{"slug":"govarbitrage","total":15,"limit":100,"offset":0,"since":null,"commits":[{"hash":"51d02ee","date":"2026-09-16 15:36:32 -0700","author":"Steve Abrams","subject":"chore: v0.5.3 (session close — TK-00046 /agents sort+density runtime guard)","body":"Lint clean (eslint 0), typecheck clean (tsc 0), unit suite green\n(vitest 196/196). No product code changed this session — the only\naddition is the TK-00046 regression guard committed in e801772.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>"},{"hash":"e801772","date":"2026-09-16 15:34:58 -0700","author":"Steve Abrams","subject":"TK-00046 test: runtime regression guard for /agents sort + density","body":"The sort + density fix landed 2026-07-26 but nothing verified it kept\nworking. Source/bundle inspection only proves the code is deployed, not\nthat the controls render and are wired, so this asserts observable\nbehaviour in a real browser instead.\n\nCovers: controls render; sort reorders across all four keys; the density\nslider changes the grid's minmax() track; both prefs survive a reload.\n\nIntercepts /api/agents/search with a fixture, so it never calls Google\nPlaces and costs $0 (a real search bills ~$0.04/query x 3 lenses x kinds).\nThe fixture is ordered so best/name/reviews/rating each yield a different\nsequence — a no-op sort cannot pass.\n\nVerified negative-capable: with name-sort stubbed to return the list\nunsorted, exactly the two name-dependent tests go red while the render\nand density tests stay green.\n\nBasic-auth creds come from the same BASIC_AUTH env src/middleware.ts\nreads (nothing hardcoded); E2E_CHANNEL drives system Chrome when the\nshared ms-playwright cache is lock-contended by another project.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>"},{"hash":"bfb96b1","date":"2026-09-16 14:39:36 -0700","author":"auto-commit-fleet","subject":"auto-data-snapshot: 2026-09-16T14:34:47 (1 data files) — tsconfig.tsbuildinfo","body":""},{"hash":"9bbed62","date":"2026-09-16 11:26:34 -0700","author":"Steve Abrams","subject":"Add GovArbitrage mobile app, browser extension, and import/digest scripts (with code-review hardening)","body":"Introduces the Expo mobile app (apps/mobile), the listing-capture browser\nextension, the auction-source importers, and the digest/newsletter/hot-deal\nsenders, plus test/build configs.\n\nCode-review fixes applied to these files before commit:\n- importers: exit non-zero on empty feed / all-rows-failed (no more false green);\n  govdeals-free isolates each market so one failure can't abort the siblings\n- liveness-sweep: scope GONE_MARKERS to <title>/no-live-signal so a sidebar\n  \"ended\" string can't falsely mark a live listing REMOVED; add fetch timeout\n- mobile auth-headers: UTF-8-safe base64 so a non-Latin1 password no longer\n  throws out of every API call\n- \"Newest\" sort now sorts by createdAt end-to-end (backend flattenListing +\n  NATIVE_SORT_COLUMNS + sort test + mobile SortField), which also restores the\n  admin created-date chip + location on the list grid\n- hot-deal-alert: stamp hotAlertedAt before send with rollback-on-failure to\n  avoid duplicate alerts\n- send-digest: escapeHtml on scraped location; mkdir logs/ before dry-run write\n\nVerified: backend tsc clean, 196 vitest pass, 13 mobile unit tests pass, lint clean.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_014TiE2Px2C8yTX7JJFajxoP"},{"hash":"8c048d3","date":"2026-09-16 11:16:24 -0700","author":"auto-commit-fleet","subject":"auto-data-snapshot: 2026-09-16T11:14:29 (1 data files) — tsconfig.tsbuildinfo","body":""},{"hash":"c32a7a1","date":"2026-09-13 08:57:43 -0700","author":"Steve Abrams","subject":"chore: v0.5.2 (session close — TK-11476 test coverage)","body":"Lint (eslint) clean on src/middleware.test.ts, no autofixes needed.\nRefactor pass: file already uses shared req()/basicHeader() helpers,\nno dead code or duplication found — no changes made. Patch bump for\nthe TK-11476 regression-test addition.