Summary

This PR updates the dataframe toolbar to always show the column visibility menu (the eye icon), regardless of whether all columns are currently visible. Previously, the icon was only shown if at least one column was hidden. It also adds important documentation notes warning users that hidden columns can still be shown by the user, advising them to remove sensitive data before passing it to the dataframe.

Code Quality

The code changes are clean and straightforward:

• In frontend/lib/src/components/widgets/DataFrame/DataFrame.tsx, the useEffect that previously hid the menu when all columns were visible has been correctly removed.
• The rendering condition has been appropriately updated from allColumns.length > columns.length to allColumns.length > 0.
• The documentation additions in the Python files (arrow.py, data_editor.py, column_types.py) are clear and provide valuable guidance to developers regarding data exposure.

Test Coverage

• Unit Tests: DataFrame.test.tsx has been updated to expect 4 toolbar buttons instead of 3, and a new test should show column visibility button when all columns are visible has been added.
• E2E Tests: The visual snapshots in e2e_playwright have been updated to reflect the new toolbar appearance.

Backwards Compatibility

There are no breaking API changes. The UI will now show an additional icon in the dataframe toolbar by default. The documentation updates correctly highlight a pre-existing behavior (that hidden columns can be unhidden by the user via the UI) which might surprise some developers who were using column_config={...: None} as a security measure. Adding the warning to the docstrings is a great proactive step.

Security & Risk

No new security risks are introduced. In fact, the documentation updates improve security awareness by explicitly warning developers not to pass sensitive data to the frontend, even if it is configured to be "hidden".

External test recommendation

No. Triggered categories: None. The changes are limited to frontend UI rendering logic (always showing a button) and Python docstring updates. There are no modifications to routing, authentication, websockets, or cross-origin behavior. Confidence is high.

Accessibility

The column visibility button remains accessible, utilizing the existing "Show/hide columns" aria-label (as verified by the updated unit tests).

Recommendations

The implementation looks solid. No further changes are required.

Verdict

APPROVED: The changes successfully implement the feature, are well-tested, and include excellent documentation updates regarding data visibility.

This is an automated AI review by gemini-3.1-pro.

Summary

This PR makes the dataframe/data editor column visibility menu button always available when the table has columns, instead of only showing it after columns become hidden. It also updates public Python docs to explicitly clarify that hidden/omitted columns can still be revealed in the UI, and refreshes affected Playwright snapshots.

Code Quality

The implementation is small, focused, and aligns with existing frontend patterns:

• frontend/lib/src/components/widgets/DataFrame/DataFrame.tsx removes an unnecessary derived-state useEffect and simplifies the toolbar condition to allColumns.length > 0, which is cleaner and easier to reason about.
• frontend/lib/src/components/widgets/DataFrame/DataFrame.test.tsx updates toolbar expectations and adds a targeted regression test for the column visibility control.
• lib/streamlit/elements/arrow.py, lib/streamlit/elements/widgets/data_editor.py, and lib/streamlit/elements/lib/column_types.py docstring changes follow existing Numpydoc style and correctly communicate behavior.

No maintainability or correctness issues were identified in the changed logic.

Test Coverage

Coverage is good for the scope of this change:

• Frontend unit test: frontend/lib/src/components/widgets/DataFrame/DataFrame.test.tsx now verifies the column visibility button is present when all columns are visible.
• E2E visual coverage: Snapshot updates in e2e_playwright/__snapshots__/linux/st_dataframe_interactions_test/* and e2e_playwright/__snapshots__/linux/host_config_test/* reflect the toolbar UI change across browsers and host-config scenarios.
• Existing interaction test test_column_hiding_via_visibility_menu in e2e_playwright/st_dataframe_interactions_test.py continues to cover visibility menu behavior.

Given the narrow UI condition change, this is adequate.

Backwards Compatibility

No API-level breaking changes were introduced.

