An authenticated GET to any unrecognised API route — a typo, a renamed
endpoint, an older client — fell through to the SPA fallback and returned
200 text/html containing the app shell.
This is close to the worst failure shape for an API consumer. `response.ok` is
true, so nothing treats it as an error; the caller then dies on `JSON.parse`
with "Unexpected token '<'" far from the actual cause. The MCP server, the CLI
and Piggy all consume this API and would all have hit it. It was masked from
casual testing because unauthenticated requests are rejected earlier by the
auth middleware, so it only appears once you hold a valid token.
Found by probing production with Scott's token: GET /api/keys (the real path is
/api/api-keys) returned 200 text/html.
The static-file middleware already carried this guard — added for the same
reason when og.png was being served as HTML — but the SPA fallback beneath it
did not. Same guard, one place missing.
Verified: unknown API paths now return 404 application/json, real API paths
still answer, client-side routes still receive the shell, and static assets
still serve with their own content types. Typecheck clean, 124 unit tests and
the e2e suite green.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The Overview page overflowed 80px at 393px wide. Traced to the "The book" card:
the grid column was a correct 361px, the card inside it was 457px and refused
to shrink. Confirmed by forcing `min-width: 0` on grid children in the live
page, which took the overflow to 0.
Fixed on the Card base class rather than at the call site, because this is the
third time the same trap has been fixed individually — grid and flex children
default to `min-width: auto` and cards routinely hold something unshrinkable, a
tabular-nums figure or a nowrap badge. `min-width: 0` is inert for a
block-level card outside a flex or grid parent, so applying it always costs
nothing and removes the whole class of bug.
Verified by running the stack locally against the demo data: 0px overflow
across all 12 routes at both 393px and 1440px.
AGENTS.md updated to say any NEW container primitive needs the same, with the
one-line browser check to confirm it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Named by convention so a coding agent finds it without being told. Written to
get someone productive from a cold start without having to reconstruct the
reasoning from the diff.
Four sections carry the weight. The architecture rules that must not be broken,
each of which fails silently rather than loudly — intelligence never lives in
the API, authentication is not authorization, cost is charged against the full
commitment, sold and held are different things. The traps that have already
cost time here, with the specific symptom each produces: onConflictDoNothing
being a no-op without a constraint, z.coerce.boolean turning "false" into true,
grid children needing min-w-0, Drizzle emitting a cast Postgres rejects, the
CSP allowing exactly one inline script by hash, and the Prime Intellect API
quoting node totals rather than per-GPU prices. The conventions, including that
comments explain why rather than what. And an explicit start order.
The last section says what not to do, which is the part most easily lost: do
not copy component files from the MIT project we borrowed ideas from, do not
open self-registration on a shared identity provider, do not put a production
key on the CI runner, do not weaken the guard that refuses to serve the CRM
unauthenticated, and do not invent email addresses for real people.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
karti