auth/env hardening and reliability updates

.github/workflows/ci.yml

@@ -25,6 +25,9 @@ jobs:
     - name: Type check
       run: bun run tsc --noEmit
 
+    - name: Run unit tests
+      run: bun run test:unit
+
     - name: Build frontend
       run: bun run build
 
@@ -71,16 +74,50 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v4
 
+    - name: Setup Bun
+      uses: oven-sh/setup-bun@v2
+      with:
+        bun-version: latest
+
+    - name: Install dependencies
+      run: bun install --frozen-lockfile
+
     - name: Run security audit
       run: |
-        bun audit || true  # Don't fail on audit issues for now
+        audit_log="$(mktemp)"
+        last_exit=0
+        for attempt in 1 2 3; do
+          if bun audit >"$audit_log" 2>&1; then
+            cat "$audit_log"
+            rm -f "$audit_log"
+            exit 0
+          else
+            audit_exit=$?
+            last_exit=$audit_exit
+            last_attempt=$attempt
+            if [ "$attempt" -lt 3 ]; then
+              echo "bun audit failed (attempt $attempt), retrying..."
+              sleep 5
+            fi
+          fi
+        done
+
+        audit_output="$(cat "$audit_log")"
+        echo "bun audit failed after ${last_attempt:-3} attempts with exit code ${last_exit}"
+        if grep -Eiq 'network|registry|ENOTFOUND|ECONNREFUSED|EAI_AGAIN|ETIMEDOUT' "$audit_log"; then
+          echo "bun audit failed after retries due to network/registry error: $audit_output"
+        else
+          echo "bun audit failed after retries - vulnerabilities detected: $audit_output"
+        fi
+        rm -f "$audit_log"
+        exit 1
 
     - name: Check for secrets
-      uses: trufflesecurity/trufflehog@main
+      # Pinned to immutable commit (v3.93.4) for supply-chain safety.
+      uses: trufflesecurity/trufflehog@7c0734f987ad0bb30ee8da210773b800ee2016d3
       with:
         path: ./
         extra_args: --debug --only-verified
-      continue-on-error: true
 
   docker:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -73,6 +73,12 @@ jobs:
         echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT
         echo "version_number=${NEW_VERSION#v}" >> $GITHUB_OUTPUT
 
+    - name: Type check
+      run: bun run tsc --noEmit
+
+    - name: Run backend tests
+      run: bun run test:unit
+
     - name: Build application
       run: bun run build
 

.gitignore

@@ -64,7 +64,7 @@ data/.session-secret
 test-*.sh
 debug-*.js
 verify-*.md
-.DS_Store
+test-results/
 
 # LLM files
 .claude

frontend/components/ui/peer-list.tsx

@@ -390,7 +390,7 @@ const PeerList: React.FC<PeerListProps> = ({
       window.removeEventListener('peerStatusUpdate', handlePeerUpdate as EventListener);
       window.removeEventListener('peerPingUpdate', handlePeerUpdate as EventListener);
     };
-  }, [isSignerRunning]);
+  }, [authHeaders, isSignerRunning]);
 
   // Ping individual peer
   const handlePingPeer = useCallback(async (peerPubkey: string) => {
@@ -434,7 +434,7 @@ const PeerList: React.FC<PeerListProps> = ({
         return newSet;
       });
     }
-  }, [isSignerRunning]);
+  }, [authHeaders, isSignerRunning]);
 
   const updatePeerPolicy = useCallback(async (peer: PeerStatus, changes: { allowSend?: boolean; allowReceive?: boolean }) => {
     if (!isSignerRunning || disabled) {
@@ -525,7 +525,7 @@ const PeerList: React.FC<PeerListProps> = ({
       return;
     }
     try {
-      const response = await fetch('/api/peers/ping', {
+      await fetch('/api/peers/ping', {
         method: 'POST',
         headers: { 
           'Content-Type': 'application/json',
@@ -534,14 +534,12 @@ const PeerList: React.FC<PeerListProps> = ({
         body: JSON.stringify({ target: 'all' })
       });
 
