Go Straightforward Web Application Development.

GitHub Activity

1. ryota-murakami pushed to laststance/gitbox · February 11, 2026 17:33

   2 commits to main

   • 6b5e11e

     refactor: extract useOptimisticCardAction hook (#81)

   • 7b81a7b

     fix: add useOptimisticCardAction to BoardPageClient test mock

   • 1 more commit »
2. ryota-murakami deleted branch refs/heads/fix/github-token-cookie-83 in laststance/gitbox · February 11, 2026 18:06

   laststance/gitbox

   Updated Feb 11

3. ryota-murakami merged laststance/gitbox#98 · February 11, 2026 10:06

   fix: align GitHub token cookie lifetime with token TTL (#83) #98

   Summary

   • Changed cookie maxAge from 7 days to 8 hours to match GitHub fine-grained token default TTL
   • Added 401 response interceptor to axios-github.ts

   +23 -1

   6 comments
4. ryota-murakami closed an issue in laststance/gitbox · February 11, 2026 10:06

   GitHub token cookie lifetime mismatch with actual token expiry #83

   ## Summary The GitHub provider token cookie has \`maxAge: 7 days\` (\`src/app/auth/callback/route.ts:67\`), but GitHub OAuth tokens may expire soon…

   1 comment
5. ryota-murakami pushed to laststance/gitbox · February 11, 2026 18:06

   2 commits to main

   • f80657c

     fix: align GitHub token cookie lifetime with token TTL and clear on 401

   • ce03f9f

     Merge branch 'main' into fix/github-token-cookie-83

   • 1 more commit »
6. ryota-murakami deleted branch refs/heads/fix/upsert-projectinfo-67 in laststance/gitbox · February 11, 2026 16:39

   laststance/gitbox

   Updated Feb 11

7. ryota-murakami pushed to laststance/gitbox · February 11, 2026 17:48

   2 commits to fix/github-token-cookie-83

   • 496d151

     fix: add MSW handler for GET /orgs/:org/repos (#71)

   • d8928ca

     fix: remove redundant updated_at and unsafe .passthrough() (#85)

   • 20 more commits »
8. ryota-murakami pushed to laststance/gitbox · February 11, 2026 16:20

   2 commits to main

   • c291b20

     perf: memoize cards-per-column filtering in KanbanBoard (#75)

   • 358021b

     Merge pull request #97 from laststance/perf/memoize-cards-column-75

9. ryota-murakami deleted branch refs/heads/fix/backend-cleanup-85 in laststance/gitbox · February 11, 2026 17:39

   laststance/gitbox

   Updated Feb 11

10. ryota-murakami merged laststance/gitbox#93 · February 11, 2026 09:39

    fix: remove redundant updated_at and unsafe .passthrough() #93

    Summary

    • Remove 7 redundant manual updated_at assignments from board.ts (3) and shared-project-info.ts (4) — the DB update_updated_at_column() trig…

    +17 -26

    7 comments
11. ryota-murakami closed an issue in laststance/gitbox · February 11, 2026 09:39

    Minor backend cleanup: remove redundant updated_at, fix boardSettingsSchema passthrough #85

    ## Summary Minor backend improvements: ### 1. Redundant manual updated_at Some actions manually set \`updated_at: new Date().toISOString()\` but th…
12. ryota-murakami pushed to laststance/gitbox · February 11, 2026 17:39

    2 commits to main

    • d8928ca

      fix: remove redundant updated_at and unsafe .passthrough() (#85)

    • 396dbca

      fix: update board validation tests for .passthrough() removal

    • 2 more commits »
13. ryota-murakami deleted branch refs/heads/refactor/optimistic-card-action-81 in laststance/gitbox · February 11, 2026 17:33

    laststance/gitbox

    Updated Feb 11

14. ryota-murakami closed an issue in laststance/gitbox · February 11, 2026 09:33

