vayungodara
diff --git a/‎app/dashboard/DashboardClient.js‎
Lines changed: 6 additions & 0 deletions b/‎app/dashboard/DashboardClient.js‎
Lines changed: 6 additions & 0 deletions
diff --git a/‎app/dashboard/DashboardLayout.js‎
Lines changed: 3 additions & 1 deletion b/‎app/dashboard/DashboardLayout.js‎
Lines changed: 3 additions & 1 deletion
diff --git a/‎app/dashboard/groups/GroupsPage.module.css‎
Lines changed: 64 additions & 3 deletions b/‎app/dashboard/groups/GroupsPage.module.css‎
Lines changed: 64 additions & 3 deletions
diff --git a/‎app/dashboard/groups/GroupsPageClient.js‎
Lines changed: 15 additions & 3 deletions b/‎app/dashboard/groups/GroupsPageClient.js‎
Lines changed: 15 additions & 3 deletions
diff --git a/‎app/dashboard/groups/[id]/GroupDetail.module.css‎
Lines changed: 24 additions & 1 deletion b/‎app/dashboard/groups/[id]/GroupDetail.module.css‎
Lines changed: 24 additions & 1 deletion
diff --git a/‎app/dashboard/groups/[id]/GroupDetailClient.js‎
Lines changed: 3 additions & 1 deletion b/‎app/dashboard/groups/[id]/GroupDetailClient.js‎
Lines changed: 3 additions & 1 deletion
diff --git a/‎app/dashboard/pacts/PactsPageClient.js‎
Lines changed: 5 additions & 1 deletion b/‎app/dashboard/pacts/PactsPageClient.js‎
Lines changed: 5 additions & 1 deletion
diff --git a/‎app/share/streak/page.js‎
Lines changed: 10 additions & 4 deletions b/‎app/share/streak/page.js‎
Lines changed: 10 additions & 4 deletions
diff --git a/‎components/ActivityFeed.js‎
Lines changed: 5 additions & 2 deletions b/‎components/ActivityFeed.js‎
Lines changed: 5 additions & 2 deletions
diff --git a/‎components/ActivityFeed.module.css‎
Lines changed: 8 additions & 0 deletions b/‎components/ActivityFeed.module.css‎
Lines changed: 8 additions & 0 deletions
@@ -83,6 +83,12 @@ export default function DashboardClient({ user }) {
         }
       }
 
+      // Dashboard only renders max 3 pacts, but the full set is used for
+      // due-today/overdue counts in the header. limit=200 gives headroom for
+      // active+historical so active pacts aren't pushed out of the window
+      // when a user has a long tail of completed/missed pacts. Kept
+      // select('*') to avoid drift with schema migrations that add new
+      // columns (e.g. xp_reward, is_recurring).
       const { data, error } = await supabase
         .from('pacts')
         .select('*')
 
@@ -34,7 +34,9 @@ export default function DashboardLayout({ user, children }) {
           .from('profiles')
           .update({ timezone: detected })
           .eq('id', user.id)
-          .then(() => {}); // fire-and-forget
+          .then(({ error }) => {
+            if (error) console.warn('Timezone sync failed:', error.message);
+          });
       }
     } catch {
       // Intl API unavailable — timezone stays as DB default ('UTC')
 
@@ -87,13 +87,61 @@
   gap: var(--space-4);
 }
 
-/* Hero card — most active group gets visual emphasis */
+/* Hero card — most active group gets visual emphasis without breaking the grid */
 .groupCardHero {
-  grid-column: 1 / -1;
   border-left: 3px solid var(--accent-primary);
+  box-shadow:
+    0 0 0 1px rgba(var(--accent-primary-rgb), 0.2),
+    0 4px 16px rgba(var(--accent-primary-rgb), 0.08);
+}
+
+.groupCardHero:hover {
+  box-shadow:
+    var(--shadow-md),
+    0 0 0 1px var(--accent-primary),
+    0 6px 20px rgba(var(--accent-primary-rgb), 0.14);
+}
+
+.groupCardHero .progressFill {
+  height: 6px;
+  background: linear-gradient(
+    90deg,
+    var(--accent-primary),
+    var(--accent-secondary, var(--accent-primary))
+  );
+}
+
+.groupCardHero .progressBar {
+  height: 6px;
+}
+
+/* "Most Active" celebratory badge — anchors top-right of hero card */
+.heroBadge {
+  position: absolute;
+  top: var(--space-3);
+  right: var(--space-3);
+  display: inline-flex;
+  align-items: center;
+  gap: 4px;
+  padding: 3px var(--space-2);
+  background: var(--accent-glow);
+  color: var(--accent-primary);
+  font-size: 10px;
+  font-weight: 700;
+  letter-spacing: 0.04em;
+  text-transform: uppercase;
+  border-radius: var(--radius-sm);
+  line-height: 1;
+  white-space: nowrap;
+  pointer-events: none;
+}
+
+.heroBadge svg {
+  flex-shrink: 0;
 }
 
