Ship account-aware v0-style Studio flow - #23

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

lib/studio-account-profile.ts (1)

5-14: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Make the display-name truncation and the initial locale-independent.

Line 14 calls toLocaleUpperCase() with no locale argument, so the result depends on the ambient default locale of the runtime. The server runtime locale and the browser locale can differ, and drops-studio.tsx renders this initial in markup, so the values can disagree during hydration. Line 6 also truncates by UTF-16 code unit, which can split a surrogate pair at position 160.

♻️ Proposed change

-  const normalized = value?.trim().replace(/\s+/g, " ") ?? "";
-  return normalized ? normalized.slice(0, 160) : fallback;
+  const normalized = value?.trim().replace(/\s+/g, " ") ?? "";
+  return normalized ? Array.from(normalized).slice(0, 160).join("") : fallback;
 }
 
 export function studioAccountInitial(
   value: string | null | undefined,
   fallback = "D",
 ): string {
   const displayName = studioAccountDisplayName(value, "");
-  return Array.from(displayName)[0]?.toLocaleUpperCase() ?? fallback;
+  return Array.from(displayName)[0]?.toLocaleUpperCase("en-US") ?? fallback;
 }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@lib/studio-account-profile.ts` around lines 5 - 14, Update
studioAccountDisplayName and studioAccountInitial to make normalization
deterministic: truncate the normalized display name by Unicode code points
without splitting surrogate pairs, and uppercase the selected initial with an
explicit locale-independent locale. Preserve the existing fallback behavior for
empty or missing display names.

app/api/auth/google/callback/route.ts (1)

60-62: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Avoid the dynamic re-import of @/lib/access-tier.

createStudioAccountCookie, resolveAccountCookieSecret, and STUDIO_ACCOUNT_COOKIE are already statically imported from @/lib/access-tier at the top of the file. Add readStudioAccountCookie to that same static import instead of dynamically re-importing the module here.

♻️ Proposed fix

 import {
   createStudioAccountCookie,
+  readStudioAccountCookie,
   resolveAccountCookieSecret,
   STUDIO_ACCOUNT_COOKIE,
 } from "`@/lib/access-tier`";
@@
-    const account = await import("`@/lib/access-tier`").then(({ readStudioAccountCookie }) =>
-      readStudioAccountCookie(accountCookie, signingSecret),
-    );
+    const account = readStudioAccountCookie(accountCookie, signingSecret);

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@app/api/auth/google/callback/route.ts` around lines 60 - 62, Update the
existing static import from "`@/lib/access-tier`" to include
readStudioAccountCookie, then call it directly in the account initialization
instead of dynamically importing the module. Preserve the existing arguments and
behavior.

db/studio-account-state.ts (1)

180-189: 🩺 Stability & Availability | 🔵 Trivial | 🏗️ Heavy lift

Add a repair path for an unparsable stored record.

readStored throws StudioAccountStateUnavailableError when parseState rejects the stored JSON. mutateState reads before every write. One malformed record therefore blocks read, save, and delete for that account forever, and the operator has no recovery route through the API.

Keep the strict read for the account API, but give writes a bounded recovery: copy the unreadable record to a quarantine path, then continue from emptyState(). Record the event so the loss is visible.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@db/studio-account-state.ts` around lines 180 - 189, Add bounded recovery in
mutateState for StudioAccountStateUnavailableError from readStored: copy the
unreadable record to a quarantine path, record the recovery event, and continue
mutation from emptyState(). Keep readStored strict for account API reads, and
ensure quarantine or logging failures do not silently overwrite the original
record.

app/api/account/connections/route.ts (1)

28-45: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Move sameOrigin into one shared module.

This function repeats the logic in app/api/agent/plan/route.ts lines 61-75 and the builder variant. The copies already differ: this version rejects a request with no origin header, the plan route accepts it outside production. Divergent copies of a cross-site guard become a security defect over time.

Extract one helper, expose the "missing origin" behavior as an option, and call it from every route.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@app/api/account/connections/route.ts` around lines 28 - 45, Extract the
duplicated sameOrigin logic into a shared helper module, preserving its existing
host, protocol, origin, and sec-fetch-site validation. Add an option controlling
whether a missing Origin header is accepted, then update the connections route,
plan route, and builder variant to call the shared helper with their intended
missing-origin behavior.

lib/studio-account-state.ts (1)

67-79: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Derive the vault key with a KDF, not a single SHA-256 pass.

resolveConnectionVaultKey hashes the configured passphrase one time. The result has no salt and no work factor. DROPS_CONNECTION_VAULT_KEY only needs 32 bytes of text, so an operator can supply a low-entropy passphrase. If a stored record leaks, an offline guess of the passphrase decrypts every remembered credential.

Use hkdfSync with a fixed context string, or scryptSync for passphrase input. Record the derivation version inside EncryptedStudioConnection so existing records stay readable during migration.

