Blame · Line-by-line history

`AUDIT.md`

Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.

AUDIT.mdBlame144 lines · 1 contributor

Normal view Raw

74a8784Claude	1	> SUPERSEDED (2026-06-10): historical record only. The current audit is `AUDIT-2026-06-10.md` at the repo root.
	2
2e8a4d5Claude	3	# Gluecron Audit — 2026-05-16
	4
	5	Comprehensive end-to-end audit run on branch `claude/fix-aa-loop-issue-PonMQ`
	6	at commit `67f64a3`. Four parallel agents covered: route inventory, link/form
	7	target validation, automated checks (bun test + tsc + smoke crawl), and
	8	critical-user-journey code-path tracing.
	9
	10	## Health snapshot
	11
	12	\| Check \| Result \|
	13	\|---\|---\|
	14	\| `bun test` \| 1995 pass / 0 fail / 2 skip across 143 files \|
	15	\| `bunx tsc --noEmit` \| clean — zero errors \|
	16	\| Registered HTTP routes \| 172 \|
	17	\| Broken internal `href` \| 1 — register form links to non-existent `/legal/*` \|
	18	\| Broken form actions \| 0 \|
	19	\| Broken client `fetch()` calls \| 0 \|
	20	\| Routes hanging on stub DB \| 2 — `/` and `/status` \|
	21	\| Routes 500ing on stub DB \| 1 — `/explore` \|
	22
	23	## Verified bugs (severity-ranked)
	24
	25	### P0 — Fixed this session
	26
	27	1. AA reload loop on admin dashboard. Layout registered `/sw.js` and
	28	`/sw-push.js` at the same scope `/`; the SW spec only allows one
	29	active SW per scope, so each registration kept replacing the other and
	30	the `updatefound → reload` hook fired on every page load. Cause of the
	31	"deploy pill flashing" / "typing wiped" / "buttons don't work"
	32	symptoms. Commit `d7ba05d`. Includes regression test.
	33
	34	2. AI code review silently auto-approves PRs. `src/lib/ai-review.ts`
	35	`reviewDiff()` returned `{ approved: true }` whenever Claude's output
	36	couldn't be parsed as JSON. Combined with the `approved: parsed.approved
	37	!== false` defaulting, **a missing field or any parse failure became an
	38	approval signal**, which feeds the K2 auto-merge gate. Fail-open on a
	39	security-relevant decision. Now fails closed: explicit `approved: true`
	40	required, otherwise returns `false` with a parseable failure summary.
	41	(committed in this batch.)
	42
	43	3. Broken legal links in register form. `src/routes/auth.tsx` linked
	44	to `/legal/terms` and `/legal/privacy`; mounted routes are `/terms`,
	45	`/privacy`, `/acceptable-use` (no `/legal/` prefix). 404 on click.
	46	Fixed to use the live paths. (committed in this batch.)
	47
	48	4. `drizzle.config.ts` crashes obscurely without `DATABASE_URL`.
	49	Non-null assertion → undefined → deep parser crash. Now throws a
	50	clean, actionable error at the top of the run. Commit `67f64a3`.
	51
	52	### P1 — Real bugs, not yet fixed
	53
	54	5. `src/routes/legal/` is an orphan subdirectory. Contains
	55	`terms.tsx`, `privacy.tsx`, `acceptable-use.tsx`, `dmca.tsx`. None of
	56	them are mounted in `src/app.tsx`. Self-reference `/legal/*` paths
	57	internally. Either mount them (and drop `legal.tsx`), or delete them.
	58	Currently dead code that wastes reviewer attention.
	59
	60	6. Duplicate route registration on `/:owner/:repo/dependencies`.
	61	Registered in both `src/routes/deps.tsx:45` and
	62	`src/routes/insights.tsx:183`. Hono is first-wins, and `insightRoutes`
	63	mounts first (line 372 vs 411 in `app.tsx`), so the `deps.tsx` handler
	64	is unreachable dead code.
	65
	66	7. `/explore` 500s with no DB. No defensive error boundary around
	67	the public repo-list query. Means a Neon hiccup takes the public
	68	discovery page down hard rather than degrading. Same pattern as
	69	`public-stats.ts` already handles; copy that approach.
	70
	71	8. `/` and `/status` hang indefinitely on DB failure. The home page