    Extract useOptimisticCardAction hook for BoardPageClient #81

    ## Summary \`BoardPageClient.tsx\` has two handlers (\`handleMoveToMaintenance\` and \`handleRemoveFromBoard\`) that follow an identical pattern: 1…
15. ryota-murakami merged laststance/gitbox#95 · February 11, 2026 09:33

    refactor: extract useOptimisticCardAction hook #95

    Summary

    • Extract shared optimistic remove + revert pattern into useOptimisticCardAction hook
    • Replaces ~60 lines of duplicated logic in handleMoveTo…

    +126 -88

    6 comments
16. ryota-murakami pushed to laststance/gitbox · February 11, 2026 16:48

    2 commits to fix/backend-cleanup-85

    • 496d151

      fix: add MSW handler for GET /orgs/:org/repos (#71)

    • 0d12b4a

      fix: drop stale create_default_board trigger (#82)

    • 13 more commits »
17. ryota-murakami pushed to laststance/gitbox · February 11, 2026 16:19

    2 commits to main

    • 0d12b4a

      fix: drop stale create_default_board trigger (#82)

    • dc7a95e

      Merge pull request #94 from laststance/fix/remove-stale-trigger-82

18. ryota-murakami deleted branch refs/heads/fix/msw-org-repos-71 in laststance/gitbox · February 11, 2026 16:47

    laststance/gitbox

    Updated Feb 11

19. ryota-murakami merged laststance/gitbox#92 · February 11, 2026 08:47

    fix: add MSW handler for GET /orgs/:org/repos #92

    Summary

    • Add missing MSW handler for GET /orgs/:org/repos GitHub API endpoint
    • Add 2 mock organization repos (laststance/create-react-app-vite, last…

    +68 -0

    5 comments
20. ryota-murakami pushed to laststance/gitbox · February 11, 2026 16:47

    2 commits to main

    • 496d151

      fix: add MSW handler for GET /orgs/:org/repos (#71)

    • c08f94f

      Merge pull request #92 from laststance/fix/msw-org-repos-71

21. ryota-murakami closed an issue in laststance/gitbox · February 11, 2026 08:47

    Add missing MSW handler for GET /orgs/:org/repos #71

    ## Summary The `GET /orgs/:org/repos` endpoint is called in `src/lib/actions/github.ts` (line 264/285) but has **no MSW handler** in `mocks/handler…
22. ryota-murakami pushed to laststance/gitbox · February 11, 2026 16:39

    2 commits to main

    • 6104be0

      fix: use Supabase .upsert() for projectinfo operations (#67)

    • 97d3844

      Merge pull request #96 from laststance/fix/upsert-projectinfo-67

23. ryota-murakami deleted branch refs/heads/feat/loading-error-boundaries-73 in laststance/gitbox · February 11, 2026 16:43

    laststance/gitbox

    Updated Feb 11

24. ryota-murakami merged laststance/gitbox#101 · February 11, 2026 08:43

    feat: add loading.tsx and error.tsx boundaries for all routes (#73) #101

    Summary

    • Added loading.tsx skeletons for boards, maintenance, settings, account routes
    • Added error.tsx boundaries for boards, maintenance, settings, …

    +486 -0

    5 comments
25. ryota-murakami closed an issue in laststance/gitbox · February 11, 2026 08:43

    Add Suspense boundaries, loading.tsx files, and ErrorBoundary components #73

    ## Summary The codebase has **zero** \`\` components and **zero** component-level \`\` wrappers. Only \`src/app/board/[id]/loading.tsx\` exists for…
26. ryota-murakami pushed to laststance/gitbox · February 11, 2026 16:43

    2 commits to main

    • d9f8251

      feat: add loading.tsx and error.tsx boundaries for all route segments

    • f0bd447

      Merge pull request #101 from laststance/feat/loading-error-boundaries-73

27. ryota-murakami closed an issue in laststance/gitbox · February 11, 2026 08:39

    Use Supabase .upsert() for projectinfo operations #67

    ## Summary ProjectInfo operations use a select-then-insert/update pattern (2 round-trips) instead of Supabase's native `.upsert()` (1 round-trip). …
28. ryota-murakami merged laststance/gitbox#96 · February 11, 2026 08:39

    fix: use Supabase .upsert() for projectinfo operations #96

    Summary

    • Replace select-then-insert/update anti-pattern in upsertProjectInfoCore with a single .upsert() call
    • Reduces two DB round-trips to one, si…

