Make Pulse operational for dogfooding

## Summary - **Production bootstrap**: Created "Pulse" project in Supabase, set admin role, registered GitHub App installation (ID: 111433380) - **GitHub backfill**: New `backfillFromGitHub` server action that imports the last 100 commits, 50 merged PRs, and 20 releases from a connected GitHub repo into changelog entries with idempotent content hashes - **Manual sync**: Replaced the no-op `triggerManualSync` with a real backfill that fetches from GitHub API - **Auto-backfill on link**: When a repo is linked to a project, historical data is automatically backfilled - **Admin sidebar link**: Conditional "Admin" link with Shield icon appears for admin users - **Widget embed card**: Project settings now shows a ready-to-copy `<script>` tag with configuration hints - **Better empty states**: Changelog, feedback, roadmap, and sync history tables show helpful guidance and action buttons when empty - **Project overview**: Setup status checklist (GitHub connected, changelog populated, roadmap items) and public page links - **Onboarding checklist**: Dashboard shows a getting-started guide that auto-hides once key steps are completed ## Test plan - [ ] `npm run check` passes (833 tests, 0 lint errors, 0 type errors) - [ ] Navigate to `/p/pulse/changelog` — project loads (no 404) - [ ] Go to `/projects/pulse/sync`, click "Trigger Sync" — changelog entries appear - [ ] Log in as admin, verify "Admin" link appears in sidebar - [ ] Go to `/projects/pulse/settings` — see widget embed code with copy button - [ ] Create empty project, verify improved empty states in all modules - [ ] Dashboard shows onboarding checklist, steps check off progressively

Targeted select, partial sync status, return sync record directly, onboarding comment

Address review feedback — batch upsert, release heuristic, env-aware URLs

Add Claude Code GitHub Workflow

## 🤖 Installing Claude Code GitHub App This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository. ### What is Claude Code? [Claude Code](https://claude.com/claude-code) is an AI coding agent that can help with: - Bug fixes and improvements - Documentation updates - Implementing new features - Code reviews and suggestions - Writing tests - And more! ### How it works Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment. Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action. ### Important Notes - **This workflow won't take effect until this PR is merged** - **@claude mentions won't work until after the merge is complete** - The workflow runs automatically whenever Claude is mentioned in PR or issue comments - Claude gets access to the entire PR or issue context including files, diffs, and previous comments ### Security - Our Anthropic API key is securely stored as a GitHub Actions secret - Only users with write access to the repository can trigger the workflow - All Claude runs are stored in the GitHub Actions run history - Claude's default tools are limited to reading/writing files and interacting with our repo by creating comments, branches, and commits. - We can add more allowed tools by adding them to the workflow file like: ``` allowed_tools: Bash(npm install),Bash(npm run build),Bash(npm run lint),Bash(npm run test) ``` There's more information in the [Claude Code action repo](https://github.com/anthropics/claude-code-action). After merging this PR, let's try mentioning @claude in a comment on any PR to get started!

"Claude Code Review workflow"

"Claude PR Assistant workflow"

Add GitHub backfill, admin link, widget embed, empty states, onboarding checklist

Resolve E2E Clerk auth failures with ticket-based sign-in

## Summary - Switch `clerk.signIn()` from password to emailAddress/ticket strategy to bypass Clerk Client Trust device verification in Playwright - Create `e2e/dev-server.mjs` wrapper to obtain `CLERK_TESTING_TOKEN` before starting Next.js dev server (Playwright starts webServer before globalSetup) - Remove `storageState` dependency — each test signs in fresh via `clerk.signIn()` in `beforeEach` - Add `waitForLoadState('networkidle')` after sign-in to prevent Firefox `NS_BINDING_ABORTED` errors - Fix `auth-flows.spec.ts` sign-up link selector to use substring match (Clerk appends redirect params) - Clean up temporary debug logging from `middleware.ts` and `auth.ts` ## Root causes resolved 1. **Client Trust / Device Verification** — password-based sign-in blocked by Clerk's unrecognized device check. Fixed with ticket strategy. 2. **60-second JWT expiry** — saved storageState expired before tests ran. Fixed with fresh sign-in per test. 3. **CLERK_TESTING_TOKEN propagation** — Playwright starts webServer before globalSetup. Fixed with dev-server.mjs wrapper. 4. **Clerk user ID mismatch** — profiles table had stale clerk_ids. Fixed by updating Supabase profiles to match actual Clerk API user IDs. 5. **Firefox navigation timing** — NS_BINDING_ABORTED during rapid navigation. Fixed with networkidle waits. ## Test plan - [x] 62 E2E tests passing (Chromium + Firefox) - [x] 789 unit tests passing - [x] `npm run check` passing (lint + format + typecheck + tests) - [ ] CI needs Clerk env vars to run E2E in pipeline