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>"},{"hash":"f407576","date":"2026-09-13 00:24:57 -0700","author":"auto-commit-fleet","subject":"auto-data-snapshot: 2026-09-13T00:21:19 (1 data files) — tsconfig.tsbuildinfo","body":""},{"hash":"037818c","date":"2026-09-12 23:56:17 -0700","author":"Steve Abrams","subject":"TK-11476 test: regression guard for TK-11466 FIX 2 (presentedAdminBasicAuth)","body":"Adds src/middleware.test.ts (8 cases) exercising the wall-OFF scenario that\ncaused the anonymous-ADMIN bypass: with BASIC_AUTH=\"\" an anon caller on a\nprotected page must redirect to /login (307) / 401 JSON on APIs, and must\nnever be minted an ADMIN ga_session cookie -- including regression guards\nfor a bogus Authorization header and for presenting the exact default\nBASIC_AUTH credential while the wall is off (the precise TK-11466 shape).\nWall-ON behavior is asserted unchanged (401 with no creds, ADMIN mint on\nthe correct shared credential, 401 on a wrong one). All 8 pass against the\ncurrent working-tree middleware.ts (which already carries FIX 2, committed\n0442a97 and verified live on Kamatera prod per TK-11466's action log).\nFull suite: 196/196 pass; tsc --noEmit clean.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01SF5S5cw5NwnFQwg5iSbj6T"},{"hash":"91c4705","date":"2026-09-12 13:28:40 -0700","author":"auto-commit-fleet","subject":"auto-data-snapshot: 2026-09-12T13:27:22 (1 data files) — tsconfig.tsbuildinfo","body":""},{"hash":"5c6b0bb","date":"2026-09-12 08:11:53 -0700","author":"Steve Abrams","subject":"Snapshot: commit staged govarbitrage scaffold (Docker, README, apps/mobile Expo app, extension, docs, 5x report)","body":"Session close-out snapshot of the staged index (local only, no remote). Also\ntune .gitleaks.toml: allowlist .env.example (pure placeholder template) + the\ndummy hex/dev-only/DEMO_KEY/public-actor-id values so the generic-api-key rule\nstops false-positiving on the 64-hex shape. No live secrets involved; all other\nrules stay active on every other file.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01WcVgXtxgFs4DnQDv3fFnLD"},{"hash":"c62e153","date":"2026-09-12 07:24:46 -0700","author":"Steve Abrams","subject":"TK-11464 fix (re-commit): gate orderBy nulls-ordering to nullable sort columns only","body":"Re-commit — the prior fix commit was lost when this repo's .git was reset by\nan external process on the re-populated tree. The working-tree fix was intact.\nSort-by-title (and any required native column) 500'd with PrismaClientValidationError\nbecause the {sort,nulls} orderBy object form was applied to required fields;\nPrisma only accepts it on nullable fields. Gate behind NULLABLE_NATIVE_SORT_COLUMNS.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01UYTNq3N4J57Gcna8XdPJ18"},{"hash":"6531e6f","date":"2026-09-12 07:23:45 -0700","author":"Steve Abrams","subject":"TK-11464 test: regression guard for sort orderBy nullability classification","body":"DB-free vitest guard (reads Prisma DMMF) asserting a native sort column is\nclassified nullable iff its schema field is optional — catches the exact\nrecurrence vector of the title-sort 500 (the {sort,nulls} object form applied\nto a required field). Verified: passes on current schema; proven to fail when\na required column (title) is misclassified as nullable. Does not touch\nlistings.ts (keeps the single-file deploy diff-guard intact).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01UYTNq3N4J57Gcna8XdPJ18"},{"hash":"0442a97","date":"2026-09-11 20:09:19 +0000","author":"Steve Abrams","subject":"TK-11466 FIX 2: decouple ADMIN mint from wall-disabled state (presentedAdminBasicAuth)","body":"Anonymous ADMIN auth-bypass: when BASIC_AUTH=\"\" (wall off) basicAuthOk()\nreturns true for everyone, so the mint branch handed a real ADMIN ga_session\nto any anonymous visitor -> reached /api/credentials + billing. Add\npresentedAdminBasicAuth() (false when BASIC_AUTH empty; true only on a real\nmatching Basic-Auth credential) and use it for the ADMIN mint. Wall-on\nbehavior unchanged; wall-off no longer mints anonymous ADMIN.\n\ntsc + next build pass. Verified: anon / -> 401, anon /api/credentials -> 401,\nauthed admin -> /api/credentials 200, anon /api/listings + /pricing -> 200.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_019UrUfuy6xZtKf7bmWusKco"},{"hash":"e3141d0","date":"2026-09-11 15:36:10 +0000","author":"Steve Abrams","subject":"Deploy approved TK-11249 pricing copy; local source e69a5ea","body":""},{"hash":"d81ee96","date":"2026-09-11 15:31:42 +0000","author":"Steve Abrams","subject":"Snapshot live source before approved TK-11249 pricing release","body":""}]}