    +27 -48

    7 comments
29. ryota-murakami deleted branch refs/heads/refactor/error-handling-68 in laststance/gitbox · February 11, 2026 16:33

    laststance/gitbox

    Updated Feb 11

30. ryota-murakami pushed to laststance/gitbox · February 11, 2026 16:33

    2 commits to main

    • 17b349a

      refactor: standardize Server Action error handling with ActionResult<T>

    • 367bce7

      Merge pull request #100 from laststance/refactor/error-handling-68

31. ryota-murakami closed an issue in laststance/gitbox · February 11, 2026 08:33

    Standardize Server Action error handling pattern #68

    ## Summary Server Actions use two inconsistent error patterns, forcing callers to handle both `try/catch` and result checking. ## Pattern A: Throw-…
32. ryota-murakami merged laststance/gitbox#100 · February 11, 2026 08:33

    refactor: standardize Server Action error handling with ActionResult<T> (#68) #100

    Summary

    • Created ActionResult<T> discriminated union type in src/lib/actions/types.ts for type-safe error handling
    • Added withAuthResult<T>() helper…

    +180 -101

    5 comments
33. ryota-murakami merged laststance/gitbox#99 · February 11, 2026 08:33

    fix: add CSP + Permissions-Policy security headers (#59) #99

    Summary

    • Added Content-Security-Policy-Report-Only header with restrictive directives for scripts, styles, images, connections, fonts, frames, and …

    +22 -4

    5 comments
34. ryota-murakami pushed to laststance/gitbox · February 11, 2026 16:33

    2 commits to main

    • 3c0ad80

      fix: add Content-Security-Policy and Permissions-Policy headers

    • 08ffde2

      Merge pull request #99 from laststance/fix/csp-headers-59

35. ryota-murakami deleted branch refs/heads/fix/csp-headers-59 in laststance/gitbox · February 11, 2026 16:33

    laststance/gitbox

    Updated Feb 11

36. ryota-murakami closed an issue in laststance/gitbox · February 11, 2026 08:33

    Add Content-Security-Policy and Permissions-Policy headers #59

    ## Summary `next.config.ts` is missing `Content-Security-Policy` (CSP) and `Permissions-Policy` headers. CSP is the most important browser security…
37. ryota-murakami created a branch in laststance/gitbox · February 11, 2026 15:15

    

    refs/heads/fix/msw-org-repos-71 in laststance/gitbox

    Updated Feb 11

38. ryota-murakami deleted branch refs/heads/perf/memoize-cards-column-75 in laststance/gitbox · February 11, 2026 16:20

    laststance/gitbox

    Updated Feb 11

39. ryota-murakami closed an issue in laststance/gitbox · February 11, 2026 08:20

    KanbanBoard performance: memoize cards-per-column filtering #75

    ## Summary \`KanbanBoard.tsx\` passes \`cards.filter((c) =&gt; c.statusId === status.id)\` to each \`SortableColumn\`, creating new array references o…
40. ryota-murakami merged laststance/gitbox#97 · February 11, 2026 08:20

    perf: memoize cards-per-column filtering in KanbanBoard #97

    Summary

    • Add cardsByStatus useMemo to group cards once per render cycle
    • Replace 3 inline .filter() calls with O(1) lookups from the memoized map
    • Us…

    +15 -3

    5 comments
41. ryota-murakami merged laststance/gitbox#94 · February 11, 2026 08:19

    fix: drop stale create_default_board trigger #94

    Summary

    • Drop the on_user_created trigger on auth.users and its create_default_board() function
    • The trigger created bare boards without status list…

    +24 -0

    5 comments
42. ryota-murakami deleted branch refs/heads/fix/remove-stale-trigger-82 in laststance/gitbox · February 11, 2026 16:19

    laststance/gitbox

    Updated Feb 11

43. ryota-murakami closed an issue in laststance/gitbox · February 11, 2026 08:19