	72	handler blocks on `computePublicStats()` (and that file already has a
	73	"degraded to zeros" fallback) but the underlying query path can hang
	74	when the connection refuses rather than fails. Needs an explicit
	75	`Promise.race` against a 3–5s timeout so the page renders cached or
	76	zero data instead of timing out at the proxy.
	77
	78	### P1 — Silent failures across journeys (from critical-path audit)
	79
	80	9. Post-receive hook silent failures. `src/hooks/post-receive.ts`
	81	fires auto-repair, analysis, health-score updates as fire-and-forget
	82	with `.catch(() => {})`. User's push reports green from git but
	83	downstream automation may have crashed. No surface on the repo page.
	84
	85	10. Import-bulk has no input validation, no size limits. A 10GB repo
	86	can be cloned into RAM with no progress feedback or timeout
	87	(`src/routes/import-bulk.tsx`, `src/lib/import-helper.ts`). Git stderr
	88	is truncated to 200 bytes, so real errors are illegible.
	89
	90	11. `releaseExpiredWaitTimers` `.set is not a function` at
	91	`src/lib/environments.ts:376`. Caught and silently logged in tests;
	92	in production this means env-approval wait timers never release.
	93	Looks like a stale Drizzle call after a schema change.
	94
	95	### P2 — Style / pattern issues (lower priority)
	96
	97	12. Admin auth is inconsistent. Some admin routes use `requireAdmin`
	98	middleware, others use inline `gate()` helpers that call
	99	`isSiteAdmin()`. All routes audited are properly admin-gated —
	100	the route auditor flagged false positives on `mirrors`,
	101	`github-oauth`, `sso`, but all three have explicit `isSiteAdmin()`
	102	checks inside the handler. The inconsistency is a maintenance hazard,
	103	not a security hole.
	104
	105	13. **Many helpers `return null` instead of returning a `Response` or
	106	throwing.** Pattern in `ai-tests.tsx`, `ai-explain.tsx`,
	107	`discussions.tsx`, `issues.tsx`, `admin-ops.tsx`. Non-standard
	108	semantics that could mask bugs. Not a current crash source.
	109
	110	14. Silent `.catch(() => {})` patterns. Several auth flows swallow
	111	notification and audit-log failures without logging. Appropriate for
	112	best-effort side effects but lack of observability means operational
	113	issues are invisible.
	114
	115	## Verdict
	116
	117	The codebase is **substantially more solid than the user's framing
	118	suggested**. 1995 tests pass, navigation has zero broken links/forms, all
	119	admin routes are properly authenticated. The user-visible symptoms ("loop",
	120	"buttons don't work") trace to a single root cause (the SW scope collision)
	121	which is now fixed.
	122
	123	The genuine P0s are concentrated in two areas:
	124	- The AI auto-merge pipeline (now fixed — review can no longer fake
	125	approval through JSON parse failure)
	126	- Failure surfaces — post-receive, imports, and env approvals fail
	127	silently rather than reporting to the user
	128
	129	What this is not: a beginner codebase. It is an ambitious one with
	130	~170 routes and significant feature breadth (SSO, OAuth, GraphQL, MCP,
	131	marketplace, AI review, etc.). The fragility comes from surface area, not
	132	craftsmanship.
	133
	134	## What's still needed for "usable as a normal website"
	135
	136	1. Deploy `d7ba05d` + the fixes in this batch to prod.
	137	2. Run a golden-path smoke test manually: register → create repo → `git
	138	push` → file an issue → open a PR. Each step that fails gets a fix.
	139	3. Address P1 items as discovered during the smoke test, in order of
	140	user-visible impact.
	141
	142	Visibility sweep (activity drawer, live admin, repo activity rail, run
	143	pages) is a separate effort and belongs on a fresh branch after the
	144	golden-path is green.