fix(audit): private-repo API leak, dead pushedAt, "000" counts, layout overflow #24

fix(audit): private-repo API leak, dead pushedAt, "000" counts, layout overflow

Findings from a 270-page live render sweep (96 anon + 147 authed desktop, 27 mobile @390px). Six independent defects, each verified against the live site before and after.

• api: GET /api/repos/:owner/:name returned the full repo row — including isPrivate, description, ownerId and the internal diskPath — to anonymous callers. Gate on the existing resolveRepoAccess() helper (mirroring the HTML surface, which already 404s) and never serialize diskPath at all. Types the api router with AuthEnv so it can read the softAuth viewer.

• post-receive: repositories.pushedAt was never written anywhere in the codebase, so it read null forever and every "recently active" sort and dashboard ranked all repos as dormant. Gluecron.com's own updated_at was still its creation date despite constant pushes. Stamp both on push, fire-and-forget so the push path cannot break.

• web: the "Get started with " card is an EMPTY-repo nudge, but was gated only on owner + !onboarding_shown, and onboarding_shown flips only on explicit dismiss. A populated repo (27 files, 7 branches) therefore rendered "add a README" above the fold forever. Require an actually empty tree + no branches.

• pulls: sql is a compile-time cast only — Postgres count() returns bigint, which the driver returns as a string. "0"+"0"+"0" rendered the All pill as "000", and openCount === 0 was never true so the empty state never showed. Coerce with Number() at the boundary.

• app: mount marketplaceAgentsRoutes before marketplaceRoutes; the generic /marketplace/:slug was swallowing /marketplace/agents and 404ing it.

• layout: fix horizontal overflow on five pages. docs used a 1fr grid track (min-width:auto) that grew to its widest

  , so overflow-x:auto never
  engaged — 3406px wide at a 1440 viewport. signin-v2 ships a standalone
  stylesheet that never reset the browser default body margin, and
  .si-magic-row floored the column at 422px. pricing/enterprise hero orbs
  are decorative and now clip.
  Verified: 3406->1440, 3092->390, 821->390, 430->390, 405->390, 435->390.
  
  

• deploy: the container never received a build SHA. self-deploy.sh pinned BUILD_SHA into a systemd drop-in, but the app runs under docker compose, which passed neither BUILD_SHA nor GIT_SHA — and build-info.ts reads GIT_SHA while version.ts/pwa.ts read BUILD_SHA. So the footer showed "unknown . unknown", /api/version reported a SHA that never changed (the auto-update banner could never fire) and the PWA service-worker cache key never rotated between deploys. Export all three in auto-update.sh (the real deploy path) and interpolate them in the compose file.

Typecheck clean. Test suite: 3122 pass / 4 fail — the same 4 that already fail on main (login shell, playground x2, wiki 404), unchanged by this work.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com

Opened from a 270-page live render sweep (96 anon + 147 authed desktop, 27 mobile @390px).

Not fixed here (worth separate issues): owner repo-home takes 7.8s vs 2.1s anon; PAT auth is completely uncached (SHA-256 + Neon SELECT + UPDATE per request); PREVIEW_TTL_MS hardcoded 24h with no UI; PATs never expire; 33 pages missing h1; homepage advertises all zeros; four competing layout shells.

Generated with Claude Code