    Verify/remove stale create_default_board trigger #82

    ## Summary The \`create_default_board\` trigger (from \`20251115_initial_schema.sql:343-354\`) fires on \`auth.users\` INSERT and creates a board n…

    1 comment
44. ryota-murakami pushed to laststance/gitbox · February 11, 2026 16:19

    1 commit to refactor/optimistic-card-action-81

    • 7b81a7b

      fix: add useOptimisticCardAction to BoardPageClient test mock

45. ryota-murakami pushed to laststance/gitbox · February 11, 2026 16:17

    1 commit to fix/backend-cleanup-85

    • 396dbca

      fix: update board validation tests for .passthrough() removal

46. ryota-murakami created a branch in laststance/gitbox · February 11, 2026 15:30

    

    refs/heads/fix/remove-stale-trigger-82 in laststance/gitbox

    Updated Feb 11

47. ryota-murakami opened an issue in laststance/gitbox · February 11, 2026 07:57

    Migrate remaining Server Actions to ActionResult<T> pattern #102

    ## Summary PR #100 introduced `ActionResult` discriminated union type and converted `github.ts` and `user-presets.ts`. The remaining Server Action …
48. ryota-murakami opened laststance/gitbox#101 · February 11, 2026 07:56

    feat: add loading.tsx and error.tsx boundaries for all routes (#73) #101

    Summary

    • Added loading.tsx skeletons for boards, maintenance, settings, account routes
    • Added error.tsx boundaries for boards, maintenance, settings, …

    +486 -0

    5 comments
49. ryota-murakami created a branch in laststance/gitbox · February 11, 2026 15:56

    

    refs/heads/feat/loading-error-boundaries-73 in laststance/gitbox

    Updated Feb 11

50. ryota-murakami created a branch in laststance/gitbox · February 11, 2026 15:38

    

    refs/heads/fix/upsert-projectinfo-67 in laststance/gitbox

    Updated Feb 11

51. ryota-murakami opened laststance/gitbox#100 · February 11, 2026 07:53

    refactor: standardize Server Action error handling with ActionResult<T> (#68) #100

    Summary

    • Created ActionResult<T> discriminated union type in src/lib/actions/types.ts for type-safe error handling
    • Added withAuthResult<T>() helper…

    +180 -101

    5 comments
52. ryota-murakami created a branch in laststance/gitbox · February 11, 2026 15:52

    

    refs/heads/refactor/error-handling-68 in laststance/gitbox

    Updated Feb 11

53. ryota-murakami opened laststance/gitbox#99 · February 11, 2026 07:45

    fix: add CSP + Permissions-Policy security headers (#59) #99

    Summary

    • Added Content-Security-Policy-Report-Only header with restrictive directives for scripts, styles, images, connections, fonts, frames, and …

    +22 -4

    5 comments
54. ryota-murakami created a branch in laststance/gitbox · February 11, 2026 15:45

    

    refs/heads/fix/csp-headers-59 in laststance/gitbox

    Updated Feb 11

55. ryota-murakami opened laststance/gitbox#98 · February 11, 2026 07:43

    fix: align GitHub token cookie lifetime with token TTL (#83) #98

    Summary

    • Changed cookie maxAge from 7 days to 8 hours to match GitHub fine-grained token default TTL
    • Added 401 response interceptor to axios-github.ts

    +23 -1

    6 comments
56. ryota-murakami created a branch in laststance/gitbox · February 11, 2026 15:43

    

    refs/heads/fix/github-token-cookie-83 in laststance/gitbox

    Updated Feb 11

57. ryota-murakami opened laststance/gitbox#97 · February 11, 2026 07:40

    perf: memoize cards-per-column filtering in KanbanBoard #97

    Summary

    • Add cardsByStatus useMemo to group cards once per render cycle
    • Replace 3 inline .filter() calls with O(1) lookups from the memoized map
    • Us…

    +15 -3

    5 comments
58. ryota-murakami created a branch in laststance/gitbox · February 11, 2026 15:39