 .groupCard {
+  position: relative;
   display: flex;
   flex-direction: column;
   gap: var(--space-3);
@@ -435,7 +483,20 @@
 
 :global([data-theme="dark"]) .groupCardHero {
   border-left-color: var(--accent-primary);
-  box-shadow: var(--shadow-sm), inset 3px 0 12px -4px rgba(var(--accent-primary-rgb), 0.15);
+  box-shadow:
+    0 0 0 1px rgba(var(--accent-primary-rgb), 0.3),
+    0 4px 20px rgba(var(--accent-primary-rgb), 0.18);
+}
+
+:global([data-theme="dark"]) .groupCardHero:hover {
+  box-shadow:
+    var(--shadow-lg),
+    0 0 0 1px var(--accent-primary),
+    0 0 28px rgba(var(--accent-primary-rgb), 0.28);
+}
+
+:global([data-theme="dark"]) .heroBadge {
+  background: rgba(var(--accent-primary-rgb), 0.18);
 }
 
 :global([data-theme="dark"]) .metaDot {
 
@@ -35,6 +35,14 @@ function GroupCard({ group, isHero = false }) {
 
   return (
     <Link href={`/dashboard/groups/${group.id}`} className={`${styles.groupCard} ${isHero ? styles.groupCardHero : ''}`}>
+      {isHero && (
+        <span className={styles.heroBadge} aria-label="Most active group">
+          <svg width="12" height="12" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg" aria-hidden="true">
+            <path d="M13 2L4.5 13H11L10 22L18.5 11H12L13 2Z" fill="currentColor" stroke="currentColor" strokeWidth="1.5" strokeLinejoin="round"/>
+          </svg>
+          Most Active
+        </span>
+      )}
       <div className={styles.groupHeader}>
         <div
           className={styles.groupIcon}
@@ -115,10 +123,14 @@ function GroupSections({ groups }) {
   const ownedGroups = groups.filter(g => g.role === 'owner');
   const joinedGroups = groups.filter(g => g.role !== 'owner');
 
-  // Identify the most active group (highest task count) for hero treatment.
-  // Only apply hero when there are 3+ groups to avoid odd layout with 1-2 cards.
+  // Hero: the group with the most COMPLETED tasks (real progress signal).
+  // Require >= 5 completed tasks to avoid celebrating empty groups.
+  // Only apply with 3+ groups to avoid odd layout with 1-2 cards.
   const mostActiveId = groups.length >= 3
-    ? groups.reduce((best, g) => (g.taskCount > (best?.taskCount || 0) ? g : best), null)?.id
+    ? groups.reduce((best, g) => {
+        if ((g.tasksDone || 0) < 5) return best;
+        return (g.tasksDone || 0) > (best?.tasksDone || 0) ? g : best;
+      }, null)?.id
     : null;
 
   return (
 
@@ -456,12 +456,35 @@
   display: grid;
   grid-template-columns: 1fr 1.5fr;
   gap: var(--space-4);
-  align-items: start;
+  align-items: stretch;
+}
+
+/* Activity panel matches the left column's height so the whole activity
+   feed lives inside one scrollable block instead of endlessly expanding
+   the page. The nested ActivityFeed's IntersectionObserver already roots
+   on its own feed ref, so infinite scroll happens INSIDE this box. */
+.activityPanel {
+  height: 100%;
+  min-height: 500px;
+  max-height: 720px;
+  display: flex;
+  flex-direction: column;
+}
+
+.activityPanel > * {
+  flex: 1;
+  min-height: 0;
 }
 
 @media (max-width: 1024px) {
   .activityGrid {
     grid-template-columns: 1fr;
+    align-items: start;
+  }
+
+  .activityPanel {
+    height: auto;
+    max-height: 600px;
   }
 }
 
 
@@ -434,7 +434,9 @@ export default function GroupDetailClient({ user, group, userRole }) {
               )}
               <GroupStats groupId={group.id} />
             </div>
-            <ActivityFeed groupId={group.id} />
+            <div className={styles.activityPanel}>
+              <ActivityFeed groupId={group.id} pageSize={10} />
+            </div>
           </div>
         </section>
       )}
 
