docs: quality upgrade plan to 9.5+ (Bun, DAG, security, CI) by KitsuneKode · Pull Request #24 · KitsuneKode/buzz8n

KitsuneKode · 2026-07-10T02:48:33Z

Summary

Implements the quality upgrade plan to raise Architecture, Security, Reliability, Tests, DevEx/CI, and Code Quality toward ≥ 9.5, using Bun-first practices and production-grade DAG/queue patterns.

Plan: docs/superpowers/plans/2026-07-10-quality-upgrade-to-9.5.md

Completed (all plan tasks)

Phase 0 — Quality gates

Wire @buzz8n/tests workspace + bun test preload
Web check-types for Turbo CI
.env.example + README Environment section
Re-enable CI test + secretlint

Phase 1 — Security

AES-GCM credential envelopes; encrypt on write; redact API responses
Worker credential lookup scoped by userId
JWT expiry, uniform auth errors, env cookie domain
Honest security FAQ; signup auth middleware

Phase 2 — Reliability / DAG

Express error handler + 404 fallback
Webhook payload forwarding
Rate-limit key + fail policy
DAG module split + unit tests
Multi-worker shutdown + DLQ

Phase 3 — Bun practices

Logger over console.log; CONTRIBUTING Bun practices
Zod-validate queue payloads

Phase 4 — Tests / docs

Docs aligned to root scripts

Phase 5 — Polish

Workflow.status comment; UI dead export removed; React strict mode

Follow-up fixes (post-review)

Declare crypto/auth env vars in turbo.json globalEnv (CI lint)
Require CREDENTIALS_ENCRYPTION_KEY in backend/worker config validation
Align cookie Max-Age with JWT_EXPIRES_IN
Reject plaintext credentials unless ALLOW_PLAINTEXT_CREDENTIALS=true
DLQ execution failures before ACK (leave pending if DLQ write fails)
Uniform JSON error responses across auth/webhook/credential/workflow/execution
Shared getApiErrorMessage for web clients (useAuth, useWorkflow, CredentialModal)
Redact PII from email/telegram/AI agent logs
Canonical encryption docs (docs/CREDENTIAL_ENCRYPTION.md) — this PR’s Web Crypto envelope wins over PR feat: Phase 0 hardening — security, queue, CI, and frontend usability #23’s node:crypto format
Key resolution accepts hex / base64-32 / hashed secrets

Verification (local)

bun test (auth, webhook, jwt-expiry, load-credential, processor, crypto, api-error) → pass

Out of scope (as planned)

Express → Bun.serve
Prisma → Bun.sql
Startup XCLAIM reclaim
OAuth / formal SOC 2

Note vs PR #23

Do not merge both encryption formats. Prefer this PR. Cherry-pick OpenAPI/metrics/deploy/Playwright from #23 if still needed — skip credentials-crypto.ts.

Phased plan covering Bun workspace/CI gates, credential encryption, JWT expiry, webhook payload forwarding, DAG hardening, multi-worker Redis shutdown/DLQ, and test coverage exit criteria.

vercel · 2026-07-10T02:48:38Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
buzz8n-web	Error		Jul 10, 2026 6:04am

coderabbitai · 2026-07-10T02:48:40Z

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: df6ed6d4-b050-4ce8-b923-1865cbdbdcea

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch cursor/quality-upgrade-plan-3e47

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Replace placeholder credentials in plan and .env.example so the new secretlint CI job does not fail on documentation examples.

…by userId

Add CREDENTIALS_ENCRYPTION_KEY and related auth env vars to turbo globalEnv so eslint turbo/no-undeclared-env-vars stops failing CI. Require the encryption key in backend/worker config validation, and derive cookie Max-Age from JWT_EXPIRES_IN so token and cookie lifetimes stay in sync.

Reject plaintext credentials unless ALLOW_PLAINTEXT_CREDENTIALS is set, send execution failures to the DLQ before ACK, and standardize auth/ webhook/credential error responses as JSON. Redact PII from worker node logs and keep the web auth client compatible with JSON error bodies.