-      const result = await response.json();
-
       // Refresh peer list after pinging all
       await fetchPeers();
     } catch (error) {
       console.warn('[PeerList] Ping all failed:', error);
     }
-  }, [isSignerRunning, peers.length, fetchPeers]);
+  }, [authHeaders, isSignerRunning, peers.length, fetchPeers]);
 
   // Enhanced refresh that includes pinging
   const handleRefresh = useCallback(async () => {
@@ -597,6 +595,7 @@ const PeerList: React.FC<PeerListProps> = ({
         className="flex flex-col sm:flex-row sm:items-center justify-between bg-gray-800/50 p-2.5 rounded cursor-pointer hover:bg-gray-800/70 transition-colors gap-2 sm:gap-0"
         onClick={handleToggle}
         role="button"
+        aria-expanded={isExpanded}
         tabIndex={0}
         onKeyDown={(e) => {
           if (e.key === 'Enter' || e.key === ' ') {
@@ -611,11 +610,20 @@ const PeerList: React.FC<PeerListProps> = ({
             <ChevronDown className="h-4 w-4 text-blue-400 flex-shrink-0" />
           }
           <span className="text-blue-200 text-sm font-medium select-none">Peer List</span>
-          <div onClick={e => e.stopPropagation()}>
+          <div onClick={e => e.stopPropagation()} onKeyDown={e => e.stopPropagation()}>
             <Tooltip
               position="right"
               width="w-64"
-              trigger={<HelpCircle size={16} className="text-blue-400 cursor-pointer" />}
+              focusable
+              trigger={(
+                <button
+                  type="button"
+                  aria-label="Peer list help"
+                  className="inline-flex items-center text-blue-400 cursor-pointer"
+                >
+                  <HelpCircle size={16} />
+                </button>
+              )}
               content={
                 <p>Shows the signing peers in your FROSTR group with online/offline status and ping latency. Use the refresh button to ping all peers and update their status.</p>
               }
@@ -654,7 +662,7 @@ const PeerList: React.FC<PeerListProps> = ({
             )}
           </div>
         </div>
-        <div onClick={e => e.stopPropagation()} className="flex-shrink-0">
+        <div onClick={e => e.stopPropagation()} onKeyDown={e => e.stopPropagation()} className="flex-shrink-0">
           {actions}
         </div>
       </div>
@@ -665,7 +673,9 @@ const PeerList: React.FC<PeerListProps> = ({
           "transition-all duration-300 ease-in-out overflow-hidden",
           isExpanded ? "max-h-[400px] opacity-100" : "max-h-0 opacity-0"
         )}
+        aria-hidden={!isExpanded}
       >
+        {isExpanded && (
         <div className="bg-gray-900/30 rounded border border-gray-800/30 p-4 space-y-4">
           {isLoading ? (
             <div className="flex items-center justify-center py-8">
@@ -770,10 +780,7 @@ const PeerList: React.FC<PeerListProps> = ({
                             </div>
                             <div className="mt-1 flex flex-wrap items-center gap-2 text-xs text-gray-400">
                               <span className="whitespace-nowrap">Policy: out {outboundPolicy.statusLabel}, in {inboundPolicy.statusLabel}</span>
-                              <Badge
-                                variant={policyBadgeVariant as any}
-                                className="text-xs px-2 py-0.5 whitespace-nowrap"
-                              >
+                              <Badge variant={policyBadgeVariant} className="text-xs px-2 py-0.5 whitespace-nowrap">
                                 {policyBadgeLabel}
                               </Badge>
                             </div>
@@ -896,6 +903,7 @@ const PeerList: React.FC<PeerListProps> = ({
             </div>
           )}
         </div>
+        )}
       </div>
     </div>
   );

frontend/types/index.ts

@@ -124,6 +124,7 @@ export interface UpdateInfo {
   updateAvailable: boolean;
   releaseUrl?: string;
   checkedAt?: string;
+  source?: 'github-release' | 'github-tags';
   error?: string;
 }