fix: task board live updates, auth headers, security hardening, and cleanup

[ChitkulLakshya]

Summary

This PR fixes the task board live-update mechanism, adds missing authentication headers, hardens security, fixes pre-existing bugs, and cleans up duplicate files.

Task board live updates (no refresh needed)

• Forward getTaskIO through webhook queue so GitHub push/PR transitions emit task-updated socket events to connected clients
• Add task-created + task-assigned socket emissions to both Kanban task creation routes (POST /steps/:stepId/tasks and POST /quick-task)
• Previously only task update/delete and the separate /api/tasks/assign route emitted socket events; task creation required a manual refresh

Auth and response handling

• Add missing Authorization: Bearer header to task create/update in ProjectDetails.tsx and task create in MobileProjectDetails.tsx
• Add response.ok check to task update handler with refetch + error toast on failure

Security hardening

• Protect /api/internal-metrics/metrics with authMiddleware (was publicly accessible)
• Update puppeteer 24.x → 25.6.0 to fix high-severity extract-zip symlink path traversal vulnerability

Bug fixes

• Fix ProjectTask sparse unique index collision: remove default: null from displayId and commitCode so sparse indexes skip unset fields instead of colliding on null
• Remove redundant schema.index() calls in User.js and Team.js that caused duplicate index warnings
• Fix missing API_BASE_URL import in ArchitectureView.tsx (typecheck error)
• Add missing braces after if statements in DesktopView.tsx and MobileView.tsx (lint errors)
• Fix flaky auth E2E test
• Set Jest maxWorkers: 1 to avoid jose ESM race condition under parallel workers

Cleanup

• Delete 18 duplicate " 2" files that were tracked in git (source code, docs, temp files)

Files changed

• backend/services/webhookQueue.js — forward getTaskIO to worker
• backend/services/githubWebhookWorker.js — emit task-updated on push/PR transitions
• backend/routes/githubAppWebhook.js — supply getTaskIO getter
• backend/routes/projectRoutes.js — emit task-created/task-assigned on task creation
• backend/routes/internalMetrics.js — add authMiddleware
• backend/models/ProjectTask.js — fix sparse index
• backend/models/User.js, backend/models/Team.js — remove duplicate indexes
• backend/jest.config.js — maxWorkers: 1
• backend/package.json — puppeteer 25.6.0
• src/pages/ProjectDetails.tsx — auth headers + response.ok
• src/components/views/mobile/MobileProjectDetails.tsx — auth header
• src/components/zlam/ArchitectureView.tsx — API_BASE_URL import
• src/components/views/DesktopView.tsx, MobileView.tsx — lint fixes
• tests/auth.spec.ts — flaky test fix
• backend/tests/projectRoutesTasks.test.js — 4 new regression tests (B25-B28)
• backend/tests/githubWebhookWorker.test.js — 2 new regression tests (W8-W9)
• Various test files — authMiddleware mocks
• 18 duplicate " 2" files deleted

Test plan

• Backend Jest: 17 suites, 85 tests pass
• Frontend Vitest: 2 suites, 26 tests pass
• Playwright E2E: 11 tests pass
• TypeScript typecheck: clean (exit 0)
• ESLint: 0 errors (876 pre-existing warnings)
• npm audit: 0 vulnerabilities (root + backend)
• Vite build: succeeds (5595 modules)

Generated with Devin

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
zync	Ready	Preview	Aug 13, 2026 9:05am

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.