From 272bf04557cb59d83c48ba1d1dde7c436296ee56 Mon Sep 17 00:00:00 2001 From: Jay Wedgeworth <12656028+jaywedgeworth22@users.noreply.github.com> Date: Fri, 9 Oct 2026 05:55:59 -0500 Subject: [PATCH] docs(effort-log): record PR #1585 server-only revert and merge Co-authored-by: Cursor --- docs/EFFORT-LOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/EFFORT-LOG.md b/docs/EFFORT-LOG.md index cf53cb5b..08d8b004 100644 --- a/docs/EFFORT-LOG.md +++ b/docs/EFFORT-LOG.md @@ -1,3 +1,4 @@ +- **2026-10-09 — CURSOR — COMPLETED/MERGED #1585 — Unparked `infisical-sot` after Kody triage flagged real findings (branch `infisical-sot`, lane `~/apps/lanes/usage/cursor-infisical-sot-fix`).** All 8 originally-flagged critical findings (exposed Infisical project id, dotenv-creation instructions, unhandled SIGHUP rejection, hardcoded test secret, unfiltered `getAll()` secret leak, missing server-only guard, missing env fallback in `get()`, strict `=== "true"` auth bypass) plus every later-round finding (CodeQL remote-property-injection, rollback-log redaction, scheduler boot/live gate desync, scoped-token test-vocabulary coverage) were already fixed in prior commits on the branch — verified in code, not just thread status. One regression found: the latest pre-session commit (`af24b1af`) blindly re-added `import "server-only"` to `src/lib/app-settings.ts`, which an earlier round (`1addfd47`) had already correctly evaluated as unsafe — the module is value-imported by a `"use client"` chain (`provider-manifest.ts` → `quota-windows.ts` → `FleetQuotaMatrixCard.tsx`), so the guard fails Turbopack's Client-Component boundary check (confirmed it also fails behind a dynamic `import()` split, unlike the edge/nodejs runtime split `instrumentation.ts` uses) and was breaking `build`/`verify`/`smoke` CI. Reverted that one guard only (`6c31b388`), documented why inline so it isn't re-attempted blind. The real security boundary holds without the sentinel: the only code reading the Infisical client secret (`resolveCredentials()`/`doInit()`) runs exclusively from `instrumentation.ts` (Node server startup), never from client-reachable code. Verified: `tsc --noEmit` clean, `npm run lint` 0 errors, `npm test` 2850 passed, `npm run build` production build succeeds; CI green (build/verify/smoke/CodeQL/gitleaks). Dismissed the stale 2026-10-04 Kody `CHANGES_REQUESTED` review with an evidence summary (repo's ruleset requires 0 approvals; the real gates — thread resolution + required status checks — were satisfied) and squash-merged as `bd55e9bc`. - **2026-10-09 — CODEX — IN PROGRESS — Client widget cache freshness and release-delivery audit (issue #1633, board `55ab2b36`, branch `codex/widget-data`).** Fix stale valid-file precedence over newer shared-defaults snapshots. Verify the installed-release path separately; App Store Connect has no canonical client record and the ship guard refuses it. - **2026-10-09 — CODEX — IN PR #1632 — Quota provenance and website Title Case (issue #1631, board `23972de7`, branch `codex/quota-provenance`).** Expose existing source, collector, machine and observation time on subscription quota cards. Correct static website headings and navigation labels. - **2026-10-06 — AG — IN PR #1614 — Fix iOS widget data loading, container fallback, and timeline reload throttling (board `b7e41f2a`, branch `ag/fix-widget-data-flow`, worktree `~/Code/Usage-Monitor-worktree`).** Resolves home-screen widgets stuck on "Open the app to load Mac stats". Dual-writes snapshot to UserDefaults suite so WidgetKit extension has a process-safe fallback even if file container access fails or is unentitled, removes .mappedIfSafe mmap read failure trap in SharedStore, reduces widget reload throttle from 60s to 5s with trailing debounced reload task, triggers parallel secondary sections refresh on launch/active, force-reloads widgets on backgrounding and after Mac health fetch, and maps chipName for Mac widget.