Update auth.setup.ts docs for ticket strategy, add spawn error handling

Replace test.skip auth guards with assertions, decouple password validation

Exclude /projects/new from feedback spec project link selector

Resolve CI E2E failures from empty build artifact and server startup conflict

Address Copilot review feedback on E2E auth setup

Resolve E2E Clerk auth failures with ticket-based sign-in strategy

Add .prettierignore and update .gitignore for debug artifacts

## Summary - Add `.prettierignore` to exclude non-source directories (`.claude/`, `.playwright-mcp/`, `supabase/.temp/`, `.next/`, `node_modules/`, `coverage/`, `playwright-report/`, `test-results/`, `build/`, `.vercel/`) from Prettier checks - Update `.gitignore` to ignore browser automation screenshots (`*.png`), Playwright MCP logs (`.playwright-mcp/`), Supabase temp files (`supabase/.temp/`), and Claude config (`.claude/`) - Commit pending `AI_PLANNING.md` updates from Session 9 (branch/PR status, test count 723→789, CSP + auth loop guard completion notes) and format to pass Prettier check ## Context Debug artifacts (12 PNG screenshots, Playwright MCP logs, Supabase temp files) accumulated in the repo from browser automation sessions. These should never be tracked. Additionally, `npm run check` was failing because Prettier was scanning `.claude/settings.local.json`. The `AI_PLANNING.md` had uncommitted session state updates from Session 9 that are included in this cleanup. ## Test plan - [x] `npm run check` passes (lint + format:check + typecheck + 789 tests) - [x] No untracked artifacts remain in `git status` - [x] All debug/temp directories are properly gitignored

Rename misleading CI audit step label to reflect full dependency scan

Add informational dev dependency audit step to CI

Scope CI security audit to production deps, fix npm audit vulnerabilities

Add .prettierignore, update .gitignore for debug artifacts

Add auth redirect loop guard for stale Clerk sessions

## Summary - Adds a cookie-based loop guard to the Clerk middleware to prevent ERR_TOO_MANY_REDIRECTS when stale session cookies cause /sign-in ↔ /dashboard redirect loops - Sets a 10-second httpOnly cookie when redirecting from auth routes to /dashboard; if the user bounces back within that window, the sign-in page renders instead of redirecting again - Adds 4 new middleware tests covering the loop guard behavior ## Test plan - [ ] Verify authenticated users are still redirected from /sign-in to /dashboard on first visit - [ ] Verify the redirect loop is broken when stale cookies are present - [ ] Verify unauthenticated users can access /sign-in normally - [ ] All 789 tests pass

Scope loop guard cookie path to /sign- prefix to reduce header exposure

Make loop guard test assertions resilient to cookie format and NODE_ENV

Environment-aware secure flag on loop guard cookie, rename misleading test

Add cookie-based loop guard to prevent auth redirect loops

Add Clerk production proxy domain to CSP allowlist

## Summary - Add `https://clerk.pulse.g8n.ai` to CSP script-src, connect-src, img-src, and frame-src directives The Clerk production proxy domain was being blocked by CSP, preventing the Clerk JS bundle from loading. This caused a blank sign-in page and broken auth on production. ## Test Plan - [x] Verified on production — sign-in page loads, zero CSP errors - [x] All 783 unit tests passing

Add CSP regression assertions for Clerk production proxy domain

The middleware test suite verified CSP header existence but not its content. Without assertions on specific allowlisted domains, refactors could silently break production auth by removing required entries. ## Changes - Added test case validating `https://clerk.pulse.g8n.ai` presence in CSP directives (`script-src`, `connect-src`, `img-src`, `frame-src`) - Uses regex pattern matching to parse individual directives from the full CSP header string ```typescript it("includes Clerk production proxy domain in CSP directives", async () => { const response = await middlewareCallback(auth, request); const csp = response.headers.get("Content-Security-Policy"); // Verify it's in script-src const scriptSrcMatch = csp!.match(/script-src[^;]+/); expect(scriptSrcMatch![0]).toContain("https://clerk.pulse.g8n.ai"); // Verify it's in connect-src const connectSrcMatch = csp!.match(/connect-src[^;]+/); expect(connectSrcMatch![0]).toContain("https://clerk.pulse.g8n.ai"); // ... (img-src, frame-src) }); ``` This prevents future CSP refactors from inadvertently removing the production auth domain. <!-- START COPILOT CODING AGENT TIPS --> --- 💬 We'd love your input! Share your thoughts on Copilot coding agent in our [2 minute survey](https://gh.io/copilot-coding-agent-survey).

