Fix 13 audit findings (startup blocker, credential leaks, retrieval correctness) + CI gates

[ShreeBohara]

Findings from a full-repository audit, ordered by cost today over risk of changing it. Every item was reproduced before the fix and re-verified after.

Why this is worth reviewing first

Two of these are not latent:

• docker compose up could never start the API. pydantic-settings JSON-decodes List[str] inside EnvSettingsSource before field validators run, so the comma-separated CORS_ORIGINS that docker-compose.yml ships as its own default raised SettingsError at import of src.config — before uvicorn bound a port. config.py now reads it as a str and splits in a property.
• The GitHub token could be exfiltrated by an unauthenticated request. The token was injected whenever "github.com" in url, which also matches github.com.attacker.tld. POST /api/repos/ needs no auth, so an attacker-chosen host received the token. Host is now compared exactly against the parsed hostname, git stderr is redacted before it is raised, and .dockerignore stops COPY apps/api . baking a live .env into the image.

What changed

Startup / deployment — CORS_ORIGINS parsing; blank env assignments fall back to declared defaults rather than becoming ""; compose forwards LLM_PROVIDER, EMBEDDING_PROVIDER, GITHUB_TOKEN, ANTHROPIC_*, OLLAMA_* and the embedding rate-limit knobs, which its hardcoded allowlist had been dropping (Anthropic and Ollama were unreachable under the documented Docker path).

Credentials — exact-host token injection; token redacted from indexing_error, which the public /api/repos/{id}/progress SSE endpoint streams; .env and .venv excluded from the Docker build context.

Retrieval correctness

• Answer cache key now includes a conversation-history digest. The prompt contained history but the key did not, so a fresh session was served another session's history-conditioned answer for the full 30-minute TTL.
• A stream failure with nothing delivered now raises instead of yielding [Error: ...] as a token. That text was being cached and persisted as the assistant's answer, so one transient upstream error poisoned a question for every later asker.
• tree_sitter_parser uses node.text instead of slicing the decoded str with start_byte/end_byte. Those are byte offsets, so a single multi-byte character mis-aligned every chunk after it in the file.
• .tsx is parsed with language_tsx(). The plain TypeScript grammar cannot parse JSX, and has_error was never checked — tree-sitter returns an ERROR tree rather than raising, so the existing except clause never fired. Chunks are now checked and fall back to raw indexing.
• Ollama 404s raise instead of being retried and failed-open, and fail-open gained a failure-ratio ceiling. The default model name was a HuggingFace id Ollama cannot resolve, so every chunk exhausted a 10-attempt backoff and landed as a zero vector — which scores every chunk identically and makes retrieval arbitrary at full confidence.

API surface — quiz input bounded and rate-limited (it was the only LLM route with neither, and the quiz bucket it needed did not exist, so the limit call would have been a silent no-op); /health uses .value (a str-Enum f-strings to IndexingStatus.COMPLETED, so demo mode reported degraded permanently) and an unreachable LLM now actually fails the check; api-client.ts reads the error body once and handles FastAPI's array detail, so 422s and non-JSON bodies stop collapsing to a generic message.

Dependencies — tree-sitter>=0.22 (Parser(language) is 0.22+; the old floor permitted a version where importing the parser raises TypeError and the API cannot boot), chromadb>=1.0, plus the undeclared pyyaml and pytest-cov.

Second commit: CI gates that passed for the wrong reasons

• CI ran pytest tests/unit tests/integration, silently skipping tests/test_parser.py at the tests/ root — so CI never constructed a tree-sitter parser, and local runs covered more than CI on the same commit. Now pytest tests.
• pnpm install --frozen-lockfile, matching vercel.json. CI was repairing lockfile drift that the Vercel build then rejected, so a PR could go green while the deploy failed on the same commit.
• test is vitest run (bare vitest only exits when it detects CI, so pnpm test hung locally); type-check runs next typegen first, since Next 16 generates route types only during dev/build; turbo clean now resolves, so root pnpm clean reaches its rm -rf node_modules instead of short-circuiting.
• turbo.json: test depends on ^build not build, dropping a full next build --webpack before the first test; globalDependencies points at apps/web/.env.local, the file that actually exists.
• .env.example / docker/README.md contradicted each other on where .env goes and neither was right for both paths — local dev reads apps/api/.env, Compose expands ${VAR} from docker/.env. Also commented out the OPENAI_API_KEY=sk placeholder, which was a truthy value that left the app believing it was configured.

Verification

Gate	Result
pytest tests	89 passed, 0 failed
ruff check src tests	clean
vitest run (CI unset)	12 passed, exits
next typegen	types generated
tsc --noEmit	0 errors in project source

pytest also could not run at all on a clean install before this: pyproject's addopts requires pytest-cov, which requirements.txt never declared.

Not included

• .tsx and byte-offset fixes are correct in code but existing indexes need a re-index to benefit — 28 .tsx files in the pinned demo repo are still mis-chunked.
• Chroma's implicit l2 space (embeddings are normalized for cosine) is deliberately left for that same re-index, since the space is immutable after collection creation.
• parse_github_url still accepts non-GitHub hosts, so git clone can reach internal addresses. The credential exposure is closed; restricting the host set is a functional decision.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
codebaseqa-web	Ready	Preview	Aug 9, 2026 3:28pm

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bed0605207

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Avoid rejecting long lessons before truncation

When a generated lesson's content_markdown exceeds 20 KB, the frontend still sends the full lesson body to this endpoint (api.generateQuiz(..., content.content_markdown)), but LearningService.generate_quiz() only uses context_content[:2000] in the actual prompt. This new validation rejects those long lessons with a 422 before the server can use the safe 2 KB slice, so users can no longer generate quizzes for longer lessons even though no extra LLM spend would occur. Consider truncating before validation or having the client send the already-bounded excerpt.

Useful? React with 👍 / 👎.