From 2c0721a15b1c37146f0203df598b74da958db251 Mon Sep 17 00:00:00 2001 From: vlad-ko Date: Thu, 9 Jul 2026 11:26:29 -0400 Subject: [PATCH 1/2] docs: setup.md cron section covers both authenticated cron routes Follow-up to the PR #143 review finding that landed post-merge: the vercel.json snippet and CRON_SECRET prose still described the recovery sweep only, so an operator following setup.md could miss why /api/cron/code-index 401s and the index never builds. Snippet now shows both crons; prose and env-table row state that CRON_SECRET gates both. Co-Authored-By: Claude Fable 5 --- docs/setup.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/docs/setup.md b/docs/setup.md index 04b92a4..d785829 100644 --- a/docs/setup.md +++ b/docs/setup.md @@ -175,7 +175,8 @@ The repo ships a `vercel.json` that schedules the recovery sweep — the endpoin ```json { "crons": [ - { "path": "/api/cron/sweep", "schedule": "*/5 * * * *" } + { "path": "/api/cron/sweep", "schedule": "*/5 * * * *" }, + { "path": "/api/cron/code-index", "schedule": "*/5 * * * *" } ] } ``` @@ -186,7 +187,7 @@ Vercel picks this up automatically on deploy — but the sweep authenticates eve vercel env add CRON_SECRET # any long random string, e.g. `openssl rand -hex 32` ``` -Vercel sends `Authorization: Bearer $CRON_SECRET` with each cron invocation; the sweep **denies all requests** (401) when the variable is unset — a missing secret disables recovery rather than exposing the endpoint. +Vercel sends `Authorization: Bearer $CRON_SECRET` with each cron invocation; **both cron routes** (`/api/cron/sweep` and `/api/cron/code-index`) **deny all requests** (401) when the variable is unset — a missing secret disables recovery and code indexing rather than exposing the endpoints. > **Hobby plan note**: Hobby allows at most one cron invocation per day, so the `*/5` schedule degrades to roughly daily. Recovery stays **correct** on any cadence — the sweep's decisions depend only on marker age, never on how often it runs — you just wait longer for a stuck question to be retried. On Pro the 5-minute cadence applies as written. @@ -268,7 +269,7 @@ If the bot does not respond, check the [Troubleshooting Guide](./troubleshooting | `UPSTASH_VECTOR_REST_TOKEN` | Optional | `ABcD3...` | Token for the Vector index -- both must be set or neither | | `KV_REST_API_URL` | Legacy | `https://...upstash.io` | Read as a fallback by `@upstash/redis` for projects that still provision "Vercel KV" | | `KV_REST_API_TOKEN` | Legacy | `AaB1Cc2...` | Read as a fallback — either pair works | -| `CRON_SECRET` | Yes (for recovery) | `f3a9...64 hex chars` | Auth for `/api/cron/sweep` (Vercel Cron sends it as a Bearer token). Unset = sweep denies all requests, recovery disabled | +| `CRON_SECRET` | Yes (for recovery) | `f3a9...64 hex chars` | Auth for both `/api/cron/*` routes — sweep and code-index (Vercel Cron sends it as a Bearer token). Unset = both deny all requests: recovery and code indexing disabled | ## Security Notes From 31bbf123aac25f641a326157e35b82efbe6bece2 Mon Sep 17 00:00:00 2001 From: vlad-ko Date: Thu, 9 Jul 2026 11:30:23 -0400 Subject: [PATCH 2/2] docs: CRON_SECRET required-column label covers both cron consumers Co-Authored-By: Claude Fable 5 --- docs/setup.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/setup.md b/docs/setup.md index d785829..397544b 100644 --- a/docs/setup.md +++ b/docs/setup.md @@ -269,7 +269,7 @@ If the bot does not respond, check the [Troubleshooting Guide](./troubleshooting | `UPSTASH_VECTOR_REST_TOKEN` | Optional | `ABcD3...` | Token for the Vector index -- both must be set or neither | | `KV_REST_API_URL` | Legacy | `https://...upstash.io` | Read as a fallback by `@upstash/redis` for projects that still provision "Vercel KV" | | `KV_REST_API_TOKEN` | Legacy | `AaB1Cc2...` | Read as a fallback — either pair works | -| `CRON_SECRET` | Yes (for recovery) | `f3a9...64 hex chars` | Auth for both `/api/cron/*` routes — sweep and code-index (Vercel Cron sends it as a Bearer token). Unset = both deny all requests: recovery and code indexing disabled | +| `CRON_SECRET` | Yes (for recovery + code index) | `f3a9...64 hex chars` | Auth for both `/api/cron/*` routes — sweep and code-index (Vercel Cron sends it as a Bearer token). Unset = both deny all requests: recovery and code indexing disabled | ## Security Notes