🔐 Suggested derivation change

-import {
-  createCipheriv,
-  createDecipheriv,
-  createHash,
-  randomBytes,
-} from "node:crypto";
+import {
+  createCipheriv,
+  createDecipheriv,
+  hkdfSync,
+  randomBytes,
+} from "node:crypto";
@@
-  return createHash("sha256").update(configured, "utf8").digest();
+  return Buffer.from(hkdfSync(
+    "sha256",
+    Buffer.from(configured, "utf8"),
+    Buffer.from("drops-studio-connection-vault:v1", "utf8"),
+    Buffer.from("drops-studio-connection-key", "utf8"),
+    32,
+  ));

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@lib/studio-account-state.ts` around lines 67 - 79, Update
resolveConnectionVaultKey to derive the vault key with a password-appropriate
KDF such as scryptSync, or hkdfSync with the specified fixed context, instead of
a single unsalted SHA-256 pass. Add a derivation-version field to
EncryptedStudioConnection and use it when reading records so existing encrypted
records remain decryptable during migration.

tests/studio-account-state.test.mjs (1)

8-72: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add coverage for the blob persistence layer.

These tests cover the vault primitives well. The persistence layer in db/studio-account-state.ts has no test, and it holds the riskiest logic: the conditional-write retry loop, the parseState rejection path, the 96 KiB bound, and the pre-v1 envelope fallback in readStudioConnectionSecret.

Every exported function accepts storageOverride, so a fake BlobStorage with get and put can drive these paths without network access. Add cases for a first write with no ETag, a concurrent ETag mismatch followed by a successful retry, and a stored record that fails validation.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/studio-account-state.test.mjs` around lines 8 - 72, Add tests for the
persistence functions in db/studio-account-state.ts using a fake BlobStorage
supplied through storageOverride. Cover an initial write without an ETag, a
conditional-write ETag mismatch followed by a successful retry, parseState
rejection for invalid stored data, the 96 KiB size limit, and pre-v1 envelope
fallback in readStudioConnectionSecret; verify the expected get/put behavior and
outcomes without network access.

app/api/builder/shared.ts (1)

264-271: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Replace the repeated provider list and the cast with one typed constant.

The supported provider names appear at line 254 and again at line 265, and line 270 casts the value to a union that no check guarantees. A typed constant plus a type guard removes the cast and keeps the two lists in sync.

♻️ Suggested refactor

+const REMEMBERED_PROVIDERS = ["openai", "anthropic", "openrouter", "kimi", "custom"] as const;
+type RememberedProvider = (typeof REMEMBERED_PROVIDERS)[number];
+
+function isRememberedProvider(value: string): value is RememberedProvider {
+  return (REMEMBERED_PROVIDERS as readonly string[]).includes(value);
+}
@@
-  const provider = selection.provider;
-  if (!["openai", "anthropic", "openrouter", "kimi", "custom"].includes(provider)) {
-    return { credentials, selection };
-  }
-  const remembered = await readStudioConnectionSecret(
-    account.identity,
-    provider as "openai" | "anthropic" | "openrouter" | "kimi" | "custom",
-  ).catch(() => null);
+  const provider = selection.provider;
+  if (!isRememberedProvider(provider)) return { credentials, selection };
+  const remembered = await readStudioConnectionSecret(account.identity, provider)
+    .catch(() => null);

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@app/api/builder/shared.ts` around lines 264 - 271, Define one typed
supported-provider constant near the existing provider definitions and reuse it
for validation in the selection flow. Replace the inline provider list and the
cast passed to readStudioConnectionSecret with a type guard that narrows
provider to the supported-provider union before the call, keeping both checks
synchronized.

components/drops-studio-dialogs.tsx (1)

168-192: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Give the account card an accessible name.

The section element has no accessible name, so assistive technology announces it as a generic region. Add aria-label to describe it.

♿ Proposed change

-            <section className={`studio-account-card ${accountProfile ? "connected" : ""}`}>
+            <section
+              aria-label="Studio account"
+              className={`studio-account-card ${accountProfile ? "connected" : ""}`}
+            >

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@components/drops-studio-dialogs.tsx` around lines 168 - 192, Add an
aria-label to the account card section in the account profile UI so assistive
technology announces a descriptive accessible name. Update the section element
containing the account avatar, profile details, and sign-in/sign-out button;
keep its existing class and content unchanged.

lib/member-project-sync-client.ts (1)

212-234: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

Accept an optional expectedRevision to avoid one full listing per delete.

deleteMemberProjectFromCloud calls listMemberProjectsFromCloud() on every invocation. The bulk deletion loop in components/drops-studio.tsx (lines 1982-1994) calls it once per project, so deleting N projects issues N full listings plus N deletes. Let callers pass a known revision and fall back to the listing only when the revision is absent.