Format test file with prettier

Add CSP regression assertions for Clerk production proxy domain

Initial plan

Add Clerk production proxy domain to CSP allowlist

Migrate auth to Clerk, add GitHub App integration and legacy user reconciliation

## Summary - **Auth migration**: Replace Supabase Auth with Clerk for authentication, session management, and social logins (GitHub OAuth, passkeys, email+password) - **GitHub App integration**: Full repo connectivity — installation flow, repo linking, feedback-to-issue creation, webhook-driven changelog sync - **Legacy user reconciliation**: Seamless migration path for existing users via email-based profile matching and idempotent backfill - **Security hardening**: 34 Copilot review threads resolved across 7 review rounds — CSP tightening, CSRF state nonces, input validation, fail-closed middleware, server-only guards ## Auth Migration (Supabase Auth → Clerk) - Add `profiles` table (UUID PK + `clerk_id` TEXT) with idempotent backfill from `auth.users` - Migrate all FK constraints from `auth.users` to `profiles` with `IF EXISTS` for idempotency - Legacy profile reconciliation: `requireAuth()` and Clerk webhook match existing users by email, update `clerk_id` in-place to preserve all associated data - Rewrite middleware with `clerkMiddleware()`, route matchers, fail-closed error handling for protected routes, and CSP headers (dev + production Clerk domains) - Replace auth forms with Clerk `<SignIn>` / `<SignUp>` components (catch-all routes) - Clerk webhook endpoint for user sync (`user.created`/`updated`/`deleted`) with legacy reconciliation and null-email safety - Migrate 52+ auth call sites across 10 server action files to `requireAuth()` + service role `db()` - Admin system rewritten: Clerk Backend API for user management/suspend, PostgREST foreign-table joins for scalable plan filtering - Stripe routes updated with dual metadata keys (`pulse_user_id` + `supabase_user_id`) for backward compatibility - `import "server-only"` guards on Supabase service role and GitHub App modules ## GitHub App Integration - `octokit`-based GitHub App client (lazy singleton, base64 private key decoding) - Installation flow with CSRF state nonce (cookie + query param verificatio

Add Clerk production CSP domains, proper cookie deletion, tighten email type to non-null

Unique placeholder emails in backfill, slug validation, .maybeSingle() for legacy lookup

Document why RLS is disabled in migration 015

Legacy profile reconciliation, GitHub callback CSRF, server-side plan joins, E2E env validation

Reconcile legacy profiles by email before creating duplicates in requireAuth

Backfill profiles from auth.users before adding FK constraints in migration 014

Dead auth-route redirect, migration idempotency, free-plan filter perf, server-only guards

Address 9 review comments — security, correctness, and build fixes

Resolve 6 review comments and CI build prerender failure

Sanitize PostgREST special characters in admin user search filter

Migrate auth from Supabase to Clerk, add GitHub App integration

Full-stack SaaS platform with auth, billing, admin, and public API

## Summary Full-stack developer intelligence platform built with Next.js 16 (App Router), Supabase, TypeScript, Tailwind v4, shadcn/ui, and Stripe. ### Core Platform - **Authentication**: Email+password and GitHub OAuth via Supabase Auth with cookie-based sessions - **Multi-tenant Dashboard**: Projects CRUD with RLS-enforced data isolation - **Tier System**: Free / Pro ($100/month) with Stripe checkout, billing portal, and webhook handling ### Modules - **Changelog**: Versioned entries with categories, markdown sync, unseen tracking, RSS feeds, and AI summaries - **Roadmap**: Entries with milestone grouping, status tracking, and authenticated voting - **Feedback**: User submissions with categories, threaded messages, GitHub issue creation, and AI triage - **Notifications**: In-app system with read/unread tracking and email delivery (Pro) - **Announcements**: Scheduled banners with priority ordering, dismiss tracking, and WCAG contrast validation - **Content Generation**: Auto-generated marketing content across 5 template types ### Admin Portal - User management with search, plan filtering, suspension, and impersonation - Project and subscription overview with aggregated statistics - Blog management system with threaded comments and spam detection ### Public Interface - Landing page with hero, features, pricing, and CTA sections - Public project pages for changelog, roadmap, and feedback - Embeddable widget (Shadow DOM) with feedback, notifications, and announcements - REST API with API-key authentication and rate limiting ### Security Hardening - XSS sanitization (DOMPurify), open redirect prevention, UUID validation on all endpoints - CORS headers, field allowlisting, spoofable user ID prevention - Case-insensitive admin email gating, httpOnly impersonation cookies - Stripe error concealment, webhook signature verification, side-effect-free validation ordering - PGRST116-based 404 vs 500 distinction across all Supabase queries ### Infrastructure & Testing -

