fix(security): avoid rendering raw error messages in UI; enforce via ESLint

.github/scripts/README.md

@@ -0,0 +1,33 @@
+Watch and Fix automation
+
+This folder contains a small script to watch a workflow's recent runs and automatically create
+a retry-based fix PR if a failing run is detected.
+
+Usage:
+
+```bash
+# PowerShell (temporary env):
+`$env:GITHUB_TOKEN='...'; node .github/scripts/watch_and_fix.cjs --owner OWNER --repo REPO [--minutes 60] [--poll 60]; Remove-Item Env:GITHUB_TOKEN`
+
+# Or set for session then run:
+`$env:GITHUB_TOKEN='...'
+node .github/scripts/watch_and_fix.cjs --owner OWNER --repo REPO [--minutes 60] [--poll 60]
+Remove-Item Env:GITHUB_TOKEN`
+
+# cmd.exe one-liner:
+`set "GITHUB_TOKEN=..." && node .github/scripts/watch_and_fix.cjs --owner OWNER --repo REPO [--minutes 60] [--poll 60]`
+
+# Recommended: use the `gh` CLI wrapper which authenticates securely and runs the watcher without exposing the PAT:
+```powershell
+# Authenticate (interactive)
+gh auth login
+
+# Then run the wrapper (uses gh auth token under the hood)
+powershell -File .github/scripts/run_watcher.ps1 -Owner 73junito -Repo autolearnpro -Minutes 60 -Poll 60
+```
+
+Notes:
+- Script requires Node 18+ (global `fetch`).
+- The script creates a branch and PR that adds a retry loop around `pnpm install` in
+  `.github/workflows/storybook.yml` to mitigate transient install failures.
+  Use the `.cjs` script when the repo has `"type": "module"` in `package.json`.

.github/scripts/run_watcher.ps1

@@ -0,0 +1,36 @@
+# PowerShell wrapper: ensures `gh` auth and runs the watcher securely.
+param(
+  [string]$Owner = '73junito',
+  [string]$Repo  = 'autolearnpro',
+  [int]$Minutes = 60,
+  [int]$Poll = 60
+)
+
+# Check gh
+if (-not (Get-Command gh -ErrorAction SilentlyContinue)) {
+  Write-Host "gh CLI not found. Install from https://cli.github.com/ or use winget: winget install --id GitHub.cli -e --source winget"
+  exit 1
+}
+
+# Ensure gh is authenticated
+$auth = gh auth status 2>&1
+if ($LASTEXITCODE -ne 0) {
+  Write-Host "Not authenticated. Running 'gh auth login'..."
+  gh auth login
+  if ($LASTEXITCODE -ne 0) { Write-Error "gh auth login failed"; exit 1 }
+}
+
+# Get token from gh
+$token = gh auth token 2>&1
+if ($LASTEXITCODE -ne 0 -or -not $token) {
+  Write-Error "Failed to obtain token from 'gh auth token'"
+  exit 1
+}
+
+# Run watcher with token in env (session only)
+$env:GITHUB_TOKEN = $token
+try {
+  node .github/scripts/watch_and_fix.cjs --owner $Owner --repo $Repo --minutes $Minutes --poll $Poll
+} finally {
+  Remove-Item Env:GITHUB_TOKEN -ErrorAction SilentlyContinue
+}