@@ -66,10 +66,14 @@ export default function PactsPageClient({ user }) {
 
   const handleDeletePact = async (pactId) => {
     try {
+      // Defense-in-depth: RLS already scopes this to the caller, but adding
+      // the explicit user_id filter ensures a hostile/misconfigured policy
+      // can't expand the delete's blast radius beyond the caller's pacts.
       const { error } = await supabase
         .from('pacts')
         .delete()
-        .eq('id', pactId);
+        .eq('id', pactId)
+        .eq('user_id', user.id);
 
       if (error) throw error;
       setPacts(prev => prev.filter(p => p.id !== pactId));
 
@@ -5,9 +5,15 @@ import ShareStreakClient from './ShareStreakClient';
 
 export async function generateMetadata({ searchParams }) {
   const params = await searchParams;
-  const streak = params?.streak || '0';
-  const name = params?.name || 'Someone';
-  
+  // Sanitize untrusted query params to prevent XSS / metadata injection.
+  // searchParams values can be `string | string[] | undefined` when the same
+  // key appears multiple times (e.g. `?name=a&name=b`). Coerce to a single
+  // string before calling `.replace` to avoid a TypeError on arrays.
+  const rawStreak = Array.isArray(params?.streak) ? params.streak[0] : params?.streak;
+  const streak = String(parseInt(rawStreak, 10) || 0);
+  const rawName = Array.isArray(params?.name) ? params.name[0] : params?.name;
+  const name = (rawName || 'Someone').replace(/[<>"'&]/g, '').slice(0, 50);
+
   return {
     title: `${name} is on a ${streak}-day streak! | LockIn`,
     description: `${name} has been crushing their goals with LockIn. Join them!`,
@@ -18,7 +24,7 @@ export async function generateMetadata({ searchParams }) {
   };
 }
 
-export default async function ShareStreakPage({ searchParams }) {
+export default async function ShareStreakPage() {
   const supabase = await createClient();
   const { data: { user } } = await supabase.auth.getUser();
 
 
@@ -135,7 +135,10 @@ export default function ActivityFeed({ groupId = null, pageSize = DEFAULT_PAGE_S
       const newActivities = result.data || [];
 
       offsetRef.current = currentOffset + newActivities.length;
-      setActivities(prev => [...prev, ...newActivities]);
+      setActivities(prev => {
+        const existingIds = new Set(prev.map(a => a.id));
+        return [...prev, ...newActivities.filter(a => !existingIds.has(a.id))];
+      });
       setHasMore(newActivities.length === pageSize);
     } catch (err) {
       console.error('Error loading more:', err);
@@ -237,7 +240,7 @@ export default function ActivityFeed({ groupId = null, pageSize = DEFAULT_PAGE_S
             <ActivityItem key={activity.id} activity={activity} />
           ))}
 
-          {/* Sentinel element for infinite scroll */}
+          {/* Sentinel element — IntersectionObserver auto-loads more as user scrolls */}
           <div ref={sentinelCallbackRef} className={styles.sentinel}>
             {isLoadingMore && (
               <div className={styles.loadingMore}>
 
@@ -4,6 +4,7 @@
   border-radius: var(--radius-lg);
   display: flex;
   flex-direction: column;
+  min-height: 0;
 }
 
 .header {
@@ -31,6 +32,13 @@
   padding: var(--space-3) var(--space-4);
   display: flex;
   flex-direction: column;
+  /* When the parent constrains height, scroll happens INSIDE the feed
+     — the IntersectionObserver's scroll root is this element, so
+     infinite scroll auto-loads more as the user scrolls here. */
+  flex: 1;
+  min-height: 0;
+  overflow-y: auto;
+  overscroll-behavior: contain;
 }
 
 .loading {
Original file line number	Diff line number	Diff line change
`@@ -83,6 +83,12 @@ export default function DashboardClient({ user }) {`
`83`	`83`	`}`
`84`	`84`	`}`
`85`	`85`
	`86`	`+ // Dashboard only renders max 3 pacts, but the full set is used for`
	`87`	`+ // due-today/overdue counts in the header. limit=200 gives headroom for`
	`88`	`+ // active+historical so active pacts aren't pushed out of the window`
	`89`	`+ // when a user has a long tail of completed/missed pacts. Kept`
	`90`	`+ // select('*') to avoid drift with schema migrations that add new`
	`91`	`+ // columns (e.g. xp_reward, is_recurring).`
`86`	`92`	`const { data, error } = await supabase`
`87`	`93`	`.from('pacts')`
`88`	`94`	`.select('*')`