• Behavioral change (intentional): Users now always see the column visibility button when columns exist.
• Compatibility impact: Existing apps continue to function; this is a UX enhancement rather than a protocol or parameter change.
• Docs alignment: Updated Python docs now explicitly describe revealability of hidden columns, reducing ambiguity for existing users.

Security & Risk

No security-sensitive infrastructure paths were modified (no routing/auth/session/cookie/CORS/WebSocket/server endpoint changes).

• The frontend change is limited to toolbar visibility logic.
• Python changes are documentation-only.
• The new docs appropriately warn that hidden columns are not a data-protection mechanism and sensitive columns should be removed before rendering.

Regression risk is low and primarily visual/UX.

External test recommendation

• Recommend external_test: No
• Triggered categories: None
• Evidence:
  • frontend/lib/src/components/widgets/DataFrame/DataFrame.tsx: UI-only toolbar condition/effect change; no routing/auth/session/embed/network/storage/header logic touched.
  • frontend/lib/src/components/widgets/DataFrame/DataFrame.test.tsx: unit test updates only.
  • lib/streamlit/elements/arrow.py, lib/streamlit/elements/widgets/data_editor.py, lib/streamlit/elements/lib/column_types.py: documentation-only changes.
  • e2e_playwright/__snapshots__/linux/...: snapshot refreshes only, no new external-mode logic.
• Suggested external_test focus areas:
  • None required for this PR.
  • Optional periodic smoke test (outside this PR): dataframe toolbar rendering in an embedded iframe host.
• Confidence: High
• Assumptions and gaps: Assessment is based on diff inspection only; no runtime execution was performed and binary snapshots were not visually reviewed in this environment.

Accessibility

No accessibility regressions identified.

• The column visibility control remains an icon button with an accessible label ("Show/hide columns"), and the new unit test queries it by label.
• No changes were made to focus handling, keyboard bindings, or semantic structure of the toolbar controls.

Recommendations

1. Optional cleanup: in frontend/lib/src/components/widgets/DataFrame/DataFrame.test.tsx, prefer toBeVisible() over getBy* + toBeInTheDocument() to match the frontend AGENTS guidance for RTL assertions.

Verdict

APPROVED: The change is focused, low-risk, documented, and sufficiently covered for the scope.

This is an automated AI review by gpt-5.3-codex-high. Please verify the feedback and use your judgment.

Summary

This PR makes the dataframe column visibility menu (eye icon) always visible in the toolbar, instead of only showing it when some columns are hidden. Previously, users couldn't discover the column visibility feature until they first hid a column via the column context menu. The change also removes a useEffect that auto-closed the visibility menu when all columns became visible, and adds docstring notes across st.dataframe, st.data_editor, and ColumnConfig warning that hidden columns can still be revealed by users via the toolbar.

Key changes:

• Frontend (DataFrame.tsx): Removed the useEffect that auto-closed the column visibility menu, and changed the render condition from allColumns.length > columns.length to allColumns.length > 0.
• Frontend tests (DataFrame.test.tsx): Updated toolbar button count from 3 to 4, added a new test for column visibility button presence.
• Python docstrings (arrow.py, data_editor.py, column_types.py): Added .. note:: blocks documenting that hidden columns can be re-shown by users.
• E2E snapshots: Updated 15 toolbar-related snapshots reflecting the new always-visible icon.

Code Quality

The code is clean and well-scoped:

1. Removal of the useEffect is correct: The removed effect (previously at ~line 627) watched allColumns.length and columns.length to auto-close the visibility menu — a classic "setting derived state in an Effect" anti-pattern per the project's frontend/AGENTS.md guidelines. Removing it aligns with React best practices. The menu can still be closed via the toggle button, clicking outside, pressing Escape, or grid selection changes (line 951 in DataFrame.tsx).

2. Condition change is sound: Changing from allColumns.length > columns.length to allColumns.length > 0 ensures the icon appears whenever there are columns. The !isEmptyTable guard already ensures the table has data; allColumns.length > 0 is a reasonable extra safety check.