Use validated env var directly for Stripe price ID, remove redundant helper call

Validate project slug before Stripe customer creation to avoid side effects

Ensure impersonate response has stable type, remove hardcoded test counts from ROADMAP

Case-insensitive admin email check, safe workflow payload quoting, decouple public E2E from auth setup

Warn instead of throw for missing E2E creds locally, fix misleading signIn comment

Add nodejs runtime to Stripe checkout route for SDK compatibility

Fail-fast on missing E2E env vars and assert auth state instead of skipping

Guard pulse-sync workflow to skip unmerged PR close events

Distinguish PGRST116 from DB errors in blog/project GET, deduplicate suspend logic

Return 404 for blog post/comment DELETE on missing rows, add nodejs runtime to webhook

Lazy-load E2E credentials to allow partial test runs, add E2E vars to .env.example

Narrow admin projects query to only fetch columns used in response

Add explicit Node.js runtime to Stripe portal route, add aria-label to projects search

Add 300ms search debounce and AbortController to admin projects page

Preserve actual Stripe status in webhook handler, remove redundant non-null assertions

Hide Stripe SDK error details from webhook response, log unhandled event types

Handle DB errors in deleteProject, surface total_truncated flag in admin users API

Require E2E email env vars instead of falling back to placeholder defaults

Accumulate totalUsers across all pages when API total field is missing

Surface auth admin API failure in stats response, fail fast on missing E2E passwords

Batch user ID enrichment queries to avoid PostgREST URL length limits

Strip ILIKE wildcards from project search, guard null portal URL, fix key generation bias, stable FAQ keys

Potential fix for code scanning alert no. 5: Incomplete string escaping or encoding

Guard null Stripe session URL, escape ILIKE wildcards in project search, abort stale user fetches

Prevent checkout upsert from overwriting existing subscription tier and status

Pre-compute Date boundaries in stats loop, add error handling to bootstrap project lookup

Consistent owner lookup in admin project detail, validate API key scopes, expand README env vars

Trim whitespace in ADMIN_EMAILS parsing to handle spaces after commas

Make impersonation email cookie httpOnly, centralize PRO_PRICE_USD constant

Add aria-label to admin users search input for screen reader accessibility

Extract shared clearImpersonationCookies helper, clarify bootstrap webhook secret naming

Prevent infinite loading on project fetch failure, handle null user email in Stripe checkout

Derive Stripe return URLs from request origin, extract ban duration constant

Add error checking to admin stats count queries

Extract shared billing body parser, add signups_truncated flag to admin stats

Compensate orphaned Stripe customers on upsert failure, use URL composition in checkout and portal routes

Correct README license reference, use left join for blog comments, add portal Stripe guard, fix DELETE test method

Batch N+1 project count queries, cap admin stats pagination, expand checkout and users test coverage

Verify subscription status before activation, hide raw Stripe errors, sanitize blog search, server-side counting

Always update subscription status in webhook, denormalize user_email on subscriptions

Update all documentation and test counts, add admin projectId tests

Narrow Stripe union types, add period field fallback, PGRST116 404 handling, project slug error check

Guard webhook period fields and missing metadata, fix unread count logic, add admin page error handling

Handle listUsers error in stats, consistent PUT error format, honest N+1 comment, env-var test passwords

Skip enrichment queries on empty IDs, NaN-safe blog pagination, Zod PUT validation, portal error handling

NaN-safe pagination in admin routes, Zod validation for announcements POST, update test count

Validate UUIDs in admin PUT/DELETE, return 404 on empty DELETE, harden Stripe and pagination

Eliminate open redirect in Stripe routes, handle query errors in admin routes, harden bootstrap

Handle Supabase query errors in Stripe routes, use PGRST116 error code, expand admin tests

Validate Stripe slug params, guard empty admin updates, fix blog 404s, import ReactNode

Persist Stripe customer ID on creation, handle trialing subscriptions, add banner a11y roles

Rewrite README, update CHANGELOG and ROADMAP, add architecture and API documentation

Allowlist mutable fields in admin PUT handlers, fix WCAG contrast and PostgREST timestamp parsing

Use read_at for notification unread counts, standardize UUID error messages, add rate limiting to feedback GET

Add UUID validation to feedback POST, admin user enrichment error handling, WCAG banner contrast helper

Add UUID validation to changelog and announcements, accurate notification unread counts, a11y for announcement table

Add Stripe webhook and changelog unseen test suites, fix PostgREST in-filter quoting and comment a11y