feat: harden analysis and export pipeline

Author: AnasBabari

.github/workflows/ci.yml

@@ -30,6 +30,20 @@ jobs:
           cache: npm
       - run: npm ci
       - run: npm run lint
+      - run: npm run typecheck
       - run: npm run test:unit
       - run: npm run build
       - run: npm run build:vercel
+
+  browser-smoke:
+    runs-on: ubuntu-latest
+    needs: visualizer
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+        with:
+          node-version: '22'
+          cache: npm
+      - run: npm ci
+      - run: npx playwright install --with-deps chromium
+      - run: npm run test:e2e

README.md

@@ -145,7 +145,7 @@ UPSTASH_REDIS_REST_TOKEN="your-upstash-token"
 # Run the Vitest unit, security invariant, analyzer, and export-contract tests
 npm run test:unit
 
-# Run Python core test suite (28 unit, parity, and conformance tests)
+# Run Python core test suite (30 unit, parity, and conformance tests)
 npm run test:python
 
 # Run Playwright browser contracts (use REPODNA_E2E_PORT if port 3000 is busy)

app/api/analyze/route.ts

@@ -5,12 +5,18 @@ import { IngestionError, PUBLIC_REPOSITORY_INGESTION_LIMITS } from '../../lib/an
 import { auth } from '../../lib/auth';
 import { checkAnalysisRateLimit } from '../../lib/ratelimit';
 import { createApiErrorResponse } from '../../lib/api-error';
+import { isJsonBodyTooLarge, readBoundedJson } from '../../lib/bounded-json';
 import { validateRepoDNAProject } from '../../lib/schema/validator';
 import { getGitHubAccessToken } from '../../lib/github-session';
 import { recordScannedPublicRepository } from '../../lib/stats/scanned-repositories';
 
 export const dynamic = 'force-dynamic';
 
+const NO_STORE_HEADERS = {
+  'Cache-Control': 'no-store, private, max-age=0',
+  'X-Content-Type-Options': 'nosniff',
+};
+
 interface StructuredLog {
   requestId: string;
   timestamp: string;
@@ -235,7 +241,7 @@ async function handleAnalyze(url: string | null, method: string, request: NextRe
       failureCategory: null,
     });
 
-    return NextResponse.json({ success: true, project }, { status: 200 });
+    return NextResponse.json({ success: true, project }, { status: 200, headers: NO_STORE_HEADERS });
   } catch (error: unknown) {
     const durationMs = Date.now() - startTime;
 
@@ -286,13 +292,16 @@ async function handleAnalyze(url: string | null, method: string, request: NextRe
 export async function POST(request: NextRequest) {
   let url: string | null = null;
   try {
-    const body = (await request.json()) as { url?: unknown; repo?: unknown };
+    const body = await readBoundedJson<{ url?: unknown; repo?: unknown }>(request);
     if (typeof body?.url === 'string') {
       url = body.url;
     } else if (typeof body?.repo === 'string') {
       url = body.repo;
     }
-  } catch {
+  } catch (error) {
+    if (isJsonBodyTooLarge(error)) {
+      return createApiErrorResponse('PAYLOAD_TOO_LARGE', 'Request body exceeds the 16 KB limit.', 413);
+    }
     return createApiErrorResponse(
       'MALFORMED_JSON',
       'Invalid JSON request body. Expected {"url": "https://github.com/owner/repo"}.',

app/api/auth/revoke/route.ts

@@ -4,13 +4,14 @@ import { revokeGitHubAccessToken } from '../../../lib/github-oauth';
 import { getGitHubAccessToken } from '../../../lib/github-session';
 
 export const dynamic = 'force-dynamic';
+const NO_STORE_HEADERS = { 'Cache-Control': 'no-store, private, max-age=0', 'X-Content-Type-Options': 'nosniff' };
 
 export async function POST(request: NextRequest) {
   try {
     const session = await auth();
     const accessToken = await getGitHubAccessToken(request);
     if (!session?.user || !accessToken) {
-      return NextResponse.json({ success: false, message: 'Not authenticated' }, { status: 401 });
+      return NextResponse.json({ success: false, message: 'Not authenticated' }, { status: 401, headers: NO_STORE_HEADERS });
     }
 
     const controller = new AbortController();
@@ -32,17 +33,20 @@ export async function POST(request: NextRequest) {
               ? 'GitHub revocation is not configured correctly.'
               : 'GitHub did not confirm token revocation. Your local session remains active.',
         },
-        { status }
+        { status, headers: NO_STORE_HEADERS }
       );
     }
 
