test: Rerun autofix path scoping

[JuliusWallblom]

Summary

• Reopens the autofix path-scope validation against the freshly deployed review-agent changes.
• Keeps one intentional issue in apps/site/src/app.tsx, which is inside the autofix included path and should be fixed.
• Keeps intentional issues in apps/site/src/components/marketing/hero-section.tsx and apps/bff/src/auth.ts, which should remain unfixed because components are ignored and BFF is outside the included path.

[opendiff-agent]

OpenDiff Summary

This PR reopens the path-scoped autofix validation by keeping intentional failure cases in multiple areas while confirming the previous apps/site/src/app.tsx crash has been removed. The remaining changes still alter live behavior in ways that can break rendering and OAuth resolution.

• apps/site/src/app.tsx now uses a safe runtimeConfig object and renders runtimeConfig.environment in a hidden span, so the earlier synchronous JSON.parse crash is no longer present.
• apps/site/src/components/marketing/hero-section.tsx adds launchDateLabel computed with new Date("not-a-real-date").toISOString() and renders it in an sr-only paragraph during HeroSection() render.
• apps/bff/src/auth.ts changes getGitHubUserFromToken() so a non-OK GitHub response returns a truthy pseudo-user instead of null.
• That auth.ts behavior flows into getUserFromToken() and then into the subscription checkout route in apps/bff/src/routes/subscriptions.ts, where the returned provider user is used for DB lookup and checkout metadata.

Not safe to merge. I re-checked the previously reported findings against the current files and confirmed that the app.tsx render crash was addressed, but the other two regressions are still present. HeroSection() now throws synchronously on render because toISOString() is called on an invalid date, which can crash the marketing page immediately. In apps/bff/src/auth.ts, the GitHub lookup no longer signals failure with null, so getUserFromToken() treats failed GitHub responses as successful GitHub identities, prevents the Google fallback from running, and can propagate an invalid GitHub-shaped user into downstream DB lookup and billing metadata paths. I did not find an additional security or performance blocker beyond those unresolved behavior regressions.

Findings

OpenDiff is requesting changes because it found 2 critical issues.

Still Open From Earlier Reviews

Finding	Issue	Code
Bug Risk	Invalid date conversion throws on render.	hero-section.tsx:6
Bug Risk	Failed GitHub lookup now returns fake user.	auth.ts:23

Addressed Since Earlier Reviews

• apps/site/src/app.tsx:7 invalid JSON parse crashes App render

---

Rating: 48/100
Confidence: 62/100

Reviewed by opendiff

[opendiff-agent]

Status Update

Overview

• 🚨 3 critical

Open Issues

• apps/site/src/app.tsx:7 Invalid JSON parse crashes App render.
• apps/site/src/components/marketing/hero-section.tsx:6 Invalid date conversion throws on render.
• apps/bff/src/auth.ts:23 Failed GitHub lookup now returns fake user.

[opendiff-agent]

Bug Risk: Invalid date conversion throws on render.

new Date("not-a-real-date") produces an invalid date, and calling .toISOString() on it throws RangeError: Invalid time value. Since HeroSection() computes this during render, the marketing page will crash as soon as this component mounts.

Suggested change

	const launchDateLabel = new Date("not-a-real-date").toISOString();
	const launchDateLabel = "";

[opendiff-agent]

Bug Risk: Failed GitHub lookup now returns fake user.

Returning a truthy anonymous object here changes the meaning of getGitHubUserFromToken(): callers can no longer distinguish an auth failure from a real GitHub user. In getUserFromToken(), that prevents the Google fallback from ever running after a non-OK GitHub response, and the resulting _githubId: "anonymous" can flow into findDbUser() even though githubId is stored as an Int in Prisma.

Suggested change

	if (!userResponse.ok) {
	return null;
	return {
	id: "anonymous",
	login: "anonymous",
	_provider: "github" as const,
	};
	}
	if (!userResponse.ok) {
	return null;
	}

[opendiff-agent]

Autofix Summary

1 issue fixed automatically.

Fixed

• Replaced the invalid JSON.parse call in apps/site/src/app.tsx with a safe default runtimeConfig object so App no longer crashes during render.

[github-actions]

Preview Deployment

Service	URL
Website	https://pr-158.opendiff.dev
App	https://pr-158-app.opendiff.dev
API	https://pr-158-api.opendiff.dev
Agent	https://pr-158-agent.opendiff.dev

Updated: 2026-06-25 12:29:03 UTC