Convert remaining workflow/execution/credential responses to JSON, share getApiErrorMessage across web clients, and document this branch's Web Crypto envelope as canonical vs PR #23. Key resolution now accepts hex/base64/hashed secrets for production-ready key provisioning.

coderabbitai · 2026-07-10T06:06:18Z

Caution

Review failed

An error occurred during the review process. Please try again later.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch cursor/quality-upgrade-plan-3e47

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

docs: add quality upgrade plan targeting 9.5+ scores

c65d8a4

Phased plan covering Bun workspace/CI gates, credential encryption, JWT expiry, webhook payload forwarding, DAG hardening, multi-worker Redis shutdown/DLQ, and test coverage exit criteria.

vercel Bot deployed to Preview July 10, 2026 02:50 View deployment

chore(tests): wire @buzz8n/tests workspace and fix bun test preload

cdeea7c

vercel Bot deployed to Preview July 10, 2026 03:02 View deployment

cursoragent added 2 commits July 10, 2026 03:05

chore(web): add check-types script for turbo CI

15f177c

docs: add .env.example for all required services

739f58c

vercel Bot deployed to Preview July 10, 2026 03:06 View deployment

ci: re-enable tests and add secretlint gate

f41e386

vercel Bot deployed to Preview July 10, 2026 03:06 View deployment

fix(ci): sanitize example DATABASE_URL for secretlint

2716340

Replace placeholder credentials in plan and .env.example so the new secretlint CI job does not fail on documentation examples.

vercel Bot deployed to Preview July 10, 2026 03:07 View deployment

feat(security): add aes-gcm credential envelope helpers

0698e74

vercel Bot deployed to Preview July 10, 2026 03:11 View deployment

feat(security): encrypt credentials at rest and scope worker lookups …

dd3226b

…by userId

vercel Bot deployed to Preview July 10, 2026 03:16 View deployment

feat(server): jwt expiry, uniform errors, env cookie domain

038c7aa

vercel Bot deployed to Preview July 10, 2026 03:21 View deployment

cursoragent added 3 commits July 10, 2026 03:21

fix(web): align security FAQ with actual controls

61a09c1

fix(web): tighten auth middleware matcher for signup

26be895

fix(server): restore Express error handler and 404 fallback

6a12de7

vercel Bot deployed to Preview July 10, 2026 03:23 View deployment

feat(webhook): forward sanitized request payload into executions

d2c6d95

vercel Bot deployed to Preview July 10, 2026 03:29 View deployment

fix(server): webhook rate-limit key and configurable fail policy

2d276fb

vercel Bot deployed to Preview July 10, 2026 03:30 View deployment

refactor(worker): split DAG graph helpers and add executor tests

1a9d93a

vercel Bot deployed to Preview July 10, 2026 03:34 View deployment

fix(worker): multi-worker shutdown and execution DLQ

9778c26

cursoragent added 2 commits July 10, 2026 03:43

chore: enforce Bun logging and password crypto practices

ebc0873

feat(types): zod-validate execution queue payloads

40317ea

vercel Bot deployed to Preview July 10, 2026 03:46 View deployment

cursoragent added 2 commits July 10, 2026 03:56

test: fix suite path aliases, react deps, and common export resolution

dab372a

docs: align test commands with root package scripts

1b5e87f

vercel Bot had a problem deploying to Preview July 10, 2026 03:58 Failure

cursoragent added 5 commits July 10, 2026 03:58

docs(store): clarify workflow status field semantics

5bdf95e

chore(ui): remove dead hooks export path

ce7bb97

fix(web): enable React strict mode

8ccfcb2

fix(store): exclude migration scripts from package typecheck

8916601

fix(common): re-export ExecutionsInfiniteResponse type

abf7c6d

vercel Bot deployed to Preview July 10, 2026 04:02 View deployment

vercel Bot deployed to Preview July 10, 2026 06:00 View deployment

vercel Bot deployed to Preview July 10, 2026 06:02 View deployment

vercel Bot had a problem deploying to Preview July 10, 2026 06:04 Failure

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

docs: quality upgrade plan to 9.5+ (Bun, DAG, security, CI) - #24

docs: quality upgrade plan to 9.5+ (Bun, DAG, security, CI)#24
KitsuneKode wants to merge 28 commits into
mainfrom
cursor/quality-upgrade-plan-3e47

KitsuneKode commented Jul 10, 2026 •

edited by cursor Bot

Loading

Uh oh!

vercel Bot commented Jul 10, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jul 10, 2026 •

edited

Loading

Review skipped

Uh oh!

coderabbitai Bot commented Jul 10, 2026

Review failed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

KitsuneKode commented Jul 10, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Completed (all plan tasks)

Phase 0 — Quality gates

Phase 1 — Security

Phase 2 — Reliability / DAG

Phase 3 — Bun practices

Phase 4 — Tests / docs

Phase 5 — Polish

Follow-up fixes (post-review)

Verification (local)

Out of scope (as planned)

Note vs PR #23

Uh oh!

vercel Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

coderabbitai Bot commented Jul 10, 2026

Review failed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

KitsuneKode commented Jul 10, 2026 •

edited by cursor Bot

Loading

vercel Bot commented Jul 10, 2026 •

edited

Loading

coderabbitai Bot commented Jul 10, 2026 •

edited

Loading