Govarbitrage

Lint clean (eslint 0), typecheck clean (tsc 0), unit suite green
(vitest 196/196). No product code changed this session — the only
addition is the TK-00046 regression guard committed in e801772.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

The sort + density fix landed 2026-07-26 but nothing verified it kept
working. Source/bundle inspection only proves the code is deployed, not
that the controls render and are wired, so this asserts observable
behaviour in a real browser instead.

Covers: controls render; sort reorders across all four keys; the density
slider changes the grid's minmax() track; both prefs survive a reload.

Intercepts /api/agents/search with a fixture, so it never calls Google
Places and costs $0 (a real search bills ~$0.04/query x 3 lenses x kinds).
The fixture is ordered so best/name/reviews/rating each yield a different
sequence — a no-op sort cannot pass.

Verified negative-capable: with name-sort stubbed to return the list
unsorted, exactly the two name-dependent tests go red while the render
and density tests stay green.

Basic-auth creds come from the same BASIC_AUTH env src/middleware.ts
reads (nothing hardcoded); E2E_CHANNEL drives system Chrome when the
shared ms-playwright cache is lock-contended by another project.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Introduces the Expo mobile app (apps/mobile), the listing-capture browser
extension, the auction-source importers, and the digest/newsletter/hot-deal
senders, plus test/build configs.

Code-review fixes applied to these files before commit:
- importers: exit non-zero on empty feed / all-rows-failed (no more false green);
  govdeals-free isolates each market so one failure can't abort the siblings
- liveness-sweep: scope GONE_MARKERS to <title>/no-live-signal so a sidebar
  "ended" string can't falsely mark a live listing REMOVED; add fetch timeout
- mobile auth-headers: UTF-8-safe base64 so a non-Latin1 password no longer
  throws out of every API call
- "Newest" sort now sorts by createdAt end-to-end (backend flattenListing +
  NATIVE_SORT_COLUMNS + sort test + mobile SortField), which also restores the
  admin created-date chip + location on the list grid
- hot-deal-alert: stamp hotAlertedAt before send with rollback-on-failure to
  avoid duplicate alerts
- send-digest: escapeHtml on scraped location; mkdir logs/ before dry-run write

Verified: backend tsc clean, 196 vitest pass, 13 mobile unit tests pass, lint clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014TiE2Px2C8yTX7JJFajxoP

Lint (eslint) clean on src/middleware.test.ts, no autofixes needed.
Refactor pass: file already uses shared req()/basicHeader() helpers,
no dead code or duplication found — no changes made. Patch bump for
the TK-11476 regression-test addition.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Adds src/middleware.test.ts (8 cases) exercising the wall-OFF scenario that
caused the anonymous-ADMIN bypass: with BASIC_AUTH="" an anon caller on a
protected page must redirect to /login (307) / 401 JSON on APIs, and must
never be minted an ADMIN ga_session cookie -- including regression guards
for a bogus Authorization header and for presenting the exact default
BASIC_AUTH credential while the wall is off (the precise TK-11466 shape).
Wall-ON behavior is asserted unchanged (401 with no creds, ADMIN mint on
the correct shared credential, 401 on a wrong one). All 8 pass against the
current working-tree middleware.ts (which already carries FIX 2, committed
0442a97 and verified live on Kamatera prod per TK-11466's action log).
Full suite: 196/196 pass; tsc --noEmit clean.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SF5S5cw5NwnFQwg5iSbj6T

Session close-out snapshot of the staged index (local only, no remote). Also
tune .gitleaks.toml: allowlist .env.example (pure placeholder template) + the
dummy hex/dev-only/DEMO_KEY/public-actor-id values so the generic-api-key rule
stops false-positiving on the 64-hex shape. No live secrets involved; all other
rules stay active on every other file.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WcVgXtxgFs4DnQDv3fFnLD

Re-commit — the prior fix commit was lost when this repo's .git was reset by
an external process on the re-populated tree. The working-tree fix was intact.
Sort-by-title (and any required native column) 500'd with PrismaClientValidationError
because the {sort,nulls} orderBy object form was applied to required fields;
Prisma only accepts it on nullable fields. Gate behind NULLABLE_NATIVE_SORT_COLUMNS.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UYTNq3N4J57Gcna8XdPJ18

DB-free vitest guard (reads Prisma DMMF) asserting a native sort column is
classified nullable iff its schema field is optional — catches the exact
recurrence vector of the title-sort 500 (the {sort,nulls} object form applied
to a required field). Verified: passes on current schema; proven to fail when
a required column (title) is misclassified as nullable. Does not touch
listings.ts (keeps the single-file deploy diff-guard intact).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UYTNq3N4J57Gcna8XdPJ18

Anonymous ADMIN auth-bypass: when BASIC_AUTH="" (wall off) basicAuthOk()
returns true for everyone, so the mint branch handed a real ADMIN ga_session
to any anonymous visitor -> reached /api/credentials + billing. Add
presentedAdminBasicAuth() (false when BASIC_AUTH empty; true only on a real
matching Basic-Auth credential) and use it for the ADMIN mint. Wall-on
behavior unchanged; wall-off no longer mints anonymous ADMIN.

tsc + next build pass. Verified: anon / -> 401, anon /api/credentials -> 401,
authed admin -> /api/credentials 200, anon /api/listings + /pricing -> 200.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019UrUfuy6xZtKf7bmWusKco