    

    refs/heads/perf/memoize-cards-column-75 in laststance/gitbox

    Updated Feb 11

59. ryota-murakami opened laststance/gitbox#96 · February 11, 2026 07:38

    fix: use Supabase .upsert() for projectinfo operations #96

    Summary

    • Replace select-then-insert/update anti-pattern in upsertProjectInfoCore with a single .upsert() call
    • Reduces two DB round-trips to one, si…

    +27 -48

    7 comments
60. ryota-murakami created a branch in laststance/gitbox · February 11, 2026 15:29

    

    refs/heads/fix/backend-cleanup-85 in laststance/gitbox

    Updated Feb 11

61. ryota-murakami opened laststance/gitbox#95 · February 11, 2026 07:35

    refactor: extract useOptimisticCardAction hook #95

    Summary

    • Extract shared optimistic remove + revert pattern into useOptimisticCardAction hook
    • Replaces ~60 lines of duplicated logic in handleMoveTo…

    +126 -88

    6 comments
62. ryota-murakami created a branch in laststance/gitbox · February 11, 2026 15:35

    

    refs/heads/refactor/optimistic-card-action-81 in laststance/gitbox

    Updated Feb 11

63. ryota-murakami deleted branch refs/heads/feat/skill-agent-management in laststance/skills-desktop · February 11, 2026 14:45

    laststance/skills-desktop

    Updated Feb 11

64. ryota-murakami opened laststance/gitbox#94 · February 11, 2026 07:30

    fix: drop stale create_default_board trigger #94

    Summary

    • Drop the on_user_created trigger on auth.users and its create_default_board() function
    • The trigger created bare boards without status list…

    +24 -0

    5 comments
65. ryota-murakami opened laststance/gitbox#93 · February 11, 2026 07:29

    fix: remove redundant updated_at and unsafe .passthrough() #93

    Summary

    • Remove 7 redundant manual updated_at assignments from board.ts (3) and shared-project-info.ts (4) — the DB update_updated_at_column() trig…

    +17 -26

    7 comments
66. ryota-murakami created a branch in laststance/skills-desktop · February 11, 2026 14:39

    

    refs/heads/feat/skill-agent-management in laststance/skills-desktop

    Updated Feb 11

67. ryota-murakami opened laststance/gitbox#92 · February 11, 2026 07:16

    fix: add MSW handler for GET /orgs/:org/repos #92

    Summary

    • Add missing MSW handler for GET /orgs/:org/repos GitHub API endpoint
    • Add 2 mock organization repos (laststance/create-react-app-vite, last…

    +68 -0

    5 comments
68. ryota-murakami released v0.3.0 of laststance/skills-desktop · February 11, 2026 07:07

    

    laststance / /laststance/skills-desktop

    v0.3.0

    What's New

    Skill & Agent Management Features

    • Agent context menu: Right-click any agent → "Remove all symlinks" to bulk-remove linked skills
    • Filter reset: Click ~/.agents/skills path to clear searc…

    Read more
69. ryota-murakami pushed to laststance/gitbox · February 11, 2026 14:50

    2 commits to main

    • e2bff50

      fix: extract withAuth() guard and standardize auth checks in Server A…

    • 1e3c738

      Merge branch 'main' into fix/withauth-guard-standardize-63

    • 1 more commit »
70. ryota-murakami deleted branch refs/heads/fix/withauth-guard-standardize-63 in laststance/gitbox · February 11, 2026 14:50

    laststance/gitbox

    Updated Feb 11

71. ryota-murakami closed an issue in laststance/gitbox · February 11, 2026 06:50

    Extract withAuth() guard and standardize auth checks in Server Actions #63

    ## Summary Every Server Action repeats the same 4-line auth boilerplate ~20 times. Additionally, some mutating actions rely solely on RLS without e…
72. ryota-murakami merged laststance/gitbox#89 · February 11, 2026 06:50

    fix: extract withAuth() guard and standardize auth checks in Server Actions #89

    Summary

    Closes #63

    • Created reusable withAuth() higher-order function in src/lib/actions/auth-guard.ts that wraps Server Actions with Supabase auth…