♻️ Proposed refactor

 export async function deleteMemberProjectFromCloud(
   projectId: string,
+  expectedRevision?: number,
 ): Promise<void> {
-  const listing = await listMemberProjectsFromCloud();
-  const current = listing.projects.find((project) => project.id === projectId);
-  if (!current) return;
+  let revision = expectedRevision;
+  if (revision === undefined) {
+    const listing = await listMemberProjectsFromCloud();
+    const current = listing.projects.find((project) => project.id === projectId);
+    if (!current) return;
+    revision = current.revision;
+  }
   const response = await fetch("/api/projects", {
     method: "DELETE",
     credentials: "same-origin",
     headers: {
       accept: "application/json",
       "content-type": "application/json",
     },
     body: JSON.stringify({
       id: projectId,
-      expectedRevision: current.revision,
+      expectedRevision: revision,
     }),
   });

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@lib/member-project-sync-client.ts` around lines 212 - 234, Update
deleteMemberProjectFromCloud to accept an optional expectedRevision parameter
and use it directly when provided. Only call listMemberProjectsFromCloud and
resolve the project revision when the parameter is absent, preserving the
existing not-found behavior and DELETE request handling.

components/drops-studio.tsx (1)

1982-1994: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Continue the bulk deletion after a single project fails.

deleteAllProjectsFromLibrary awaits deleteProjectRecord inside the loop. The first rejection exits the loop, so the remaining projects stay in place even when they could be deleted. Collect the failures and report them after the loop.

♻️ Proposed change

-    try {
-      for (const project of [...projects]) await deleteProjectRecord(project);
-      setProjects([]);
-      setToast("All projects deleted.");
-    } catch (error) {
-      setToast(error instanceof Error ? error.message : "Some projects could not be deleted.");
-    }
+    const failures: string[] = [];
+    for (const project of [...projects]) {
+      try {
+        await deleteProjectRecord(project);
+      } catch {
+        failures.push(project.spec.name);
+      }
+    }
+    setToast(
+      failures.length
+        ? `These projects could not be deleted: ${failures.join(", ")}.`
+        : "All projects deleted.",
+    );

deleteProjectRecord already updates the project list after each successful deletion, so the explicit setProjects([]) is no longer required.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@components/drops-studio.tsx` around lines 1982 - 1994, Update
deleteAllProjectsFromLibrary to attempt every project even when an individual
deleteProjectRecord call fails, collecting failed deletions and reporting them
after the loop. Remove the redundant setProjects([]), preserve successful
deletion updates, and show an appropriate success or failure summary in the
toast based on the collected failures.

e2e/fixtures/ui-test.ts (1)

59-63: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Document why the reset runs only once per session.

The addInitScript callback runs for every document in the context. The new marker makes the storage reset run only on the first document, so state that a test creates during later navigations survives. Add a short comment so a later reader does not remove the guard. Note the behavior change: a second prepareHomePage call in the same context no longer clears storage.

♻️ Proposed change

+    // This init script runs on every document. Reset storage only on the
+    // first one so state created during the flow survives later navigations.
     const seedKey = "drops-studio:e2e-home-seeded"

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@e2e/fixtures/ui-test.ts` around lines 59 - 63, Add a concise comment
immediately above the seedKey/sessionStorage guard in the addInitScript callback
explaining that the marker limits storage clearing to the first document per
session, preserving state across later navigations and repeated prepareHomePage
calls; do not change the existing reset behavior.

components/project-studio.tsx (2)

2014-2019: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Log the discarded error before showing the generic fallback message.

void error; drops the original failure with no logging, so there is no trace to diagnose why the connected model failed. Keep the generic user-facing message (it intentionally avoids leaking provider-specific text), but log the error for diagnostics.

♻️ Proposed fix

-      } catch (error) {
-        void error;
+      } catch (error) {
+        console.error("Project V2 agent edit failed", error);

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@components/project-studio.tsx` around lines 2014 - 2019, Replace the
discarded `error` expression in the failure-handling path with diagnostic
logging before constructing the generic `assistant` fallback message. Preserve
the existing user-facing message and avoid exposing provider-specific error
details in it.

---

1013-1018: 🎯 Functional Correctness | 🔵 Trivial | 💤 Low value

Remove or consume the autobuild query parameter.

autobuild=1 has no runtime consumer. Project V2 auto-build uses a session-storage key instead. Remove the parameter and update the URL assertions, or implement URL handling.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@components/project-studio.tsx` around lines 1013 - 1018, Update the project
initialization logic near requestedPanel in project-studio.tsx to remove or
consume the obsolete autobuild query parameter; preserve Project V2 auto-build
through its existing session-storage mechanism, and update any related URL
assertions to match the parameter’s removal if it is no longer handled.

components/telegram-channel-wizard.tsx (1)

92-113: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

Consider rendering the phone-entry form immediately while the account check runs in the background.

This effect now always calls /api/telegram/account/status, even when there is no saved accountToken, to support cross-session restore for signed-in accounts. First-time users (no saved token, not signed in) now wait for this round trip before the phone-entry form appears, instead of seeing it immediately as before.

Consider showing the phone phase optimistically by default, and only switching to "connected" if the status check confirms a restored account, so first-time users are not delayed by a network round trip that will return nothing for them.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@components/telegram-channel-wizard.tsx` around lines 92 - 113, Initialize the
Telegram wizard in the phone-entry phase with checking disabled so first-time
users see the form immediately, while keeping the status request in the existing
useEffect for background restoration. When the response confirms a valid
account, continue switching to the connected phase and populating the account
state; preserve the existing fallback cleanup and phone-phase behavior for
failed or missing restoration.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes