fix: resolve merge conflicts and apply security/robustness improvements

[Copilot]

Resolves unresolved Git merge conflict markers in prompt-draft.ts and applies security/robustness improvements across the configuration layer.

Changes

Critical

• prompt-draft.ts: Removed merge conflict markers blocking execution; clarified expiry check comment

Security & Robustness

• check-redis.ts:
  • Added type guard for Redis response validation
  • Handle escaped quotes in env var parsing ("value with \"quotes\"")
  • Use URL constructor for safer URL normalization
  • Fail fast in non-dev environments when Redis unavailable

Configuration

• vite.config.ts:
  • Add radix to parseInt() (prevents octal interpretation)
  • Make host configurable via HOST env var
  • Explicit VERCEL check (=== '1' || === 'true' vs truthy)

Formatting

• auth-client.tsx: Remove extraneous whitespace

Example

// Before: Type assertion without validation
const payload = (await response.json()) as Array<{ result?: string }>;

// After: Runtime validation with type guard
const rawPayload = await response.json();
if (!isRedisPingResponse(rawPayload)) {
  throw new Error("Unexpected Redis response format");
}
const payload = rawPayload;

Original prompt

Please apply the following diffs and create a pull request.
Once the PR is ready, give it a title based on the messages of the fixes being applied.

[{"message":"[nitpick] There's an empty line with whitespace on line 2. This should be removed for consistency.","fixFiles":[{"filePath":"apps/web/src/lib/auth-client.tsx","diff":"diff --git a/apps/web/src/lib/auth-client.tsx b/apps/web/src/lib/auth-client.tsx\n--- a/apps/web/src/lib/auth-client.tsx\n+++ b/apps/web/src/lib/auth-client.tsx\n@@ -1,5 +1,5 @@\n import {\n-  \n+\n   createContext,\n   useCallback,\n   useContext,\n"}]},{"message":"[nitpick] Multiple consecutive empty lines between imports and code. Consider reducing to a single empty line for better consistency.","fixFiles":[{"filePath":"apps/web/src/lib/auth-client.tsx","diff":"diff --git a/apps/web/src/lib/auth-client.tsx b/apps/web/src/lib/auth-client.tsx\n--- a/apps/web/src/lib/auth-client.tsx\n+++ b/apps/web/src/lib/auth-client.tsx\n@@ -16,7 +16,6 @@\n import { analytics } from \"./analytics\";\n import type {ReactNode} from \"react\";\n \n-\n /**\n  * Better Auth client with Convex integration.\n  */\n"}]},{"message":"The file contains unresolved Git merge conflict markers. These markers need to be resolved before the code can be properly executed or reviewed.","fixFiles":[{"filePath":"apps/web/src/stores/prompt-draft.ts","diff":"diff --git a/apps/web/src/stores/prompt-draft.ts b/apps/web/src/stores/prompt-draft.ts\n--- a/apps/web/src/stores/prompt-draft.ts\n+++ b/apps/web/src/stores/prompt-draft.ts\n@@ -4,29 +4,15 @@\n /**\n  * Store for persisting prompt drafts within the current browser session.\n  *\n-<<<<<<< HEAD\n- * Uses sessionStorage instead of localStorage to limit exposure of sensitive\n- * chat content — data is scoped to the tab/session and not accessible after\n- * the browser session ends.\n-||||||| 54e09ce\n- * Store for persisting prompt drafts across page reloads.\n-=======\n  * Security: Uses sessionStorage instead of localStorage to limit exposure\n  * of sensitive draft content. Drafts are automatically cleared when the\n  * browser tab is closed, reducing the risk of exfiltration via XSS or\n  * compromised browser profiles.\n->>>>>>> main\n  *\n  * Non-annoying approach:\n  * - Drafts are saved per-chat (or \"global\" for new chat input)\n  * - Drafts are automatically cleared when a message is sent\n-<<<<<<< HEAD\n- * - Old drafts are cleaned up after 7 days to prevent storage bloat\n-||||||| 54e09ce\n- * - Old drafts are cleaned up after 7 days to prevent localStorage bloat\n-=======\n  * - Old drafts are cleaned up after 24 hours as a defensive measure\n->>>>>>> main\n  */\n \n const DRAFT_EXPIRY_MS = 24 * 60 * 60 * 1000; // 24 hours (session-scoped, defensive expiry)\n"}]},{"message":"The condition `Date.now() - draft.updatedAt < DRAFT_EXPIRY_MS` returns the draft if it's NOT expired, but the comment says 'Don't return expired drafts'. The logic appears correct but the comment is misleading.","fixFiles":[{"filePath":"apps/web/src/stores/prompt-draft.ts","diff":"diff --git a/apps/web/src/stores/prompt-draft.ts b/apps/web/src/stores/prompt-draft.ts\n--- a/apps/web/src/stores/prompt-draft.ts\n+++ b/apps/web/src/stores/prompt-draft.ts\n@@ -91,7 +91,7 @@\n \t\t\t\t\t\treturn \"\";\n \t\t\t\t\t}\n \n-\t\t\t\t\t// Don't return expired drafts\n+\t\t\t\t\t// Only return drafts that have not yet expired\n \t\t\t\t\tif (Date.now() - draft.updatedAt < DRAFT_EXPIRY_MS) {\n \t\t\t\t\t\treturn draft.text;\n \t\t\t\t\t}\n"}]},{"message":"parseInt without a radix parameter can lead to unexpected behavior with octal numbers. Consider using parseInt(process.env.PORT ?? '3000', 10) or Number(process.env.PORT ?? '3000').","fixFiles":[{"filePath":"apps/web/vite.config.ts","diff":"diff --git a/apps/web/vite.config.ts b/apps/web/vite.config.ts\n--- a/apps/web/vite.config.ts\n+++ b/apps/web/vite.config.ts\n@@ -7,7 +7,7 @@\n \n const config = defineConfig({\n   server: {\n-    port: parseInt(process.env.PORT ?? '3000'),\n+    port: parseInt(process.env.PORT ?? '3000', 10),\n     host: '127.0.0.1',\n   },\n   plugins: [\n"}]},{"message":"[nitpick] Hard-coded host IP address makes the configuration less flexible. Consider making this configurable via environment variable like process.env.HOST ?? '127.0.0.1'.","fixFiles":[{"filePath":"apps/web/vite.config.ts","diff":"diff --git a/apps/web/vite.config.ts b/apps/web/vite.config.ts\n--- a/apps/web/vite.config.ts\n+++ b/apps/web/vite.config.ts\n@@ -8,7 +8,7 @@\n const config = defineConfig({\n   server: {\n     port: parseInt(process.env.PORT ?? '3000'),\n-    host: '127.0.0.1',\n+    host: process.env.HOST ?? '127.0.0.1',\n   },\n   plugins: [\n     viteTsConfigPaths({\n"}]},{"message":"[nitpick] The preset selection logic could be more explicit. Consider using process.env.VERCEL === 'true' or process.env.VERCEL === '1' for clearer boolean evaluation instead of truthy check.","fixFiles":[{"filePath":"apps/web/vite.config.ts","diff":...