.github/scripts/watch_and_fix.cjs

@@ -0,0 +1,142 @@
+#!/usr/bin/env node
+// CommonJS version of watch_and_fix for repositories with "type": "module".
+const { argv, env } = require('process');
+const fetch = globalThis.fetch;
+if (!fetch) {
+  console.error('Node runtime must support global fetch (Node 18+).');
+  process.exit(1);
+}
+
+function arg(name) {
+  const idx = argv.indexOf(`--${name}`);
+  return idx >= 0 ? argv[idx + 1] : undefined;
+}
+
+const OWNER = arg('owner');
+const REPO = arg('repo');
+const WORKFLOW = arg('workflow') || 'storybook.yml';
+const DURATION_MIN = Number(arg('minutes') || '60');
+const POLL_SEC = Number(arg('poll') || '60');
+let TOKEN = env.GITHUB_TOKEN;
+// If no env var provided, try to use `gh auth token` if available to avoid prompting for PAT
+if (!TOKEN) {
+  try {
+    const { execSync } = require('child_process');
+    const out = execSync('gh auth token', { stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim();
+    if (out) {
+      TOKEN = out;
+      console.log('Using token from `gh auth token`.');
+    }
+  } catch (e) {
+    // ignore - will error later if TOKEN still unset
+  }
+}
+
+if (!OWNER || !REPO) {
+  console.error('Usage: node watch_and_fix.cjs --owner OWNER --repo REPO [--minutes 60] [--poll 60]');
+  process.exit(2);
+}
+
+if (!TOKEN) {
+  console.error('No GitHub token available. Set GITHUB_TOKEN or run `gh auth login` and ensure `gh auth token` returns a token.');
+  process.exit(2);
+}
+
+const API = `https://api.github.com/repos/${OWNER}/${REPO}`;
+
+async function gh(path, opts = {}) {
+  opts.headers = Object.assign({}, opts.headers || {}, {
+    Authorization: `token ${TOKEN}`,
+    'User-Agent': 'watch-and-fix-script',
+    Accept: 'application/vnd.github+json',
+  });
+  const res = await fetch(`${API}${path}`, opts);
+  if (!res.ok) {
+    const text = await res.text();
+    if (res.status === 401) {
+      throw new Error('Unauthorized (401): GitHub token invalid or missing required scopes.\n' +
+        'When running locally, create a Personal Access Token with `repo` scope and set it as GITHUB_TOKEN.\n' +
+        'See: https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token');
+    }
+    throw new Error(`${res.status} ${res.statusText} ${text}`);
+  }
+  return res.json();
+}
+
+async function getLatestRun() {
+  const path = `/actions/workflows/${WORKFLOW}/runs?per_page=1`;
+  const data = await gh(path);
+  return data.workflow_runs && data.workflow_runs[0];
+}
+
+async function createRetryFixPR(defaultBranch) {
+  const path = `/contents/.github/workflows/storybook.yml`;
+  const file = await gh(path + `?ref=${defaultBranch}`);
+  const content = Buffer.from(file.content, 'base64').toString('utf8');
+
+  const installBlockRegex = /- name: Install dependencies \(ui\)[\s\S]*?- name:/m;
+  const retryBlock = `- name: Install dependencies (ui)\n        working-directory: packages/ui\n        run: |\n          set -euo pipefail\n          echo "Installing dependencies with retries"\n          for i in 1 2 3; do\n            pnpm install --frozen-lockfile && break || { echo "pnpm install failed (attempt $i)"; sleep $((i * 5)); }\n          done\n\n      - name:`;
+
+  if (!installBlockRegex.test(content)) {
+    console.error('Could not find install block to replace. Aborting automated fix.');
+    return null;
+  }
+
+  const newContent = content.replace(installBlockRegex, retryBlock);
+
+  // create branch
+  const timestamp = Date.now();
+  const branch = `autofix/storybook-retry-${timestamp}`;
+  const defaultRef = await gh(`/git/ref/heads/${defaultBranch}`);
+  const sha = defaultRef.object.sha;
+  await gh('/git/refs', { method: 'POST', body: JSON.stringify({ ref: `refs/heads/${branch}`, sha }) });
+
+  // update file on new branch
+  const putPath = `/contents/.github/workflows/storybook.yml`;
+  const body = {
+    message: 'chore: retry pnpm install in Storybook workflow (automated)',
+    content: Buffer.from(newContent, 'utf8').toString('base64'),
+    branch,
+    sha: file.sha,
+  };
+  await gh(putPath, { method: 'PUT', body: JSON.stringify(body) });
+
+  // create PR
+  const pr = await gh('/pulls', {
+    method: 'POST',
+    body: JSON.stringify({ title: 'Automated: retry pnpm install for Storybook build', head: branch, base: defaultBranch, body: 'Automated fix: add retries to pnpm install to mitigate transient failures.' }),
+  });
+  return pr.html_url;
+}
+
+async function main() {
+  const repoInfo = await gh('');
+  const defaultBranch = repoInfo.default_branch || 'main';
+
+  const end = Date.now() + DURATION_MIN * 60 * 1000;
+  console.log(`Watching ${OWNER}/${REPO} workflow ${WORKFLOW} for ${DURATION_MIN} minutes (poll ${POLL_SEC}s)`);
+
+  let lastSeenRunId = null;
+  while (Date.now() < end) {
+    try {
+      const run = await getLatestRun();
+      if (run && run.id !== lastSeenRunId) {
+        lastSeenRunId = run.id;
+        console.log(`Latest run #${run.id} - status=${run.status} conclusion=${run.conclusion} url=${run.html_url}`);
+        if (run.conclusion && run.conclusion !== 'success') {
+          console.log('Detected failing run — attempting automated fix');
+          const prUrl = await createRetryFixPR(defaultBranch);
+          if (prUrl) console.log('Created PR:', prUrl);
+          else console.log('Automated fix not applied.');
+          return;
+        }
+      }
+    } catch (err) {
+      console.error('Error while checking runs:', err.message || err);
+    }
+    await new Promise(r => setTimeout(r, POLL_SEC * 1000));
+  }
+  console.log('Watch duration completed with no failing run detected.');
+}
+
+main().catch(err => { console.error(err); process.exit(1); });