    +191 -125

    8 comments
73. ryota-murakami pushed to laststance/skills-desktop · February 11, 2026 14:45

    2 commits to main

    • aef90e7

      feat: add skill/agent management features (delete, add symlink, sync)

    • 7098636

      Merge pull request #3 from laststance/feat/skill-agent-management

74. ryota-murakami merged laststance/skills-desktop#3 · February 11, 2026 06:45

    feat: add skill/agent management features #3

    Summary

    • Agent context menu delete: Right-click agent in sidebar → "Remove all symlinks" → confirmation dialog → removes all symlinked skills from …

    +1,432 -48

    2 comments
75. ryota-murakami opened laststance/skills-desktop#3 · February 11, 2026 06:41

    feat: add skill/agent management features #3

    Summary

    • Agent context menu delete: Right-click agent in sidebar → "Remove all symlinks" → confirmation dialog → removes all symlinked skills from …

    +1,432 -48

    2 comments
76. ryota-murakami pushed to laststance/gitbox · February 11, 2026 14:37

    2 commits to fix/withauth-guard-standardize-63

    • 7a2832e

      fix: prevent open redirect in OAuth callback (#58)

    • eca5c9b

      fix: add production build assertion against test env vars (#60)

    • 13 more commits »
77. ryota-murakami deleted branch refs/heads/fix/transaction-rpc-functions-61 in laststance/gitbox · February 11, 2026 14:14

    laststance/gitbox

    Updated Feb 11

78. ryota-murakami merged laststance/gitbox#90 · February 11, 2026 06:14

    fix: wrap multi-step DB operations in PostgreSQL transactions #90

    Summary

    Closes #61

    • Add 5 PostgreSQL RPC functions for atomic multi-step operations (migration file)
    • Replace fragile manual rollback in moveToMaint…

    +308 -186

    16 comments
79. ryota-murakami pushed to laststance/gitbox · February 11, 2026 14:14

    2 commits to main

    • a8ec17f

      fix: wrap multi-step DB operations in PostgreSQL transactions (#61)

    • f0abe66

      fix: resolve CodeRabbit review findings

    • 3 more commits »
80. ryota-murakami closed an issue in laststance/gitbox · February 11, 2026 06:14

    Wrap multi-step DB operations in database transactions #61

    ## Summary `moveToMaintenance`, `restoreToBoard`, and batch position update operations perform 3-4 sequential DB operations without database transa…
81. ryota-murakami pushed to laststance/gitbox · February 11, 2026 14:01

    1 commit to fix/transaction-rpc-functions-61

    • c681f5f

      fix: harden RPC functions per CodeRabbit review

82. ryota-murakami pushed to laststance/gitbox · February 11, 2026 13:54

    1 commit to fix/transaction-rpc-functions-61

    • 9302622

      fix: use 14-digit timestamp for migration filename

83. ryota-murakami pushed to laststance/gitbox · February 11, 2026 13:47

    1 commit to fix/transaction-rpc-functions-61

    • f0abe66

      fix: resolve CodeRabbit review findings

84. ryota-murakami pushed to laststance/skills-desktop · February 11, 2026 13:45

    2 commits to main

    • 3953c59

      fix(skills): include local skills for all matching agents

    • dfdf364

      test(skills): add regression for duplicate local skill names

    • 1 more commit »
85. ryota-murakami deleted branch refs/heads/refactor/unify-project-info-62 in laststance/gitbox · February 11, 2026 13:37

    laststance/gitbox

    Updated Feb 11

86. ryota-murakami closed an issue in laststance/gitbox · February 11, 2026 05:37

    Unify project-info.ts and maintenance-project-info.ts (~400 lines duplication) #62

