silently misses;
    patching kora_cli.web_server is critical. Helper does all
    three + standard env + config-path overrides so per-file
    fixtures collapse to a one-liner.

Updated tests to use the new helpers:

  * 5 files swap inline _strip_ts_comments for the shared import:
    test_heartbeat_panel_drift_fixes, test_mcp_clients_health_display,
    test_web_server_alerts, test_web_server_email, test_web_server_slack_dm
  * 6 files swap inline 3-namespace fixture for isolated_kora_home:
    test_web_server_agent_activity, test_web_server_reasoning,
    test_web_server_webhook_events, test_web_server_slack_dm (keeps
    KORA_SLACK_JOSHUA_USER_ID env addition on top), audit/test_reasoning_xref,
    audit/test_reasoning_xref_email
  * test_heartbeat_panel_drift_fixes source-pin updated: previously
    pinned local HeartbeatPanel signatures, now pins the canonical
    panelHelpers.ts signatures AND verifies HeartbeatPanel imports
    from the shared module (so the pin isn't validating an
    orphaned helper).

Banked observations (NOT in scope; flagged in #143 + spec §
banked-observations for separate micro-buckets):

  * KR-FE-EMPTY-STATE-CONVERGENCE — converge other 7 panels on
    AlertsPanel's positive-reinforcement empty state
  * KR-FE-TZ-RENDERING — add Z / (local) TZ suffix to toLocaleString
  * KR-FE-SHOW-MORE-AFFORDANCE — expose ?limit query param to
    operators via "Show more" footer on timeline panels

PM's default ("keep this PR tightly refactor-only") followed.

Tests:
  * Subset (refactored files + related): 176/176 pass.
  * Full admin-panel + audit regression: 434/434 pass across
    30 suites.
  * tsc -b + vite build both clean.
  * Pre-existing failures in test_web_server_cron_profiles +
    test_model_switch_custom_providers confirmed on bare HEAD
    (not introduced by this refactor; separate cleanup if PM
    wants to dispatch).

Refs:
  * rafe-walker/kora-docs 17_cc_bucket_prompts/KR-FE-PANEL-HELPERS-DRY_backlog.md
  * PR #143 (KR-REASONING-PANEL-MODEL-XREF) ship report —
    observations that surfaced this bucket
  * PR #137 — fixture-isolation pattern (now codified in
    isolated_kora_home)
  * PR #132 — original panel patterns (formatRelative copy origin)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>