.github/scripts/watch_and_fix.js

@@ -0,0 +1,118 @@
+#!/usr/bin/env node
+// Watch Storybook workflow runs for failures and create an automated retry-fix PR.
+// Usage: GITHUB_TOKEN=... node .github/scripts/watch_and_fix.js --owner OWNER --repo REPO
+
+const { argv, env } = require('process');
+const fetch = globalThis.fetch;
+if (!fetch) {
+  console.error('Node runtime must support global fetch (Node 18+).');
+  process.exit(1);
+}
+
+function arg(name) {
+  const idx = argv.indexOf(`--${name}`);
+  return idx >= 0 ? argv[idx + 1] : undefined;
+}
+
+const OWNER = arg('owner');
+const REPO = arg('repo');
+const WORKFLOW = arg('workflow') || 'storybook.yml';
+const DURATION_MIN = Number(arg('minutes') || '60');
+const POLL_SEC = Number(arg('poll') || '60');
+const TOKEN = env.GITHUB_TOKEN;
+
+if (!OWNER || !REPO || !TOKEN) {
+  console.error('Usage: GITHUB_TOKEN=... node watch_and_fix.js --owner OWNER --repo REPO [--minutes 60] [--poll 60]');
+  process.exit(2);
+}
+
+const API = `https://api.github.com/repos/${OWNER}/${REPO}`;
+
+async function gh(path, opts = {}) {
+  opts.headers = Object.assign({}, opts.headers || {}, {
+    Authorization: `token ${TOKEN}`,
+    'User-Agent': 'watch-and-fix-script',
+    Accept: 'application/vnd.github+json',
+  });
+  const res = await fetch(`${API}${path}`, opts);
+  if (!res.ok) throw new Error(`${res.status} ${res.statusText} ${await res.text()}`);
+  return res.json();
+}
+
+async function getLatestRun() {
+  const path = `/actions/workflows/${WORKFLOW}/runs?per_page=1`;
+  const data = await gh(path);
+  return data.workflow_runs && data.workflow_runs[0];
+}
+
+async function createRetryFixPR(defaultBranch) {
+  const path = `/contents/.github/workflows/storybook.yml`;
+  const file = await gh(path + `?ref=${defaultBranch}`);
+  const content = Buffer.from(file.content, 'base64').toString('utf8');
+
+  const installBlockRegex = /- name: Install dependencies \(ui\)[\s\S]*?- name:/m;
+  const retryBlock = `- name: Install dependencies (ui)\n        working-directory: packages/ui\n        run: |\n          set -euo pipefail\n          echo "Installing dependencies with retries"\n          for i in 1 2 3; do\n            pnpm install --frozen-lockfile && break || { echo "pnpm install failed (attempt $i)"; sleep $((i * 5)); }\n          done\n\n      - name:`;
+
+  if (!installBlockRegex.test(content)) {
+    console.error('Could not find install block to replace. Aborting automated fix.');
+    return null;
+  }
+
+  const newContent = content.replace(installBlockRegex, retryBlock);
+
+  // create branch
+  const timestamp = Date.now();
+  const branch = `autofix/storybook-retry-${timestamp}`;
+  const defaultRef = await gh(`/git/ref/heads/${defaultBranch}`);
+  const sha = defaultRef.object.sha;
+  await gh('/git/refs', { method: 'POST', body: JSON.stringify({ ref: `refs/heads/${branch}`, sha }) });
+
+  // update file on new branch
+  const putPath = `/contents/.github/workflows/storybook.yml`;
+  const body = {
+    message: 'chore: retry pnpm install in Storybook workflow (automated)',
+    content: Buffer.from(newContent, 'utf8').toString('base64'),
+    branch,
+    sha: file.sha,
+  };
+  await gh(putPath, { method: 'PUT', body: JSON.stringify(body) });
+
+  // create PR
+  const pr = await gh('/pulls', {
+    method: 'POST',
+    body: JSON.stringify({ title: 'Automated: retry pnpm install for Storybook build', head: branch, base: defaultBranch, body: 'Automated fix: add retries to pnpm install to mitigate transient failures.' }),
+  });
+  return pr.html_url;
+}
+
+async function main() {
+  const repoInfo = await gh('');
+  const defaultBranch = repoInfo.default_branch || 'main';
+
+  const end = Date.now() + DURATION_MIN * 60 * 1000;
+  console.log(`Watching ${OWNER}/${REPO} workflow ${WORKFLOW} for ${DURATION_MIN} minutes (poll ${POLL_SEC}s)`);
+
+  let lastSeenRunId = null;
+  while (Date.now() < end) {
+    try {
+      const run = await getLatestRun();
+      if (run && run.id !== lastSeenRunId) {
+        lastSeenRunId = run.id;
+        console.log(`Latest run #${run.id} - status=${run.status} conclusion=${run.conclusion} url=${run.html_url}`);
+        if (run.conclusion && run.conclusion !== 'success') {
+          console.log('Detected failing run — attempting automated fix');
+          const prUrl = await createRetryFixPR(defaultBranch);
+          if (prUrl) console.log('Created PR:', prUrl);
+          else console.log('Automated fix not applied.');
+          return;
+        }
+      }
+    } catch (err) {
+      console.error('Error while checking runs:', err.message || err);
+    }
+    await new Promise(r => setTimeout(r, POLL_SEC * 1000));
+  }
+  console.log('Watch duration completed with no failing run detected.');
+}
+
+main().catch(err => { console.error(err); process.exit(1); });