    ## Summary `maintenance-project-info.ts` (467 lines) is ~85% duplicated from `project-info.ts` (562 lines). The only substantive difference is the …
87. ryota-murakami merged laststance/gitbox#91 · February 11, 2026 05:37

    refactor: unify project-info and maintenance-project-info #91

    Summary

    • Extract shared logic from project-info.ts and maintenance-project-info.ts into shared-project-info.ts, parameterized by FkConfig (repo_car…

    +684 -864

    8 comments
88. ryota-murakami pushed to laststance/gitbox · February 11, 2026 13:37

    2 commits to main

    • 1145c01

      refactor: unify project-info and maintenance-project-info (#62)

    • aa94177

      fix: create fresh empty comment objects per missing entity ID

    • 1 more commit »
89. ryota-murakami pushed to laststance/gitbox · February 11, 2026 13:11

    1 commit to refactor/unify-project-info-62

    • aa94177

      fix: create fresh empty comment objects per missing entity ID

90. ryota-murakami deleted branch refs/heads/fix/oauth-open-redirect-58 in laststance/gitbox · February 11, 2026 13:00

    laststance/gitbox

    Updated Feb 11

91. ryota-murakami pushed to laststance/gitbox · February 11, 2026 13:00

    2 commits to main

    • 7a2832e

      fix: prevent open redirect in OAuth callback (#58)

    • a1b69ec

      fix: block backslash variants in open redirect validation

    • 1 more commit »
92. ryota-murakami closed an issue in laststance/gitbox · February 11, 2026 05:00

    Fix open redirect vulnerability in OAuth callback #58

    ## Summary The `next` query parameter in the OAuth callback URL is used directly in `NextResponse.redirect()` without validation. An attacker can c…
93. ryota-murakami merged laststance/gitbox#87 · February 11, 2026 05:00

    fix: prevent open redirect in OAuth callback #87

    Summary

    Fixes #58 — Validates the next query parameter in the OAuth callback to prevent open redirect attacks.

    Changes

    File: src/app/auth/callback/…

    +9 -1

    8 comments
94. ryota-murakami pushed to laststance/gitbox · February 11, 2026 12:46

    1 commit to fix/oauth-open-redirect-58

    • a1b69ec

      fix: block backslash variants in open redirect validation

95. ryota-murakami deleted branch refs/heads/fix/prod-test-env-assertion-60 in laststance/gitbox · February 11, 2026 12:38

    laststance/gitbox

    Updated Feb 11

96. ryota-murakami pushed to laststance/gitbox · February 11, 2026 12:38

    2 commits to main

    • eca5c9b

      fix: add production build assertion against test env vars (#60)

    • e11729f

      fix: scope build assertion to Vercel deployments only

    • 1 more commit »
97. ryota-murakami merged laststance/gitbox#88 · February 11, 2026 04:38

    fix: add production build assertion against test env vars #88

    Summary

    Fixes #60 — Adds build-time assertions that prevent test-mode environment variables from reaching production.

    Changes

    File: next.config.ts

    A…

    +15 -0

    6 comments
98. ryota-murakami closed an issue in laststance/gitbox · February 11, 2026 04:38

    Add production build assertion against test environment variables #60

    ## Summary If `APP_ENV=test` or `NEXT_PUBLIC_ENABLE_MSW_MOCK=true` accidentally reach production, **all authentication is completely bypassed**. Th…
99. ryota-murakami pushed to laststance/gitbox · February 11, 2026 12:23

    1 commit to fix/prod-test-env-assertion-60

    • e11729f

      fix: scope build assertion to Vercel deployments only

100. ryota-murakami opened laststance/gitbox#91 · February 11, 2026 03:27

     refactor: unify project-info and maintenance-project-info #91

     Summary

     • Extract shared logic from project-info.ts and maintenance-project-info.ts into shared-project-info.ts, parameterized by FkConfig (repo_car…

     +684 -864

     8 comments
101. ryota-murakami created a branch in laststance/gitbox · February 11, 2026 11:27

     

     refs/heads/refactor/unify-project-info-62 in laststance/gitbox

     Updated Feb 11

102. ryota-murakami opened laststance/gitbox#90 · February 11, 2026 03:08

     fix: wrap multi-step DB operations in PostgreSQL transactions #90

     Summary

     Closes #61

     • Add 5 PostgreSQL RPC functions for atomic multi-step operations (migration file)
     • Replace fragile manual rollback in moveToMaint…