3. Docstring additions are well-written: The .. note:: blocks follow Numpydoc/RST conventions and are placed consistently across all three Python files (arrow.py, data_editor.py, column_types.py). The security guidance about removing sensitive data before passing to the function is appropriate and important.

Minor note in the test file at DataFrame.test.tsx line 127:

  it("should show column visibility button when all columns are visible", () => {
    render(<DataFrame {...props} />)

    // The column visibility button should be present even when all columns are shown
    // (it appears when the toolbar is shown via hover)
    expect(screen.getByLabelText("Show/hide columns")).toBeInTheDocument()
  })

Per frontend/AGENTS.md: "Utilizing any query that throws if not found AND asserting using toBeInTheDocument is redundant and must be avoided." Since the toolbar starts with opacity: 0, toBeVisible() would fail, so toBeInTheDocument() is intentional here. However, the recommended pattern per the guide would be queryByLabelText + toBeInTheDocument() to avoid the redundancy. This is a very minor style point and not a blocker.

Test Coverage

• Unit tests: The existing "should have a toolbar" test was correctly updated from 3 to 4 expected buttons. A new focused test "should show column visibility button when all columns are visible" validates the core behavioral change using an accessible query (getByLabelText).
• E2E tests: The existing test_column_hiding_via_visibility_menu E2E test already exercises the full flow of opening the visibility menu, hiding a column, and verifying the result. The 15 updated snapshots (toolbar and toolbar-hover-search across all 3 browsers in light/dark themes, plus host-config snapshots) properly reflect the new icon appearing in the toolbar by default.
• Coverage assessment: The test coverage is adequate for this change. The behavior is straightforward (always render vs. conditionally render), and both the unit and E2E tests verify it.

Backwards Compatibility

This change is fully backwards compatible:

• No API changes, protobuf changes, or config changes.
• The column visibility menu was already functional; this only changes when the toolbar icon is visible.
• The docstring additions are informational only and don't change behavior.
• Users who relied on column_order or column_config={"col": None} to hide columns should be aware that users can now more easily discover and toggle column visibility. This is clearly documented in the new notes.

Security & Risk

• No security concerns identified. The change is UI-only and doesn't touch authentication, WebSocket handling, file operations, or any server-side logic.
• Important documentation improvement: The added docstring notes correctly warn users that hidden columns can still be revealed via the toolbar and recommend removing sensitive data from the DataFrame before passing it. This is a valuable security-aware documentation addition that addresses a common misunderstanding.

External test recommendation

• Recommend external_test: No
• Triggered categories: None
• Evidence:
  • frontend/lib/src/components/widgets/DataFrame/DataFrame.tsx: Pure UI rendering condition change (when to show a toolbar icon). No routing, auth, WebSocket, embedding, asset serving, CORS, storage, or security header changes.
  • lib/streamlit/elements/arrow.py, data_editor.py, column_types.py: Docstring-only changes with no behavioral impact.
• Suggested external_test focus areas: N/A
• Confidence: High
• Assumptions and gaps: None. The change is entirely client-side UI rendering logic with no impact on external hosting, embedding, or cross-origin behavior.

Accessibility

• The column visibility toolbar button already has an appropriate aria-label="Show/hide columns", which is verified by the new unit test.
• The ColumnVisibilityMenu component uses autoFocus, focusLock, and onEsc for keyboard accessibility.
• Each checkbox item in the menu has an aria-label matching the column name.
• No accessibility regressions identified. Making the button always visible actually improves discoverability for all users.

Recommendations

1. (Minor/Optional) In DataFrame.test.tsx line 127, consider using queryByLabelText instead of getByLabelText when asserting with toBeInTheDocument(), to align with the project's RTL best practices documented in frontend/AGENTS.md. Alternatively, hover the element first and assert with toBeVisible().

Verdict

APPROVED: Clean, well-scoped change that improves discoverability of the column visibility feature, removes an unnecessary useEffect anti-pattern, updates snapshots, and adds appropriate security-aware documentation. No regressions or concerns identified.

This is an automated AI review by opus-4.6-thinking.