-    return NextResponse.json({
-      success: true,
-      message: result.alreadyRevoked
-        ? 'GitHub access was already revoked.'
-        : 'GitHub access token revoked successfully.',
-      githubSettingsUrl: 'https://github.com/settings/installations',
-    });
+    return NextResponse.json(
+      {
+        success: true,
+        message: result.alreadyRevoked
+          ? 'GitHub access was already revoked.'
+          : 'GitHub access token revoked successfully.',
+        githubSettingsUrl: 'https://github.com/settings/installations',
+      },
+      { headers: NO_STORE_HEADERS }
+    );
   } catch (err: unknown) {
     const timedOut = err instanceof Error && err.name === 'AbortError';
     return NextResponse.json(
@@ -52,7 +56,7 @@ export async function POST(request: NextRequest) {
           ? 'GitHub revocation timed out. Your local session remains active.'
           : 'GitHub revocation failed. Your local session remains active.',
       },
-      { status: timedOut ? 504 : 502 }
+      { status: timedOut ? 504 : 502, headers: NO_STORE_HEADERS }
     );
   }
 }

app/api/feedback/route.ts

@@ -12,6 +12,7 @@ export interface FeedbackPayload {
 }
 
 const MAX_FEEDBACK_BYTES = 16 * 1024;
+const NO_STORE_HEADERS = { 'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff' };
 
 async function readBoundedJson<T>(request: NextRequest, maxBytes: number): Promise<T> {
   const contentLength = request.headers.get('content-length');
@@ -71,12 +72,12 @@ export async function POST(request: NextRequest) {
     if (err instanceof Error && err.message === 'PAYLOAD_TOO_LARGE') {
       return NextResponse.json(
         { success: false, error: 'Request body exceeds 16 KB limit', requestId },
-        { status: 413 }
+        { status: 413, headers: NO_STORE_HEADERS }
       );
     }
     return NextResponse.json(
       { success: false, error: 'Invalid or malformed JSON body.', requestId },
-      { status: 400 }
+      { status: 400, headers: NO_STORE_HEADERS }
     );
   }
 
@@ -101,14 +102,16 @@ export async function POST(request: NextRequest) {
     if (!usefulnessScore) {
       return NextResponse.json(
         { success: false, error: 'usefulnessScore must be an integer between 1 and 5', requestId },
-        { status: 400 }
+        { status: 400, headers: NO_STORE_HEADERS }
       );
     }
 
     const entry = {
       requestId,
       timestamp: new Date().toISOString(),
-      user: session?.user?.id || 'anonymous',
+      user: session?.user?.id
+        ? crypto.createHash('sha256').update(session.user.id).digest('hex').slice(0, 16)
+        : 'anonymous',
       usefulnessScore,
       primaryUsecase,
       missingCapabilities,
@@ -118,11 +121,14 @@ export async function POST(request: NextRequest) {
 
     console.log(`[RepoDNA:Feedback] ${JSON.stringify(entry)}`);
 
-    return NextResponse.json({ success: true, message: 'Thank you for your feedback!', requestId });
+    return NextResponse.json(
+      { success: true, message: 'Thank you for your feedback!', requestId },
+      { headers: NO_STORE_HEADERS }
+    );
   } catch {
     return NextResponse.json(
       { success: false, error: 'Failed to process feedback submission.', requestId },
-      { status: 400 }
+      { status: 400, headers: NO_STORE_HEADERS }
     );
   }
 }

app/api/internal/cleanup-artifacts/route.ts

@@ -8,6 +8,10 @@ export const runtime = 'nodejs';
 
 const MAX_BLOBS_PER_RUN = 5000;
 const BATCH_SIZE = 100;
+const NO_STORE_HEADERS = {
+  'Cache-Control': 'no-store, private, max-age=0',
+  'X-Content-Type-Options': 'nosniff',
+};
 
 export async function GET(request: NextRequest) {
   return handleCleanup(request);
@@ -20,13 +24,13 @@ export async function POST(request: NextRequest) {
 async function handleCleanup(request: NextRequest): Promise<NextResponse> {
   const cronSecret = process.env.CRON_SECRET;
   if (!cronSecret) {
-    return NextResponse.json({ code: 'CRON_SECRET_NOT_CONFIGURED', message: 'Cron secret is not configured.' }, { status: 503 });
+    return NextResponse.json({ code: 'CRON_SECRET_NOT_CONFIGURED', message: 'Cron secret is not configured.' }, { status: 503, headers: NO_STORE_HEADERS });
   }
 