     +308 -186

     16 comments
103. ryota-murakami created a branch in laststance/gitbox · February 11, 2026 11:08

     

     refs/heads/fix/transaction-rpc-functions-61 in laststance/gitbox

     Updated Feb 11

104. ryota-murakami opened laststance/gitbox#89 · February 11, 2026 02:34

     fix: extract withAuth() guard and standardize auth checks in Server Actions #89

     Summary

     Closes #63

     • Created reusable withAuth() higher-order function in src/lib/actions/auth-guard.ts that wraps Server Actions with Supabase auth…

     +191 -125

     8 comments
105. ryota-murakami created a branch in laststance/gitbox · February 11, 2026 10:34

     

     refs/heads/fix/withauth-guard-standardize-63 in laststance/gitbox

     Updated Feb 11

106. ryota-murakami opened laststance/gitbox#88 · February 11, 2026 02:24

     fix: add production build assertion against test env vars #88

     Summary

     Fixes #60 — Adds build-time assertions that prevent test-mode environment variables from reaching production.

     Changes

     File: next.config.ts

     A…

     +15 -0

     6 comments
107. ryota-murakami created a branch in laststance/gitbox · February 11, 2026 10:24

     

     refs/heads/fix/prod-test-env-assertion-60 in laststance/gitbox

     Updated Feb 11

108. ryota-murakami opened laststance/gitbox#87 · February 11, 2026 02:18

     fix: prevent open redirect in OAuth callback #87

     Summary

     Fixes #58 — Validates the next query parameter in the OAuth callback to prevent open redirect attacks.

     Changes

     File: src/app/auth/callback/…

     +9 -1

     8 comments
109. ryota-murakami created a branch in laststance/gitbox · February 11, 2026 10:18

     

     refs/heads/fix/oauth-open-redirect-58 in laststance/gitbox

     Updated Feb 11

110. ryota-murakami opened an issue in laststance/gitbox · February 11, 2026 02:10

     Add E2E test for CommandPalette and unit tests for missing dialog components #86

     ## Summary Several components have Storybook coverage but lack behavioral tests: ### Missing E2E Tests - **CommandPalette** (Ctrl+K) — Storybook st…
111. ryota-murakami opened an issue in laststance/gitbox · February 11, 2026 02:09

     Minor backend cleanup: remove redundant updated_at, fix boardSettingsSchema passthrough #85

     ## Summary Minor backend improvements: ### 1. Redundant manual updated_at Some actions manually set \`updated_at: new Date().toISOString()\` but th…
112. ryota-murakami opened an issue in laststance/gitbox · February 11, 2026 02:09

     Reduce E2E networkidle dependency and global timeout #84

     ## Summary Two related E2E reliability improvements: ### 1. networkidle waits (187 occurrences) \`waitForLoadState('networkidle')\` waits 500ms of …
113. ryota-murakami opened an issue in laststance/gitbox · February 11, 2026 02:09

     GitHub token cookie lifetime mismatch with actual token expiry #83

     ## Summary The GitHub provider token cookie has \`maxAge: 7 days\` (\`src/app/auth/callback/route.ts:67\`), but GitHub OAuth tokens may expire soon…

     1 comment
114. ryota-murakami opened an issue in laststance/gitbox · February 11, 2026 02:09

     Verify/remove stale create_default_board trigger #82

     ## Summary The \`create_default_board\` trigger (from \`20251115_initial_schema.sql:343-354\`) fires on \`auth.users\` INSERT and creates a board n…

     1 comment
115. ryota-murakami opened an issue in laststance/gitbox · February 11, 2026 02:09

     Extract useOptimisticCardAction hook for BoardPageClient #81

     ## Summary \`BoardPageClient.tsx\` has two handlers (\`handleMoveToMaintenance\` and \`handleRemoveFromBoard\`) that follow an identical pattern: 1…