[vtshreeram]

Summary

FlowStack V2: setup and onboarding, secrets, monitoring, quality gates, safe deploys and template upgrades. Built incrementally on dev; existing commands, auth, schema and migrations are preserved.

bun run setup                      # existing script, extended
  toolchain check (Node 24, Bun)
  questions / flags                # name, mode, frontend, integrations, ports
  configure + .flowstack.json v2   # v1 files upgraded in place
  bun install
  scripts/onboard.mjs              # separate process: setup stays dependency-free
    secrets      .env names | Infisical login + access + required names
    database     connectivity
    migrations   applied only with consent (prompt | --migrate)
    doctor       full report
  rerun = resume (reuse earlier choices)

 scripts/
+├── onboard.mjs  doctor.mjs  dev.mjs  secrets.mjs  db.mjs  upgrade.mjs
+├── deploy-preflight.mjs  cloud-run.mjs  secrets-scan.mjs  check-bundle-secrets.mjs
+└── lib/         env manifest, project config, infisical, db status, toolchain
 apps/server/
+├── src/app.ts  instrument.ts  routes/health/       # Sentry, /health/live|ready, request IDs
 └── .deploy/scripts/deploy.sh                        # verify-before-traffic, rollback, audit
+.github/workflows/  deploy.yml  release.yml          # verify.yml extended: secret-scan, actionlint, e2e
+e2e/  tests/*                                        # 14 → 103 tests + Playwright journey
+AGENTS.md  CLAUDE.md→@AGENTS.md  docs/advanced/*

Deploy flow (deploy.sh):

preflight → build :<sha> → deploy revision with NO traffic (tag r-<sha>)
  → /health/ready on tag URL
     fail: tag failed-<sha>, traffic unchanged, report
     pass: move 100% traffic → (--auto-rollback) re-check, restore previous if unhealthy

Follow-up fixes and verification

• Added direct Infisical runtime loading for Cloud Run using GCP ID Token Auth. Deployment passes public bootstrap identifiers; instances fetch secrets before importing the API. No local secret files or Google Secret Manager are needed in this mode. Existing env-file and Secret Manager modes remain available.
• Fixed deployment configuration parsing to respect complete YAML sections and their boundaries, and included dependency patches in the Docker build context.
• Protected existing migration SQL/snapshots and non-append journal changes during template upgrades; preserved executable script permissions and validated upgrade flags before fetching upstream.
• Preserved injected auth proxy and database options through Turbo's strict development environment, retained the existing runtime log-format setting in Infisical, and redacted credentials inside arrays without crashing on circular log metadata.
• Installed the pinned secret scanner in every CI job that runs the hook tests, including preset validation and deployment verification.
• Centralized the production API build with production JSX compilation. The previous build emitted development JSX calls against production React and silently failed to render verification emails. Runtime/API/browser fixtures now use the same build configuration.
• Ignored generated Google authentication files so CI credentials do not make production deployments appear dirty or enter build contexts.

Validation on the follow-up commits: 113 tests passed, zero failures and zero skips (including real PostgreSQL-wire-protocol, API lifecycle, deployment simulation, runtime injection and Git-hook tests). Lint, type checking, build and staged gitleaks scan passed. Local browser E2E reached the isolated stack but could not launch Chromium because the pinned Playwright version does not support this host's macOS 13. The Linux CI browser journeys passed for all four personal/organization and React/TanStack combinations on the latest head.

GitHub verification on commit e766e9d: all 12 jobs passed, covering shared lint/types/tests/audit, secret scanning, workflow lint, all five preset builds and all four browser journeys. Successful verification run.

Live Infisical/GCP identity configuration, native runtime authentication against real services and a sandbox deployment have not been performed. These are required before enabling the new runtime mode in a deployed environment.

Evidence from the initial implementation

• Before: 14 tests; bun audit 45 advisories (5 critical) on dev.
  After: 103 tests pass (10 consecutive runs, 0 failures); 0 advisories; 5/5 presets (4 combos + no optional integrations) install, type-check, test, build with sentinel secrets (no bundle leaks), audit; Playwright journey passes for all 4 presets.
• Bugs found and fixed, each with a regression test:
  • Production API bundle shipped with SQL query logging on (bun build inlined NODE_ENV="development") → logger: false asserted on the built bundle.
  • Behind a load balancer (X-Forwarded-For: client, lb) all clients shared one auth rate-limit bucket → AUTH_TRUSTED_PROXIES; e2e: client B was 429, now 401; forged left-most IP still 429.
  • Sentry v11 collects cookies/bodies/users when dataCollection is unset → all categories set; runtime test with a fake ingest shows no cookie, bearer or query secret sent.
  • Rollback could pick a release that failed verification → failed-* tag excluded (fake-gcloud test: v1 ok, v2 failed, v3 ok, rollback → v1).
  • Migrations 0004/0005 silently skipped by drizzle on DBs migrated to 0003 (out-of-order journal timestamps) → hash-based db:status detects it and db:migrate refuses.
  • Axios read undocumented VITE_API_URL instead of VITE_API_BASE_URL.
  • infisical run passed INFISICAL_TOKEN into the app process → stripped before the app starts.
  • Membership check mutation (removed in auth middleware) makes the org e2e test fail.
• Not verified live (mocked only): Infisical project access, Sentry delivery to sentry.io, GCP Workload Identity / Cloud Run deploy and rollback.

Merge Danger

Door: two-way

Revertible commit range; no schema changes, no data migrations, no destructive operations. Deploy script keeps the legacy service-account key and env-file paths working (with warnings); Secret Manager and keyless auth are opt-in.

Blast Radius: tooling-wide

Every developer command goes through new scripts (bun run dev → scripts/dev.mjs). Runtime-visible changes: optional R2/Google/email follow TEMPLATE_FEATURES; API now also runs on non-Neon PostgreSQL (Neon unchanged); production logs become JSON. Before relying on deploys: complete GCP/GitHub setup in apps/server/DEPLOYMENT.md and do a sandbox run first.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7fdc1f7d-a270-4971-a594-10c963289e87

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-25T01:41:45.018089Z We couldn’t complete this review. Comment @codex review to try again.	7caa685	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.