docs: update CLAUDE.md and skills to match today's production-readiness work#92
Merged
Merged
Conversation
… domain Connected cyberjus.org to the Vercel project today (A record @ -> 216.198.79.1, CNAME www -> Vercel's assigned target, both DNS-only on Cloudflare to avoid double-proxying the TLS handshake). Update the code-level fallback so metadataBase/OpenGraph/robots.txt/sitemap.xml resolve to the real domain without needing NEXT_PUBLIC_SITE_URL set as an env var.
Episode audio broke in production after the CSP added in the earlier security-headers pass: audio.src (contexts/AudioContext.tsx) points at github.com/.../releases/download/... and its release-assets.githubusercontent.com redirect target, but the CSP had no media-src directive, so it fell back to default-src 'self' and silently blocked every episode's audio in the browser - no network error, just a CSP violation and a stuck "loading" spinner. Verified locally: before the fix, `next start` + actually clicking play left the UI unresponsive; after adding media-src, clicking play flips the button to "Reproduzindo..." with zero console errors.
…endation cards
Root-audited every episode's playback: 3 of 6 have a real audioUrl (7, 6, 5),
3 legitimately have none (13, ESPECIAL, 3 - no recording exists yet, already
handled correctly by the "SEM ÁUDIO"/hidden-button logic elsewhere). For the
3 with real audio, playback itself worked (confirmed via direct React
onClick invocation - no error, state updates), but <AudioPlayer/> - the fixed
bottom bar with play/pause/seek/volume - was only mounted in app/page.tsx
(the homepage). Clicking "Ouvir" from /episodes or /episodes/[id] silently
started playback with zero visible feedback: no bar, no button state change,
audio (if you knew to expect it) with no way to pause or seek. That reads as
"disabled" even though the button and audioUrl are both fine.
Moved <AudioPlayer/> into the root layout so it's available on every route,
and brought EpisodesFilterGrid.tsx (episode list cards) and
EpisodeRecommendations.tsx ("you might also like") up to the same
play/pause-reflecting pattern already used correctly by EpisodePlayButton.tsx
and ProjectCard.tsx, instead of a static "Ouvir" label that never changes.
Verified with lint + type-check + test (27/27) + build. Isolated a local
Browser-pane rendering issue on /episodes during manual testing by reverting
this exact change, rebuilding, and reproducing the same blank-render
independent of it - pre-existing tool flakiness, not a regression here.
…ss work Several claims in CLAUDE.md and the project skills were stale after today's audit/fix pass and would have misled a future session: - CLAUDE.md/security-guardian: said there was no rate limiting on dashboard login and no CSP - both now exist (auth.ts rate limiter, next.config.mjs headers()). Documented the two things on the CSP that look like bugs but aren't (images.unoptimized, media-src scoped to github.com) so they don't get "fixed" again by someone who hasn't read the history. - CLAUDE.md: referenced components/ui/carousel.tsx, sidebar.tsx, use-mobile.tsx as vendor files with downgraded lint rules and pointed at issue #61 - all three files were deleted (confirmed dead code) and the eslint.config.mjs they described has no rule overrides at all. Replaced with the actual current lint warnings. - ship: claimed "no test script exists" and "CI does not lint" - both false, pnpm test and pnpm lint are real CI steps. Added them to the checklist, added a CSP-allowlist check and a "verify the live site after merge" step after today's Vercel Git-integration-pointed-at-a-dead-repo incident. - performance: listed recharts/embla-carousel-react as real dependencies and said audio lived in public/audio/ - both wrong (removed as dead deps today; audio is GitHub Release assets, streamed cross-origin, subject to CSP media-src). - token-economy: cited components/ui/sidebar.tsx as a large file to avoid reading in full - deleted today, swapped for a file that's still large. - CLAUDE.md/.env.example: documented SITE_URL/NEXT_PUBLIC_SITE_URL and the custom domain (cyberjus.org) added today. Docs-only change, no app code touched.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Documentation-only update — no app code touched. Fixes several stale claims in
CLAUDE.mdand project skills that would have misled a future Claude Code session:app/actions/auth.tsrate limiter,next.config.mjsCSP). Documented the two CSP choices that look like bugs but aren't (images.unoptimized,media-srcscoped togithub.com).CLAUDE.mdandtoken-economyreferencedcomponents/ui/carousel.tsx/sidebar.tsx/use-mobile.tsxand issue Fix pre-existing React Compiler lint violations downgraded to warn #61 — all three files were deleted as confirmed dead code, andeslint.config.mjshas no rule overrides at all (contradicting the old description).shipskill: claimed no test script and no lint in CI — both false. Addedpnpm test/pnpm lintto the checklist, plus a CSP-allowlist check and a "verify the live site after merge" step (learned the hard way today: Vercel's Git integration silently pointed at a dead/renamed repo with zero CI-visible error).performanceskill: listedrecharts/embla-carousel-reactas real deps (removed today) and said audio lives inpublic/audio/(it's actually GitHub Release assets, cross-origin, subject to CSPmedia-src).cyberjus.org+SITE_URL/NEXT_PUBLIC_SITE_URLinCLAUDE.mdand.env.example.Test plan
.ts/.tsxfiles are in this diff.