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

---

Summary by cubic

Cleaned up whitespace in auth-client and resolved prompt-draft conflicts. Tightened Vite config and hardened the Redis check script for safer development.

• Bug Fixes
  • prompt-draft.ts: removed conflict markers; clarified sessionStorage and 24h expiry; corrected comment to return only non-expired drafts.
  • vite.config.ts: added radix to parseInt, made host configurable via HOST, and made VERCEL preset selection explicit ('1'/'true' → vercel, else bun).
  • scripts/check-redis.ts: improved env parsing for quoted values, normalized URL handling with URL, validated response format, and fail fast outside dev when Redis is misconfigured.

^{Written for commit fa0f8c2. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
osschat-web	Error		Feb 18, 2026 1:05pm

[cubic-dev-ai]

1 issue found across 4 files

Confidence score: 3/5

• new URL("/pipeline", baseUrl) in scripts/check-redis.ts ignores any pathname on baseUrl, so the prior pathname manipulation is dead code and the constructed endpoint may be wrong in non-root deployments
• Single medium-severity, concrete behavior bug suggests some user-impacting risk, so this isn’t a no‑brainer merge
• Pay close attention to scripts/check-redis.ts - URL construction may drop intended base path

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="scripts/check-redis.ts">

<violation number="1" location="scripts/check-redis.ts:87">
P2: `new URL("/pipeline", baseUrl)` ignores `baseUrl`'s pathname because `/pipeline` is an absolute path—it resolves against the origin only. This makes the pathname manipulation on the previous line dead code, and introduces a subtle behavioral regression if the URL ever contains a path prefix.

Use a relative path (`"pipeline"` without leading `/`) so the URL resolves relative to the base pathname:</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: new URL("/pipeline", baseUrl) ignores baseUrl's pathname because /pipeline is an absolute path—it resolves against the origin only. This makes the pathname manipulation on the previous line dead code, and introduces a subtle behavioral regression if the URL ever contains a path prefix.

Use a relative path ("pipeline" without leading /) so the URL resolves relative to the base pathname:

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At scripts/check-redis.ts, line 87:

<comment>`new URL("/pipeline", baseUrl)` ignores `baseUrl`'s pathname because `/pipeline` is an absolute path—it resolves against the origin only. This makes the pathname manipulation on the previous line dead code, and introduces a subtle behavioral regression if the URL ever contains a path prefix.

Use a relative path (`"pipeline"` without leading `/`) so the URL resolves relative to the base pathname:</comment>

<file context>
@@ -60,8 +81,11 @@ async function main() {
+		const baseUrl = new URL(url);
+		// Remove trailing slashes from the pathname to avoid double slashes when appending "/pipeline"
+		baseUrl.pathname = baseUrl.pathname.replace(/\/+$/, "") || "/";
+		const pipelineUrl = new URL("/pipeline", baseUrl);
+		const response = await fetch(pipelineUrl, {
 			method: "POST",
</file context>

[tembo]

✅ No security issues found — scanned commits: 0716bebc, fa0f8c24