   const authHeader = request.headers.get('authorization');
   const expected = `Bearer ${cronSecret}`;
   if (authHeader !== expected) {
-    return NextResponse.json({ code: 'UNAUTHORIZED', message: 'Invalid cron token.' }, { status: 401 });
+    return NextResponse.json({ code: 'UNAUTHORIZED', message: 'Invalid cron token.' }, { status: 401, headers: NO_STORE_HEADERS });
   }
 
   try {
@@ -90,8 +94,8 @@ async function handleCleanup(request: NextRequest): Promise<NextResponse> {
       deletedTotal: deletedCanonical + deletedExports,
       failedDeletions,
       failedBatches,
-    });
+    }, { headers: NO_STORE_HEADERS });
   } catch {
-    return NextResponse.json({ code: 'CLEANUP_FAILED', message: 'Cleanup failed.' }, { status: 500 });
+    return NextResponse.json({ code: 'CLEANUP_FAILED', message: 'Cleanup failed.' }, { status: 500, headers: NO_STORE_HEADERS });
   }
 }

app/api/v2/analyses/[runId]/route.ts

@@ -6,6 +6,11 @@ import type { PublicAnalysisWorkflowResult } from '../../../../workflows/analyze
 
 export const dynamic = 'force-dynamic';
 
+const NO_STORE_HEADERS = {
+  'Cache-Control': 'no-store, private, max-age=0',
+  'X-Content-Type-Options': 'nosniff',
+};
+
 export async function GET(_request: Request, context: { params: Promise<{ runId: string }> }) {
   const { runId } = await context.params;
 
@@ -46,7 +51,7 @@ export async function GET(_request: Request, context: { params: Promise<{ runId:
           : status === 'cancelled'
             ? { code: 'WORKFLOW_CANCELLED', message: 'The durable analysis was cancelled.' }
             : null,
-    });
+    }, { headers: NO_STORE_HEADERS });
   } catch {
     return createApiErrorResponse('RUN_NOT_FOUND', 'Unknown or expired analysis run.', 404);
   }

app/api/v2/analyses/route.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from 'next/server';
 import { getRun, start } from 'workflow/api';
 
 import { createApiErrorResponse } from '../../../lib/api-error';
+import { isJsonBodyTooLarge, readBoundedJson } from '../../../lib/bounded-json';
 import { parseGitHubUrl } from '../../../lib/analyzer';
 import { isPublicArtifactCacheConfigured } from '../../../lib/analyzer/v2/artifact-cache';
 import { auth } from '../../../lib/auth';
@@ -13,6 +14,11 @@ import {
 
 export const dynamic = 'force-dynamic';
 
+const NO_STORE_HEADERS = {
+  'Cache-Control': 'no-store, private, max-age=0',
+  'X-Content-Type-Options': 'nosniff',
+};
+
 async function resolveCommitSha(owner: string, name: string): Promise<string | null> {
   try {
     const response = await fetch(`https://api.github.com/repos/${owner}/${name}/commits/HEAD`, {
@@ -103,8 +109,11 @@ export async function POST(request: NextRequest) {
 
   let bodyUrl: unknown;
   try {
-    bodyUrl = ((await request.json()) as { url?: unknown })?.url;
-  } catch {
+    bodyUrl = (await readBoundedJson<{ url?: unknown }>(request))?.url;
+  } catch (error) {
+    if (isJsonBodyTooLarge(error)) {
+      return createApiErrorResponse('PAYLOAD_TOO_LARGE', 'Request body exceeds the 16 KB limit.', 413);
+    }
     return createApiErrorResponse('INVALID_REQUEST', 'Body must be JSON with a "url" field.', 400);
   }
   if (typeof bodyUrl !== 'string' || !bodyUrl.trim()) {
@@ -157,7 +166,7 @@ export async function POST(request: NextRequest) {
         commitSha,
         ...runEndpoints(run.runId),
       },
-      { status: 202 }
+      { status: 202, headers: NO_STORE_HEADERS }
     );
   } catch (error) {
     console.error('[RepoDNA:WorkflowStartFailed]', error);
@@ -178,7 +187,7 @@ export async function GET(request: NextRequest) {
   try {
     const status = await runStatus(runId);
     return status
-      ? NextResponse.json(status)
+      ? NextResponse.json(status, { headers: NO_STORE_HEADERS })
       : createApiErrorResponse('RUN_NOT_FOUND', 'Unknown or expired analysis run.', 404);
   } catch {
     return createApiErrorResponse('RUN_NOT_FOUND', 'Unknown or expired analysis run.', 404);